- Freeradius-Users - lists.freeradius.org

Help to by a NAS
by Leonardo Mártyres 13 Mar '09

13 Mar '09

Hi, Could someone suggest some NAS models to buy? I want to do account properly. Thanks _________________________________________________________________ Show them the way! Add maps and directions to your party invites. http://www.microsoft.com/windows/windowslive/products/events.aspx

1 0

Re: Error in Authentication
by Jaswinder Kaur 12 Mar '09

12 Mar '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 My problem is that, I am not able to figure out, what wrong am I doing ? I shall be highly thankful, if you can point me what part of config I need to change? Many Thanks, JK Jaswinder Kaur wrote: > I am using freeradius 2.1.1 on Suse 10 SP1. I am trying to integrate Freeradius with edirectory, but somehow, I am not able to achieve the desired result, the client just sits while trying to authenticate, I can see the Radius server reading the username and password, but still its not authenticating it. > > Kindly Help. I am attaching the debug from radius server here: This is explained in the FAQ, and in the comments in eap.conf. Please read the existing documentation. Alan DeKok. -----BEGIN PGP SIGNATURE----- Version: PGP Universal 2.9.0 (Build 472) Charset: US-ASCII wsBVAwUBSblWe/svZpRjP72bAQgOaAf/Y0B9kpfry1PKnyQoxCM3iyEY38vgfaky 8G/IjsL0YnnXyEyWjbCZcWqUys2d+bpN6YKa+/mWmUDME+HMcS5QXJewHDSvRH9J ONWElOOl8BKasoU4Xs7kbjJZXGRdHIJjWiCMxuxl1XP5DaXOTEwE9vgMGmZKd88f YwOBmyrzVb7ohAYKgvOp40W49By1ZB+QLdq78uMmviYn9di61i5iORyoUCEHvAGs 18y0/4ewF+jmBYXSD0vrdrXxUSfUbxVpE7/DUG35lBwqQzxEKAdOMBxiZ8D+Sx4W NTLBoxoIdUD2i4DnaEi7f7PY0XaA/z024fmOpsme5oN92K9xffJWPg== =+pcE -----END PGP SIGNATURE----- Access your county council services online 24 hours a day, 7 days a week at www.northyorks.gov.uk. WARNING Any opinions or statements expressed in this e-mail are those of the individual and not necessarily those of North Yorkshire County Council. This e-mail and any files transmitted with it are confidential and solely for the use of the intended recipient. If you receive this in error, please do not disclose any information to anyone, notify the sender at the above address and then destroy all copies. North Yorkshire County Council�s computer systems and communications may be monitored to ensure effective operation of the system and for other lawful purposes. Although we have endeavoured to ensure that this e-mail and any attachments are free from any virus we would advise you to take any necessary steps to ensure that they are actually virus free. If you receive an �out of office� notice from the person you are contacting and you wish to request information under either the Freedom of Information Act, the Data Protection Act or the Environmental Information Regulations please forward your request by e-mail to the Data Management Team (datamanagement.officer(a)northyorks.gov.uk) who will process your request. North Yorkshire County Council.

2 1

Huntgroups and Network of Clients
by HRZ Konten 12 Mar '09

12 Mar '09

Hi all, I use Freeradius 1.1.7 (yes, sorry I know it is a little bit old but there is no time to upgrade :( I want that the requests from some servers are checked and authenticated through LDAP-Groups for example Requests from IP x.x.x.x should be authenticate only if the user is in ldap-group employee, tha same for IP y.y.y.y . Then I have some other servers with requests that don't need LDAP authorisation. I used the Huntgroups to define the first two servers als huntgroup "testldap" and the rest as huntgroup "all". That functions great for IP Addresses. The list ist long, but still ok. Only if I want to do that for network of clients this doesn't work. The problem is that I must list all of the servers that should gain access and I have a lot of PC-Pools which use radius to authenticate. In the client.conf they are written with the network addresses, that doesn't work in huntgroups file. I don't want to list all of the PC-Pool members in the Huntgroups because there are too many... Does Huntgroup support only IP-Addresses or I can fill up Network Addresses too? Or there is another workaround? Or maybe this issue is already changed in the new version 2.3.1? users -------- DEFAULT Huntgroup-Name==testldap, Ldap-Group == employee, Auth-Type := Pam Fall-Through = no DEFAULT Huntgroup-Name==all, Auth-Type := Pam Fall-Through = no DEFAULT Auth-Type := Reject Reply-Message = "Please call the helpdesk." huntgroups ----------------- #Test LDAP testldap NAS-IP-Address == x.x.x.x testldap NAS-IP-Address == y.y.y.y #All Users all NAS-IP-Address == a.a.a.a .... all NAS-IP-Address == z.z.z.z/26 Greets, Meyes

2 5

Winbind errors
by Mike Diggins 12 Mar '09

12 Mar '09

Freeradius 2.1.3 winbindd version 3.0.33-3.7.el5 RedHat Linux 5, release 2 fully patched I know this isn't a FreeRadius issue, but is related. Has anyone running FreeRadius with Winbindd for windows authentication, found a solution to these error messages in the samba.log? [root@prad01 log]# tail samba.log [2009/03/12 09:28:33, 0] lib/util_sid.c:string_to_sid(242) string_to_sid: Sid S-0-0 is not in a valid format. [2009/03/12 09:33:33, 0] lib/util_sid.c:string_to_sid(242) string_to_sid: Sid S-0-0 is not in a valid format. [2009/03/12 09:33:33, 0] lib/util_sid.c:string_to_sid(242) string_to_sid: Sid S-0-0 is not in a valid format. [2009/03/12 09:38:35, 0] lib/util_sid.c:string_to_sid(242) string_to_sid: Sid S-0-0 is not in a valid format. I get several a minute. I've found many posts with the same complaint, but no solution. Is upgrading (or downgrading) likely to stop it? It seems to be a purely cosmetic issue, but I'd still like to find a solution. -Mike

1 0

How to allow nas'es to serve only groups of clients?
by Alexander Yu. Solodukhin 12 Mar '09

12 Mar '09

Hi. I have two types of nases: 1) hotspots 2) vpn servers. I need vpn nases authorize only vpn users and hotspot nases authorize only hotspot users. How can i divide users into several groups and reject vpn accounts to login through hotspot and vice versa? I think i must use huntgroups and unlang, but not cleanly understand how. -- ISP CrIS, Softwarium

5 9

Re: Re: No accounting Freeradius + EAP/PEAP/TLS
by Leonardo Mártyres 12 Mar '09

12 Mar '09

------------------------------ > > Message: 7 > Date: Thu, 12 Mar 2009 12:17:56 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > Subject: Re: Re: No accounting Freeradius + EAP/PEAP/TLS > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20090312121756.GD28045(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > The Zinwell manual didn't say anything about enabling account. My Freeradius is configured with default values, only things I changed was to use EAP/PEAP and freeradius, at radius database I configured tables NAS, Usergroup, radcheck ang groupreply(Auth-Type:=EAP). > > if it doesnt mention it, how do you know it can do it? > > you're only real choice is to sniff ALL the traffic on the wire > from the zinwell and see what the heck its sending. if it doesnt > send any accounting then theres nothing magical that FreeRADIUS > (or any other RADIUS server) can do - as the RADIUS server > doesnt tell the NAS to 'oi, send me stuff!' - the NAS is configured > to do accounting and then where to send it. if its good, the NAS > sends accounting packets as per the RFCs.....but from personal > experience 90% of devices out there break accounting in wierd > and wonderful ways..be it cisco, hp, 3com, zyxel, hauwei etc. Could you dive me Model? ex: DWL-2100ap... etc. Thanks > > once you DO get accounting packets to the RADIUS server, then thats > when the real fun begins! ("oh, but i wanted unique per client > sessions that could be matched to the real user!" argggh! ;-) ) > > alan _________________________________________________________________ Drag n’ drop—Get easy photo sharing with Windows Live™ Photos. http://www.microsoft.com/windows/windowslive/products/photos.aspx

1 0

Re: Re: No accounting Freeradius + EAP/PEAP/TLS
by Leonardo Mártyres 12 Mar '09

12 Mar '09

Hi Ivan, The Zinwell manual didn't say anything about enabling account. My Freeradius is configured with default values, only things I changed was to use EAP/PEAP and freeradius, at radius database I configured tables NAS, Usergroup, radcheck ang groupreply(Auth-Type:=EAP). Could you tell me thar have to be another think at GroupReply and suggest some nas devices? Thanks. > Date: Thu, 12 Mar 2009 00:11:44 +0100 > From: <tnt(a)kalik.net> > Subject: Re: Re: No accounting Freeradius + EAP/PEAP/TLS > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <9kef2EDk.1236813104.0870720.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > >I used wireshark and didn't see anything referred about Account Packages. Only thing I see is Radius-Access Resquest, Access Challenges and Access Accept. > > > > So read Zinwell documentation about enabling accounting. > > Ivan Kalik > Kalik Informatika ISP _________________________________________________________________ News, entertainment and everything you care about at Live.com. Get it now! http://www.live.com/getstarted.aspx

4 3

Version 2.1.4 has been released
by Alan DeKok 12 Mar '09

12 Mar '09

This version comes 3 months after 2.1.3, which is a bit more of a delay than we would like. However, it includes a number of minor bug fixes, and some interesting new features. The best new feature is one that has been needed for a long time. The (easy) ability to see debugging output from a "live" server. You can now do this via the "raddebug" command. FreeRADIUS 2.1.4 Thu Dec 25 17:40:00 CEST 2008; , urgency=medium Feature improvements * Permit multiple "-e" in radmin. * Add support for originating CoA-Request and Disconnect-Request. See raddb/sites-available/originate-coa. * Added "lifetime" and "max_queries" to raddb/sql.conf. This helps address the problem of hung SQL sockets. * Allow packets to be injected via radmin. See "inject help" in radmin. * Answer VMPS reconfirmation request. Patch from Hermann Lauer. * Sample logrotate script in scripts/logrotate.freeradius * Add configurable poll interval for "detail" listeners * New "raddebug" command. This prints debugging information from a running server. See "man raddebug. * Add "require_message_authenticator" configuration to home_server configuration. This makes the server add Message-Authenticator to all outgoing Access-Request packets. * Added smsotp module, as contributed by Siemens. * Enabled the administration socket in the default install. See raddb/sites-available/control-socket, and "man radmin" * Handle duplicate clients, such as with replicated or load-balanced SQL servers and "readclients = yes" Bug fixes * Clean up control sockets when they are closed, so that we don't leak memory. * Define SUN_LEN for systems that don't have it. * Correct some boundary conditions in the conditional checker ("if") in "unlang". Bug noted by Arran Cudbard-Bell. * Work around minor building issues in gmake. This should only have affected developers. * Change how we manage unprivileged user/group, so that we do not create control sockets owned by root. * Fixed more minor issues found by Coverity. * Allow raddb/certs/bootstrap to run when there is no "make" command installed. * In radiusd.conf, run_dir depends on the name of the program, and isn't hard-coded to "..../radiusd" * Check for EOF in more places in the "detail" file reader. * Added Freeswitch dictionary. * Chop ethernet frames in VMPS, rather than droppping packets. * Fix EAP-TLS bug. Patch from Arnaud Ebalard * Don't lose string for regex-compares in the "users" file. * Expose more functions in rlm_sql to rlm_sqlippool, which helps on systems where RTLD_GLOBAL is off. * Fix typos in MySQL schemas for ippools. * Remove macro that was causing build issues on some platforms. * Fixed issues with dead home servers. Bug noted by Chris Moules. * Fixed "access after free" with some dynamic clients.

10 25

Running an external script
by Jonathan Gazeley 12 Mar '09

12 Mar '09

In my my inner-tunnel virtual server, authorize section, I have some code like this, for sorting users into vlans: update control { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := `/usr/local/etc/raddb/scripts/userVlan.pl %{User-Name} 2>/dev/null` } update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := `/usr/local/etc/raddb/scripts/userVlan.pl %{User-Name} 2>/dev/null` } This was put together in a hurry and is pretty undesirable, as the perl script (which queries a slow database) is executed twice. Of course in any other language, one would simply save the return value of the script in a variable and reference it twice - but quoting "man unlang": " Note that unlike C, there is no way to declare variables". So is there a way to store the return value such that I can execute the script only once? Or how about something like: update control { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := `/usr/local/etc/raddb/scripts/userVlan.pl %{User-Name} 2>/dev/null` } update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := %{control.Tunnel-Private-Group-Id} } Cheers, Jonathan ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team Information Services University of Bristol ----------------------------

3 3

Config. Help please - ldap and Active Directory
by Leighton Man 12 Mar '09

12 Mar '09

Hi, I'm new to freeradius (3 weeks experience) and mailing lists (second attempt) so please have patience. I have freeradius 1.1.7 (prebuilt package) on Solaris 10 configured to authenticate against Active Directory using ntlm-auth. All working OK. Now I'm trying to return different reply attributes depending on Active Directory group membership and restrict which groups can authenticate. Ldap lookups against the active directory root fail with operation error. Reconfiguring Active Directory is not a viable option so I have to specify an OU=xxxx in the query. I have configured two instances of the ldap module for authorisation, one to query the staff ou and the other to query the student ou. Both work OK for valid queries but if the user does not exist in the ou the server still authenticates the username/password and grants access if valid. Relevant debug output: rlm_ldap: performing search in ou=students, dc=ad, dc=hud, dc=ac, dc=uk, with filter (sAMAccountName=stafftest) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_student" returns notfound for request 8 modcall: leaving group student (returns notfound) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list ............................... rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 8 modcall: leaving group authenticate (returns ok) for request 8 Sending Access-Accept of id 104 to 10.127.240.217 port 1645 Relevant bits of radiusd.conf: ldap ldap_student{ server = "server.hud.ac.uk" identity = "cn=user,ou=Specials,ou=Staff,dc=ad,dc=hud,dc=ac,dc=uk" password = secret port = 636 basedn = "ou=students, dc=ad, dc=hud, dc=ac, dc=uk" filter = "(sAMAccountName=%{mschap:User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 } ........................................ instantiate { exec expr ldap_staff ldap_student } authorize { preprocess mschap suffix eap Autz-Type staff{ ldap_staff } Autz-Type student{ ldap_student } files } authenticate { Auth-Type MS-CHAP { mschap } eap } I want to reject the user if they are not in the relevant ou. I must be missing something obvious. Can anyone help please? Thanks in advance, Leighton

4 17