August 2011 - Freeradius-Users - lists.freeradius.org

radius + rlm_ldap: alter auth-type if server not reachable
by Thomas Dupas 22 Aug '11

22 Aug '11

Hi, I'm currently using FreeRADIUS v2.1.7 with OpenLDAP v2.3.43 as back-end. After already reading numerous times that ldap failover doesn't work/isn't implemented in the rlm_ldap I had to find another way to provide HA. Currently I'm pointing towards 2 radius servers, each configured with a different ldap server. The problem I'm having is that the radius sends an explicit reject when it can't connect to ldap. This is problematic since the requester will reject the user, instead of trying to contact the second radius. Is there a way to catch the "Can't contact LDAP server"/rlm_fail and send no response at all in that case? From a requester perspective it would be much cleaner to get no response at all (and trying the 2nd radius server) then getting a reject. Br, Thomas

2 3

freeradius & cisco COA
by Student University 21 Aug '11

21 Aug '11

Hi , anyone have like experience to share ,,, Thanks in advance ,,, Lily ,,,

4 3

Re: A little issue with disconnecting users
by Mobin Yazarlou 21 Aug '11

21 Aug '11

>> Could you give a working Packet of Disconnect example cause it will not work if I eliminate "X-Ascend-Session-Svr-Key" or set a NULL value for it. >You don't need X-Ascend-Session-Srv-Key and i've removed it from the example on the wiki... >See here http://wiki.freeradius.org/HP#Radclient+DM+example >-Arran Thanks. I did what you said but it seems that there must be a NAS to get the packet on port 3799 and disconnect the user for me. I have everything on a single machine and there is not any standalone hardware or something to act as a NAS. PPTP and L2TP/IPSec processes serve dialin users and freeRADIUS is used to authenticate them. Is there any lightweight software that I can use as a NAS to solve this? Thanks in advance. Moby

3 5

Radius Testing Tool
by Ben Brown 19 Aug '11

19 Aug '11

Morning all, A few months ago I was changing part of our RADIUS platform. I wanted to thoroughly test the change I was making in our test environment, so I captured a few thousand RADIUS packets from one of our live servers using tcpdump, then used tcpreplay to fire them at the test radius server and then set about comparing the output. I quickly found this to be very tedious and time consuming, so I started looking for a program that would read in the pcap file I'd made with tcpdump, fire the packets at the test server and compare the packet it got back with the response packets in the capture. After some googling I couldn't find anything, so I decided to write one. After using it successfully to test my change, I convinced the management here to let me open source the resulting code, which you can now get from: https://gitorious.org/radreplay/ Now I am a developer, but an Engineer, so my C might not be the best, however I've found this very useful and thought other people might also find it useful. It's simple to use and the output is fairly easy to interpret. It builds and runs fine on 32 and 64 bit Debian GNU/Linux, and doesn't have any dependencies other than the standard c library so should build and run pretty easily on other UNIX based platforms, YMMV. I've distributed the debian directory with it so if you are using Debian you can build a package. Obviously I can't fully support this, any work I do on this is now in my own time, not on the company's time, but if you find problems with it or have suggestions let me know and I'll try to see what I can do. Or if you have improvements clone it and send me a pull request! Regards, Ben -- | Ben Brown Broadband Solutions for | Infrastructure Engineer Home & Business@ | Plusnet Plc www.plus.net | Registered Office: Internet House, 2 Tenter Street, Sheffield, S1 4BY | Registered in England no: 3279013 + --------------- Plusnet - ISPA Best Consumer ISP 2008 ---------------

2 3

A little issue with disconnecting users
by Mobin Yazarlou 19 Aug '11

19 Aug '11

Hi, I am trying to disconnect users with the instructions given at < http://wiki.freeradius.org/Disconnect-Messages>. I made a packet.txt file with the following content: Acct-Session-Id=4E4EB0DE083800 User-Name=amin X-Ascend-Session-Svr-Key= NAS-IP-Address=127.0.0.1 Then run the following command: root@ubuntu:~/kill# cat packet.txt | radclient -x 127.0.0.1:3799 disconnect "testing123" And the result was: radclient:: failed to get value radclient: Nothing to send. Well, "xascendsessionsvrkey" field had no value so I though I have to set it to null. mysql> SELECT radacctid,acctsessionid,username,realm,nasipaddress,nasportid,framedipaddress,xascendsessionsvrkey FROM radacct ORDER BY radacctid DESC LIMIT 1; +-----------+----------------+----------+-------+--------------+-----------+-----------------+----------------------+ | radacctid | acctsessionid | username | realm | nasipaddress | nasportid | framedipaddress | xascendsessionsvrkey | +-----------+----------------+----------+-------+--------------+-----------+-----------------+----------------------+ | 24 | 4E4EB0DE083800 | amin | | 127.0.1.1 | 0 | 10.1.2.2 | | +-----------+----------------+----------+-------+--------------+-----------+-----------------+----------------------+ 1 row in set (0.00 sec) Could you give a working Packet of Disconnect example cause it will not work if I eliminate "X-Ascend-Session-Svr-Key" or set a NULL value for it. Thanks in advance, Moby freeRADIUS version: 2.1.11 Operating System: Ubuntu Netbook 10 (Linux ubuntu 2.6.32-21-generic #32-Ubuntu SMP Fri Apr 16 08:10:02 UTC 2010 i686 GNU/Linux)

2 1

Devices in more than one huntgroup
by Jan.Weiss＠t-systems.com 19 Aug '11

19 Aug '11

>DEFAULT. Huntgroup-Name == "nexus",LDAP-Group == "nexus_RO" >... > >DEFAULT. Huntgroup-Name == "nexus",LDAP-Group == "nexus_RW" >... > >Add your users to groups to suit. While devices can only be in one group, users can be in many. Thanks for the answer! But there are several problems for me: - i have no access to ldap, new groups are not as easy to implement as in small environments - i already have more than 20 DEFAULT-entries for different huntgroup/ldap-group combinations and splitting nexus to nexus_RO and nexus_RW means adding additional 5 entries minimum I´m searching for a more scalable solution. If the next team should get access to different devices, and then the third team to a third group of devices, or other rights...

1 0

Devices in more than one huntgroup
by Jan.Weiss＠t-systems.com 19 Aug '11

19 Aug '11

>Hi, > >I have a little problem with devices in multiple huntgroups. >By now i kno that this is not possible (rtfm helped ;-) > >What i wanted to do is the following: > >Two Teams, but with diffenrent rights. > >Users: >==================== >DEFAULT Auth-Type := LDAP, Huntgroup-Name == "nexus", LDAP-Group == "<Team-1-Group>" > Login-Service = Telnet, > Cisco-AVPair = "shell:roles*\"network-admin\" \"vdc-admin\"" > >DEFAULT Auth-Type := LDAP, Huntgroup-Name == "readonly-nexus", LDAP-Group == "<Team-2-Group>" > Login-Service = Telnet, > Cisco-AVPair = "shell:roles*\"network-operator\" \"vdc-operator\"" > >Huntgroups: >==================== >readonly-nexus NAS-IP-Address == 192.168.11.123 >Nexus NAS-IP-Address == 192.168.11.123 > > >Since only the first match within the huntgroups is checked, team-2 always gets "access-reject". > > >For checking only the NAS-IP-Adress makes sense in our environment. >I already found a hint to use rlm-passwd, but i can?t get this run. > >So i tried the following: > >======================= >Users: >DEFAULT Auth-Type := LDAP, Huntgroup-Name == "nexus", My-Device-Group "Nexus-readonly", LDAP-Group == "<Team-2-Group>" > Login-Service = Telnet, > Cisco-AVPair = "shell:roles*\"network-operator\" \"vdc-operator\"" > >modules/passwd: >passwd Groups_local { > filename = /etc/raddb/groups_local > format = "My-Device-Group:*NAS-IP-Address" > hashsize = 50 > ignorenislike = no > allowmultiplekeys = no > delimiter = ":" >} > >groups_local: >Nexus-readonly:192.168.11.123 > >dictionary: >ATTRIBUTE My-Device-Group 3000 string > >======================= > >Groups_local was placed in authorize section, after preprocess. > >Debug shows: > >Ready to process requests. >rad_recv: Access-Request packet from host 192.168.11.123 port 48910, id=20, length=62 > User-Name = "test" > User-Password = "test" > NAS-Port-Type = Virtual > NAS-Port = 3000 > NAS-IP-Address = 192.168.11.123 >+- entering group authorize {...} >++[preprocess] returns ok >++[groups_local] returns notfound > >Any Idea? >Or is there a big bug in my config (and my mind)? >Thanks! > >Jan Does nobody has an idea what i´m doing wrong? Or any idea how i could realize this? Thanks a lot! Jan

2 1

methods to redirect select users to authenticate to another radius server
by Det Det 18 Aug '11

18 Aug '11

hi, i'm testing radius migration. i plan to do it by phase so it will be safer and would have less impact in case something won't turn out right. users will be grouped and thus will be migrated by group. i'm thinking what are available methods/options to do this? i want to have the new radius server replace the old radius server slowly. old radius should still be running when i deploy the new one. AAA of selected group of users will be redirected to the new one. this will be done recursively until all groups of users are served by the new radius server. only after that will i take the old radius server down. can anyone give some more detailed instructions on how this can be achieved? like can i redirect based on user group? thanks a lot. bregards, det

1 0

Need help authenticating local users on Apple server
by Raymond Norton 18 Aug '11

18 Aug '11

Just installed v 2.1.11 on a mac (OSX 6.3) . Freeradius is working with clear text passwords and radtest. According to the wiki, I should be able to authenticate local users accounts without changing anything on the config. That's the way I understood it anyway. However, I am getting "Access-Reject" errors when using local credentials. What documentation specifically addresses authenticating local users? Raymond

4 12

Unique Identifier
by Luke Hammond 18 Aug '11

18 Aug '11

Can someone please let me know if FreeRADIUS can assign a certain unique ID per client added to the database? I want my client numbers to automatically increment as i add them. i am guessing this is possible?

3 2