- Freeradius-Users - lists.freeradius.org

Unknown Auth-Type "LDAP" in authenticate sub-section
by up＠3.am 12 Mar '12

12 Mar '12

Hi: Trying to set up a new RADIUS 2.1.12 server with LDAP. It configured and built all the modules I need, including rlm_ldap, once I installed the dependencies. I took all of the same config files that I have working on servers running 2.1.9 and 2.1.10, but 2.1.12 rlm_ldap doesn't seem to finish instantiating. Here's most of the debug: FreeRADIUS Version 2.1.12, for host x86_64-unknown-linux-gnu, built on Mar 8 2012 at 21:44:43 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/etc/raddb/radiusd.conf including configuration file /usr/etc/raddb/clients.conf including configuration file /usr/etc/raddb/eap.conf including configuration file /usr/etc/raddb/policy.conf including files in directory /usr/etc/raddb/sites-enabled/ including configuration file /usr/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/etc/raddb/sites-enabled/default main { user = "root" group = "wheel" allow_core_dumps = no } including dictionary file /usr/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/usr/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/usr/var/run/radiusd" libdir = "/usr/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 5 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { <SNIP CLIENTS> radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/etc/raddb/radiusd.conf exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/etc/raddb/radiusd.conf Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/etc/raddb/radiusd.conf expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/etc/raddb/radiusd.conf logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/etc/raddb/radiusd.conf modules { Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/etc/raddb/radiusd.conf pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/etc/raddb/radiusd.conf Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/etc/raddb/radiusd.conf mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_pam Module: Instantiating module "pam" from file /usr/etc/raddb/radiusd.conf pam { pam_auth = "radiusd-auth" } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/etc/raddb/radiusd.conf unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating module "ldap1" from file /usr/etc/raddb/radiusd.conf ldap ldap1 { server = "ldap1.domain.com" port = 389 password = "" identity = "" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=domain,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/usr/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = no } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap1-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap1-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap1 rlm_ldap: reading ldap<->radius mappings from file /usr/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP shadowMax mapped to RADIUS Shadow-Max-Age rlm_ldap: LDAP shadowLastChange mapped to RADIUS Shadow-Last-Change rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x958cf20 Module: Instantiating module "ldap2" from file /usr/etc/raddb/radiusd.conf ldap ldap2 { server = "ldap2.domain.com" port = 389 password = "" identity = "" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=domain,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/usr/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = no } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap2-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap2-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap2 rlm_ldap: reading ldap<->radius mappings from file /usr/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password <SNIP most attr maps> rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x958f390 /usr/etc/raddb/sites-enabled/default[241]: Unknown Auth-Type "LDAP" in authenticate sub-section.

5 16

Is this a possible project?
by 甄鹏 12 Mar '12

12 Mar '12

Hello Everybody: Recently,I got a project,it requires set a Radius Server in the company,and 100 APs in 100 Restarants in the city,all the APs of course connected to its own router. I want to the customers who want to use wifi in any of these restarant need to get authentication through the Radius Server locate in my company rather than the traditional wpa/wpa2 ways. for honestly,i am new to freeRadius,i even not really sure if is it a possible project? The radius server could have a static WAN ip address,but all the APs could only got a LAN ip address like 192.168.*.*,when I set up the freeRadius+Mysql system,how could i distinguish different AP?because,i know in the LAN,i set the IP address for different AP for the nasname option in nas.sql. sorry for too many questions here, thank you in advanced Joey

3 2

custom AVPs from LDAP in AccessAccept packet
by Stefano Zanmarchi 12 Mar '12

12 Mar '12

hi, we have a central radius server (LDAP user store) talking to a department radius server connected to an AP. I can't change the LDAP, so I can't use the radiusprofile objectclass. I'd like to configure the central radius server to send custom AVPs fetched from the LDAP to the department radius server. The department radius server (which is proxying AccessRequests to the central radius server) will then unlang these custom AVPs contained in the AccessAccept packet to set the appropriate VLAN Id. I've mapped ldap attributes in the ldap.attrmap of the central radius server (eg: replyItem Campus-Usage-Right diritto8021x) but am now a bit confused on how to go on. Should I now define a custom dictionary file that that the central radius server and the department radius server must share? Or should I rather add entries in /etc/raddb/dictionary of the central radius server (eg ATTRIBUTE Campus-Usage-Right 1 string)? Thank you very much in advance for your help, Stefano

1 0

HP-Command-String in sql accounting
by Marc Boisis-Delavaud 12 Mar '12

12 Mar '12

Hello, I've enabled command accounting of my HP procure switches. The information is sent to radius : rad_recv: Accounting-Request packet from host 10.10.0.138 port 1274, id=79, length=128 Acct-Session-Id = "002800000016" Acct-Status-Type = Interim-Update Service-Type = NAS-Prompt-User Acct-Authentic = RADIUS User-Name = "toto" NAS-IP-Address = 10.10.0.138 NAS-Identifier = "sw" NAS-Port-Type = Virtual Calling-Station-Id = "10.1.11.61" HP-Command-String = "show running-config" Acct-Delay-Time = 0 But the HP-Command-String is not present in the radacct table, is it possible to have it ? thanks

3 2

Re: Freeradius-Users Digest, Vol 83, Issue 43
by pamela pomary 12 Mar '12

12 Mar '12

Thank you Fajar, it works. i included sqlcounter.conf in module section of radiusd.conf. Then I inserted into radcheck a user with the attributes User-Password:="password" Service-Type:="Framed-User" Max-Daily-Session:="240" Debug logs. rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user student, check_item=240, counter=242 modcall[authorize]: module "dailycounter" returns reject for request 15 modcall: leaving group authorize (returns reject) for request 15 Invalid user (rlm_sqlcounter: Maximum hourly usage time reached): [student] (from client C2960_NOC_LAN1 port 50009 cli 00-1E-33-D5-7A-68) Delaying request 15 for 1 seconds Finished request 15 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.1.5.4:1645, id=81, length=197 Sending Access-Reject of id 81 to 10.1.5.4 port 1645 Reply-Message = "Your maximum hourly usage time has been reached" Once again thank you Pamela Pomary ICTD University of Ghana Email: ppomary(a)gmail.com

1 0

about multiple nas
by Dagia Dorjsuren 12 Mar '12

12 Mar '12

Hello all, Does anyone know how to configure the users on the multiple nas/clients in freeradius? for example : my nas type (client type) is chillispot access points. my first nas ip address is 192.168.1.1 my second nas ip address is 192.168.1.2 my third nas ip address is 192.168.1.3 "bot" user must be valid from these NASs/Clients. So, I inserted below rows in radcheck table. But it is not working. Username | Attribute | op | value | | dagia | NAS-IP-Address | == | 192.168.1.1|192.168.1.2|192.168.1.3 | Anyone help me pls?

1 0

Multiple sql accounting queries
by Joe Holden 12 Mar '12

12 Mar '12

Hi guys, I'm looking into the best way to implement multiple sql queries for accounting... what is the "proper" way of doing this (besides evil sql magic), can I define another sql instance? How do I go about mapping queries to that etc? Thanks, Joe

2 2

RE: freeradius + ntlm_auth, broken? SOLVED!
by Andres Septer 10 Mar '12

10 Mar '12

So I finally got the idea, whats wrong. Tehre were missing premissions. I tried to run ntlm_auth under radiusd user and got same error as in logs. Reading winbind reply failed! (0xc0000001) Adding rediusd to winbind group solved the problem. A.

1 0

RE: freeradius + ntlm_auth, broken?
by Andres Septer 10 Mar '12

10 Mar '12

OK, I found out at least one mistake I made: when using command line, grabbed from strace output I forgot to remove commas: SO, this line gives /usr/bin/ntlm_auth "--request-nt-key", "--username=freeradius.test", "--domain=LOCAL", "--challenge=0x7c68b9721c3a0b46", "--nt-response=13e96b497efab1bd69bfdcb845393f54e1cd4d71aa7e604a" Logon failure (0xc000006d) And corrected command line gives /usr/bin/ntlm_auth --request-nt-key --username=freeradius.test --domain=LOCAL --challenge=0x7c68b9721c3a0b46 --nt-response=13e96b497efab1bd69bfdcb845393f54e1cd4d71aa7e604a NT_KEY: 9BBCFC30D5E235BBEC00B013372B14E4 Whitch is, I suppose, correct answer. Why it does not work inside freeradius still remains mystery to me. A.

1 0

RE: freeradius + ntlm_auth, broken?
by Andres Septer 10 Mar '12

10 Mar '12

> which version of samba are you running? versions 3.2 - 3.5 have b0rked return things - > fixed in latest 3.6 - on the command line things work okay but when a program is using the > return values they are wrong (or something to that affect. cant recall all the details > but the recomendation is 3.0.x (RHEL5 classic) or 3.6 (new distro). the mailing list > logs are filled with previous discussion. I have samba 3.6.1 I would like to read previous discussions but google search return broken links (404). https://www.google.com/search?q=ntlm_auth%20site%3Ahttp%3A%2F%2Flists.freer… A.

1 0