- Freeradius-Users - lists.freeradius.org

groupmembership and vlan assignment
by Matt Ashfield 05 Aug '08

05 Aug '08

Hello We have been using the groupmembership attribute in radius.conf to assign users to the appropriate vlans. Up until now we've done it based on the type of LDAP user they are (ie, staff, student, faculty, etc..): groupmembership_attribute = eduPersonPrimaryAffiliation, (where eduPersonPrimaryAffliation=staff, student, facult, etc..) Unfortunately, our student vlans have grown significantly large and we want to take measures to make them smaller. We have looked into using LDAP entitlement fields. There are however a few issues here: - The eduPersonEntitlement attribute is not unique. A user record can have multiple instances of this attribute for each different entitlement they have. - The eduPersonEntitlement attribute has a value that is not simply the name of a vlan. It is typically something like: eduPersonEntitlement: urn:mace:uni.ca:wireless?vlan=student1 So I'd need to parse the value as well to pull out the vlan name, in this case "student1". I'm unsure how to get around these two issues. Any suggestions are welcome. Thanks Matt mda(a)unb.ca

2 8

Using ntlm_auth with AD subdomains
by Dow, Corey 05 Aug '08

05 Aug '08

Hi All, I have an environment where I'm trying to use FreeRADIUS to authenticate with two Active Directory domains at the same time. The problem I'm encountering is that I can authenticate one domain at a time, but not both, by manipulating the ntlm_auth syntax in radiusd.conf. For example, my parent AD domain is idmcorp.net (IDMCORP), and my subdomain is sub.idmcorp.net (SUB). The redhat linux system is joined to the parent domain and I can authenticate users via the ntlm_auth command line executable as shown. ProCurve RADIUS(ms):/etc/raddb # ntlm_auth --nt-request-key --username=codo password: NT_STATUS_OK: Success (0x0) ProCurve RADIUS(ms):/etc/raddb # ntlm_auth --nt-request-key --username='SUB\subusr1' password: NT_STATUS_OK: Success (0x0) I have two test systems which are Windows XP, configured for machine authentication, and each joined to one of the AD domains. The following radiusd.conf ntlm_auth configuration will allow machines in idmcorp.net to authenticate successfully, but not sub.idmcorp.net. If I change the --domain to sub.idmcorp.net, then that domain can authentication successfully but not idmcorp.net. ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{NT-Domain:-idmcorp.net} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" The bottom line when I look at radiusd -X is that the challenge fails because only idmcorp.net is applied: radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=subusr1' WARNING: Attempt to use unknown xlat function, or non-existent attribute in string %{NT-Domain} radius_xlat: '--domain=idmcorp.net' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: b2 radius_xlat: '--challenge=f5ba542c686e9959' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=dfdebeef4582ae2ee49bba789b110a6af1507b67abc97e5e' Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 I thought removing the domain argument from ntlm_auth might work, but this fails as well: radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=subusr1' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 49 radius_xlat: '--challenge=dcadf8974326b238' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=804ebd5ea2b41d58ee34f221268885086ca958434d969593' Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 Sorry so wordy. Can anyone think of a way to get this working for both the parent/child domains ? Thanks, Corey Corey Dow Security Solutions Test Engineer ProCurve Networking Hewlett-Packard Company 8000 Foothills Blvd. (MS 5549) Roseville, CA 95747

2 1

radacct insert issue.
by S Adrian 05 Aug '08

05 Aug '08

Hi everybody ... After banging my head against the table all day long for a few days now I decided it's time to give up and ask someone who might actually know what they're doing, so here it goes: I'm using freeradius 2.0.5 with rp-pppoe on a gentoo x86_64 box to auth .. works ok so far .. the only thing I don't get is why does it insert into radacct 2 sessions, can be seen here: http://d3xt3r01.tk/~dexter/rad/radius.log .. when the user disconnects .. it only updates the latest ( the one with 01 in the end ) session ! .. so I don't get it ! radiusd.conf http://d3xt3r01.tk/~dexter/rad/radiusd.conf sites-enabled/default http://d3xt3r01.tk/~dexter/rad/default I have another issue with making snmp work but that'll be in another thread after this is fixed. Thanks in advance, Adrian.

2 1

access to multiple value from rlm_exec
by Dmitry Goncharov 04 Aug '08

04 Aug '08

Hi! please help me, how can access to multiple value from rlm_exec? radius receive packet such this: Mon Aug 4 16:32:06 2008 Acct-Session-Id = "55E86035000A015A" Cisco-AVPair = "client-mac-address=0050.0430.4c23" Framed-Protocol = PPP Framed-IP-Address = xx.xx.xx.xx User-Name = "xxxx" Cisco-AVPair = "connect-progress=LAN Ses Up" Acct-Session-Time = 22796 Acct-Input-Octets = 2565126 Acct-Output-Octets = 23229624 Acct-Input-Packets = 23808 Acct-Output-Packets = 25356 Acct-Authentic = RADIUS Acct-Status-Type = Interim-Update NAS-Port-Type = Virtual Cisco-NAS-Port = "0/0/1/570" NAS-Port = 0 Service-Type = Framed-User NAS-IP-Address = xx.xx.xx.xx Acct-Delay-Time = 0 Client-IP-Address = xx.xx.xx.xx Acct-Unique-Session-Id = "2252af4ea3eae1d8" Timestamp = 1217853126 however, from rlm_exec, printenv show: ACCT_INPUT_OCTETS=5545038 CLIENT_IP_ADDRESS=xx.xx.xx.xx NAS_PORT_TYPE=Virtual FRAMED_PROTOCOL=PPP SERVICE_TYPE=Framed-User ACCT_STATUS_TYPE=Interim-Update ACCT_INPUT_PACKETS=26107 ACCT_SESSION_ID="55E860350009FEC8" ACCT_OUTPUT_OCTETS=13415143 NAS_PORT=0 ACCT_SESSION_TIME=24230 ACCT_AUTHENTIC=RADIUS FRAMED_IP_ADDRESS=xx.xx.xx.xx NAS_IP_ADDRESS=xx.xx.xx.xx USER_NAME="xxxxxx" CISCO_NAS_PORT="0/0/1/555" ACCT_OUTPUT_PACKETS=25996 CISCO_AVPAIR="connect-progress=LAN Ses Up" ACCT_UNIQUE_SESSION_ID="3ca7cb358d495772" ACCT_DELAY_TIME=0 in first example, value Cisco-AVPair exist twice, in second - once. i`m use freeradius-1.1.6, -- Dmitry, son of Anatoly

2 3

Re: Seek through several RADIUS severs without realms
by Alan DeKok 04 Aug '08

04 Aug '08

Ronen Kfir wrote: > Unfortunately I lost the previous message of this thread, where Alan Dekok's > respond is presented. > Anyway, the content of it was he offered to use groups membership. He also > gave a specific file: rlm_passwd which should be configured in order to > achieve groups membership as an indication which IAS server would respond > each authentication request. No. You configure groups on the FREERADIUS server. > The thing is, though went over the help file of rlm_passwd a couple of > times, I didn't see clear explanation how to configure it when working in > IAS-Active Directory environment. If you're using IAS and not FreeRADIUS, don't ask questions here. If you're using FreeRADIUS a proxy to IAS, you can configure groups on FreeRADIUS, and apply policies there. Alan DeKok.

1 0

RE: Seek through several RADIUS severs without realms
by Ronen Kfir 04 Aug '08

04 Aug '08

Unfortunately I lost the previous message of this thread, where Alan Dekok's respond is presented. Anyway, the content of it was he offered to use groups membership. He also gave a specific file: rlm_passwd which should be configured in order to achieve groups membership as an indication which IAS server would respond each authentication request. The thing is, though went over the help file of rlm_passwd a couple of times, I didn't see clear explanation how to configure it when working in IAS-Active Directory environment. Appreciate you help on this one. Cheers, Ronen As I didn't get any response yet, I would like to make my self clearer: I'm looking for alternative ways to differ among authenticated users, other then realms. I thought that the way to do it is, as I described bellow. The thing is I'm not sure how to implement this idea with in Free RADIUS. Please help me in the configuration and implamantation of this concepts. Thank you, Ronen My scenario is as follow: I use more then one strong authentication system, which is OTP (One Time Password) based and has a RADIUS interface. I use the same users repository for the various authentication systems and wish to differ between the authentication systems, using Free RADIUS .Net. I wouldn't like to use realms, as I would like users to use ordinary username and not make them use a realm. I think that the way to do it, is to create sort of loop, which will run through the various RADIUS interfaces of the OTP systems and seek for a given username. If it fails on one system, continue to the next one, and if not found in any of them, send reject access response. Best, Ronen.

1 0

Same user, different service authentication
by Prasit Gebsaap 04 Aug '08

04 Aug '08

Dear all, I am a newbie for FreeRadius, and I have set up it for WLAN authentication (EAP with username/password) and PPTP VPN. Both NAS are Cisco device (Access Point and Integrated Router). It work as I expected, but use differnent user for each service, how to configure for same user to authenticate for different service as both NAS use different authenication method? Prasit Gebsaap

2 1

postgresqlippool
by Maxim Sirenko 04 Aug '08

04 Aug '08

Hi, All! Could you answer the question on the basis of your experience? Since what version of freeradius you was successfull in using rlm_sqlippool with postgresql and what little fixes you had to do to make it work? I have 1.1.7_3 port on FreeBSD 6.2 and I'm unsuccessfull in forcing to assign an IP from sql pool rather from NAS configuration pool. In docs we encouraged to use 2.0.x to have this feature working. I cannot upgrade to 2.0.x now because my radius is under 24*7 load and I don't have spare server to test it. So I want to find out whether anyone had success with sqlippool+pgsql on 1.1.x Real successfull configs would be nice to see. Thanks. Maxim Sirenko.

4 4

No authenticate method (Auth-Type)??
by Oguzhan Kayhan 04 Aug '08

04 Aug '08

Hello, Im trying to use virtual server config for the freeradius. But i got the following error when i test the config. auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user My config for the sites-enables is: ----------------------- listen { ipaddr = * port = 1821 type = auth } server one { authorize { preprocess files perl } authenticate { Auth-Type Perl { perl } } accounting { unix radutmp } session { radutmp } } server two { } client 139.179.14.250 { shortname = example-client secret = testing123 virtual_server = one } -------------------------------------- Also added the following under the modules section of radiusd.conf -------------- perl { module = /usr/local/bin/login.pl func_authenticate = authenticate func_authorize = authorize } --------------- this is the ouput of the radiusd -X. rad_recv: Access-Request packet from host 139.179.14.250 port 36926, id=31, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 139.179.14.250 NAS-Port = 10 server one { +- entering group authorize ++[preprocess] returns ok ++[files] returns noop perl_pool: item 0x88af708 asigned new request. Handled so far: 1 found interpetator at address 0x88af708 rlm_perl: Added pair User-Name = test rlm_perl: Added pair User-Password = test rlm_perl: Added pair NAS-Port = 10 rlm_perl: Added pair NAS-IP-Address = 139.179.14.250 perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x88af708 ++[perl] returns ok auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. } # server one Found Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Sending Access-Reject of id 31 to 139.179.14.250 port 36926 PS: the same perl script works fine with single freerad config.

3 5

Freeradius proxy accounting
by Mailing List 04 Aug '08

04 Aug '08

Hi, I have freeradius (A) up and running that proxies accounting messages to another freeradius (B) . Is it possible to configure (A) in such a way that it will always will acknowedge towards the NAS even when (B) is not responding to an proxied accounting message coming from (A). Now, If (B) is down, (A) will also not respond back to the NAS and the NAS keeps on retrying. (A) is configured to put the accounting in a mysql database. Basically, I want that (A) always sends an ACK back to the NAS regardless the state of (B). Thx, Kurt

3 3