January 2017 - Freeradius-Users - lists.freeradius.org

simultaneous use
by Bill Schoolfield 04 Jan '17

04 Jan '17

I have a client that wanted his customers limited to a single connection. So I implemented: mysql> select * from radgroupcheck; +----+--------------------+------------------+----+-------+ | id | groupname | attribute | op | value | +----+--------------------+------------------+----+-------+ | 1 | Package2MB | Simultaneous-Use | := | 1 | After some time and 100's of subscribers he now wants on a case by case (ie user) basis to allow multiple simultaneous sessions. I thought I just add Simultaneous-Use to radcheck for those users and use the "appropriate" operators. I can't seem to get this to work. I'm trying to avoid dropping the use of radgroupcheck and adding the Simultaneous-Use radcheck attribute to all users. Is this possible? What operators do I use? I used '=' in radgroupcheck and that succeeded in allowing the radcheck item to "override" the radgroupcheck item but the check fails if no radcheck item exists (as will be the case in many instances). Bill

2 5

Authorize with EAP-TLS, but use LDAP for authentication to check user's group membership
by Petar Marinkovic 03 Jan '17

03 Jan '17

I am quite a freeradius noob, so in advance, my apologies if this question of mine doesn't make too much sense. I have a mixed environment, mostly Windows users, but also Linux and Macs, and requirement is to implement a 802.1x wired authentication for DHCP clients, with dynamic VLAN assignment. As a first layer of security, I've implemented this solution https://wiki.freeradius.org/guide/mac-auth with both mac authentication (reading allowed MAC addresses) and then proceeding with EAP-TLS (with certificates issued from Windows Active Directory Certificate Services). I've created machine certificate for freeradius server (2.2, running on CentOS 6) in AD CS, converted that one and root CA, and set up everything per that solution, and I can successfully authenticate with any Windows or Linux client with allowed MAC and user having their certificate. Now, I would like to add LDAP, in order to check the user's group permissions, and to set up dynamic vlan assignment per group membership (if a HR person is member of "HR" group, put him in VLAN 10, for example). I have Juniper access switches, so this solution should work. But, I am seeking advice from you here guys on how to proceed. I've installed LDAP module, and configured my settings in /etc/raddb/modules/ldap but where should the configuration for this takes place? Currently, my /etc/raddb/sites-available/default config looks the same as on the link above, and I am not sure if I can use the username of authorized user (which is in form of username(a)domain.com from the Windows user certificate) with LDAP to check the groups of that authorized user and assign him the correct VLAN? I've googled around, but what I found didn't help me much, so any help is more than appreciated! I guess it's easier to switch to MAC and LDAP and bypass EAP-TLS, but since we're already issuing certificates to users (and they use those Windows AD certificates for other services as well), I would like to use them here as well for authorization with MAC addresses. Thanks in advance!

2 2

rlm_ldap not populating Stripped-User-Name
by Arnab Roy 03 Jan '17

03 Jan '17

Hi , Just wondering if one of you could help me with a strange issue that has suddenly appeared. Freeradius Version: 3.0.11 It looks like rlm_ldap has suddenly stopped picking up the Stripped-User-Name value, my config looks like bellow user { filter = "(samAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" scope = "sub" base_dn = "dc=domain,dc=com" access_positive = yes } All was working fine with this server for a while. The same filter is working fine in other modules like mschap and ntlm_auth. The exapnsion of the filter returns no value for the Stripped-User-Name parameter. Here is the grepd version of radiusd -X Any points where I could start looking would be much appreciated as to why it suddenly stopped. # Loaded module rlm_ldap # Loading module "ldap" from file /etc/raddb/mods-enabled/ldap ldap { server = "172.20.0.40" port = 389 identity = "bindaccount" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { scope = "base" name_attribute = "cn" membership_attribute = "memberOf" membership_filter = "(&(objectClass=group)(member=%{control:Ldap-UserDn}))" cacheable_name = yes cacheable_dn = yes } client { scope = "sub" base_dn = "" } profile { } options { ldap_debug = 0 chase_referrals = no rebind = no net_timeout = 10 res_timeout = 10 srv_timelimit = 1 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name}} --domain=%{%{mschap:NT-Domain}:-removed.com} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" passchange { } -- # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20444 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 10 spare = 20 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 0 retry_delay = 30 spread = no } Do let me know if you would like to see some additional configuration files. Many Thanks Arnab

2 2

rlm_eap module
by Peter Balsianok 02 Jan '17

02 Jan '17

Hi, How can i prevent to compile rlm-eap module ? Thx.

2 3