July 2014 - Freeradius-Users - lists.freeradius.org

Re: Fwd: Dynamic VLAN assignment for Active Directory Users on Freeradius
by Alan DeKok 02 Jul '14

02 Jul '14

Bomongo Esse wrote: > Thank you Alan, > > Just to tell you that the solution (freeradius) works well with Active > Directory. I can authenticate Active Directory users through Freeradius. > The main issue i encounter is to get the users assigned dynamically > VLAN. I saw in a forum that we need to setup the file > /etc/raddb/modules/ldap that what i did. > > The line 68 of the users file contains this : > > DEFAULT > Ldap-Group = "CN=group1,DC=rasad,DC=local", > Tunnel-Type = "VLAN", > Tunnel-Medium-Type = "IEEE-802", > Tunnel-Private-Group-ID = "1" Which isn't in the correct format. I told you what the correct format is. You need to use it. If you're not going to follow instructions, you need to stop asking questions on this list. > I would like to make sure that we can dynamically assign VLAN to Active > Directory users through Freeradius. You've said that. I understand. Do you understand my response? > The authentication without Dynamic VLAN works well. > What should i modify on the file /etc/raddb/modules/ldap ? Did I tell you to modify the contents of that file? > Below is the content of the file : Which you have already posted. > What should be modified again once Active Directory works well with > Freeradius without Dynamic VLAN? I'm sure I already answered that question. If you're going to ignore my responses, and keep posting the same question... you should realize that it's rude. All you're doing is being annoying. Alan DeKok.

1 0

Re: crash freeradius
by Mitch Yackobeck 02 Jul '14

02 Jul '14

5 6

crash freeradius
by Arnaud . 02 Jul '14

02 Jul '14

Hello there, I had a problem with my server that hosts a small radius server with a captive portal. I rebooted the freeradius service and it started to work again against by peeling logs I really do not see the cause! Here are freeradius logs: Thu Jun 26 21:56:19 2014 : Error: rlm_radutmp: Logout for NAS localhost port 17, but no Login record Thu Jun 26 21:59:54 2014 : Error: rlm_radutmp: Logout for NAS localhost port 31, but no Login record Thu Jun 26 22:08:07 2014 : Error: rlm_radutmp: Logout for NAS localhost port 3, but no Login record Thu Jun 26 22:08:34 2014 : Error: rlm_radutmp: Logout for NAS localhost port 30, but no Login record Thu Jun 26 22:15:51 2014 : Error: rlm_radutmp: Logout for NAS localhost port 27, but no Login record Thu Jun 26 22:21:58 2014 : Error: rlm_radutmp: Logout for NAS localhost port 22, but no Login record Fri Jun 27 09:11:43 2014 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Fri Jun 27 09:11:43 2014 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Fri Jun 27 09:11:43 2014 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:/radius Fri Jun 27 09:11:43 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Fri Jun 27 09:11:43 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Fri Jun 27 09:11:43 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Fri Jun 27 09:11:43 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Fri Jun 27 09:11:43 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Fri Jun 27 09:11:43 2014 : Info: Ready to process requests. The service has planted resumed at 22:21 p.m. ET 9:11 when I rebooted freeradius. Do you have any idea what happened? I would also like to disable archiving in radwtmp because I ustilise sql how is it done?

2 9

Re: PAP Authentication Question
by Mitch Yackobeck 01 Jul '14

01 Jul '14

1 0

PAP Authentication Question
by Derek Bolichowski 01 Jul '14

01 Jul '14

Hi there, We are currently using FreeRadius to authenticate ADSL modems at customer locations to our ADSL service via PAP Auth. We have had this working for some time now. Recently, I have noticed a number of Auth Login Incorrect entries. It seems that whenever a modem tries to authenticate using username(a)realm.com<mailto:username@realm.com> / somepassword, we get a RADIUS auth request one second before with 'realm.com' / radius-secret. Example seen here: rad_recv: Access-Request packet from host 192.168.9.6 port 1645, id=37, length=214 User-Name = "ourrealm.com" User-Password = "secret" Calling-Station-Id = "GigabitEthernet 5/0/4.4210116:421-116#587310171#804 GE1 WNDSON1431W-WNDSON1434W##pppoe 00:24:c9:90:ca:72#" Connect-Info = "1000000000" NAS-Port-Type = Virtual NAS-Port = 693 NAS-Port-Id = "Uniq-Sess-ID693" Service-Type = Dialout-Framed-User NAS-IP-Address = 192.168.9.6 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.9.6/auth-detail-20140630 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.9.6/auth-detail-20140630 [auth_log] expand: %t -> Mon Jun 30 19:44:09 2014 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ourrealm.com", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [ourrealm.com/secret] (from client cisco-router port 693 cli GigabitEthernet 5/0/4.4210116:421-116#587310171#804 GE1 WNDSON1431W-WNDSON1434W##pppoe 00:24:c9:90:ca:72#) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ourrealm.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 37 to 192.168.9.6 port 1645 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.9.6 port 1645, id=38, length=226 Framed-Protocol = PPP User-Name = "validuser(a)ourrealm.com" User-Password = "validpassword" Calling-Station-Id = "GigabitEthernet 5/0/4.4210116:421-116#587310171#804 GE1 WNDSON1431W-WNDSON1434W##pppoe 00:24:c9:90:ca:72#" Connect-Info = "1000000000" NAS-Port-Type = Virtual NAS-Port = 693 NAS-Port-Id = "Uniq-Sess-ID693" Service-Type = Framed-User NAS-IP-Address = 192.168.9.6 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.9.6/auth-detail-20140630 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.9.6/auth-detail-20140630 [auth_log] expand: %t -> Mon Jun 30 19:44:10 2014 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "ourrealm.com" for User-Name = "validuser(a)ourrealm.com" [suffix] No such realm "ourrealm.com" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry validuser(a)ourrealm.com at line 87 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "validpassword" [pap] Using clear text password "validpassword" [pap] User authenticated successfully ++[pap] returns ok Login OK: [validuser(a)ourrealm.com/validpassword] (from client cisco-router port 693 cli GigabitEthernet 5/0/4.4210116:421-116#587310171#804 GE1 WNDSON1431W-WNDSON1434W##pppoe 00:24:c9:90:ca:72#) +- entering group post-auth {...} [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/192.168.9.6/reply-detail-20140630 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.9.6/reply-detail-20140630 [reply_log] expand: %t -> Mon Jun 30 19:44:10 2014 ++[reply_log] returns ok ++[exec] returns noop Sending Access-Accept of id 38 to 192.168.9.6 port 1645 Framed-IP-Address = 10.40.100.82 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 37 with timestamp +32 Cleaning up request 1 ID 38 with timestamp +33 Ready to process requests.

2 1