- Freeradius-Users - lists.freeradius.org

Add users without restarting radiusd
by ournixnation＠gmail.com 12 May '09

12 May '09

Is there a way to add entries to or modify the users file in /etc/raddb without having to restart radiusd to apply the changes?

2 1

Upgrading freeradius from source
by mctiew＠yahoo.com 12 May '09

12 May '09

I have done some testing on 2.1.4 and I like the flexibility comparing to 1.x. Unfortunately, I am using for production a pretty old distribution 1.1.7. For such an old distro, it's almost impossible to do an upgrade and still maintaining the rpm package info and what not, so I am considering upgrading by compiling from source, ie configure and make install. Any thing I should consider before I have go down to this path ? Cheers.

3 2

how to define ACL like things in RADIUS
by Parashar Singh 12 May '09

12 May '09

Hi I have configure Radius server with LDAP authentication, for performing AAA for Cisco Routers and Firwalls. Currently all users created in LDAP are getting equal priviledge of accessing all devices (NAS) configured with AAA. I want to allow a set of users to let access some devices (say only few routers) while to allow other set of users with access permission of all devices (including Routers and Firwalls). I am aware of following: root Auth-Type := Accept Reply-Message = "Your account has been disabled." which deny all access to user root. But I want some modification, i.e. root user will able to authenticate to only two NAS, 192.168.1.178 & 192.168.1.179. Pls suggest some solution. Please guide me and help me to implement above scenario. Thanks

2 1

radiusd -X solaris eap error
by tony＠urugn.com 12 May '09

12 May '09

2 1

users authentication problem
by Andreas Bourges 12 May '09

12 May '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, ...we recently upgraded vom freeradius 0.9 to freeradius 2.1.4. Unfortunately local users cannot be authenticated anymore. This morning I used the default configuration files from 2.1.4 and started from scratch. My first objective was to get any valid response from the freeradiusd - but unluckily, without success. In the users file, I enabled the following line: lameuser Auth-Type := Reject Reply-Message = "Your account has been disabled." one entry in clients.conf for localhost testing: client localhost { ipaddr = 127.0.0.1 secret = testing123 require_message_authenticator = no nastype = other virtual_server = default } sites-enabled/default: authorize { chap suffix eap { ok = return } files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap files } I think that must be the main configuration items for my very basic test. Then I run freeradiusd -X -xx and test the user via radclient: echo "User-Name=lameuser, Password=bla, NAS-IP-Address=127.0.0.1" | radclient - -r 1 -x -s 127.0.0.1 auth 'testing123' results in: Sending Access-Request of id 20 to 127.0.0.1 port 1812 User-Name = "lameuser" Password = "bla" NAS-IP-Address = 127.0.0.1 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=20, length=20 Total approved auths: 0 Total denied auths: 1 Total lost auths: 0 The radiusd logs the following: Tue May 12 11:31:58 2009 : Debug: Listening on authentication address * port 1812 Tue May 12 11:31:58 2009 : Debug: Listening on accounting address * port 1813 Tue May 12 11:31:58 2009 : Debug: Listening on command file /var/run/freeradius/run/radiusd/radiusd.sock Tue May 12 11:31:58 2009 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 33013, id=5, length=54 User-Name = "lameuser" User-Password = "bla" NAS-IP-Address = 127.0.0.1 Tue May 12 11:32:04 2009 : Info: server default { Tue May 12 11:32:04 2009 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Tue May 12 11:32:04 2009 : Info: Failed to authenticate the user. Tue May 12 11:32:04 2009 : Info: } # server default - -> the user gets rejected, but not because of the Auth-Type := Reject setting in the users file. This is the same behaviour we observer when configuring "real" user accounts having a password associated, like the following: testuser Auth-Type := Local, Cleartext-Password == "blabla" server log says: Tue May 12 11:35:50 2009 : Info: server default { Tue May 12 11:35:50 2009 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Tue May 12 11:35:50 2009 : Info: Failed to authenticate the user. Tue May 12 11:35:50 2009 : Info: } # server default Thanks for any hints troubleshooting this! Regards, Andy -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkoJQ+MACgkQRrny/uOBVy7sggCfRfAjnhIkHwQbElEUwwZWPM4L DIEAniJziPLwpdyQKAWpa/vJvGAftmq1 =4Tih -----END PGP SIGNATURE-----

3 4

Upgrade to latest freeradius release
by pcsd＠canoemail.com 12 May '09

12 May '09

Freeradius Server v2.1.4. All clients are authenticating properly, except for clients that pass a ntdomain\userid. I have configured proxy.conf, realm and inner-tunnel in the past (i.e. v2.0.5) to handle these requests without issue. As of v2.0.6 and greater, clients are no longer authenticating. The debug logs seem to indicate login success. WinXP SP3 wireless client using latest IBM Thinkvantage software. --- debug log --- rad_recv: Access-Request packet from host 10.5.251.2 port 1645, id=191, length=248 User-Name = "SMBDOM\\userid" Framed-MTU = 1400 Called-Station-Id = "0017.0fdd.e701" Calling-Station-Id = "0005.4e41.ec86" Service-Type = Login-User Message-Authenticator = 0xacbf72d2001dfb409e9924fcdc973b1f EAP-Message = 0x02090050190017030100203438196b413d6f8f767ff2592331e9f6327862d45efe5ed8 084bb77a96c2987c1703010020182885154796afcf433e43f64e253e3960dd238a412d6f a974474d9da1a75899 NAS-Port-Type = Wireless-802.11 NAS-Port = 1674 NAS-Port-Id = "1674" State = 0xb2e30b4db5ea124aad52ba89ddbd4668 NAS-IP-Address = 10.5.251.2 NAS-Identifier = "head_office_wireless_2" - entering group authorize {...} [preprocess] returns ok [chap] returns noop [mschap] returns noop [suffix] No '@' in User-Name = "SMBDOM\userid", looking up realm NULL [suffix] No such realm "NULL" [suffix] returns noop [SMBDOM] Looking up realm "SMBDOM" for User-Name = "SMBDOM\userid" [SMBDOM] Found realm "SMBDOM" [SMBDOM] Adding Stripped-User-Name = "userid" [SMBDOM] Adding Realm = "SMBDOM" [SMBDOM] Authentication realm is LOCAL. [SMBDOM] returns ok [eap] EAP packet type response id 9 length 80 [eap] Continuing tunnel setup. [eap] returns ok Found Auth-Type = EAP - entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020900061a03 server { PEAP: Setting User-Name to SMBDOM\userid Sending tunneled request EAP-Message = 0x020900061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "SMBDOM\\userid" State = 0xa2f7c944a3fed33462945b4e374f79ce server inner-tunnel { - entering group authorize {...} [chap] returns noop [mschap] returns noop [unix] returns notfound [suffix] No '@' in User-Name = "SMBDOM\userid", looking up realm NULL [suffix] No such realm "NULL" [suffix] returns noop [SMBDOM] Looking up realm "SMBDOM" for User-Name = "SMBDOM\userid" [SMBDOM] Found realm "SMBDOM" [SMBDOM] Adding Stripped-User-Name = "userid" [SMBDOM] Adding Realm = "SMBDOM" [SMBDOM] Authentication realm is LOCAL. [SMBDOM] returns ok [control] returns ok [eap] EAP packet type response id 9 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation [eap] returns updated [files] users: Matched entry userid at line 1385 [files] returns ok [expiration] returns noop [logintime] returns noop [pap] Found existing Auth-Type, not changing it. [pap] returns noop Found Auth-Type = EAP - entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler [eap] returns ok Login OK: [SMBDOM\\userid] (from client private-network-5 port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 2 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "userid" [peap] Got tunneled reply RADIUS code 2 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "userid" [peap] Tunneled authentication was successful. [peap] SUCCESS [eap] returns handled Sending Access-Challenge of id 191 to 10.5.251.2 port 1645 EAP-Message = 0x010a002b19001703010020b5c3cd4e27abb67bc4536c0829ed6f45c07edbfb2f42c758 649472d7b8857cb2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb2e30b4dbae9124aad52ba89ddbd4668 Finished request 8. --- end debug log --- Thanks for any assisantance

3 2

test
by François Mehault 12 May '09

12 May '09

De : François Mehault Envoyé : mardi 12 mai 2009 11:27 À : 'freeradius-users(a)lists.freeradius.org' Cc : François Mehault Objet : RE: check-item NAS-IP-ADdress & Calling-Station-ID with openldap Hi All, I want to use FreeRadius to administer network equipement. I use also OpenLDAP to stock information about users. FreeRADIUS and OpenLDAP are installed on the same server FreeBSD 7.0. I contact a Network equipement (like catalyst cisco 2950 v12.1) with putty (ssh/telnet). To resume : Windows XP -> ssh or telnet -> Cisco 2950 (client radius/authenticator/NAS) -> EAPoRadius (I suppose) -> FreeRADIUS & OpenLDAP For the moment, I don't install/configure supplicant on the Windows XP, I don't know if it's require because I don't want to use FreeRADIUS to auhtenticate my Windows session. I have an active directory to do this. I configure slapd.conf, radius.conf, clients.conf, module ldap etc ... and it's works. And now I would like to add some check-item like NAS-IP-Address and Caliing-Station-ID. But I don't succeed :s, I use checkval to do this. I have 2 questions : - Why my calling-station-id in the request is a IP and not a MAC ? - When I authenticate on the cisco 2950, I have in my log « rlm_checkval: Item Name: NAS-IP-Address, Value: À¨ » instead of 192.168.0.50, what is the problem ??? I think I have numerous problem, If you see one of them, could you inform me ? I am a novice with freeradius (and openldap also :s ). I could give you all information you need to help me to fix my problem. Thanks for your help, Regards Francçois MEHAULT On my cisco 2950 : aaa new-model aaa authentication login default local group radius aaa authorization exec default group radius local aaa authorization network default group radius My ldap.attrmap : checkItem Calling-Station-Id radiusCallingStationId checkItem NAS-IP-Address radiusNASIpAddress Extract of my openldap : dn: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr givenName:: RnJhbsOnb2lz sn: MEHAULT uid: fmehault cn: Francois MEHAULT homeDirectory: /home/admins/fmehault loginShell: /usr/local/bin/zsh gidNumber: 1203 uidNumber: 1203 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: radiusprofile radiusGroupName: stagiaire radiusCallingStationId: 192.168.0.80 -> I put a IP address and not a Mac address because in the request it's a IP and not a mac, I don't know why... radiusNASIpAddress: 192.168.0.60 -> in fact, the NAS IP is 192.168.0.50, but I put .60 to have Access-Reject userPassword: {SSHA}tOoPUvtVW5O3+StoxScmQLiGFTO5l/+z <12:34>[labobe2:~]# radiusd -X FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd7.0, built on Apr 16 2009 at 12:03:36 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A [...] radiusd: #### Loading Clients #### client 192.168.0.50 { require_message_authenticator = no secret = "cherche" shortname = "swlabo" nastype = "cisco" } radiusd: #### Instantiating modules #### [...] modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "127.0.0.1" port = 389 password = "secret" identity = "cn=root,dc=netplus,dc=fr" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=netplus,dc=fr" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group [...] rlm_ldap: LDAP radiusVSA mapped to RADIUS Cisco-AVPair conns: 0x2852c240 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_checkval Module: Instantiating station-check checkval station-check { item-name = "Calling-Station-Id" check-name = "Calling-Station-Id" data-type = "string" notfound-reject = no } rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiating nas-check checkval nas-check { item-name = "NAS-IP-Address" check-name = "NAS-IP-Address" data-type = "ipaddr" notfound-reject = no } rlm_checkval: Registered name NAS-IP-Address for attribute 4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail [...] Then I launch my putty and log on the cisco : rad_recv: Access-Request packet from host 192.168.0.50 port 1812, id=117, length=80 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "fmehault" Calling-Station-Id = "192.168.0.80" --> it's not a MAC address, why ??? User-Password = "toto" +- entering group authorize {...} ++[preprocess] returns ok [...] [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=fmehault) [ldap] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=netplus,dc=fr, with filter (uid=fmehault) rlm_ldap: performing search in cn=stagiaire,ou=Profiles,dc=netplus,dc=fr, with filter (objectclass=radiusprofile) rlm_ldap: radiusServiceType -> Service-Type = NAS-Prompt-User [ldap] looking for check items in directory... rlm_ldap: radiusNASIpAddress -> NAS-IP-Address == 192.168.0.60 rlm_ldap: radiusCallingStationId -> Calling-Station-Id == "192.168.0.80" [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = LDAP [ldap] user fmehault authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: 192.168.0.80 rlm_checkval: Value Name: Calling-Station-Id, Value: 192.168.0.80 ++[station-check] returns ok rlm_checkval: Item Name: NAS-IP-Address, Value: À¨ --> what is the problem ??? rlm_checkval: Value Name: NAS-IP-Address, Value: 192.168.0.60 (I put 192.168.0.60 instead of 192.168.0.50 to be reject ) [...] Sending Access-Accept of id 117 to 192.168.0.50 port 1812 Reply-Message = "Utilisateur: fmehault, group: Stagiaire" Service-Type = NAS-Prompt-User Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 117 with timestamp +237 Ready to process requests.

2 2

OpenLDAP check item
by François Mehault 12 May '09

12 May '09

Hi All, I want to use FreeRadius to administer network equipement. I use also OpenLDAP to stock information about users. FreeRADIUS and OpenLDAP are installed on the same server FreeBSD 7.0. I contact a Network equipement (like catalyst cisco 2950 v12.1) with putty (ssh/telnet). To resume : Windows XP -> ssh or telnet -> Cisco 2950 (client radius/authenticator/NAS) -> EAPoRadius (I suppose) -> FreeRADIUS & OpenLDAP For the moment, I don't install/configure supplicant on the Windows XP, I don't know if it's require because I don't want to use FreeRADIUS to auhtenticate my Windows session. I have an active directory to do this. I configure slapd.conf, radius.conf, clients.conf, module ldap etc ... and it's works. And now I would like to add some check-item like NAS-IP-Address and Caliing-Station-ID. But I don't succeed :s, I use checkval to do this. I have 2 questions : - Why my calling-station-id in the request is a IP and not a MAC ? - When I authenticate on the cisco 2950, I have in my log « rlm_checkval: Item Name: NAS-IP-Address, Value: À¨ » instead of 192.168.0.50, what is the problem ??? I think I have numerous problem, If you see one of them, could you inform me ? I am a novice with freeradius (and openldap also :s ). I could give you all information you need to help me to fix my problem. Thanks for your help, Regards Francçois MEHAULT On my cisco 2950 : aaa new-model aaa authentication login default local group radius aaa authorization exec default group radius local aaa authorization network default group radius My ldap.attrmap : checkItem Calling-Station-Id radiusCallingStationId checkItem NAS-IP-Address radiusNASIpAddress Extract of my openldap : dn: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr givenName:: RnJhbsOnb2lz sn: MEHAULT uid: fmehault cn: Francois MEHAULT homeDirectory: /home/admins/fmehault loginShell: /usr/local/bin/zsh gidNumber: 1203 uidNumber: 1203 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: radiusprofile radiusGroupName: stagiaire radiusCallingStationId: 192.168.0.80 -> I put a IP address and not a Mac address because in the request it's a IP and not a mac, I don't know why... radiusNASIpAddress: 192.168.0.60 -> in fact, the NAS IP is 192.168.0.50, but I put .60 to have Access-Reject userPassword: {SSHA}tOoPUvtVW5O3+StoxScmQLiGFTO5l/+z <12:34>[labobe2:~]# radiusd -X FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd7.0, built on Apr 16 2009 at 12:03:36 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A [...] radiusd: #### Loading Clients #### client 192.168.0.50 { require_message_authenticator = no secret = "cherche" shortname = "swlabo" nastype = "cisco" } radiusd: #### Instantiating modules #### [...] modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "127.0.0.1" port = 389 password = "secret" identity = "cn=root,dc=netplus,dc=fr" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=netplus,dc=fr" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group [...] rlm_ldap: LDAP radiusVSA mapped to RADIUS Cisco-AVPair conns: 0x2852c240 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_checkval Module: Instantiating station-check checkval station-check { item-name = "Calling-Station-Id" check-name = "Calling-Station-Id" data-type = "string" notfound-reject = no } rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiating nas-check checkval nas-check { item-name = "NAS-IP-Address" check-name = "NAS-IP-Address" data-type = "ipaddr" notfound-reject = no } rlm_checkval: Registered name NAS-IP-Address for attribute 4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail [...] Then I launch my putty and log on the cisco : rad_recv: Access-Request packet from host 192.168.0.50 port 1812, id=117, length=80 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "fmehault" Calling-Station-Id = "192.168.0.80" --> it's not a MAC address, why ??? User-Password = "toto" +- entering group authorize {...} ++[preprocess] returns ok [...] [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=fmehault) [ldap] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=netplus,dc=fr, with filter (uid=fmehault) rlm_ldap: performing search in cn=stagiaire,ou=Profiles,dc=netplus,dc=fr, with filter (objectclass=radiusprofile) rlm_ldap: radiusServiceType -> Service-Type = NAS-Prompt-User [ldap] looking for check items in directory... rlm_ldap: radiusNASIpAddress -> NAS-IP-Address == 192.168.0.60 rlm_ldap: radiusCallingStationId -> Calling-Station-Id == "192.168.0.80" [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = LDAP [ldap] user fmehault authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: 192.168.0.80 rlm_checkval: Value Name: Calling-Station-Id, Value: 192.168.0.80 ++[station-check] returns ok rlm_checkval: Item Name: NAS-IP-Address, Value: À¨ --> what is the problem ??? rlm_checkval: Value Name: NAS-IP-Address, Value: 192.168.0.60 (I put 192.168.0.60 instead of 192.168.0.50 to be reject ) [...] Sending Access-Accept of id 117 to 192.168.0.50 port 1812 Reply-Message = "Utilisateur: fmehault, group: Stagiaire" Service-Type = NAS-Prompt-User Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 117 with timestamp +237 Ready to process requests.

1 0

RE: check-item NAS-IP-ADdress & Calling-Station-ID with openldap
by François Mehault 12 May '09

12 May '09

Hi All, I want to use FreeRadius to administer network equipement. I use also OpenLDAP to stock information about users. FreeRADIUS and OpenLDAP are installed on the same server FreeBSD 7.0. I contact a Network equipement (like catalyst cisco 2950 v12.1) with putty (ssh/telnet). To resume : Windows XP -> ssh or telnet -> Cisco 2950 (client radius/authenticator/NAS) -> EAPoRadius (I suppose) -> FreeRADIUS & OpenLDAP For the moment, I don't install/configure supplicant on the Windows XP, I don't know if it's require because I don't want to use FreeRADIUS to auhtenticate my Windows session. I have an active directory to do this. I configure slapd.conf, radius.conf, clients.conf, module ldap etc ... and it's works. And now I would like to add some check-item like NAS-IP-Address and Caliing-Station-ID. But I don't succeed :s, I use checkval to do this. I have 2 questions : - Why my calling-station-id in the request is a IP and not a MAC ? - When I authenticate on the cisco 2950, I have in my log « rlm_checkval: Item Name: NAS-IP-Address, Value: À¨ » instead of 192.168.0.50, what is the problem ??? I think I have numerous problem, If you see one of them, could you inform me ? I am a novice with freeradius (and openldap also :s ). I could give you all information you need to help me to fix my problem. Thanks for your help, Regards Francçois MEHAULT On my cisco 2950 : aaa new-model aaa authentication login default local group radius aaa authorization exec default group radius local aaa authorization network default group radius My ldap.attrmap : checkItem Calling-Station-Id radiusCallingStationId checkItem NAS-IP-Address radiusNASIpAddress Extract of my openldap : dn: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr givenName:: RnJhbsOnb2lz sn: MEHAULT uid: fmehault cn: Francois MEHAULT homeDirectory: /home/admins/fmehault loginShell: /usr/local/bin/zsh gidNumber: 1203 uidNumber: 1203 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: radiusprofile radiusGroupName: stagiaire radiusCallingStationId: 192.168.0.80 -> I put a IP address and not a Mac address because in the request it's a IP and not a mac, I don't know why... radiusNASIpAddress: 192.168.0.60 -> in fact, the NAS IP is 192.168.0.50, but I put .60 to have Access-Reject userPassword: {SSHA}tOoPUvtVW5O3+StoxScmQLiGFTO5l/+z <12:34>[labobe2:~]# radiusd -X FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd7.0, built on Apr 16 2009 at 12:03:36 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A [...] radiusd: #### Loading Clients #### client 192.168.0.50 { require_message_authenticator = no secret = "cherche" shortname = "swlabo" nastype = "cisco" } radiusd: #### Instantiating modules #### [...] modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "127.0.0.1" port = 389 password = "secret" identity = "cn=root,dc=netplus,dc=fr" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=netplus,dc=fr" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group [...] rlm_ldap: LDAP radiusVSA mapped to RADIUS Cisco-AVPair conns: 0x2852c240 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_checkval Module: Instantiating station-check checkval station-check { item-name = "Calling-Station-Id" check-name = "Calling-Station-Id" data-type = "string" notfound-reject = no } rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiating nas-check checkval nas-check { item-name = "NAS-IP-Address" check-name = "NAS-IP-Address" data-type = "ipaddr" notfound-reject = no } rlm_checkval: Registered name NAS-IP-Address for attribute 4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail [...] Then I launch my putty and log on the cisco : rad_recv: Access-Request packet from host 192.168.0.50 port 1812, id=117, length=80 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "fmehault" Calling-Station-Id = "192.168.0.80" --> it's not a MAC address, why ??? User-Password = "toto" +- entering group authorize {...} ++[preprocess] returns ok [...] [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=fmehault) [ldap] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=netplus,dc=fr, with filter (uid=fmehault) rlm_ldap: performing search in cn=stagiaire,ou=Profiles,dc=netplus,dc=fr, with filter (objectclass=radiusprofile) rlm_ldap: radiusServiceType -> Service-Type = NAS-Prompt-User [ldap] looking for check items in directory... rlm_ldap: radiusNASIpAddress -> NAS-IP-Address == 192.168.0.60 rlm_ldap: radiusCallingStationId -> Calling-Station-Id == "192.168.0.80" [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = LDAP [ldap] user fmehault authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: 192.168.0.80 rlm_checkval: Value Name: Calling-Station-Id, Value: 192.168.0.80 ++[station-check] returns ok rlm_checkval: Item Name: NAS-IP-Address, Value: À¨ --> what is the problem ??? rlm_checkval: Value Name: NAS-IP-Address, Value: 192.168.0.60 (I put 192.168.0.60 instead of 192.168.0.50 to be reject ) [...] Sending Access-Accept of id 117 to 192.168.0.50 port 1812 Reply-Message = "Utilisateur: fmehault, group: Stagiaire" Service-Type = NAS-Prompt-User Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 117 with timestamp +237 Ready to process requests.

1 0

NAS or supplicant, pam_radius or xsupplicant
by François Mehault 12 May '09

12 May '09

Hi All I have to install a FreeRADIUS to authenticate some users on network equipement (like a Catalyst cisco). I just want to authenticate users on the cisco switch, no vlan attribution ... So i conclude that I don't have to install/configure supplicant on my computer (windows XP), the computer I use to contact the switch via telnet/ssh. Could you confirm me that I'm right ? I would like also to authenticate users on UNIX servers. Also, I just need to authenticate the users on servers, So I conclude that I configure pam_radius on these servers and no install/configure xsupllicant. Servers are RADIUS client/NAS and no supplicant. Of course I would like to have a safe communication beetween NAS and FreeRADIUS. Could you say me if I selected the good configuration, or if I am totally wrong. I read comments in files configuration and a lot of documentation on the web, but the case described are often with supplicant - NAS - FreeRADIUS, with Authentication on the supplicant for vlan attribution. I don't understand wery well when I have to install xsupplicant or pam_radius on my server UNIX, if my Server is a supplicant or a NAS. Thanks for your help François

1 0