- Freeradius-Users - lists.freeradius.org

Referencing Ldap-Group in unlang
by Jason Alderfer 13 May '08

13 May '08

Hi all, I would like to convert the following users file entry to unlang code in 2.0.4. DEFAULT Ldap-Group == "cn=not_student,ou=n,o=emu" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = 6 But after reading the unlang man page and trying it several ways, I can't figure out how to duplicate this functionality. The above users file entry causes this in the debug output: rlm_ldap: Entering ldap_groupcmp() expand: o=emu -> o=emu expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dalderfjh\2cou\3dis\2cou\3dn\2co\3demu))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=not_student,ou=n,o=emu, with filter (|(&(objectClass=GroupOfNames)(member=cn\3dalderfjh\2cou\3dis\2cou\3dn\2co\3demu))) request done: ld 0x81a5118 msgid 29 rlm_ldap::ldap_groupcmp: User found in group cn=not_student,ou=n,o=emu But so far none of the syntax below has invoked ldap_groupcmp(). if ( Ldap-Group == "cn=not_student,ou=n,o=emu" ) { if ( control:Ldap-Group == "cn=not_student,ou=n,o=emu" ) { if ( "%{Ldap-Group}" == "cn=not_student,ou=n,o=emu" ) { if ( "%{ldap:Ldap-Group}" == "cn=not_student,ou=n,o=emu" ) { Jason

2 3

Multiple BaseDN's - How Do I Do This?
by Rob VanDusen 12 May '08

12 May '08

I'm very new to both Linux and FreeRadius, so please excuse me if this is too easy a question. After a couple weeks of fighting, reading, testing and reconfiguring - I finally managed to get FreeRadius 2.x working with my Novell eDirectory. Right now my eDir tree is made up of 6 "O's" - one for each building in the organization. It looks something like this: ISDTREE | CTC | ESB | MTC | SPS | OAC | JSC My current config will check via LDAP against a NetWare box and authorize anyone in the ESB container - but I can't get it to look at any of the other containers. I tried doing multiple instances of the LDAP module - but that resulted in the server not authorizing anyone. How would I set this up so I can add the other O's as Base DN's? I'd really appreciate any instructions that a slightly dim bulb could follow. -Rob

4 6

Re: Can't get the value of 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce'.
by johnson elangbam 12 May '08

12 May '08

>You are (again) sending a request without Digest-Attributes. Try sending >one with them. >Ivan Kalik >Kalik Informatika ISP hi, I check all the clients attributes and start sending the Digest attributes.. now the problem is I can't get those attributes in my perl code by accessing using RAD_REQUEST or RAD_CHECK, so that I can calculate my ha1, ha2 for md5 encryption. Please help. Output log file when run in debug mode by using radiusd -X rad_recv: Access-Request packet from host 192.168.1.227 port 32817, id=222, length=262 User-Name = "john(a)192.168.1.227" Digest-Attributes = "\n\006john" Digest-Attributes = "\001\017192.168.1.227" Digest-Attributes = "\002*48281f56caacb6aa62fc3bb31ec98146efeaae15" Digest-Attributes = "\004\023sip:192.168.1.227" Digest-Attributes = "\003\nREGISTER" Digest-Response = "9ae01536efc46358e61f2fe362552af4" Service-Type = SIP Sip-URI-User = "john" Cisco-AVPair = "call-id= 8717e9ec07014e138298c43a5dcdd370(a)192.168.1.193" NAS-IP-Address = 127.0.0.1 NAS-Port = 5060 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x8d08568 asigned new request. Handled so far: 1 found interpetator at address 0x8d08568 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: Digest-Response = 9ae01536efc46358e61f2fe362552af4 rlm_perl: RAD_REQUEST: Service-Type = SIP rlm_perl: RAD_REQUEST: Cisco-AVPair = call-id= 8717e9ec07014e138298c43a5dcdd370(a)192.168.1.193 rlm_perl: RAD_REQUEST: User-Name = john(a)192.168.1.227 rlm_perl: RAD_REQUEST: Sip-URI-User = john rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: RAD_REQUEST: NAS-Port = 5060 rlm_perl: RAD_REQUEST: Digest-Attributes = ARRAY(0x8df353c) rlm_perl: ############################################################### rlm_perl: Added pair Digest-Response = 9ae01536efc46358e61f2fe362552af4 rlm_perl: Added pair Service-Type = SIP rlm_perl: Added pair Cisco-AVPair = call-id= 8717e9ec07014e138298c43a5dcdd370(a)192.168.1.193 rlm_perl: Added pair User-Name = john(a)192.168.1.227 rlm_perl: Added pair Sip-URI-User = john rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair NAS-Port = 5060 rlm_perl: Added pair Digest-Attributes = \n\006john rlm_perl: Added pair Digest-Attributes = \001\017192.168.1.227 rlm_perl: Added pair Digest-Attributes = \002*48281f56caacb6aa62fc3bb31ec98146efeaae15 rlm_perl: Added pair Digest-Attributes = \004\023sip:192.168.1.227 rlm_perl: Added pair Digest-Attributes = \003\nREGISTER rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x8d08568 ++[perl] returns ok rlm_digest: Adding Auth-Type = DIGEST ++[digest] returns ok rlm_realm: Looking up realm "192.168.1.227" for User-Name = " john(a)192.168.1.227" rlm_realm: No such realm "192.168.1.227" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type DIGEST auth: type "digest" +- entering group authenticate rlm_digest: Cleartext-Password or Digest-HA1 is required for authentication. ++[digest] returns invalid auth: Failed to validate the user. Login incorrect: [john(a)192.168.1.227/<via Auth-Type = DIGEST>] (from client 192.168.1.227 port 5060) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john(a)192.168.1.227 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.1.227 port 32818, id=223, length=262 User-Name = "john(a)192.168.1.227" Digest-Attributes = "\n\006john" Digest-Attributes = "\001\017192.168.1.227" Digest-Attributes = "\002*48281f56caacb6aa62fc3bb31ec98146efeaae15" Digest-Attributes = "\004\023sip:192.168.1.227" Digest-Attributes = "\003\nREGISTER" Digest-Response = "9ae01536efc46358e61f2fe362552af4" Service-Type = SIP Sip-URI-User = "john" Cisco-AVPair = "call-id= 8717e9ec07014e138298c43a5dcdd370(a)192.168.1.193" NAS-IP-Address = 127.0.0.1 NAS-Port = 5060 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x8e67348 asigned new request. Handled so far: 1 found interpetator at address 0x8e67348 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: Digest-Response = 9ae01536efc46358e61f2fe362552af4 rlm_perl: RAD_REQUEST: Service-Type = SIP rlm_perl: RAD_REQUEST: Cisco-AVPair = call-id= 8717e9ec07014e138298c43a5dcdd370(a)192.168.1.193 rlm_perl: RAD_REQUEST: User-Name = john(a)192.168.1.227 rlm_perl: RAD_REQUEST: Sip-URI-User = john rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: RAD_REQUEST: NAS-Port = 5060 rlm_perl: RAD_REQUEST: Digest-Attributes = ARRAY(0x8efce0c) rlm_perl: ############################################################### rlm_perl: Added pair Digest-Response = 9ae01536efc46358e61f2fe362552af4 rlm_perl: Added pair Service-Type = SIP rlm_perl: Added pair Cisco-AVPair = call-id= 8717e9ec07014e138298c43a5dcdd370(a)192.168.1.193 rlm_perl: Added pair User-Name = john(a)192.168.1.227 rlm_perl: Added pair Sip-URI-User = john rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair NAS-Port = 5060 rlm_perl: Added pair Digest-Attributes = \n\006john rlm_perl: Added pair Digest-Attributes = \001\017192.168.1.227 rlm_perl: Added pair Digest-Attributes = \002*48281f56caacb6aa62fc3bb31ec98146efeaae15 rlm_perl: Added pair Digest-Attributes = \004\023sip:192.168.1.227 rlm_perl: Added pair Digest-Attributes = \003\nREGISTER rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x8e67348 ++[perl] returns ok rlm_digest: Adding Auth-Type = DIGEST ++[digest] returns ok rlm_realm: Looking up realm "192.168.1.227" for User-Name = " john(a)192.168.1.227" rlm_realm: No such realm "192.168.1.227" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type DIGEST auth: type "digest" +- entering group authenticate rlm_digest: Cleartext-Password or Digest-HA1 is required for authentication. ++[digest] returns invalid auth: Failed to validate the user. Login incorrect: [john(a)192.168.1.227/<via Auth-Type = DIGEST>] (from client 192.168.1.227 port 5060) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john(a)192.168.1.227 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.4 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 222 to 192.168.1.227 port 32817 Reply-Message = "Incorrect Password" Waking up in 0.4 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 223 to 192.168.1.227 port 32818 Reply-Message = "Incorrect Password" Waking up in 4.5 seconds. Cleaning up request 0 ID 222 with timestamp +3 Waking up in 0.4 seconds. Cleaning up request 1 ID 223 with timestamp +3 Ready to process requests. Thanks and Regards, Elangbam Johnson

3 2

reply-attributes are not set in the ACCES-ACCEPT
by Alex Mija 12 May '08

12 May '08

Hello, I try to authenticate (using freeradius 102)to a freeradius server . My user entry in the users file looks like this: user2 User-Password := "alcatel" Session-Timeout = 3600, Termination-Action = 1, # Class = 0x1234567890, # User-Name = "accounting", Service-Flow-Descriptor = 0x000104008302040083040303050304060301070383080384, QoS-Descriptor += 0x000103830403020606000F40000c0302, QoS-Descriptor += 0x000103840403020606001F40000c0302 When I use TTLS with CHAP it works fine. BUT When I use TTLS with MSCHAPv2 in ACCESS-ACCEPT message I can't see any of the attributes I set in the reply list of items from the users file. Here is the ACCESS-ACCEPT I get for TTLS with CHAP: Sending Access-Accept of id 5 to 10.10.10.30:36608 Session-Timeout = 3600 Termination-Action = RADIUS-Request Service-Flow-Descriptor = 0x000104008302040083040303050304060301070383080384 QoS-Descriptor += 0x000103830403020606000f40000c0302 QoS-Descriptor += 0x000103840403020606001f40000c0302 MS-MPPE-Recv-Key = 0x8a3b613e1d64e0a0336d2e60e2fb0632b6a43cc6b3d5d2b4e5567d1a96192ce4 MS-MPPE-Send-Key = 0x6e80df49b3c1508922184f681e1ce50d92c8be285caffd8ade63819b62a39f71 EAP-Message = 0x03b80004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anonymous" State = 0x2c1b82994bd0419cabdcaf1926213bd5 Finished request 4 And here is the ACCESS-ACCEPT I get for TTLS with MSCHAPv2: Sending Access-Accept of id 5 to 10.10.10.40:42816 MS-MPPE-Recv-Key = 0x1da9c1c1e531f3196e83dfc1916b5b3a86b495ab8e2af29713c599be4bdfbbfd MS-MPPE-Send-Key = 0xe1059cf8c3c43acb40917d40d11f75b38d3ebcdd7ff3c8ce50555cfed46e286b EAP-Message = 0x03c20004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anonymous" State = 0x84615d95aae822404e0a3e27f174ea81 Finished request 4 Could anyone tell me why in the second case the reply attributes are not included in ACCESS-ACCEPT? Regards, Alex

2 3

RomelDutta wants to keep up with you on Twitter
by RomelDutta 12 May '08

12 May '08

To find out more about Twitter, visit the link below: http://twitter.com/i/4f1f94b0c7346025ec6e15519105f5031e871c00 Thanks, -The Twitter Team About Twitter Twitter is a unique approach to communication and networking based on the simple concept of status. What are you doing? What are your friends doing—right now? With Twitter, you may answer this question over SMS, IM, or the Web and the responses are shared between contacts. This message was sent by a Twitter user who entered your email address. If you'd prefer not to receive emails when other people invite you to Twitter, click here: http://twitter.com/i/optout/abdcfc01be34644e916679f286282c27ea97dd4c

1 0

Recommendations for manging user password
by thekat 11 May '08

11 May '08

Thank you all for responding to my first post in getting FreeRadius set up and working on a Solaris 10 box. I am working on creating the (non-priviledged) user environment that will run the server. I have successfully set up a working Radius server to work with a FirePass VPN appliance.. FirePass uses PAP for authentication.. however I have authenticated using both local and PAP. <code> "charlie" Auth-Type := Local, User-Password == "hello" Reply-Message = "Hello, %u" "charles" Auth-Type := PAP, User-Password == "hello" Reply-Message = "Hello, %u" </code> This works like this: -- FirePass appliaance has a SSL login page. -- User enters creditials -> validates against FreeRadius -- User is shown a "static" page on the FirePass Server with a Static Link. I will have about 75 users and need to set up password aging.. Using system (non-shell) accounts with IDs in /etc/password could be an option I did read the "Expired" thread and I can write a script to update that field if necessary.. My Goal --- let the user know their password has expired --- let them change it themselves.. --- age the password for 90 days --- I really don't want a MySQL database ( I don't know MySQL but could learn if I have to) I am hoping someone can point me in the right direction.. Charles

3 3

ippool usage question
by John Joe 11 May '08

11 May '08

Hy, What happens if the ip addresses from the ippool are finished? I have some moments when the clients are receiving ip addresses from 10.67 subnet allthow i have nothing configured for this. --------------------------------- Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.

3 2

Can any one help me out by sending the detailed info of how to do the radius confis for Routers plz!!!!
by shanmugavel Balu 10 May '08

10 May '08

Thanks in Advance, shan

2 1

huntgroups are failing auth - missing Chap Password
by Terry Pelley 09 May '08

09 May '08

FreeRADIUS Version 1.1.7 I am using the FreeRADIUS.net Windows version of the software. at least for the time being. I am trying to set up a very basic single user account for a very specific purpose and have created the account as follows. hunttest User-Password == "hunttest", Huntgroup-Name == "hunttest" My huntgroups file has a huntgroup called hunttest with a single NAS IP Address listed as follows. public NAS-IP-Address == 10.252.9.2 when the user huntest attempts to authenticate it fails. My RADIUS Log shows the following entry. Wed May 7 15:07:25 2008 : Auth: Login incorrect (rlm_chap: Clear text password not available): [hunttest/<CHAP-Password>] (from client NAS04 port 5 cli 00-1E-8C-0E-8E-70) Wed May 7 15:07:25 2008 : Auth: Login incorrect (rlm_chap: Clear text password not available): [hunttest/<CHAP-Password>] (from client NAS04 port 5 cli 00-1E-8C-0E-8E-70) Can some one tell me what is wrong. I am simply trying to create a config that will allow the user hunttest to authenticate only if the request comes from the client NAS04. Perhaps a huntgroup is not the best way to do this.

4 7

Altering extra table in SQL module
by Barry 09 May '08

09 May '08

Hi List In my accounting_start_query I would like to update another table in the same database with the NASIPAddress. What would be the best way to do this? Could I add a ; at the end of the query and add another one to the same quoted string or should I use the exec() module? Thanks Barry

3 2