- Freeradius-Users - lists.freeradius.org

Error downloading
by Ted Behling 02 Jul '09

02 Jul '09

Hi, In case the admin(s) of the FreeRADIUS download servers is on this list, I thought I'd point out that I received an error just now when trying to download 2.1.6. Following the links at http://freeradius.org/download.html, the link to: ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-2.1.6.tar.bz2 shows a "Not Found" error in my browser, as does the UK link to ftp://ftp.uk.freeradius.org/pub/radius/freeradius-server-2.1.6.tar.gz However, the German (DE) link works fine and I was able to download the tarball. Ted Behling ISP Systems Analyst, Hargray Communications

2 1

Re: ldap and ad for 802.1x
by Ivan Kalik 01 Jul '09

01 Jul '09

>> I'm trying to figure out the necessary steps and configs to make the >> following happen. 2 groups of users, one residing in ldap with >> samba/ntlm hashes and another in AD, need to authenticate through Radius >> servers for 802.1x wireless. At this point, I have the Radius server >> successfully authenticating the users in LDAP, using their Samba >> credentials, but it's a different story with AD. I joined Samba from the >> Radius box into the AD domain and I'm able to test authentication >> successfully with ntlm_auth command, however authentication against >> Radius doesn't seem to be working. The debug output shows that any AD >> auth. attempt is going against LDAP instead. >> I'm doing it on the same box, same shared Radius config, which is >> probably related to the issue and I think that I need some way to >> enforce separation between LDAP and AD, however my next steps are not at >> clear. I would appreciate any guidance or advise on this. >> >> Thank you very much in advance. >> >> The AD-Radius guide I used came from this URL and I simply added the >> described config to the working LDAP config. >> >> http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO > > You need to create authentication fail-over. If you are sending pap > requests, replace pap in Auth-Type PAP with: > > redundant { > pap > ntlm_auth > } > > For mschap requests, create two mschap module instances - one as default > and one with ntlm_auth line enabled. Then replace mschap in Auth-Type > MS-CHAP with: > > redundant { > mschap_default > mschap_ad > } > > Ivan Kalik > Kalik Informatika ISP >

1 0

timestamp in radpostauth and radacct
by liran tal 01 Jul '09

01 Jul '09

Hey, To include information about the NAS in a listing of the radpostauth (which doesn't have an entry regarding the nas from which the request originated from) I am joining the tables based on the radacct.acctstarttime = radpostauth.date which works "part" of the time. Meaning, for most of my tests it works just fine but I've seen logs where the timestamp in both of these tables differ (for the same request ofcourse). I was hoping someone can clear this issue, what's a normal behavior here? are the timestamp supposed to be the same/different and why. Regards, Liran.

1 0

ldap double bind (rebind) problem
by Joerg Spatschil 01 Jul '09

01 Jul '09

I run FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu and testing FreeRADIUS Version 2.1.3 both on gentoo systems, I want to peap authenticate, authorize and set VLANs on a Cisco Cat 4500 according to a ldap Attribute. * What does work already: I can authenticate peap using certificates from an XP machine store as well as from the user store. Adding the machine and user to users file DEFAULT Auth-Type := EAP, User-Password == "" Service-Type = Shell-User, Fall-Through = Yes, Tunnel-Type = 13, Tunnel-Medium-Type = 6 # Tunnel-Private-Group-Id = 101 user@domain Auth-Type := EAP, User-Password == "" Service-Type = Shell-User, Fall-Through = Yes, Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 101 sets the VLAN correctly on the Cisco; removing user uses DEFAULT and works as well when the Tunnel-Private-Group-Id is enabled. * What does not work: removing the users entry and setting up ldpa: sites-enabled/MySite authorize { preprocess mschap eap { ok = return } files Autz-Type LDAP1 { ldap_client1 } ldap_client1 expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest pam unix Auth-Type LDAP1{ ldap_client1 } eap } modules/ldap ldap ldap_client1 { server = "ldapserver" identity = "cn=ldapuser,ou=users,...." password = "password" basedn = "dc=ad,..." dictionary_mapping = ${raddbdir}/ldap.attrmap filter = "(userPrincipalName=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 ldap_debug = 0xFFFF } ldap.attrmap checkItem Tunnel-Private-Group-Id comment My VLAN is in the comment Attribute: ldapsearch -h ldaserver -b "dc=casedn" -D "ldapuser@ldaserver" -w "password" -x '(userPrincipalName=user@domain)' comment --> .... comment: 101 Major problem in the debug: new result: res_errno: 1, res_error: <000004DC: LdapErr: DSID-0C0906DD, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1772>, res_matched: <> read1msg: ld 0x81c1068 0 new referrals In tcpdump from ldapsearch there is one bind + one searchRequest In tcpdump from radiusd there is one bind + one searchRequest with searchResDone ... vals 101 - This is perfect. But right thereafter is an anonymous bind which uses the searchResRef and issues the same query again and fails, as it is not allowed for anonymous bind. Is there any idea how to resolve this or how to use ldap differently. Thanks Joerg

2 2

simple test,, how to go on?
by Rakotomandimby Mihamina 01 Jul '09

01 Jul '09

Hi, - Freeradius 2.0.4, packaged by Ubuntu 9.04 Jaunty, on "radius20" host. In users: [...] mihamina Cleartext-Password := "{clear}mihamina" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP [...] "clients.conf" already allows the client I launch radtest from. "radiusd.conf" is attached. When I launch $ radtest mihamina mihamina radius20 10 testing123 or $ radtest mihamina {clear}mihamina radius20 10 testing123 I get the answer: Access-Reject packet from host 41.204.103.216 port 1812 On the server, lauched with -X flag: rad_recv: Access-Request packet from host 41.204.104.9 port 54132, id=132, length=60 User-Name = "mihamina" User-Password = "mihamina" NAS-IP-Address = 127.0.1.1 NAS-Port = 10 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "mihamina", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated users: Matched entry mihamina at line 86 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "mihamina" rlm_pap: Using CRYPT encryption. rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Login incorrect (rlm_pap: CRYPT password check failed): [mihamina/mihamina] (from client quarante_un_deux_cent_quatre port 10) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> mihamina attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 4 seconds Going to the next request Waking up in 0.9 seconds. Waking up in 2.9 seconds. rad_recv: Access-Request packet from host 41.204.104.9 port 54132, id=132, length=60 Waiting to send Access-Reject to client quarante_un_deux_cent_quatre port 54132 - ID: 132 Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 132 to 41.204.104.9 port 54132 Waking up in 4.9 seconds. Cleaning up request 0 ID 132 with timestamp +29 -- Architecte Informatique Gulfsat/Blueline: Administration Système, Recherche et Développement Mob: +261 33 11 207 36 Penser à l'environnement avant d'imprimer ce message

3 3

Sending Access Accept when Request comes from a particular IP
by Mauro Iorio - Smart Soft s.r.l. 01 Jul '09

01 Jul '09

Is it possible to send an Access Accept Packet every time an Access Request is sent from a specified source ip only??? Is there an example configuration I can read? Thanks, Mauro Iorio Smart Soft s.r.l.

3 2

Nortel Dictionary update
by David Hobley 01 Jul '09

01 Jul '09

Hello, Here is an updated dictionary.nortel file, it contains the Radius attributes to be able to authenticate against their BCM platform. I wasn't certain how to submit it formally, so thought I would send it here. -- Cheers, David

2 1

about Cisco-AVPair attribute
by Tseveendorj 01 Jul '09

01 Jul '09

Hello, Sorry for asking cisco related thing. What kind of Cisco-AVPair attribute's value to known for policy based shaping. Currently I'm using following configuration with known Cisco-AVPair attribute's value ip:sub-policy-Out=1024Kbps, ip:sub-policy-In=1024Kbps policy-map 1Mbps class Match-Any-Packet police cir 1024000 bc 72000 conform-action transmit exceed-action drop So, I need to change the police to shape like below Router(config)# *policy-map shape-cbwfq * Router(config-pmap)# *class cust1 * Router(config-pmap-c)# *shape average 384000 * Router(config-pmap-c)# *bandwidth 256 * But I don't know what is the Cisco-AVPair attribute's value of shape ? Sincerely, Tseveen.

1 0

freeradius2 Proxy fail-over issues
by Emmett Culley 30 Jun '09

30 Jun '09

I just upgraded one of our CentOS 5 systems from FreeRadius 1.x to FreeRadius 2.1.6. It was all working before the upgrade and I have it working on the new version. That is, by using the deprecated authhost and accthost variables in the realm definition I can successfully authenticate and process accounting with the new version. However, as soon as I attempt to define a set of main and backup servers, then use the auth_pool and acct_pool variables I get the following error: "Ignoring spoofed proxy reply. Signature is invalid" Here is a status query that results in the error, like any other query: Sending Access-Request of id 136 to x.x.x.x port 1812 User-Name := "" User-Password := "" Service-Type := Authenticate-Only Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. rad_recv: Access-Reject packet from host x.x.x.x port 1812, id=136, length=64 Ignoring spoofed proxy reply. Signature is invalid Of course, the main reason I upgraded at all was to be able to define a pool of servers. I've searched Google and cannot find any references to this issue. Here is the proxy.conf lines that matter: home_server my_rlm_auth { ipaddr = x.x.x.x port = 1812 type = "auth" secret = "bignewsecret" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_check = "none" # ping_interval = 30 # check_interval = 30 # num_answers_to_alive = 3 # num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server my_rlm_acct { ipaddr = x.x.x.x port = 1813 type = "acct" secret = "bignewsecret" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_check = "none" # ping_interval = 30 # check_interval = 30 # num_answers_to_alive = 3 # num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } server_pool my_rlm_auth_pool { type = fail-over home_server = my_rlm_auth # home_server = Primary_my_rlm_auth # home_server = Secondary_my_rlm_auth } server_pool my_rlm_acct_pool { type = fail-over home_server = my_rl_acct # home_server = Primary_my_rlm_acct # home_server = Secondary_my_rlm_acct } realm my_rlm { nostrip auth_pool = my_rlm_auth_pool acct_pool = my_rlm_acct_pool # authhost = x.x.x.x:1812 # accthost = x.x.x.x:1813 # secret = "bignewsecret" type = radius } Any ideas or pointers? Regards, Emmett

3 9

Accounting help please
by David Hobley 30 Jun '09

30 Jun '09

Hello, I have freeradius2 configured and authenticating properly. I would like to be able to get radwho and radlast working properly, but for some reason the files do not get created (permission are correct in that directory). I thought I have set up accounting correctly, but obviously haven't. I have attached the output from radiusd -X, any pointers anyone could give me, I would appreciate. The output I get from radwho and radlast is: [root@samba raddb]# radwho radwho: Error reading /var/log/radius/radutmp: No such file or directory [root@samba raddb]# radlast last: /var/log/radius/radwtmp: No such file or directory Thanks! -- Cheers, David

2 1