June 2011 - Freeradius-Users - lists.freeradius.org

Re: LDAP redundant with LDAP-Group within users file
by up＠3.am 30 Jun '11

30 Jun '11

> Just a gap of our users file, we have 18 default lines and additional 4 for a > local/PAP user: > > > DEFAULT Auth-Type := LDAP, Huntgroup-Name == consoleserver, LDAP-Group == > "<LDAP-GROUP-Team-a>" > Login-Service = Telnet > FWIW, since it's the LDAP-Group attribute that you're having trouble with, we are doing LDAP auth with POSIX style LDAP auth data and I believe it gets around this by simply using the old "Group" attribute from before we migrated from PAP/unix (but still gets from LDAP): DEFAULT Group == acme, Pool-Name :="acme_pool", Auth-Type = Ldap This is a smaller network with 1 fallback LDAP server, and I know that the fallback is working and I'm pretty sure it passes on the proper group info to assign the correct IP pool in this case. It may not work with non-POSIX LDAP groups though...

1 0

patch files for pam_radius - adding an 'Always Prompt' option for one-time passcodes
by Nick Owen 30 Jun '11

30 Jun '11

We recently had a customer that wanted to check a password against AD via kerberos and then an one-time passcode against a WiKID Strong Authentication server via radius. We found that PAM passed the AD password to our OTP server, which failed. We have added a pam option "always prompt" in the attached code. This will force a "WiKID passcode:" prompt regardless of any previous password entry. The /etc/pam.d/sshd file looks like: Here's the /etc/pam.d/sshd: #%PAM-1.0 auth required /lib/security/pam_krb5.so auth requisite /lib/security/pam_radius_auth.so always_prompt account required pam_nologin.so account include system-auth password include system-auth session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so No changes to system-auth were made. The /etc/ssh/sshd_config looks like: Protocol 2 SyslogFacility AUTHPRIV PasswordAuthentication yes ChallengeResponseAuthentication yes GSSAPIAuthentication yes UsePAM yes AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL X11Forwarding yes UseDNS no Subsystem sftp /usr/libexec/openssh/sftp-server The key change is that ChallengeResponseAuthentication is yes. Hopefully, others will find this of use. Nick -- Nick Owen WiKID Systems, Inc. 404.962.8983 http://www.wikidsystems.com Commercial/Open Source Two-Factor Authentication

3 2

Re: LEAP Authentication?
by Alan Buxey 30 Jun '11

30 Jun '11

Client not responding to the access challenge, client issue alan

6 9

freeradius and IdenticalClients
by Franz Angeli 30 Jun '11

30 Jun '11

Hi i'm trying to migrate my radiator server to freeradius, i have to use something like "IdenticalClients" on radiator: # TEST <Client 10.1.131.1> # Specifies a list of other clients that have an identical setup. # You can use this parameter to avoid having to create separate # Client clauses for lots of otherwise identical clients IdenticalClients X.X.X.X Y.Y.Y.Y Z.Z.Z.Z # Secret is the shared secret between client and this server # Any number of characters, any character except newline # You must set a secret in every Client clause. Secret somesecret # Use this to set a default realm for requests that dont # already have one. This can trigger a specific Realm # statement for users who log in to this NAS without a # realm DefaultRealm FQDN </Client> can i replicate this configuration on freeradius? Thanks in advance Franz

3 2

Re: LDAP redundant with LDAP-Group within users file
by Jan.Gnepper＠t-systems.com 30 Jun '11

30 Jun '11

> I will try to test this. Thank you very much! >What OS are you on, and what LDAP libraries & version of those libs are you using? RHEL Server 5.6 (64 bit), Kernel 2.6.18-238.5.1.el5 # rpm -qa | grep -i ldap php-ldap-5.1.6-27.el5_5.3 openldap-clients-2.3.43-12.el5_6.7 openldap-2.3.43-12.el5_6.7 python-ldap-2.2.0-2.1 mozldap-6.0.5-1.el5 freeradius2-ldap-2.1.7-7.el5 nss_ldap-253-37.el5 nss_ldap-253-37.el5 openldap-2.3.43-12.el5_6.7 #

1 0

Re: Re: LDAP redundant with LDAP-Group within users file
by Jan.Gnepper＠t-systems.com 29 Jun '11

29 Jun '11

>> Problem: radius is using always the same ldap server for group extends. >> If this (one!) server fails, radius authentication is not possible. >> Very bad, because we have "redundancy" configured, and expected to have zero outage. >Sorry. The "ldap" module and FreeRADIUS do not work that way. >"LDAP-Group" is a virtual attribute, that is registered by the first >LDAP module to be created; it can't "fail over". It doesn't know about >"redundant {}" or similar. OK, thanks for detailed answer. I read in other threads ansers that already point to that fact. >> Defining all three server whithin one section in modules/ldap >> >> ldap { >> server = "<IP ldap-1> <IP ldap-2> <IP ldap-3>" >> .} >> >> And setting just "ldap" within authorize and authenticate: >> >> With this config an other ldap server is choosen, if the one that has handelt the communication for ldap group extends fails. But failover took 15 minutes. Thats much too long for us. >> (1-3 minutes at most will be acceptable, "zero outage" gorgeous/expected) >It should not take 15 minutes. >What is your "net_timeout" set to? net_timeout = 1 timelimit = 2 timeout = 4 For testing i added a hostroute to an other gateway (=host unreachable) >Unfortunately, when you supply >1 LDAP server, this is handled >internally by libldap, and libldap tries the LDAP servers in series, not >in parallel. So there will always be some outage. As i wrote in my first post, short outage would be ok, but 15 minutes was too much. I added the hostroute to the server that opend the first connection when a request came in (i thought that this is the call regarding ldap-group). That was normaly the last from the list (server=...). I made serveral requests, but all end with "server unreachable / reject". But i could see in tcpdump, that after 15 minutes a lot of connections to an other ldap server were opend. >From this moment, all new requests were successfull, to an other ldap. >FreeRADIUS does not currently have connection pools, and they're a bit >hard with LDAP because libldap doesn't have a great API. >> >> I found mails regarding similar problems within the archive, but no suitable solution. >> (e.g http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg23408.… from 2006) >> >> Is there a solution for reducing the outage and having loadbalancing for our case? >At the moment, the "ldap" module does not have the kind of instant >failover you're looking for. You will need some kind of IP loadbalancing >solution in front of your LDAP servers to achieve this. Not as easy as it sounds ;-) 12 radius pairs (singe server with the same config) at 10 locations, 3 ldap server at 3 different locations For countervail lost of one or two locations, loadbalancing will be very complex.

3 2

Error with Thread
by Jean Carlos Oliveira Guandalini 29 Jun '11

29 Jun '11

Hello, i'm using version 1.1.8, my OS is Linux (Gentoo). My server stop and log this: Error: FATAL: Thread create failed: Resource temporarily unavailable Before this log, have: Wed Jun 29 00:16:13 2011 : Error: Dropping conflicting packet from client client1:41250 - ID: 195 due to unfinished request 155365 Wed Jun 29 00:16:13 2011 : Error: Dropping conflicting packet from client client2:59253 - ID: 235 due to unfinished request 155374 My config for start server is: start_servers = 200 max_servers = 200 min_spare_servers = 10 max_spare_servers = 200 max_requests_per_server = 0 The server only returns if I restart the service Thanks Jean

2 4

Cisco Accounting Attributes
by Arran Cudbard-Bell 29 Jun '11

29 Jun '11

Dear List Users, Would anyone happen to know if the Cisco Aironet 1130AG is capable and willing to provide client IP addresses in Accounting Starts/Stops/Updates? Theoretically it must know the IP address of connected clients, because it does that fancy ARP caching stuff, but it seems like it needs some special hidden command to prod it into sending this information to the RADIUS server. Yes.. I know, not FreeRADIUS related, flame me later... Many Thanks, Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Half the complexity of Diameter

1 0

Consigue acceso a mis imágenes y más
by Horacio Andrade 29 Jun '11

29 Jun '11

Hola: He creado una cuenta en Netlog con mis imágenes, vídeos, blogs y eventos. Quiero agregarte a mi lista de amistades para que puedas verlo, ¡pero antes tienes que registrarte en Netlog! Cuando te conectes podrás crear tu propio perfil. Échale un vistazo: http://es.netlog.com/go/mailurl/-bT0xODQyNDgyNjAzJmw9MSZnbT0xMiZ1PSUyRmdvJT… Saludos, Horacio ---------------------------------------------------------------- ¿No quieres recibir más invitaciones de tus amigos? http://es.netlog.com/go/mailurl/-bT0xODQyNDgyNjAzJmw9MiZnbT0xMiZ1PSUyRmdvJT… Don't want to receive invitations from your friends anymore? http://es.netlog.com/go/mailurl/-bT0xODQyNDgyNjAzJmw9MyZnbT0xMiZ1PWh0dHAlM0…

1 0

802.1x auth EAP-TLS problem
by Marco Londero 29 Jun '11

29 Jun '11

Hi folks, I have a problem in my freeradius setup and I'm looking for some hints about that. Scenario: 1) GNU/Linux client w/ WPA supplicant configured to request access through EAP-TLS using a certificate (in order to achieve 802.1x ethernet authentication) 2) 802.1x enabled switch where client is connected 3) user/pass 802.1x authentication works fine (MSCHAPv2 based) 4) freeradius authenticates users on LDAP Freeradius debug log of the issue is here: ------- http://pastie.org/2132916 ------- All certificates should be ok (both on server and client): ------- FP42A certs # openssl verify ca.pem ca.pem: OK FP42A certs # openssl verify server.pem server.pem: OK FP42A certs # openssl verify 02.pem 02.pem: OK ------- Any tips? Thank you! -- mandi, Marco

4 6