January 2014 - Freeradius-Users - lists.freeradius.org

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

unlang vs suffix
by Rui Ribeiro 07 Nov '14

07 Nov '14

Hi, I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing suffix do instead (ignore the if part, I know it is missing in the example above, it is here just for the sake of clarity): if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "iscte.pt") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := EDUROAM } } } Regards, Rui Regards, Rui Ribeiro

7 8

AVP EAP-KEY name support in FR
by Srinu Bandari 12 May '14

12 May '14

Hi, We are trying to bring up MACsec with Cisco and FR, and we are stuck because of Radius unable to send EAP-Key-Name AVP. Below is what is expected as per RFC4072 RFC4072 says "A home Diameter server receiving a Diameter-EAP-Request with a Key-Name AVP with non-empty data MUST silently discard the AVP. In addition, the home Diameter server SHOULD include this AVP in Diameter-EAP-Response only if an empty EAP-Key-Name AVP was present in Diameter-EAP-Request." But radius server is not sending EAP-Key-Name AVP (Radius Attribute Type 102) even invalid AVP present in the Diameter-EAP-Request". Below is the debug print of radius Sending Access-Accept of id 647 to 10.20.64.9 port 1645 MS-MPPE-Recv-Key = 0x84e5c624c3bcdeadca3c6210f24bd7b8336921ccc1c58399d397afc75770332c MS-MPPE-Send-Key = 0xa6c4860cc8092c251502f5adc3ee13586e05fe84cbbb8b6793b08d9523d12b1f EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user1" Does anyone have clue on this. Thanks, Srinivas CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 19

authorization based on ldap attribute
by Stefano Zanmarchi 29 Apr '14

29 Apr '14

Hallo, I've configured freeradius to authenticate users with PEAP, using openldap to store NTLM hashes. It works fine. Now I'd like to authorize only people who have the ldap attribute "haDirittoEduroam" set to Y (or the other way round: not to authorize users with "haDirittoEduroam" set to N). Below an example openldap entry. Is there an easy way to achive this? dn: uid=uto.ughi(a)myorg.it,dc=myorg,dc=it objectClass: sambaSamAccount objectClass: inetOrgPerson objectClass: person objectClass: dirittoEduroam cn: Uto sn: Ughi uid: uto.ughi(a)myorg.it haDirittoEduroam: N sambaSID: 121212 userPassword: {SSHA}EnK9jqiVGSPNi6EQwpqdpjThBJHtZ1fi sambaNTPassword: 2B466E3D3FB6AA4BF8AAAFEF8F59F6F3 sambaLMPassword: E52CAC67419A9A224300941ECC02054C thanks a lot for your help, Stefano

4 6

configuration parameters for perl module in rlm_perl
by Cornelius Kölbel 28 Mar '14

28 Mar '14

Hi list, is there are recommended way to pass configuration parameter to a rlm_perl module? My rlm_perl module, would need to have additional configuration parameters. I would like to avoid having the perl module read an additional configuration file. Is there a possibility to add such paramters somewhere in the freeradius config like in /etc/freeradius/modules/perl and than have the perl module access these parameters? Thanks a lot and kind regards Cornelius

8 20

FR 3.0.1 (radsec) crashes
by JB 11 Feb '14

11 Feb '14

Hi! We're currently testing FR 3.0.1 with RadSec and we're seeing crashes when we turn off an access point. In the log below you can see that the access point sends an accounting stop request before it powers down. FR crashes after closing the socket. I also pasted the GDB stack trace below. BTW, we're also seeing these warnings a lot and we're not sure what they mean or how to prevent them: Debug: (19) Writing to socket 12 Debug: (19) Finished request 19. Debug: Thread 1 waiting to be assigned a request WARNING: WARNING: Socket was closed while processing request 19: Stopping it. Debug: (19) Cleaning up request packet ID 73 with timestamp +1053 Debug: Waking up in 1.1 seconds. Cheers, JB == Log == Sending Accounting-Response of id 1 from 0.0.0.0 port 2083 to XXX.XXX.XXX.XXX port 2159 (0) Finished request 0. Thread 5 waiting to be assigned a request Waking up in 0.3 seconds. Client has closed connection ... closing socket auth+acct from client (XXX.XXX.XXX.XXX, 2159) -> (*, 2083, virtual-server=testserver) Waking up in 0.3 seconds. WARNING: Socket was closed while processing request 0: Stopping it. (0) Cleaning up request packet ID 1 with timestamp +10 talloc: access after free error - first free may be at src/main/listen.c:3287 Bad talloc magic value - access after free Program received signal SIGABRT, Aborted. 0xb7fe1424 in __kernel_vsyscall () == GDB stacktrace == #0 0xb7fe1424 in __kernel_vsyscall () No symbol table info available. #1 0xb7b5d941 in raise () from /lib/i386-linux-gnu/i686/cmov/libc.so.6 No symbol table info available. #2 0xb7b60d72 in abort () from /lib/i386-linux-gnu/i686/cmov/libc.so.6 No symbol table info available. #3 0xb7f2bd99 in talloc_abort () from /usr/local/lib/libtalloc.so.2 No symbol table info available. #4 0xb7f2be50 in talloc_abort_access_after_free () from /usr/local/lib/libtalloc.so.2 No symbol table info available. #5 0xb7f2bedf in talloc_chunk_from_ptr () from /usr/local/lib/libtalloc.so.2 No symbol table info available. #6 0xb7f2dafb in _talloc_free () from /usr/local/lib/libtalloc.so.2 No symbol table info available. #7 0xb7fd2a99 in request_free (request_ptr=0xbffff330) at src/main/util.c:229 request = 0x8293630 #8 0x0807446c in request_done (request=0x8293630, action=2) at src/main/process.c:599 now = {tv_sec = -1073745096, tv_usec = 134690952} when = {tv_sec = 17, tv_usec = 134838992} __FUNCTION__ = "request_done" #9 0x080748dd in request_process_timer (request=0x8293630) at src/main/process.c:753 now = {tv_sec = 136778432, tv_usec = 134553804} when = {tv_sec = 136790696, tv_usec = 136791168} #10 0x08074d1f in request_common (request=0x8293630, action=5) at src/main/process.c:906 buffer = "\250B'\b@\364\377\277\370\363\377\277\004\364\377\277\000\f\376\267\000\f\376\267\000\000\000\000d\364\377\277\250\254\370\267\343\312\370\267d\372\377\267\000\000\000\000\000\000\000\000p\364\377\277(\364\377\277\064\364\377\277\000\f\376\267\000\f\376\267\000\000\000\000\b\364\377\277\274>\n\b\226Q\272\267\370\266\370\267\000\f\376\267\000\000\000\000\377\377\377\377\364\357\377\267\343\312\370\267\005\000\000\000P\364\377\277\026\374\376\267\270\r\376\267" __FUNCTION__ = "request_common" #11 0x08075849 in request_running (request=0x8293630, action=5) at src/main/process.c:1214 __FUNCTION__ = "request_running" #12 0x08073d0e in request_timer (ctx=0x8293630) at src/main/process.c:352 request = 0x8293630 action = 5 #13 0xb7fabe7a in fr_event_run (el=0x82540b0, when=0xbffff608) at src/lib/event.c:219 callback = 0x8073ce4 <request_timer> ctx = 0x8293630 ev = 0x0 #14 0xb7fac4ab in fr_event_loop (el=0x82540b0) at src/lib/event.c:405 i = 4 rcode = 0 maxfd = 16 when = {tv_sec = 1390328421, tv_usec = 338121} wake = 0xbffff608 read_fds = {fds_bits = {0 <repeats 32 times>}} master_fds = {fds_bits = {61440, 0 <repeats 31 times>}} #15 0x0807c34c in radius_event_process () at src/main/process.c:4251 No locals. #16 0x0806b8ef in main (argc=4, argv=0xbffff804) at src/main/radiusd.c:533 rcode = 0 status = -1073744040 argval = -1 spawn_flag = 1 dont_fork = 1 write_pid = 0 flag = 0 from_child = {-1, -1} act = {__sigaction_handler = {sa_handler = 0x806bcf7 <sig_fatal>, sa_sigaction = 0x806bcf7 <sig_fatal>}, sa_mask = {__val = { 0 <repeats 32 times>}}, sa_flags = 0, sa_restorer = 0}

2 10

split Called-Station-Id
by Zeus Panchenko 07 Feb '14

07 Feb '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi, please, where am I mistaking? I need to auth user, comming from via hostapd as client, only if the user belongs to definite Ldap-Group (works fine via radiusGroupName attribute set for user LDAP object) and SSID (which I'm unable to pick - From Called-Station-Id) ... please advise how to do that correct ... I am trying to do it the way described here: http://wiki.freeradius.org/guide/Mac%20Auth#Mac-Auth-authorisation-by-SSID in debug I see - ---[ quotation start ]------------------------------------------- ... rad_recv: Access-Request packet from host 10.241.16.117 port 58063, id=40, length=202 User-Name = "vudhNrF7zxJJmteIVF/Xzg==" NAS-Identifier = "es-student.wrt" Called-Station-Id = "48-5B-39-E7-B0-3B:USER_SSID" NAS-Port-Type = Wireless-802.11 NAS-Port = 2 Calling-Station-Id = "00-BD-3A-69-69-1B" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x0254001d01767564684e7246377a784a4a6d74654956462f587a673d3d Message-Authenticator = 0x6c46a58131867c13ca7fb318d9d407fd ... Fri Jan 31 22:50:48 2014 : Info: ++[logintime] = noop Fri Jan 31 22:50:48 2014 : Info: ++policy rewrite.called_station_id { ... Fri Jan 31 22:50:48 2014 : Info: ? Evaluating (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_. ]*)?/i) -> TRUE Fri Jan 31 22:50:48 2014 : Info: +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_. ]*)?/i) -> TRUE Fri Jan 31 22:50:48 2014 : Info: +++if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_. ]*)?/i) { Fri Jan 31 22:50:48 2014 : Info: ++++update request { Fri Jan 31 22:50:48 2014 : Info: expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 485b39e7b03b Fri Jan 31 22:50:48 2014 : Info: expand: %{7} -> USER_SSID Fri Jan 31 22:50:48 2014 : Info: ++++} # update request = noop Fri Jan 31 22:50:48 2014 : Info: +++} # if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_. ]*)?/i) = noop Fri Jan 31 22:50:48 2014 : Info: +++ ... skipping else for request 1: Preceding "if" was taken Fri Jan 31 22:50:48 2014 : Info: ++} # policy rewrite.called_station_id = updated ... - ---[ quotation end ]------------------------------------------- but what is next? so, how to get Called-Station-Id and Called-Station-SSID set to be able to add SSID to user ldap attributes? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iEYEARECAAYFAlLsFQQACgkQr3jpPg/3oyrdogCgn6YZa0otNybkcWo38KHLRomD adsAoKVxMXQhF48JC6unIqdftzrEXZva =oe77 -----END PGP SIGNATURE-----

2 3

Core dump on start of FR3.0.1
by Palmer J.D.F. 05 Feb '14

05 Feb '14

Hello, I've just compiled FR3.0.1 from source but it is core dumping on start-up, I have copied the debug output below. I'm using the same config as I was with FR3.0.0. Has anyone else encountered such issues? [root@radauth3 raddb]# pkill radiusd ; radiusd -XX Fri Jan 17 11:10:50 2014 : Info: radiusd: FreeRADIUS Version 3.0.1, for host i686-pc-linux-gnu, built on Jan 17 2014 at 11:06:21 Fri Jan 17 11:10:50 2014 : Debug: Server was built with: Fri Jan 17 11:10:50 2014 : Debug: accounting Fri Jan 17 11:10:50 2014 : Debug: authentication Fri Jan 17 11:10:50 2014 : Debug: ascend binary attributes Fri Jan 17 11:10:50 2014 : Debug: coa Fri Jan 17 11:10:50 2014 : Debug: control-socket Fri Jan 17 11:10:50 2014 : Debug: detail Fri Jan 17 11:10:50 2014 : Debug: dhcp Fri Jan 17 11:10:50 2014 : Debug: dynamic clients Fri Jan 17 11:10:50 2014 : Debug: proxy Fri Jan 17 11:10:50 2014 : Debug: regex-posix Fri Jan 17 11:10:50 2014 : Debug: session-management Fri Jan 17 11:10:50 2014 : Debug: stats Fri Jan 17 11:10:50 2014 : Debug: tcp Fri Jan 17 11:10:50 2014 : Debug: threads Fri Jan 17 11:10:50 2014 : Debug: tls Fri Jan 17 11:10:50 2014 : Debug: unlang Fri Jan 17 11:10:50 2014 : Debug: vmps Fri Jan 17 11:10:50 2014 : Debug: Server core libs: Fri Jan 17 11:10:50 2014 : Debug: talloc : 2.0.* Fri Jan 17 11:10:50 2014 : Debug: ssl : OpenSSL 1.0.0e-fips 6 Sep 2011 Fri Jan 17 11:10:50 2014 : Info: Copyright (C) 1999-2014 The FreeRADIUS server project and contributors Fri Jan 17 11:10:50 2014 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Fri Jan 17 11:10:50 2014 : Info: PARTICULAR PURPOSE Fri Jan 17 11:10:50 2014 : Info: You may redistribute copies of FreeRADIUS under the terms of the Fri Jan 17 11:10:50 2014 : Info: GNU General Public License Fri Jan 17 11:10:50 2014 : Info: For more information about these matters, see the file named COPYRIGHT Fri Jan 17 11:10:50 2014 : Info: Starting - reading configuration files ... Fri Jan 17 11:10:50 2014 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Fri Jan 17 11:10:50 2014 : Debug: including files in directory /usr/local/etc/raddb/mods-enabled/ Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/preprocess Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/detail Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/utf8 Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/detail.log Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/echo Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/soh Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/linelog Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/pap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/exec Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/always Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/ldap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/unix Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/passwd Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/eap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/files Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/realm Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/chap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/radutmp Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/mschap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/replicate Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/dhcp Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/logintime Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/expiration Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/digest Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/expr Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/sql Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-config/sql/main/mysql/queries.conf Fri Jan 17 11:10:50 2014 : Debug: including files in directory /usr/local/etc/raddb/policy.d/ Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/accounting Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/operator-name Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/eap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/filter Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/cui Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/control Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/dhcp Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/canonicalization Fri Jan 17 11:10:50 2014 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/StripUserName.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/SetRealm.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/format-callstaid.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/dosomestuff.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/StripUserName.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/dosomestuff.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/poolacc.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/control-socket Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/StripUserName.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/SetRealm.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/format-callstaid.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/dosomestuff.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/poolacc.conf Fri Jan 17 11:10:50 2014 : Debug: main { Fri Jan 17 11:10:50 2014 : Debug: security { Fri Jan 17 11:10:50 2014 : Debug: allow_core_dumps = no Fri Jan 17 11:10:50 2014 : Debug: } Fri Jan 17 11:10:50 2014 : Debug: } Fri Jan 17 11:10:50 2014 : Debug: main { Fri Jan 17 11:10:50 2014 : Debug: name = "radiusd" Segmentation fault (core dumped) Many thanks, Jezz.

4 20

Authenticate users different Domain using LDAP group search
by Luis Diaz 05 Feb '14

05 Feb '14

Hi there! First of all, I'd like to thank everybody in this forum for the help you provide. This forum has been very helpful for me in order to deploy and make my FreeRADIUS server work. However, I'm facing a config problem that I couldn't solve just searching on this forum. So, I need a little bit of help with it. I'm running FreeRADIUS Version 2.2.0 and I've managed to make the server work to authenticate users against our AD. I'm using ntlm_auth + mschap + ldap. Everything works very fine with domain users. I have no problem. I use the ldap module in order to authenticate just some users inside specific groups and also, assigning the VLAN dynamically. The issue comes when I try to authenticate users from a different domain. I highlight that both domains share a trust relationship. I read on the forum that just configuring NTLM module adding the trusted domain would work, but for the moment, it doesn't work. I'll show you part of my config for this purpose: NTLM_AUTH Module: exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{mschap:User-Name:-None}} --domain=%{%{mschap:NT-Domain}:-MAIN-DOMAIN} --domain=%{%{mschap:NT-Domain}:-TRUSTED-DOMAIN}--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } If I exec the command: ntlm_auth --request-nt-key --domain=TRUSTED-DOMAIN --username=USER-TURSTED-DOMAIN --password=******** NT_STATUS_OK: Success (0x0) As you can see, ntlm module works. However, when the request comes through the radius I get a prompt from ldap module saying "object (user) not found". This is the error from the debug output: [ldap] object not found rlm_ldap::ldap_groupcmp: search failed The user from the trusted domain is inside the same group for users from my domain. The ldap search works for user form my domain, but fails when it tries to search a user from the trusted domain. I guess the problem lies on the ldap module. However, I don't fully understand where the config problem can be. Any help would be appreciate it very much. Thank you so much in advance. And have a great day!

2 3