October 2012 - Freeradius-Users - lists.freeradius.org

Using ldap_xlat in unlang with Chars not allowed in an ldap search
by Daniel Finger 01 Oct '12

01 Oct '12

Hi! I have a Problem using the ldap Module to search in the ldap Tree for a specific Attribute Containing a (. I am using FreeRadius (2.1.12) for 802.1X Authentification (EAP-TLS) which is working fine. After successful EAP Authentication, I want to check if the User has an Entry in the LDAP: During authenticate (I just changed a bit of formattig to have it readable here): Auth-Type eap { eap # Some Code to react to EAP Auth Failures if ( "%{TLS-Client-Cert-Common-Name}" != "" ) { update control { Tmp-String-1 = "%{ldap_WLAN_auth: ldap:///cn=UserAccounts,dc=DE?cn?sub? ( & (CommonName=%{TLS-Client-Cert-Common-Name}) (allowedSSID=%{Aruba-Essid-Name}) )}" } if ("%{control:Tmp-String-1}" == "") { update control { Auth-Type := "Reject" } update reply { Reply-Message = "The user %{User-Name} is not known or allowed to access the SSID %{Aruba-Essid- Name}" } reject } Now the {TLS-Client-Cert-Common-Name} contains a ( and a ) which leads to a bad search filter: |Debug: [ldap_WLAN_auth] - ldap_xlat |Info: expand: ldap:///cn=UserAccounts,dc=NI-NGN,dc=DE?cn?sub?(&(CommonName=%{TLS-Client-Cert-Common-Name})(allowedSSID=%{Aruba-Essid-Name})) -> ldap:///cn=UserAccounts,dc=DE?cn?sub?(&(CommonName=Testuser(10) Daniel)(allowedSSID=ssid-data)) |Debug: [ldap_WLAN_auth] ldap_get_conn: Checking Id: 0 |Debug: [ldap_WLAN_auth] ldap_get_conn: Got Id: 0 |Debug: [ldap_WLAN_auth] performing search in cn=UserAccounts,dc=DE, with filter (&(CommonName=Testuser(10) Daniel)(allowedSSID=ssid-data)) |ldap_search() failed: Bad search filter: (&(CommonName=Testuser(10) Daniel)(allowedSSID=ssid-data)) |Debug: [ldap_WLAN_auth] Search returned error |Debug: [ldap_WLAN_auth] ldap_release_conn: Release Id: 0 |Info: expand: %{ldap_WLAN_auth:ldap:///cn=UserAccounts,dc=DE?cn?sub?(&(CommonName=%{TLS-Client-Cert-Common-Name})(allowedSSID=%{Aruba-Essid-Name}))} -> If I have searched correctly it should work if I rewrite the Attribute with \28 for ( and \29 for ) (as ascii string, not escaped :-)) As it seems the rewrite Module is not the solution as i could not get it to do this :-) It works as I expected it to do if the CommonName does not contain the Parentheses. Any Ideas to work around these Parentheses? Preferably using any Char allowed in the Common Name, as i expect it to contain Umlauts or an & Char. Greetings, Daniel

2 3

Group verification with Multiple SSID
by Chitrang Srivastava 01 Oct '12

01 Oct '12

Hi, I have a use case where I have 2 SSID and 2 databases of users , one locally configured users in a group and other set of users on a LDAP server. SSID 1 - > Local group of users on radius server SSID 2 -> Set of user configured in LDAP Authentication : PEAP- MSCHAPv2 I have modified mschap module to do ntlm_auth for SSID2 and use default mschap module for SSID 1, So now I have 2 mschap module in my radiusd.conf and uses unland to place if-elsif condition in authroize and authenticate block. Above setup is working fine. But I also need to verify ldap group ( i.e. user belongs to group or not) , Issues is , for SSID 1 users , radiusd is trying to do a group comparison on ldap server , which eventually fails. I guess the reason for this we have 1 users file and for each user radiusd refers that , Their should be way for radiusd to know which user file to refer for each SSID. To solve the issues I have create 2 users file users - > for LDAP users group policy users_local -> for local users create 2 modules like this: *files_local* { usersfile = ${confdir}/*users_local* *----> Above created file* acctusersfile = ${confdir}/acct_users compat = no } and modified *authroize* block if (Wlan == "local") { * files_local * } elsif (Wlan == "ldap") { redundant { ldap_primary ldap_secondary } } else { *files_local* } It seems to be working , Just wanted to check with experts here , is this is the way to go ? or their is some other simpler way ?

2 1

Radius Stress testing
by QASIM RAO 01 Oct '12

01 Oct '12

hi, i doing stress testing of my freeradius with help of perl script. when i run perl script i runs and gives output, but in log file it genrate an error Mon Oct 1 04:45:46 2012: Error: rlm_radutmp: No Accounting-Status-Type record. on each request and when i run radiusd in debug mode radiusd -X it it shows same error and not going in procedure... and shows rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d:%H expands to /usr/local/var/log/radius/radacct/192.168.1.13/detail-20121001:05 modcall[accounting]: module "detail" returns ok for request 932rlm_radutmp: No Accounting-Status-Type record. modcall[accounting]: module "radutmp" returns noop for request 932 modcall[accounting]: module "sql" returns ok for request 932modcall: leaving group accounting (returns ok) for request 932Sending Accounting-Response of id 79 to 192.168.1.13 port 34641 ReturnCode = 1 User-Name = "82723EH5F7560"Finished request 932Going to the next request--- Walking the entire request list ---Cleaning up request 932 ID 79 with timestamp 50695ba0Nothing to do. Sleeping until we see a request. Please help me in this.. regardsRao Qasim

4 6