August 2010 - Freeradius-Users - lists.freeradius.org

FreeRadius2 + OpenLDAP for Wifi Authentication
by rrperez＠apc.edu.ph 05 Aug '10

05 Aug '10

I configured a freeradius2 server and an openldap server on the same machine, actually a virtual machine. I would like to ask why does it only works locally? If I try to connect to the wireless network, it gives me a "No Authentication Method Found" in the debug mode. I really need help for this matter.

2 1

Re: Fwd: FreeRadius2&MySQL
by shark_l 05 Aug '10

05 Aug '10

//I am planing to migrate from Aradial to FreeRadius2 //and i currently have 10000 subscribers A piece of advice: DO NOT deploy Freeradius2 now! I am using FreeRadius 2.1.9 + Mysql 5.3 on FreeBSD 8.1, and the radiusd exits abnormally (although it says "info: exiting normally" by itself ) many times a day! I have been driven mad! and I decide to revert to freeradius 1.1.8. Believe me, or you can search "exit normally but unexpectedly" in maillist archive yourself. PS: deployment of freeradius is rather easy. Read its sample configuration files, and you will find them easy to understand.

3 5

Freeradius 2.1.9 stop working
by BELLIERE Eric 05 Aug '10

05 Aug '10

Thanks. I saw on http://koji.fedoraproject.org/koji/buildinfo?buildID=187278 that there is a new RPM freeradius-2.1.9-3.fc15.src.rpm and in the changelog I can see " Work-around for bug #35 " So I will upgrade with this RPM. Maybe someone can confirm that the problem is well corrected with this RPM? Thanks Eric Bellière -----Original Message----- From: freeradius-users-bounces+eric.belliere=mail.mobistar.be(a)lists.freeradius.org [mailto:freeradius-users-bounces+eric.belliere=mail.mobistar.be@lists.freera dius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Thursday 5 August 2010 12:00 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 64, Issue 18 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Fwd: FreeRadius2&MySQL (Alan Buxey) 2. Re: Freeradius 2.1.9 stop working (Alan Buxey) 3. Re: Freeradius 2.1.9 stop working (Johan Meiring) ---------------------------------------------------------------------- Message: 1 Date: Thu, 5 Aug 2010 10:02:53 +0100 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Subject: Re: Fwd: FreeRadius2&MySQL To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20100805090253.GA20214(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > Can you please provide me with the link of document you talk about , http://wiki.freeradius.org/SQL_HOWTO alan ------------------------------ Message: 2 Date: Thu, 5 Aug 2010 10:04:38 +0100 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Subject: Re: Freeradius 2.1.9 stop working To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Cc: ROUSSEAU David <David.ROUSSEAU(a)mail.mobistar.be> Message-ID: <20100805090438.GB20214(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > Thanks Alan. But maybe you can update me with the out date of the RPM in > 2.1.10? 2.1.10 isnt out yet. but when it is, then your package maintainers should ensure a new RPM is available. alan ------------------------------ Message: 3 Date: Thu, 05 Aug 2010 11:19:48 +0200 From: Johan Meiring <jmeiring(a)pcservices.co.za> Subject: Re: Freeradius 2.1.9 stop working To: freeradius-users(a)lists.freeradius.org Message-ID: <4C5A8234.1040209(a)pcservices.co.za> Content-Type: text/plain; charset=ISO-8859-1; format=flowed On 2010/08/05 11:04 AM, Alan Buxey wrote: > > 2.1.10 isnt out yet. but when it is, then your package maintainers should > ensure a new RPM is available. > This page might tell you how to build an RPM from source. http://wiki.freeradius.org/Red_Hat_FAQ Use git as the "source". -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782 ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 64, Issue 18 ************************************************

2 1

Freeradius 2.1.9 stop working
by BELLIERE Eric 05 Aug '10

05 Aug '10

Thanks Alan. But maybe you can update me with the out date of the RPM in 2.1.10? I would like to upgrade from the RPM. I don't want to make a ./configure to install the FreeRadius. Thanks Eric B. -----Original Message----- From: freeradius-users-bounces+eric.belliere=mail.mobistar.be(a)lists.freeradius.org [mailto:freeradius-users-bounces+eric.belliere=mail.mobistar.be@lists.freera dius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Tuesday 3 August 2010 16:53 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 64, Issue 10 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Freeradius 2.1.9 digest authentication problem (Alan Buxey) 2. Re: Tag and Untag a port in several VLAN (fcombernous(a)kezia.com) 3. Re: Freeradius 2.1.9 stop working (Alan DeKok) 4. Re: Freeradius 2.1.9 digest authentication problem (Nicolas Goutte) 5. Re: Freeradius 2.1.9 digest authentication problem (Alan Buxey) 6. Re: Freeradius 2.1.9 digest authentication problem (alexb(a)arctel.ru) 7. Re: Freeradius 2.1.9 digest authentication problem (Alan DeKok) 8. Re: Tag and Untag a port in several VLAN (Fabien COMBERNOUS) 9. Re: Freeradius 2.1.9 digest authentication problem (Nicolas Goutte) ---------------------------------------------------------------------- Message: 1 Date: Tue, 3 Aug 2010 13:26:27 +0100 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Subject: Re: Freeradius 2.1.9 digest authentication problem To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20100803122627.GD16747(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > Tried Cleartext-Password := "test", Cleartext-Password == "test", > Cleartext-Password = "test", result is the same. and remember - if you are changing the users file and not doing anything funky, you will have to restart the server! alan ------------------------------ Message: 2 Date: Tue, 3 Aug 2010 14:34:47 +0200 (CEST) From: fcombernous(a)kezia.com Subject: Re: Tag and Untag a port in several VLAN To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <e90578a477a443c9f260c2f6b6fc8b28.squirrel(a)kezia.com> Content-Type: text/plain;charset=iso-8859-1 > On 2010/08/03 01:51 PM, Fabien COMBERNOUS wrote: >> Thank you for your answer. >> I can't change FreeRadius version. So i need to use decimal number. >> Can you give me an exemple about to untag a port in vlan 7 ? >> > > > Just convert 0x320007 to decimal?? No. Just a correct example in hexa to untag in vlan 7. I'll translate in decimal. Thank you for your help. ------------------------------ Message: 3 Date: Tue, 03 Aug 2010 14:35:34 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Freeradius 2.1.9 stop working To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4C580D16.6000006(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 BELLIERE Eric wrote: > Then if it is a bug I will have to upgrade? or do you have a patch? > you send me the link for GIT.freeradius.org but what must I do to correct > this problem? Try using the v2.1.x branch from http://git.freeradius.org. i.e. download it and install it. The instructions are on that web page. Go read them. > For the log rotate I will add kill -HUP `cat /var/run/radiusd/radiusd.pid` > in postrotate. > Like this : > /var/log/radius/radius.log { > daily > rotate 4 > create > missingok > postrotate > kill -HUP `cat /var/run/radiusd/radiusd.pid` > compress > } > > Must I put this KILL -HUP for each log to rotate? > (/var/log/radius/radacct/*/detail, /var/log/radius/checkrad.log, ...) or > only for radius.log ? Only for radius.log. Alan DeKok. ------------------------------ Message: 4 Date: Tue, 3 Aug 2010 14:42:44 +0200 From: Nicolas Goutte <nicolas.goutte(a)extragroup.de> Subject: Re: Freeradius 2.1.9 digest authentication problem To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <B32493C2-246D-4FED-B43E-C163AF85802C(a)extragroup.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed; delsp=yes Am 03.08.2010 um 14:25 schrieb Alan Buxey: > Hi, > >> Tried Cleartext-Password := "test", Cleartext-Password == "test", >> Cleartext-Password = "test", result is the same. > > why? why did you do that? > > Cleartext-Password := "test" > > is the only correct way. you just compl;eted ignored the information/ > help given by the actual > author of FreeRADIUS. you dont trust him to know how the code works?? > Alan Cox's email was sent only minutes later. > alan > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Have a nice day. Nicolas Goutte extragroup GmbH - Karlsruhe Waldstr. 49 76133 Karlsruhe Germany Gesch?ftsf?hrer: Lars Busch Registergericht: Amtsgericht M?nster / HRB: 5624 Steuer Nr.: 337/5903/0421 / UstID: DE 204607841 ------------------------------ Message: 5 Date: Tue, 3 Aug 2010 14:24:44 +0100 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Subject: Re: Freeradius 2.1.9 digest authentication problem To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20100803132444.GC16890(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > Alan Cox's email was sent only minutes later. Alan Cox? wow. RedHat finally taking development to new levels...... you meant Alan DeKok I assume? Too many Alan's for you? ;-) alan ------------------------------ Message: 6 Date: Tue, 3 Aug 2010 17:36:46 +0400 From: alexb(a)arctel.ru Subject: Re: Freeradius 2.1.9 digest authentication problem To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20100803133646.GB4282(a)arctel.ru> Content-Type: text/plain; charset=us-ascii On Tue, Aug 03, 2010 at 01:56:48PM +0200, Alan DeKok wrote: > alexb(a)arctel.ru wrote: > > trying to test digest authentication (freeradius 2.1.9). After > > uncommenting 'digest' in sites-available/default 'radiusd -X' > > starts fine. but after I added (according to 'man rlm_digest') > > to users file: > > > > test Auth-Type := Digest, User-Password = "test" > > Reply-Message = "Hello, test with digest" > > (1) Don't force Auth-Type > (2) Use: Cleartext-Password := 'test" > Not: User-Password = "test" Ok, it works as expected (according test procedure in 'man rlm_digest') with this config: test Cleartext-Password := "test" Reply-Message = "Hello, test with digest" i.e. without Auth-Type attrubute. I MUST NOT use Auth-Type? > (3) search for "digest" in raddb/sites-available/default found and uncommented "digest" in "authorize" and "authenticate" sections already (before posting here). > (4) READ the comments > (5) enable digest as instructed Thank You -- Alexander Belov ------------------------------ Message: 7 Date: Tue, 03 Aug 2010 15:58:17 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Freeradius 2.1.9 digest authentication problem To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4C582079.9010506(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 alexb(a)arctel.ru wrote: > i.e. without Auth-Type attrubute. I MUST NOT use Auth-Type? No. It has VERY limited uses. Nearly everyone who tries to use it gets it wrong. Ignore all of the third-party web sites that say to set Auth-Type. They're wrong, and they've been wrong for about 5 years. Alan DeKok. ------------------------------ Message: 8 Date: Tue, 03 Aug 2010 16:01:46 +0200 From: Fabien COMBERNOUS <fcombernous(a)kezia.com> Subject: Re: Tag and Untag a port in several VLAN To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4C58214A.2090206(a)kezia.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Alan DeKok wrote: > Fabien COMBERNOUS wrote: > >> I'm using FreeRadius 2.1.3. I'm doing a mac based port assignment with >> sql backend. >> > ... > >> But when i plug the equipment radius give this debug : >> [sql1] expand: SELECT id, groupname, attribute, value, >> op FROM radgroupreply WHERE groupname = >> '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, >> attribute, value, op FROM radgroupreply >> WHERE groupname = 'test' ORDER BY id >> rlm_sql: Failed to create the pair: Unknown value 0x320007 for attribute >> Egress-VLANID >> >> What am i missing or misunderstanding ? >> > > The hex value isn't accepted in 2.1.3. You'll need to run 2.1.6 or later. > > Or, change the hex number to a decimal number. > So i used the other possibility with Egress-VLAN-Name instead of Egress-VLANID. It is easier to understand the meaning of the value and it works with my version of FreeRadius. Thank you for your help. -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group ------------------------------ Message: 9 Date: Tue, 3 Aug 2010 16:53:01 +0200 From: Nicolas Goutte <nicolas.goutte(a)extragroup.de> Subject: Re: Freeradius 2.1.9 digest authentication problem To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <885F2DEE-D290-4F30-A78F-96EBFA2075FE(a)extragroup.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Am 03.08.2010 um 15:24 schrieb Alan Buxey: > Hi, > >> Alan Cox's email was sent only minutes later. > > Alan Cox? wow. RedHat finally taking development to new levels...... > > you meant Alan DeKok I assume? Too many Alan's for you? ;-) Sorry for the mistyping. > > alan > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Nicolas Goutte extragroup GmbH - Karlsruhe Waldstr. 49 76133 Karlsruhe Germany Gesch?ftsf?hrer: Lars Busch Registergericht: Amtsgericht M?nster / HRB: 5624 Steuer Nr.: 337/5903/0421 / UstID: DE 204607841 ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 64, Issue 10 ************************************************

3 2

Multiple LDAP search
by Wayne Van der Merwe 04 Aug '10

04 Aug '10

Hi all I got LDAP working on FreeRADIUS Version 2.1.8, with SUSE 10.1 Now i need to do the following if the user is not found in the 1st LDAP search, that searches in o=EC, then it must search again in o=HLT. I would like to know where to create these files. Thank you Wayne van der Merwe

3 2

freeradius, rlm_sql and tagged attributes
by Evgeniy Kozhuhovskiy 04 Aug '10

04 Aug '10

I need to reply to NAS with same attributes with different tags. All works ok when i'm using users file. But when i'm migrating to rlm_sql, only first instance of attribute goes in reply: mysql> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'test' ORDER BY id; +----+-----------+-----------------------+-----------------+----+ | id | groupname | attribute | value | op | +----+-----------+-----------------------+-----------------+----+ | 6 | test | Framed-IP-Address | 255.255.255.254 | = | | 7 | test | Service-Type | Framed-User | = | | 8 | test | Acct-Interim-Interval | 1800 | = | | 9 | test | PPPD-Pool-Number | ippool | = | | 16 | test | Ip-Address-Pool-Name | ippool | = | | 19 | test | Service-Name:1 | GUEST | = | | 20 | test | Service-Name:2 | INET | = | | 21 | test | Service-Options:1 | 0 | = | | 22 | test | Service-Options:2 | 1 | = | | 28 | test | Context-Name | Internet | = | +----+-----------+-----------------------+-----------------+----+ 10 rows in set (0.01 sec) rad_recv: Access-Request packet from host 127.0.0.1 port 11113, id=248, length=252 User-Name = "test@test" CHAP-Password = 0x01f304695c088000b6a248776d9ec67084 CHAP-Challenge = 0xc581f30d3a2736d1a039596397c627fd Service-Type = Framed-User Framed-Protocol = PPP NAS-Identifier = "Redback" NAS-Port = 33619968 NAS-Real-Port = 553652128 NAS-Port-Type = Virtual NAS-Port-Id = "2/1 vlan-id 4000 pppoe 6" Medium-Type = 11 Mac-Address = "00-0c-29-bd-8b-a1" Platform-Type = 3 OS-Version = "6.2.1.2" Acct-Session-Id = "0100FFFF680000BE-4C596DEB" NAS-IP-Address = 172.26.201.21 Proxy-State = 0x3632 server guest { +- entering group authorize ++[preprocess] returns ok rlm_chap: Setting 'Auth-Type := CHAP' ++[chap] returns ok users: Matched entry DEFAULT at line 163 ++[files] returns ok expand: %{User-Name} -> test@test rlm_sql (sql): sql_set_user escaped user --> 'test@test' rlm_sql (sql): Reserving sql socket id: 65 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test@test' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test@test' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test@test' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'test' ORDER BY id rlm_sql (sql): User found in group test expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'test' ORDER BY id rlm_sql (sql): Released sql socket id: 65 ++[sql] returns ok rad_check_password: Found Auth-Type CHAP auth: type "CHAP" +- entering group CHAP rlm_chap: login attempt by "test@test" with CHAP password rlm_chap: Using clear text password "ilser56" for user test@test authentication. rlm_chap: chap user test@test authenticated succesfully ++[chap] returns ok Login OK: [test@test/<CHAP-Password>] (from client localhost port 33619968) } # server guest Sending Access-Accept of id 248 to 127.0.0.1 port 11113 Framed-Protocol = PPP Session-Timeout = 172800 Framed-IP-Address = 255.255.255.254 Framed-Compression = Van-Jacobson-TCP-IP Service-Type = Framed-User Acct-Interim-Interval = 1800 PPPD-Pool-Number = "ippool" Ip-Address-Pool-Name = "ippool" Service-Name:1 = "GUEST" Service-Options:1 = 0 Context-Name = "Internet" Proxy-State = 0x3632 Finished request 374. -- С уважением, Евгений Кожуховский Руководитель группы сервисных платформ УИТ ЦИТС МГТС РУП Белтелеком +375-29-3998175 +375-29-7561625 +375-17-3060026

2 2

Prevent logging of testusers?
by Jens Weibler 04 Aug '10

04 Aug '10

Hi, I'm searching for a way to prevent testlogins getting logged. Is this possible? How? ;) -- Jens Weibler IT Services Hochschule Darmstadt www.h-da.de University of Applied Sciences Fachbereich Informatik www.fbi.h-da.de Schöfferstr. 8b D-64295 Darmstadt Tel +49 6151 16-8425 Fax +49 6151 16-8935 jens.weibler(a)h-da.de

1 0

Remove Domain from User-Name
by benoit.bianchi＠enel.com 04 Aug '10

04 Aug '10

Hi, I've successfully set up freeradius for EAP-PEAP Authentication with MSCHAP on my AD Domain, but I'm facing a problem on accounting: I'm using SQL accounting and can't get rid of the "DOMAIN\" part for the sql_user_name, I've tried using the Stripped-User-Name variable but it remains empty. I've also tried using hints file to define a proper Stripped-User-Name, with the following: DEFAULT User-Name =~ "DOMAIN\\(.*)" Stripped-User-Name := "%{1}" Still without any success, so I investigate on the realm module who do recognize the DOMAIN\ part of User-Name but then it look for proxying (which I don't have) and don't give me a Stripped-User-Name anyway ... I'm stucked, is there anyone here who can give me a hand on this? Thanks in advance

1 1

Tag and Untag a port in several VLAN
by Fabien COMBERNOUS 04 Aug '10

04 Aug '10

Hi there, I'm using FreeRadius 2.1.3. I'm doing a mac based port assignment with sql backend. To untag a port of the switch in a VLAN works well. But in some case i need to tag a port in several VLAN. In the wiki [1] it looks possible. By following indicated in the wiki i inserted the followind data in my sql backend : insert into radgroupreply(groupname,attribute,op,value) values ('AP_test','Egress-VLANID',':=','0x320007'); insert into radgroupreply(groupname,attribute,op,value) values ('AP_test','Egress-VLANID',':=','0x32000102'); But when i plug the equipment radius give this debug : [sql1] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'test' ORDER BY id rlm_sql: Failed to create the pair: Unknown value 0x320007 for attribute Egress-VLANID What am i missing or misunderstanding ? Help is welcome. Best regards, [1] http://wiki.freeradius.org/HP -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group

5 8

Authenticating again LDAP, specific group
by Cory Johnson 03 Aug '10

03 Aug '10

Greetings, I am running FreeRADIUS 2.1.8 on Ubuntu 8.04, attempting to use the ldap module. I only want to authenticate users in a certain group. These groups exist in LDAP as a "posixGroup" with a "memberUID" list. As I have it configured currently, I get an "Access-Accept" for any user in the directory. The ldap module is configured as such: ldap { server = "192.168.1.99" identity = "cn=admin,dc=corp,dc=example,dc=com" password = s3cret basedn = "dc=corp,dc=example,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_attribute = NOC groupmembership_filter = (&(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{User-Name}})) } I've also seen recomendations to add something like this to the users file: DEFAULT LDAP-Group == NOC Service-Type = Administrative-User Now I can see the service-type displayed when I do a radtest using the username/password of users in the "NOC" group, but I still see an "Access-Accept" for users who are not in the group. How can I make the server reject users that aren't in the NOC group? Any hints would be fantastic.

2 1