- Freeradius-Users - lists.freeradius.org

More Info: Setting group membership
by inetjunkmail 10 Nov '10

10 Nov '10

Debug info below On Tue, Nov 9, 2010 at 2:09 PM, inetjunkmail <inetjunkmail(a)gmail.com> wrote: > I know I'm missing something obvious but I'm stuck here so I apologize in > advance for the silly question. > > I'm using freeradius 2.1.7. > > I'm using the "files" option for all processes but I want to use user > groups so I can reference them in my huntgroups definitions as groups of > users permitted to authentication to that group of devices. I tried > modifying the etc_group module and the group is correctly determined but it > takes place after the huntgroup decision making process done by > "preprocessing" so the match condition for the huntgroup fails. I then > inserted the module before "preprocessing" in my sites-available/default > file and the group is correctly determined prior to preprocessing but it > doesn't seem to match the test condition. Snippets of config are below. > Any guidance would be appreciated. > > modules/My-Group-Name > ----- > passwd My-Group-Name { > filename = /etc/raddb/group > format = "=My-Group-Name:*,User-Name" > hashsize = 50 > ignorenislike = yes > allowmultiplekeys = yes > delimiter = ":" > } > ----- > > dictionary > ----- > ATTRIBUTE My-Group-Name 3000 string > ----- > > group > ----- > telecom:test1 > hg1admin:test2 > > huntgroups > ----- > hg1 NAS-IP-Address =~ "^10\.69\.1\..*" > My-Group-Name == telecom, > My-Group-Name == hg1admin, > ----- > > users > ----- > test1 Cleartext-Password := "password1" > test2 Cleartext-Password := "password2" > ----- > > I've inserted the My-Group-Name module at various locations within > sites-available/default with no luck. Again, ant guidance would be > appreciated. > > > > Here is some debug info. The group name is assigned but the huntgroup match still fails. Can someone provide insight as to why? Ready to process requests. rad_recv: Access-Request packet from host 10.69.1.10 port 1645, id=69, length=76 User-Name = "test1" User-Password = "password1" NAS-Port = 0 NAS-Port-Id = "tty0" NAS-Port-Type = Async Calling-Station-Id = "async" NAS-IP-Address = 10.69.1.10 +- entering group authorize {...} [My-Group-Name] Added My-Group-Name: 'telecom' to reply_items ++[My-Group-Name] returns ok [preprocess] expand: %{NAS-IP-Address} -> 10.69.1.10 [preprocess] No huntgroup access: [test1] (from client k12 port 0 cli async) ++[preprocess] returns reject Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 69 to 10.69.1.10 port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 69 with timestamp +16 Ready to process requests.

2 1

Mikrotik Dictionaries
by Ben Wiechman 10 Nov '10

10 Nov '10

It appears that the Mikrotik dictionary was removed from /usr/share/dictionary in commit 38cee089d7f88a4e517d when the Motorola WiMAX dictionaries were added. Was this intentional or an oversight? Ben

3 3

username@domain
by zouzou 10 Nov '10

10 Nov '10

Hello, I have two users: test1 and test2 I would like to grant test1 access by this syntax of username ; Username: test1@domaine1 ( exp: domaine1= DRH) I would like to grant test2 access by this syntax of username; Username: test2@domaine2 ( exp: domaine1=DG) And I would not like to grant test1 access by this syntax of username Username: test1@domaine2 ( exp: domaine2= DG) Same for user test2 I wonder if FreeRADIUS is capable of handling it , if freeradius handle it , please could you tell me how??? Best Regard. -- View this message in context: http://freeradius.1045715.n5.nabble.com/username-domain-tp3258786p3258786.h… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

LDAP Groups
by Hugh Blandford 10 Nov '10

10 Nov '10

Dear All, I have been experimenting with using FreeRADIUS and LDAP, trying to get some understanding of how groups are handled. I have left things in the configuration files mostly as standard, except uncommenting the LDAP sections but am obviously not understanding how things are supposed to work. I can place an LDAP group name in the users file and then have my LDAP user checked against it and return the relevant attributes. eg (following someone's helpful example) DEFAULT Ldap-Group == flat10000, User-Profile := "uid=flat10000,ou=profiles,ou=radius,ou=wl,dc=example,dc=org" Fall-Through = yes DEFAULT Ldap-Group == disabled, Auth-Type := Reject Reply-Message = "Account disabled. Please call the helpdesk.", Fall-Through = no However, I was hoping to not use the users file. I was hoping that: groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = radiusGroupName would mean you could add the attribute radiusGroupName to a user's entry and it would then look up the relevant GroupofNames and add those attributes to the return items. However, when I add radiusGroupName to a user's entry I don't see any groupname lookups in the debug at all. Sorry if I have failed to understand something basic. What I actually want to do is might not be solved best by LDAP groups. Most of our customers are in different VRFs and this, the loopback address and DNS servers etc are returned. Rather than store this information under each user I would like to have template that I refer to. However, at the same time, having 50+ default entries didn't seem the right way to do it either. Thanks for your patience. Hugh Blandford -- Hugh Blandford Island Internet ph 1300 130 428 mb 0412 016 875

5 7

EAP-AKA patch
by dfds fds 10 Nov '10

10 Nov '10

Hi , I searched web via google , but i am not able to find the patch for AKA support for free radiusAll are pointing to http://bugs.freeradius.org/show_bug.cgi?id=386but this is no longer exists , did anybody have the patch? please send me the patch.

1 0

LDAP Frontend with Support for RADIUS Schema
by Holger Rauch 09 Nov '10

09 Nov '10

Hi, I would like to use FreeRADIUS on either Debian or FreeBSD stable for VPN user authentication. Authentication should be based on the following information: a) username+MIT Kerberos password b) MAC address of the machine c) OTP generated by e.g. a Yubikey device d) (possibly) a client certificate or a public/private key pair (either created by SSH or GPG) (The combination of b) and d) would uniquely identify the machine; the combination of a) and c) would uniquely identify the user). I would like to store this information in LDAP DIT (served by OpenLDAP). Up to now, I've only used OpenLDAP for POSIX+Samba account info und MIT Kerberos related data. My questions are: - Is there any current documentation for such a (or a quite similar) scenario? Up to now, one documentation I found was http://vuksan.com/linux/dot1x/802-1x-LDAP.html but this one is related to MAC authentication for WLAN setups - Are there any web frontends and/or GUI frontends offering support for the RADIUS schema? Thanks in advance for any info and kind regards, Holger

3 3

Re: Accounting Log
by Breuer Nicolas 09 Nov '10

09 Nov '10

Breuer Nicolas wrote: > > Accounting-01 thinks that stop packet with zero session length is an error > and tried to connect to Accounting-02 sql server. > > Is it the correct behaviour ? Yes. see doc/configurable_failover for how to change redundant groups. Alan DeKok. Alan, I know that this is the correct behaviour concerning redundant groups but for me a Stop with zero session length isn't a SQL issue that needs to go on secondary SQL servers. Breuer Nicolas Network Supervisor Sales Executive BELCENTER sprl/bvba Avenue Henri Consciencelaan, 94 Bruxelles 1140 Brussel T. : +32 (0)2 403 04 60 F. : +32 (0)2 403 04 63 M. :+32 (0)486 50 27 87 E. : Nicolas.Breuer(a)Belcenter.biz W. : http://www.BelCenter.be | http://www.BelCenter.net

2 1

redundant SQL / WARNING: Unknown module "sql" in string expansion
by Tom Teeuwen 09 Nov '10

09 Nov '10

Hello, I configured my freeradius with redundant SQL config: In sql.conf: Sql sql1 { .... ..... .... } Sql sql2 { ...... ..... ...... } Radiusd.conf: Redundant sql { Sql1 Sql2 } And in my default site config: Authorize { .... ... .... .... Sql ... ... } Now I want to do some extra SQL-queries within my authorize section. I used something like if ("%{sql:select ........ I receive the following error: WARNING: Unknown module "sql" in string expansion "%{sql:select Without the redundant module it works perfectly :) Kind regards, Tom

2 3

Setting group membership
by inetjunkmail 09 Nov '10

09 Nov '10

I know I'm missing something obvious but I'm stuck here so I apologize in advance for the silly question. I'm using freeradius 2.1.7. I'm using the "files" option for all processes but I want to use user groups so I can reference them in my huntgroups definitions as groups of users permitted to authentication to that group of devices. I tried modifying the etc_group module and the group is correctly determined but it takes place after the huntgroup decision making process done by "preprocessing" so the match condition for the huntgroup fails. I then inserted the module before "preprocessing" in my sites-available/default file and the group is correctly determined prior to preprocessing but it doesn't seem to match the test condition. Snippets of config are below. Any guidance would be appreciated. modules/My-Group-Name ----- passwd My-Group-Name { filename = /etc/raddb/group format = "=My-Group-Name:*,User-Name" hashsize = 50 ignorenislike = yes allowmultiplekeys = yes delimiter = ":" } ----- dictionary ----- ATTRIBUTE My-Group-Name 3000 string ----- group ----- telecom:test1 hg1admin:test2 huntgroups ----- hg1 NAS-IP-Address =~ "^10\.69\.1\..*" My-Group-Name == telecom, My-Group-Name == hg1admin, ----- users ----- test1 Cleartext-Password := "password1" test2 Cleartext-Password := "password2" ----- I've inserted the My-Group-Name module at various locations within sites-available/default with no luck. Again, ant guidance would be appreciated.

1 0

Authentication by domain of company
by zouzou 09 Nov '10

09 Nov '10

Hi, I am new to FreeRADIUS. I have two users: test1 test2 I would like to grant test1 access by this syntax of username ; Username: test1@domaine1 ( exp: domaine1= DRH) I would like to grant test2 access by this syntax of username; Username: test2@domaine2 ( exp: domaine1=DG) And I would not like to grant test1 access by this syntax of username Username: test1@domaine2 ( exp: domaine2= DG) Same for user test2 I wonder if FreeRADIUS is capable of handling , if freeradius handle it , please could you tell me how??? Best Regard. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentication-by-domain-of-company… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0