- Freeradius-Users - lists.freeradius.org

Re: FreeRADIUS + OpenLDAP + NAS (it?s make me crazy!!! please HELP)
by Koko Kurniawan 20 Mar '08

20 Mar '08

Thank you... now it works and success. but if my client disconnect and reconnect again, now it doesn't need to input user name and password again. It's directly connected .. Is it right??? --------------------------------- Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.

2 1

Post-proxy and rlm_perl
by Julien Leloup 20 Mar '08

20 Mar '08

Hi, I have to use FreeRadius v2.0.1 in a proxy configuration for translating attributes between two vendor specific equipements (Alcatel-Lucent and Redback). In a first phase (pre-proxy so), I use the preproxy_user file to add attributes to the proxied requests and attr_filter to block others. In a second phase (post-proxy phase I assume), when the reply comes from the home FreeRadius, I have to go through the same kind of process (add attributes which values are taken from a database), but I can't find a equivalent of preproxy_user file to the post-proxy phase. I think that using a perl script with rlm_perl will do this work in the post-proxy function, but when I try to manipulate attributes from the home server response, I can't find them in the %RAD_REQUEST, %RAD_REPLY hashes, and I can see this kind of logs : rlm_perl: Added pair Attribute1 = Value1 ... with the attributes I need from the home server, but after the execution of my code in post-proxy function. I found in the wiki that %RAD_PROXY or %RAD_PROXY_REPLY could be my solution, but when I'm trying to use them, I got an error during the launching of radiusd. Does anyone know how I can get the attributes coming in the Access-Accept from my server, and put new attributes in the Access-Accept send to the original client ? Find a way to make this in rlm_perl could be a solution but if there is an other solution, directly in a FreRadius mechanism I missed during my research, I will use it instead :) Regards, Julien Leloup Axione 130/132 Boulevard Camélinat 92240 MALAKOFF FRANCE

2 2

rlm_exec use
by T Kid82 20 Mar '08

20 Mar '08

Hi everyone, I have been trying to get RADIUS to run a perl script which would authenticate users (and yes I have tried rlm_perl but I decided against it). So far all I have in the perl script itself is ------------------------------------ #!/usr/bin/perl use strict; use Data::Dumper; exit 3; ---------------------------------- This is what my debug output says when I run radtest: rad_recv: Access-Request packet from host 127.0.0.1 port 33397, id=236, length=56 User-Name = "matt" User-Password = "testing" NAS-IP-Address = 127.0.0.1 NAS-Port = 1645 +- entering group authorize Exec-Program output: Exec-Program: returned: 3 ++[exec] returns ok auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [matt/testing] (from client localhost port 1645) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> matt attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds ------------------------------------------------------------------------------------------------- This is what I have in my radiusd.conf authorize { exec } authentication { Auth-Type Exec { exec } } ----------------------------------------------------------------------------------------------- I would think this should let all users pass through but it doesnt seem to be doing that. What am I missing here? Thanks in advance for your help, -- Tauseef

3 6

Wifi with Welcome message?
by Guillaume Chartrand 20 Mar '08

20 Mar '08

Hi, Is it possible to send or execute a script to a user when he authenticated thru wi-fi connection with particular NAS. Like when user joe successfully authenticated with the sql database, if he was connected with NAS IP address X, he receive a Welcome message X and if he authenticated with NAS Y, he receive Welcome message Y. Currently I have Freeradius 2.0 with authentification on a mssql database and it work and give an ip address to the client when is authenticated. Guillaume

3 2

CRL signature failure
by lowbassman＠gmail.com 19 Mar '08

19 Mar '08

I have a cronjob that pulls down a CRL, runs openssl to verify it's OK, and then stops radius, copies the crl into place, and then starts radius. Occasionally, around two or three times a month, I get the following errors and no one can auth to radius until the next run of the cronjob when the CRL is again pulled down. Wed Mar 19 15:01:00 2008 : Error: --> verify error:num=8:CRL signature failure Wed Mar 19 15:01:00 2008 : Error: TLS Alert write:fatal:decrypt error Wed Mar 19 15:01:00 2008 : Error: TLS_accept:error in SSLv3 read client certificate B Wed Mar 19 15:01:00 2008 : Error: rlm_eap: SSL error error:04077068:rsa routines:RSA_verify:bad signature Wed Mar 19 15:01:00 2008 : Error: rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. Any ideas what might be causing this or how I might determine the cause? Thanks, ~Matt

1 0

RE: Error EAP
by Gustavo Chavelas 19 Mar '08

19 Mar '08

Thanks a lot of Alan. I will try to install the SSL as you suggest me. Saludos cordiales, Message: 4 Date: Wed, 19 Mar 2008 17:07:17 +0100 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Error EAP To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <47E13A35.5050702(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Gustavo Chavelas wrote: > It's very strange. I don't delete anything. > Just modified the option in eap md5 to peap, but when I try to reload > the radius with radiusd -X the program can't work and send it errors. Then the server was built *without* SSL support. PEAP needs SSL, so... > I have another test server, and same configurations work fine. > I have copied the folder raddb that work fine to my production server, > and crash, can't work again. The issue isn't the configuration files, but the libraries. > I was formatted my server, install the freeradius, I was configured my > options and can't work again. > > If I change the option peap to md5, freeradius work fine. But if try to > change md5 to peap, don't work again. > > Do you have any suggest? Install the OpenSSL libraries && header files. Then re-build FreeRADIUS. Alan DeKok.

1 0

Re: Error EAP
by Gustavo Chavelas 19 Mar '08

19 Mar '08

Hi, Ivan. Thanks for your answer. It's very strange. I don't delete anything. Just modified the option in eap md5 to peap, but when I try to reload the radius with radiusd -X the program can't work and send it errors. I have another test server, and same configurations work fine. I have copied the folder raddb that work fine to my production server, and crash, can't work again. I was formatted my server, install the freeradius, I was configured my options and can't work again. If I change the option peap to md5, freeradius work fine. But if try to change md5 to peap, don't work again. Do you have any suggest? Regardds Message: 2 Date: Tue, 18 Mar 2008 11:56:35 +0100 From: "Ivan Kalik" <tnt(a)kalik.net> Subject: Re: Error EAP To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <8rxFTXYg.1205837795.4525660.tnt(a)kalik.co.yu> Content-Type: text/plain; charset=ISO-8859-2 You have broken eap.conf. Go back to the default and try again. Read instructions in the file first and *don't* delete anything you are not certain about. Ivan Kalik Kalik Informatika ISP Dana 17/3/2008, "Gustavo Chavelas" <gchavelas(a)bfmx.com.mx> pi?e: >Hi to all. > > > >I'm installing freeradius-server-2.0.2.tar.gz,i was to configured it, but >when I try to start radiusd -X, I have an error : > >rlm_eap: No such sub-type for default EAP type peap > >/usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" > >/usr/local/etc/raddb/radiusd.conf[1944]: Failed to find module "eap". > >/usr/local/etc/raddb/radiusd.conf[1891]: Errors parsing authenticate >section. > >} > >} > >Errors initializing modules > > > >Im searching for solve this error, something have any suggest? > > > >Saludos cordiales, > > > ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 35, Issue 58 ************************************************

2 1

RE: Freeradius-Users Digest, Vol 35, Issue 58
by Gustavo Chavelas 19 Mar '08

19 Mar '08

Hi, Ivan. Thanks for your answer. It's very strange. I don't delete anything. Just modified the option in eap md5 to peap, but when I try to reload the radius with radiusd -X the program can't work and send it errors. I have another test server, and same configurations work fine. I have copied the folder raddb that work fine to my production server, and crash, can't work again. I was formatted my server, install the freeradius, I was configured my options and can't work again. If I change the option peap to md5, freeradius work fine. But if try to change md5 to peap, don't work again. Do you have any suggest? Regardds Message: 2 Date: Tue, 18 Mar 2008 11:56:35 +0100 From: "Ivan Kalik" <tnt(a)kalik.net> Subject: Re: Error EAP To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <8rxFTXYg.1205837795.4525660.tnt(a)kalik.co.yu> Content-Type: text/plain; charset=ISO-8859-2 You have broken eap.conf. Go back to the default and try again. Read instructions in the file first and *don't* delete anything you are not certain about. Ivan Kalik Kalik Informatika ISP Dana 17/3/2008, "Gustavo Chavelas" <gchavelas(a)bfmx.com.mx> pi?e: >Hi to all. > > > >I'm installing freeradius-server-2.0.2.tar.gz,i was to configured it, but >when I try to start radiusd -X, I have an error : > >rlm_eap: No such sub-type for default EAP type peap > >/usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" > >/usr/local/etc/raddb/radiusd.conf[1944]: Failed to find module "eap". > >/usr/local/etc/raddb/radiusd.conf[1891]: Errors parsing authenticate >section. > >} > >} > >Errors initializing modules > > > >Im searching for solve this error, something have any suggest? > > > >Saludos cordiales, > > > ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 35, Issue 58 ************************************************

1 0

posixAccount,posixGroup, and CiscoAVPair
by Pietro Accerboni 19 Mar '08

19 Mar '08

Hi, here is my problem: 0) Cisco APs - Radius - Ldap authentication via 802.1x - PEAP - MSCHAPv2 works. 1) I need to link the group of the user that try to authenticate with the SSID, so i can allow only a particular group of users to use a particular SSID/VLAN. 2) I have an OpenLDAP backend were all users and groups reside. users have, among others, objectClass posixAccount and sambaSamAccount. Groups have shadowAccount. 3) I DO NOT HAVE LDAPv3 SCHEMA FOR RADIUS ATTRIBUTES, so no objectClass radiusprofile for users. 4) A typical entry for user (relevant attributes): uid=username,ou=People,dc=mydomain,dc=it uid=<username> gidNumber=<gid> .. 5) A typical group entry (relevant attributes): cn=groupname, dc=mydomain,dc=it cn=<groupname> gidNumber=<gid> memberUid=<list of usernames> ... 6) I nave Cisco APs as NAS, with which i am able to send the SSID info, using vsa, to the radius server. From the request list I see: User-Name = "username" Framed-MTU = 1400 Called-Station-Id = "xxxx.xxxx.xxxx" Calling-Station-Id = "yyyy.yyyy.yyyy" Cisco-AVPair = "ssid=ZZZZ" Service-Type = Login-User Message-Authenticator = 0x8bded00fdb8decb62a26bc9c01f33938 EAP-Message = 0x02....... NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "260" NAS-Port = 260 NAS-IP-Address = nnn.nnn.nnn.nnn NAS-Identifier = "apname" 7) I really connot figure out a correct configuration of: * ldap module in radius.conf * selection in users * mapping of group attribute in ldap.attrmap I try: (radius.conf, module ldap) filter = "(&(objectClass=posixAccount)(uid=%{Stripped-User-Name:-%{User-Name}}))" groupname_attribute=gidNumber groupmembership_filter = "(&(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{User-Name}))" groupmembership_attribute = gidNumber compare_check_items = yes (if i do not set this, all users with valid credentials can log in!) (users) DEFAULT Cisco-AVPair=="ssid=SISSA-STAFF", Ldap-Group==800 Fall-Through = no DEFAULT Cisco-AVPair=="ssid=SISSA-SIS", Ldap-Group==801 Fall-Through = no Here is the 'radiusd -X' output: ---------------------------- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/ldap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "md5" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "ldapserver.mydomain.it" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Reader,dc=sissa,dc=it" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "cippalippa1" ldap: basedn = "dc=mydomain,dc=it" ldap: filter = "(&(objectClass=posixAccount)(uid=%{Stripped-User-Name:-%{User-Name}}))" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "gidNumber" ldap: groupmembership_filter = "(&(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{User-Name}))" ldap: groupmembership_attribute = "gidNumber" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = yes ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x9561bc8 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/mydomain-certs/key.pem" tls: certificate_file = "/etc/raddb/certs/mydomain-certs/crt.pem" tls: CA_file = "/etc/raddb/certs/mydomain-certs/mydomain-ca.pem" tls: private_key_password = "(null)" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = yes peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx:1645, id=181, length=165 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "001b.2b6a.dbd0" Calling-Station-Id = "000d.889c.8b70" Cisco-AVPair = "ssid=SISSA-SIS" Service-Type = Login-User Message-Authenticator = 0x4e756588125d03a06da9a2bc7acf6ede EAP-Message = 0x0202000801616365 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "290" NAS-Port = 290 NAS-IP-Address = xxx.xxx.xxx.xxx NAS-Identifier = "ciscoap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=mydomain,dc=it' radius_xlat: '(&(objectClass=posixAccount)(uid=test))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to auth-01.mydomain.it:389, authentication 0 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as cn=user,dc=mydomain,dc=it/password to ldapserver.mydomain.it:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=mydomain,dc=it, with filter (&(objectClass=posixAccount)(uid=test)) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(&(objectClass=posixGroup)(memberUid=test))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=mydomain,dc=it, with filter (&(gidNumber=801)(&(objectClass=posixGroup)(memberUid=test))) rlm_ldap::ldap_groupcmp: User found in group 801 rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 4 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for test radius_xlat: '(&(objectClass=posixAccount)(uid=test))' radius_xlat: 'dc=mydomain,dc=it' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=mydomain,dc=it, with filter (&(objectClass=posixAccount)(uid=test)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U] & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value xxxxxxxxxxxxxxxxxxxxxxxx & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value xxxxxxxxxxxxxxxxxxxxxxxxxx & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=mydomain,dc=it' radius_xlat: '(&(objectClass=posixGroup)(memberUid=test))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 1 rlm_ldap: ldap_get_conn: Got Id: 1 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to auth-01.mydomain.it:389, authentication 0 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as cn=user,dc=mydomain,dc=it/passowrd to ldapserver.mydomain.it:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=mydomain,dc=it, with filter (&(gidNumber=801)(&(objectClass=posixGroup)(memberUid=test))) rlm_ldap::ldap_groupcmp: User found in group 801 rlm_ldap: ldap_release_conn: Release Id: 1 rlm_ldap: Pairs do not match. Rejecting user. rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns reject for request 0 modcall: leaving group authorize (returns reject) for request 0 Delaying request 0 for 1 seconds Finished request 0 --------------------------- If you see in the bottom of the log, 'rlm_ldap::ldap_groupcmp: User found in group 801' but also 'rlm_ldap: Pairs do not match. Rejecting user' Any help really appreciated! Pietro

2 3

Re: FreeRADIUS + OpenLDAP + NAS (it�s make me crazy!!! please HELP!!!)
by Koko Kurniawan 19 Mar '08

19 Mar '08

thanks for the answer, i want ask something what do you mean about "the password is NOT in the RADIUS packet"?? so where is the user-password?? i have removed Auth-Type := LDAP in users.. it´s still not working. what must i do? LDAP doesn´t know EAP, so what kind of authentication i must use. can you give me suggestion the ideal configuration for my FreeRADIUS + OpenLDAP so that the authentication be performed successfully. i will show you my freeradius log, and i hope you will correct that Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radius" main: group = "radius" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = no Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded Pam pam: pam_auth = "radiusd" Module: Instantiated pam (pam) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "" ldap: basedn = "dc=aiueo,dc=com" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "{CRYPT}" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x801024c0 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work! WARNING: Fix this by running the OpenSSL command listed in eap.conf rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. --------------------------------- Looking for last minute shopping deals? Find them fast with Yahoo! Search.

3 2