- Freeradius-Users - lists.freeradius.org

Re: Re: LDAP redundant with LDAP-Group within users file
by Jan.Gnepper＠t-systems.com 29 Jun '11

29 Jun '11

>> Problem: radius is using always the same ldap server for group extends. >> If this (one!) server fails, radius authentication is not possible. >> Very bad, because we have "redundancy" configured, and expected to have zero outage. >Sorry. The "ldap" module and FreeRADIUS do not work that way. >"LDAP-Group" is a virtual attribute, that is registered by the first >LDAP module to be created; it can't "fail over". It doesn't know about >"redundant {}" or similar. OK, thanks for detailed answer. I read in other threads ansers that already point to that fact. >> Defining all three server whithin one section in modules/ldap >> >> ldap { >> server = "<IP ldap-1> <IP ldap-2> <IP ldap-3>" >> .} >> >> And setting just "ldap" within authorize and authenticate: >> >> With this config an other ldap server is choosen, if the one that has handelt the communication for ldap group extends fails. But failover took 15 minutes. Thats much too long for us. >> (1-3 minutes at most will be acceptable, "zero outage" gorgeous/expected) >It should not take 15 minutes. >What is your "net_timeout" set to? net_timeout = 1 timelimit = 2 timeout = 4 For testing i added a hostroute to an other gateway (=host unreachable) >Unfortunately, when you supply >1 LDAP server, this is handled >internally by libldap, and libldap tries the LDAP servers in series, not >in parallel. So there will always be some outage. As i wrote in my first post, short outage would be ok, but 15 minutes was too much. I added the hostroute to the server that opend the first connection when a request came in (i thought that this is the call regarding ldap-group). That was normaly the last from the list (server=...). I made serveral requests, but all end with "server unreachable / reject". But i could see in tcpdump, that after 15 minutes a lot of connections to an other ldap server were opend. >From this moment, all new requests were successfull, to an other ldap. >FreeRADIUS does not currently have connection pools, and they're a bit >hard with LDAP because libldap doesn't have a great API. >> >> I found mails regarding similar problems within the archive, but no suitable solution. >> (e.g http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg23408.… from 2006) >> >> Is there a solution for reducing the outage and having loadbalancing for our case? >At the moment, the "ldap" module does not have the kind of instant >failover you're looking for. You will need some kind of IP loadbalancing >solution in front of your LDAP servers to achieve this. Not as easy as it sounds ;-) 12 radius pairs (singe server with the same config) at 10 locations, 3 ldap server at 3 different locations For countervail lost of one or two locations, loadbalancing will be very complex.

3 2

Error with Thread
by Jean Carlos Oliveira Guandalini 29 Jun '11

29 Jun '11

Hello, i'm using version 1.1.8, my OS is Linux (Gentoo). My server stop and log this: Error: FATAL: Thread create failed: Resource temporarily unavailable Before this log, have: Wed Jun 29 00:16:13 2011 : Error: Dropping conflicting packet from client client1:41250 - ID: 195 due to unfinished request 155365 Wed Jun 29 00:16:13 2011 : Error: Dropping conflicting packet from client client2:59253 - ID: 235 due to unfinished request 155374 My config for start server is: start_servers = 200 max_servers = 200 min_spare_servers = 10 max_spare_servers = 200 max_requests_per_server = 0 The server only returns if I restart the service Thanks Jean

2 4

Cisco Accounting Attributes
by Arran Cudbard-Bell 29 Jun '11

29 Jun '11

Dear List Users, Would anyone happen to know if the Cisco Aironet 1130AG is capable and willing to provide client IP addresses in Accounting Starts/Stops/Updates? Theoretically it must know the IP address of connected clients, because it does that fancy ARP caching stuff, but it seems like it needs some special hidden command to prod it into sending this information to the RADIUS server. Yes.. I know, not FreeRADIUS related, flame me later... Many Thanks, Arran Arran Cudbard-Bell a.cudbardb(a)freeradius.org RADIUS - Half the complexity of Diameter

1 0

Consigue acceso a mis imágenes y más
by Horacio Andrade 29 Jun '11

29 Jun '11

Hola: He creado una cuenta en Netlog con mis imágenes, vídeos, blogs y eventos. Quiero agregarte a mi lista de amistades para que puedas verlo, ¡pero antes tienes que registrarte en Netlog! Cuando te conectes podrás crear tu propio perfil. Échale un vistazo: http://es.netlog.com/go/mailurl/-bT0xODQyNDgyNjAzJmw9MSZnbT0xMiZ1PSUyRmdvJT… Saludos, Horacio ---------------------------------------------------------------- ¿No quieres recibir más invitaciones de tus amigos? http://es.netlog.com/go/mailurl/-bT0xODQyNDgyNjAzJmw9MiZnbT0xMiZ1PSUyRmdvJT… Don't want to receive invitations from your friends anymore? http://es.netlog.com/go/mailurl/-bT0xODQyNDgyNjAzJmw9MyZnbT0xMiZ1PWh0dHAlM0…

1 0

802.1x auth EAP-TLS problem
by Marco Londero 29 Jun '11

29 Jun '11

Hi folks, I have a problem in my freeradius setup and I'm looking for some hints about that. Scenario: 1) GNU/Linux client w/ WPA supplicant configured to request access through EAP-TLS using a certificate (in order to achieve 802.1x ethernet authentication) 2) 802.1x enabled switch where client is connected 3) user/pass 802.1x authentication works fine (MSCHAPv2 based) 4) freeradius authenticates users on LDAP Freeradius debug log of the issue is here: ------- http://pastie.org/2132916 ------- All certificates should be ok (both on server and client): ------- FP42A certs # openssl verify ca.pem ca.pem: OK FP42A certs # openssl verify server.pem server.pem: OK FP42A certs # openssl verify 02.pem 02.pem: OK ------- Any tips? Thank you! -- mandi, Marco

4 6

LDAP redundant with LDAP-Group within users file
by Jan.Gnepper＠t-systems.com 28 Jun '11

28 Jun '11

Hi, We use radius (freeradius2-2.1.7-7.el5) for user authentication/authorization on network devices. Therefore we use a mapping from huntgroups to ldap groups. We have three ldap server running, and wanted to use "redundant" or "redundant-load-balance". I have tested two cases till now, because i already found messages that point to known problems with ldap redundancy and extends (ldap-groups) within the users file. Case 1 ================ Defining 3 separate ldap server whithin modules/ldap ldap ldap-1 { server = "<IP ldap-1>" .} ldap ldap-2 { server = "<IP ldap-2>" .} ldap ldap-2 { server = "<IP ldap-3>" And using "redundant" for ldap whithin authorize and authenticate: authorize { preprocess files redundant { ldap-1 ldap-2 ldap-3 handled } pap } authenticate { Auth-Type PAP { pap } Auth-Type ldap-1 { ldap-1 } Auth-Type ldap-2 { ldap-2 } Auth-Type ldap-3 { ldap-3 } Auth-Type LDAP { redundant { ldap-1 ldap-2 ldap-3 handled } } } Problem: radius is using always the same ldap server for group extends. If this (one!) server fails, radius authentication is not possible. Very bad, because we have "redundancy" configured, and expected to have zero outage. Case 2 ================ Defining all three server whithin one section in modules/ldap ldap { server = "<IP ldap-1> <IP ldap-2> <IP ldap-3>" .} And setting just "ldap" within authorize and authenticate: authorize { preprocess files ldap pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } } With this config an other ldap server is choosen, if the one that has handelt the communication for ldap group extends fails. But failover took 15 minutes. Thats much too long for us. (1-3 minutes at most will be acceptable, "zero outage" gorgeous/expected) I found mails regarding similar problems within the archive, but no suitable solution. (e.g http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg23408.… from 2006) Is there a solution for reducing the outage and having loadbalancing for our case? I hope that i explained my problem in an understandingly (native language is german), and didn´t paste too much configs. Jan Just a gap of our users file, we have 18 default lines and additional 4 for a local/PAP user: DEFAULT Auth-Type := LDAP, Huntgroup-Name == consoleserver, LDAP-Group == "<LDAP-GROUP-Team-a>" Login-Service = Telnet DEFAULT Auth-Type := LDAP, Huntgroup-Name == consoleserver, LDAP-Group == "<LDAP-GROUP-Team-b>" Login-Service = Telnet DEFAULT Auth-Type := LDAP, Huntgroup-Name == consoleserver, LDAP-Group == "<LDAP-GROUP-Team-c>" Login-Service = Telnet DEFAULT Auth-Type := LDAP, Huntgroup-Name == "nexus", LDAP-Group == "<LDAP-GROUP-Team-a>" Login-Service = Telnet, Vendor-Specific = 9, Cisco-AVPair = "shell:roles*\"network-admin\" \"vdc-admin\"" DEFAULT Auth-Type := LDAP, Huntgroup-Name == "brocade", LDAP-Group == "<LDAP-GROUP-Team-a>" Vendor-Specific = 1991, Foundry-Privilege-Level = 0, foundry-command-string="*", foundry-command-exception-flag=0 DEFAULT Auth-Type := LDAP, LDAP-Group == "<LDAP-GROUP-Team-a>" Service-Type = Administrative-User, Login-Service = Telnet, Vendor-Specific = 9, cisco-avpair = "shell:priv-lvl=15"

3 3

Changing the User-Name value from a request
by Tiberiu Breana 28 Jun '11

28 Jun '11

Hello. I'm using freeRADIUS to authenticate SIP requests and I'm having problems processing the users. In a request I receive a User-Name that isn't useful, and a Sip-URI-User value which contains the real User-Name that I need. I've tried if(Sip-URI-User) { update request { User-Name = Sip-URI-User } } in default's authorize section, but it says "request returns notfound". I've tried User-Name = Sip-URI-User in the preprocess section of radiusd.conf but it doesn't seem to do anything. So, how can I switch the two before proceeding to authenticate the user? Where and what conditions should be placed? I'm kind of in a time crisis and I don't know what to try anymore. Advice is welcome. Thank you.

3 2

change EAP Accept-reject to Accept-Accept
by adzhuma 28 Jun '11

28 Jun '11

Hello, how it's possible change EAP-PEAP Accept-reject to Accept-Accept? I tried with unlang in ms-chap authenticate in inner-tunnel config, but read the documentation for the unlang that the Auth-Type := "Accept" can't be used with EAP. I tried with such config: MSCHAP authentication. Auth-Type MS-CHAP { mschap { reject = 1 } if (reject) { update reply { Framed-IP-Address = "10.0.0.0+" } update control { Auth-Type := "Accept" } ok } Please, help me to solve this issue and how can I change reject to accept. -- View this message in context: http://freeradius.1045715.n5.nabble.com/change-EAP-Accept-reject-to-Accept-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Freeradius + Ldap + SSL/TLS
by RATSIMIVEH Remi 28 Jun '11

28 Jun '11

Hi, I install freeradius on Debian machine. I have my user in ldap and I use that directory to authentication.But when I want to use SSL or TLS in connections between radius and ldap, I have that error in radius log. (Freeradius -X) --------------------------------- [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.corporate.com:1793, authentication 0 [ldap] setting TLS CACert File to /etc/freradius/certs/RootCA.pem [ldap] setting TLS CACert Directory to /etc/freeradius/certs/ [ldap] setting TLS Cert File to /etc/freeradius/certs/RootCA.crt [ldap] setting TLS Key File to /etc/freeradius/certs/SSLSubCA.pem [ldap] setting TLS Key File to /etc/freeradius/certs/ [ldap] bind as uid=...,dc=...,dc=...,dc=.../pssword to ldap.corporate.com:1793 [ldap] waiting for bind result ... [ldap] ldap_result() [ldap] uid=...,dc=...,dc=...,dc=.../pssword to ldap.corporate.com:1793failed: timeout [ldap] (re)connection attempt failed [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns fail --------------------------------- i have in ldap.conf : ldap { server = "ldap.corporate.com" port = 1793 ... tls { # cacertfile = /path/to/cacert.pem # cacertdir = /path/to/certs/ # certfile = /path/to/radius.crt # keyfile = /path/to/radius.key # randfile = /path/to/rnd # require_cert = "demand" cacertfile = /etc/freradius/certs/RootCA.pem cacertdir = /etc/freeradius/certs/ certfile = /etc/freeradius/certs/RootCA.crt keyfile = /etc/freeradius/certs/SSLSubCA.pem randfile = /etc/freeradius/certs/ require_cert = "allow" it's an another team who manage this ldap corporate. This team request me to import the Corporate.Root.CA and Corporate.SSL.CA to be able to SSL connections. About them, my radius server don't used SSL connections. I don't know where put them... Sorry for my English, the french replies will be accepted.....

1 0

Bind username to certificate
by Marco Londero 28 Jun '11

28 Jun '11

Hi folks, is it possible to bind a SSL certificate (used for EAP-TLS auth) to a specific LDAP user instead of using user's LDAP-stored password? Thank you! -- mandi, Marco

2 2