September 2013 - Freeradius-Users - lists.freeradius.org

Freeradius + 2 x LDAP + VLAN
by Miroslav Lednicky 16 Sep '13

16 Sep '13

Hello, I have Freeradius 2.1.10 with 2 LDAP servers (ldap1 + ldap2) and Ubuntu 12.04 I using it for 802.1x users. I need switch users from ldap1 to VLAN 1 and users from ldap2 to VLAN 2. I don't know how can i do it. My configuration: /etc/freeradius/modules/ldap: ldap ldap1 { ... server = 1.1.1.1 basedn = ou=users,dc=test,dc=cz ... } ldap ldap2 { ... server = 2.2.2.2 basedn = ou=users,dc=test1,dc=cz .... } /etc/freeradius/sites-enabled/inner-tunnel: authorize { chap mschap unix suffix eap { ok=return } files ldap1 ldap2 expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP1 { ldap1 } Auth-Type LDAP2 { ldap2 } eap } It works. But i need send atributes to switch or Access Point: Tunnel-Type=VLAN, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-Id=1 for users from ldap1 and Tunnel-Type=VLAN, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-Id=2 for users from ldap2 I tried configure it in /etc/freeradius/users, but without success. Thank You for help Miroslav

4 4

Last call for Version 2.2.1
by Alan DeKok 16 Sep '13

16 Sep '13

Unless there are any objections, we'll release 2.2.1 tomorrow. The list of changes is large: https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/doc/ChangeLog Alan DeKok.

3 3

RE: Freeradius 2.1.12 Second LDAP Server
by Beliars Fire 16 Sep '13

16 Sep '13

Hi, thanks for the Help. Actually im decided to create a new VM and reinstall the complete Server. I`m following the complete How-To, but i`m getting two different Errors. The First One is this: It`s under the first Point: Configuring Authentification with Active Directory I`m startet the Samba and Kerberos Services und used this Command: net join -U MyAdministrator > Worked. I`m getting this Message: Using short domain name -- MYDomain Joined 'UBUNTU' to realm 'MYDomain' The next Step wbinfo -a user%password works too, but i`m getting this Error-Message: Could not authenticate user Username%Password with plaintext password challenge/response password authentication succeeded Is this normal? How can I fix it? The Response seems to work correctly. The Second One is this: It`s the last Point on this Page: Configuring FreeRadius to use ntml_auth for MS-CHAP In this Step, i must edit the following line with this text in the file: /etc/freeradius/modules/mschap ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" But my default commented ntml_auth looks like this: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" In my default ntlm_auth, the option "--domain=%{%{mschap:NT-Domain}:-MYDOMAIN}" is missing. Should i add it? Actually i`m using my default uncommented ntlm_auth. So, i`m going to test the MS-CHAP authentification reuqest with this command: $ radtest -t mschap bob hello localhost 0 testing123 And i`m getting this Error-Message: Sending Access-Request of id 251 to 127.0.0.1 port 1812 User-Name = "bob" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 MS-CHAP-Challenge = 0x01774f129c72245c MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000024ff68dcea66e8348622a45aa91804201f2102e9ecc0add6 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=251, length=38 MS-CHAP-Error = "\000E=691 R /etc/freeradius/users First Line: bob Cleartext-Password := "hello" # # Please read the documentation file ../doc/processing_users_file, # or 'man 5 users' (after installing the server) for more information. # .... @Mathieu Is there a current RADIUS-book that you can recommend? -- BeliarsFire

3 2

Last call for Version 2.2.1
by Alan DeKok 16 Sep '13

16 Sep '13

Unless there are any objections, we'll release 2.2.1 tomorrow. The list of changes is large:

2 1

Windows Phone CA verification debugging
by Mathieu Simon 16 Sep '13

16 Sep '13

Hi list While I've been quite successful in making preconfigured profiles and docs for our students on how to make proper proper wireless configuration, I'm encountering some issues with those (yet quite rare) people with Windows Phone 8 (WP8) systems. WP8 devices are yet able to connect without (any) CA or common name verification, but seem to fail when I let them check the CA by choosing it from the device' CA store. (As usual), the client-side error message is not helpful at all (it fails to connect without any error message). On the desktop side one can at least fire up 'netsh ras diagnostics' to trace (P)EAP and CHAP during connection which can help figuring out at least something. But on WP8, well there is no such thing that I've found. Is there anyone on the FR list who already had to mangle a WP8 device? -- Mathieu

2 2

static ip allocation
by Petre Bandac 15 Sep '13

15 Sep '13

hallo I have a rp-pppoe/freeradius/mysql instance running, with ip addresses dynamically allocated from defined pools. I want for some users to have static ip addresses, the same ip at every connect. this can be achieved by manually entering the Framed-IP-Attribute in the radreply table ? or any other settings need to be changed ? Thanks, petre -- Petre Bandac Network Scientist - petre(a)kgb.ro

2 1

Freeradius 2.1.12 Second LDAP Server
by Kevin Bigalke 14 Sep '13

14 Sep '13

Hello, i`m running a Freeradius Server 2.1.12 on a Ubuntu 13.04 VM. The Login with 802.1 works perfectly. I`m using a Windows LDAP Server for the Login and want to add a second LDAP-Server for a Fail Over. I`m following the Tutorials to setup my Freeradius Server: *Click*. I`cant find a suitable Tutorial to adding a second LDAP Server for a Fail Over. Which files are responsible for the integration of a second LDAP server? These are my current Settings: /etc/freeradius/modules/ldap: ldap ldap1 { server = "serv01.xyz.local" basedn = "dc=xyz,dc=local" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no set_auth_type = no keepalive { # LDAP_OPT_X_KEEPALIVE_IDLE idle = 60 # LDAP_OPT_X_KEEPALIVE_PROBES probes = 3 # LDAP_OPT_X_KEEPALIVE_INTERVAL interval = 3 } } ldap ldap2 { server = "serv02.xyz.local" basedn = "dc=xyz,dc=local" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no set_auth_type = no keepalive { # LDAP_OPT_X_KEEPALIVE_IDLE idle = 60 # LDAP_OPT_X_KEEPALIVE_PROBES probes = 3 # LDAP_OPT_X_KEEPALIVE_INTERVAL interval = 3 } } /etc/samba/smb.conf: [global] workgroup = XYZ dns proxy = no security = ads password server = serv01.xyz.local password server = serv02.xyz.local winbind separator = + /etc/freeradius/sites-enabled/inner-tunnel: authenticate { ntlm_auth … /etc/freeradius/sites-enabled/default: authenticate { ntlm_auth … /etc/freeradius/users: DEFAULT Auth-Type = ntlm_auth Thanks for Help! BeliarsFire

5 7

FreeRadius DHCP against LDAP
by Nikolaos Milas 13 Sep '13

13 Sep '13

Hello, A couple of quick questions. 1. Is DHCP functionality supported against an LDAP Server (in v2.2.0)? 2. If so, is there a planned freeradius ldap schema change (in future versions) to include DHCP-* attributes? Please advise. Thanks, Nick

3 15

Problem with multiple groups
by Volker Lieder 13 Sep '13

13 Sep '13

Hi there, we have a setup running for ppp user on a freeradius/mysql base. We recognized that not all group values are given to the user while the login is running. After some debugging we found out, that freeradius didn't get all information from the database while its inside of the tables. Attached you find our used versions, database setting and a sql debug log from a testing user. Tested on debian 6.0.7, 2.1.10+dfsg-2+squeeze1 and debian 7.1, 2.1.12+dfsg-1.2 mysql> select * from radusergroup where username like 'dsluser%';+-----------------+------------------------------+----------+ | username | groupname | priority | +-----------------+------------------------------+----------+ | dsluser(a)realm.net | Default | 1 | | dsluser(a)realm.net | 5Uhr-Trennung | 2 | | dsluser(a)realm.net | Default_dsl-mobile.de | 1 | | dsluser(a)realm.net | PM_DSL_8000 | 1 | +-----------------+------------------------------+----------+ select * from radgroupreply where groupname='PM_DSL_8000'; +----+------------------------------+--------------+----+-------------------------------------------------------------------------+ | id | groupname | attribute | op | value | +----+------------------------------+--------------+----+-------------------------------------------------------------------------+ | 35 | PM_DSL_8000 | Cisco-AVPair | := | lcp:interface-config=service-policy output PM_DSL_8000_DSCP46_50PROZENT | +----+------------------------------+--------------+----+-------------------------------------------------------------------------+ mysql> select * from radgroupreply where groupname='Default'; +----+-----------+-----------------+----+----------------------------------+ | id | groupname | attribute | op | value | +----+-----------+-----------------+----+----------------------------------+ | 9 | Default | Framed-Protocol | = | PPP | | 10 | Default | Framed-Routing | = | None | | 11 | Default | Service-Type | = | Framed-User | | 24 | Default | Cisco-AVPair | += | lcp:interface-config=ip mtu 1492 | +----+-----------+-----------------+----+----------------------------------+ mysql> select * from radgroupreply where groupname='5Uhr-Trennung'; +----+----------------+-----------------+----+-----------------+ | id | groupname | attribute | op | value | +----+----------------+-----------------+----+-----------------+ | 2 | 5Uhr-Trennung | Session-Timeout | = | `%{expr:05:00}` | +----+----------------+-----------------+----+-----------------+ mysql> select * from radgroupreply where groupname='Default_dsl-mobile.de'; +----+--------------------------+-----------------+----+----------------------------------+ | id | groupname | attribute | op | value | +----+--------------------------+-----------------+----+----------------------------------+ | 44 | Default_dsl-mobile.de | Framed-Protocol | = | PPP | | 45 | Default_dsl-mobile.de | Framed-Routing | = | None | | 46 | Default_dsl-mobile.de | Service-Type | = | Framed-User | | 48 | Default_dsl-mobile.de | Cisco-AVPair | += | lcp:interface-config=ip mtu 1448 | +----+--------------------------+-----------------+----+----------------------------------+ Output from "/usr/sbin/freeradius -d /etc/freeradius -X -f" and a new dsl login try: [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dsluser(a)realm.net' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dsluser(a)realm.net' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'dsluser(a)realm.net' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'dsluser(a)realm.net' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'Default' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'Default' ORDER BY id Invalid operator for item Framed-Protocol: reverting to '==' [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'Default_dsl-mobile.de' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'Default_dsl-mobile.de' ORDER BY id Invalid operator for item Framed-Protocol: reverting to '==' [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'PM_DSL_8000' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'PM_DSL_8000' ORDER BY id [sql] User found in group PM_DSL_8000 [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'PM_DSL_8000' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'PM_DSL_8000' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok As you can see, the radius didn't get infos about the group 5Uhr-Trennung and the group PM_DSL_8000 seems to be there two times. It doesn't matter on what position a group is, we can reproduce it with any settings. Any idea or restrictions known, why freeradius won't lookup all groups? Or any hint, what to test? Regards, Volker

1 0

unsubscribe
by Romeo Mihalcea 13 Sep '13

13 Sep '13

unsubscribe

2 1