May 2011 - Freeradius-Users - lists.freeradius.org

Multiple ldaps (SSL) backends and only the first queried works. Possible bug?
by Daniele Albrizio 04 May '11

04 May '11

I've two ldaps backends instantiated like: authorize { ... Autz-Type OPENLDAP { openldap } Autz-Type ADLDAP { adldap } ... } authenticate { ... Auth-Type OPENLDAP { openldap } Auth-Type ADLDAP { adldap } ... } The two modules are configured as follows using DIFFERENT issuing CAs... ldap adldap { server = "ldaps://myAD.ds.units.it" identity = ... password = ... basedn = ... filter = "(samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no cacertfile = /usr/local/etc/raddb/.../certs/ad_root_ca.pem require_cert = "demand" } ... } ldap openldap { server = "ldaps://myopenldap.units.it" identity = ... password = ... basedn = ... filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 5 timelimit = 5 net_timeout = 10 tls { start_tls = no cacertfile = /etc/ssl/certs/AddTrust_External_Root.pem require_cert = "demand" } ... } Now, the problem is that once I started freeradius, the first connection to an ldap server goes straight, while the second (to the other one) says: ldap_create ldap_url_parse_ext(ldaps://myAD.ds.units.it) ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP myAD.ds.units.it:636 ldap_new_socket: 32 ldap_prepare_socket: 32 ldap_connect_to_host: Trying yyy.yyy.yyy.yyy:636 ldap_pvt_connect: fd: 32 tm: 1 async: 0 ldap_ndelay_on: 32 ldap_int_poll: fd: 32 tm: 1 ldap_is_sock_ready: 32 ldap_ndelay_off: 32 ldap_pvt_connect: 0 TLS: peer cert untrusted or revoked (0x42) TLS: can't connect: (unknown error code). ldap_err2string ...and letting the first request to be to the myAD server (soon after a restart): ldap_create ldap_url_parse_ext(ldaps://myopenldap.units.it) ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP myopenldap.units.it:636 ldap_new_socket: 33 ldap_prepare_socket: 33 ldap_connect_to_host: Trying xxx.xxx.xxx.xxx:636 ldap_pvt_connect: fd: 33 tm: 10 async: 0 ldap_ndelay_on: 33 ldap_int_poll: fd: 33 tm: 10 ldap_is_sock_ready: 33 ldap_ndelay_off: 33 ldap_pvt_connect: 0 TLS: peer cert untrusted or revoked (0x42) TLS: can't connect: (unknown error code). ldap_err2string I suspect the "cacertfile" attribute is not correctly re-instantiated and only the value of the first request is used to check against when instantiating a new ldaps connection. Any suggestions? -- Daniele ALBRIZIO - albrizio(a)univ.trieste.it

4 6

First-Login
by Rtz Poknat 04 May '11

04 May '11

can u help me how can CAN I DO THIS in freeradius its like i want a certain user to be expired after x minutes since his first login thanks

1 0

Multiple groups per user
by googerdi 03 May '11

03 May '11

Hi I want to have multiple groups per user but radius choose only the highest priority group with lowest number. How can i enable this feature for mysql module if exists! Thanks-- View this message in context: http://freeradius.1045715.n5.nabble.com/Multiple-groups-per-user-tp4362664p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

ldap server connection timeout
by Daniel Davidson 03 May '11

03 May '11

My new wireless network tested great, but now that I have rolled it out to the entire building, I get error messages like: Mon May 2 15:15:06 2011 : Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. And when these trigger, nearly everyone gets disconnected for about 5 seconds. Possible relevant code from ldap module: ldap { #private stuff ldap_connections_number = 15 timeout = 10 timelimit = 10 net_timeout = 5 } The only existing firewalls are on the machines themselves and the ip range of the servers are open with each other. Any ideas? Dan

3 2

Freeradius, bind addresses, and multihoming
by Gary T. Giesen 03 May '11

03 May '11

I've compiled freeradius with the --with-udpfromto directive. Everything works as expected when I bind to all IPs: listen { ipaddr = * port = 1812 type = auth } listen { ipaddr = * port = 1813 type = acct } However, if I specify multiple IPs to bind to (rather than just one or all), it reverts to the the behaviour of responding to all requests with a source IP of the first bind directive listed. For example: listen { ipaddr = 192.168.1.250 port = 1812 type = auth } listen { ipaddr = 192.168.1.250 port = 1813 type = acct } listen { ipaddr = 1.2.3.4 port = 1812 type = auth } listen { ipaddr = 1.2.3.4 port = 1813 type = acct } In this configuration, freeradius will always respond from 192.168.1.250, even if the initial request was sent to 1.2.3.4. This is obviously breaking things for me, as I'd rather not have freeradius listen on every interface on the server (and there are a number of them). Am I doing something wrong? Am I expecting the wrong behaviour? Or is this a bug? GG

4 6

Re: ldap server connection timeout
by Daniel Davidson 03 May '11

03 May '11

Upon seeing Alan's response, i took the step of installing openldap on the radius machine and then trying it with the ldap module pointing to localhost. I am still seeing the same results from this. The server is up and taking requests. Any other ideas as to what could be causing this? Dan On 05/03/2011 05:00 AM, freeradius-users-request(a)lists.freeradius.org wrote: > Daniel Davidson wrote: >> > My new wireless network tested great, but now that I have rolled it out >> > to the entire building, I get error messages like: >> > >> > Mon May 2 15:15:06 2011 : Error: rlm_ldap: ldap_search() failed: Timed >> > out while waiting for server to respond. Please increase the timeout. > Make sure your LDAP server is up and reachable. > >> > The only existing firewalls are on the machines themselves and the ip >> > range of the servers are open with each other. Any ideas? > It's a networking issue and has nothing to do with FreeRADIUS. The > server is just a victim of the underlying problem. > > Alan DeKok. >

1 0

Multiple MACs per Network
by John Corps 03 May '11

03 May '11

Just a quick question, hope someone has an answer. Does anyone know how, or if its even possible, to do mac filtering for multiple networks? Say I have 1 AP with 2 WLAN SSIDs, I want list of macs allowed access to SSID1 but not SSID2 and list of macs allowed access to SSID2 and not SSID1. As far as I can see now it is a global list for mac authentication and will be applied to all SSIDs. I noticed in the "CALLED-STATION-ID it says the SSID at the end, for example 00-00-00-00-00-00:SSID. If anyone has any insight into this, that would be greatly appreciated. Thanks.

2 10

freeradius authentification ldap and windows 7 (PEAP mschapv2)
by rene.gomez＠laposte.net 03 May '11

03 May '11

Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

1 0

Mikrotik-Rate-Limit issue
by speedlnx 02 May '11

02 May '11

Hello, i'm migrating from freeradius 1.x to freeradius 2.1.10 on debian. I've replicated all the configuration i have on the old radius to the new and I import a dump of the mysql database on the new mysql server but i've an issue when i try to authenticate my users: radtest xxxxxxx.xxxxxx xxxxxx localhost 1812 mysupersecretpwd Sending Access-Request of id 18 to 127.0.0.1 port 1812 User-Name = "xxxxxxx.xxxxxx" User-Password = "xxxxxx" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=18, length=20 The freeradius debug give me this: Sun May 1 13:24:02 2011 : Info: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 36449, id=18, length=64 User-Name = "xxxxxxx.xxxxxx" User-Password = "xxxxxx" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Sun May 1 13:24:29 2011 : Info: # Executing section authorize from file /etc/freeradius/radiusd.conf Sun May 1 13:24:29 2011 : Info: +- entering group authorize {...} Sun May 1 13:24:29 2011 : Info: ++[preprocess] returns ok Sun May 1 13:24:29 2011 : Info: ++[chap] returns noop Sun May 1 13:24:29 2011 : Info: ++[mschap] returns noop Sun May 1 13:24:29 2011 : Info: [suffix] No '@' in User-Name = "xxxxxxx.xxxxxx", looking up realm NULL Sun May 1 13:24:29 2011 : Info: [suffix] No such realm "NULL" Sun May 1 13:24:29 2011 : Info: ++[suffix] returns noop Sun May 1 13:24:29 2011 : Info: [sql] expand: %{User-Name} -> xxxxxxx.xxxxxx Sun May 1 13:24:29 2011 : Info: [sql] sql_set_user escaped user --> 'xxxxxxx.xxxxxx' Sun May 1 13:24:29 2011 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Sun May 1 13:24:29 2011 : Info: [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' and attivato=1 ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'xxxxxxx.xxxxxx' and attivato=1 ORDER BY id Sun May 1 13:24:29 2011 : Debug: WARNING: Found User-Password == "...". Sun May 1 13:24:29 2011 : Debug: WARNING: Are you sure you don't mean Cleartext-Password? Sun May 1 13:24:29 2011 : Debug: WARNING: See "man rlm_pap" for more information. Sun May 1 13:24:29 2011 : Info: [sql] User found in radcheck table Sun May 1 13:24:29 2011 : Info: [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'xxxxxxx.xxxxxx' ORDER BY id Sun May 1 13:24:29 2011 : Error: rlm_sql: Failed to create the pair: Invalid octet string "512k/2048k 512k/2048k 192k/960k 8/8 1 128k/128k" for attribute name "Mikrotik-Rate-Limit" Sun May 1 13:24:29 2011 : Error: rlm_sql (sql): Error getting data from database Sun May 1 13:24:29 2011 : Error: [sql] SQL query error; rejecting user Sun May 1 13:24:29 2011 : Debug: rlm_sql (sql): Released sql socket id: 4 Sun May 1 13:24:29 2011 : Info: ++[sql] returns fail Sun May 1 13:24:29 2011 : Info: Delaying reject of request 0 for 1 seconds Sun May 1 13:24:29 2011 : Debug: Going to the next request Sun May 1 13:24:29 2011 : Debug: Waking up in 0.9 seconds. Sun May 1 13:24:30 2011 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 18 to 127.0.0.1 port 36449 Sun May 1 13:24:30 2011 : Debug: Waking up in 4.9 seconds. Sun May 1 13:24:35 2011 : Info: Cleaning up request 0 ID 18 with timestamp +27 Sun May 1 13:24:35 2011 : Info: Ready to process requests. I've of course the mikrotik dictionary with the correct attribute and there's a record in the database with the rate limit for the user in radreply table. Any idea? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Mikrotik-Rate-Limit-issue-tp4363178… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

Help with freeradius 2.1 with Mikrotik parameter
by Michell 02 May '11

02 May '11

Hello people, I just did an installation with debian squeeze freeradius / freeradius-mysql 2.1.10 + dfsg-2. He had previously debian Etch with freeradius 1.1.1-3 installed and running normally. I made corrections to the layout settings in the current package, the service starts normally. But when I radtest a user with a connection to the Mikrotik get the following error: "Failed to create the pair: Invalid octet string 2M/2M" for attribute name "Mikrotik-Rate-Limit." Mikrotik-Rate-Limit in the dictionary of my radius server. I use this setting usually in version 1.x. I've made several changes to this field and all I return the same error. Removing this information from the user table radgroupreply normally connects. Any suggestions? I thank the attention and help from you. - Mon May 2 17:11:56 2011: Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql # 4 Mon May 2 17:11:56 2011: Info: rlm_sql_mysql: Starting connect to MySQL server for # 4 Mon May 2 17:11:56 2011: Info: rlm_sql (sql): Connected new DB handle, # 4 Mon May 2 17:11:56 2011: Info: Loaded virtual server <default> Mon May 2 17:11:56 2011: Info: Ready to process requests. Mon May 2 17:12:04 2011: Error: rlm_sql: Failed to create the pair: Invalid octet string 2M/2M "for attribute name" Mikrotik-Rate-Limit " Mon May 2 17:12:04 2011: Error: rlm_sql (sql): Error getting date from database Mon May 2 17:12:04 2011: Error: [sql] SQL query error; Rejecting user Mon May 2 17:12:04 2011: Auth: Invalid user: [User @ domain / password] (from client localhost port 0)

1 1