- Freeradius-Users - lists.freeradius.org

Reject users based on LDAP attribute
by C.F. Yeung 17 May '12

17 May '12

We have 802.1x authentication via AD. It's okay. Now, we would like to reject users based on LDAP attribute, WLANStatus. Added attribute in dictionary and ldap.attrmap as follow. Where should I put the unlang? /etc/raddb/dictionary ATTRIBUTE My-Local-wlanStatus 3000 string /etc/raddb/ldap.attrmap replyItem My-Local-wlanStatus WLANStatus /etc/raddb/sites-available/default authorize { ... ldap if (My-Local-wlanStatus == "A1") { reject } ... } rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=student,o=example.com, with filter (uid=testuser) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... rlm_ldap: WLANStatus -> My-Local-wlanStatus = "A1" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++? if (My-Local-wlanStatus == "A1") (Attribute My-Local-wlanStatus was not found)

3 6

EAP and automatically authenticating users
by David Peterson 17 May '12

17 May '12

I have a couple of users who have unknown usernames and passwords. They are also using EAP-TTLS for authentication. Is there a way to automatically authenticate all of them and if so, can I also send the Framed-Filter-Id attribute with the authentication response as if the user were truly authorized. David

3 6

Re: freeradius service doest start
by Baris Genc 17 May '12

17 May '12

> Dear All, > > When i try to start radius service on ubuntu service is fail. How to start > radius service on ubuntu? > > root@123:/etc/init.d# /etc/init.d/freeradius start > * Starting FreeRADIUS daemon freeradius > ...fail! > > root@123:/etc/init.d# /etc/init.d/freeradius reload > * Reloading FreeRADIUS daemon freeradius > * /var/run/freeradius/freeradius.pid not found... > ...done. > > root@123:/# radiusd -X The program 'radiusd' can be found in the following packages: * radiusd-livingston * yardradius Try: apt-get install <selected package> > Is there any person help to me? > Thank you. >

4 6

ntlm_auth in freeradius
by val john 17 May '12

17 May '12

Hi... i need to configure the freeradius with mschap (need to specify the ntlm_auth file path in "modules/mschap and modules/ntlm_auth files) , but i cant find the ntlm_auth file in my OS , is it coming with freeradius or we have to install it separately . Thank you John

5 8

Re: Conditionally passing custom attributes
by Chad Lensert 17 May '12

17 May '12

> Why? 2.1.1 was released almost 4 years ago. This is the version that is supplied with SuSE and needs to be managed via their patch channel, so I am required to use this version. > Well, it should work. It works for me in my testing. I'll continue to troubleshoot. I wasn't sure if there was some global config option or something obvious I might be missing or a bug in this version.

2 1

Unix TimeStamp Based Login
by jomajo 16 May '12

16 May '12

Hello! Maybe somebody know or maybe already implemented , Unix TimeStamp based login? For example if I have "radcheck" table like this: http://freeradius.1045715.n5.nabble.com/file/n5708187/freeradius_unix.png How should Freeradius know, that he need's to look at start_time and end_time field in this table, and let the user to log in just at this specific time slot? I know that I need to change this SQL statement: authorize_check_query = "SELECT id, username, attribute1, value, op1 \ FROM ${authcheck_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY id" Thanks if you have a minute to help me figure this out. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Unix-TimeStamp-Based-Login-tp570818… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 27

Post-crash investigations
by Julien Cornuwel 16 May '12

16 May '12

Hi, I setup a cluster (Pacemaker) of two freeradius servers on CentOS 5.8 (freeradius 1.1.3). We use it for 802.1X: our switchs (HP Procurve) send it EAP challenges and it authenticates our users/hosts against an ActiveDirectory domain. It's been running smoothly for a month and stopped working this morning. We switched back to our old server but I want to know what happened before putting the cluster back in production. I'm currently trying to find out what happened but information is sparse: - From the cluster perspective, everything is fine. The daemon is running and no failover event occurred. - From samba, same thing. - In radius.log: nothing. There are client SSL certs errors but they have been there the whole time. - In auth-detail logfile: I can see all received requests. Before _and_ after the problem. However, it doesn't contain the reply :-/ - In detail logfile: Nothing after 7:56, time of the outage. So, I need pointers on two different issues: - I don't have enough information in logs. I realize that the recommended solution is to run the server in debug mode but I'm not sure I can store a month - or more - of such verbose logging. Any way to have more information, except the debug mode ? - I failed to check the whole authentication process both at the cluster level and at the monitoring level (nagios). Tools like NTradPing and check_radius_adv are of little help here because they can only check static accounts declared in radius configuration. They do not exercise the whole chain (Windows client > switch > radius server > ntlm_auth > AD). I tried replaying a successful authentication but it failed (Access-Denied). Any way to perform a 'real' check ? Sorry for the long post and thanks for any idea/pointer you can give me. Regards,

5 8

Re: Specific User Trace and multiple radiusd instant
by 全球无线联盟 16 May '12

16 May '12

Hello everyone, We use below freeradius. It works well. The OS is Linux Enterprise 5.4. Thanks. freeradius2.x86_64 2.1.12-3.el5 installed freeradius2-krb5.x86_64 2.1.12-3.el5 installed freeradius2-ldap.x86_64 2.1.12-3.el5 installed freeradius2-mysql.x86_64 2.1.12-3.el5 installed freeradius2-perl.x86_64 2.1.12-3.el5 installed freeradius2-postgresql.x86_64 2.1.12-3.el5 installed freeradius2-python.x86_64 2.1.12-3.el5 installed freeradius2-unixODBC.x86_64 2.1.12-3.el5 installed freeradius2-utils.x86_64 2.1.12-3.el5 installed We got below two questions recently. 1. We know 'radiusd -X' will run the radius in debuge mode. With large amount user request, the debug information will be massive. It will be difficult to read one specific user authentication process. Can anyone advise how to debug a specific user's access process? 2. We tried to run multiple radiusd at same server while the second failed. Can anyone advise how to configure the server to run multiple radiusd simultaneously？ Thanks! Tom

5 7

Re: MSCHAP Errors
by Alan Buxey 15 May '12

15 May '12

What does the server try to run when actually dealing with your client? radius -X will show you, you can then try running that command yourself. alan

4 3

Conditionally passing custom attributes
by Chad Lensert 15 May '12

15 May '12

freeradius-server-utils-2.1.1-7.7.19.77 freeradius-server-libs-2.1.1-7.7.19.77 freeradius-server-2.1.1-7.10.1 Greetings all. I am trying to pass a list of custom attributes based on the information in the radius request. Originally, I tried matching on NAS-IP-Address as noted below, but it looks like I can also match on Client-IP-Address, which I would prefer. The issue I am having is that I don't see radius matching the right entry in the users file and returning specific custom attributes. I can't determine why it is choosing the last user entry in the users file. Here is an example of the users file. I expect the information from the request to match the first entry for user "chad". #################################################### DEFAULT Auth-Type=Pam Service-Type = NAS-Prompt-User, cisco-avpair +="shell:priv-lvl=2", cisco-avpair :="shell:roles*network-operator", Fall-Through = 1 ... #put customer user attributes here! chad NAS-IP-Address == "1.2.3.4" cisco-avpair += "NCS:virtual-domain0=ROOT-DOMAIN", cisco-avpair += "NCS:role0=Root" chad NAS-IP-Address == "2.3.4.5" cisco-avpair += "NCS:virtual-domain0=ROOT-DOMAIN", cisco-avpair += "NCS:role0=Root" chad Service-Type := Administrative-User, cisco-avpair := "shell:priv-lvl=15", cisco-avpair := "shell:roles*network-admin" #################################################### The debug from radius shows that the NAS-IP-Address in the first user entry matches the initial request. I also tried to match on Client-IP-Address, but the debugs always show radius matching on the last user entry and sending different attributes. Ready to process requests. rad_recv: Access-Request packet from host x.x.x.x port 19721, id=31, length=62 NAS-IP-Address = 1.2.3.4 Service-Type = Login-User NAS-Port-Type = Virtual User-Name = "chad" User-Password = "0123456789" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "chad", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated [files] users: Matched entry DEFAULT at line 1 [files] users: Matched entry chad at line 29 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = PAM +- entering group authenticate {...} pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: authentication succeeded for <chad> ++[pam] returns ok Login OK: [chad/0123456789] (from client lensert port 0) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 31 to x.x.x.x port 19721 Service-Type := Administrative-User Cisco-AVPair := "shell:roles*network-admin" Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 9296, id=104, length=68 User-Name = "chad" User-Password = "0123456789" NAS-IP-Address = 2.3.4.5 Message-Authenticator = 0xb346bbcf6f763e4e9e32c2f4ddc657b9 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "chad", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated [files] users: Matched entry DEFAULT at line 1 [files] users: Matched entry chad at line 29 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = PAM +- entering group authenticate {...} pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: function pam_authenticate FAILED for <chad>. Reason: Permission denied ++[pam] returns reject Failed to authenticate the user. Login incorrect: [chad/0123456789] (from client lensert port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> chad attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 104 to x.x.x.x port 9296 Finished request 1. Going to the next request Waking up in 2.7 seconds. rad_recv: Access-Request packet from host x.x.x.x port 55546, id=31, length=62 NAS-IP-Address = 1.2.3.4 Service-Type = Login-User NAS-Port-Type = Virtual User-Name = "chad" User-Password = "0123456789" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "chad", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated [files] users: Matched entry DEFAULT at line 1 [files] users: Matched entry chad at line 29 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = PAM +- entering group authenticate {...} pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: function pam_authenticate FAILED for <chad>. Reason: Permission denied ++[pam] returns reject Failed to authenticate the user. Login incorrect: [chad/0123456789] (from client lensert port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> chad attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 31 to x.x.x.x port 55546 Finished request 2. Going to the next request Waking up in 0.4 seconds. Cleaning up request 0 ID 31 with timestamp +30 Waking up in 2.2 seconds. Cleaning up request 1 ID 104 with timestamp +32 Waking up in 2.3 seconds. Cleaning up request 2 ID 31 with timestamp +35 Ready to process requests.

2 1