- Freeradius-Users - lists.freeradius.org

LDAP integrations
by Martin MacLeod-Brown 16 Oct '08

16 Oct '08

Hi Everyone I have installed the latest version of Free Radius onto an Ubuntu server, and was hoping that someone can help me with the steps to get it to authenticate users against our LDAP server Are there any good HOW-TOs out there on the best way to do this? Im finding everything as bit confusing and could do with an outline of the steps to take, or files I need to edit. So far from googling Edit the LDAP section of radius.conf - done, I think! Edit the dictionary file? Edit users file? Any help appreciated Martin Martin Macleod-Brown | Infrastructure Engineer - Networks & Security Infrastructure Team London Business School | Regent's Park | London NW1 4SA | United Kingdom Switchboard +44 (0)20 7000 7000 | Direct line +44 (0)20 7000 7772 | Mobile +44 (0)796 690 7772 | Email mmacleod(a)london.edu <mailto:mmacleod@london.edu> www.london.edu <http://www.london.edu> | London experience. World impact. Please consider the environment before printing this email ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System on behalf of the London Business School community. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

4 3

I'm stuck; FreeRadius and Heimdal Kerberos
by Ronni Feldt 16 Oct '08

16 Oct '08

Hi, I am trying to get FreeRadius to work with Heimdal Kerberos. What I use: Ubuntu 8.04 FreeRadius 1.1.7-1build4 Heimdal-kdc 1.0.1-5ubuntu4 I have installed Heimdal Kerberos and get tickets. My next step is to get FreeRadius to work with Heimdal and then logging in to my HP-Switch using FreeRadius. I have done the following: # Heimdal Kerberos information REALM = ONE.COM HOST = rofe # In Heimdal Kerberos kadmin -l kadmin> add radius kadmin> ext_keytab --keytab=/etc/krb5.keytab radius kadmin> add rofe # Installing FreeRadius apt-get install freeradius freeradius-krb5 # Added the following in /etc/freeradius/radiusd.conf # In the authenticate section Auth-Type Kerberos { krb5 } # In the modules section krb5 { # keytab containing the key used by rlm_krb5 keytab = /etc/krb5.keytab # principal that is used by rlm_krb5 service_principal = radius/rofe.one.com } I have followed what documentation I could find; http://wiki.freeradius.org/Rlm_krb5 # Then I configured my HP-Switch: radius-server host 192.168.212.93 radius-server key <key> # As key I used the principal radius password - correct ? aaa authentication ssh login radius local aaa authentication ssh enable radius local aaa authentication telnet login radius local aaa authentication telnet enable radius local aaa authentication login privilege-mode # Then I tried to login using telnet telnet 192.168.212.4 # Gets prompted for username and password and uses principal rofe and my password but gets this error: Can't reach RADIUS server 192.168.212.93 I can ping 192.168.212.4 from the HP-Switch. I don't know what to do or where to look - I'm stuck! - Ronni

2 4

Re: freeradius 2.1.1 with ubuntu server 8.04
by piston 16 Oct '08

16 Oct '08

Hi All Update, i found this error message under freeradius-server-2.1.1/debian/patches/01-radiusd-to-freeradius.dpatch patching file Make.inc.in Hunk #1 succeeded at 48 with fuzz 1. patching file raddb/radiusd.conf.in Hunk #1 succeeded at 66 with fuzz 2 (offset 33 lines). Hunk #2 FAILED at 128. Hunk #3 FAILED at 154. 2 out of 3 hunks FAILED -- saving rejects to file raddb/radiusd.conf.in.rej Thanks ----- Original Message ---- From: piston <pistonic(a)yahoo.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, October 16, 2008 7:06:45 PM Subject: freeradius 2.1.1 with ubuntu server 8.04 Hi All I'm trying to building package, so how i got error during the process. I have no problem to build freeradius 2.1.0 package at this pc. Please assist. Below are the logs dpkg-buildpackage -b -uc dpkg-buildpackage: set CPPFLAGS to default value: dpkg-buildpackage: set CFLAGS to default value: -g -O2 dpkg-buildpackage: set CXXFLAGS to default value: -g -O2 dpkg-buildpackage: set FFLAGS to default value: -g -O2 dpkg-buildpackage: set LDFLAGS to default value: -Wl,-Bsymbolic-functions dpkg-buildpackage: source package freeradius dpkg-buildpackage: source version 2.1.1-0 dpkg-buildpackage: source changed by Alan DeKok <aland(a)freeradius.org> dpkg-buildpackage: host architecture i386 debian/rules clean dpatch deapply-all 02-dialupadmin-help not applied to ./ . attempting to revert failed patch 01-radiusd-to-freeradius from ./: md5sums match, proceeding ... done (neither success nor failure guaranteed) rm -rf patch-stamp patch-stampT debian/patched dh_testdir dh_clean rm -f build-arch-stamp build-indep-stamp libltdl/stamp-h1 rm -f install-arch-stamp install-indep-stamp configure-stamp [ -f Make.inc ] && make distclean || true # The make clean forgets to remove this build directory [ -d src/modules/lib ] && rm -fr src/modules/lib || true # Put the original autotools files back in place [ -f config.sub.dist ] && rm config.sub && mv config.sub.dist config.sub || true [ -f config.guess.dist ] && rm config.guess && mv config.guess.dist config.guess || true debian/rules build test -d debian/patched || install -d debian/patched dpatch apply-all applying patch 01-radiusd-to-freeradius to ./ ... failed. make: *** [patch-stamp] Error 1 dpkg-buildpackage: failure: debian/rules build gave error exit status 2 Thank you. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Syslog?
by Phillip Heller 16 Oct '08

16 Oct '08

Hello, Running FreeRadius 2.0.5, with the following log related config: logdir = syslog log { log_destination = syslog syslog_facility = local7 stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } I've found lots of conflicting info among the wiki, documentation, and list suggesting different statements (log_destination=, destination=), and perhaps outside of log{}. I did look at the code, and it looks to me as if log_destination is the proper statement. Regardless of what I try (and I have tried both destination= and log_destination=, both inside and outside of log{}), the server does not show it as a parsed command when I fire up attached with debugging: [root@h36laa001:/etc/raddb]% radiusd -X -f FreeRADIUS Version 2.0.5, for host x86_64-redhat-linux-gnu, built on Aug 14 2008 at 23:20:24 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/clients.conf group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "syslog" libdir = "/usr/lib64" radacctdir = "syslog/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } } I'm sure I'm just missing something simple. Any ideas? --phil

4 5

turn off accounting for specific group
by Marinko Tarlac 15 Oct '08

15 Oct '08

Hi I want to ignore accounting inform. for some user groups and to insert them into database for another groups. What is the best way to do this ? Thanks

2 1

Number of Clients
by Bernhard Miklautz 15 Oct '08

15 Oct '08

Hi there, I'm graphing the stats of the configured clients we have. Currently I use something like <snip> echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 35, FreeRADIUS-Stats-Client-Number = 21" | radclient 127.0.0.1:18120 status veryverysecret </snip> to retrive them.That works out fine. What I now miss is a way to actually get a list of clients, either the number (Stats-Client-Number), or even better a list of ips. Is it somehow possible to also get the number of clients via the server status? Or is there another possibility, besides parsing the config file. Thanks in advance, Bernhard

3 7

EAP-TTLS with LDAP and KRB5?
by Jonathan D. Proulx 15 Oct '08

15 Oct '08

Hi all, using 1.1.7 (forgive me) I have EAP-TTLS working from the files module and I have krb5 athentication working with ldap authorization fro radtest, but when I try EAP-TTLS as an ldap user I fail to connect, and the sever never seems to try the krb5 module. Before I start pulling my hair out is even possible? http://lists.cistron.nl/pipermail/freeradius-users/2006-March/msg00055.html seems to suggest it is but my searches aren't turning up much specifics... Thanks, -Jon

2 2

Testing WAP EAP from wired network?
by Jonathan D. Proulx 15 Oct '08

15 Oct '08

Hi All, This is probably a pipe dream, but... I'm desperately trying to get a WPA2 wireless system up at a remote site, I'm not using EAP-MD5 so radeapclient can't help me. At last test radclient authenticates and authorizes the way I want but EAP from an actual wireless supplicant fails. I have some input on what I might do to fix this but given the "remote" bit I can't test it as readily as I'd like. My question is if I set up 802.1x on a wired port (with a multi homed host so I can get to it through the back door as it were), would this be a valid test or do I just need to wait untill I can make a (relatively short) trip on site? I'm not clear on how the wired and wireless versions differ. Thanks, -Jon

3 3

Filter-Id SQL xlat function
by Ljupco Vangelski 15 Oct '08

15 Oct '08

Hi I want FreeRADIUS to return the Filter-Id attribute, on behalf of a service of the client which is in another table (not in radreply or radgroupreply). The idea is to have a different Filter-Id depending on the region the client is connecting to (which means depending on the CallingStation-Id parameter). So I have a separate table in which CallingStation-Ids and Filter-Ids are mapped. For example: mysql> select service from userinfo where username='ljupco' limit 1; +---------+ | service | +---------+ | net1 | +---------+ Now if I put that query in the Filter-Id, the XLAT function doesn't get executed: ==In radreply===================================== UserName......Attribute..........op.........Value ljupco............Filter-Id.............=.........%{sql:select service from userinfo where username='ljupco' limit 1;} ============================================== # radtest ljupco ljupco localhost 523 testing123 Sending Access-Request of id 201 to 127.0.0.1 port 1812 User-Name = "ljupco" User-Password = "ljupco" NAS-IP-Address = 255.255.255.255 NAS-Port = 523 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=201, length=89 Filter-Id = "%{sql:select service from userinfo where username='ljupco' limit 1;}" Instead of "%{sql:select service from userinfo where username='ljupco' limit 1;}" there should be net1. How can I do this? Output from radiusd -X (freeradius v1.1.6) rad_recv: Access-Request packet from host 127.0.0.1:59998, id=201, length=58 User-Name = "ljupco" User-Password = "ljupco" NAS-IP-Address = 255.255.255.255 NAS-Port = 523 rad_lowerpair: User-Name now 'ljupco' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "ljupco", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 7 radius_xlat: 'ljupco' rlm_sql (sql): sql_set_user escaped user --> 'ljupco' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'ljupco' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'ljupco' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'ljupco' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'ljupco' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 7 modcall[authorize]: module "pap" returns updated for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 7 rlm_pap: login attempt with password ljupco rlm_pap: Using clear text password "ljupco". rlm_pap: User authenticated successfully modcall[authenticate]: module "pap" returns ok for request 7 modcall: leaving group PAP (returns ok) for request 7 Login OK: [ljupco/ljupco] (from client localhost port 523) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 7 rlm_sql (sql): Processing sql_postauth radius_xlat: 'ljupco' rlm_sql (sql): sql_set_user escaped user --> 'ljupco' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'ljupco', 'ljupco', 'Access-Accept', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'ljupco', 'ljupco', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 modcall[post-auth]: module "sql" returns ok for request 7 modcall: leaving group post-auth (returns ok) for request 7 Sending Access-Accept of id 201 to 127.0.0.1 port 59998 Filter-Id = "%{sql:select service from userinfo where username='ljupco' limit 1}" Finished request 7 Going to the next request Tried as well with freeradius v2.0.5, the result is the same. Regards, -- Ljupco

2 2

redundant + load balancing not working?
by ST Wong (ITSC) 15 Oct '08

15 Oct '08

Hi all, I'm using freeradius 2.1.1 on CentOS 5.2. I've 2 ldap servers for authentication. It works when I specify: redundant { ldap1 ldap2 } As expected, requests go to ldap2 when ldap1 is down. However, when I specify the 2 ldap servers like following: redundant-load-balance { ldap1 ldap2 } The effect is just like redundant. All requests go still go to ldap1 instead of load balancing. Did I miss anything? Thanks a lot. /ST Wong

2 1