- Freeradius-Users - lists.freeradius.org

Re: must i use rlm_ldap to use groups/ou via winbind/Active Directory?
by john 23 May '09

23 May '09

. > > That depends on capabilities of your equipment. This how Cisco implements it: > > www.cisco.com/univercd/cc/td/doc/solution/macauthb.pdf > > Other vendors have more on less the same. It is enabled on some models and > not on others. Thanks for this. > >> So this policy would check the huntgroup that the NAS was a member of >> and then go on to check if the users was part of the proper >> Ldap-Group and assuming that both were true then access would be >> granted. I am still not clear how some hunt groups will always >> require a host cert and others never will. Is this set in the hunt >> group? > > No, on the equipment. Your setup is such that you have to enforce > (enable/disable) it on hardware. If you would require certificates for > access to all hardware you could enforce it with AD Group Policy. Like > this students don't need machine certificates for wireless access. So, you > should enable mac auth bypass on your student APs. Most APs should have > such feature.You should make students register mac address of their > wireless equipment if they want to connect. Hmm. I don't think I like this approach for a couple of reasons, perhaps you can let me know if I am thinking about this incorrectly. We already use mac address as an auth scheme and I want to move away from this because of the ease of mac spoofing in a wireless environment. That's why I hoped to move to username/password authentication with WPA2 that was centrally managed via freeradius <=> Active Directory. I currently have a fairly central way to manage access by mac, but I would have to give that up if I had to maintain a mac address table on each NAS. I guess I could add a list of allowed mac addresses in the freeradius/users file and maintain it from there? Just so I understand you clearly, we can't have 1 class of users who must use host certs via NAS A and another class of uses who never have to use certs via NAS B on the same freeradius server? If that is the case I think I might want to set up a second instance of Freeradius and point the NAS that don't require host certs at that one. I could simply mint another virtual freeradius instance in freeradius/sites-enabled couldn't I? If I have this all muddled up, I hope you'll straighten me out. Thanks for all of your help. John

2 1

freeRADIUS + POPTOP
by Neville 22 May '09

22 May '09

Firstly, let me apologies now for asking what is most probably a simple question to you long standing veterans of freeRADIUS. I've search the INTERNET for 5 days now and late into the evening, but I'm totally stumped in resolving my problem, so I would appreciate any guidance from the experts. I've configured as per the many guides I've found and have a basic understanding of how this all works, but there is no information anywhere on how to setup the Users / Client details for freeRADIUS. I've been using poptop (pptpd) server for several weeks, with great success, but now I wish to introduce freeRADIUS. The problem, I'm facing is the allocation of IP address / GW / DNS by freeRADIUS for the VPN connections coming onto my server. my service PrivateIP address is 19x.xxx.xxx.190 I've iptables setup to forward all NAT traffic through the PRIVATEIP, but allocation of a GW of 10.0.0.1 and a Client IP of 10.0.0.200 However, when I connect and freeRADIUS authenticates me SUCCESSFULLY. I get given a IP of 192.168.2.82 from the test_pool, but pool range-start = 10.0.0.100 range-stop = 10.0.0.199 which is totally different to the address allocated by the pool. ANY IDEAS? /var/log/messages May 22 21:49:13 server pppd[765]: MPPE 128-bit stateless compression enabled May 22 21:49:15 server pppd[765]: Cannot determine ethernet address for proxy ARP May 22 21:49:15 server pppd[765]: local IP address 10.0.0.1 May 22 21:49:15 server pppd[765]: remote IP address 192.168.2.82 radiusd -X rad_recv: Access-Request packet from host 127.0.0.1 port 34510, id=245, length=133 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test1" MS-CHAP-Challenge = 0xd4fd1b2f3b03fa424ae2ccc6dcd11029 MS-CHAP2-Response = 0x87001d6e9a747c3545dd123d19c410c037be00000000000000002b9c7e96783abd1954a72ae8f4bc4733b1470477ba725366 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20090522 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20090522 [auth_log] expand: %t -> Fri May 22 22:46:15 2009 ++[auth_log] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 70 [files] users: Matched entry test1 at line 77 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for test1 with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok +- entering group post-auth {...} [test_pool] expand: %{NAS-IP-Address} %{NAS-Port} -> 127.0.0.1 0 [test_pool] MD5 on 'key' directive maps to: ee0282d57992a30bce29ea43d092ac16 [test_pool] Searching for an entry for key: 'ee0282d57992a30bce29ea43d092ac16' rlm_ippool: Allocating ip to key: 'ee0282d57992a30bce29ea43d092ac16' [test_pool] num: 1 [test_pool] Allocated ip 192.168.2.82 to client key: ee0282d57992a30bce29ea43d092ac16 ++[test_pool] returns ok ++[exec] returns noop Sending Access-Accept of id 245 to 127.0.0.1 port 34510 Service-Type = Framed-User Session-Timeout = 65000 Framed-Protocol = PPP Framed-MTU = 1400 MS-CHAP2-Success = 0x87533d46313037374533443535323430343534463737333338463639364534383642374434433244333842 MS-MPPE-Recv-Key = 0x5a21400d6e5601f9c7201a94d401eefb MS-MPPE-Send-Key = 0x14eadb5ada027ccdd63a6cf372f0defd MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Framed-IP-Address = 192.168.2.82 Framed-IP-Netmask = 255.255.255.0 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 127.0.0.1 port 43515, id=246, length=97 Acct-Session-Id = "4A172B390A9300" User-Name = "test1" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 192.168.2.82 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "4A172B390A9300",User-Name = "test1"' [acct_unique] Acct-Unique-Session-ID = "29e101f9a598e8fe". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/detail-20090522 [detail] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/detail-20090522 [detail] expand: %t -> Fri May 22 22:46:17 2009 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> test1 ++[radutmp] returns ok [test_pool] This is not an Accounting-Stop. Return NOOP. ++[test_pool] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> test1 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 246 to 127.0.0.1 port 43515 Finished request 1. Cleaning up request 1 ID 246 with timestamp +44 Going to the next request Waking up in 2.9 seconds. Cleaning up request 0 ID 245 with timestamp +42 Ready to process requests. freeRADIUS Configurations users DEFAULT Pool-Name := test_pool Fall-Through = Yes test1 Cleartext-Password := "test1" Service-Type = Framed-User, Session-Timeout = 65000, Framed-Protocol = PPP, Framed-MTU = 1400, ippool module ippool test_pool { range-start = 10.0.0.100 range-stop = 10.0.0.199 netmask = 255.255.255.0 cache-size = 800 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = no maximum-timeout = 0 #key = "%{NAS-IP-Address} %{NAS-Port}" } POPTOP Configuration Files /etc/ppp/options.pptpd name pptpd #chapms-strip-domain refuse-pap refuse-chap refuse-mschap require-mschap-v2 require-mppe-128 ms-dns 208.67.222.222 ms-dns 208.67.222.220 proxyarp debug dump lock nobsdcomp novj novjccomp noipv6 noipx nologfd plugin radius.so plugin radattr.so /etc/pptpd.conf ppp /usr/sbin/pppd option /etc/ppp/options.pptpd debug noipparam #logwtmp #bcrelay eth1 delegate connections 100 localip 10.0.0.1

2 1

must i use rlm_ldap to use groups/ou via winbind/Active Directory?
by john 22 May '09

22 May '09

Hi all, I am gradually refining my thinking thanks to help from Ivan and others on the list. I am using the current freeradius stable along with Active Directory to provide dot1x based access for our school district. Our test setup looks like this: active directory <=>winbind<=> Freeradius<=>NAS<=>supplicant Problem: I want to enforce different access policies for users depending on who they are and where they try to authenticate. (1) If students or teachers try to authenticate on the wired lan I want my dot1x capable NAS to provide access only if they user has a computer cert and valid domain credentials (2) If students try to connect via the student wireless lan they must only receive access if they are a member of the Active Directory based "student wireless users group", e.g. no staff member should be able to join. (3) If teachers try to connect via the teacher wireless lan, I want them to connect only if they HAVE a computer cert AND they have valid credentials. e.g only members of the Active Directoy based "staff group" using computers with a valid host credential may receive access. One solution would be two have two different radius servers, and point different NAS clients at the appropriate server, but I this is probably not the "right" way to do this. Ideally, I should be able to do it all from a single radius server with appropriate controls. I see that in the past folks have done similar things with openLdap and freeradius. But I think that using winbind may have changed this for users of Active Directly. I am not sure how to proceed. I would appreciate any guidance you wish to share. Thanks! John

4 7

Additional thread
by James Devine 22 May '09

22 May '09

Is it possible for me to spin off my own thread to do background work separate from individual requests in a module? I am trying to start a thread from the instantiate call and then rejoin on the detach, this seems to work when I run radius -X, but something is happening when radius is not in debug so that it gets stuck or killed somehow, the log statement is only logged once. All I have is a while loop with a log and sleep statement in it as shown below. It is not getting stuck in the log call as even without that, sending a sigterm to the process still hangs. #include <freeradius/ident.h> RCSID("$Id$") #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <pthread.h> #include <freeradius-devel/radiusd.h> #include <freeradius-devel/modules.h> typedef struct rlm_gwis_t { int shutdown; pthread_t p_thread; } gw_config; const CONF_PARSER module_config[] = { { NULL, -1, 0, NULL, NULL } /* end the list */ }; void *gwis__background__start(void *data) { gw_config *gwd = data; if(!gwd) return NULL; while(!gwd->shutdown) { radlog(L_ERR, "Background process, shutdown %d", gwd->shutdown); sleep(1); } return NULL; } static int gwis_detach(void *gwd) { if(gwd) { ((gw_config *)gwd)->shutdown = 1; pthread_join(((gw_config *)gwd)->p_thread, NULL); free(gwd); } return RLM_MODULE_OK; } static int gwis_instantiate(CONF_SECTION *conf, void **gwd) { gw_config *tmp_gwd; tmp_gwd = rad_malloc(sizeof(gw_config)); if(!tmp_gwd) { return RLM_MODULE_FAIL; } memset(tmp_gwd, 0, sizeof(gw_config)); if(cf_section_parse(conf, tmp_gwd, module_config) < 0) { free(tmp_gwd); return RLM_MODULE_FAIL; } tmp_gwd->shutdown = 0; if(pthread_create(&tmp_gwd->p_thread, NULL, gwis__background__start, tmp_gwd)) { gwis_detach(tmp_gwd); return -1; } *gwd = tmp_gwd; return RLM_MODULE_OK; } static int gwis_preacct(void *gwd, REQUEST *request) { return RLM_MODULE_OK; } module_t rlm_gwis = { RLM_MODULE_INIT, "gwis", RLM_TYPE_THREAD_SAFE, gwis_instantiate, gwis_detach, { NULL, NULL, gwis_preacct, NULL, NULL, NULL, NULL, NULL }, };

2 2

clients
by jon jon 22 May '09

22 May '09

hello, I am new to Freeradius, I am trying to use NTRadPing testing tool to send packets to my Freeradius server. I keep getting Ignoring request to authentication address * port 1812 from unknow client error message. So, the question you will ask me is did I add the client to the client.conf file. I thought I did but maybe not corectly. this is what I added to my client.conf file client ip address { secretname = testing123 shortname = private-network } is this correct?

2 2

Rewriting User-Name in pre-proxy
by William Taylor 22 May '09

22 May '09

Im currently using freeradius 2.1.4 I need to lookup a username in a dbm and rewrite it before sending off the proxy request. I have achieved this by using the below method. But I was wondering if there was a better way. It would seem that invoking perl with every auth request might be bad. Thanks in advance! -William In: /etc/raddb/dictionary ATTRIBUTE My-Local-String 3000 string In: sites-available/default pre-proxy { rewrite update proxy-request { User-Name := "%{proxy-request:My-Local-String}" } } In: /etc/raddb/modules/rewrite exec rewrite { wait = yes program = "/etc/raddb/rewriteusername.pl %{User-Name} %{Stripped- User-Name} %{Realm}" input_pairs = proxy-request output_pairs = proxy-request shell_escape = yes } In: /etc/raddb/rewriteusername.pl #!/usr/bin/perl use strict; use DB_File; my %h; tie %h, "DB_File", "/etc/raddb/rewritemap.db", O_RDONLY, 0444, $DB_HASH or die "Cannot open file rewritemap.db: $!\n"; my $fuser = $ARGV[0]; my $suser = $ARGV[1]; my $realm = $ARGV[2]; if($realm eq "foobee.net") { if($h{$suser}) { print "My-Local-String=" . $h{$suser}; } else { print "My-Local-String=$suser"; } } else { print "My-Local-String=$suser"; } exit 0;

2 5

Re: Freeradius and WiMAX Access Point
by Ming-Ching Tiew 22 May '09

22 May '09

--- On Fri, 5/22/09, Ivan Kalik <tnt(a)kalik.net> wrote: > Well, if the name is recongnizable ... Just return > Acct-Interim-Interval = > let's say 600 in the Access-Accept packet and see what > happens. That > should send updates every 10 minutes. Maybe trained talking > monkeys from > technical support don't know how it's done. > That's a good suggestion. Will give this a try when there is chance. Regards.

1 0

Re: accounting with 802.1X: some clients trigger multiple starts at a time
by Sam Hooker 22 May '09

22 May '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Alan DeKok wrote: > My $0.02 is that the NAS is broken (big surprise). It's likely > doing DHCP snooping to determine session IP address. Interesting. I suppose this would be the least of several evils, if they can't be guaranteed to be in the same Ethernet broadcast domain as the supplicant stations. Is there a better way? > Remember: The NAS sends accounting packets whenever it wants. The > contents of the accounting packets are determined SOLELY by the NAS. I hadn't consciously recognized it was that arbitrary; makes sense, though. > The clients MAY be requesting those IPs. e.g. The user takes a > laptop home, it gets a private IP. When he shows back up at work, the OS > may try to first renew that IP... and when it gets no response, ask for a > different IP. Yeah, that was one of my early theories, when I started noticing this (and before realizing the preponderance of *ahem* "unofficial" networks). > So the big question is: what NAS is causing the problem? Cisco LWAPP controllers. > The detail module doesn't care about the contents of the packet. > The SQL module does. If it doesn't like the contents, it won't log it. Important safety tip: thanks, Egon. ;-) > Maybe suppress multiple accounting starts in the same second? This sounds promising: How would you recommend doing it? I'm still new to the manipulation of RADIUS conversations, so hints are most welcome. > Tell the rogue department to buy an AP that works. Well, they're using a client bridge (and must be NATting), so no rogue AP...at least not in this particular case. Although there are plenty of those, too. Thanks, Alan! Cheers, - -sth sam hooker|sth@noiseplant.com|http://www.noiseplant.com Are you satisfied? ([y]/n): -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Use GnuPG with Firefox : http://getfiregpg.org (Version: 0.7.5) iEYEARECAAYFAkoWqjgACgkQX8KByLv3aQ0MWwCfaK3kcKJDj+OeQ/3wi/mIzlxf y9kAnjjXCNMPguX3bJkkK67WDaCt5AdI =yJVA -----END PGP SIGNATURE-----

2 1

Still with ldap error
by Sergio Belkin 22 May '09

22 May '09

Hi, Some months ago I mentioned a problem that it seems to be non-fatal but it still is there: Fri May 22 10:00:50 2009 : Error: rlm_ldap: ldap_search() failed: LDAP connection lost. Fri May 22 10:00:50 2009 : Info: rlm_ldap: Attempting reconnect This problem appears more or less every 90 seconds. on ldap logs you can see things like that: May 22 04:16:40 ldap-server slapd[27663]: conn=219 fd=14 ACCEPT from IP=127.0.0.1:56359 (IP=127.0.0.1:389) May 22 04:16:40 ldap-server slapd[27663]: conn=219 op=0 BIND dn="uid=jojo0l4,ou=people,dc=domain,dc=edu" method=128 May 22 04:16:40 ldap-server slapd[27663]: conn=219 op=0 BIND dn="uid=jojo0l4,ou=people,dc=domain,dc=edu" mech=SIMPLE ssf=0 May 22 04:16:40 ldap-server slapd[27663]: conn=219 op=0 RESULT tag=97 err=0 text= May 22 04:17:19 ldap-server slapd[27663]: conn=219 op=1 BIND anonymous mech=implicit ssf=0 May 22 04:17:19 ldap-server slapd[27663]: conn=219 op=1 BIND dn="uid=jojoi1,ou=people,dc=domain,dc=edu" method=128 May 22 04:17:19 ldap-server slapd[27663]: conn=219 op=1 BIND dn="uid=jojoi1,ou=people,dc=domain,dc=edu" mech=SIMPLE ssf=0 May 22 04:17:19 ldap-server slapd[27663]: conn=219 op=1 RESULT tag=97 err=0 text= May 22 04:18:01 ldap-server slapd[27663]: conn=219 fd=14 closed (idletimeout) May 22 09:31:50 ldap-server slapd[17574]: conn=219 fd=23 ACCEPT from IP=IPADDRESS:57845 (IP=0.0.0.0:636) May 22 09:31:50 ldap-server slapd[17574]: conn=219 fd=23 TLS established tls_ssf=256 ssf=256 May 22 09:31:50 ldap-server slapd[17574]: conn=219 op=0 BIND dn="uid=jojo2,ou=people,dc=domain,dc=edu" method=128 May 22 09:31:50 ldap-server slapd[17574]: conn=219 op=0 BIND dn="uid=jojo2,ou=people,dc=domain,dc=edu" mech=SIMPLE ssf=0 May 22 09:31:50 ldap-server slapd[17574]: conn=219 op=0 RESULT tag=97 err=0 text= May 22 09:31:50 ldap-server slapd[17574]: conn=219 op=1 UNBIND May 22 09:31:50 ldap-server slapd[17574]: conn=219 fd=23 closed May 22 10:07:45 ldap-server slapd[22236]: conn=219 fd=17 ACCEPT from IP=IPADDRESS:36313 (IP=0.0.0.0:636) May 22 10:07:45 ldap-server slapd[22236]: conn=219 fd=17 TLS established tls_ssf=256 ssf=256 I've tried modifying idletimeout y timelimit on slapd.conf, and modifying limits per ldap radius user. I was playing with timeout and timelimit and nothing changed it. Raising and lowering.... Using FreeRADIUS Version 2.1.1, for host x86_64-unknown-linux-gnu, built on Oct 21 2008 at 15:14:37 I'd thank you your help! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 1

Re: Freeradius and WiMAX Access Point
by Ming-Ching Tiew 22 May '09

22 May '09

--- On Fri, 5/22/09, Ivan Kalik <tnt(a)kalik.net> wrote: > > I shall not name the vendor name > here. I just got some info from the > > vendor that the WiMAX Access Point does not do > 'interim accounting', > > 'acctupdate' and so on. Only thing possible right now > is authenticate > > and start/stop accounting. > > That's pathetic. You should name them and shame them. > > Oh boy, that name isn't a small name. I hope it's the people I liased with was not knowledgible enough to tell me the truth. To put a box in front of the AP path is so ugly .... Regards.

2 1