March 2011 - Freeradius-Users - lists.freeradius.org

Help migrating from 1.1.7 to 2.1.10 - clear text password being lost
by John Hayward 11 Mar '11

11 Mar '11

Hi Radius Fans, I am trying to move our current environment from 1.1.7 to 2.1.10 and are having a problem getting things to work. We have a Novell NDSLdap server which provides clear text passwords for Novell users. We are using peap-mschapv2. In looking at the logs and Eap-Messages we see: response 01 identity (username) -> server The server looks up the user in ndsldap and: Info: [ldap] Added the eDirectory password (password removed) in check items as Cleartext-Password Then the server sends a request 02 to use EAP-TLS There are a series of responses (mostly appear to be ack) and requests to get the tunnel setup which succeeds. Near the end the client sends a response (ID=8) which is a response to the mschap2 challenge. When the server is processing this response it reports: Info: [mschap] No Cleartext-Password configured. Cannot create LM-Password. I put in some additional debugging and found that address of the request->config_item has changed from when the ldap module put the cleartext password in as a pair and when the mschap module attempts to remove it. The ldap module is called in authorize and the mschap is called in authenticate. What might be causing the request->config to be at a different location between when the clear text password is stored and when it is needed to authenticate? johnh...

3 2

CHAP-Challenge Question
by Jeremiah 11 Mar '11

11 Mar '11

We are using freeradius 2.1.10. We are using a Mikrotik as a nas and trying to use CHAP for hotspot access. I have a test user setup and can use ntradping to Access-Accept back. Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 174.57.91.24 port 1026, id=7, length=52 User-Name = "testwifi" CHAP-Password = 0xe89981fe6bf05bf6af662769cbb1a084f8 # Executing section authorize from file /opt/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> testwifi [sql] sql_set_user escaped user --> 'testwifi' [sql] User found in radcheck table ++[sql] returns ok ++[mschap] returns noop Found Auth-Type = CHAP # Executing group from file /opt/etc/raddb/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "testwifi" with CHAP password [chap] Using clear text password "testblah" for user testwifi authentication. [chap] chap user testwifi authenticated succesfully ++[chap] returns ok Login OK: [testwifi] (from client mikrotik port 0) # Executing section post-auth from file /opt/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 7 to 174.57.91.24 port 1026 Mikrotik-Rate-Limit := "256k/512k" Session-Timeout += 120 Finished request 1. Going to the next request When a request comes in from the Tik , it adds a CHAP challenge and the Chap password obviously is differejt and the request fails. rad_recv: Access-Request packet from host 203.45.185.115 port 33303, id=6, length=246 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:12:AB:36:3E:0C" Called-Station-Id = "server1" NAS-Port-Id = "bridge1" User-Name = "testwifi" MS-CHAP-Domain = "wifi.net" NAS-Port = 2157969420 Acct-Session-Id = "80a0000c" Framed-IP-Address = 192.168.10.246 Mikrotik-Host-IP = 192.168.10.246 CHAP-Challenge = 0xf3663a1617d0a1d2537c157ee4ef1e77 CHAP-Password = 0xedcbec473f0529359a785e47ada0e0b23e Service-Type = Login-User WISPr-Logoff-URL = "http://0.0.0.0/logout" NAS-Identifier = "MikroTik" NAS-IP-Address = 203.45.185.115 Mikrotik-Realm = "wifi.net" # Executing section authorize from file /opt/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> testwifi [sql] sql_set_user escaped user --> 'testwifi' [sql] User found in radcheck table ++[sql] returns ok ++[mschap] returns noop Found Auth-Type = CHAP # Executing group from file /opt/etc/raddb/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "testwifi" with CHAP password [chap] Using clear text password "testblah" for user testwifi authentication. [chap] Password check failed ++[chap] returns reject Failed to authenticate the user. Login incorrect (rlm_chap: Wrong user password): [testwifi/<CHAP-Password>] (from client mikrotik port 2157969420 cli 00:12:AB:36:3E:0C) Using Post-Auth-Type Reject # Executing group from file /opt/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testwifi attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 22 for 1 seconds Going to the next request Waking up in 0.3 seconds. What basic element am I failing to understand? If the chap challenge string is sent in, should freeradius be able to use that with the chap-password to accept the user? Thanks Jeremiah

2 2

Proxy Request to Virtual Server using EAP
by joaocdc＠gmail.com 11 Mar '11

11 Mar '11

Hello Guys I need a help to use proxy request to virtual_server using EAP-TTLS and EAP-PEAP I have the following scenario: I have a Radius Sever (version 2.1.10), this server on a Linux Debian 6 This server must authenticate users of my wireless network. But my network is interconnected with several educational institutions, and users of these institutions are in my network. For users who are in my company, I want to authenticate them in my radius server, for users who are from other institutions to do routing or proxy server. I already have configured the authentication of my users using LDAP as a backend. My users will be divided into groups, each group has its own realm, each realm and forwards the authentication to a virtual server. If my users try to authenticate without entering the realm, it works OK. If users try to authenticate other institutions stating the realm of the institution, my radius is usually the proxy, and it works OK. if my users try to authenticate informing realm, I see in debug mode the virtual server is invoked, but the authentication does not happen, he accuses the following error: # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Multiple levels of TLS nesting is invalid. [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server inner-tunnel Apparently he often wraps the request with TLS, and can no longer decapsulation. If you do a test without using EAP authentication (via radtest) authentication with realm works. Apparently he often wraps the request with TLS, and can no longer decapsulation. Enough already researched on the internet but have not found a solution. I need to make a proxy for virtual_server using EAP. If any can help me thank you. Sincerely John

1 0

FR 2.1.7 Exits for no reason
by McNutt, Justin M. 11 Mar '11

11 Mar '11

Hey all, So the host-based auth stuff is working well now, but we've discovered another problem. We have four FR 2.1.7 servers running on RHEL 5 (fully patched). Every now and then, for no apparent reason, radiusd just stops. It exits with "Exiting normally." to syslog. They don't all exit at the same time. Since there are four of them behind a load balancer, it usually doesn't result in a service outage, and we've been lucky so far that only a couple of them have been down at once. But it's still disconcerting. The servers tend to all be started within a minute of each other, since I make changes to Server #1, and then use an rsync script to replicate /etc/raddb to the other servers and restart them. So they all start within seconds of one another. This week, Server #3 stopped within about 8 hours of being started (went from 1130 to 1930). Server #1 failed last week at 2330. Server #4 hasn't failed yet. It's very odd. Any ideas on how I can troubleshoot this? Thanks! Justin McNutt Network Systems Analyst - Ninja DNPS, Mizzou Telecom (573) 882-5183 "Do you have a concussion?" Ping is NOT a service. You don't need it. Use a real test.

5 7

linelog and rlm_eap
by Kolbjørn Barmen 11 Mar '11

11 Mar '11

Is it possible to use the linelog to provide a "debug light" for rlm_eap and submodules? What I'm looking for is some way to tell why an authentication has failed for a given login attempt, without resorting to full debugging. If it is possible, example configuration is most welcome. Thanks! -- Kolbjørn Barmen UNINETT Driftsenter

4 6

Virtual Server
by Rob Yamry 11 Mar '11

11 Mar '11

Im running FreeRadius 2.1.8 to allow wireless access and that is working great. I now want to have the vpn auth against the freeradius server for access, but checking for a different ldap attribute on the user. I read the virtual servers wiki and it says that all modules are global across virtual servers. Do I need to set up another install of freeradius so I can check for the other ldap attribute or is there a better way to get this accomplished? Thanks for your help.

2 2

Customizing Reply-Messages for failed auths on 1.x
by Lorenzo Milesi 11 Mar '11

11 Mar '11

Hi. I've done several searches, but couldn't find a way... I'd like to customize the Reply-Message returned to client upon failed auth, like "User expired" or "Usage limit reached"... I'm running 1.1.7. How can I do that? Thanks. -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it YetOpen S.r.l. - http://www.yetopen.it/ Via Carlo Torri Tarelli 19 - 23900 Lecco - ITALY - Tel 0341 220 205 - Fax 178 6070 222 GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it -------- D.Lgs. 196/2003 -------- Si avverte che tutte le informazioni contenute in questo messaggio sono riservate ed a uso esclusivo del destinatario. Nel caso in cui questo messaggio Le fosse pervenuto per errore, La invitiamo ad eliminarlo senza copiarlo, a non inoltrarlo a terzi e ad avvertirci non appena possibile. Grazie.

2 1

same username with different password mysql chap
by Brent Wilkinson 11 Mar '11

11 Mar '11

I am in the process of setting up freeradius with mysql. I pretty much have everything working correctly except a issue that has come up. I am not sure if I did something wrong or this cannot be done. Here is my radcheck database +-----+----------+-----------+----+--------+-------+------------+ | id | username | attribute | op | value | PID | expires | +-----+----------+-----------+----+--------+-------+------------+ | 462 | 10295 | password | == | 912547 | 10295 | 2011-03-21 | | 463 | 10295 | password | == | 659320 | 10295 | 2011-03-21 | | 464 | 10295 | password | == | 322438 | 10295 | 2011-03-28 | | 465 | 10295 | password | == | 339410 | 10295 | 2011-04-04 | | 466 | 10295 | password | == | 987255 | 10295 | 2011-04-11 | | 467 | 10295 | password | == | 990160 | 10295 | 2011-04-18 | | 468 | 10295 | password | == | 373359 | 10295 | 2011-04-25 | | 469 | 10295 | password | == | 974781 | 10295 | 2011-05-02 | | 470 | 10295 | password | == | 121431 | 10295 | 2011-05-09 | | 471 | 10295 | password | == | 566703 | 10295 | 2011-05-16 | | 472 | 10295 | password | == | 430339 | 10295 | 2011-05-23 | +-----+----------+-----------+----+--------+-------+------------+ Here is the debug I get from radius -X using username 10295 and password 912547 Ready to process requests. rad_recv: Access-Request packet from host 192.168.99.175 port 48655, id=43, length=216 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:13:E8:17:C9:09" Called-Station-Id = "test1" NAS-Port-Id = "ether2" User-Name = "10295" MS-CHAP-Domain = "test" NAS-Port = 2153775123 Acct-Session-Id = "80600013" Framed-IP-Address = 10.0.100.251 Mikrotik-Host-IP = 10.0.100.251 CHAP-Challenge = 0x9a7dde24641b743604ed531068ad4662 CHAP-Password = 0x1ac903f936a5ccd7efdf337e94bd4ba958 Service-Type = Login-User WISPr-Logoff-URL = "http://10.0.100.1/logout" NAS-Identifier = "Air2Data" NAS-IP-Address = 192.168.99.175 Mikrotik-Realm = "test" # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "10295", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> 10295 [sql] sql_set_user escaped user --> '10295' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '10295' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '10295' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '10295' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "10295" with CHAP password [chap] Using clear text password "912547" for user 10295 authentication. [chap] Password check failed ++[chap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 10295 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.99.175 port 48655, id=43, length=216 Waiting to send Access-Reject to client hotspot port 48655 - ID: 43 Waking up in 0.6 seconds. rad_recv: Access-Request packet from host 192.168.99.175 port 48655, id=43, length=216 Waiting to send Access-Reject to client hotspot port 48655 - ID: 43 Waking up in 0.3 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 43 to 192.168.99.175 port 48655 Waking up in 4.9 seconds. Cleaning up request 0 ID 43 with timestamp +2 Ready to process requests. What am I missing in that the chap is failing the password even though it is in the mysql database? Thanks Brent

3 3

Re: Freeraidus 2
by Usuário do Sistema 10 Mar '11

10 Mar '11

Hello, My freeradius2 it's up and when I make a test from other linux machine with command "radtest joao.vero jango123 128.2.100.131 2 meleca" it's working as follow out Sending Access-Request of id 45 to 128.2.100.131 port 1645 User-Name = "joao.vero" User-Password = "jango123" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 rad_recv: Access-Accept packet from host 128.2.100.131:1645, id=45, length=20 But, when I'm going to authenticate wireless users ( with EAP-TLS, I'm using the test certificate from /etc/raddb/certs/..) It isn't working. it's appear in log: [mschap] No Cleartext-Password configured. Cannot create LM-Password. I wish to use LDAP for authenticate my users but seems that User-Password must be Clear text. there is possible reach EAP-TLS with LDAP?? What I have do ?? any help is welcome....I'm new in freeradius. Gary Gatten, what did you mean with Content-Type: text/plain; charset="utf-8" as your comments thank everyone! 2011/3/5 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Caching techniques with ntlm_auth usage? > (EAP-PEAP-MSchapV2) (Phil Mayers) > 2. Re: Freeraidus 2 (Gary Gatten) > 3. Re: Caching techniques with ntlm_auth usage? > (EAP-PEAP-MSchapV2) (James J J Hooper) > 4. RE: mschap with ntlm_auth and Active Directory (McNutt, Justin M.) > 5. Re: MS-CHAP-V2 with no retry (Alan DeKok) > 6. Re: Hopefully quick question: conditional processing sneaking > in and setting Auth-Type (Alan DeKok) > 7. Re: Freeraidus 2 (Alan Buxey) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 05 Mar 2011 00:45:43 +0000 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: Caching techniques with ntlm_auth usage? > (EAP-PEAP-MSchapV2) > To: freeradius-users(a)lists.freeradius.org > Message-ID: <4D7187B7.5000402(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 03/05/2011 12:21 AM, Gary Gatten wrote: > > I kinda like your caching idea, but not sure of any security > > implications. > > It's not a workable idea. MSCHAP responses are specific to the 8-byte > random challenge, which is different every time. You can't cache them. > > > > > I have (2) FR servers (each pointing to different DC) and my NAS's > > are configured to use both. But, iirc if AD is down on the backend > > FR still replies (with something) so the NAS never rolls over to the > > other FR server. > > Yes, this is a bad idea. > > Just configure samba to autodiscover the AD controllers. Winbind will > cache connections and open new ones when the old ones go away. > > > > > So, I thought about some script that would use ntlm_auth every...n > > seconds, if it fails kill FR process (or use FR policy to act dead). > > When it starts working again, restart FR. This should make the NAS > > roll to the next FR server. > > That might work, but it seems like a sledgehammer to crack a nut. > > > > > What about OpenLDAP on the FR server that's "refreshed" / sync'd to > > the winblows/AD? I've never tried this but assume it's doable. > > It's not possible. AD controllers will only sync to other AD controllers. > > At some point in the future, Samba 4 might be able to slave the LDAP > database of an AD controller, but it's purely theoretical at the moment > I think. > > > ------------------------------ > > Message: 2 > Date: Fri, 4 Mar 2011 18:54:44 -0600 > From: Gary Gatten <Ggatten(a)waddell.com> > Subject: Re: Freeraidus 2 > To: "'freeradius-users(a)lists.freeradius.org'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > < > 27487_1299286485_4D7189D5_27487_3768_1_D9B37353831173459FDAA836D3B43499BD354A55(a)WADPMBXV0.waddell.com > > > > Content-Type: text/plain; charset="utf-8" > > Try ../sites_enabled/default; or if *eap requests it would be inner-tunnel, > - I think... > > From: Paulo Maia [mailto:phc.maia@gmail.com] > Sent: Friday, March 04, 2011 06:43 PM > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeraidus 2 > > Compilou o instalou via yum ? Geralmente fica em $RADIUSDIR/modules/ldap > > Abs, > > > 2011/3/4 Usu?rio do Sistema <maiconlp(a)ig.com.br<mailto:maiconlp@ig.com.br > >> > Hello everyone, I'm Maicon from Brazil. > > I'm in a project with Freeradius. I want to deployment authentication with > certificate from my wireless users EAP-TLS but I'm finding some difficult. > there is a good how to for version 2 ?? I've started with version 1.x but > decided to change for version 2 and I'm not finding where I set the LDAP > conection. at the older version it was inside radiusd.conf. anybody help me > ?? > > > thank! > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > > <font size="1"> > <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in > 0in 1.0pt 0in'> > </div> > "This email is intended to be reviewed by only the intended recipient > and may contain information that is privileged and/or confidential. > If you are not the intended recipient, you are hereby notified that > any review, use, dissemination, disclosure or copying of this email > and its attachments, if any, is strictly prohibited. If you have > received this email in error, please immediately notify the sender by > return email and delete this email from your system." > </font> > >

1 0

Multiple modules entries
by m jones 10 Mar '11

10 Mar '11

Hi I'm trying to configure radiusd.conf Module section to look at more than one module config. Can get one to work but when I add a second it dosen't work. below is a copy of my radiusd.conf file. modules { # # Each module has a configuration as follows: # # name [ instance ] { # config_item = value # ... # } # ldap ldap1 { server = "gmcnhs1.glasgowmet.ac.uk" port = 636 ... } ldap ldap 2 { server = "gmcnhs1.glasgowmet.ac.uk" port = 636 ... } # The 'name' is used to load the 'rlm_name' library # which implements the functionality of the module. # # The 'instance' is optional. To have two different instances # of a module, it first must be referred to by 'name'. # The different copies of the module are then created by # inventing two 'instance' names, e.g. 'instance1' and 'instance2' # # The instance names can then be used in later configuration # INSTEAD of the original 'name'. See the 'radutmp' configuration # below for an example. # # PAP module to authenticate users based on their stored password # # Supports multiple encryption schemes # clear: Clear text # crypt: Unix crypt # md5: MD5 ecnryption # sha1: SHA1 encryption. # DEFAULT: crypt pap { encryption_scheme = crypt } # CHAP module # # To authenticate requests containing a CHAP-Password attribute. # chap { authtype = CHAP } # Pluggable Authentication Modules # # For Linux, see: # http://www.kernel.org/pub/linux/libs/pam/index.html # # WARNING: On many systems, the system PAM libraries have # memory leaks! We STRONGLY SUGGEST that you do not # use PAM for authentication, due to those memory leaks. # pam { # # The name to use for PAM authentication. # PAM looks in /etc/pam.d/${pam_auth_name} # for it's configuration. See 'redhat/radiusd-pam' # for a sample PAM configuration file. # # Note that any Pam-Auth attribute set in the 'authorize' # section will over-ride this one. # pam_auth = radiusd } # Unix /etc/passwd style authentication # unix { # # Cache /etc/passwd, /etc/shadow, and /etc/group # # The default is to NOT cache them. # # For FreeBSD and NetBSD, you do NOT want to enable # the cache, as it's password lookups are done via a # database, so set this value to 'no'. # # Some systems (e.g. RedHat Linux with pam_pwbd) can # take *seconds* to check a password, when th passwd # file containing 1000's of entries. For those systems, # you should set the cache value to 'yes', and set # the locations of the 'passwd', 'shadow', and 'group' # files, below. # # allowed values: {no, yes} cache = no # Reload the cache every 600 seconds (10mins). 0 to disable. cache_reload = 600 # # Define the locations of the normal passwd, shadow, and # group files. # # 'shadow' is commented out by default, because not all # systems have shadow passwords. # # To force the module to use the system password functions, # instead of reading the files, leave the following entries # commented out. # # This is required for some systems, like FreeBSD, # and Mac OSX. # # passwd = /etc/passwd # shadow = /etc/shadow # group = /etc/group # # The location of the "wtmp" file. # This should be moved to it's own module soon. # # The only use for 'radlast'. If you don't use # 'radlast', then you can comment out this item. # radwtmp = ${logdir}/radwtmp } # Lightweight Directory Access Protocol (LDAP) # # This module definition allows you to use LDAP for # authorization and authentication (Auth-Type := LDAP) # # See doc/rlm_ldap for description of configuration options # and sample authorize{} and authenticate{} blocks ldap ldap1 { server = "gmcnhs1.glasgowmet.ac.uk" port = 636 #==== # identity = "cn=sambaProxy,o=GMC" # password = "" identity = "cn=GMET-RADIUS,ou=STUDENTS,ou=USERS,o=GMC" password = "radius" #==== basedn = "ou=BUILTENV,ou=STUDENTS,ou=USERS,o=GMC" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" #basedn = "ou=STUDENTS,ou=USERS,o=GMC" #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no tls_mode = yes # tls_cacertfile = /radius_certs/gmet-tree.b64 tls_cacertfile = /etc/raddb/certs/gmet-tree.b64 # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" #access_attr = "dialupAccess" access_attr_used_for_allow = no # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # # password_header = "{clear}" # # Set: password_attribute = nspmPassword access_attr_used_for_allow = no # # to get the user's password from a Novell eDirectory # backend. This will work *only if* freeRADIUS is # configured to build with --with-edir option. # # # The server can usually figure this out on its own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # # password_attribute = userPassword # # # Un-comment the following to disable Novell eDirectory account # policy check and intruder detection. This will work *only if* # FreeRADIUS is configured to build with --with-edir option. # edir_account_policy_check=yes # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes # # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # You can disable this behavior by setting the following # configuration entry to "no". # # allowed values: {no, yes} set_auth_type = no } ldap ldap2 { server = "gmcnhs1.glasgowmet.ac.uk" port = 636 #==== # identity = "cn=sambaProxy,o=GMC" # password = "" identity = "cn=GMET-RADIUS,ou=STUDENTS,ou=USERS,o=GMC" password = "radius" basedn = "ou=COMMSMED,ou=STUDENTS,ou=USERS,o=GMC" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" #basedn = "ou=STUDENTS,ou=USERS,o=GMC" #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no tls_mode = yes # tls_cacertfile = /radius_certs/gmet-tree.b64 tls_cacertfile = /etc/raddb/certs/gmet-tree.b64 # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" #access_attr = "dialupAccess" access_attr_used_for_allow = no # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # # password_header = "{clear}" # # Set: password_attribute = nspmPassword access_attr_used_for_allow = no # # to get the user's password from a Novell eDirectory # backend. This will work *only if* freeRADIUS is # configured to build with --with-edir option. # # # The server can usually figure this out on its own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # # password_attribute = userPassword # # # Un-comment the following to disable Novell eDirectory account # policy check and intruder detection. This will work *only if* # FreeRADIUS is configured to build with --with-edir option. # edir_account_policy_check=yes # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes # # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # You can disable this behavior by setting the following # configuration entry to "no". # # allowed values: {no, yes} set_auth_type = no } authorize { # # The preprocess module takes care of sanitizing some bizarre # attributes in the request, and turning them into attributes # which are more standard. # # It takes care of processing the 'raddb/hints' and the # 'raddb/huntgroups' files. # # It also adds the %{Client-IP-Address} attribute to the request. preprocess # # If you want to have a log of authentication requests, # un-comment the following line, and the 'detail auth_log' # section, above. # auth_log # attr_filter # # The chap module will set 'Auth-Type := CHAP' if we are # handling a CHAP request and Auth-Type has not already been set chap # # If the users are logging in with an MS-CHAP-Challenge # attribute for authentication, the mschap module will find # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' # to the request, which will cause the server to then use # the mschap module for authentication. # # The ldap module will set Auth-Type to LDAP if it has not # already been set ldap1 ldap2 # authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authorize' section. # digest # # Pluggable Authentication Modules. # pam # # See 'man getpwent' for information on how the 'unix' # module checks the users password. Note that packets # containing CHAP-Password attributes CANNOT be authenticated # against /etc/passwd! See the FAQ for details. # unix # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. Auth-Type LDAP { ldap1 ldap2 } # # Allow EAP authentication. eap } I am new freeradius so any help would be appreciated. Performed a debug and received. Error: Cannot find a configuration entry for module ldap. Error: radiusd.conf [2018] unknown module ldap Error: radiuse.conf [2018] failed to parse ldap entry. version of freeradius 1.1.7 Miles -- View this message in context: http://freeradius.1045715.n5.nabble.com/Multiple-modules-entries-tp3405254p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3