- Freeradius-Users - lists.freeradius.org

Rlm_ldap Login withount a identity
by Esdras Caleb Oliveira Silva 03 Oct '11

03 Oct '11

My LDAP server requires autentication, but for security reasson I cant let a user with permission to read all data from outher to made the bind for radius. Studing the log and using radiusd in debug mod I discovered if I let the identity and password in black the raius try log with the login and password provide by the user of radius, and it binds, but afther it also tryes retrive the user info with the user login, what fails. There is a way to do the login with LDAP without the identity or password? Using the information provide by the user to try bind in LDAP and if bind is sucessufull the RADIUS autenticates?? Sorry bad English Esdras Caleb -- (Você irá para o céu ou não? Acesse www.BoaPessoa.com.br já para saber!) "Não se VAI à Igreja. Se É Igreja."

1 0

rlm_ldap patch for access_attr_deny_value
by Fred 03 Oct '11

03 Oct '11

Hi all, This patch is an attempt to have a more generic custom access_attr support, by introducing a new ldap module configuration parameter named "access_attr_deny_value" allowing to check arbitrary access_attr attribute value to reject user. Without this patch, configured access_attr attribute is checked against a static,(hard-coded) "FALSE" value. With this patch, rlm_ldap module user can configure not only custom access_attr attribute, but also custom access_attr_deny_value value to control user lock status. Default value remains FALSE, to maintain backward compatibility. This patch has been made because if, for example, inetUserStatus is used at ldap server level to control lock user status, this control is done by ldap server when user tries to bind to the ldap. >From freeradius point of view, if ldap bind is not done for any reason (e.I. because radiusd received a MSCHAP challenge, and just replayed MSCHAP using ntPassword or lmPassword retrieved during author) , ldap server will not have occation to reject the user at binding, so radiusd has to do the job himself for inetUserStatus to be honored. If radiusd does not do the job, only ldap-binded user will be rejected (by ldap) but non-binded user will be accepted, thus making ldap settings disabling the user with inetUserStatus set to "inactive" will not be honored at radius level and user will be unexpectedly accepted. For example, ${confdir}/modules/ldap : access_attr = inetUserStatus # OID 2.16.840.1.113730.3.1.692 access_attr_deny_value = "inactive" With this setup, if inetUSerStatus is set to inactive in ldap directory for a particular user, this user will be rejected early during authorization. Best regards, Fred MAISON ############################################### diff -u ./src/freeradius-server/src/modules/rlm_ldap/rlm_ldap.c ./Documents/Radius/Freeradius/freeradius-server-2.1.12/src/modules/rlm_ldap/rlm_ldap.c --- ./src/freeradius-server/src/modules/rlm_ldap/rlm_ldap.c 2011-09-20 14:11:34.000000000 +0200 +++ ./Documents/Radius/Freeradius/freeradius-server-2.1.12/src/modules/rlm_ldap/rlm_ldap.c 2011-09-29 17:39:32.000000000 +0200 @@ -146,6 +146,7 @@ char *default_profile; char *profile_attr; char *access_attr; + char *access_attr_deny_value; char *passwd_hdr; char *passwd_attr; int auto_header; @@ -304,6 +305,8 @@ offsetof(ldap_instance,access_attr), NULL, NULL}, {"access_attr_used_for_allow", PW_TYPE_BOOLEAN, offsetof(ldap_instance,default_allow), NULL, "yes"}, + {"access_attr_deny_value", PW_TYPE_STRING_PTR, + offsetof(ldap_instance,access_attr_deny_value), NULL, "FALSE"}, {"chase_referrals", PW_TYPE_BOOLEAN, offsetof(ldap_instance,chase_referrals), NULL, NULL}, {"rebind", PW_TYPE_BOOLEAN, @@ -1405,8 +1408,8 @@ if (inst->access_attr) { if ((vals = ldap_get_values(conn->ld, msg, inst->access_attr)) != NULL) { if (inst->default_allow){ - RDEBUG("checking if remote access for %s is allowed by %s", request->username->vp_strvalue, inst->access_attr); - if (!strncmp(vals[0], "FALSE", 5)) { + RDEBUG("checking if remote access for user %s is %s by %s", request->username->vp_strvalue, inst->access_attr_deny_value, inst->access_attr); + if (!strncmp(vals[0], inst->access_attr_deny_value, sizeof(inst->access_attr_deny_value))) { RDEBUG("dialup access disabled"); snprintf(module_fmsg,sizeof(module_fmsg)," [%s] Access Attribute denies access", inst->xlat_name); module_fmsg_vp = pairmake("Module-Failure-Message", module_fmsg, T_OP_EQ); ###############################################

1 1

Ubuntu client always connect to wlan even if it is not allowed by Freeradius
by PROST Frédéric 03 Oct '11

03 Oct '11

Hello, I set up Freeradius 2.1.11 to authenticate against ActiveDirectory (with ntlm) after having validated the mac Address (with mac-auth), for a wireless Lan (Netgear WPAN320). Everything is working fine on Windows but I have a problem with workstation on Ubuntu 11.04 : on the first connection, everything is working fine : it checks if the MAC address and login/password are correct and allow connection or not. But if the connection is correct at the first time and if I then change one of those parameters (ie, disable MAC address on the radius server or change login on my Ubuntu workstation), I can still connect to my WLAN. The only way to correct this problem is to physically switch off and on the wlan card on Ubuntu workstation. It seems that it has a kind of cache but I can't determine where and how to disable it (on my Radius server). Here is a freeradius log extract of the first connection where we can see that it checks the MAC address Mon Oct 3 11:55:51 2011 : Info: ++- entering policy rewrite.calling_station_id {...} Mon Oct 3 11:55:51 2011 : Info: +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) Mon Oct 3 11:55:51 2011 : Info: ?? Evaluating (Calling-Station-Id) -> TRUE Mon Oct 3 11:55:51 2011 : Info: expand: %{Calling-Station-Id} -> 00-18-DE-55-61-7F Mon Oct 3 11:55:51 2011 : Info: expand: policy.mac-addr -> policy.mac-addr Mon Oct 3 11:55:51 2011 : Info: expand: ^%{config:policy.mac-addr}$ -> ^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$ Mon Oct 3 11:55:51 2011 : Info: ? Evaluating ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE Mon Oct 3 11:55:51 2011 : Info: +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE Mon Oct 3 11:55:51 2011 : Info: +++- entering if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) {...} Mon Oct 3 11:55:51 2011 : Info: expand: %{1}-%{2}-%{3}-%{4}-%{5}-%{6} -> 00-18-DE-55-61-7F Mon Oct 3 11:55:51 2011 : Info: expand: %{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} -> 00-18-de-55-61-7f Mon Oct 3 11:55:51 2011 : Info: ++++[request] returns ok Mon Oct 3 11:55:51 2011 : Info: ++++[updated] returns updated Mon Oct 3 11:55:51 2011 : Info: +++- if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) returns updated Mon Oct 3 11:55:51 2011 : Info: +++ ... skipping else for request 11: Preceding "if" was taken Mon Oct 3 11:55:51 2011 : Info: ++- policy rewrite.calling_station_id returns updated Mon Oct 3 11:55:51 2011 : Info: [authorized_macs] expand: %{Calling-Station-ID} -> 00-18-de-55-61-7f Mon Oct 3 11:55:51 2011 : Info: [authorized_macs] users: Matched entry 00-18-de-55-61-7f at line 2 Mon Oct 3 11:55:51 2011 : Info: ++[authorized_macs] returns ok Mon Oct 3 11:55:51 2011 : Info: ++? if (!ok) Mon Oct 3 11:55:51 2011 : Info: ? Evaluating !(ok) -> FALSE Mon Oct 3 11:55:51 2011 : Info: ++? if (!ok) -> FALSE Mon Oct 3 11:55:51 2011 : Info: ++? if (!EAP-Message) Mon Oct 3 11:55:51 2011 : Info: ? Evaluating !(EAP-Message) -> FALSE Here is the Freeradius log file for the second connection, after disable MAC Address and restarted FreeRadius (it connects directly without checking MAC address) : rad_recv: Accounting-Request packet from host 192.168.2.15 port 32847, id=2, length=152 Acct-Session-Id = "4E8592C9-00000140" Acct-Status-Type = Start Acct-Authentic = RADIUS User-Name = "salons" NAS-IP-Address = 192.168.2.15 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "20-4E-7F-3C-EF-00:mdwifi" Calling-Station-Id = "00-18-DE-55-61-7F" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" Mon Oct 3 11:50:16 2011 : Info: # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default Mon Oct 3 11:50:16 2011 : Info: +- entering group preacct {...} Mon Oct 3 11:50:16 2011 : Info: ++[preprocess] returns ok Mon Oct 3 11:50:16 2011 : Info: [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.2.15,NAS-IP-Address = 192.168.2.15,Acct-Session-Id = "4E8592C9-00000140",User-Name = "salons"' Mon Oct 3 11:50:16 2011 : Info: [acct_unique] Acct-Unique-Session-ID = "94477ec3eb897dd7". Mon Oct 3 11:50:16 2011 : Info: ++[acct_unique] returns ok Mon Oct 3 11:50:16 2011 : Info: [suffix] No '@' in User-Name = "salons", looking up realm NULL Mon Oct 3 11:50:16 2011 : Info: [suffix] No such realm "NULL" Mon Oct 3 11:50:16 2011 : Info: ++[suffix] returns noop Mon Oct 3 11:50:16 2011 : Info: ++[files] returns noop Mon Oct 3 11:50:16 2011 : Info: # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default Mon Oct 3 11:50:16 2011 : Info: +- entering group accounting {...} Mon Oct 3 11:50:16 2011 : Info: [detail] expand: %{Packet-Src-IP-Address} -> 192.168.2.15 Mon Oct 3 11:50:16 2011 : Info: [detail] expand: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.2.15/detail-20111003 Mon Oct 3 11:50:16 2011 : Info: [detail] /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.2.15/detail-20111003 Mon Oct 3 11:50:16 2011 : Info: [detail] expand: %t -> Mon Oct 3 11:50:16 2011 Mon Oct 3 11:50:16 2011 : Info: ++[detail] returns ok Mon Oct 3 11:50:16 2011 : Info: ++[unix] returns ok Mon Oct 3 11:50:16 2011 : Info: [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp Mon Oct 3 11:50:16 2011 : Info: [radutmp] expand: %{User-Name} -> salons Mon Oct 3 11:50:16 2011 : Info: ++[radutmp] returns ok Mon Oct 3 11:50:16 2011 : Info: ++[exec] returns noop Mon Oct 3 11:50:16 2011 : Info: [attr_filter.accounting_response] expand: %{User-Name} -> salons Mon Oct 3 11:50:16 2011 : Debug: attr_filter: Matched entry DEFAULT at line 12 Mon Oct 3 11:50:16 2011 : Info: ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 2 to 192.168.2.15 port 32847 Mon Oct 3 11:50:16 2011 : Info: Finished request 1. Mon Oct 3 11:50:16 2011 : Info: Cleaning up request 1 ID 2 with timestamp +17 Mon Oct 3 11:50:16 2011 : Debug: Going to the next request Mon Oct 3 11:50:16 2011 : Info: Ready to process requests. Do you have any idea of how to correct this ? Thank you very much, Regards, Fred

4 3

FW: Radius Server Doesn't Communicate AP
by Alejandro Moreno 03 Oct '11

03 Oct '11

Hi my problem is that im trying to communicate my radius server with the access point that i already configured and already added to the clients list and still doesn't work! i've been in all the forums about freeradius and i've read all the documentation of freeradius but nothing solve thisim really frustrated about this so i'd really appreciate it if someone could help me thank u

8 25

Re: Radius Server Doesn't Communicate AP
by Alan Buxey 02 Oct '11

02 Oct '11

Hi, You box is on a different subnet to your wireless router. What kit do you have UK place to ensure your 192.168.0.0/24 kit can talk to the 192.168.75.0/24? You should always be able to reach 127.0.0.1 on whatever box you are on ;) alan

1 0

Freeradius for Lan
by Andreas Rudat 02 Oct '11

02 Oct '11

Hello, I use radius for my wlan auth but I also want it for lan but how? I use pfsense with radius 2.x It works fine with wlan but how I use it for lan? If I connect via lan port on my AP I can reach everything without radius auth. Thanks Andreas

6 9

Using unlang to customize Tunnel-Medium-Type for 3com switches
by Stanisław Kamiński 30 Sep '11

30 Sep '11

Hi, my problem: I use RADA on 2 lines of 3com switches: - those with ComWare 5 expect Radius to return Tunnel-Medium-Type = "IEEE-802" - those with ComWare 3 expect Tunnel-Medium-Type = "802" Of course, in users, I can use only one of those values, as follows: f0-0f-de-ad-f0-01 Cleartext-Password := "f0-0f-de-ad-f0-01" Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id := 3, Tunnel-Type = VLAN Fortunately, after switching Radius mode on Comware3 switches to "extended", they started to introduce themselves: rad_recv: Access-Request packet from host 172.23.30.70 port 41201, id=97, length=130 User-Name = "f0-0f-de-ad-f0-01" User-Password = "f0-0f-de-ad-f0-01" NAS-IP-Address = 172.23.30.210 NAS-Identifier = "deadbeef1e02" NAS-Port = 16867329 NAS-Port-Id = "unit=1;subslot=0;port=22;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "f00f-dead-f001" 3Com-Connect_Id = 9 3Com-Product-ID = "4200G" 3Com-NAS-Startup-Timestamp = 954636905 I can see 3Com-Product-ID = "4200G", and I would like to change Tunnel-Medium-Type to 802 if I see it. After looking at unlang man page - explains the basics, but show no examples; radiusd.conf - still no examples; and googling - some examples, but I counted 4 of them (maybe I searched the wrong way, but see for yourself what does "unlang examples" yield) I decided to write here for help. From what I read, I should add the condition in "post-auth" section. As I understand it, it should look like this: if ( "%{request:3Com-Product-ID}" == "4200G" ) { update reply { Tunnel-Medium-Type = "802" } } is that about right? (and yes, I should find that by myself, only explanation is that test system setup would take ~3-4 hrs and I can't do testing on production - whereas I count on you being able to tell right from wrong in about ~5 sec). Thanks in advance, Stan

4 3

missing "rlm_perl.so" in the built from src file
by Alex rsm 30 Sep '11

30 Sep '11

Hi, I built a fresh freeradius on a ubuntu server from source files. When I add perl module and start the freeradiusin the debug mode, it is asking for "rlm_perl.so" that can not find it. It seems the make file does not create the shared lib file for perl module. Is there any change should be made in Makefile to create "rlm_perl.so" file? Thanks, ASM

2 1

Fwd: MySQL and FreeRADIUS environment.
by Antonio Fernández Pérez 30 Sep '11

30 Sep '11

Hi everybody, In my company we are thinking to implement a FreeRADIUS server with MySQL on Linux. We need to duplicate FreeRADIUS service because we think that this is a critical service for us but the authentication process only could be done with the master server(FreeRADIUS and MySQL service, both in only one server). For the other hand, if we want to replicate the data base servers, we would have to synchronize two database servers but we would not know wich would be the best solution, cluster or synchronize. Maybe we will not to need a MySQL cluster service and we will need two servers only. First with master FreeRADIUS service and master MySQL service and the second with slave FreeRADIUS service and slave MySQL service. What do you think about the best solution to implement this environment? I hope your answer. Thank you very much. Regards, -- *Antonio Manuel Fernández Pérez* Ingeniero Técnico Informático Dpto. Informático Fabergames S.L. TLF:966261111 / FAX:966551801 www.fabergames.com Fabergames respeta su privacidad<http://www.fabergames.com/index.php/component/content/article/57/1-politica…> * * * ADVERTENCIA LEGAL * * * Le informamos, como destinatario de este mensaje, que el correo electrónico y las comunicaciones por medio de Internet no permiten asegurar ni garantizar la confidencialidad de los mensajes transmitidos, así como tampoco su integridad o su correcta recepción, por lo que FABERGAMES S.L. no asume responsabilidad alguna por tales circunstancias. Si no consintiese en la utilización del correo electrónico o de las comunicaciones vía Internet le rogamos nos lo comunique y ponga en nuestro conocimiento de manera inmediata. Este mensaje va dirigido, de manera exclusiva, a su destinatario y contiene información confidencial y sujeta al secreto profesional, cuya divulgación no está permitida por la ley. En caso de haber recibido este mensaje por error, le rogamos que, de forma inmediata, nos lo comunique mediante correo electrónico remitido a nuestra atención o a través del teléfono (+ 34) 966 26 11 11 y proceda a su eliminación, así como a la de cualquier documento adjunto al mismo. Asimismo, le comunicamos que la distribución, copia o utilización de este mensaje, o de cualquier documento adjunto al mismo, cualquiera que fuera su finalidad, están prohibidas por la ley.

3 2

rlm_perl
by Alex rsm 30 Sep '11

30 Sep '11

Hi, How can I configure Freeradius to call example.pl perl script in the rlm_perl module? i.e., I want the perl script to be called when Freeradius receives a request. Thanks, ASM

5 7