- Freeradius-Users - lists.freeradius.org

adding mschap to an existing ttls/pap setup
by Brian Gold 13 Apr '12

13 Apr '12

We currently have an existing freeradius setup using eap-ttls/pap with an openldap backend. Up until now, our userPassword has always been SHA encoded. I've been working to add sambaNTPassword hashes so that we can use either eap-ttls/mschap or peap/mschap. I've got the nt hashes set, but I'm having some difficulty getting freeradius to successfully authenticate. Output from "radtest -t mschap username password localhost 0 secret": http://pastebin.com/FeiwwhzE output from "radtest -t pap username password localhost 0 secret": http://pastebin.com/tvZXqJCm

3 5

Authentication with radiusclient 1.4
by ikram 12 Apr '12

12 Apr '12

Hi every one , I have 2 major problems : 1.I can't found documentation on radiusclient 1.4 to use it for authenticate an asterisk server 2. Capturing with wireshark can't show radius accounting requestes even if I specify the filter, and thgis requests are shown on the server with console mode please help -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentication-with-radiusclient-1-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Re: EAP-PEAP + Windows 7 with SSO and Password change
by CD DD 12 Apr '12

12 Apr '12

Hi, it seems that is not possible that a user can change the password on loggon screen in windows 7 with freeradius after it has expired, except i use a windows IAS / NPS Server, or not ? I debugged the RAS crap on windows side and in the Logs i have: [3564] 04-12 12:02:33:182: EapChapBeginMSChapV2 [3564] 04-12 12:02:33:182: ReadUserData [3564] 04-12 12:02:33:182: Version three user blob is passed, size: 1018 [3564] 04-12 12:02:33:182: ReadConnectionData [3564] 04-12 12:02:33:182: EapChapBeginCommon [3564] 04-12 12:02:33:182: ChapBegin(fS=0,bA=0x81) [3564] 04-12 12:02:33:182: StoreCredentials [3564] 04-12 12:02:33:198: ChapBegin done. [3564] 04-12 12:02:33:198: ChapMakeMessage,RBuf=0000000000000000 [3564] 04-12 12:02:33:198: ChapCMakeMessage... [3564] 04-12 12:02:33:198: CS_Initial [3564] 04-12 12:02:33:198: EapMSChapv2MakeMessage [3564] 04-12 12:02:33:198: EapMSChapv2CMakeMessage (DOMAIN\test) [3564] 04-12 12:02:33:198: EMV2_Initial [3564] 04-12 12:02:33:198: EapMSChapv2CMakeMessage: Rcvd packet size: 37 [3564] 04-12 12:02:33:198: ChapMakeMessage,RBuf=0000000004352B35 [3564] 04-12 12:02:33:198: ChapCMakeMessage... [3564] 04-12 12:02:33:198: CS_WaitForChallenge [3564] 04-12 12:02:33:198: MakeResponseMessage... [3564] 04-12 12:02:33:198: Generating Challenge [3564] 04-12 12:02:33:198: GetChallenge. [3564] 04-12 12:02:33:198: GetChallenge: LsaCallAuthenticationPackage succeeded [3564] 04-12 12:02:33:198: GetChallenge. [3564] 04-12 12:02:33:198: GetChallenge: LsaCallAuthenticationPackage succeeded [3564] 04-12 12:02:33:198: GetChallengeResponse [3564] 04-12 12:02:33:198: GetDESChallengeResponse [3564] 04-12 12:02:33:198: GetDESChallengeResponse Success [3564] 04-12 12:02:33:198: GetMD5ChallengeResponse Success [3564] 04-12 12:02:33:198: GetMD5ChallengeResponse Success [3564] 04-12 12:02:33:198: GetChallengeResponse Success [3564] 04-12 12:02:33:198: GetChallengeResponse=0 02 09 00 41 31 1F C4 A4 0B D5 E9 77 D5 CB E9 34 |...A1......w...4| 94 7E 7B 04 E2 00 00 00 00 00 00 00 00 85 83 94 |.~{.............| DF 03 C5 95 73 46 E5 57 2D A5 03 D5 1B 75 EE 7F |....sF.W-....u.| 26 D3 16 59 DE 00 5A 4F 4F 50 4C 55 53 5C 77 74 |&..Y..DOMAIN\tes| 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |t...............| [3564] 04-12 12:02:33:245: EapMSChapv2MakeMessage [3564] 04-12 12:02:33:245: EapMSChapv2CMakeMessage (DOMAIN\test) [3564] 04-12 12:02:33:245: EMV2_ResponseSend [3564] 04-12 12:02:33:245: Got a Code Failure when expecting Response. Failing Auth [3728] 04-12 12:02:34:290: EapMSChapv2End [3728] 04-12 12:02:34:290: ChapEnd Maybe the FR send a wrong EAP Messages to the Client ? Is it anyway possible to get the whole unencrypted EAP Message from FR ? Network traces are useless cause crypted traffic. thanks, C. -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

1 0

MS-CHAPv2, allow_retry=yes, but no code to handle the retry?
by James J J Hooper 12 Apr '12

12 Apr '12

Hi All, FR 2.1.x Git, doing PEAP against AD via ntlm_auth. I thought that with: allow_retry = yes [in modules/mschap] and send_error = yes [in modules/eap] ...FR has the functionality to take the second password attempt, and re-try it against AD i.e. The scenario outlined in section 9.1.4 of RFC2759: <http://tools.ietf.org/html/rfc2759#section-9.1.4> I can't get it to work: Configuring as above does indeed make Windows re-prompt for the password if the first attempt is bad, but when this comes back to FR, nothing seems to be done with it. I've had a look at the code. From the little I can understand of it, the new challenge is generated into 'buffer', and sent back to the client in the MS-CHAP-Error attribute (C=<new-challenge>). However the challenge in buffer is not then "put somewhere safe" until the client sends it's response against the new challenge [having re-prompted the user for the correct password], and when the response comes in it isn't sent to do_mschap() Am I mistaken and this functionality hasn't been written yet? ...or have I mis-configured something? Debug snippet appended. Thanks, James ## INITIAL ATTEMPT WITH BAD PASSWORD: Debug: modsingle[authorize]: calling eduroamlocaleap-bris-ca (rlm_eap) for request 629 Debug: [eduroamlocaleap-bris-ca] EAP packet type response id 9 length 80 Debug: [eduroamlocaleap-bris-ca] No EAP Start, assuming it's an on-going EAP conversation Debug: modsingle[authorize]: returned from eduroamlocaleap-bris-ca (rlm_eap) for request 629 Debug: +++[eduroamlocaleap-bris-ca] returns updated Debug: ++- else else returns updated Debug: Found Auth-Type = eduroamlocaleap-bris-ca Debug: # Executing group from file /usr/local/etc/raddb/sites-enabled/eduroamlocal-inner Debug: +- entering group eduroamlocaleap-bris-ca {...} Debug: modsingle[authenticate]: calling eduroamlocaleap-bris-ca (rlm_eap) for request 629 Debug: [eduroamlocaleap-bris-ca] Request found, released from the list Debug: [eduroamlocaleap-bris-ca] EAP/mschapv2 Debug: [eduroamlocaleap-bris-ca] processing type mschapv2 Debug: [mschapv2] # Executing group from file /usr/local/etc/raddb/sites-enabled/eduroamlocal-inner Debug: [mschapv2] +- entering group MS-CHAP {...} Debug: [mschapv2] modsingle[authenticate]: calling eduroamlocalmschap (rlm_mschap) for request 629 Debug: [eduroamlocalmschap] Creating challenge hash with username: jh01761(a)bristol.ac.uk Debug: [eduroamlocalmschap] Told to do MS-CHAPv2 for jh01761(a)bristol.ac.uk with NT-Password Debug: [eduroamlocalmschap] expand: %{Stripped-User-Name} -> jh01761 Debug: [eduroamlocalmschap] expand: --username=%{%{Stripped-User-Name}:-%{eduroamlocalmschap:User-Name}} -> --username=jh01761 Debug: [eduroamlocalmschap] radius_xlat: Running registered xlat function of module eduroamlocalmschap for string 'Challenge' Debug: [eduroamlocalmschap] Creating challenge hash with username: jh01761(a)bristol.ac.uk Debug: [eduroamlocalmschap] expand: --challenge=%{eduroamlocalmschap:Challenge} -> --challenge=3db717d83ec4e184 Debug: [eduroamlocalmschap] radius_xlat: Running registered xlat function of module eduroamlocalmschap for string 'NT-Response' Debug: [eduroamlocalmschap] expand: --nt-response=%{eduroamlocalmschap:NT-Response} -> --nt-response=0b7588b2a33b43f7379d4bded3d69adcfbe5da07911b8485 Debug: [eduroamlocalmschap] External script failed. Debug: [eduroamlocalmschap] FAILED: MS-CHAP2-Response is incorrect Debug: modsingle[authenticate]: returned from eduroamlocalmschap (rlm_mschap) for request 629 Debug: ++[eduroamlocalmschap] returns reject Debug: ++? if (reject) Debug: >>> RECURSING WITH ... reject) Debug: >>> LOOKING AT reject) Debug: >>> Comparison returned 1 Debug: ? Evaluating (reject) -> TRUE Debug: >>> GOT result 1 Debug: >>> AT EOL -> 1 Debug: >>> AFTER RECURSION ... ) Debug: >>> AT EOL -> 1 Debug: ++? if (reject) -> TRUE Debug: ++- entering if (reject) {...} Debug: ::: FROM 1 TO 25 MAX 26 Debug: ::: Examining UOB-Info-Type Debug: ::: APPENDING UOB-Info-Type FROM 0 TO 25 Debug: ::: TO in 25 out 26 Debug: ::: to[0] = EAP-Message Debug: ::: to[1] = FreeRADIUS-Proxied-To Debug: ::: to[2] = User-Name Debug: ::: to[3] = State Debug: ::: to[4] = Calling-Station-Id Debug: ::: to[5] = Called-Station-Id Debug: ::: to[6] = NAS-Port Debug: ::: to[7] = Cisco-AVPair Debug: ::: to[8] = NAS-IP-Address Debug: ::: to[9] = NAS-Identifier Debug: ::: to[10] = Airespace-Wlan-Id Debug: ::: to[11] = Service-Type Debug: ::: to[12] = Framed-MTU Debug: ::: to[13] = NAS-Port-Type Debug: ::: to[14] = Tunnel-Type Debug: ::: to[15] = Tunnel-Medium-Type Debug: ::: to[16] = Tunnel-Private-Group-Id Debug: ::: to[17] = UOB-Stripped-MAC Debug: ::: to[18] = Stripped-User-Name Debug: ::: to[19] = Realm Debug: ::: to[20] = EAP-Type Debug: ::: to[21] = MS-CHAP-Challenge Debug: ::: to[22] = MS-CHAP2-Response Debug: ::: to[23] = NTLM-User-Name Debug: ::: to[24] = Module-Failure-Message Debug: ::: to[25] = UOB-Info-Type Debug: +++[request] returns reject Debug: modsingle[authenticate]: calling eduroaminfo (rlm_linelog) for request 629 Debug: [eduroaminfo] expand: %{UOB-Info-Type} -> BADP Debug: [eduroaminfo] expand: %{Virtual-Server}.%{%{UOB-Info-Type}:-UNKN} -> eduroamlocal-inner.BADP Debug: [eduroaminfo] expand: BADP, %{UOB-Stripped-MAC}, USER PASSWORD or ADS GROUP INCORRECT [%{User-Name}] [%{Virtual-Server}], [%{Module-Failure-Message}] [%{reply:MS-CHAP-Error}] -> BADP, 68:7f:74:f2:a3:4e, USER PASSWORD or ADS GROUP INCORRECT [jh01761(a)bristol.ac.uk] [eduroamlocal-inner], [eduroamlocalmschap: External script says Logon failure (0xc000006d)] [\011E=691 R=1 C=077b54f94a5230c9ecb273bfff3ef93b V=3 M=Verify username and re-enter your password] Debug: modsingle[authenticate]: returned from eduroaminfo (rlm_linelog) for request 629 Debug: +++[eduroaminfo] returns ok Debug: modsingle[authenticate]: calling reject (rlm_always) for request 629 Debug: modsingle[authenticate]: returned from reject (rlm_always) for request 629 Debug: +++[reject] returns reject Debug: ++- if (reject) returns reject Debug: modsingle[authenticate]: returned from eduroamlocaleap-bris-ca (rlm_eap) for request 629 Debug: ++[eduroamlocaleap-bris-ca] returns handled ## THEN 4 SECONDS LATER (user has re-typed their password) Debug: ++- entering else else {...} Debug: modsingle[authorize]: calling eduroamlocaleap-bris-ca (rlm_eap) for request 673 Debug: [eduroamlocaleap-bris-ca] EAP packet type response id 10 length 80 Debug: [eduroamlocaleap-bris-ca] No EAP Start, assuming it's an on-going EAP conversation Debug: modsingle[authorize]: returned from eduroamlocaleap-bris-ca (rlm_eap) for request 673 Debug: +++[eduroamlocaleap-bris-ca] returns updated Debug: ++- else else returns updated Debug: Found Auth-Type = eduroamlocaleap-bris-ca Debug: # Executing group from file /usr/local/etc/raddb/sites-enabled/eduroamlocal-inner Debug: +- entering group eduroamlocaleap-bris-ca {...} Debug: modsingle[authenticate]: calling eduroamlocaleap-bris-ca (rlm_eap) for request 673 Debug: [eduroamlocaleap-bris-ca] Request found, released from the list Debug: [eduroamlocaleap-bris-ca] EAP/mschapv2 Debug: [eduroamlocaleap-bris-ca] processing type mschapv2 Debug: [eduroamlocaleap-bris-ca] Freeing handler Debug: modsingle[authenticate]: returned from eduroamlocaleap-bris-ca (rlm_eap) for request 673 Debug: ++[eduroamlocaleap-bris-ca] returns reject Debug: Failed to authenticate the user. Wed Apr 11 15:53:04 2012 : Auth: Login incorrect: [jh01761(a)bristol.ac.uk] (from client WISM4 port 13 cli 68:7f:74:f2:a3:4e via TLS tunnel)

2 2

One session per user
by Fabricio Flores 11 Apr '12

11 Apr '12

Hi everyone, I have a little problem.... I work with Ubuntu, freeradius, coovachilli. I want that when a user loged in he can´t log in from another pc with his username and password... but he can... how can i controle it? -- Fabricio A. Flores G. Egresado en Ingeniería en Sistemas MSN: fabri_floresg(a)hotmail.com Google: fabrifloresg(a)gmail.com Twitter: fabricioflores Skype: fabriciofloresgallardo Blog Personal <http://fabricioflores.wordpress.com/>

4 9

Windows 7 prompting several times
by Morris, Andi 11 Apr '12

11 Apr '12

Hi all, Apologies for being slightly off topic. Does anyone else get a problem with Windows 7 clients prompting for the radius credentials 2 or 3 times before finally accepting them? No errors are shown on the radius side, and I've read that this is a problem with the operating system, but wondered whether anyone in this knowledgeable community had overcome this? Cheers, Andi ________________________________ >From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>

10 38

Automatic ppp ip address assignment
by Timmy 10 Apr '12

10 Apr '12

Dear All FreeRadius 2.1 users, I can run successfully with pptpd and freeradius 2.1 authentication very well. I need to assign ip address to each pptp user manually. However, I can't set up mysql ip pool for pptp user. I have tried this way: http://wiki.freeradius.org/Rlm_sqlippool but it doesn't work. ppp user cannot get ip address automatically. I also comment out main_pool inside the /site-available/default file. This doesn't work neither. I have also tried any possible combinations of other settings but they don't work. Any user would like to post the main setting of a successful automatic ppp ip address assignment through mysql ip pool? Your help is highly appreciated. Your Faithfully, Timmy

2 3

checking ad membership
by Heinrich, Sebastian 10 Apr '12

10 Apr '12

Hello, my aim is that only one group of the active directory gets access the others are rejected. I have read in this thread: http://freeradius.1045715.n5.nabble.com/Conditional-attributes-with-AD-td55… that you can use the ldap module to check group membership and check the output of the checking. I use this filter in the groupmembership checking: groupname_attribute = cn groupmembership_filter = "(objectClass=group)(member=%{<where the group in the ad is>}))" groupmembership_attribute = memberOf I get this output of the debug of freeRADIUS: [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=domain,dc=de, with filter (sAMAccountName=heinrich) [ldap] rebind to URL ldap://domain.de/CN=Configuration,DC=domain,DC=de [ldap] ldap_release_conn: Release Id: 0 expand: (&(objectClass=group)(member=%{control:cn=group,cn=users,dc=domain,dc=de})) -> (&(objectClass=group)(member=)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in cn=group,cn=users,dc=aos-stade,dc=de, with filter (&(objectClass=group)(member=)) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=Heinrich\, Sebastian,CN=Users,DC=aos-stade,DC=de, with filter (objectclass=*) [ldap] performing search in CN=group1,CN=Users,DC=aos-stade,DC=de, with filter (cn=cn=group,cn=users,dc=domain,dc=de) [ldap] object not found [ldap] performing search in CN=group2,CN=group4,CN=Users,DC=domain,DC=de, with filter (cn=cn=group,cn=users,dc=domain,dc=de) [ldap] object not found [ldap] performing search in CN=group3,CN=Users,DC=domain,DC=de, with filter (cn=cn=group,cn=users,dc=domain,dc=de) [ldap] object not found [ldap] performing search in CN=group,CN=Users,DC=domain,DC=de, with filter (cn=cn=group,cn=users,dc=domain,dc=de) [ldap] object not found [ldap] performing search in CN=group,CN=group4,CN=Users,DC=aos-stade,DC=de, with filter (cn=cn=group,cn=users,dc=domain,dc=de) [ldap] object not found rlm_ldap::groupcmp: Group cn=group,cn=users,dc=aos-stade,dc=de not found or user not a member [ldap] ldap_release_conn: Release Id: 0 I have written this in my inner-tunnel: If(!(Ldap-group == 'cn=group,cn=users,dc=domain,dc=de)) { update config { Auth-Type := Reject } } Can anybody help me? As I understand the debug the group is checked but the user isn't member of it. I totally sure that I am a member of the group. Best Regards Sebastian Heinrich Techn. DV Aluminium Oxid Stade GmbH Johann-Rathje-Köser-Straße 21683 Stade email S.Heinrich(a)aos-stade.de web http://www.aos-stade.de <http://www.aos-stade.de/>

2 1

optimize questions for unlang code
by Tobias Hachmer 10 Apr '12

10 Apr '12

Hello listmembers, In my testing environment I set up a virtual freeradius 2.1.12 server, which is configured to do ntlm_auth for authentication and ldap authorization against Microsoft AD. These are my ldap groups: - cn=radius.users,ou=Groups,dc=test,dc=local (only users within this group are allowed to authenticate against AD) - cn=alu.rw,ou=Groups,dc=test,dc=local (read-write group for alcatel-lucent devices) - cn=alu.ro,ou=Groups,dc=test,dc=local (read-only group for alcatel-lucent devices) - cn=netscreen.rw,ou=Groups,dc=test,dc=local (read-write group for juniper netscreen devices) - cn=netscreen.ro,ou=Groups,dc=test,dc=local (read-only group for juniper netscreen devices) - cn=nsm.rw,ou=Groups,dc=test,dc=local (read-write group for juniper nsm) - cn=nsm.ro,ou=Groups,dc=test,dc=local (read-only group for juniper nsm) - cn=aruba.rw,ou=Groups,dc=test,dc=local (read-write group for aruba devices) - cn=aruba.ro,ou=Groups,dc=test,dc=local (read-only group for aruba devices) I wrote unlang code in the authorize section of virtual server "default" (will post this later) - if a AD user is member of the radius.user I set Auth-Type to "ntlm_auth" - if a AD user is member of a device group above freeradius will add the appropriate return attributes to the access-accept packet. - if a AD user ist member of a read-write and a read-only group at once the user will be rejected because I assume this will be a configuration mistake. This is working so far very well but there is another advantage: Here are several devices which only support telnet access (yes, I know I have to get rid of them as soon as possible). In my point of view it would be fatal to logon to those devices with the active directory account. What I have done for now to authenticate non AD users only for these devices: - define these users in users file - create a huntgroup telnet with all the NAS-IP-Addresses of these devices - create unlang code to set Auth-Type to PAP if a radius request is received with one NAS-IP-Address defined in the huntgroup unlang code below "preprocess" (authorize section of virtual server "default): if(Huntgroup-Name == xos) { update control { Auth-Type = pap } } unlang code below "ldap" (authorize section of virtual server "default): # reject users which are member of a read-only and a read-write group if(Ldap-Group == "cn=alu.rw,ou=Groups,dc=test,dc=local" && Ldap-Group == "cn=alu.ro,ou=Groups,dc=test,dc=local") { reject } elsif(Ldap-Group == "cn=netscreen.rw,ou=Groups,dc=test,dc=local" && Ldap-Group == "cn=netscreen.ro,ou=Groups,dc=test,dc=local") { reject } elsif(Ldap-Group == "cn=nsm.rw,ou=Groups,dc=test,dc=local" && Ldap-Group == "cn=nsm.ro,ou=Groups,dc=test,dc=local") { reject } elsif(Ldap-Group == "cn=aruba.rw,ou=Groups,dc=test,dc=local" && Ldap-Group == "cn=aruba.ro,ou=Groups,dc=test,dc=local") { reject } # Allow only members of AD-Group "cn=radius.users,ou=Groups,dc=test,dc=local" to authenticate against AD! if(Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") { update control { Auth-Type = ntlm_auth } # # Return-Attribute Section # # Return appropriate return attributes to members of "cn=alu.rw,ou=Groups,dc=test,dc=local" if(Ldap-Group == "cn=alu.rw,ou=Groups,dc=test,dc=local") { update reply { Alcatel-Access-Priv = Alcatel-Read-Priv Alcatel-Access-Priv += Alcatel-Write-Priv Alcatel-Access-Priv += Alcatel-Admin-Priv Alcatel-Acce-Priv-F-W1 := 0xffffffff Alcatel-Acce-Priv-F-W2 := 0xffffffff Alcatel-Asa-Access := All Service-Type := 6 } } # Return appropriate return attributes to members of "cn=alu.ro,ou=Groups,dc=test,dc=local" if(Ldap-Group == "cn=alu.ro,ou=Groups,dc=test,dc=local" && !Ldap-Group == "cn=alu.rw,ou=Groups,dc=test,dc=local") { update reply { Alcatel-Access-Priv := Alcatel-Read-Priv Alcatel-Acce-Priv-F-R1 := 0xFFFFFFFF Alcatel-Acce-Priv-F-R2 := 0xFFFFFFFF Alcatel-Acce-Priv-F-W1 := 0x0000000A Alcatel-Acce-Priv-F-W2 := 0x00000000 Alcatel-Asa-Access := all } } # Return appropriate return attributes to members of "cn=netscreen.rw,ou=Groups,dc=test,dc=local" if(Ldap-Group == "cn=netscreen.rw,ou=Groups,dc=test,dc=local") { update reply { NS-Admin-Privilege := Root-Admin } } # Return appropriate return attributes to members of "cn=netscreen.ro,ou=Groups,dc=test,dc=local" if(Ldap-Group == "cn=netscreen.ro,ou=Groups,dc=test,dc=local" && !Ldap-Group == "cn=netscreen.rw,ou=Groups,dc=test,dc=local") { update reply { NS-Admin-Privilege := Read-Only-Admin } } # Return appropriate return attributes to members of "cn=nsm.rw,ou=Groups,dc=test,dc=local" if(Ldap-Group == "cn=nsm.rw,ou=Groups,dc=test,dc=local") { update reply { NS-NSM-User-Domain-Name := global NS-NSM-User-Role-Mapping := "global:System Administrator" } } # Return appropriate return attributes to members of "cn=nsm.ro,ou=Groups,dc=test,dc=local" if(Ldap-Group == "cn=nsm.ro,ou=Groups,dc=test,dc=local" && !Ldap-Group == "cn=nsm.rw,ou=Groups,dc=test,dc=local") { update reply { NS-NSM-User-Domain-Name := global NS-NSM-User-Role-Mapping := "global:Read-Only System Administrator" } } # Return appropriate return attributes to members of "cn=aruba.rw,ou=Groups,dc=test,dc=local" if(Ldap-Group == "cn=aruba.rw,ou=Groups,dc=test,dc=local") { update reply { Aruba-Admin-Role := root Aruba-Priv-Admin-User := 1 } } # Return appropriate return attributes to members of "cn=aruba.ro,ou=Groups,dc=test,dc=local" if(Ldap-Group == "cn=aruba.ro,ou=Groups,dc=test,dc=local" && !Ldap-Group == "cn=aruba.rw,ou=Groups,dc=test,dc=local") { update reply { Aruba-Admin-Role := read-only } } } This is working quite well. An AD user can't logon to a telnet device because the Auth-Type is set to PAP. A local user defined in users file can't logon to any other device than the telnet ones cause of the Huntgroup restriction: xosadmin Huntgroup-Name == xos, Cleartext-Password := "testpw" Now I'm coming closer to my questions. When a local user logon to a telnet device freeradius does all the ldap membership queries. When an AD user will logon to a telnet device freeradius also does all the ldap membership queries. Q1: Can I abbreviate this process that when a local user wants access to a telnet device the ldap queries will be skipped? Q2: Is there a smarter way to reject a local user immediately when he wants to logon to a non telnet device? Q3: Is there a smarter way to reject an AD user immediately when he wants to logon to a telnet device? Q4: Are there any tweaking capabilities to my unlang code to make it smarter or more hardened? Q5: Can I abbreviate any code snippets like using a switch/case block or use variables or anything I don't know? Q6: Are the positions of the unlang code in the authorize section correct? Thanks in advance for any help and hints. Regards, Tobias Hachmer

2 2

pam_radius not using /etc/raddb/server
by g17jimmy 09 Apr '12

09 Apr '12

I have a client system that seems to be ignoring changes in the pam_radius config file, /etc/raddb/server. I initially configured the system with a simple shared secret and had it pointed to a test server and now when I change the file /etc/raddb/server the client still talks to the test server instead of the new freeradius server. I even added the test server IP address to the new freeradius server and verified that the client is even still using the old simple shared secret. I've gone as far as completely removing the /etc/raddb/server file and the client continues to use the previous config. What am I missing? The system has been rebooted numerous times. -- View this message in context: http://freeradius.1045715.n5.nabble.com/pam-radius-not-using-etc-raddb-serv… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2