- Freeradius-Users - lists.freeradius.org

Re: Seek through several RADIUS severs without realms
by Ronen Kfir 05 Aug '08

05 Aug '08

> Unfortunately I lost the previous message of this thread, where Alan > Dekok's respond is presented. > Anyway, the content of it was he offered to use groups membership. He > also gave a specific file: rlm_passwd which should be configured in > order to achieve groups membership as an indication which IAS server > would respond each authentication request. No. You configure groups on the FREERADIUS server. > The thing is, though went over the help file of rlm_passwd a couple of > times, I didn't see clear explanation how to configure it when working > in IAS-Active Directory environment. If you're using IAS and not FreeRADIUS, don't ask questions here. If you're using FreeRADIUS a proxy to IAS, you can configure groups on FreeRADIUS, and apply policies there. Alan DeKok. Ronen Kfir: I would like to use FreeRADIUS as proxy to IAS servers. The question now is how do I create those FreeRADIUS groups and how do I manage the groups membership within FreeRADIUS.

1 0

simultaneous-use check via sql
by Oguzhan Kayhan 05 Aug '08

05 Aug '08

Hello I am trying to run Simultaneous-Use parameter on freeradius 2.0.5 which i have 2 virtual servers on. There can be same usernames on both virtual servers, so im not sure about how it works but i prefer to use sql instead of radutmp file for simultaneous check. Anyway, I added the following lines to users file as it is said /usr/share/doc/freeradius/Simultaneous-Use file. DEFAULT Simultaneous-Use := 0 Fall-Through = 1 I made the value 0 for testing purposes.. But no success.It still authenticates the user without any sim. check parameter. And I also wonder where did the Simul.Use queries in sql.conf in 1.1.7 version dissapeared? My virtual server config as follows..: server dormnet { authorize { preprocess files sql_dormnet } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } accounting { unix radutmp sql_dormnet } session { radutmp sql_dormnet } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } }

3 5

radacct insert issue.
by S Adrian 05 Aug '08

05 Aug '08

Ok, thanks, I got the latest git .. and I get this upon compilation :| gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -DEAPLIB -I. -I.. -I/root/radiusd/src -DOPENSSL_NO_KRB5 -c eap_tls.c -o eap_tls.o >/dev/null 2>&1 /usr/bin/libtool --mode=link gcc -release 2.0.6 \ -export-dynamic -o libfreeradius-eap.la -rpath /usr/local/lib eapcommon.lo eapcrypto.lo eapsimlib.lo fips186prf.lo cb.lo eap_tls.lo mppe_keys.lo tls.lo \ /root/radiusd/src/lib/libfreeradius-radius.la -lnsl -lresolv -lpthread libtool: link: `eapcommon.lo' is not a valid libtool object gmake[7]: *** [libfreeradius-eap.la] Error 1 gmake[7]: Leaving directory `/root/radiusd/src/modules/rlm_eap/libeap' gmake[6]: *** [common] Error 2 /usr/bin/libtool --mode=link gcc -release 2.0.6 \ -export-dynamic -o libfreeradius-eap.la -rpath /usr/local/lib eapcommon.lo eapcrypto.lo eapsimlib.lo fips186prf.lo cb.lo eap_tls.lo mppe_keys.lo tls.lo \ /root/radiusd/src/lib/libfreeradius-radius.la -lnsl -lresolv -lpthread libtool: link: `eapcommon.lo' is not a valid libtool object gmake[7]: *** [libfreeradius-eap.la] Error 1 gmake[7]: Leaving directory `/root/radiusd/src/modules/rlm_eap/libeap' gmake[6]: *** [libeap/freeradius-eap.la] Error 2 gmake[6]: Leaving directory `/root/radiusd/src/modules/rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/root/radiusd/src/modules' gmake[4]: *** [all] Error 2 which isn't good .. but still regarding my initial issue .. is the rp-pppoe server sending 2 accounting requests ? :| why would he do that ?! Thanks again for the quick answer. Adrian.

2 1

groupmembership and vlan assignment
by Matt Ashfield 05 Aug '08

05 Aug '08

Hello We have been using the groupmembership attribute in radius.conf to assign users to the appropriate vlans. Up until now we've done it based on the type of LDAP user they are (ie, staff, student, faculty, etc..): groupmembership_attribute = eduPersonPrimaryAffiliation, (where eduPersonPrimaryAffliation=staff, student, facult, etc..) Unfortunately, our student vlans have grown significantly large and we want to take measures to make them smaller. We have looked into using LDAP entitlement fields. There are however a few issues here: - The eduPersonEntitlement attribute is not unique. A user record can have multiple instances of this attribute for each different entitlement they have. - The eduPersonEntitlement attribute has a value that is not simply the name of a vlan. It is typically something like: eduPersonEntitlement: urn:mace:uni.ca:wireless?vlan=student1 So I'd need to parse the value as well to pull out the vlan name, in this case "student1". I'm unsure how to get around these two issues. Any suggestions are welcome. Thanks Matt mda(a)unb.ca

2 8

Using ntlm_auth with AD subdomains
by Dow, Corey 05 Aug '08

05 Aug '08

Hi All, I have an environment where I'm trying to use FreeRADIUS to authenticate with two Active Directory domains at the same time. The problem I'm encountering is that I can authenticate one domain at a time, but not both, by manipulating the ntlm_auth syntax in radiusd.conf. For example, my parent AD domain is idmcorp.net (IDMCORP), and my subdomain is sub.idmcorp.net (SUB). The redhat linux system is joined to the parent domain and I can authenticate users via the ntlm_auth command line executable as shown. ProCurve RADIUS(ms):/etc/raddb # ntlm_auth --nt-request-key --username=codo password: NT_STATUS_OK: Success (0x0) ProCurve RADIUS(ms):/etc/raddb # ntlm_auth --nt-request-key --username='SUB\subusr1' password: NT_STATUS_OK: Success (0x0) I have two test systems which are Windows XP, configured for machine authentication, and each joined to one of the AD domains. The following radiusd.conf ntlm_auth configuration will allow machines in idmcorp.net to authenticate successfully, but not sub.idmcorp.net. If I change the --domain to sub.idmcorp.net, then that domain can authentication successfully but not idmcorp.net. ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{NT-Domain:-idmcorp.net} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" The bottom line when I look at radiusd -X is that the challenge fails because only idmcorp.net is applied: radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=subusr1' WARNING: Attempt to use unknown xlat function, or non-existent attribute in string %{NT-Domain} radius_xlat: '--domain=idmcorp.net' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: b2 radius_xlat: '--challenge=f5ba542c686e9959' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=dfdebeef4582ae2ee49bba789b110a6af1507b67abc97e5e' Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 I thought removing the domain argument from ntlm_auth might work, but this fails as well: radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=subusr1' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 49 radius_xlat: '--challenge=dcadf8974326b238' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=804ebd5ea2b41d58ee34f221268885086ca958434d969593' Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 Sorry so wordy. Can anyone think of a way to get this working for both the parent/child domains ? Thanks, Corey Corey Dow Security Solutions Test Engineer ProCurve Networking Hewlett-Packard Company 8000 Foothills Blvd. (MS 5549) Roseville, CA 95747

2 1

radacct insert issue.
by S Adrian 05 Aug '08

05 Aug '08

Hi everybody ... After banging my head against the table all day long for a few days now I decided it's time to give up and ask someone who might actually know what they're doing, so here it goes: I'm using freeradius 2.0.5 with rp-pppoe on a gentoo x86_64 box to auth .. works ok so far .. the only thing I don't get is why does it insert into radacct 2 sessions, can be seen here: http://d3xt3r01.tk/~dexter/rad/radius.log .. when the user disconnects .. it only updates the latest ( the one with 01 in the end ) session ! .. so I don't get it ! radiusd.conf http://d3xt3r01.tk/~dexter/rad/radiusd.conf sites-enabled/default http://d3xt3r01.tk/~dexter/rad/default I have another issue with making snmp work but that'll be in another thread after this is fixed. Thanks in advance, Adrian.

2 1

access to multiple value from rlm_exec
by Dmitry Goncharov 04 Aug '08

04 Aug '08

Hi! please help me, how can access to multiple value from rlm_exec? radius receive packet such this: Mon Aug 4 16:32:06 2008 Acct-Session-Id = "55E86035000A015A" Cisco-AVPair = "client-mac-address=0050.0430.4c23" Framed-Protocol = PPP Framed-IP-Address = xx.xx.xx.xx User-Name = "xxxx" Cisco-AVPair = "connect-progress=LAN Ses Up" Acct-Session-Time = 22796 Acct-Input-Octets = 2565126 Acct-Output-Octets = 23229624 Acct-Input-Packets = 23808 Acct-Output-Packets = 25356 Acct-Authentic = RADIUS Acct-Status-Type = Interim-Update NAS-Port-Type = Virtual Cisco-NAS-Port = "0/0/1/570" NAS-Port = 0 Service-Type = Framed-User NAS-IP-Address = xx.xx.xx.xx Acct-Delay-Time = 0 Client-IP-Address = xx.xx.xx.xx Acct-Unique-Session-Id = "2252af4ea3eae1d8" Timestamp = 1217853126 however, from rlm_exec, printenv show: ACCT_INPUT_OCTETS=5545038 CLIENT_IP_ADDRESS=xx.xx.xx.xx NAS_PORT_TYPE=Virtual FRAMED_PROTOCOL=PPP SERVICE_TYPE=Framed-User ACCT_STATUS_TYPE=Interim-Update ACCT_INPUT_PACKETS=26107 ACCT_SESSION_ID="55E860350009FEC8" ACCT_OUTPUT_OCTETS=13415143 NAS_PORT=0 ACCT_SESSION_TIME=24230 ACCT_AUTHENTIC=RADIUS FRAMED_IP_ADDRESS=xx.xx.xx.xx NAS_IP_ADDRESS=xx.xx.xx.xx USER_NAME="xxxxxx" CISCO_NAS_PORT="0/0/1/555" ACCT_OUTPUT_PACKETS=25996 CISCO_AVPAIR="connect-progress=LAN Ses Up" ACCT_UNIQUE_SESSION_ID="3ca7cb358d495772" ACCT_DELAY_TIME=0 in first example, value Cisco-AVPair exist twice, in second - once. i`m use freeradius-1.1.6, -- Dmitry, son of Anatoly

2 3

Re: Seek through several RADIUS severs without realms
by Alan DeKok 04 Aug '08

04 Aug '08

Ronen Kfir wrote: > Unfortunately I lost the previous message of this thread, where Alan Dekok's > respond is presented. > Anyway, the content of it was he offered to use groups membership. He also > gave a specific file: rlm_passwd which should be configured in order to > achieve groups membership as an indication which IAS server would respond > each authentication request. No. You configure groups on the FREERADIUS server. > The thing is, though went over the help file of rlm_passwd a couple of > times, I didn't see clear explanation how to configure it when working in > IAS-Active Directory environment. If you're using IAS and not FreeRADIUS, don't ask questions here. If you're using FreeRADIUS a proxy to IAS, you can configure groups on FreeRADIUS, and apply policies there. Alan DeKok.

1 0

RE: Seek through several RADIUS severs without realms
by Ronen Kfir 04 Aug '08

04 Aug '08

Unfortunately I lost the previous message of this thread, where Alan Dekok's respond is presented. Anyway, the content of it was he offered to use groups membership. He also gave a specific file: rlm_passwd which should be configured in order to achieve groups membership as an indication which IAS server would respond each authentication request. The thing is, though went over the help file of rlm_passwd a couple of times, I didn't see clear explanation how to configure it when working in IAS-Active Directory environment. Appreciate you help on this one. Cheers, Ronen As I didn't get any response yet, I would like to make my self clearer: I'm looking for alternative ways to differ among authenticated users, other then realms. I thought that the way to do it is, as I described bellow. The thing is I'm not sure how to implement this idea with in Free RADIUS. Please help me in the configuration and implamantation of this concepts. Thank you, Ronen My scenario is as follow: I use more then one strong authentication system, which is OTP (One Time Password) based and has a RADIUS interface. I use the same users repository for the various authentication systems and wish to differ between the authentication systems, using Free RADIUS .Net. I wouldn't like to use realms, as I would like users to use ordinary username and not make them use a realm. I think that the way to do it, is to create sort of loop, which will run through the various RADIUS interfaces of the OTP systems and seek for a given username. If it fails on one system, continue to the next one, and if not found in any of them, send reject access response. Best, Ronen.

1 0

Same user, different service authentication
by Prasit Gebsaap 04 Aug '08

04 Aug '08

Dear all, I am a newbie for FreeRadius, and I have set up it for WLAN authentication (EAP with username/password) and PPTP VPN. Both NAS are Cisco device (Access Point and Integrated Router). It work as I expected, but use differnent user for each service, how to configure for same user to authenticate for different service as both NAS use different authenication method? Prasit Gebsaap

2 1