- Freeradius-Users - lists.freeradius.org

Allow users from a specific DA group
by Free2009 24 Sep '09

24 Sep '09

Hi, I spent some time trying to put working together FR+AD and presently i'm using ntlm to authenticate users through mschap against the AD. It is working. Next step is try to allow access only to specific users belonging to a Group from the AD, but it is not working. I post here the important i have configured untill now: 1. users file: DEFAULT Ldap-Group != "wireless", Auth-Type := Reject 2. /usr/local/etc/raddb/sites-enabled/inner-tunnel and default: # uncommented ldap from authorize function 3. /modules/ldap: server = "192.168.1.10" port = 389 identity = "cn=Administrator,cn=users,dc=DOT1X,dc=local" password = 123456 basedn = "dc=DOT1X,dc=local" filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}}))" base_filter = "(objectclass=radiusprofile)" groupmembership_filter = "(|(&(objectClass=group)(member=%{Ldap-UserDn}))(&(objectClass=top)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf Do you have any idea what can be missing? I send also the debub: ldap_chase_v3referral: msgid 15, url "ldap://dot1x.local/CN=Configuration,DC=dot1x,DC=local" ldap_send_server_request ldap_new_connection 0 1 1 ldap_int_open_connection ldap_connect_to_host: TCP dot1x.local:389 ldap_new_socket: 15 ldap_prepare_socket: 15 ldap_connect_to_host: Trying 192.168.1.10:389 ldap_pvt_connect: fd: 15 tm: 1 async: 0 ldap_ndelay_on: 15 ldap_int_poll: fd: 15 tm: 1 ldap_is_sock_ready: 15 ldap_ndelay_off: 15 ldap_pvt_connect: 0 anonymous rebind via ldap_sasl_bind("") ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ldap_result ld 0x818f1f8 msgid 25 wait4msg ld 0x818f1f8 msgid 25 (timeout 100000 usec) wait4msg continue ld 0x818f1f8 msgid 25 all 1 ** ld 0x818f1f8 Connections: * host: dot1x.local port: 0 refcnt: 2 status: Connected last used: Wed Sep 23 21:25:55 2009 rebind in progress queue is empty * host: DomainDnsZones.dot1x.local port: 0 refcnt: 1 status: Connected last used: Wed Sep 23 21:25:55 2009 * host: 192.168.1.10 port: 389 (default) refcnt: 2 status: Connected last used: Wed Sep 23 21:25:55 2009 ** ld 0x818f1f8 Outstanding Requests: * msgid 25, origid 25, status InProgress outstanding referrals 0, parent count 0 * msgid 22, origid 15, status InProgress outstanding referrals 0, parent count 3 * msgid 18, origid 15, status RequestCompleted outstanding referrals 0, parent count 2 * msgid 16, origid 15, status RequestCompleted outstanding referrals 0, parent count 1 * msgid 15, origid 15, status ChasingRefs outstanding referrals 2, parent count 3 ld 0x818f1f8 request count 5 (abandoned 0) ** ld 0x818f1f8 Response Queue: * msgid 15, type 115 chained responses: * msgid 15, type 115 * msgid 15, type 115 ld 0x818f1f8 response count 1 ldap_chkResponseList ld 0x818f1f8 msgid 25 all 1 ldap_chkResponseList returns ld 0x818f1f8 NULL ldap_int_select read1msg: ld 0x818f1f8 msgid 25 all 1 read1msg: ld 0x818f1f8 msgid 25 message type bind read1msg: ld 0x818f1f8 0 new referrals read1msg: mark request completed, ld 0x818f1f8 msgid 25 request done: ld 0x818f1f8 msgid 25 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 25, msgid 25) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_result ldap_msgfree read1msg: search ref chased, mark request chasing refs, id = 15 adding response ld 0x818f1f8 msgid 15 type 115: wait4msg ld 0x818f1f8 3 s 972321 us to go wait4msg continue ld 0x818f1f8 msgid 15 all 1 ** ld 0x818f1f8 Connections: * host: dot1x.local port: 0 refcnt: 1 status: Connected last used: Wed Sep 23 21:25:55 2009 * host: DomainDnsZones.dot1x.local port: 0 refcnt: 1 status: Connected last used: Wed Sep 23 21:25:55 2009 * host: 192.168.1.10 port: 389 (default) refcnt: 2 status: Connected last used: Wed Sep 23 21:25:55 2009 ** ld 0x818f1f8 Outstanding Requests: * msgid 24, origid 15, status InProgress outstanding referrals 0, parent count 4 * msgid 22, origid 15, status InProgress outstanding referrals 0, parent count 3 * msgid 18, origid 15, status RequestCompleted outstanding referrals 0, parent count 2 * msgid 16, origid 15, status RequestCompleted outstanding referrals 0, parent count 1 * msgid 15, origid 15, status ChasingRefs outstanding referrals 2, parent count 4 ld 0x818f1f8 request count 5 (abandoned 0) ** ld 0x818f1f8 Response Queue: * msgid 15, type 115 chained responses: * msgid 15, type 115 * msgid 15, type 115 * msgid 15, type 115 ld 0x818f1f8 response count 1 ldap_chkResponseList ld 0x818f1f8 msgid 15 all 1 ldap_chkResponseList returns ld 0x818f1f8 NULL ldap_int_select read1msg: ld 0x818f1f8 msgid 15 all 1 read1msg: ld 0x818f1f8 msgid 22 message type search-result ldap_chase_referrals read1msg: V2 referral chased, mark request completed, id = 22 read1msg: ld 0x818f1f8 0 new referrals read1msg: mark request completed, ld 0x818f1f8 msgid 22 merged parent (id 15) error info: result errno 1, error <>, matched <> ldap_free_connection 0 1 ldap_send_unbind ldap_free_connection: actually freed wait4msg ld 0x818f1f8 3 s 972094 us to go wait4msg continue ld 0x818f1f8 msgid 15 all 1 ** ld 0x818f1f8 Connections: * host: dot1x.local port: 0 refcnt: 1 status: Connected last used: Wed Sep 23 21:25:55 2009 * host: 192.168.1.10 port: 389 (default) refcnt: 2 status: Connected last used: Wed Sep 23 21:25:55 2009 ** ld 0x818f1f8 Outstanding Requests: * msgid 24, origid 15, status InProgress outstanding referrals 0, parent count 4 * msgid 22, origid 15, status RequestCompleted outstanding referrals 0, parent count 3 * msgid 18, origid 15, status RequestCompleted outstanding referrals 0, parent count 2 * msgid 16, origid 15, status RequestCompleted outstanding referrals 0, parent count 1 * msgid 15, origid 15, status ChasingRefs outstanding referrals 1, parent count 4 ld 0x818f1f8 request count 5 (abandoned 0) ** ld 0x818f1f8 Response Queue: * msgid 15, type 115 chained responses: * msgid 15, type 115 * msgid 15, type 115 * msgid 15, type 115 ld 0x818f1f8 response count 1 ldap_chkResponseList ld 0x818f1f8 msgid 15 all 1 ldap_chkResponseList returns ld 0x818f1f8 NULL ldap_int_select read1msg: ld 0x818f1f8 msgid 15 all 1 read1msg: ld 0x818f1f8 msgid 15 message type search-result read1msg: ld 0x818f1f8 0 new referrals read1msg: mark request completed, ld 0x818f1f8 msgid 15 ldap_free_connection 0 1 ldap_free_connection: refcnt 1 wait4msg ld 0x818f1f8 3 s 971737 us to go wait4msg continue ld 0x818f1f8 msgid 15 all 1 ** ld 0x818f1f8 Connections: * host: dot1x.local port: 0 refcnt: 1 status: Connected last used: Wed Sep 23 21:25:55 2009 * host: 192.168.1.10 port: 389 (default) refcnt: 1 status: Connected last used: Wed Sep 23 21:25:55 2009 ** ld 0x818f1f8 Outstanding Requests: * msgid 24, origid 15, status InProgress outstanding referrals 0, parent count 4 * msgid 22, origid 15, status RequestCompleted outstanding referrals 0, parent count 3 * msgid 18, origid 15, status RequestCompleted outstanding referrals 0, parent count 2 * msgid 16, origid 15, status RequestCompleted outstanding referrals 0, parent count 1 * msgid 15, origid 15, status RequestCompleted outstanding referrals 1, parent count 4 ld 0x818f1f8 request count 5 (abandoned 0) ** ld 0x818f1f8 Response Queue: * msgid 15, type 115 chained responses: * msgid 15, type 115 * msgid 15, type 115 * msgid 15, type 115 ld 0x818f1f8 response count 1 ldap_chkResponseList ld 0x818f1f8 msgid 15 all 1 ldap_chkResponseList returns ld 0x818f1f8 NULL ldap_int_select read1msg: ld 0x818f1f8 msgid 15 all 1 read1msg: ld 0x818f1f8 msgid 24 message type search-result ldap_chase_referrals read1msg: V2 referral chased, mark request completed, id = 24 read1msg: ld 0x818f1f8 0 new referrals read1msg: mark request completed, ld 0x818f1f8 msgid 24 merged parent (id 15) error info: result errno 1, error <00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece>, matched <> request done: ld 0x818f1f8 msgid 15 res_errno: 1, res_error: <00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece>, res_matched: <> ldap_free_request (origid 15, msgid 15) ldap_free_request (origid 15, msgid 24) ldap_free_request (origid 15, msgid 22) ldap_free_request (origid 15, msgid 18) ldap_free_request (origid 15, msgid 16) ldap_free_connection 0 1 ldap_send_unbind ldap_free_connection: actually freed adding response ld 0x818f1f8 msgid 15 type 101: ldap_parse_result ldap_err2string rlm_ldap: ldap_search() failed: Operations error ldap_msgfree [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> dot1x\user3 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 66 to 192.168.1.7 port 1645 Waking up in 4.9 seconds -- View this message in context: http://www.nabble.com/Allow-users-from-a-specific-DA-group-tp25544888p25544… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

ACME Net-Net 4000
by Michael Joyner 23 Sep '09

23 Sep '09

I am trying to setup ACME PACKET Session Border Controller for accounting. I am totally lost. Does anyone have any experience setting up accounting. I bought the RADIUS book, googl'd, and read ACME Manual and the "dots" are not connecting. Any information setting up Accounting would be appreciated, especially for the ACME SBC. Best Regards

2 1

RE: Accounting doesn't increase Daily's count.
by Pablo Zanitti 23 Sep '09

23 Sep '09

My bad, this is it refusing to update: rad_recv: Accounting-Request packet from host 192.168.63.1:15138, id=249, length=196 NAS-IP-Address = 192.168.11.146 NAS-Identifier = "pfSense.local" User-Name = "Prueba3" Acct-Status-Type = Stop Acct-Session-Time = 100 Acct-Authentic = RADIUS Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 0 Acct-Session-Id = "01e56ba6b4be990c" Framed-IP-Address = 192.168.63.132 Called-Station-Id = "08:00:27:dc:bf:b1" Calling-Station-Id = "00:16:76:60:3d:81" Acct-Input-Packets = 25 Acct-Input-Octets = 1888 Acct-Input-Gigawords = 0 Acct-Output-Packets = 29 Acct-Output-Octets = 39478 Acct-Output-Gigawords = 0 Acct-Session-Time = 100 Acct-Terminate-Cause = NAS-Request Processing the preacct section of radiusd.conf modcall: entering group preacct for request 5 modcall[preacct]: module "preprocess" returns noop for request 5 rlm_acct_unique: Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.63.1,NAS-IP-Address = 192.168.11.146,Acct-Session-Id = "01e56ba6b4be990c",User-Name = "Prueba3"' rlm_acct_unique: Acct-Unique-Session-ID = "c968f78b6779a240". modcall[preacct]: module "acct_unique" returns ok for request 5 modcall[preacct]: module "files" returns noop for request 5 modcall: leaving group preacct (returns ok) for request 5 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 5 radius_xlat: '/var/log/radacct/192.168.63.1/detail-20090923' rlm_detail: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/192.168.63.1/detail-20090923 modcall[accounting]: module "detail" returns ok for request 5 rlm_counter: Packet Unique ID = 'c968f78b6779a240' rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key found. rlm_counter: Counter Unique ID = 'c968f78b6779a240' rlm_counter: Unique IDs for user match. Droping the request. modcall[accounting]: module "daily" returns noop for request 5 rlm_counter: Packet Unique ID = 'c968f78b6779a240' rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key found. rlm_counter: Counter Unique ID = 'c968f78b6779a240' rlm_counter: Unique IDs for user match. Droping the request. modcall[accounting]: module "weekly" returns noop for request 5 rlm_counter: Packet Unique ID = 'c968f78b6779a240' rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key found. rlm_counter: Counter Unique ID = 'c968f78b6779a240' rlm_counter: Unique IDs for user match. Droping the request. modcall[accounting]: module "monthly" returns noop for request 5 rlm_counter: Packet Unique ID = 'c968f78b6779a240' rlm_counter: Searching the database for key 'Prueba3' rlm_counter: Key found. rlm_counter: Counter Unique ID = 'c968f78b6779a240' rlm_counter: Unique IDs for user match. Droping the request. modcall[accounting]: module "forever" returns noop for request 5 radius_xlat: '/var/log/radutmp' radius_xlat: 'Prueba3' rlm_radutmp: Logout for NAS 192.168.11.146 port 0, but no Login record modcall[accounting]: module "radutmp" returns ok for request 5 modcall: leaving group accounting (returns ok) for request 5 Sending Accounting-Response of id 249 to 192.168.63.1 port 15138 Finished request 5

1 0

Problem with proxying accounting packets on FR 2.1.3
by Patric 23 Sep '09

23 Sep '09

Hi all, I hope I can explain this clearly and concisely :) I have 2 freeradius servers: Primary: freeradius 1.1.6 (I know, its old, busy trying to get issues resolved so that I can update...) Secondary: freeradius 2.1.3 I have radrelay proxying accounting packets from the primary to the secondary which appears to be working fine. I am trying to get the secondary to proxy accounting requests to the primary as well, but there seems to be some trouble. It *appears* that the secondary is receiving proxy updates from the primary, applying them, and then proxying them back to the primary. I eventually noticed that the secondary is not adding the Client-IP-Address to incoming requests (I found the posts in the archive mentioning that this is normal and is no longer done in FR2). So I suspect the primary is sending the update to the secondary, the secondary is applying it and sending it back instead of stopping there. My question is: How do I get the secondary to realize it must not send the proxied request back again. I include my secondary config in case ive munged it somewhere. Any pointers would be very much appreciated! Freeradius 2.1.3 radiusd.conf ------------ proxy_requests = yes $INCLUDE proxy.conf proxy.conf ---------- proxy server { default_fallback = no } home_server copy-acct-to-home-server { type = acct ipaddr = ip_of_primary_server port = 1813 secret = shared_secret response_window = 20 zombie_period = 40 revive_interval = 120 } home_server_pool my_acct_failover { home_server = copy-acct-to-home-server } realm DEFAULT { acct_pool = my_acct_failover nostrip } sites-enabled/default --------------------- authorize { preprocess files exec-radauth # custom authorization... } authenticate { } preacct { preprocess acct_unique } accounting { detail detail-radrelay sql } pre-proxy { } post-proxy { } sites-enabled/copy-acct-to-home-server -------------------------------------- server copy-acct-to-home-server { listen { type = detail filename = ${radacctdir}/detail-combined load_factor = 10 } preacct { suffix } accounting { ok } I have tried include all relevant info but please advise if anything further is required. Many many thanks as always Patric

2 2

Munin Plugins
by Neville 23 Sep '09

23 Sep '09

Hi everyone, This is not directly FreeRadius related, but I would really appreciate if anyone share any munin plugins that would monitoring number of users connected during the day or anything else worth monitoring. I've googled and can only find ones for login attempts by parsing the radius.log. I'm currently using MYSQL to store the current open connections and get retrieve the current connections by doing... SELECT COUNT(*) FROM radacct WHERE (radacct.AcctStopTime IS NULL OR radacct.AcctStopTime = '0000-00-00 00:00:00'); Apologies if anyone feels offend by me posting to the list for such a basic request. Thx Nev

2 1

radwho doesn't work
by José Johnny RANDRIAMAMPIONONA 22 Sep '09

22 Sep '09

Hi all, Systems: CentOs v5.3, FreeRadius-server-2.1.6 + Openldap ---------------------------------------------------------------------------------------------------- I d like to know who are logged on(uid, duration ...) so I did radwho but it said that the radutmp file is not found ... radwho: Error reading /usr/local/freeradius-server-2.1.6/var/log/radius/radutmp: No such file or directory Can anyone help me?I checked in the indicated directory and it was right (anyway, it's temporary file) Best regards! -- JJohnny RANDRIAMAMPIONONA Phone: +212663682554, +212533158575 National School of Applied Sciences ZIP 1818 TANGIER 90000 ---------Morocco ---------------

1 0

EAP-TLS:Error: rlm_eap: Failed to store handler
by leopold 22 Sep '09

22 Sep '09

We are using 2.1.4 version and sometimes we see the following error Wed Sep 16 11:21:01 2009 : Error: rlm_eap: Failed to store handler This error is very difficult to reproduce, but if the server goes into this mode it starts randomly rejecting some users and accepting others. Many users get rejected with the same error message The only way now is to restart server and then it works fine. Could there be some kind of rbtree corruption or there is a way to explain this when EAP session is already in the tree and client retries or for some reason sends message twice the server finds the session based on STATE variable in the tree and prints this message? This would be okay if one client gets rejected is supplicant misbehaves and sends duplicate requests, but many clients get the same failure. Are there any code fixes from 2.1.4 and 2.1.7 that fix exact same problem? Thank you for your reply. -- View this message in context: http://www.nabble.com/EAP-TLS%3AError%3A-rlm_eap%3A-Failed-to-store-handler… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 6

[freeradius-users] Freeradius exiting normally
by Vincent Arniego 22 Sep '09

22 Sep '09

Hi Everyone! My radius server suddenly logs "Exiting normally" while the process is still up. Though it looks like the process is already a zombie as it does not reply. I'm using freeradius 2.1.5 and using a perl-module that connects to ldap. The server specs are as follows: Linux RHEL 5 kernel 2.6.18 x86_64 ulimit -a core file size (blocks, -c) 0 data seg size (kbytes, -d) unlimited max nice (-e) 0 file size (blocks, -f) unlimited pending signals (-i) 71680 max locked memory (kbytes, -l) 32 max memory size (kbytes, -m) unlimited open files (-n) 1024 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 max rt priority (-r) 0 stack size (kbytes, -s) 10240 cpu time (seconds, -t) unlimited max user processes (-u) 71680 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited installed freeradius from source. and using syslog for logging (configured in radius) Just for additional info, I'm using daemontools to up the process and uses this as the commandline : /usr/local/sbin/radiusd -sfx and this are the last entries in the radiusd.log file. Sep 20 09:35:46 radiusprod radiusd[28724]: rlm_perl: Added pair Reply-Message = Access-Accept Sep 20 09:35:46 radiusprod radiusd[28724]: rlm_perl: Added pair Service-Type = Framed Sep 20 09:35:46 radiusprod radiusd[28724]: rlm_perl: Added pair Auth-Type = perl Sep 20 09:35:46 radiusprod radiusd[28724]: Waking up in 1.9 seconds. Sep 20 09:35:46 radiusprod radiusd[28724]: Waking up in 1.6 seconds. Sep 20 09:35:46 radiusprod radiusd[28724]: Waking up in 1.6 seconds. Sep 20 09:35:48 radiusprod radiusd[28724]: Ready to process requests. Sep 20 09:36:09 radiusprod last message repeated 14 times Sep 20 09:36:09 radiusprod radiusd[28724]: Exiting normally. Any help is most appreciated thanks!

2 1

MS-CHAP Authentication / Bug 17
by Garber, Neal 21 Sep '09

21 Sep '09

I've been running 2.1.6 in Production with the patch from Bug 17, for a month, and everything has been working fine. As a reminder, this patch corrects a bug in MS-CHAP with the calculation of the MS-CHAPv1 challenge passed to ntlm_auth. It causes inappropriate Logon Failure errors, in certain circumstances having to do with the case of the userid and the logon method (see the bug report and previous posts for more details if you didn't follow the thread). Others have reported this problem in the past and the workaround has been to create all users in a specific case and force the userid to the same case in FR. (I'd really like to see this fix incorporated in the code, as other RADIUS servers don't have this userid case-sensitivity issue and this gives people an opportunity to cast stones at FR.) Arran: You seemed a bit interested in this patch - have you had the time/desire to apply and test it? If anyone else has some time to apply and test the patch, it is very much appreciated. Thanks in advance for your assistance and feedback..

3 9

h323-class
by Sokvantha YOUK 21 Sep '09

21 Sep '09

Dear All, I got this error in my radius server. I could not understand about this error. Please help me to get this problem fixed. Error: Mon Sep 21 21:11:58 2009 : Error: rlm_sql: Failed to create the pair: Unknown attribute "h323-class" -- Best Regards, YOUK Sokvantha Tell: (855) 89896589 email: sokvantha(a)gmail.com

1 0