- Freeradius-Users - lists.freeradius.org

FreeRadius and LDAP from Nortel Switch
by BELLIERE Eric 28 Sep '10

28 Sep '10

Phil, Fine It is working better. What a stupid error :-) Now I have to troubleshoot because the Freeradius send a Accept but the Switch is saying Invalid Password FR 2.1.9 Sending Access-Accept of id 169 to 192.168.250.64 port 4481 Switch Login: ebellier Password: ******** Invalid Password. Many Thanks. Eric B. ****

1 0

FreeRadius and LDAP from Nortel Switch
by BELLIERE Eric 28 Sep '10

28 Sep '10

Dears, I would like to make a radius authentication while access to a Network Elements (Nortel ERS 8600). This authentication will be done via LDAP. Everything seems to be ok except that when the request is sent from the Network elements the password is not in clear text and then FreeRadius says that password didn't matches. When I try from RadPing (from my laptop) then my LDAP authentication is OK Can you please help me? >From RadPing rad_recv: Access-Request packet from host 172.18.113.82 port 3340, id=1, length=48 User-Name = "ebellier" User-Password = "xxxxxxxxxx" Tue Sep 28 14:25:30 2010 : Info: +- entering group authorize {...} Tue Sep 28 14:25:30 2010 : Info: ++[preprocess] returns ok Tue Sep 28 14:25:30 2010 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.18.113.82/auth-detail-20100928 Tue Sep 28 14:25:30 2010 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.18.113.82/auth-detail-20100928 Tue Sep 28 14:25:30 2010 : Info: [auth_log] expand: %t -> Tue Sep 28 14:25:30 2010 Tue Sep 28 14:25:30 2010 : Info: ++[auth_log] returns ok Tue Sep 28 14:25:30 2010 : Info: ++[chap] returns noop Tue Sep 28 14:25:30 2010 : Info: ++[mschap] returns noop Tue Sep 28 14:25:30 2010 : Info: [suffix] No '@' in User-Name = "ebellier", looking up realm NULL Tue Sep 28 14:25:30 2010 : Info: [suffix] Found realm "DEFAULT" Tue Sep 28 14:25:30 2010 : Info: [suffix] Adding Stripped-User-Name = "ebellier" Tue Sep 28 14:25:30 2010 : Info: [suffix] Adding Realm = "DEFAULT" Tue Sep 28 14:25:30 2010 : Info: [suffix] Authentication realm is LOCAL. Tue Sep 28 14:25:30 2010 : Info: ++[suffix] returns ok Tue Sep 28 14:25:30 2010 : Info: [eap] No EAP-Message, not doing EAP Tue Sep 28 14:25:30 2010 : Info: ++[eap] returns noop Tue Sep 28 14:25:30 2010 : Info: ++[unix] returns updated Tue Sep 28 14:25:30 2010 : Debug: [ldap] Entering ldap_groupcmp() Tue Sep 28 14:25:30 2010 : Info: [files] expand: ou=Staff,o=mobistar.be -> ou=Staff,o=mobistar.be Tue Sep 28 14:25:30 2010 : Info: [files] expand: %{Stripped-User-Name} -> ebellier Tue Sep 28 14:25:30 2010 : Info: [files] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ebellier) Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (uid=ebellier) request done: ld 0x1fb4500 msgid 8 Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:25:30 2010 : Info: [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass =GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3debellier\2cou\3dStaff\2c o\3dmobistar.be))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3debell ier\2cou\3dStaff\2c o\3dmobistar.be))) Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (&(cn=GF_FW_networkManagementProdAdmin)(|(&(objectClass=GroupOfNames)(member =uid\3debellier\2cou\3dStaff\2c o\3dmobistar.be))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3debell ier\2cou\3dStaff\2c o\3dmobistar.be)))) request done: ld 0x1fb4500 msgid 9 Tue Sep 28 14:25:30 2010 : Debug: rlm_ldap::ldap_groupcmp: User found in group GF_FW_networkManagementProdAdmin Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:25:30 2010 : Info: ++[files] returns noop Tue Sep 28 14:25:30 2010 : Info: [ldap] performing user authorization for ebellier Tue Sep 28 14:25:30 2010 : Info: [ldap] expand: %{Stripped-User-Name} -> ebellier Tue Sep 28 14:25:30 2010 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ebellier) Tue Sep 28 14:25:30 2010 : Info: [ldap] expand: ou=Staff,o=mobistar.be -> ou=Staff,o=mobistar.be Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:25:30 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (uid=ebellier) request done: ld 0x1fb4500 msgid 10 Tue Sep 28 14:25:30 2010 : Info: [ldap] looking for check items in directory... Tue Sep 28 14:25:30 2010 : Info: [ldap] looking for reply items in directory... Tue Sep 28 14:25:30 2010 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Sep 28 14:25:30 2010 : Info: [ldap] Setting Auth-Type = LDAP Tue Sep 28 14:25:30 2010 : Info: [ldap] user ebellier authorized to use remote access Tue Sep 28 14:25:30 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:25:30 2010 : Info: ++[ldap] returns ok Tue Sep 28 14:25:30 2010 : Info: ++[expiration] returns noop Tue Sep 28 14:25:30 2010 : Info: ++[logintime] returns noop Tue Sep 28 14:25:30 2010 : Info: [pap] Found existing Auth-Type, not changing it. Tue Sep 28 14:25:30 2010 : Info: ++[pap] returns noop Tue Sep 28 14:25:30 2010 : Info: Found Auth-Type = LDAP Tue Sep 28 14:25:30 2010 : Info: +- entering group LDAP {...} Tue Sep 28 14:25:30 2010 : Info: [ldap] login attempt by "ebellier" with password "xxxxxxx" Tue Sep 28 14:25:30 2010 : Info: [ldap] user DN: uid=ebellier,ou=Staff, o=mobistar.be Tue Sep 28 14:25:30 2010 : Debug: [ldap] (re)connect to 192.168.154.50:389, authentication 1 Tue Sep 28 14:25:30 2010 : Debug: [ldap] bind as uid=ebellier,ou=Staff, o=mobistar.be/Mamour20 to 192.168.154.50:389 Tue Sep 28 14:25:30 2010 : Debug: [ldap] waiting for bind result ... request done: ld 0x1fbcdb0 msgid 1 Tue Sep 28 14:25:30 2010 : Debug: [ldap] Bind was successful Tue Sep 28 14:25:30 2010 : Info: [ldap] user ebellier authenticated succesfully Tue Sep 28 14:25:30 2010 : Info: ++[ldap] returns ok Tue Sep 28 14:25:30 2010 : Auth: Login OK: [ebellier/Mamour20] (from client 172.18.113.82/32 port 0) Tue Sep 28 14:25:30 2010 : Info: +- entering group post-auth {...} Tue Sep 28 14:25:30 2010 : Info: [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/172.18.113.82/reply-detail-20100928 Tue Sep 28 14:25:30 2010 : Info: [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/172.18.113.82/reply-detail-20100928 Tue Sep 28 14:25:30 2010 : Info: [reply_log] expand: %t -> Tue Sep 28 14:25:30 2010 Tue Sep 28 14:25:30 2010 : Info: ++[reply_log] returns ok Tue Sep 28 14:25:30 2010 : Info: ++[exec] returns noop Sending Access-Accept of id 1 to 172.18.113.82 port 3340 Tue Sep 28 14:25:30 2010 : Info: Finished request 3. Tue Sep 28 14:25:30 2010 : Debug: Going to the next request Tue Sep 28 14:25:30 2010 : Debug: Waking up in 4.9 seconds. Tue Sep 28 14:25:35 2010 : Info: Cleaning up request 3 ID 1 with timestamp +176 Tue Sep 28 14:25:35 2010 : Info: Ready to process requests. >From Nortel ERS : rad_recv: Access-Request packet from host 192.168.250.64 port 4439, id=186, length=60 User-Name = "ebellier" User-Password = "%\357\350\t\310}\341Ú¡9\327F\336F\034\364" NAS-IP-Address = 192.168.250.64 NAS-Port = 1 Tue Sep 28 14:22:40 2010 : Info: +- entering group authorize {...} Tue Sep 28 14:22:40 2010 : Info: ++[preprocess] returns ok Tue Sep 28 14:22:40 2010 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.250.64/auth-detail-20100928 Tue Sep 28 14:22:40 2010 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.250.64/auth-detail-20100928 Tue Sep 28 14:22:40 2010 : Info: [auth_log] expand: %t -> Tue Sep 28 14:22:40 2010 Tue Sep 28 14:22:40 2010 : Info: ++[auth_log] returns ok Tue Sep 28 14:22:40 2010 : Info: ++[chap] returns noop Tue Sep 28 14:22:40 2010 : Info: ++[mschap] returns noop Tue Sep 28 14:22:40 2010 : Info: [suffix] No '@' in User-Name = "ebellier", looking up realm NULL Tue Sep 28 14:22:40 2010 : Info: [suffix] Found realm "DEFAULT" Tue Sep 28 14:22:40 2010 : Info: [suffix] Adding Stripped-User-Name = "ebellier" Tue Sep 28 14:22:40 2010 : Info: [suffix] Adding Realm = "DEFAULT" Tue Sep 28 14:22:40 2010 : Info: [suffix] Authentication realm is LOCAL. Tue Sep 28 14:22:40 2010 : Info: ++[suffix] returns ok Tue Sep 28 14:22:40 2010 : Info: [eap] No EAP-Message, not doing EAP Tue Sep 28 14:22:40 2010 : Info: ++[eap] returns noop Tue Sep 28 14:22:40 2010 : Info: ++[unix] returns updated Tue Sep 28 14:22:40 2010 : Debug: [ldap] Entering ldap_groupcmp() Tue Sep 28 14:22:40 2010 : Info: [files] expand: ou=Staff,o=mobistar.be -> ou=Staff,o=mobistar.be Tue Sep 28 14:22:40 2010 : Info: [files] expand: %{Stripped-User-Name} -> ebellier Tue Sep 28 14:22:40 2010 : Info: [files] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ebellier) Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] attempting LDAP reconnection Tue Sep 28 14:22:40 2010 : Debug: [ldap] (re)connect to 192.168.154.50:389, authentication 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] bind as / to 192.168.154.50:389 Tue Sep 28 14:22:40 2010 : Debug: [ldap] waiting for bind result ... request done: ld 0x1fb4500 msgid 1 Tue Sep 28 14:22:40 2010 : Debug: [ldap] Bind was successful Tue Sep 28 14:22:40 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (uid=ebellier) request done: ld 0x1fb4500 msgid 2 Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:22:40 2010 : Info: [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass =GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3debellier\2cou\3dStaff\2c o\3dmobistar.be))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3debell ier\2cou\3dStaff\2c o\3dmobistar.be))) Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (&(cn=GF_FW_networkManagementProdAdmin)(|(&(objectClass=GroupOfNames)(member =uid\3debellier\2cou\3dStaff\2c o\3dmobistar.be))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3debell ier\2cou\3dStaff\2c o\3dmobistar.be)))) request done: ld 0x1fb4500 msgid 3 Tue Sep 28 14:22:40 2010 : Debug: rlm_ldap::ldap_groupcmp: User found in group GF_FW_networkManagementProdAdmin Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:22:40 2010 : Info: ++[files] returns noop Tue Sep 28 14:22:40 2010 : Info: [ldap] performing user authorization for ebellier Tue Sep 28 14:22:40 2010 : Info: [ldap] expand: %{Stripped-User-Name} -> ebellier Tue Sep 28 14:22:40 2010 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ebellier) Tue Sep 28 14:22:40 2010 : Info: [ldap] expand: ou=Staff,o=mobistar.be -> ou=Staff,o=mobistar.be Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Tue Sep 28 14:22:40 2010 : Debug: [ldap] performing search in ou=Staff,o=mobistar.be, with filter (uid=ebellier) request done: ld 0x1fb4500 msgid 4 Tue Sep 28 14:22:40 2010 : Info: [ldap] looking for check items in directory... Tue Sep 28 14:22:40 2010 : Info: [ldap] looking for reply items in directory... Tue Sep 28 14:22:40 2010 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Sep 28 14:22:40 2010 : Info: [ldap] Setting Auth-Type = LDAP Tue Sep 28 14:22:40 2010 : Info: [ldap] user ebellier authorized to use remote access Tue Sep 28 14:22:40 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Tue Sep 28 14:22:40 2010 : Info: ++[ldap] returns ok Tue Sep 28 14:22:40 2010 : Info: ++[expiration] returns noop Tue Sep 28 14:22:40 2010 : Info: ++[logintime] returns noop Tue Sep 28 14:22:40 2010 : Info: [pap] Found existing Auth-Type, not changing it. Tue Sep 28 14:22:40 2010 : Info: ++[pap] returns noop Tue Sep 28 14:22:40 2010 : Info: Found Auth-Type = LDAP Tue Sep 28 14:22:40 2010 : Info: +- entering group LDAP {...} Tue Sep 28 14:22:40 2010 : Info: [ldap] login attempt by "ebellier" with password "%ïè È}áÚ¡9×FÞF?ô" Tue Sep 28 14:22:40 2010 : Info: [ldap] user DN: uid=ebellier,ou=Staff, o=mobistar.be Tue Sep 28 14:22:40 2010 : Debug: [ldap] (re)connect to 192.168.154.50:389, authentication 1 Tue Sep 28 14:22:40 2010 : Debug: [ldap] bind as uid=ebellier,ou=Staff, o=mobistar.be/%ïè È}áÚ¡9×FÞF?ô to 192.168.154.50:389 Tue Sep 28 14:22:40 2010 : Debug: [ldap] waiting for bind result ... request done: ld 0x1fbcd90 msgid 1 Tue Sep 28 14:22:40 2010 : Debug: [ldap] Bind failed with invalid credentials Tue Sep 28 14:22:40 2010 : Info: ++[ldap] returns reject Tue Sep 28 14:22:40 2010 : Info: Failed to authenticate the user. Tue Sep 28 14:22:40 2010 : Auth: Login incorrect ( [ldap] Bind as user failed): [ebellier/%\357\350\t\310}\341Ú¡9\327F\336F\034\364] (from client 192.168.250.64 port 1) Tue Sep 28 14:22:40 2010 : Debug: WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Tue Sep 28 14:22:40 2010 : Info: Using Post-Auth-Type Reject Tue Sep 28 14:22:40 2010 : Info: +- entering group REJECT {...} Tue Sep 28 14:22:40 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> ebellier Tue Sep 28 14:22:40 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Sep 28 14:22:40 2010 : Info: ++[attr_filter.access_reject] returns updated Tue Sep 28 14:22:40 2010 : Info: Delaying reject of request 0 for 1 seconds Tue Sep 28 14:22:40 2010 : Debug: Going to the next request Tue Sep 28 14:22:40 2010 : Debug: Waking up in 0.9 seconds. Tue Sep 28 14:22:41 2010 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 186 to 192.168.250.64 port 4439 Tue Sep 28 14:22:41 2010 : Debug: Waking up in 4.9 seconds. Tue Sep 28 14:22:46 2010 : Info: Cleaning up request 0 ID 186 with timestamp +6 Tue Sep 28 14:22:46 2010 : Info: Ready to process requests. <http://k-village/team_members/who_s_who/kpeople01.asp?login=ebellier> Eric Bellière Operation & Integration Expert ITNO/ISO/ISIO/LSS Mobistar NV/SA Avenue Jean Mermoz 32 6041 Gosselies cid:image003.jpg@01C961E5.77656AB0 Tel: +32 (0)2 745 7997 GSM: +32(0)495 55 1343

2 1

Re: Radius proxy - kind of
by Matija Levec 28 Sep '10

28 Sep '10

Hi! I still can't find solution to my problem in documentation so I'll rephrase the question. Is it possible to proxy requests in a way analogous to bogus example below? realm example.com { auth_pool = pool1 { reject = 1 ok = return } auth_pool = pool2 { reject = 1 ok = return } } # Authentication fails only if both pools return reject. I know documentation says "... It proxies packets ONLY when it receives a packet or a re-transmission from the NAS. If the NAS never re-transmits, the proxy never re-transmits, either." Can someone at least suggest in what direction to look for solution? Thank you, Matija >>> Matija Levec 24.9.2010 16:24 >>> Hi everyone! First a little bit of explaining... - auth_server 1 client - fr_proxy -[ - auth_server 2 (client=random NAS, fr_proxy=freeradius, auth_server=two-factor auth server(s)) Currently we have clients authenticating directly to auth_server 1. We would like to gradually (and transparently) move users to new authenticators which use auth_server 2 Question What I would like to accomplish is: If auth_server 1 returns notfound or reject or fail, proxy request to auth_server 2 Is it possible to use 'configurable module fail over'-like syntax for configuring proxy (home)servers? I hopes this makes sense. Anyway... all ideas appreciated! Regards, Matija

2 1

Problemers using Freeradius with Anyconnect..
by Thomas Raabo - ZitCom A/S 28 Sep '10

28 Sep '10

Iam trying to use Freeradius with Cisco ASA anyconnect.. But I just can´t get it to work The problem is that when I use Freeradius the ASA just don't seem to get the framed-ip-address or something... ( when we try to connect with anyconnect it gives the error host or network is 0) with IAS the right ip gets assigned and all just works If I try the same thing with Microsoft IAS it just works Here is the output from radtest First MS IAS [root@mgmt3 raddb]# radtest tr2(a)test.local XXXX 172.16.16.206:1812 1 test Sending Access-Request of id 185 to 172.16.16.206 port 1812 User-Name = "tr2(a)test.local" User-Password = "XXXX" NAS-IP-Address = 172.16.24.4 NAS-Port = 1 rad_recv: Access-Accept packet from host 172.16.16.206 port 1812, id=185, length=259 Framed-IP-Netmask = 255.255.255.128 Framed-Protocol = PPP Service-Type = Framed-User Framed-IP-Address = 172.20.3.129 Class = 0xb4fc099a0000013700011700fe80000000000000e42365c53146798301cb5ed46d12aaaa0000000000000056 Cisco-AVPair = "ip:inacl#100=permit ip 172.20.3.128 255.255.255.128 172.20.3.0 255.255.255.0" Cisco-AVPair = "ip:inacl#101=permit ip 172.20.3.128 255.255.255.128 172.16.34.0 255.255.255.0" >From Freeradius [root@mgmt3 raddb]# radtest hmm2 XXXX 172.16.16.202:1812 1 Rzitcom! Sending Access-Request of id 79 to 172.16.16.202 port 1812 User-Name = "hmm2" User-Password = "XXXX" NAS-IP-Address = 172.16.24.4 NAS-Port = 1 rad_recv: Access-Accept packet from host 172.16.16.202 port 1812, id=79, length=222 Framed-IP-Netmask = 255.255.255.128 Framed-Protocol = PPP Service-Type = Framed-User Framed-IP-Address = 172.20.3.128 Class = 0x4f553d54455354 Cisco-AVPair = "ip:inacl#100=permit ip 172.20.3.128 255.255.255.128 172.20.3.0 255.255.255.0" Cisco-AVPair = "ip:inacl#100=permit ip 172.20.3.128 255.255.255.128 172.16.34.0 255.255.255.0" INSERT INTO `radreply` (`id`, `UserName`, `Attribute`, `op`, `Value`) VALUES (3, 'hmm2', 'Framed-IP-Netmask', ':=', '255.255.255.128'), (4, 'hmm2', 'Framed-Protocol', ':=', 'PPP'), (5, 'hmm2', 'Service-Type', ':=', 'Framed-User'), (6, 'hmm2', 'Framed-IP-Address', ':=', '172.20.3.128'), (8, 'hmm2', 'Cisco-AVPair', '+=', 'ip:inacl#100=permit ip 172.20.3.128 255.255.255.128 172.20.3.0 255.255.255.0'), (9, 'hmm2', 'Cisco-AVPair', '+=', 'ip:inacl#100=permit ip 172.20.3.128 255.255.255.128 172.16.34.0 255.255.255.0'), (7, 'hmm2', 'Class', ':=', 'OU=TEST'); This is the out from the ASA so its able to use freeradius... :) we also use it for administrative users test aaa-server authentication RadiusServers host 172.16.16.202 us$ INFO: Attempting Authentication test to IP address <172.16.16.202> (timeout: 12 seconds) INFO: Authentication Successful Med venlig hilsen | Best regards Thomas Raabo Netværksansvarlig [Description: Description: Description: cid:image001.jpg@01C9A70C.01A27540]<http://www.zitcom.dk/> tr(a)zitcom.dk<mailto:tr@zitcom.dk> | Direkte: +45 69 10 60 18 | Tlf: +45 70 23 55 66

2 2

problema con la instalacion freeradius en debian
by Samuel Isaias Barriga Perez 27 Sep '10

27 Sep '10

Estimados: Estoy tratando de configurar un servidor Radius (Freeradius) en debian (Lenny), el problema es que cuando uso el comando radisud -XX el resultado me da el siguiente: radius01:~# radiusd -XX Mon Sep 27 20:49:45 2010 : Info: FreeRADIUS Version 2.1.9, for host x86_64-unknown-linux-gnu, built on Sep 27 2010 at 02:41:08 Mon Sep 27 20:49:45 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Mon Sep 27 20:49:45 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Mon Sep 27 20:49:45 2010 : Info: PARTICULAR PURPOSE. Mon Sep 27 20:49:45 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Mon Sep 27 20:49:45 2010 : Info: GNU General Public License v2. Mon Sep 27 20:49:45 2010 : Info: Starting - reading configuration files ... Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Mon Sep 27 20:49:45 2010 : Debug: including files in directory /usr/local/etc/raddb/modules/ Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/exec Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/inner-eap Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pap Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smsotp Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/echo Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/policy Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expr Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/unix Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/wimax Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/always Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ntlm_auth Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/digest Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/linelog Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pam Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/files Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/realm Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/cui Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.example.com Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/counter Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/perl Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/chap Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/otp Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/eap.conf Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/policy.conf Mon Sep 27 20:49:45 2010 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/control-socket Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Mon Sep 27 20:49:45 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Mon Sep 27 20:49:45 2010 : Debug: main { Mon Sep 27 20:49:45 2010 : Debug: allow_core_dumps = no Mon Sep 27 20:49:45 2010 : Debug: } Mon Sep 27 20:49:45 2010 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Mon Sep 27 20:49:45 2010 : Error: Errors reading dictionary: dict_init: /usr/local/etc/raddb/dictionary[14]: Couldn't open dictionary "/usr/local/share/freeradius/dictionary": No such file or directory y si me voy al path /usr/local/share/freeradius/dictionary este archivo no existe, que puedo hacer al respecto gracias samuel

2 1

Additional Restrictions for users
by William Burnett 27 Sep '10

27 Sep '10

I currently have my RADIUS servers setup to handle authentication for my various NAS's to grant users access to network resources. I would like to use the same servers to handle authentication for SSH for various routers. This all works, but I'm having a hard time getting the RADIUS server to only accept requests from users of the "ssh" group. I obviously don't want john.doe accessing my core routers. What is the best way to go about this? I was trying to use unlang to query my database but can't seem to get the syntax right. contents of sites-enabled/default: ...authorize { preprocess if (Service-Type == "Login-User") if ( %{group_membership_query} == "ssh") { update reply { ok-to-continue } } else { update reply { Auth-Type := Reject } }.... The group_membership_query would reference this: group_membership_query = "SELECT groupname \ FROM ${usergroup_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY priority" Any help/suggestions would be much appreciated. Sincerely, William Burnett burnett.w(a)gmail.com

3 5

sending accounting for two home servers
by Evgeniy Kozhuhovskiy 27 Sep '10

27 Sep '10

Is it possible to send accounting packets to two home servers? In fact, one server is real auth+acct server, and another server is a web filter that applies rules according information at start packets. -- С уважением, Евгений Кожуховский Руководитель группы сервисных платформ УИТ ЦИТС МГТС РУП Белтелеком +375-29-3998175 +375-29-7561625 +375-17-3060026

3 7

eap-tls certificates
by Peter McEvoy 27 Sep '10

27 Sep '10

Hi. I'm in the process of setting up freeradius 2.1.9 on debian lenny/sparc. I've got everything working for eap tls with the self signed certificates that come with freeradius. This is working well for macs and some smartphones but I'm having trouble with windows machines. My research indicates that buying a certificate from a known CA will solve my problems (or I believe I could import a certificate into the windows devices but with up to 1000 clients I'd prefer not to have to do this). Can anyone confirm if this is the case? If so, is there a specific type of certificate I need to buy that would include some 'extensions' that I'm told windows clients require. Cheers -- Pete

2 2

Re: Re: radius client / send NAS IP ?
by Michael Arndt 27 Sep '10

27 Sep '10

Hello Alan, sorry, my fault :-) radclient saves my day, indeed i can send any attribute / value pair i like thanks for your help Micha

1 0

Re: Pushing group attribute from OpenDirectory to Cisco
by Sander van Loosbroek 26 Sep '10

26 Sep '10

Just wanted to let you all know that I got it working with your instructions. In the end I realized that there were multiple groups associated with each user and that such a lookup wasn't gonna work anyway. I created single user entries like this in the users file: user1 Cleartext-Password := "userpassword" Service-Type = NAS-Prompt-User, cisco-avpair = "webvpn:user-vpn-group=management" The user has to be active in the OpenDirectory as well for this to work but this is desired behaviour in my configuration anyway. Now the avpair gets pushed to the Cisco router and used to select the correct policy in the WebVPN context. I'm gonna write a blogpost on my full setup on http://edgetechnology.wordpress.com that explains the full setup for those interested. Thank you all for your help. Sander On 24 sep 2010, at 12:00, freeradius-users-request(a)lists.freeradius.org wrote: > Date: Fri, 24 Sep 2010 09:04:34 +0200 > From: Sander van Loosbroek <sander(a)vanloosbroek.com> > Subject: Re: Freeradius-Users Digest, Vol 65, Issue 105 > To: freeradius-users(a)lists.freeradius.org > Message-ID: <9C852831-8F4D-4DCF-9A2A-1D6C3D8EDD96(a)vanloosbroek.com> > Content-Type: text/plain; charset=us-ascii > > What I'm trying to do is retrieve the user group from the OpenDirectory instead of setting a static one. There is only one NAS and the Mac OS X Server runs a standalone OpenDirectory Master so I don't need any huntgroups then? > > On 24 sep 2010, at 05:42, freeradius-users-request(a)lists.freeradius.org wrote: > >> Date: Fri, 24 Sep 2010 08:02:38 +1200 >> From: Peter Lambrechtsen <plambrechtsen(a)gmail.com> >> Subject: Re: Pushing group attribute from OpenDirectory to Cisco >> To: FreeRadius users mailing list >> <freeradius-users(a)lists.freeradius.org> >> Message-ID: >> <AANLkTik16Nrmbb1OmrVWcFuhTFKnLEDYwvPFs5FydrbT(a)mail.gmail.com> >> Content-Type: text/plain; charset="iso-8859-1" >> >> In the "users" file is where you specify the reply attributes in my example. >> >> So using your example: >> >> DEFAULT Huntgroup-Name == CiscoVPN, Ldap-Group == >> "cn=CiscoVPN,ou=Roles,ou=Radius,DC=ACME,DC=COM" >> Service-Type = "NAS-Prompt-User", >> Idle-Timeout = 600, >> Cisco-AVPair = >> "webvpn:user-vpn-group=whatevervpngroupyouwanttoaddtheuserto" >> >> Then you can either use the huntgroup file and set the IP addresses of the >> Routers (NAS's) you're using: http://wiki.freeradius.org/Huntgroups >> >> Or you can have the Huntgroups in ldap as per my e-mail, and that would be >> if you have a more dynamic environment or want to move the NAS between >> different huntgroups easily. >> >> >> >> On Fri, Sep 24, 2010 at 2:03 AM, Sander van Loosbroek < >> sander(a)vanloosbroek.com> wrote: >> >>> Hello Peter and Alan, >>> >>> Thank you for your reply. I've given the documentation of Peter a look but >>> I'm not that familiar with LDAP or how its underpinnings work in OS X >>> Server. >>> >>> When the Cisco router now authenticates against the FreeRADIUS server all >>> works fine except for the fact that the group name is not returned with the >>> webvpn:vpn-user-group attribute. What is unclear to me is how I instruct >>> FreeRADIUS to include that attribute when it returns the authorization >>> message. I have made the following addition to my clients file: >>> >>> client 192.168.13.1/32 { >>> secret = xxx >>> shortname = vpn >>> nastype = cisco >>> } >>> >>> I have added a policy to the Cisco router to pick up the attribute but it >>> doesn't seem to get through. Can you suggest what to try next? >>> >>> Thanks, >>> Sander >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html

2 1