June 2011 - Freeradius-Users - lists.freeradius.org

LDAP redundant with LDAP-Group within users file
by Jan.Gnepper＠t-systems.com 28 Jun '11

28 Jun '11

Hi, We use radius (freeradius2-2.1.7-7.el5) for user authentication/authorization on network devices. Therefore we use a mapping from huntgroups to ldap groups. We have three ldap server running, and wanted to use "redundant" or "redundant-load-balance". I have tested two cases till now, because i already found messages that point to known problems with ldap redundancy and extends (ldap-groups) within the users file. Case 1 ================ Defining 3 separate ldap server whithin modules/ldap ldap ldap-1 { server = "<IP ldap-1>" .} ldap ldap-2 { server = "<IP ldap-2>" .} ldap ldap-2 { server = "<IP ldap-3>" And using "redundant" for ldap whithin authorize and authenticate: authorize { preprocess files redundant { ldap-1 ldap-2 ldap-3 handled } pap } authenticate { Auth-Type PAP { pap } Auth-Type ldap-1 { ldap-1 } Auth-Type ldap-2 { ldap-2 } Auth-Type ldap-3 { ldap-3 } Auth-Type LDAP { redundant { ldap-1 ldap-2 ldap-3 handled } } } Problem: radius is using always the same ldap server for group extends. If this (one!) server fails, radius authentication is not possible. Very bad, because we have "redundancy" configured, and expected to have zero outage. Case 2 ================ Defining all three server whithin one section in modules/ldap ldap { server = "<IP ldap-1> <IP ldap-2> <IP ldap-3>" .} And setting just "ldap" within authorize and authenticate: authorize { preprocess files ldap pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } } With this config an other ldap server is choosen, if the one that has handelt the communication for ldap group extends fails. But failover took 15 minutes. Thats much too long for us. (1-3 minutes at most will be acceptable, "zero outage" gorgeous/expected) I found mails regarding similar problems within the archive, but no suitable solution. (e.g http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg23408.… from 2006) Is there a solution for reducing the outage and having loadbalancing for our case? I hope that i explained my problem in an understandingly (native language is german), and didn´t paste too much configs. Jan Just a gap of our users file, we have 18 default lines and additional 4 for a local/PAP user: DEFAULT Auth-Type := LDAP, Huntgroup-Name == consoleserver, LDAP-Group == "<LDAP-GROUP-Team-a>" Login-Service = Telnet DEFAULT Auth-Type := LDAP, Huntgroup-Name == consoleserver, LDAP-Group == "<LDAP-GROUP-Team-b>" Login-Service = Telnet DEFAULT Auth-Type := LDAP, Huntgroup-Name == consoleserver, LDAP-Group == "<LDAP-GROUP-Team-c>" Login-Service = Telnet DEFAULT Auth-Type := LDAP, Huntgroup-Name == "nexus", LDAP-Group == "<LDAP-GROUP-Team-a>" Login-Service = Telnet, Vendor-Specific = 9, Cisco-AVPair = "shell:roles*\"network-admin\" \"vdc-admin\"" DEFAULT Auth-Type := LDAP, Huntgroup-Name == "brocade", LDAP-Group == "<LDAP-GROUP-Team-a>" Vendor-Specific = 1991, Foundry-Privilege-Level = 0, foundry-command-string="*", foundry-command-exception-flag=0 DEFAULT Auth-Type := LDAP, LDAP-Group == "<LDAP-GROUP-Team-a>" Service-Type = Administrative-User, Login-Service = Telnet, Vendor-Specific = 9, cisco-avpair = "shell:priv-lvl=15"

3 3

Changing the User-Name value from a request
by Tiberiu Breana 28 Jun '11

28 Jun '11

Hello. I'm using freeRADIUS to authenticate SIP requests and I'm having problems processing the users. In a request I receive a User-Name that isn't useful, and a Sip-URI-User value which contains the real User-Name that I need. I've tried if(Sip-URI-User) { update request { User-Name = Sip-URI-User } } in default's authorize section, but it says "request returns notfound". I've tried User-Name = Sip-URI-User in the preprocess section of radiusd.conf but it doesn't seem to do anything. So, how can I switch the two before proceeding to authenticate the user? Where and what conditions should be placed? I'm kind of in a time crisis and I don't know what to try anymore. Advice is welcome. Thank you.

3 2

change EAP Accept-reject to Accept-Accept
by adzhuma 28 Jun '11

28 Jun '11

Hello, how it's possible change EAP-PEAP Accept-reject to Accept-Accept? I tried with unlang in ms-chap authenticate in inner-tunnel config, but read the documentation for the unlang that the Auth-Type := "Accept" can't be used with EAP. I tried with such config: MSCHAP authentication. Auth-Type MS-CHAP { mschap { reject = 1 } if (reject) { update reply { Framed-IP-Address = "10.0.0.0+" } update control { Auth-Type := "Accept" } ok } Please, help me to solve this issue and how can I change reject to accept. -- View this message in context: http://freeradius.1045715.n5.nabble.com/change-EAP-Accept-reject-to-Accept-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Freeradius + Ldap + SSL/TLS
by RATSIMIVEH Remi 28 Jun '11

28 Jun '11

Hi, I install freeradius on Debian machine. I have my user in ldap and I use that directory to authentication.But when I want to use SSL or TLS in connections between radius and ldap, I have that error in radius log. (Freeradius -X) --------------------------------- [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.corporate.com:1793, authentication 0 [ldap] setting TLS CACert File to /etc/freradius/certs/RootCA.pem [ldap] setting TLS CACert Directory to /etc/freeradius/certs/ [ldap] setting TLS Cert File to /etc/freeradius/certs/RootCA.crt [ldap] setting TLS Key File to /etc/freeradius/certs/SSLSubCA.pem [ldap] setting TLS Key File to /etc/freeradius/certs/ [ldap] bind as uid=...,dc=...,dc=...,dc=.../pssword to ldap.corporate.com:1793 [ldap] waiting for bind result ... [ldap] ldap_result() [ldap] uid=...,dc=...,dc=...,dc=.../pssword to ldap.corporate.com:1793failed: timeout [ldap] (re)connection attempt failed [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns fail --------------------------------- i have in ldap.conf : ldap { server = "ldap.corporate.com" port = 1793 ... tls { # cacertfile = /path/to/cacert.pem # cacertdir = /path/to/certs/ # certfile = /path/to/radius.crt # keyfile = /path/to/radius.key # randfile = /path/to/rnd # require_cert = "demand" cacertfile = /etc/freradius/certs/RootCA.pem cacertdir = /etc/freeradius/certs/ certfile = /etc/freeradius/certs/RootCA.crt keyfile = /etc/freeradius/certs/SSLSubCA.pem randfile = /etc/freeradius/certs/ require_cert = "allow" it's an another team who manage this ldap corporate. This team request me to import the Corporate.Root.CA and Corporate.SSL.CA to be able to SSL connections. About them, my radius server don't used SSL connections. I don't know where put them... Sorry for my English, the french replies will be accepted.....

1 0

Bind username to certificate
by Marco Londero 28 Jun '11

28 Jun '11

Hi folks, is it possible to bind a SSL certificate (used for EAP-TLS auth) to a specific LDAP user instead of using user's LDAP-stored password? Thank you! -- mandi, Marco

2 2

Copy user entries from a server to another?
by Tiberiu Breana 28 Jun '11

28 Jun '11

Hello. Is it possible to copy user entries from a server to another? I have a user that connects to a "foreign" Radius server (AAAF). The AAAF detects his realm and forwards the request to the realm's appropriate Radius server (AAAH). The AAAH authenticates the user and returns the result. What I'd like to do: copy the user entry to the AAAF (username, password, check items, reply items) so that the AAAF can later authenticate the user without having to forward the request. Is this possible? Furthermore, how could I keep the user's data, seeing how unlang doesn't support creating new variables? Any advice is welcome.

4 5

(no subject)
by Waqar Qayyum 28 Jun '11

28 Jun '11

1 0

Radwtmp
by Blake Hodder 28 Jun '11

28 Jun '11

Hi, The file in '/var/log/freeradius/' radwtmp, can this file be removed every so often as it becomes quite large? Also what is it used for exactly. Thanks, Blake --

3 2

Accounting log issue
by Tseveendorj 28 Jun '11

28 Jun '11

Hello, The accounting information not logged in /var/log/freeradius/radacct/IPADDRESS/detail-xxxxx.log and also in MySQL table radacct. How to solve this ? Sincerely, Tseveen.

2 3

Send response to client
by Christ Schlacta 27 Jun '11

27 Jun '11

is it at all possible to send a message to a windows 7 or windows vista client that the client is guaranteed to see when authentication is rejected? more details: wireless WPA2-EAP-TLS on a Ubiquiti PicoStation 2 firmware 5.3.2 (I believe it includes some form of hostapd, but I'm not sure which version) Freeradius Version 2.1.9 Clients running Windows 7 or Windows Vista with no special software installed. the procedure is OS, Wired Driver, ethernet cable, Windows Update once for drivers, Wireless certificate, connect to Wifi, (Note this point) finish updates. It's at the Note this point point that I want the clients to be able to recieve a rejection response with some level of certainty. what users add to their system later is welcome to break it, if they're willing to deal with it.

5 5