- Freeradius-Users - lists.freeradius.org

VS: VS: Chap auhtentication against LDAP
by Ville Leinonen 05 Apr '09

05 Apr '09

Hi, Thank you for this reply. Well then i do some scripting and pull userinfo inside ldap and export it to my radsrv. Br, Ville -----Alkuperäinen viesti----- Lähettäjä: freeradius-users-bounces+ville.leinonen=solodel.com(a)lists.freeradius.org puolesta: Alan DeKok Lähetetty: su 5.4.2009 16:16 Vastaanottaja: FreeRadius users mailing list Aihe: Re: VS: Chap auhtentication against LDAP Ville Leinonen wrote: > So i cannot do this about using freeradius, but i can make it > using IAS (see link)? No. You seemed to have misunderstood my response. Let me say it a different way: LDAP servers cannot do CHAP authentication. Why? Because LDAP servers are *DATABASES*. LDAP servers are not *authentication* servers. FreeRADIUS is an *AUTHENTICATION* server. Configure FreeRADIUS so that it pulls the clear-text password from LDAP. FreeRADIUS will then do CHAP authentication. If you don't have a clear-text password in LDAP, then doing CHAP authentication is impossible. It is impossible with FreeRADIUS, IAS, Cisco ACS, Juniper SBR, Radiator, and also with every other RADIUS server on the planet. And go read my web page: http://deployingradius.com/documents/protocols/compatibility.html Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Help with LDAP groupOfNames?
by Jason Antman 04 Apr '09

04 Apr '09

Hi, I've googled this to no avail (have been working on it for about 4 hours now). I'm running FreeRADIUS 1.1.0 (SuSE package) and OpenLDAP 2.3.19. I have an access point that will do captive portal, but only via RADIUS, not via LDAP natively. I already have an LDAP server running, so I just added a new groupOfNames called "WirelessUsers". Basically, *all* I want RADIUS to do is check the username and password, and assuming they are correct, either allow or deny based on whether the user is a member of "WirelessUsers". According to radtest, I have it working with LDAP, but it allows everyone with a valid username and password access, regardless of the WirelessUsers group - and I'm not seeing anything related to that group in the LDAP logs. I can't seem to find anything online for freeradius1 relating to groupOfNames, so I've just been trying random things that I found online (for raddb/users) hoping one would work. radiusd.conf: ldap { server = "127.0.0.1" basedn = "dc=example,dc=com" filter = "(&(objectClass=posixAccount)(uid=%{Stripped-User-Name:-%{User-Name}}))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupname_attribute = cn groupmembership_filter = (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) groupmembership_attribute = "memberof" timeout = 4 timelimit = 3 net_timeout = 1 } users: #DEFAULT Auth-Type == LDAP # Fall-Through = Yes DEFAULT LDAP-Group == "WirelessUsers" Auth-Type := Reject #DEFAULT Ldap-Group != "WirelessUsers", Auth-Type := Reject # Reply-Message = "Sorry, your account has not yet been enabled for wireless access." #DEFAULT Huntgroup-Name == "wirelessusers", Ldap-Group=="WirelessUsers", Auth-Type = LDAP #DEFAULT Auth-Type := Reject #DEFAULT Ldap-Group == "WirelessUsers" # Fall-Through = no DEFAULT Ldap-Group == WirelessUsers Fall-Through = no DEFAULT Auth-Type := Reject I've tried all of the commented out stuff also, and none of it worked. All I want is (assuming username & password are correct) allow anyone who is in "WirelessUsers" group, deny everyone else. I'm sure this is horribly simple, but I just can't seem to figure it out from the docs or from extensive googling. Thanks for any help, Jason Antman

1 0

RFC 5090 support
by Andrew Krywaniuk 04 Apr '09

04 Apr '09

Hi, I have installed version 2.1.4 of FreeRadius server and I am trying to configure digest authentication for HTTP (not SIP) as per RFC 5090. In searching through the archives/wiki, I found one message from Alan stating that dictionary.rfc5090 is disabled by default because it's not supported by the server, and another message saying that "there are patches but they are not included in the main stream yet". Are the patches available for download anywhere? I haven't been able to find them (I don't mind if they are alpha quality). Another thing is that I can't even get FreeRadius to decode the digest attributes. If I $INCLUDE dictionary.rfc5090 in the master dictionary file, I get the following error at startup: 'including dictionary file /usr/local/etc/raddb/dictionary Errors reading dictionary: dict_init: /usr/local/share/freeradius/dictionary.freeradius.internal[93]: dict_init: /usr/local/share/freeradius/dictionary.freeradius.internal[93]:' I understand that the attributes are not supported yet, but I'm not sure why just including the dictionary file causes a fatal error while loading the configuration. BTW, I noticed that the list of custom attributes in the dictionary.fortinet file is out of date. Here is an updated list: ATTRIBUTE Fortinet-Group-Name 1 string ATTRIBUTE Fortinet-Client-IP-Address 2 ipaddr ATTRIBUTE Fortinet-Vdom-Name 3 string ATTRIBUTE Fortinet-Client-IPv6-Address 4 octets ATTRIBUTE Fortinet-Interface-Name 5 string ATTRIBUTE Fortinet-Access-Profile 6 string Andrew _________________________________________________________________ Internet Explorer 8 helps keep your personal info safe. http://go.microsoft.com/?linkid=9655581

1 1

problem matching realms - for local auth not proxy
by Seamus Bridgeman 03 Apr '09

03 Apr '09

Hi Using freeradius2.1.3 for seperate Auth and Acct servers in DSL/PPPoE n/w. Using CHAP auth only and lookup via dbm file with users.txt fallback. Can successfully authenticate/authorise against specific user profiles in users dbm/txt but problems when trying to match realms. Have users dbm/txt file with list of DEFAULT realm=xxx followed by users profiles. realm matches simply returns L2TP tunnel profiles for these realms (no fallthru). No realm match (null or other domains not in proxy.conf) will do lookup and return specific user profiles (i.e matching userxx Cleartext-Password := "xxxx"). Debug shows the rlm_realms module logging error: [suffix] Looking up realm "dslip" for User-Name = "jean@dslip" [suffix] No such realm "dslip" We are not proxying to remote servers but do local auth on matching realms. Am I missing some step/module which imports the proxy.conf file - or the order of modules in authorise{} This issue occurs regardless dbm or files based lookup and in realms module.If I remove proxy.conf radius does not complain. Ive looked in maillist for similiar problems. Some reference to include suffix in preacct module but ours is Auth server only. I have spent some time testing and read man pages, searching related etc before resorting to first my first query to this maillist. Any help appreciated SeamusB Setup ---------- [1] Test users file with single record - a default realm : DEFAULT Realm == "dslip", Auth-Type := Accept Tunnel-Type:1 = L2TP, Tunnel-Medium-Type:1 = IP, Tunnel-Server-Endpoint:1 = "xxx.xxx.xxx.xxx", Tunnel-Client-Auth-Id:1 = "yyy", Tunnel-Password:1 = "yyy", Tunnel-Assignment-Id:1 = "dslip", Tunnel_Algorithm = 2, Tunnel_Domain = 1 Added to dbm file: /usr/local/freeradius/bin/rlm_dbm_cat -f /usr/local/freeradius/etc/raddb/users DEFAULT Realm == "dslip", Auth-Type := Accept Tunnel-Type:1 = L2TP, Tunnel-Medium-Type:1 = IPv4, Tunnel-Server-Endpoint:1 = "159.134.191.145", Tunnel-Client-Auth-Id:1 = "dslip", Tunnel-Password:1 = "unlock", Tunnel-Assignment-Id:1 = "dslip", Tunnel_Algorithm = 2, Tunnel_Domain = 1 freeradiusdsldev00# [2] proxy.conf has realm added as below and permissions 644 for radius/radadmin realm dslip { type = radius authhost = LOCAL accthost = LOCAL nostrip } [3] radiusd.conf includes reference to realm module and includes in authorise {} section. Also not including policy.conf which denies realms by default. modules { .. realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } } authorize { preprocess suffix chap group { dbm { ok = return reject = return notfound = return fail = 1 } files { ok = return reject = return notfound = return fail = return } } } [4] Radiusd -X output client freeradiusdsldev00 { require_message_authenticator = no secret = "testing123" shortname = "freeradiusdsldev00" } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Instantiating modules #### radiusd: #### Loading Virtual Servers #### modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_chap Module: Instantiating chap Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/freeradius/etc/raddb/huntgroups" hints = "/usr/local/freeradius/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_dbm Module: Instantiating dbm dbm { usersfile = "/usr/local/freeradius/etc/raddb/users" byclid_length = 4 } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/freeradius/etc/raddb/users.txt" compat = "no" byclid_length = 4 } } radiusd: #### Opening IP addresses and Ports #### bind_address = * WARNING: The directive 'bind_adress' is deprecated, and will be removed in future versions of FreeRADIUS. Please edit the configuration files to use the directive 'listen'. Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. [5] Test when using radclient with test username jean@dslip which should match the realm in proxy.conf and default profile in users.db. Server debug log: rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx port 35210, id=168, length=201 User-Name = "jean@dslip" Acct-Session-Id = "5511534626" CHAP-Password = 0xa812b2813543dd45b1434328ea423c83e4 Service-Type = Framed-User Framed-Protocol = PPP +- entering group authorize {...} ++[preprocess] returns ok [suffix] Looking up realm "dslip" for User-Name = "jean@dslip" [suffix] No such realm "dslip" ++[suffix] returns noop [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++- entering group {...} rlm_dbm: try open database file: /usr/local/freeradius/etc/raddb/users rlm_dbm: Call parse_user: sm_parse_user.c: check for loops Add jean@dslip to user list rlm_dbm: User <jean@dslip> not found in database Remove jean@dslip from user list sm_parse_user.c: check for loops Add DEFAULT to user list sm_parse_user: start parsing: user: DEFAULT parse buffer: <<Realm == "dslip", Auth-Type := Accept>> rlm_dbm: recod parsed process pattern rlm_dbm: patern not matched, reply skiped Remove DEFAULT from user list +++[dbm] returns notfound ++- group returns notfound Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "jean@dslip" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. Login incorrect (rlm_chap: Clear text password not available): [jean@dslip/<CHAP-Password>] (from client freeradiusdsldev00 port 3525263410 cli :xxxxxx) Sending Access-Reject of id 168 to xxx.xxx.xxx.xxx port 35210 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 168 with timestamp +5 Ready to process requests.

2 3

Chap auhtentication against LDAP
by Ville Leinonen 03 Apr '09

03 Apr '09

Hi, Does Freeradius 2.1.5 support chap authentication against ldap? If i try it here is messages what i get: Found Auth-Type = CHAP +- entering group CHAP {...} rlm_ldap: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". ++[ldap] returns invalid Failed to authenticate the user. Br, Ville

2 1

user-Password required for ldap radius
by Basant Agarwal 03 Apr '09

03 Apr '09

Hello, I am trying to authenticate wifi users for wireless network ... for this i am using freeradius with ldap... When we run radtest on localhost, it is able to get authorised and authenticated .. it works fine but when i try from laptop(windows ) then it rejects the same user... please let me know what to do ...?? here is the debug output .. Ready to process requests. rad_recv: Access-Request packet from host 172.16.1.80:1122, id=0, length=204 Message-Authenticator = 0x3f459af06e42a2a0b7cf9c1d80092e31 Service-Type = Framed-User User-Name = "testap" Framed-MTU = 1488 Called-Station-Id = "00-15-E9-C9-F3-80:MNIT-DC-AP" Calling-Station-Id = "00-16-6F-7C-DB-2D" NAS-Identifier = "D-link Corp. Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000b01746573746170 NAS-IP-Address = 172.16.1.80 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "testap", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 159 users: Matched entry DEFAULT at line 177 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for testap radius_xlat: '(uid=testap)' radius_xlat: 'dc=mnit,dc=ac,dc=in' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 172.16.1.20:389, authentication 0 rlm_ldap: bind as uid=admin,ou=people,dc=mnit,dc=ac,dc=in/system to 172.16.1.20:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=mnit,dc=ac,dc=in, with filter (uid=testap) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user testap authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap" returns invalid for request 0 modcall: leaving group LDAP (returns invalid) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 172.16.1.80 <http://172.16.1.80/>port 1122 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 46b1b8cb Nothing to do. Sleeping until we see a request.

3 2

debug log and syslog
by Jehan PROCACCIA 03 Apr '09

03 Apr '09

hello I can run debug log by starting radiusd -X , but for production, I want logs to go to a file and not stdout . When I start radiusd without -X I only get very few logs, how can I have equivalent to -X log with syslog or a log file ? or a least get more log the the very few ones I get with that config: /etc/raddb/radiusd.conf log_destination = syslog log { syslog_facility = daemon file = ${logdir}/radiusd.log } It's a freeradius-2.0.3-3.el5 on a centos 5 for now with that config I only get 2 lines in radiusd.log when I log in 802.X EAP-ttls , telling: Sep 5 10:42:30 radiustux radiusd[14619]: Login OK: [procacci] (from client APS_Cisco port 29 cli 00-1F-3C-59-5E-52) Sep 5 10:42:30 radiustux radiusd[14619]: Login OK: [anonymous] (from client APS_Cisco port 29 cli 00-1F-3C-59-5E-52) with radius -X I get a lot more, can I have at least more than these 2 lines ? thanks .

5 8

Acceess point not forwarding authentication request to the RADIUS
by kalesameer 03 Apr '09

03 Apr '09

I am working with freeradius 2.1.4 and DWL AP 21000 (DLink access point) and Fedora 8 linux os. I want to authenticate the windows clients using RADIUS server in my wifi network. But my AP is not forwarding request of authentication to RADIUS server.I can see the log of AP as FRI APR 03 09:30:46 2009 System --AP cold start with f/w version: v2.20eu FRI APR 03 09:30:46 2009 Wireless --WLAN1 Normal AP ready FRI APR 03 09:30:56 2009 System --Web login success from 192.168.1.251 FRI APR 03 09:31:32 2009 Wireless --Association:11G STA 00:13:02:12:16:6e associated with WLAN1 SSID = scoeit FRI APR 03 09:31:44 2009 Wireless --WLAN1 aged 11G STA 00:13:02:12:16:6e FRI APR 03 09:31:44 2009 Wireless --Association:11G STA 00:13:02:12:16:6e associated with WLAN1 SSID = scoeit FRI APR 03 09:31:56 2009 Wireless --WLAN1 aged 11G STA 00:13:02:12:16:6e FRI APR 03 09:31:57 2009 Wireless --Association:11G STA 00:13:02:12:16:6e associated with WLAN1 SSID = scoeit FRI APR 03 09:32:09 2009 Wireless --WLAN1 aged 11G STA 00:13:02:12:16:6e FRI APR 03 09:32:09 2009 Wireless --Association:11G STA 00:13:02:12:16:6e associated with WLAN1 SSID = scoeit FRI APR 03 09:32:21 2009 Wireless --WLAN1 aged 11G STA 00:13:02:12:16:6e FRI APR 03 09:32:22 2009 Wireless --Association:11G STA 00:13:02:12:16:6e associated with WLAN1 SSID = scoeit FRI APR 03 09:32:34 2009 Wireless --WLAN1 aged 11G STA 00:13:02:12:16:6e and RADIUS server shows only listening and not process any of the request. [sameer@sameerkale]# radiusd -X FreeRADIUS Version 2.1.1, for host i686-pc-linux-gnu, built on Feb 7 2009 at 14:41:27 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = yes auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.1.0/24 { require_message_authenticator = no secret = "testing123" shortname = "scoeit" } client 192.168.1.250 { require_message_authenticator = no secret = "testing123" shortname = "accesspoint1" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "crypt" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "localhost" port = 389 password = "secret" identity = "cn=Manager,dc=sinhgad,dc=edu" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=sinhgad,dc=edu" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=student)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP username mapped to RADIUS User-Name rlm_ldap: LDAP password mapped to RADIUS User-Password conns: 0x8a2b110 Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. ......... I tried it hard but i didnt find any solution....plz help me guys . -- View this message in context: http://www.nabble.com/Acceess-point-not-forwarding-authentication-request-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Question concerning changing a User-Name
by Bryan Graham 02 Apr '09

02 Apr '09

I'm using freeradius 2.1.4, hand compiled, and running on Solaris 10, in a zone. I've already got my server authorizing off of ldap and authenticating off of kerberos. What I would like to do is something slightly trickier. I would like to authorize off ldap and then authenticate off of kerberos, but using a different username. Optimally, this would happen by storing the alternate username in ldap, and then setting the username that will be used to authenticate against kerberos to this entry. I don't know if I would have to try to change the User-Name field (which I haven't had luck doing via the users file), or if there is some way to tell rlm_krb5 "hey, user this username instead". Worst case, I could create a mapping somewhere in a text file if needed, but storing the "other" username in ldap would be optimal. thanks, Bryan Graham

1 0

proxy setup questions
by Dallas Helquist 02 Apr '09

02 Apr '09

freeradius version: 1.0.1 (Centos4) I have the need to proxy requests based on "@domain.com" to different radius servers. I thought this would be fairly simple after reading proxy.conf, but I must be missing something! Here's the relevant portion of my proxy.conf: realm test.com { type = radius authhost = 10.19.3.8:1812 accthost = LOCAL secret = testing123 } realm test2.com { type = radius authost = 10.19.3.9:1812 accthost = LOCAL secret = testing123 } When testing via radtest using "test(a)test.com" the expected behavior happens - I see the request proxied to 1.1.1.1: <SNIP> rad_recv: Access-Request packet from host 127.0.0.1:53468, id=229, length=65 User-Name = "test(a)test.com" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 123 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: Looking up realm "test.com" for User-Name = "test(a)test.com" rlm_realm: Found realm "test.com" rlm_realm: Adding Stripped-User-Name = "test" rlm_realm: Proxying request from user test to realm test.com rlm_realm: Adding Realm = "test.com" rlm_realm: Preparing to proxy authentication request to realm "test.com" <SNIP> Sending Access-Request of id 0 to 10.19.3.8:1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 123 Proxy-State = 0x323239 Great! Now I try it with "test(a)test2.com": rad_recv: Access-Request packet from host 127.0.0.1:53482, id=7, length=66 User-Name = "test(a)test2.com" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 123 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: Looking up realm "test2.com" for User-Name = "test(a)test2.com" rlm_realm: Found realm "test2.com" rlm_realm: Adding Stripped-User-Name = "test" rlm_realm: Proxying request from user test to realm test2.com rlm_realm: Adding Realm = "test2.com" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 Why would it make the Authentication realm LOCAL? If I move the realm test2.com above test.com in proxy.conf then test2.com works & test.com doesn't. Can someone point me in the right direction? I've read included doc/proxy, proxy.conf & the online wiki sections on proxy. It seems so simple, yet I can't seem to figure it out! Thanks in advance. -dallas

6 8