November 2013 - Freeradius-Users - lists.freeradius.org

FR 3 + Ldap-Group check during the authorization
by C.D. 15 Nov '13

15 Nov '13

Hi, We currently try the official freeradius 3.0 version for migration of the configs from FR2. In our FR 2.x setup, we use Ldap-Group checks during the authorization process. This is configured by unlang and a policy like: [policy.conf] checkusers { if (Ldap-Group == "GROUP1") { update reply { Tunnel-Type = 13 Tunnel-Medium-Type = 6 Tunnel-Private-Group-Id = 100 } ok } elsif (Ldap-Group == "GROUP2") { update reply { Tunnel-Type = 13 Tunnel-Medium-Type = 6 Tunnel-Private-Group-Id = 100 } ok } else { reject } } The checks are made in the default server: [sites-available/default] authorize { preprocess ldap checkusers mschap : } Each group check works, but produce all the time a log message: "Invalid operator for item Ldap-Group: reverting to '=='" In the debug, we got this: <DEBUG> : rlm_ldap (ldap): Released connection (4) (0) User is not a member of specified group Invalid operator for item Ldap-Group: reverting to '==' (0) ? if (Ldap-Group == "GROUP1") -> FALSE (0) ? elsif (Ldap-Group == "GROUP2") : </DEBUG> When we put the checkusers into the post-auth, the log message with invalid operator are gone. What is wrong here ? Why the message "Invalid operator for item Ldap-Group: reverting to '=='" pops up in authorize but not in post-auth process ? With regards, C.

2 1

radreply and radgroupreply attrs
by Bill Schoolfield 15 Nov '13

15 Nov '13

What is the behavior when the same attribute for a given user is present in both radreply and radgroupreply? I assume the = and := operators come into play but which table's attribute is added first? Bill

2 1

Dual Stack RadSec
by Adam Bishop 14 Nov '13

14 Nov '13

Good Afternoon, The RadSec listen {} block is quite substantial - is there a way to keep the same tls configuration for both IPv4 and IPv6 listeners without maintaining two identical copies of the TLS block? Alternatively, does FreeRADIUS3 support v4 mapped addresses (i.e. ::ffff:x:x:x:x)? I did a quick test just now but didn't see any thing appear in the debug log. Adam Bishop Systems Development Specialist gpg: 0x6609D460 t: +44 (0)1235 822 245 xmpp: adamb(a)jabber.dev.ja.net Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

8 11

rlm_eap: No such sub-type for default EAP type peap
by Michael kevin 14 Nov '13

14 Nov '13

Hello I have a problem about "rlm_eap: No such sub-type for default EAP type peap" after I install the openssl,but the problem is still not resolved. Now I am testing EAP authentication process by using eapol_test tool,Iwant to write a my module for our own project to provide some AAA functions. Below are some steps that I did in the EAP authentication test. I mostly followed the two sites < http://www.freesoftwaremagazine.com/articles/howto_incremental_setup_freera…> and<http://deployingradius.com/scripts/eapol_test/> and a book named <FreeRADIUS Beginner's Guide>. all the test about <Local authentication without EAP>、<authenticate via a remote authenticator>、<Getting the simplest EAP method into the picture: EAP-MD5>were successed. But when I do the <Full swing with EAP-TLS, EAP-TTLS and PEAP> test ,it failed. Below are something i do about the users file and the configuration files: 1.I added a user in the users file 2.As my environment is Ubuntu10.04,my freeradius is installed using source(./configure->make->make install),it locates at /usr/local/etc/raddb/ ,I edit the eap.conf as below: I just changed the default_eap_type = md5 to default_eap_type = peap but then when I run radiusd -X,it turns out the below errors: rlm_eap: No such sub-type for default EAP type peap /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/default[310]: Failed to load module "eap". /usr/local/etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. Can anybody help me and give me some suggestions? Thank you very much!!!

2 3

Re: strangeness with Meru Controller
by Bruce Nunn 14 Nov '13

14 Nov '13

Do you really want to use Meru? I admined them for years. There are reasons their licensing is I expensive.

1 0

rlm_perl
by Russell Mike 14 Nov '13

14 Nov '13

Hi List, i have working rlm_sqlcounter but have limitation of 4GB. I found that rlm_perl is a solution for this problem but i cant find any example of perl data counter. someone please help Thanks RM --

2 1

CHAP, Cleartext-Password and External Script
by Prash K 13 Nov '13

13 Nov '13

Hi, I have searched high and low but I could not find answer to my problem. It may be a very simple problem for the expert users out here. Basically I'm using radius server to perform 802.1x authentication. In my set up, I use an external authentication script (written in python) which accepts user and password. I have successfully proven this set up on eapol_test with EAP-TTLS (PEAP). I perform exec in post-auth section of default. Something like this in users: Auth-Type = Accept Exec-Program-Wait = "/path/to/myscript.py %{User-Name} %{User-Password} This works fine with EAP-TTLS (PEAP). But as you know Windows built in supplicant defaults to CHAP. So I'm keen to get that working. I understand that freeradius needs to know the password (Cleartext-Password) but I can't set that in users file. I don't use ldap or sql modules. I can amend my script to print the password once it has authenticated against the external source. But how do I call my script and set the Cleartext-Password (using the script output) so that CHAP could be performed? Thanks.

6 6

Freeradius with openldap
by Mik J 13 Nov '13

13 Nov '13

Hello, I've managed to set up freeradius with sql. When a user authenticates, the freeradius server returns the nas some attributes. In my case: Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = 4 Now I'm trying to use openldap to authenticate my user # radtest myuser mypassword 127.0.0.1 1812 mysecret This command works. The mysecret is stored into the nas table and myuser/mypassword is stored in the openldap server. So I would say that the connectivity with the ldap server works perfectly But the command doesn't return the attributes I want. In the file sites-enabled/default I have authorize { #files #sql ldap I'm confuse how freeradius will proceed - Search for myuser in the ldap using the account I provided in modules/ldap - Check the users password - Should openldap return the attributes I mentioned above or can this be done with mysql ? - I'd like to return these attributes if myuser belongs to mygroup, mygroup is created in openldap and myuser belongs to mygroup I've seen the section in modules/ldap but I don't know how to test if I configured is correct groupname_attribute = cn groupmembership_filter = "(&(objectclass=posixGroup)(memberUid=%u))" Any advice is appreciated. Thank you

4 8

Problem testing using NTradping or radtest
by trevor obba 13 Nov '13

13 Nov '13

I am running freeradius 2.2.0 configure as eduroam servers which is authenticate to Active directory Here is my eduroam site-enable file (virtual server): server eduroam { authorize { update request { Operator-Name := "1mdx.ac.uk" # the literal number "1" above is an important prefix! Do not change it! } auth_log suffix eap } authenticate { ntlm_auth eap } preacct { suffix } accounting { } post-auth { reply_log f_ticks Post-Auth-Type REJECT { reply_log f_ticks } } pre-proxy { pre_proxy_log if("%{Packet-Type}" != "Accounting-Request") { attr_filter.pre-proxy } } post-proxy { post_proxy_log attr_filter.post-proxy } The configuration works fine when I tested it from wireless device such as windows PC, iPhone or android device etc. However when I tested it using NTRadPing or radtest that is “radtest testuser testpast localhost 1812 testing123” I got Access-Reject When I logged in using the credential testuser from a wireless device I am able to authenticate but not on NTradping or using radtest. Testuser is active directory user account and where NTRadping was executed from is in cliect.conf file, localhost and testing123 (share secret) are also allowed in client.conf . However I got the following error message: [eap] No EAP-Message, not doing EAP ++[eap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Can you help? Please

5 4

strangeness with Meru Controller
by Rui Ribeiro 13 Nov '13

13 Nov '13

Dear all, We have are switching to Meru here, using a FreeRadius 2.12 Debian stock with EDUROAM/EAP-TTLS-MSCHAPv2 + AD authentication, just for the sake of completeness. What happens is that whilst with our Cisco Controller, the username in the SQL User Accounting is the same as the one in authentication, when dealing with the Meru Controllers, the user in Accounting has no realm/domain unless I copy expressly the User-Name from the inner-tunnel to the outer-tunnel. Has anyone has had that problem? Best regards, Rui Ribeiro ISCTE-IUL

2 1