- Freeradius-Users - lists.freeradius.org

failover ldap + ldap-group attribute
by François Mehault 02 Jun '09

02 Jun '09

Hi all, I have to do a failover between 2 OpenLDAP for FreeRADIUS. I tested in Lab, and the failover works. But I have a problem, users in my ldap use group-Ldap with radiusVSA attribute for cisco. Without it, I can't be logged on my cisco. With one of my ldap, I have the Access-Accept with cisco attribute then I can be logged, but with the other ldap, there is no cisco attribute. Someone succeed to do a failover with 2 ldap and ldap-group ? I read post with the same problem and the solution is maybe to do a fail-over for ldap-group attribute. But I don't understand very well how I can do it. I show you my debug. Regards, François <15:42>[labobe2:/usr/local/etc/raddb]# radiusd -X FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd7.0, built on May 29 2009 at 12:21:02 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/ldap.origine including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket group = freeradius user = freeradius including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log" libdir = "/usr/local/lib/freeradius-2.1.4" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.50 { require_message_authenticator = no secret = "cherche" shortname = "swlabo" nastype = "cisco" } client 192.168.0.199 { require_message_authenticator = no secret = "cherche" shortname = "fwlabo" nastype = "other" } client 10.96.18.4 { require_message_authenticator = no secret = "unixcherche" shortname = "labobe1" nastype = "other" } client 10.96.18.12 { require_message_authenticator = no secret = "fedoracherche" shortname = "labobe4" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldaplabobe2 ldap ldaplabobe2 { server = "10.96.18.10" port = 389 password = "secret" identity = "cn=root,dc=netplus,dc=fr" net_timeout = 1 timeout = 1 timelimit = 1 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=netplus,dc=fr" filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusHuntgroupName=%{Huntgroup-name}))" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldaplabobe2-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldaplabobe2-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldaplabobe2 rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusVSA mapped to RADIUS Cisco-AVPair conns: 0x28523420 Module: Instantiating ldaplabobe1 ldap ldaplabobe1 { server = "10.96.18.4" port = 389 password = "secret" identity = "cn=root,dc=netplus,dc=fr" net_timeout = 1 timeout = 1 timelimit = 1 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=netplus,dc=fr" filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusHuntgroupName=%{Huntgroup-name}))" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldaplabobe1-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldaplabobe1-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldaplabobe1 rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusVSA mapped to RADIUS Cisco-AVPair conns: 0x28523470 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_detail Module: Instantiating auth_log detail auth_log { detailfile = "/var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating detail detail { detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.50 port 1812, id=159, length=80 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "fmehault" Calling-Station-Id = "192.168.0.80" User-Password = "toto" +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radacct/192.168.0.50/auth-detail-20090602 [auth_log] /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/192.168.0.50/auth-detail-20090602 [auth_log] expand: %t -> Tue Jun 2 15:43:21 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "fmehault", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound rlm_ldap: Entering ldap_groupcmp() [files] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] expand: (&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusHuntgroupName=%{Huntgroup-name})) -> (&(uid=fmehault)(radiusHuntgroupName=swLabo)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.96.18.4:389, authentication 0 rlm_ldap: bind as cn=root,dc=netplus,dc=fr/secret to 10.96.18.4:389 rlm_ldap: cn=root,dc=netplus,dc=fr bind to 10.96.18.4:389 failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] expand: (&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusHuntgroupName=%{Huntgroup-name})) -> (&(uid=fmehault)(radiusHuntgroupName=swLabo)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.96.18.4:389, authentication 0 rlm_ldap: bind as cn=root,dc=netplus,dc=fr/secret to 10.96.18.4:389 rlm_ldap: cn=root,dc=netplus,dc=fr bind to 10.96.18.4:389 failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[files] returns noop ++- entering policy redundant {...} [ldaplabobe2] performing user authorization for fmehault [ldaplabobe2] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldaplabobe2] expand: (&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusHuntgroupName=%{Huntgroup-name})) -> (&(uid=fmehault)(radiusHuntgroupName=swLabo)) [ldaplabobe2] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.96.18.10:389, authentication 0 rlm_ldap: bind as cn=root,dc=netplus,dc=fr/secret to 10.96.18.10:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=netplus,dc=fr, with filter (&(uid=fmehault)(radiusHuntgroupName=swLabo)) [ldaplabobe2] looking for check items in directory... [ldaplabobe2] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldaplabobe2] Setting Auth-Type = LDAP [ldaplabobe2] user fmehault authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldaplabobe2] returns ok ++- policy redundant returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = LDAP +- entering group LDAP {...} ++- entering policy redundant {...} [ldaplabobe2] login attempt by "fmehault" with password "toto" [ldaplabobe2] user DN: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr rlm_ldap: (re)connect to 10.96.18.10:389, authentication 1 rlm_ldap: bind as cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr/toto to 10.96.18.10:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful [ldaplabobe2] user fmehault authenticated succesfully +++[ldaplabobe2] returns ok ++- policy redundant returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 159 to 192.168.0.50 port 1812 Finished request 0. Going to the next request Waking up in 4.9 seconds.

1 0

InnerAttributes not escaped when transmitted to outter
by Stun Box 02 Jun '09

02 Jun '09

Hey all, I'm using PEAP/Mschapv2 with Windows machines. I need the user-name of the inner-tunnel when the authentication ends to assign the vlan id. So I put in eap.conf / peap { ... use_tunneled_reply = yes ... }, and now I can have the User-name of the inner-tunnel with %{reply:User-Name}. But it seems it has not been escaped... My User-Name "DOMAIN/testx" becomes => "DOMAIN estxx" And if I try DOMAIN/user it works nicely... ++[eap] returns ok +- entering group post-auth {...} ++[exec] returns noop expand: %{request:User-Name} -> ANKAMA\testx expand: %{reply:User-Name} -> ANKAMA estxx How can I escape this ? Regards, Frad G.

4 9

Slow "update radacct ..." query
by Marinko Tarlac 02 Jun '09

02 Jun '09

Hi I know that this maybe is not FreeRadius related question... I have some problems with freeradius and mysql as a database. radacct table is InnoDB and update queries (interim-updates) are terrible slow (10 - 50 sec). Interim-updates are triggered every 8 minutes so it isn't under heavy load. (max 500 users online @ same time) After I wrote a small benchmark script for testing this kind of queries (10 000 queries "UPDATE radacct SET ... " with random integer values for acctsessiontime, acctinputoctets and acctoutputoctets) I can't reproduce this problem. My script takes 10 000 random rows from radacct table (table has almost 600 000 rows) and it is finished in 130-180 seconds (executed 5 times and all results are between 130 and 180 seconds). That means 0,013-0,018s/query (average) Slow query log is empty after this benchm. script. I checked radacct table later and I have exaclty 10 000 updated rows so the script is OK. Any ideas how to trace this problem ? FreeRadius is 2.1.6 and the same problem I had with FR1.1.7 and FR2.1.3

3 4

1 freeradius with 2 openldap (multi master)
by François Mehault 02 Jun '09

02 Jun '09

Hi All I have one freeradius and 2 openldap (multi - master). And I want my freeradius use the second openldap if the first crash. So in freeradius I instantiate the module ldap : Ldap ldapmaster { [...] } Ldap ldapbackup { [...] } And in my site-available/default I load the two modules. If my two openldap are alive, authentication succeed, but if one of them fall, authentication failed, so like this I have a « AND » between modules, and not a « OR » like I would. I don't know if I am really clear, i don't speak very well, sorry. So If some understand the problem that I try to describe and if you know how I can fix my problem, could you help me please ? thanks, Regards, François

3 6

Re: stress test or performance test result
by Nizar Zulmi 02 Jun '09

02 Jun '09

i do test my RADIUS using EvoLynx load test, do you using this also..??please just send me your result, it just to comparing my result test to know does my result is categories on fast result or slow..and it also to show my lecture that anyone has did stress test with Evolynx radius test and got accurate result. --- On Mon, 6/1/09, Marinko Tarlac <mangia81(a)gmail.com> wrote: From: Marinko Tarlac <mangia81(a)gmail.com> Subject: Re: stress test or performance test result To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Monday, June 1, 2009, 5:08 PM Hi there Right now I'm working on some tests but results won't be ready for publishing until next week. Right now I noticed that default 5.0.45 mysql who goes with RH/CentOS Fedora is very slow... Specially with innodb tables... On Mon, Jun 1, 2009 at 11:51 AM, Nizar Zulmi <siapa_bilang_emailku_panjang(a)yahoo.com> wrote: dear all..i want to compare my RADIUS server result test with someone who perform stress test or performance test. please anyone has did performance test or stress test send me the result, it could be screenshoot or anything related to. it just for compare. thank you. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -----Inline Attachment Follows----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

supported encryption
by Rakotomandimby Mihamina 02 Jun '09

02 Jun '09

Hi all, At the moment, our FreeRaduis(v1.x) is looking up users in a PGSQL database, with clear username and clear password in the fields. We would like to switch it to FreeRadius (v2.x) and by the way, crypt (SHA, just crypt(),...) the password in the Database. What encryption is supported by FreeRadius, so that I could just make the PGSQL query with the encrypted password? Thank you.

2 1

Re: stress test or performance test result
by Nizar Zulmi 02 Jun '09

02 Jun '09

i just configure my RADIUS server with standard configuration. iam using intel pentium 4 processors with 512MB of RAM, and this is what i got, to perform stress test i am using Evolynx RADIUS load test??do you test your RADIUS with this tool??this the result i got setting and parameter Komputer 1 Server Test parameter Value Server Addres 192.168.0.1 Connection Number 2 userID Usertest1 Request Setting Non Stop Password Test1 Packet to send Auth Request Auth port 1812 Time 300 second Accounting Port 1813 Komputer 2 Server host 192.168.0.1 Connection Number 2 userID Usertest2 Request Setting Non Stop Password Test2 Packet to send Auth Request Auth port 1812 Time 300 second Accounting Port 1813 result Komputer 1 Server Test Result Value Server Addres 192.168.0.1 Request Count 100305 userID Usertest1 Accept Count 100303 Password Test1 Reject Count 0 Auth port 1812 RequestDrop 2 Accounting Port Performance/second 363 Komputer 2 Server host 192.168.0.1 Request Count 101158 userID Usertest2 Accept Count 101154 Password Test2 Reject Count 0 Auth port 1812 RequestDrop 4 Accounting Port Performance/second 386 Total performance 749 appreciate for your reply RegardNizar --- On Tue, 6/2/09, Sajeewa Warnakulasuriya <sajeewaw(a)ispone.com.au> wrote: From: Sajeewa Warnakulasuriya <sajeewaw(a)ispone.com.au> Subject: Re: stress test or performance test result To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Tuesday, June 2, 2009, 5:05 AM Hi, If you can let us know of any modifications you have done to make it faster would greatly be appreciated. We are currently in the process of testing free radius as well. At the moment with a mysql db backend we are processing around 400 - 500 requests per sec. Regards, Sajeewa Warnakulasuriya Systems Development Manager ispONE is a wholesale ISP built to help internet access resellers and independent ISPs to compete in the Australian marketplace through ONE Brand, ONE Provider, ONE Solution. Level 14 520 Collins Street Melbourne 3000 VIC Phone: 1300 663 400 Fax: 1300 665 400 E-Mail: sajeewaw(a)ispone.com.au Web: http://www.ispone.com.au/ On Mon, 1 Jun 2009, Marinko Tarlac wrote: > Hi there > > Right now I'm working on some tests but results won't be ready for > publishing until next week. > Right now I noticed that default 5.0.45 mysql who goes with RH/CentOS Fedora > is very slow... Specially with innodb tables... > > > > On Mon, Jun 1, 2009 at 11:51 AM, Nizar Zulmi < > siapa_bilang_emailku_panjang(a)yahoo.com> wrote: > >> dear all.. >> >> i want to compare my RADIUS server result test with someone who perform >> stress test or performance test. please anyone has did performance test or >> stress test send me the result, it could be screenshoot or anything related >> to. >> >> it just for compare. >> >> >> thank you. >> >> >> >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: Members of two groups
by Mike Loosbrock 01 Jun '09

01 Jun '09

On Mon, Jun 1, 2009 at 7:53 AM, Andrew Paternoster <andrew(a)gpk.net.au>wrote: > > Hi List > > Sorry if this is a simple problem i have been pulling my hair out for 3 > days. I running Freeradius 2.1.6 and its all working great. Ecept for my > users that are members of 2 groups. I have been reading on the net and it > looks like it can be done but for the life of me i can not get it to work > The only grop that applies is the lowest priorty. The system just seems to > ingor the rest of the list. The strange this is that if i run the SQL querys > it looks like it pulling the right data back but not adding each attibute to > the logon only the first one. I have moved the prioritys around and it works > will all of them but only one at a time and only the lowest priority. > Are you using the Fall-Through attribute in your radgroupcheck and radgroupreply tables? If not, only attributes for the highest priority (first) group are applied: http://wiki.freeradius.org/Rlm_sql Mike Loosbrock Bethel University Network Services 651-638-6723

2 1

stress test or performance test result
by Nizar Zulmi 01 Jun '09

01 Jun '09

dear all..i want to compare my RADIUS server result test with someone who perform stress test or performance test. please anyone has did performance test or stress test send me the result, it could be screenshoot or anything related to.it just for compare. thank you.

3 2

Failed to link to module 'rlm_exec': /usr/local/lib/rlm_exec.a: invalid ELF header
by Nakul Deshpande 01 Jun '09

01 Jun '09

Hi, When I give the command radiusd –X start, i get the the message: radiusd.conf[1600] Failed to link to module 'rlm_exec': /usr/local/lib/rlm_exec.a: invalid ELF header I have read the previous posts and tried to install different packages. I know that this is a issue with Linux/Debian and not a Freeradius issue. But if anybody has faced this problem and has been able link the “rlm_exec” module, please do let me know. Thanks, Nakul Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/freeradius/freeradius.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib radiusd.conf[1600] Failed to link to module 'rlm_exec': /usr/local/lib/rlm_exec.a: invalid ELF header

1 0