September 2010 - Freeradius-Users - lists.freeradius.org

New Install Problems
by Scott Miller 28 Sep '10

28 Sep '10

Been using FreeRadius for years now, no problems at all. Currently running 1.1 for over 5 years, upgrading the server and freeradius andam using Fedora 13. Downloaded the newest version, unzipped, went throughconfig and ran into problems. ./configure - seemed to go OK make - produced the following errors:(did not attempt make install yet) /usr/bin/ld: .libs/radeapclient.o: undefined reference tosymbol 'fr_perror'/usr/bin/ld: note: 'fr_perror' is defined in DSO/usr/local/lib/libfreeradius-radius-2.1.10.so so try adding it to the linkercommand line/usr/local/lib/libfreeradius-radius-2.1.10.so: could notread symbols: Invalid operationcollect2: ld returned 1 exit statusgmake[6]: *** [radeapclient] Error 1gmake[6]: Leaving directory `/home/scott/freeradius-server-2.1.10/src/modules/rlm_eap'gmake[5]: *** [rlm_eap] Error 2gmake[5]: Leaving directory`/home/scott/freeradius-server-2.1.10/src/modules'gmake[4]: *** [all] Error 2gmake[4]: Leaving directory`/home/scott/freeradius-server-2.1.10/src/modules'gmake[3]: *** [modules] Error 2gmake[3]: Leaving directory`/home/scott/freeradius-server-2.1.10/src'gmake[2]: *** [all] Error 2gmake[2]: Leaving directory`/home/scott/freeradius-server-2.1.10/src'gmake[1]: *** [src] Error 2gmake[1]: Leaving directory`/home/scott/freeradius-server-2.1.10'make: *** [all] Error 2[root@radius1 freeradius-server-2.1.10]# This is a fresh install of Fedora 13. I don't rememberrunning into any problems with FreeRadius 1.1, even imported my ICRadiusdatabase with no problems at that time. Anyone have any idea of what I'm missing? Thanks,Scott

2 1

Version 2.1.10 has been released
by Alan DeKok 28 Sep '10

28 Sep '10

Thanks to everyone for being patient. Version 2.1.10 has just been released. http://freeradius.org/ The changelog is quite large for a "stable" release. We've fixed a number of minor bugs. We've also added features which have been requested for a long time. Most notably: * Print out large WARNING message if we send an Access-Challenge for EAP, and receive no follow-up messages from the client. This means that when EAP has been misconfigured or not deployed correctly, the server will print a message in debug mode saying "go read a specific page on the Wiki". That page contains detailed instructions for how to solve the problem. * Added support for TLS-Cert-* attributes. For details, see raddb/sites-available/default, "post-auth" section. This means that much more complex certificate checking can be done. * Updated more documentation to use "Restructured Text" format. Thanks to James Lockie. This makes the documentation simpler and easier to read. There are a number of other minor features which "round out" the server functionality. This makes it the best release for stability, documentation, and ease of use. Alan DeKok.

4 7

FreeRadius and LDAP from Nortel Switch
by BELLIERE Eric 28 Sep '10

28 Sep '10

Phil, Fine It is working better. What a stupid error :-) Now I have to troubleshoot because the Freeradius send a Accept but the Switch is saying Invalid Password FR 2.1.9 Sending Access-Accept of id 169 to 192.168.250.64 port 4481 Switch Login: ebellier Password: ******** Invalid Password. Many Thanks. Eric B. ****

1 0

FreeRadius and LDAP from Nortel Switch
by BELLIERE Eric 28 Sep '10

28 Sep '10

Dears, I would like to make a radius authentication while access to a Network Elements (Nortel ERS 8600). This authentication will be done via LDAP. Everything seems to be ok except that when the request is sent from the Network elements the password is not in clear text and then FreeRadius says that password didn't matches. When I try from RadPing (from my laptop) then my LDAP authentication is OK Can you please help me? >From RadPing rad_recv: Access-Request packet from host 172.18.113.82 port 3340, id=1, length=48 User-Name = "ebellier" User-Password = "xxxxxxxxxx" Tue Sep 28 14:25:30 2010 : Info: +- entering group authorize {...} Tue Sep 28 14:25:30 2010 : Info: ++[preprocess] returns ok Tue Sep 28 14:25:30 2010 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.18.113.82/auth-detail-20100928 Tue Sep 28 14:25:30 2010 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.18.113.82/auth-detail-20100928 Tue Sep 28 14:25:30 2010 : Info: [auth_log] expand: %t -> Tue Sep 28 14:25:30 2010 Tue Sep 28 14:25:30 2010 : Info: ++[auth_log] returns ok Tue Sep 28 14:25:30 2010 : Info: ++[chap] returns noop Tue Sep 28 14:25:30 2010 : Info: ++[mschap] returns noop Tue Sep 28 14:25:30 2010 : Info: [suffix] No '@' in User-Name = "ebellier", looking up realm NULL Tue Sep 28 14:25:30 2010 : Info: [suffix] Found realm "DEFAULT" Tue Sep 28 14:25:30 2010 : Info: [suffix] Adding Stripped-User-Name = "ebellier" Tue Sep 28 14:25:30 2010 : Info: [suffix] Adding Realm = "DEFAULT" Tue Sep 28 14:25:30 2010 : Info: [suffix] Authentication realm is LOCAL. Tue Sep 28 14:25:30 2010 : Info: ++[suffix] returns ok Tue Sep 28 14:25:30 2010 : Info: [eap] No EAP-Message, not doing EAP Tue Sep 28 14:25:30 2010 : Info: ++[eap] returns noop Tue Sep 28 14:25:30 2010 : Info: ++[unix] returns updated Tue Sep 28 14:25:30 2010 : Debug: [ldap] Entering ldap_groupcmp() Tue Sep 28 14:25:30 2010 : Info: [files] expand: ou=Staff,o=mobistar.be -> ou=Staff,o=mobistar.be Tue Sep 28 14:25:30 2010 : Info: [files] expand: %{Stripped-User-Name} -> ebellier Tue Sep 28 14:25:30 2010 : Info: [files] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ebellier) Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (uid=ebellier) request done: ld 0x1fb4500 msgid 8 Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:25:30 2010 : Info: [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass =GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3debellier\2cou\3dStaff\2c o\3dmobistar.be))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3debell ier\2cou\3dStaff\2c o\3dmobistar.be))) Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (&(cn=GF_FW_networkManagementProdAdmin)(|(&(objectClass=GroupOfNames)(member =uid\3debellier\2cou\3dStaff\2c o\3dmobistar.be))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3debell ier\2cou\3dStaff\2c o\3dmobistar.be)))) request done: ld 0x1fb4500 msgid 9 Tue Sep 28 14:25:30 2010 : Debug: rlm_ldap::ldap_groupcmp: User found in group GF_FW_networkManagementProdAdmin Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:25:30 2010 : Info: ++[files] returns noop Tue Sep 28 14:25:30 2010 : Info: [ldap] performing user authorization for ebellier Tue Sep 28 14:25:30 2010 : Info: [ldap] expand: %{Stripped-User-Name} -> ebellier Tue Sep 28 14:25:30 2010 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ebellier) Tue Sep 28 14:25:30 2010 : Info: [ldap] expand: ou=Staff,o=mobistar.be -> ou=Staff,o=mobistar.be Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (uid=ebellier) request done: ld 0x1fb4500 msgid 10 Tue Sep 28 14:25:30 2010 : Info: [ldap] looking for check items in directory... Tue Sep 28 14:25:30 2010 : Info: [ldap] looking for reply items in directory... Tue Sep 28 14:25:30 2010 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Sep 28 14:25:30 2010 : Info: [ldap] Setting Auth-Type = LDAP Tue Sep 28 14:25:30 2010 : Info: [ldap] user ebellier authorized to use remote access Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:25:30 2010 : Info: ++[ldap] returns ok Tue Sep 28 14:25:30 2010 : Info: ++[expiration] returns noop Tue Sep 28 14:25:30 2010 : Info: ++[logintime] returns noop Tue Sep 28 14:25:30 2010 : Info: [pap] Found existing Auth-Type, not changing it. Tue Sep 28 14:25:30 2010 : Info: ++[pap] returns noop Tue Sep 28 14:25:30 2010 : Info: Found Auth-Type = LDAP Tue Sep 28 14:25:30 2010 : Info: +- entering group LDAP {...} Tue Sep 28 14:25:30 2010 : Info: [ldap] login attempt by "ebellier" with password "xxxxxxx" Tue Sep 28 14:25:30 2010 : Info: [ldap] user DN: uid=ebellier,ou=Staff, o=mobistar.be Tue Sep 28 14:25:30 2010 : Debug: [ldap] (re)connect to 192.168.154.50:389, authentication 1 Tue Sep 28 14:25:30 2010 : Debug: [ldap] bind as uid=ebellier,ou=Staff, o=mobistar.be/Mamour20 to 192.168.154.50:389 Tue Sep 28 14:25:30 2010 : Debug: [ldap] waiting for bind result ... request done: ld 0x1fbcdb0 msgid 1 Tue Sep 28 14:25:30 2010 : Debug: [ldap] Bind was successful Tue Sep 28 14:25:30 2010 : Info: [ldap] user ebellier authenticated succesfully Tue Sep 28 14:25:30 2010 : Info: ++[ldap] returns ok Tue Sep 28 14:25:30 2010 : Auth: Login OK: [ebellier/Mamour20] (from client 172.18.113.82/32 port 0) Tue Sep 28 14:25:30 2010 : Info: +- entering group post-auth {...} Tue Sep 28 14:25:30 2010 : Info: [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/172.18.113.82/reply-detail-20100928 Tue Sep 28 14:25:30 2010 : Info: [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/172.18.113.82/reply-detail-20100928 Tue Sep 28 14:25:30 2010 : Info: [reply_log] expand: %t -> Tue Sep 28 14:25:30 2010 Tue Sep 28 14:25:30 2010 : Info: ++[reply_log] returns ok Tue Sep 28 14:25:30 2010 : Info: ++[exec] returns noop Sending Access-Accept of id 1 to 172.18.113.82 port 3340 Tue Sep 28 14:25:30 2010 : Info: Finished request 3. Tue Sep 28 14:25:30 2010 : Debug: Going to the next request Tue Sep 28 14:25:30 2010 : Debug: Waking up in 4.9 seconds. Tue Sep 28 14:25:35 2010 : Info: Cleaning up request 3 ID 1 with timestamp +176 Tue Sep 28 14:25:35 2010 : Info: Ready to process requests. >From Nortel ERS : rad_recv: Access-Request packet from host 192.168.250.64 port 4439, id=186, length=60 User-Name = "ebellier" User-Password = "%\357\350\t\310}\341Ú¡9\327F\336F\034\364" NAS-IP-Address = 192.168.250.64 NAS-Port = 1 Tue Sep 28 14:22:40 2010 : Info: +- entering group authorize {...} Tue Sep 28 14:22:40 2010 : Info: ++[preprocess] returns ok Tue Sep 28 14:22:40 2010 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.250.64/auth-detail-20100928 Tue Sep 28 14:22:40 2010 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.250.64/auth-detail-20100928 Tue Sep 28 14:22:40 2010 : Info: [auth_log] expand: %t -> Tue Sep 28 14:22:40 2010 Tue Sep 28 14:22:40 2010 : Info: ++[auth_log] returns ok Tue Sep 28 14:22:40 2010 : Info: ++[chap] returns noop Tue Sep 28 14:22:40 2010 : Info: ++[mschap] returns noop Tue Sep 28 14:22:40 2010 : Info: [suffix] No '@' in User-Name = "ebellier", looking up realm NULL Tue Sep 28 14:22:40 2010 : Info: [suffix] Found realm "DEFAULT" Tue Sep 28 14:22:40 2010 : Info: [suffix] Adding Stripped-User-Name = "ebellier" Tue Sep 28 14:22:40 2010 : Info: [suffix] Adding Realm = "DEFAULT" Tue Sep 28 14:22:40 2010 : Info: [suffix] Authentication realm is LOCAL. Tue Sep 28 14:22:40 2010 : Info: ++[suffix] returns ok Tue Sep 28 14:22:40 2010 : Info: [eap] No EAP-Message, not doing EAP Tue Sep 28 14:22:40 2010 : Info: ++[eap] returns noop Tue Sep 28 14:22:40 2010 : Info: ++[unix] returns updated Tue Sep 28 14:22:40 2010 : Debug: [ldap] Entering ldap_groupcmp() Tue Sep 28 14:22:40 2010 : Info: [files] expand: ou=Staff,o=mobistar.be -> ou=Staff,o=mobistar.be Tue Sep 28 14:22:40 2010 : Info: [files] expand: %{Stripped-User-Name} -> ebellier Tue Sep 28 14:22:40 2010 : Info: [files] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ebellier) Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] attempting LDAP reconnection Tue Sep 28 14:22:40 2010 : Debug: [ldap] (re)connect to 192.168.154.50:389, authentication 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] bind as / to 192.168.154.50:389 Tue Sep 28 14:22:40 2010 : Debug: [ldap] waiting for bind result ... request done: ld 0x1fb4500 msgid 1 Tue Sep 28 14:22:40 2010 : Debug: [ldap] Bind was successful Tue Sep 28 14:22:40 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (uid=ebellier) request done: ld 0x1fb4500 msgid 2 Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:22:40 2010 : Info: [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass =GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3debellier\2cou\3dStaff\2c o\3dmobistar.be))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3debell ier\2cou\3dStaff\2c o\3dmobistar.be))) Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (&(cn=GF_FW_networkManagementProdAdmin)(|(&(objectClass=GroupOfNames)(member =uid\3debellier\2cou\3dStaff\2c o\3dmobistar.be))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3debell ier\2cou\3dStaff\2c o\3dmobistar.be)))) request done: ld 0x1fb4500 msgid 3 Tue Sep 28 14:22:40 2010 : Debug: rlm_ldap::ldap_groupcmp: User found in group GF_FW_networkManagementProdAdmin Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:22:40 2010 : Info: ++[files] returns noop Tue Sep 28 14:22:40 2010 : Info: [ldap] performing user authorization for ebellier Tue Sep 28 14:22:40 2010 : Info: [ldap] expand: %{Stripped-User-Name} -> ebellier Tue Sep 28 14:22:40 2010 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ebellier) Tue Sep 28 14:22:40 2010 : Info: [ldap] expand: ou=Staff,o=mobistar.be -> ou=Staff,o=mobistar.be Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (uid=ebellier) request done: ld 0x1fb4500 msgid 4 Tue Sep 28 14:22:40 2010 : Info: [ldap] looking for check items in directory... Tue Sep 28 14:22:40 2010 : Info: [ldap] looking for reply items in directory... Tue Sep 28 14:22:40 2010 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Sep 28 14:22:40 2010 : Info: [ldap] Setting Auth-Type = LDAP Tue Sep 28 14:22:40 2010 : Info: [ldap] user ebellier authorized to use remote access Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:22:40 2010 : Info: ++[ldap] returns ok Tue Sep 28 14:22:40 2010 : Info: ++[expiration] returns noop Tue Sep 28 14:22:40 2010 : Info: ++[logintime] returns noop Tue Sep 28 14:22:40 2010 : Info: [pap] Found existing Auth-Type, not changing it. Tue Sep 28 14:22:40 2010 : Info: ++[pap] returns noop Tue Sep 28 14:22:40 2010 : Info: Found Auth-Type = LDAP Tue Sep 28 14:22:40 2010 : Info: +- entering group LDAP {...} Tue Sep 28 14:22:40 2010 : Info: [ldap] login attempt by "ebellier" with password "%ïè È}áÚ¡9×FÞF?ô" Tue Sep 28 14:22:40 2010 : Info: [ldap] user DN: uid=ebellier,ou=Staff, o=mobistar.be Tue Sep 28 14:22:40 2010 : Debug: [ldap] (re)connect to 192.168.154.50:389, authentication 1 Tue Sep 28 14:22:40 2010 : Debug: [ldap] bind as uid=ebellier,ou=Staff, o=mobistar.be/%ïè È}áÚ¡9×FÞF?ô to 192.168.154.50:389 Tue Sep 28 14:22:40 2010 : Debug: [ldap] waiting for bind result ... request done: ld 0x1fbcd90 msgid 1 Tue Sep 28 14:22:40 2010 : Debug: [ldap] Bind failed with invalid credentials Tue Sep 28 14:22:40 2010 : Info: ++[ldap] returns reject Tue Sep 28 14:22:40 2010 : Info: Failed to authenticate the user. Tue Sep 28 14:22:40 2010 : Auth: Login incorrect ( [ldap] Bind as user failed): [ebellier/%\357\350\t\310}\341Ú¡9\327F\336F\034\364] (from client 192.168.250.64 port 1) Tue Sep 28 14:22:40 2010 : Debug: WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Tue Sep 28 14:22:40 2010 : Info: Using Post-Auth-Type Reject Tue Sep 28 14:22:40 2010 : Info: +- entering group REJECT {...} Tue Sep 28 14:22:40 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> ebellier Tue Sep 28 14:22:40 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Sep 28 14:22:40 2010 : Info: ++[attr_filter.access_reject] returns updated Tue Sep 28 14:22:40 2010 : Info: Delaying reject of request 0 for 1 seconds Tue Sep 28 14:22:40 2010 : Debug: Going to the next request Tue Sep 28 14:22:40 2010 : Debug: Waking up in 0.9 seconds. Tue Sep 28 14:22:41 2010 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 186 to 192.168.250.64 port 4439 Tue Sep 28 14:22:41 2010 : Debug: Waking up in 4.9 seconds. Tue Sep 28 14:22:46 2010 : Info: Cleaning up request 0 ID 186 with timestamp +6 Tue Sep 28 14:22:46 2010 : Info: Ready to process requests. <http://k-village/team_members/who_s_who/kpeople01.asp?login=ebellier> Eric Bellière Operation & Integration Expert ITNO/ISO/ISIO/LSS Mobistar NV/SA Avenue Jean Mermoz 32 6041 Gosselies cid:image003.jpg@01C961E5.77656AB0 Tel: +32 (0)2 745 7997 GSM: +32(0)495 55 1343

2 1

Re: Radius proxy - kind of
by Matija Levec 28 Sep '10

28 Sep '10

Hi! I still can't find solution to my problem in documentation so I'll rephrase the question. Is it possible to proxy requests in a way analogous to bogus example below? realm example.com { auth_pool = pool1 { reject = 1 ok = return } auth_pool = pool2 { reject = 1 ok = return } } # Authentication fails only if both pools return reject. I know documentation says "... It proxies packets ONLY when it receives a packet or a re-transmission from the NAS. If the NAS never re-transmits, the proxy never re-transmits, either." Can someone at least suggest in what direction to look for solution? Thank you, Matija >>> Matija Levec 24.9.2010 16:24 >>> Hi everyone! First a little bit of explaining... - auth_server 1 client - fr_proxy -[ - auth_server 2 (client=random NAS, fr_proxy=freeradius, auth_server=two-factor auth server(s)) Currently we have clients authenticating directly to auth_server 1. We would like to gradually (and transparently) move users to new authenticators which use auth_server 2 Question What I would like to accomplish is: If auth_server 1 returns notfound or reject or fail, proxy request to auth_server 2 Is it possible to use 'configurable module fail over'-like syntax for configuring proxy (home)servers? I hopes this makes sense. Anyway... all ideas appreciated! Regards, Matija

2 1

Problemers using Freeradius with Anyconnect..
by Thomas Raabo - ZitCom A/S 28 Sep '10

28 Sep '10

Iam trying to use Freeradius with Cisco ASA anyconnect.. But I just can´t get it to work The problem is that when I use Freeradius the ASA just don't seem to get the framed-ip-address or something... ( when we try to connect with anyconnect it gives the error host or network is 0) with IAS the right ip gets assigned and all just works If I try the same thing with Microsoft IAS it just works Here is the output from radtest First MS IAS [root@mgmt3 raddb]# radtest tr2(a)test.local XXXX 172.16.16.206:1812 1 test Sending Access-Request of id 185 to 172.16.16.206 port 1812 User-Name = "tr2(a)test.local" User-Password = "XXXX" NAS-IP-Address = 172.16.24.4 NAS-Port = 1 rad_recv: Access-Accept packet from host 172.16.16.206 port 1812, id=185, length=259 Framed-IP-Netmask = 255.255.255.128 Framed-Protocol = PPP Service-Type = Framed-User Framed-IP-Address = 172.20.3.129 Class = 0xb4fc099a0000013700011700fe80000000000000e42365c53146798301cb5ed46d12aaaa0000000000000056 Cisco-AVPair = "ip:inacl#100=permit ip 172.20.3.128 255.255.255.128 172.20.3.0 255.255.255.0" Cisco-AVPair = "ip:inacl#101=permit ip 172.20.3.128 255.255.255.128 172.16.34.0 255.255.255.0" >From Freeradius [root@mgmt3 raddb]# radtest hmm2 XXXX 172.16.16.202:1812 1 Rzitcom! Sending Access-Request of id 79 to 172.16.16.202 port 1812 User-Name = "hmm2" User-Password = "XXXX" NAS-IP-Address = 172.16.24.4 NAS-Port = 1 rad_recv: Access-Accept packet from host 172.16.16.202 port 1812, id=79, length=222 Framed-IP-Netmask = 255.255.255.128 Framed-Protocol = PPP Service-Type = Framed-User Framed-IP-Address = 172.20.3.128 Class = 0x4f553d54455354 Cisco-AVPair = "ip:inacl#100=permit ip 172.20.3.128 255.255.255.128 172.20.3.0 255.255.255.0" Cisco-AVPair = "ip:inacl#100=permit ip 172.20.3.128 255.255.255.128 172.16.34.0 255.255.255.0" INSERT INTO `radreply` (`id`, `UserName`, `Attribute`, `op`, `Value`) VALUES (3, 'hmm2', 'Framed-IP-Netmask', ':=', '255.255.255.128'), (4, 'hmm2', 'Framed-Protocol', ':=', 'PPP'), (5, 'hmm2', 'Service-Type', ':=', 'Framed-User'), (6, 'hmm2', 'Framed-IP-Address', ':=', '172.20.3.128'), (8, 'hmm2', 'Cisco-AVPair', '+=', 'ip:inacl#100=permit ip 172.20.3.128 255.255.255.128 172.20.3.0 255.255.255.0'), (9, 'hmm2', 'Cisco-AVPair', '+=', 'ip:inacl#100=permit ip 172.20.3.128 255.255.255.128 172.16.34.0 255.255.255.0'), (7, 'hmm2', 'Class', ':=', 'OU=TEST'); This is the out from the ASA so its able to use freeradius... :) we also use it for administrative users test aaa-server authentication RadiusServers host 172.16.16.202 us$ INFO: Attempting Authentication test to IP address <172.16.16.202> (timeout: 12 seconds) INFO: Authentication Successful Med venlig hilsen | Best regards Thomas Raabo Netværksansvarlig [Description: Description: Description: cid:image001.jpg@01C9A70C.01A27540]<http://www.zitcom.dk/> tr(a)zitcom.dk<mailto:tr@zitcom.dk> | Direkte: +45 69 10 60 18 | Tlf: +45 70 23 55 66

2 2

problema con la instalacion freeradius en debian
by Samuel Isaias Barriga Perez 27 Sep '10

27 Sep '10

Estimados: Estoy tratando de configurar un servidor Radius (Freeradius) en debian (Lenny), el problema es que cuando uso el comando radisud -XX el resultado me da el siguiente: radius01:~# radiusd -XX Mon Sep 27 20:49:45 2010 : Info: FreeRADIUS Version 2.1.9, for host x86_64-unknown-linux-gnu, built on Sep 27 2010 at 02:41:08 Mon Sep 27 20:49:45 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Mon Sep 27 20:49:45 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Mon Sep 27 20:49:45 2010 : Info: PARTICULAR PURPOSE. Mon Sep 27 20:49:45 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Mon Sep 27 20:49:45 2010 : Info: GNU General Public License v2. Mon Sep 27 20:49:45 2010 : Info: Starting - reading configuration files ... Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Mon Sep 27 20:49:45 2010 : Debug: including files in directory /usr/local/etc/raddb/modules/ Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/exec Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/inner-eap Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pap Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smsotp Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/echo Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/policy Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expr Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/unix Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/wimax Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/always Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ntlm_auth Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/digest Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/linelog Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pam Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/files Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/realm Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/cui Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.example.com Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/counter Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/perl Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/chap Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/otp Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/eap.conf Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/policy.conf Mon Sep 27 20:49:45 2010 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/control-socket Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Mon Sep 27 20:49:45 2010 : Debug: main { Mon Sep 27 20:49:45 2010 : Debug: allow_core_dumps = no Mon Sep 27 20:49:45 2010 : Debug: } Mon Sep 27 20:49:45 2010 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Mon Sep 27 20:49:45 2010 : Error: Errors reading dictionary: dict_init: /usr/local/etc/raddb/dictionary[14]: Couldn't open dictionary "/usr/local/share/freeradius/dictionary": No such file or directory y si me voy al path /usr/local/share/freeradius/dictionary este archivo no existe, que puedo hacer al respecto gracias samuel

2 1

Additional Restrictions for users
by William Burnett 27 Sep '10

27 Sep '10

I currently have my RADIUS servers setup to handle authentication for my various NAS's to grant users access to network resources. I would like to use the same servers to handle authentication for SSH for various routers. This all works, but I'm having a hard time getting the RADIUS server to only accept requests from users of the "ssh" group. I obviously don't want john.doe accessing my core routers. What is the best way to go about this? I was trying to use unlang to query my database but can't seem to get the syntax right. contents of sites-enabled/default: ...authorize { preprocess if (Service-Type == "Login-User") if ( %{group_membership_query} == "ssh") { update reply { ok-to-continue } } else { update reply { Auth-Type := Reject } }.... The group_membership_query would reference this: group_membership_query = "SELECT groupname \ FROM ${usergroup_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY priority" Any help/suggestions would be much appreciated. Sincerely, William Burnett burnett.w(a)gmail.com

3 5

sending accounting for two home servers
by Evgeniy Kozhuhovskiy 27 Sep '10

27 Sep '10

Is it possible to send accounting packets to two home servers? In fact, one server is real auth+acct server, and another server is a web filter that applies rules according information at start packets. -- С уважением, Евгений Кожуховский Руководитель группы сервисных платформ УИТ ЦИТС МГТС РУП Белтелеком +375-29-3998175 +375-29-7561625 +375-17-3060026

3 7

eap-tls certificates
by Peter McEvoy 27 Sep '10

27 Sep '10

Hi. I'm in the process of setting up freeradius 2.1.9 on debian lenny/sparc. I've got everything working for eap tls with the self signed certificates that come with freeradius. This is working well for macs and some smartphones but I'm having trouble with windows machines. My research indicates that buying a certificate from a known CA will solve my problems (or I believe I could import a certificate into the windows devices but with up to 1000 clients I'd prefer not to have to do this). Can anyone confirm if this is the case? If so, is there a specific type of certificate I need to buy that would include some 'extensions' that I'm told windows clients require. Cheers -- Pete

2 2