- Freeradius-Users - lists.freeradius.org

VMPS configuration examples
by Brett A. Karns 06 Aug '10

06 Aug '10

Can someone point me in the right direction of some VMPS configuration examples please, there seems to be very limited information about this on the web. ___________________________________________ Brett

2 1

Assistance in handling ldap query failure scenario
by John Douglass 06 Aug '10

06 Aug '10

I believe this bit of magic can be done based on other configurations but I can't work out the right "foo" so hopefully someone can help me out. I have my service manager asking for some additional magic out of our freeradius servers that handle our wireless WPA enterprise authentication/authorization. Situation: LDAP connect/lookup fails (returns 'fail') and I want to continue processing as if it were "ok". Right now we want to ensure to err on the side of the customer and continue in the event there is an LDAP service outage. Setup: I have the system working correctly with LDAP utilizing Freeradius 1.1.9. However, I am not sure how to do unlang control in the event of an LDAP failure. I am handling if an LDAP lookup is not found however. Test: What I am attempting to test with is configure the ldap module with a non-existent LDAP server to fail but continue processing in the event of an LDAP failure. I have Googled, read many configuration examples, and got a decent grip of unlang so hopefully someone can point me in the right direction. I'm close, but missing a small key component I imagine. Here are (what I believe to be ) he important configuration sections and debug output. authorize { preprocess # This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP authentication. eap { ok = return } # LDAP: Development where if not found, steer them to group vlan0316 # This part works as expected when LDAP answers and the user is not found gted-lawn-authz if(notfound) { update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 316 } notfound = return } # Look in an SQL database. The schema of the database is meant to mirror the "users" file. sqlwpa } The LDAP module configuration is as follows: ldap gted-lawn-authz { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "ldaps://blahserver.gatech.edu" port = 636 identity = "myBindDNDeletedForPrivacy" password = "myPasswordDeletedForPrivacy" basedn = "myBaseDNdeletedForPrivacy" filter = "myFilterThatWorksNormallyDeleted" ldap_connections_number = 10 timeout = 4 timelimit = 10 net_timeout = 1 tls { start_tls = no tls_mode = no require_cert = "never" } # Mapping of RADIUS dictionary attributes to LDAP directory attributes. dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no set_auth_type = no } I have tried to handle this in the authorize{} section but not sure how to override the "fail" returncode from the ldap module in order to continue. gted-lawn-authz # want to detect a failure of the above gted-lawn-authz module, on failure skip to the next section which is "sqlwpa" if(fail) { fail = return } if(notfound) { update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 316 } notfound = return } # Look in an SQL database. The schema of the database is meant to mirror the "users" file. sqlwpa Running it in debug mode I see it never hits the if(fail) section. My guess (but I haven't found any concrete info on how to continue) would be to have something in the gted-lawn-authz ldap module configuration as it looks like it breaks out of the loop there. +- entering group authorize {...} ++[preprocess] returns ok [eap] EAP packet type response id 0 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [gted-lawn-authz] performing user authorization for test-account [gted-lawn-authz] expand: (filterDeleted) [gted-lawn-authz] expand: (baseDeleted) [gted-lawn-authz] ldap_get_conn: Checking Id: 0 [gted-lawn-authz] ldap_get_conn: Got Id: 0 [gted-lawn-authz] attempting LDAP reconnection [gted-lawn-authz] (re)connect to ldaps://bleh.gatech.edu, authentication 0 [gted-lawn-authz] setting TLS Require Cert to never [gted-lawn-authz] bind as uid=deletedForPrivacy [gted-lawn-authz] uid=deletedForPrivacy [gted-lawn-authz] (re)connection attempt failed [gted-lawn-authz] search failed [gted-lawn-authz] ldap_release_conn: Release Id: 0 ++[gted-lawn-authz] returns fail Invalid user: [jd187/<via Auth-Type = EAP>] (from client localhost port 0 cli 02-00-00-00-00-01) } # server wpa Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> jd187 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Thanks in advance, - John Douglass, Georgia Institute of Technology

2 1

Setting up pam_radius_auth
by Mike J 06 Aug '10

06 Aug '10

Hi, I'm trying to get the the pam radius module to work. I've built a test radius server (FreeRADIUS Version 2.1.9) and I've setup a linux box with the pam radius module (1.3.17) The server seems to be setup properly to authenticate users: # radtest testing password 127.0.0.1 0 testing123 Sending Access-Request of id 87 to 127.0.0.1 port 1812 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=87, length=20 I have the following config on the server to correspond to my pam radius client: clients.conf: client testclient1 { ipaddr = CLIENTIP secret = testing123 require_message_authenticator = no shortname = testc1 nastype = other # localhost isn't usually a NAS... } And on the client (using pam_radius_auth) I have the following in /etc/raddb/server: # server[:port] shared_secret timeout (s) SERVERIP testing123 4 Now, when I try to authenticate my pam radius client, I get this in the client logs: Jul 22 10:22:45 (none) pamtest: pam_radius_auth: Got user name testing Jul 22 10:22:54 (none) pamtest: pam_radius_auth: Sending RADIUS request code 1 Jul 22 10:22:54 (none) pamtest: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 267885588. Jul 22 10:22:55 (none) pamtest: pam_radius_auth: packet from RADIUS server SERVERIP fails verification: The shared secret is probably incorrect. Jul 22 10:22:55 (none) pamtest: pam_radius_auth: All RADIUS servers failed to respond. Jul 22 10:22:55 (none) pamtest: pam_radius_auth: authentication failed And I get this on the radius server (running in debug mode, i.e. radiusd -X) rad_recv: Access-Request packet from host CLIENTIP port 18580, id=32, length=72 User-Name = "testing" User-Password = "\237TqI\3335Q\231\025O\020bw\021;\362" NAS-Identifier = "other" NAS-Port = 17555 NAS-Port-Type = Virtual Service-Type = Authenticate-Only +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry testing at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "?TqI�5Q??O?bw?; [pap] Using clear text password "password" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 32 to CLIENTIP port 18580 Waking up in 4.9 seconds. Cleaning up request 0 ID 32 with timestamp +24 Ready to process requests. Now obviously is says there's a problem with the secret, but I believe I've setup the secret correctly in the configs I've shown above. Does anybody have any ideas what I'm doing wrong? Thanks.

2 6

(no subject)
by Walter Goulet 06 Aug '10

06 Aug '10

Sssssseessss ee

1 0

Problem about simultaneous-use parameter and windows DC.
by 李程 06 Aug '10

06 Aug '10

Hello guys. We set up a freeradius server several months ago. We use postgresql database for Users and Clients databases, and all works fine. Then we want to use a windows domain controller to do the anthentication by calling ntlm_auth. After some tests, it works too. But now we have no idea how to enable the simultaneous-use parameter, because tables of Users database is actually empty, all user informations are in the windows DC. Is there any way to enable the simultaneous-use parameter? Thanks! Miles

2 4

Moving to Virtual Servers
by Cory Johnson 06 Aug '10

06 Aug '10

Greetings, I've been using the documentation here: http://wiki.freeradius.org/Virtual_server attempting to create 2 virtual servers on the same socket each associated with a client. I have already configured the ldap module, as well as added some lines to the users file. Before "virtualizing" I am able to authenticate my ldap users via radtest. Here's the config that works against LDAP, before trying to add to a virtual server: prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct name = freeradius confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid user = freerad group = freerad max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 1812 } listen { ipaddr = * port = 1813 type = acct } client 192.168.1.0/24 { secret = testing123 } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = yes auth = yes auth_badpass = yes auth_goodpass = no msg_goodpass = "Great Success!" msg_badpass = "I'm sorry but you appear to have entered a incorrect password or you may not be authorized to access this equipment" } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ ...And the output from a test in debug mode (edited out passwords and password hashes): [ldap] Entering ldap_groupcmp() [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 rlm_ldap::ldap_groupcmp: User found in group NOC [ldap] ldap_release_conn: Release Id: 0 [ldap] performing user authorization for cjohnson [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] sambaNtPassword -> NT-Password == 0xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX [ldap] sambaLmPassword -> LM-Password == 0xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX [ldap] looking for reply items in directory... [ldap] Setting Auth-Type = LDAP [ldap] user cjohnson authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 [ldap] login attempt by "cjohnson" with password "s3cret" [ldap] user DN: uid=cjohnson,ou=Users,dc=corp,dc=example,dc=com [ldap] (re)connect to 192.168.1.99:389, authentication 1 [ldap] bind as uid=cjohnson,ou=Users,dc=corp,dc=example,dc=com/s3cret to 192.168.1.99:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user cjohnson authenticated succesfully Login OK: [cjohnson] (from client 192.168.1.0/24 port 0) Great Success! Waking up in 4.0 seconds. Here's the changes I made to the config, attempting to add current setup to virtual server "server_one": ... listen { type = auth ipaddr = * port = 1812 } listen { ipaddr = * port = 1813 type = acct } client 192.168.1.0/24 { virtual_server = server_one secret = testing123 } server server_one { } ... The rest of the config is the same. The server will start, but now I can't see my LDAP users, heres the log entry: server server_one { Login incorrect: [cjohnson/s3cret] (from client 192.168.1.0/24 port 0) I'm sorry but you appear to have entered a incorrect password or you may not be authorized to access this equipment } # server server_one Is there something I need to put within server section? It's as if the ldap module and the users file aren't being referenced anymore. Any tips or references to complete examples where virtual servers are set up in this way? If someone could take a moment to point me in the right direction I would certainly appreciate it. Cory J

2 1

RE: suffix configuration
by Sallee, Stephen (Jake) 06 Aug '10

06 Aug '10

> Look at modules/realm > This is how you "split" off domain\user or user@domain. I did look at that file before I posted, but I don't know what I could change in it that would help me. It looks like the only think that is set in that file is the delimiter. The suffix delimiter is correct, but I still cannot get authenticated with the username@domain convention. I tried adding the following to my realms file but it does nothing -------------------------- realm umhb.edu { format = suffix delimiter = "@" } realm cru { format = suffix delimiter = "@" } -------------------------- Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221 -----Original Message----- From: freeradius-users-bounces+jake.sallee=umhb.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+jake.sallee=umhb.edu@lists.freeradius.o rg] On Behalf Of Johan Meiring Sent: Thursday, August 05, 2010 2:03 PM To: freeradius-users(a)lists.freeradius.org Subject: Re: suffix configuration On 2010/08/05 08:37 PM, Sallee, Stephen (Jake) wrote: >> realms > > ... thank you. Whilst I do appreciate brevity, a single monosyllabic > response seems as though it may be a bit too brief : ) > > Can you elaborate? I am not asking for anyone so solve my problem for > me but rather to be pointed in the correct direction. > Was hoping you had read all the files in /etc/radiusd (or /etc/freeradius) already. Look at modules/realm This is how you "split" off domain\user or user@domain. -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RADIUS Certificate question
by Sallee, Stephen (Jake) 06 Aug '10

06 Aug '10

I am about to generate a CSR for my FreeRADIUS Server. The vast majority of my clients are Vista and Win 7 with a few MACs, with this in mind would I be better off going with a 1024 bit cert or would a 2048 bit cert be better? I know both are quite secure, but for platform interoperability and future proofing, does anyone have any thoughts on which one is better? Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

2 1

mac-auth-bypass
by Brett A. Karns 05 Aug '10

05 Aug '10

Where can I find a good document on using freeRADIUS for mac-auth-bypass? ___________________________________________ Brett

2 1

suffix configuration
by Sallee, Stephen (Jake) 05 Aug '10

05 Aug '10

One last problem and I think I am ready for production, wohoo! When my users try to login with the convention username@domain the login fails because I do not think I have FreeRADIUS correctly configured to parse out the domain, however if they login with the convention domain\username it works fine. Where do I configure the behavior of suffix to act the same as prefix? Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

2 4