- Freeradius-Users - lists.freeradius.org

Logging the return code from the ldap authentication to SQL.
by Augusto G. Andreollo 23 Mar '09

23 Mar '09

Hello all. I have the need to log the return code from the LDAP authentication to our database (I'm adding it to the postauth table scheme). I've already modified the database scheme (ok), the attribute map, to create a new attribute called "reason" (ok) and the insert queries (ok). All of this is working fine, including the complete authentication, all the way thru Access-Accept and Accounting. My problem now is getting the return code into the variable, according to the LDAP module results. I've made two attempts so far, and neither gave me too much success: First, with a series of IFs and ELSIFs: authenticate { Auth-Type LDAP { redundant { ldap1 ldap2 } if (rejected) { update control { reason = "rejected" } } elsif (fail) { update control { reason = "fail" } } elsif (notfound) { update control { reason = "not found" } } elsif (ok) { update control { reason = "ok" } } else { update control { reason = "ERROR" } } } } Which gives: rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful [ldap1] user user@university authenticated succesfully +++[ldap1] returns ok ++- policy redundant returns ok ++? if (rejected) ? Evaluating (rejected) -> TRUE ++? if (rejected) -> TRUE ++- entering if (rejected) {...} +++[control] returns ok ++- if (rejected) returns ok ++ ... skipping elsif for request 0: Preceding "if" was taken ++ ... skipping elsif for request 0: Preceding "if" was taken ++ ... skipping elsif for request 0: Preceding "if" was taken ++ ... skipping else for request 0: Preceding "if" was taken +- entering group post-auth {...} (and then it goes on to successfuly add the string "rejected" to the database. Again, that part is working smoothly). My second attempt was with a switch statement, as follows: authenticate { Auth-Type LDAP { redundant { ldap1 ldap2 } switch "%{control:rcode}" { case ok { update control { reason = "ok" } } case rejected { update control { reason = "rejected" } } case notfound { update control { reason = "notfound" } } case fail { update control { reason = "fail" } } case { update control { reason = "ERROR" } } } } } Which gives me the following (Again, I've skipped what I believe to be unneeded): rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful [ldap1] user user(a)university.com authenticated succesfully +++[ldap1] returns ok ++- policy redundant returns ok expand: %{control:rcode} -> ++- entering switch %{control:rcode} {...} +++- entering case {...} ++++[control] returns ok +++- case returns ok ++- switch %{control:rcode} returns ok +- entering group post-auth {...} And then goes to successfully write "ERROR" the database. (to save room, i've already tried encasing the case options in quotes, as 'rejected', 'ok', etc.. that gives me the exact same results. So does putting it on double quotes, as "ok", "rejected", etc..) So, any ideas? btw: $ radiusd -v radiusd: FreeRADIUS Version 2.1.3, for host i386-portbld-freebsd7.0, built on Jan 9 2009 at 07:02:31 -- Augusto G. Andreollo CCUEC/DCNET/SREDE Universidade Estadual de Campinas - UNICAMP +55 19 3521-2276 -- "Wit beyond measure is men's greatest treasure."

4 8

FreeRadius, PostgreSQL and DaloRadius
by Sunday Olutayo 23 Mar '09

23 Mar '09

Login attempt after setup result in error. Please what do I do wrong? Database connection error Error Message: DB Error: not found Debug: Unable to include the DB/postgresql.php file for 'postgresql://radius:radpass@127.0.0.1/radius' Sunday

2 1

Correct operator in radcheck
by Santiago Balaguer García 23 Mar '09

23 Mar '09

Hi, I am several years working woth freeradius, bit recently I surgeg me a question: I do not want that johndoe account never connect from NASES with Client IP: * 195.56.53.23 * 96.53.26.59 * 56.15.86.35 * 56.15.86.36 I know I have to use the attribute Client-IP-Address, so radckech will content: username attribute op value ------------------------------------------------ johndoe Cleartext-Password := mypassword johndoe Client-IP-Address ?? 195.56.53.23 johndoe Client-IP-Address ?? 96.53.26.59 johndoe Client-IP-Address ?? 56.15.86.35 johndoe Client-IP-Address ?? 56.15.86.36 What is the correct op that I have to write? Thank you!! _________________________________________________________________ Descubre todas las formas en que puedes estar en contacto con amigos y familiares. http://www.microsoft.com/windows/windowslive/default.aspx

2 1

Help checking group membership with FreeRadius
by Josh Hiner 23 Mar '09

23 Mar '09

Currently we have a radius server that performs authentication off our samba domain controller for wireless users. This works great. I would like to limit users so they must be a member of the wireless group in order to connect. Since the /etc/group file is on a different server I believe I cannot use the etc_group module. Also, in order to use that module the user must have a valid account on the radius server as well. Any ideas on checking group membership? I use ntlm_auth in the mschap module for authentication in Freeradius ver 2.1.3-1. Here is the string in the users file to limit to the wireless group (its all on one line, email may wrap it): DEFAULT Called-Station-Id =~ "CCISD-REMC1", Group != "wireless", Auth-Type := Reject here is my ntlm_auth line: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=ISD --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" thanks for any help =D *** This Email was sent by a system administrator in REMC #1.

1 0

fake user and unregistered user forwarding
by Ümit AYDINLI(Teknotel) 23 Mar '09

23 Mar '09

Hi, Sory for bad English. Are we forward fake user and unregistered users to fake ip or redirect page. We are using freeradius on platform freebsd, databse server on postgresql. That is possible? Regards.

3 2

Reply with group attribute
by Markus Wernig 23 Mar '09

23 Mar '09

Hello all I'm terribly new to RADIUS, so please excuse my ignorance. What I'm looking for (and can't find in neither man nor wiki nor google) is how to send back the group an authenticated user is in together with the authentication result. I have a VPN gateway that authenticates users against freeradius, using the unix authentication scheme (the users are all real unix users on the freeradius server). All ok, works a charme. Now we have the requirement to apply different security settings to different user groups. The user groups are the unix groups the different users are in on the freeradius server. So I need the radius server to return the user's group information together with the Access-Accept. I'm sorry but for the life of me I can't find any information on how this is done. Could somebody please point me to the right direction? Thanks /markus

5 20

freeRaidus-PAM:: user password issue - Urgent help required
by krishna Mohan 23 Mar '09

23 Mar '09

Hi,I configured my FR server with PAM.When tried with radclient from localhost (where is FR is installed), user password is displaying in clear text; but when trying to authenticate the same user over network  (using ntradping), user password is showing in "unprintable chars". Following are my configs:radiusd.conf:------------1) pam {                #                #  The name to use for PAM authentication.                #  PAM looks in /etc/pam.d/${pam_auth_name}                #  for it's configuration.  See 'redhat/radiusd-pam'                #  for a sample PAM configurat! ion file.                #                #  Note that any Pam-Auth attribute set in the 'authorize'                #  section will over-ride this one.                #                pam_auth = radiusd        }2)  authenticate {     .......    pam ......   }clients.conf file:---------------client 127.0.0.1 {                secret          = testing123       &n! bsp;        shortname  &n bsp;    = localhost} client  192.168.100.192 {        secret          = testing123        shortname       = private-network-2}users file:----------John90                  Auth-Type = "Pam"                        Reply-Message = "Hello Welcome to Radius, %u"Following is the radius -X o/p:------------------------------rad_recv: Access-Request packet from host 192.168.200.196:4892, id=7, length=46        User-Name = "John90"        User-Password = "i\335T\334\227z\037\345?!<\014\024\220!\205" Processing the authorize section of radiusd.confmod! call: entering group authorize for request 1  modcall[authorize]: module "preprocess" returns ok for request 1  modcall[authorize]: module "chap" returns noop for request 1  modcall[authorize]: module "mschap" returns noop for request 1    rlm_realm: No '@' in User-Name = "John90", looking up realm NULL    rlm_realm: No such realm "NULL"  modcall[authorize]: module "suffix" returns noop for request 1  rlm_eap: No EAP-Message, not doing EAP  modcall[authorize]: module "eap" returns noop for request 1  modcall[authorize]: module "files" returns notfound for request 1rlm_pap: WARNING! No "known good" password found for the user.  Authentication may fail because of this.  modcall[authorize]: module "pap" returns noop for request 1modcall: leaving group authorize (returns ok) for request 1auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the userauth: Failed to valida! te the user.  WARNING: Unprintable characters in the password. ?& nbsp; Double-check the shared secret on the server and the NAS!Delaying request 1 for 1 secondsFinished request 1Going to the next request.......Verified the shared secret and it is given correctly in the request.Is there any configuration need to be done?Appreciate your help.Thanks,Sri

2 1

trying to use Post-Auth-Type REJECT to insert users
by Dave Sinclair 21 Mar '09

21 Mar '09

Hi, The high level goal is to have a new radius server "slurp" all the users on a DSL ATM aggregation link into a SQL database. We are taking over a bunch of users from a defunct ISP and don't have the UserName / Password data. What I'm thinking is that there should be a way to have Post-Auth-Type REJECT do two SQL insert commands. Then when the user tries to auth again there will be a valid user. Will this work ?? How to have two SQL statements run when this event is triggered??? Is there a better way ?? mucho thanks.;

4 4

How do I make FreeRadius,DaloRadius use PostgreSQL
by Sunday Olutayo 21 Mar '09

21 Mar '09

Please any help or resources on this? Sunday

2 1

Session-Timeout for disconnecting user
by Chris Li 21 Mar '09

21 Mar '09

Hi all, I am using Freeradius 2.1.3 to authenticate my users from AP via Active Directory. I have defined the time span that all users may login to the system in the users file: DEFAULT Login-Time := "Wk0630-0130,Wk1020-1033,Wk1240-1351,Wk1555-2359,Sa,Su" The logintime module calculates the number of seconds left in the time span, and sets the Session-Timeout to that number of seconds. How can i include Session-Timeout in the Access-Accept packet? Best Regards, Chris

2 1