- Freeradius-Users - lists.freeradius.org

Group Membership Checking.
by David Bell 12 Mar '08

12 Mar '08

My radius.conf file has the following for Group Membership Checking # # Group membership checking. Disabled by default. # groupname_attribute = cn groupmembership_filter = "(&(objectClass=GroupOfNames)(member= uid=%{User-Name},ou=people,dc=dxi,dc=net))" groupmembership_attribute = radiusGroupName The problem with this configuration is that if a user is a member of the group it will allow them access, even if they input the wrong password. Can someone help me with this please. Thanks David

1 0

Unsubscribe
by David W Bell 12 Mar '08

12 Mar '08

1 0

I will be giving a talk at Networkshop36 in April
by Alan DeKok 11 Mar '08

11 Mar '08

I will be giving a talk in Glasgow in April. http://www.ja.net/services/events/2008/networkshop-36.html On Wednesday: 15.00 The evolution of Free RADIUS and future developments Alan DeKok, FreeRADIUS If anyone on this list is planning on attending, look for me, or send me email. I'll also be showing up early (likely Monday), so I may have some time in advance to meet people. Alan DeKok.

2 1

Can freeRadius do that?
by Guillaume Chartrand 11 Mar '08

11 Mar '08

Hi, I just want to know if freeradius server can do what I want to deploy in my environnement. I want to deploy freeradius to taking care of security and authorization for my wireless network. What I want to do is like many hotel in my country. The user open is laptop with wireless capability, is automaticly connected to the wireless network but if he want to use the internet connection, when he first run is browser, he's automaticly redirect to an authentification page that ask him a username and a password. So is it freeradius who's handle this or another software or combination of software. Like a freeradius server and a proxy or freeradius with third party software. Can someone help me with my interrogation. Thanks a lot ---------------------------- Guillaume Chartrand Technicien informatique Cégep régional de Lanaudière Centre administratif, Repentigny (450) 470-0911 poste 7218

4 4

Help with complex redundant LDAP setup
by Capelle, Mark (PCMC-GB) 11 Mar '08

11 Mar '08

I have an LDAP setup with multiple module statements pointing to the same LDAP server, but at different OU's (referred to as sites) to get around issues due to the large tree size present. This is currently working with the following setup radiusd.conf: modules { ldap srv1-sitea { .. set_auth_type = yes } ldap srv1-siteb { .. set_auth_type = yes } } sites-available/default: authorize { srv1-sitea srv1-siteb } authenticate { Auth-Type srv1-sitea { srv1-sitea } Auth-Type srv1-siteb { srv1-siteb } } Now my goal is to make this a redundant configuration. I have duplicated my modules config, changing "srv1" to "srv2" and changing the IP address of the LDAP server. The rest of the configuration is what is fuzzy for me. I assume that my authorize section would be: authorize { redundant { srv1-sitea srv2-sitea } redundant { srv1-siteb srv2-siteb } Now the authentication part is where is becomes complicated. I don't even know where to begin with this. I tried this based on some old configs I had used in the past, but this failed miserably: authenticate { Auth-Type ldap { group { srv1-sitea { reject = 1 ok = return } srv2-siteb { reject = return ok = return } } } I read the "configurable failover" docs, but it is still not clear to me what I would need to do in this situation. I am sure there is probably an easy way to accomplish this so that for each OU ("site") it uses both LDAP servers ("srv1","srv2") in a redundant fashion, but how to do it is something I am having a heck of a time figuring out.

2 1

(no subject)
by Santiago Balaguer García 11 Mar '08

11 Mar '08

Hi, I have two radius server since three years ago. They are my two production AAA servers and can authenticate until 300.000 accounts. So my RADIUS database (PostgreSQL) grew up enough and I realize that my SQL queries slow down. I know that I have four table with almost 500.000 registers each one. Any suggestion for improving the throughput and accelerating the queries? Thanks, Santiago _________________________________________________________________ La vida de los famosos al desnudo en MSN Entretenimiento http://entretenimiento.es.msn.com/

3 4

Viewing all Radius acct attributes
by Rashmi Bajaj 11 Mar '08

11 Mar '08

Hi, I am using the freeradius to receive radius acct logs from another remote radius server. The purpose is to use the radwho output. How do I make the radwho output to show all the attributes that it receives? Currently the output shows: Login, Name, What, TTY, When, From (NAS IP address), location (Framed IP address). But my input radius account parameters include many more. What needs to be changed in the conf files, so I see all the attributes as a result of radwho? Thanks, Rashmi ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

virtual server configuration
by usawebbox＠fastmail.fm 11 Mar '08

11 Mar '08

>> I want to run two virtual servers on different ports, where one server >> allows PEAP-MSCHAPV2 and the other doesn't. It seems that only one >> eap.conf can be used. > > No. You can have multiple instances of the EAP module, just like >anything else: > > eap foo { > ... > } > > eap bar { > ... > } > >> I can see how to separate the Authorize and >> Authenticate sections, but I haven't seen any documentation on the >> syntax to select or reject auth types - let alone individual EAP types - >> within that file. I tried to make blocks for each server within >> eap.conf, but it didn't work. Is there a doc on the details of this >> feature, or some good examples online. > > Configure two different eap modules. Then refer to "foo" or "bar", >and not 'eap". The problem will solve itself. > > Alan DeKok. I was stuck for a long while. I created two modules, eap_main and eap_gtc. My server1 and server2 virtual servers referred to each one respectively. The server would start, but authentication would fail: auth: type "EAP" WARNING: Unknown value specified for Auth-Type. The problem was solved when I changed my authenticate sections, adding: Auth-Type EAP { eap_main } the default authenticate just had an unqualified 'eap' line. I'm not sure why it's required after I virtualize. I'm still having trouble with the eap_gtc section, because when I remove TLS or empty it or try to return reject, the server won't start. Is removing the section the right way to not support an eap type on one virtual server? Thanks for the reply. It was helpful. -- usawebbox(a)fastmail.fm -- http://www.fastmail.fm - One of many happy users: http://www.fastmail.fm/docs/quotes.html

2 1

Problems with 1.0.6-2.0.1 connecting to OpenLDAP 2.3.33
by Zach Lowry 10 Mar '08

10 Mar '08

I'm running FreeRadius 2.0.1 on OpenBSD 4.2 on sparc64. I've also tried versions 1.0.6 and 1.1.6. I'm using OpenLDAP 2.3.33 with rlm_ldap. It works for the first request, then returns the following: From FreeRadius: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 2362, id=66, length=56 User-Name = "zach" User-Password = "*****" NAS-IP-Address = 192.168.2.11 NAS-Port = 1812 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "zach", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for zach WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=zach) expand: o=zachlowry.net,c=US -> o=zachlowry.net,c=US rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=zachlowry.net,c=US, with filter (uid=zach) rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Invalid user: [zach/*****] (from client localhost port 1812) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> zach attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 66 to 127.0.0.1 port 2362 Waking up in 4.9 seconds. Cleaning up request 2 ID 66 with timestamp +113 Ready to process requests. From OpenLDAP: Mar 1 10:25:01 tweedledum slapd[9985]: conn=8483 op=4 SRCH base="o=zachlowry.net,c=US" scope=2 deref=0 filter="(uid=zach)" Mar 1 10:25:01 tweedledum slapd[9985]: conn=8483 op=4 SRCH attr=radiusNASIpAddress radiusExpiration acctFlags sambaNtPassword sambaLmPassword ntPassword lmPassword radiusCallingStationId radiusCalledStationId radiusSimultaneousUse radiusAuthType radiusCheckItem radiusReplyMessage radiusLoginLATPort radiusPortLimit radiusFramedAppleTalkZone radiusFramedAppleTalkNetwork radiusFramedAppleTalkLink radiusLoginLATGroup radiusLoginLATNode radiusLoginLATService radiusTerminationAction radiusIdleTimeout radiusSessionTimeout radiusClass radiusFramedIPXNetwork radiusCallbackId Mar 1 10:25:01 tweedledum slapd[9985]: conn=8483 op=4 SRCH attr=radiusCallbackNumber radiusLoginTCPPort radiusLoginService radiusLoginIPHost radiusFramedCompression radiusFramedMTU radiusFilterId radiusFramedRouting radiusFramedRoute radiusFramedIPNetmask radiusFramedIPAddress radiusFramedProtocol radiusServiceType radiusReplyItem userPassword Mar 1 10:25:01 tweedledum slapd[9985]: conn=8483 op=4 SEARCH RESULT tag=101 err=0 nentries=1 text= Mar 1 10:25:01 tweedledum slapd[9985]: conn=8483 op=5 ABANDON msg=5 I can't find where the ABANDON is sent to the LDAP server. The "increase the timeout" error is found easily enough in rlm_ldap.c, but I can't figure out what timeout to increase. I think there's a deeper issue afoot, however. Thanks, --Zach

2 11

Re: is it possible: PEAP and TTLS on one SSID?
by William Bulley 10 Mar '08

10 Mar '08

Much appreciate your reply. According to A.L.M.Buxey(a)lboro.ac.uk: > > > For Windows supplicants, we will use PEAPv0/MS-CHAPv2. > > > > For non-Windows supplicants, we would use EAP/TTLS and > > MD5 as the inner method. > > > > I am confused as to how to configure FreeRADIUS 2.0.1 > > to accomplish this simultaneous behaviour. What causes > > me to be confused is this directive in the EAP module: > > > > default_eap_type = peap > > > > which could equally be this directive: > > > > default_eap_type = ttls > > > > but not at the same time since there can be only one > > default_eap_type (hence the word "default"). Is this > > even possible? And, if yes, why then does FreeRADIUS > > have the default_eap_type configuration item? Thanks. > > its causes no problem - just set the default type to be the one > you'll see most(!) - the daemon is quite happy at recognising > the other types that get thrown at it - be it TTLS, LEAP etc Thanks! Regards, web... -- William Bulley Email: web(a)umich.edu

1 0