- Freeradius-Users - lists.freeradius.org

Grouping similar users to profiles
by Natr Brazell 29 Jul '10

29 Jul '10

I am looking for information on grouping users into profiles/groups. I've searched around the FAQ's and docs but not finding a clear picture. I've found how to associate a user with a group of NAS's. . Here's the scenario. There is a specfic VSA from Juniper called Juniper-Local-User-Name. This gets mapped to a locally defined profile on the NAS. In the users file I have the following: bob.smith Juniper-Local-User-Name = "tier3", mary.jane Juniper-Local-User-Name = "tier3", bobby.sue Juniper-Local-User-Name = "tier3", Furthermore there is other VSA's such as the Juniper-Allow-Commands and Juniper-Deny-Commands. So I can do things like: billy.bob Juniper-Local-User-Name = "tier2", Juniper-Deny-Commands "(show system alarms)|(show system software)" john.doe Juniper-Local-User-Name = "tier2", Juniper-Deny-Commands "(show system alarms)|(show system software)" So to the point, rather than defining each user with the same parameters every time, can I create a group, for instance TIER3, and associate User-Name's above to the group. And if so how or point me to some specific examples. I am using LDAP also so if there is an LDAP solution same question. Howto?

2 4

LDAP authentication problem
by Sallee, Stephen (Jake) 29 Jul '10

29 Jul '10

I have correctly configured the LDAP module (I think...) but when I try to authenticate a user I get an error saying the user cannot be found. I have attached the debug output. I have tried turning the "follow referrals" and "rebind" vars on and off but I get the same outcome. At first, I was getting a timeout error but I increased the timeouts and fixed that. I know the user is correct. Here is the LDAP string for the user: LDAP://CN=dspam,OU=InformationTechnology,OU=UsersByDepartment,OU=Adminis trative,DC=umhb,DC=edu Any ideas? Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

2 1

Passing variables from inner tunnel
by newtownz 29 Jul '10

29 Jul '10

Hi, I'm trying to pass the value of LDAP-UserDn from the inner-tunnel to the default server. I have read unlang and also tried many combinations including update outer.control from the inner tunnel and nothing worked... Here is a debug output where we can see that the User-Dn get expanded correctly in the tunnel but is empty in the default server. ++[eap] returns ok +- entering group post-auth {...} expand: %{control:LDAP-UserDn} -> cn=aruba,ou=etudiant,o=org Exec-Program output: etudiant Exec-Program-Wait: plaintext: etudiant Exec-Program: returned: 0 ++[reply] returns noop ++[outer.control] returns noop } # server inner-tunnel .... .... [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} ++[exec] returns noop expand: %{control:LDAP-UserDn} -> PHP Notice: Undefined offset: 0 in /etc/freeradius/scripts/php3 on line 4 Exec-Program output: dewor Exec-Program-Wait: plaintext: dewor Exec-Program: returned: 0 Thanks Jean -- View this message in context: http://old.nabble.com/Passing-variables-from-inner-tunnel-tp29279811p292798… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 10

Prevent Interim-Update packets being proxied
by Murray Long 29 Jul '10

29 Jul '10

Hi all, I would like to be able to prevent Interim-Update accounting packets for a realm from being proxied. Start and Stop packets need to be proxied, but the Interim-Updated should only be handled locally. Is this possible with freeradius? Many Thanks, Murray

2 1

Re: Freeradius-Users Digest, Vol 63, Issue 95
by Tom Leach 29 Jul '10

29 Jul '10

Alan, changing from User-Password to Password-With-Header brought back the 'No "known good" password' error. I'm going through the rlm_pap.c code to try to see what's going on here. I haven't found any docs yet on what the various mapping possibilities are and what they do. Do you have a pointer to any so I don't keep bugging you and the list? I agree with the 'get it work, then tune it' approach. That's where I'm at now. It's working, I'm just trying to make all the messages go away :) Thanks! Tom Here is a snippet from radiusd -X: [ldap-server1] Added Crypt-Password = 4gOgBZqZgtwIw in check items [ldap-server1] looking for check items in directory... [ldap-server1] userPassword -> Password-With-Header == "{crypt}4gOgBZqZgtwIw" [ldap-server1] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap-server1] user testuser authorized to use remote access > Date: Tue, 27 Jul 2010 09:00:23 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Another LDAP/RADIUS integration problem. > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4C4E8407.3030503(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Tom Leach wrote: >> Alan, I changed the ldap.attrmap file from "checkItem Crypt-Password >> userPassword" to "checkItem User-Password userPassword" and it's >> authenticating now, but I now have a new message in the debug output and >> I'm not sure if it's a problem, suggestion, or otherwise. > > It's a suggestion. But the first step was to get it to work. > >> I can't >> change the LDAP directory to contain actual cleartext passwords, so it >> may just be something that I have to live with. > > Change the mapping in ldap.attrmap to: > > checkItem Password-With-Header userPassword > > That should *still* work, and will remove the warning. > > The process here is to first get it to work, and then get it to work > better. > > Alan DeKok.

2 3

Solaris 10 1.13 FreeRadius
by Kory Wheatley 29 Jul '10

29 Jul '10

Will LDAP failover work on Solaris 10 with FreeRadius 1.1.3 ? This is the default that comes with Solaris or do we need to upgrade FreeRadius.

2 1

coa proxy'ing with a NAC device
by Kevin Ehlers 29 Jul '10

29 Jul '10

I'm having a really hard time with proxying or just dealing with CoA's. The documentation just isn't working for me. I can configure the coa server. I can get the originate-coa server up too. I can send CoA's to the server, but I can't get it to proxy them or re-send them as if it was originating the CoA. I see that they're being processed when looking at debug mode. But I just don't know how to do anything with them. This is what I want to do: [lots of switches doing dot1x]<->[freeradius]<->[NAC device, PacketFence in this case] I want to be able to send a CoA request from PacketFence (or another management server) to freeradius, and have it relay that CoA to a specific switch. E.g. I have determined that a user needs to be quarantined, so I run a script on the backend, and part of that requires having that user re-authenticate and get assigned a quarantine vlan. PF determines which switch they're on, sends a CoA to FreeRadius, FreeRadius then sends the CoA to the correct switch. Is there a way to do this without configuring a client entry for every edge device? Should I be using the proxy.conf in some way? I'm not really clear about how to use the virtual servers in regard to proxying. Thanks, -- Kevin Ehlers Network Engineer University of Oregon

2 1

send radius response without request
by Sallee, Stephen (Jake) 29 Jul '10

29 Jul '10

Is it possible to have FreeRADIUS send a radius response without first receiving a request, provided I can feed it the same information the request would have? OR Is it possible for FreeRADIUS to see the request come from one host and have the response go to another? Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

2 1

Fail to restart radiusd
by Yang Xue 29 Jul '10

29 Jul '10

Hi, We're running freeradius server v2.0.3 and restart of the daemon failed with: #/etc/init.d/radiusd restart Stopping RADIUS server: [FAILED] Starting RADIUS server: Fri Jul 16 07:50:16 2010 : Info: Starting - reading configuration files ... [FAILED] In the radius.log, it shows: Error: There appears to be another RADIUS server running on the authentication port 1812 <--- The odd thing is that there is no radiusd process running on the Linux server at all: # ps aux | grep rad root 4869 0.0 0.0 4544 636 pts/1 S+ 12:11 0:00 grep rad #Debug messages: /usr/sbin/radiusd -X restart Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/" main: localstatedir = "//var" main: logdir = "/var/log" main: libdir = "//lib" main: radacctdir = "/etc/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "//var/run/radiusd/radiusd.pid" main: bind_address = 10.25.210.21 IP address [10.25.210.21] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "//sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms There appears to be another RADIUS server running on the authentication port 1812 <--- Does anybody know why it complains about "another RADIUS server running on the authentication port 1812" although there is no existing radiusd process at all? Thanks.

5 16

Error: ASSERT FAILED threads.c[406]
by Meyers, Dan 28 Jul '10

28 Jul '10

Quick bit of background. We're using FreeRADIUS in combination with rlm_perl for network access control at our site. Everything was running fine on FreeBSD 8.0 with FreeRADIUS 2.1.8 compiled from ports and Perl 5.8 compiled to be non-threaded and not support multiplicity. We got new higher spec servers from Dell, and sadly the only *nix OS that currently supports the RAID card in them seems to be Ubuntu Server 10.4, so we're now on that. Perl is compiled (as it is by default on Ubuntu) with threads and multiplicity, but some testing by hammering the server from multiple different machines using radclient and some test packets from a file seemed to show that (unlike the last time we tried, which I believe was on FreeRADIUS 2.1.3) using threaded perl was stable and worked fine with rlm_perl in FreeRADIUS (it used to lock up eventually). Ran fine for a week or so, but in the last few days we've had it crash twice, both times with the same message. The logs initially fill with messages of the sort: "Sat Jul 24 01:05:08 2010 : Error: WARNING: Unresponsive child for request 128145, in module perl component accounting" and "Sat Jul 24 01:05:08 2010 : Info: WARNING: Child is hung for request 128145." We'll end up with 32 of the former type of error message (we're currently running with 32 threads configured in the thread_pool in radius.conf), interspersed with the latter, then a stack of the latter type of error (Always for the same set of requests, i.e. one of the ones we got an initial error for, but we'll get the second error multiple times for a given request). Then eventually we get "Sat Jul 24 01:05:27 2010 : Error: ASSERT FAILED threads.c[406]: (*request)->magic == REQUEST_MAGIC" All our accounting module does in perl is convert the incoming radius hash to yaml and then attempt to write it to a database with a timestamp. I am strongly suspecting that the initial problem is to do with threading in combination with the DBD::MySQL module in perl or the MySQL client rather than FreeRADIUS, despite our testing seeming to show it was OK. But I do not think that final ASSERT FAILED error should be being generated as a result of the former issue. I am trying to understand what is going on. Is FreeRADIUS attempting to kill the deadlocked threads and being unable to do so? Thanks Dan

3 4