- Freeradius-Users - lists.freeradius.org

no start of radiusd after reboot : mysql connection error
by mailinglists 08 Feb '08

08 Feb '08

Hello, I use freeradius-1.1.3-1.2.el5 and freeradius-mysql-1.1.3-1.2.el5. the mysql database (mysql-server-5.0.22-2.1.0.1) is hosted on a remote host (both centos5). When I use /etc/init.d/radiusd as root it starts up correctly. But when the service is launched at boot time, I get this error-log : Wed Feb 6 16:17:46 2008 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Feb 6 16:17:46 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Feb 6 16:17:46 2008 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Wed Feb 6 16:17:46 2008 : Info: rlm_sql (sql): Attempting to connect to radius@192.168.1.1:/radius Wed Feb 6 16:17:46 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed Feb 6 16:17:49 2008 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server radius@192.168.1.1:radius Wed Feb 6 16:17:49 2008 : Error: rlm_sql_mysql: Mysql error 'Can't connect to MySQL server on '192.168.1.1' (113)' Wed Feb 6 16:17:49 2008 : Error: rlm_sql (sql): Failed to connect DB handle #0 Wed Feb 6 16:17:49 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 Wed Feb 6 16:17:49 2008 : Error: rlm_sql (sql): generate_sql_clients() returned error Wed Feb 6 16:17:49 2008 : Error: radiusd.conf[14]: sql: Module instantiation failed. Wed Feb 6 16:17:49 2008 : Error: radiusd.conf[1844] Unknown module "sql". Wed Feb 6 16:17:49 2008 : Error: radiusd.conf[1773] Failed to parse authorize section. I set a tcpdump on the mysql-server host, and during the boot of my freeradius server, I see no traffic comming from freeradius host. There is no reject in the firewall. I've tried to put the radius rc.d script in S99 to start it as late as possible, but nothing changes. I also noticed that it doesen't seem to retry to connect to the database later. Or is it after a long time ? Is this a bug ? Where is the retry time configured (I cant try to set up to 5 seconds) ? Thanks for answers Laetitia.

4 11

How to change the key on ippool
by Luis Galan 08 Feb '08

08 Feb '08

Hi! I have a problem with my dialup users with a dynamic pool of ip addresses. My RAS provider don't send me the right Port-id nor Cisco-NAS-Port (always send me a 0 value for all users). I use ippool module to assign dynamic ip addresses. Then I have to change the key on my pool configuration. By default is: key = "%{NAS-IP-Address} %{NAS-Port}" I have changed to that: key = "%{NAS-IP-Address} %{Acct-Session-Id}" Question: Is it the right choice? or Should I use key = "%{NAS-IP-Address} %{Acct-Unique-Session-Id}"? Do I have to change something else? After that, (I am not sure if this is working well), rlm_ippool_tool doesn't show me how the pool are (how many ip addresses are assigned). Could I do something about it to show me the ip addresses assigned? Thanks.

2 1

Check for LDAP source in users?
by Kolbjørn Barmen 08 Feb '08

08 Feb '08

I have an LDAP server with sets of users. The only thing that seperate the different groups of users is the DN itself, group1 of users are located under ou=group1,o=bla,c=no, group2 of users are locate under ou=group2,o=bla,c=no and so forth. I want to send different attributes for the different groups. There are no groupMemberShip or groupName attributes available that I can trust, I just want to check if the DN contains the string "ou=group1,o=bla,c=no" or "ou=group2,o=bla,c=no" etc. I have tried setting up two LDAP entries (ldap1 and ldap2), each with the above DNs as basedn, but is there a way to create DEFAULT-entrie in the users file that will check which the user mathes? Suggestions? Thanks alot. -- Kolbjørn Barmen UNINETT Driftsenter

1 0

PEAP MSCHAP Problem
by Grooz, Marc (regio iT) 08 Feb '08

08 Feb '08

Hello, we have a strange problem with the PEAP MSCHAP authentication truh WLAN. We use freeradius 1.1.7 on debian etch. 1. If we auth a ActiveDirectory User with automatic sending of username and password to our wlan everthing is OK. No lan-cabel is connected. In my case the Username is DOMAIN\\GroozMarc. 2. If we auth the same user with a lan-cabel connected. the auth fails. In this case the Username is DOMAIN\\groozmarc 3. If we auth the user without automatic sending of username and password and enter DOMAIN\\groozmarc and have lan connected everthing fine. Her is an output from case 2: rad_recv: Access-Request packet from host x , id=11, length=303 User-Name = "DOMAIN\\groozmarc" Calling-Station-Id = "x" Called-Station-Id = "x" NAS-Port = 2 NAS-IP-Address = x NAS-Identifier = "x" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "27" EAP-Message = 0x020a006a1900170301005fca5e86c4de36db061ffe1fc7f358599fa78cd53e221d2899 73525b8ed1328424653bad8e457757c9ae67d167a60b6 0585b1c37d22ed1377e9ed39b37901e7cf213d6a306ef154326ca0f6c2aad68111681c24 4b1523668e9effcfd97e1a216 State = 0xc1c18b62ee37419ada28a725693523d4 Message-Authenticator = 0x8dd2ca9d8fc2a09f7dcaef11b100f2c6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 39 modcall[authorize]: module "preprocess" returns ok for request 39 modcall[authorize]: module "chap" returns noop for request 39 modcall[authorize]: module "mschap" returns noop for request 39 rlm_realm: No '@' in User-Name = "DOMAIN\groozmarc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 39 rlm_eap: EAP packet type response id 10 length 106 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 39 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 39 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 39 modcall: leaving group authorize (returns updated) for request 39 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 39 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020a00531a020a004e310d11f40d775fc5fcb45ad88a7c4435830000000000000000b8 28c2bcb15e3c9ddaba50c2e6933328d1849c510dc9251 000524547494f49542d41414348454e5c47726f6f7a4d617263 PEAP: Setting User-Name to DOMAIN\groozmarc PEAP: Adding old state with 6a 6f PEAP: Sending tunneled request EAP-Message = 0x020a00531a020a004e310d11f40d775fc5fcb45ad88a7c4435830000000000000000b8 28c2bcb15e3c9ddaba50c2e6933328d1849c510dc9251 000524547494f49542d41414348454e5c47726f6f7a4d617263 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "DOMAIN\\groozmarc" State = 0x6a6f2590246560c8fdcd054d188cbb3f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 39 modcall[authorize]: module "preprocess" returns ok for request 39 modcall[authorize]: module "chap" returns noop for request 39 modcall[authorize]: module "mschap" returns noop for request 39 rlm_realm: No '@' in User-Name = "DOMAIN\groozmarc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 39 rlm_eap: EAP packet type response id 10 length 83 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 39 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 39 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 39 modcall: leaving group authorize (returns updated) for request 39 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 39 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 39 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for groozmarc with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: '--domain=DOMAIN' radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=groozmarc' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: e9 radius_xlat: '--challenge=d5ab398544877442' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=b828c2bcb15e3c9ddaba50c2e6933328d1849c510dc92510' Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 39 modcall: leaving group MS-CHAP (returns reject) for request 39 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 39 modcall: leaving group authenticate (returns reject) for request 39 auth: Failed to validate the user. Login incorrect (rlm_mschap: Logon failure (0xc000006d)): [DOMAIN\\groozmarc/<no User-Password attribute>] (from client localhost p ort 0) PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x80148570 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 39 modcall: leaving group authenticate (returns handled) for request 39 hope you can help. thanks! Kind regards Marc Grooz

1 0

radsqlrelay - and default config
by A.L.M.Buxey＠lboro.ac.uk 08 Feb '08

08 Feb '08

hi, I've been looking at the current state of the default (commented out ready for use) radsqlrelay commands in radiusd.conf . for a quick reminder they look like this: # sql_log { # path = "${radacctdir}/sql-relay" # acct_table = "radacct" # postauth_table = "radpostauth" # sql_user_name = "%{%{User-Name}:-DEFAULT}" # # Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ # NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ # AcctSessionTime, AcctTerminateCause) VALUES \ # ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ # '%{Framed-IP-Address}', '%S', '0', '0', '');" # Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ # NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ # AcctSessionTime, AcctTerminateCause) VALUES \ # ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ # '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}', \ # '%{Acct-Terminate-Cause}');" # Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ # NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ # AcctSessionTime, AcctTerminateCause) VALUES \ # ('%{Acct-Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', \ # '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');" # # Post-Auth = "INSERT INTO ${postauth_table} \ # (username, pass, reply, authdate) VALUES \ # ('%{User-Name}', '%{User-Password:-Chap-Password}', \ # '%{reply:Packet-Type}', '%S');" # } now - whilst radsqlrelay is recommended for those whose accounting DB systems cannot keep up with the real flow of packets - and we recommend it - its not productive to have imho a broken default config. the issues which i can see from this are the following 1) with a default postgres install, those '0' dates are not going to work with the supplied schema for PGSQL - in fact it takes a bit of breaking postgres for such values to work. the simple change is to have a null entry. 2) likewise for MySQL - '0000-00-00 00:00:00' is iirc the correct way of doing it 3) BOTH mysql and postgres (i havent done any looking into oracle) will have issues with the radacct entries - for each of them has another index in the radacct table which cannot be null and must be unique - mysql acctuniqueid varchar(32) NOT NULL default '' KEY acctuniqueid (acctuniqueid) postgres AcctUniqueId VARCHAR(32) NOT NULL such a value is not being provided in the field. which means when the user finally runs radsqlrelay they will be faced with issues. as far as i can see, radpostauth will work fine. so what I'd propose is we get a few folk who are successfully using this function, get their radiusd.conf entries, and have 2 sections for uncommenting - one for postgres and one for mysql. alan

2 2

Newslists
by Keith Dovale - HostworX.co.za 08 Feb '08

08 Feb '08

My Honest opinion of this news list / user group is that it is not helpful at all, it seems if you are not in the click, no one helps, does anyone moderate this or not ? I have posted twice now and no one replies. Regards Keith From: Keith Dovale - HostworX.co.za [mailto:keith@HostworX.co.za] Sent: Thursday, February 07, 2008 9:08 PM To: ' Subject: attr rewrite issue Hi Guys, some help please . I am trying to do a attr rewrite to change an Attribute value then do a check based on the attribute that is changed, if the check fails do another attrib rewrite to the next value and do another check, until either the check fails or passes. There is basically only 4 checks in the group statement in the authorise section which do Attrib rewrite Do check (If it fails do) Attrib rewrite Do check (If it fails do) Attrib check Do rewrite (If it fails do) Attrib check Do rewrite Reject Pass When it runs it checks the reply packet for an attribute Configuration-Token which is defined in the radgroupreply for the users but it seems it cannot find it and gives an error. As below rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user keith, check_item=0, counter=0 modcall[authorize]: module "MonthlyUnShaped" returns reject for request 2 radius_xlat: 'UNSHAPED_NORMAL' rlm_attr_rewrite: No match found for attribute Configuration-Token with value 'SHAPED_NORMAL' radius_xlat: 'UNSHAPED_NORMAL' radius_xlat: 'SHAPED_NORMAL' rlm_attr_rewrite: Changed value for attribute Configuration-Token from 'UNSHAPED_NORMAL' to 'SHAPED_NORMAL' rlm_attr_rewrite: Could not find value pair for attribute Configuration-Token modcall[authorize]: module "AttrRewrite_MonthlyBlendedShaped" returns ok for request 2 can anyone help

3 5

Unlang in auth-type sections
by Arran Cudbard-Bell 08 Feb '08

08 Feb '08

Hi, EAP type module in autz sets Auth-Type to be EAP, allowing : Auth-Type { eap ... unlang } But it appears the eap module releases the tunneled reply into the current reply list, then everything skips to post-auth. # # Allow EAP authentication. Auth-Type EAP { eap # Parse User-Name sent back from EAP-Tunnel if(ok && "%{reply:User-Name}"){ update request { User-Name := "%{reply:User-Name}" } $INCLUDE ${unlangdir}/uidrewrite.conf } } auth: type "EAP" +- entering group EAP rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler ++[eap] returns ok Login OK: [anonymous/<via Auth-Type = EAP>] (from client hp-e-its-dev8021x-sw1 port 1 cli 001b63a3a8dd) +- entering group post-auth ++[reply] returns noop Is this intentional ? This is to do with logging with User-Names returned from the inner tunnel. It almost seems like this is something that belongs in the EAP module with an option to copy the User-Name from the tunnelled request to the outer request at the point the tunnelled reply is released. But i'm not sure, still trying to reason out the best way to deal with inner/outer identities. Thanks, Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 1

Problems using EAP-TLS with freeradius version 2
by Stefan Puch 08 Feb '08

08 Feb '08

Hello again, @Alan DeKok > But I would first suggest trying to use the test certificates that come with > 2.0.1. If those work, then the issue isn't 2.0.0 versus 1.1.7, it's that > there is something special about the certificates you're using. I tried to generate some test certificates using the README file provided in the source-code under "freeradius-server-2.0.1/raddb/certs/" Therefore the Makefile is used in the same directory. I'm not really sure, but in Line 93 where the "client.pem" is created it must be -passin pass:$(PASSWORD_CLIENT) instead of -passin pass:$(PASSWORD_SERVER) Most of the time you will not recognize, because in server.cnf and client.cnf all the passwords are set to "whatever" so they are identical, but when you set them, you will get an error (like me). It would also be helpful to integrate the following command into the ca section, when generating a self-signed CA certificate, because using Windows you need the CA in DER-format: openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der This evening I will try to test if this certificates are working. @Reimer Karlsen-Masur > We know of problems with EE certificates in PDAs containing the > "non-repudiation" flag. > Additionally Windows build-in supplicants don't like EE certificates with > the extendedKeyUsage "Microsoft Smartcard Logon" (1.3.6.1.4.1.311.20.2.2) > when doing EAP-TLS. > Apparently the latter issue can also be solved by just disabling the valid > certificate usage of Microsoft Smartcard Logon in the issuing CAs trusted > usages properties on the system. I'm not sure if understand correctly what you want to say to me (I'm stupid :-)) First I've used TinyCA to generate my certificates, now I will try the Makefile provided in the source-code of freeradius. I think the extendedKeyUsage "Microsoft Smartcard Logon" should not be set in both variants. Or do you mean that the extendedKeyUsage "Microsoft Smartcard Logon" must be disabled on the PDA? Best regards and thanks in advance Stefan Puch

7 16

Problem when removing Auth-Type := Ldap in users file
by cxu 08 Feb '08

08 Feb '08

Hi, I am testing the freeradius server, and try to clarify rules applied in freeradius. In the following trials, I could not figure out how to make Autz-Type Ldap1 in authorize section to correctly set Auth-Type used in authentication without the help from "Auth-Type := Ldap1". With the following entry in users file, ************** DEFAULT Called-Station-Id =~ ".*Guest@myu", Autz-Type := Ldap1, Auth-Type := Ldap1 ************** the user authentication worked fine. Below is the debug output. ************** rad_recv: Access-Request packet from host 192.168.1.113 port 20000, id=19, length=98 User-Name = "tester" Called-Station-Id = "00-1B-BA-A5-45-40:Guest@myu" NAS-Port = 189 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "nortel" NAS-IP-Address = 192.168.1.113 User-Password = "testing" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "tester", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop expand: %{Called-Station-Id} -> 00-1B-BA-A5-45-40:Guest@myu expand: %{Called-Station-Id} -> 00-1B-BA-A5-45-40:Guest@myu users: Matched entry DEFAULT at line 70 ++[files] returns ok rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Autz-Type Ldap1 +- entering group Ldap1 ++- entering redundant-load-balance group redundant-load-balance rlm_ldap: - authorize rlm_ldap: performing user authorization for tester WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=tester) expand: ou=people,dc=myu,dc=ca -> ou=people,dc=myu,dc=ca rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.myu.ca:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/unbCA.crt rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as uid=radius,dc=myu,dc=ca/PWD12345678 to ldap.myu.ca:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=myu,dc=ca, with filter (uid=tester) rlm_ldap: Added User-Password = {SSHA}jSTYFonbXmIE6pReKdYUvq0RhxuhLUAT6FYcG== in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tester authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[myldap2] returns ok ++- redundant-load-balance group redundant-load-balance returns ok rad_check_password: Found Auth-Type Ldap1 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! auth: type "Ldap1" +- entering group Ldap1 ++- entering redundant-load-balance group redundant-load-balance rlm_ldap: - authenticate rlm_ldap: login attempt by "tester" with password "testing" rlm_ldap: user DN: uid=tester,ou=people,dc=myu,dc=ca rlm_ldap: (re)connect to ldap.myu.ca:389, authentication 1 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/myuCA.crt rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as uid=tester,ou=people,dc=myu,dc=ca/testing to ldap.myu.ca:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user tester authenticated succesfully +++[myldap2] returns ok ++- redundant-load-balance group redundant-load-balance returns ok Login OK: [tester] (from client unbsj113 port 189) Sending Access-Accept of id 19 to 192.168.1.113 port 20000 Finished request 0. Going to the next request Waking up in 0.8 seconds. Waking up in 4.1 seconds. Cleaning up request 0 ID 19 with timestamp +99 Ready to process requests. ************** However when I removed Auth-Type := Ldap1 in the entry, ************** DEFAULT Called-Station-Id =~ ".*Guest@myu", Autz-Type := Ldap1 ************** the user authentication failed. The Auth Type is set to Local instead of Ldap. Below is the debug output. ************** rad_recv: Access-Request packet from host 192.168.1.113 port 20000, id=20, length=98 User-Name = "tester" Called-Station-Id = "00-1B-BA-A5-45-40:Guest@myu" NAS-Port = 192 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "nortel" NAS-IP-Address = 192.168.1.113 User-Password = "testing" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "tester", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop expand: %{Called-Station-Id} -> 00-1B-BA-A5-45-40:Guest@myu expand: %{Called-Station-Id} -> 00-1B-BA-A5-45-40:Guest@myu users: Matched entry DEFAULT at line 71 ++[files] returns ok rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Autz-Type Ldap1 +- entering group Ldap1 ++- entering redundant-load-balance group redundant-load-balance rlm_ldap: - authorize rlm_ldap: performing user authorization for tester WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=tester) expand: ou=people,dc=myu,dc=ca -> ou=people,dc=myu,dc=ca rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap2.myu.ca:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/myuCA.crt rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as uid=radius,dc=myu,dc=ca/PWD12345678 to ldap2.myu.ca:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=myu,dc=ca, with filter (uid=tester) rlm_ldap: Added User-Password = {SSHA}jSTYFonbXmIE6pReKdYUvq0RhxuhLUAT6FYcG== in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tester authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[myldap] returns ok ++- redundant-load-balance group redundant-load-balance returns ok !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Login incorrect: [tester] (from client unbsj113 port 192) Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 20 to 192.168.1.113 port 20000 Waking up in 4.9 seconds. Cleaning up request 0 ID 20 with timestamp +111 Ready to process requests. ************** In radiusd.conf, ldap myldap { server = "ldap2.myu.ca" identity = "uid=radius,dc=myu,dc=ca" password = PWD12345678 basedn = "ou=people,dc=myu,dc=ca" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no # cacertfile = /path/to/cacert.pem # cacertdir = /path/to/ca/dir/ # certfile = /path/to/radius.crt cacertfile = /usr/local/etc/raddb/certs/myuCA.crt # keyfile = /path/to/radius.key # randfile = /path/to/rnd require_cert = "never" } # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" # access_attr = "dialupAccess" dictionary_mapping = ${confdir}/ldap.attrmap password_attribute = userPassword # password_header = "{clear}" edir_account_policy_check = no # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupO fUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName groupmembership_attribute = eduPersonPrimaryAffiliation # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes set_auth_type = yes #ldap_debug = 0x0028 } ldap myldap2 { ... } authorize { ... Autz-Type Ldap1 { redundant-load-balance{ myldap myldap2 } } ... } authenticate { ... Auth-Type Ldap1 { redundant-load-balance{ myldap myldap2 } } ... } Thanks for your help! Andrew

3 5

How can I start the freeradius server with user privileges other than root?
by Deepak Panigrahy 07 Feb '08

07 Feb '08

I need the instructions to start the freeradius server from any user account of the linux machine other than root. Can anyone help me out? Thanks, Deepak

2 1