August 2010 - Freeradius-Users - lists.freeradius.org

Is Mikrotik-Rate-Limit used to limit users speed
by Spacelee 12 Aug '10

12 Aug '10

PPTP+PPP+FreeRadius+MySQL It seems it doesn't work. -- Spacelee

2 1

ldap fallback to local password
by Aqdas Muneer 12 Aug '10

12 Aug '10

hi, i would like to configure freeradius so that it can failover to a local password when the ldap server cannot be contacted. i was able to create a admin account in the users file with cleartext password, but when i enable it, it becomes accessible even when ldap is up and running. we are running version 2.1.7 of freeradius. thanks Aqdas

2 2

LDAP Check Item Issue
by Asin Silva 12 Aug '10

12 Aug '10

Hi All, I use freeradius version 2.1.3 and LDAP to authenticate ADSL users. I have a requirement to compare the NAS-Port-Id in the user request to the one in the LDAP. But when I test it, radius debug output says "Pairs do not match. Rejecting user.". But the values in the request and LDAP are same. I have attached the debug output. Asin

2 2

Last call for 2.1.0
by Alan DeKok 12 Aug '10

12 Aug '10

Version 2.1.10 should be released soon. If there are any pressing issues people would like to get addressed, now is the time to speak up. The proposed change log is available online at: http://github.com/alandekok/freeradius-server/blob/v2.1.x/doc/ChangeLog There are a number of feature improvements in what's supposed to be a "stable" release. These improvements are limited to documentation updates, and changes to the client programs to make them easier to use. The main benefit most people should see is that radclient and radtest now make it easier to send MS-CHAP requests. The server now also listens on 127.0.0.1:18120 for the "inner-tunnel" virtual server. These two changes mean that the "inner-tunnel" portion of PEAP can be tested using nothing more than radtest && a default server installation. This should help people debug PEAP issues. i.e. They can avoid the issue of "but it works with radtest", when their passwords aren't compatible with MS-CHAP. There only major thing missing now is a DHCP pool allocation strategy. There's been more interest recently in using FreeRADIUS as a DHCP server, so patches to help would be most welcome. Alan DeKok.

4 9

Freeradius Authentication
by rrperez 12 Aug '10

12 Aug '10

I have configured a Freeradius2.1.7 with an openLDAP backend and I'm planning to established a different type of authentication. The plan was to create one password for all the users. And the users are checked by the Freeradius in the openLDAP directory. Is it possible? If so, can anyone help me configure my freeradius server. Thanks in advance. -- View this message in context: http://old.nabble.com/Freeradius-Authentication-tp29415473p29415473.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Why the"authhost"or"accthost"item's value in "real NULL" can't be a home_server_pool in proxy.conf ?
by freddychu 12 Aug '10

12 Aug '10

Hi, I want to proxy requests which's User-Name hasn't realm domain to a home server pool, so I configure the realm NULL, but the radius server would proxy the request to a nonexistent IP address. Why the "authhost" or "accthost" item's value in "real NULL" can't be a home_server_pool in proxy.conf ? How to configure it? Any body can help me? #realm NULL { # authhost = radius.company.com:1600 # accthost = radius.company.com:1601 # secret = testing123 #} Freddy Chu

1 0

Issues with NTLM_AUTH and Windows
by Alan DeKok 11 Aug '10

11 Aug '10

A number of people have reported failed authentications with ntlm_auth when using Samba and Active Directory. This issue appears to have been tracked down, and a patch posted: https://bugzilla.samba.org/show_bug.cgi?id=6563 A few people have reported that the patch works, but the Samba team is looking for more widespread testing. We're asking that anyone who has the problem try the patch, and post a response on the above bug report reporting success / failure. Thanks to everyone for the reports, and the patience while this was tracked down. Alan DeKok.

1 0

Cisco WLC4402 - 802.1X - Android - Tunnel-Priv-Group-ID Failure
by Thomas Donnelly 11 Aug '10

11 Aug '10

Hello All, There are quite a few components coming into play here so I'm not exactly sure whats breaking where. Let me start with explaining our setup: We use cisco 1142 agn lightweight access points connected to a 4402 Wireless Lan Controller This controller is doing radius authentication off of Freeradius 1.1.8 (with FreeBSD as the Host OS) on our primary ssid. When people authenticate it replies with Tunnel-Private-Group-ID based on their username/group. This puts them in the correct vlan for their department. This works perfectly fine with our Apple Laptops, iPhones, and iPads. However when I join with my Android phone or my n900 (maemo), I get put in the default vlan for the SSID. After some digging I found the following: When joining from the Apple devices, the User-Name comes accross as Tue Aug 10 17:13:03 2010 User-Name = "someone(a)somehwere.net" When Joining from my Android, it comes accross as: Tue Aug 10 11:26:53 2010 User-Name = "1fT6ESzC4Dbj9oIpiJjjfg==" (A few chars changed to prevent the username from being figured out) This somehow is authenticating correctly because I get an IP address (in the incorrect vlan) and can surf the net, and if I mistype the password I get an authentication failure. However when it tries to do a match for the username to determine their group/vlan it fails because we don't have any users with that user name. Has anyone seen this before or have any leads I should follow? Thanks! -=Tom Donnelly

6 8

radius cant contact ldap server
by Aqdas Muneer 11 Aug '10

11 Aug '10

hello everyone, I have asked this question before but didn't get any suggestions, so please try to help me if you can. We recently had a event during which our radius server lost connectivity to our Active Directory server. all the network gear could contact radius so none fell back to the backup authentication method (local), but because AD was down we couldn't get into our devices. is there a way to use some locally stored password in free radius if the ldap server cant be reached? below is my user file config. i have an admin account that i would like to use if ldap is down, but don't want users to be able to use it when ldap is accessible. i'm running FreeRadius version 2.1.7. admin Huntgroup-Name == "network-admin", Cleartext-Password := "xxxxxxxxx" Service-Type := NAS-Prompt-User, cisco-avpair := "shell:priv-lvl=15" DEFAULT Huntgroup-Name == "network-admin", Ldap-Group == "networkadmins" Service-Type := NAS-Prompt-User, cisco-avpair := "shell:priv-lvl=15", Auth-Type := LDAP

1 0

Can't Contact LDAP Server
by rrperez 11 Aug '10

11 Aug '10

I have configured Freeradius2 server on a virtual machine and LDAP server on another virtual machine. I got all the configuration needed for the radius and ldap server to map at each other. Here is the debug when performing radiusd -X: FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "10.96.100.206" port = 389 password = "secret" identity = "cn=Admin,dc=testldap1,dc=test,dc=corpoff" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=testldap1,dc=test,dc=corpoff" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8aafa78 Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. Nothing seems wrong and the radius and ldap successfully map at each other. But attempting the radtest, the radius server can't contact the ldap server. Here is the debug for the radtest: rad_recv: Access-Request packet from host 127.0.0.1 port 56655, id=48, length=61 User-Name = "test-user" User-Password = "testpass" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test-user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry test-user at line 93 ++[files] returns ok [ldap] performing user authorization for test-user [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> test-user [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=test-user) [ldap] expand: dc=testldap1,dc=test,dc=corpoff -> dc=testldap1,dc=test,dc=corpoff rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.96.100.206:389, authentication 0 rlm_ldap: bind as cn=Admin,dc=testldap1,dc=test,dc=corpoff/secret to 10.96.100.206:389 rlm_ldap: cn=Admin,dc=testldap1,dc=test,dc=corpoff bind to 10.96.100.206:389 failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test-user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 48 to 127.0.0.1 port 56655 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 48 with timestamp +2 Ready to process requests. Can anyone help with this problem? Thanks... -- View this message in context: http://old.nabble.com/Can%27t-Contact-LDAP-Server-tp29406114p29406114.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1