- Freeradius-Users - lists.freeradius.org

unlang question
by Andy Billington 27 Jan '08

27 Jan '08

hi all, am looking at whether to migrate to 2.0 to create a couple of possibilities and was wondering if I can: 1. create a main vritual server 2. use unlang to parse the incoming requests and then based on whether they match a regex, proxy them to different virtual servers or to an external 3rd party RADIUS? I'm sure Ive missed something in the docs so pls any pointers verey gratefully received ! Andy

2 3

rlm_perl and RLM_MODULE_REJECT
by Jean-Michel Caricand 27 Jan '08

27 Jan '08

Hi, I have a question on rlm_perl and RLM_MODULE_REJECT. If in a function (post_proxy) I return RLM_MODULE_REJECT I can see this in log : modcall[post-proxy]: module "perl1" returns reject for request 1 ... but my request is still accepted : Access-Accept not Access-Reject ! How to do that ? Thank. -- Jean-Michel Caricand Tél: 03.81.66.20.63 E-mail: jean-michel.caricand(a)lifc.univ-fcomte.fr Equipe systèmes Laboratoire d'Informatique de l'Université de Franche-Comté 16, route de Gray - 25030 BESANÇON CEDEX

3 8

Force Auth-Type
by Markus Moeller 27 Jan '08

27 Jan '08

Hi, I am new to freeradius and try to authenticate users with pam and authorize with ldap groups. I try to find a minimal configuration but have some problems forcing the Auth-Type to be PAM. I have radiusd.conf: prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd db_dir = $(raddbdir) libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { ipaddr = * port = 0 type = auth } listen { ipaddr = * port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files syslog_facility = daemon file = ${logdir}/radius.log stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = no $INCLUDE clients.conf snmp = no thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pam { pam_auth = radiusd } ldap { server = "192.168.2.1" port = 636 identity = "uid=ldapadmin,ou=external,dc=example,dc=com" password = controllme basedn = "ou=external,dc=example,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls_mode = yes tls { start_tls = no cacertdir = /etc/certs } set_auth_type = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 header = "%t" suppress { User-Password } } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d detailperm = 0600 suppress { User-Password } } detail reply_log { detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } } $INCLUDE sites-enabled/ sites-enabled/default: authorize { auth_log ldap } authenticate { pam } preacct { acct_unique } accounting { detail } ldap.attrmap: checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem If I run radiusd-X I get: rad_recv: Access-Request packet from host 127.0.0.1 port 63402, id=76, length=58 User-Name = "fred" User-Password = "hamster" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 +- entering group authorize expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20080123 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20080123 expand: %t -> Wed Jan 23 19:53:47 2008 ++[auth_log] returns ok rlm_ldap: - authorize rlm_ldap: performing user authorization for fred WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=fred) expand: ou=external,dc=example,dc=com -> ou=external,dc=example,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: setting TLS CACert Directory to /etc/certs rlm_ldap: starting SSL rlm_ldap: (re)connect to 10.129.189.34:5636, authentication 0 rlm_ldap: bind as uid=ldapadmin,ou=external,dc=example,dc=com/controlme to 192.2.1.1:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=networks,ou=external,dc=example,dc=com, with filter (uid=fred) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: user fred authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [fred/hamster] (from client localhost port 0) Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 189 to 127.0.0.1 port 63418 Waking up in 4.9 seconds. Cleaning up request 0 ID 189 with timestamp +3 Ready to process requests. Only if I set set_auth_type = yes in radiusd.conf for ldap and change authorize in default to: Auth-Type LDAP { pam } I get a successful login. Is there any other way to force Auth-Type tp be PAM for all users ? Is there also a way to disable the use of the ldap.attribute mapping as I really don't need it ? Thank you Markus

2 7

duplicate ip address ippool problem
by as3ad jamous 26 Jan '08

26 Jan '08

freeradius assign duplicate ip address , i using ippool module and file, for example user1 get the IP1 and some times (not always ) user2 get the same IP1 so LNS see duplicate ip address and drop the new user (no high load at radius but some times on database may be some load ),i dont know why freeradius retrun the used ip ,may it not sotre it at the ippool files : session-db and ip-index ? but whyfrom the side of the LNS i can see the authentication and accounting is okand acknowledged about authentication and accountingif there problem from side of database , the ippool store the datat at local files at radius server and there is no problem of high cpu load or system load on it , I would be grateful if you can assist me in identifying why this happens, and how I can rectify this problemthank you in advance. i look forward to your reply. _________________________________________________________________ Helping your favorite cause is as easy as instant messaging. You IM, we give. http://im.live.com/Messenger/IM/Home/?source=text_hotmail_join

1 0

certificates in FR 2.0.1 on windows doesnt works
by orion 26 Jan '08

26 Jan '08

hi to all. created the certificates with the default config files in FR 2.0.1 with ./bootstrap created the client certificate with make client the import of the ca.pem and server.crt in winxp is OK. they link with each-other ok ( ca->server ) the import of client.p12 is ok but it doesnt have a valid link it is ca->server->client and the details of the server certificate tells that "is not authorized to issue certificates" . the client certificates tells that is issued by the server not by the ca. the question is : the client certificate should be issued by the server or by the ca? if its to be issued by the ca then the Makefile in cert dirs have to be modified. in fact after modified the Makefile and client.cnf and re-importing them in xp then the linkage is ok. ( ca->client ) is this a prob ? or what ?

4 10

Hello, and a (hopefully) simple question
by Vlad Sedov 25 Jan '08

25 Jan '08

Hey folks. Right now, we use freeradius to authenticate simple pap/chap PPP clients. When a username/password is rejected, radius simply send back a reject message to the NAS. Is it possible to change this behavior so that a failed auth attempt gets accepted with an alternate IP pool instead of being rejected? the idea is to force suspended users through a web proxy that tells them that they have a billing issue, instead of rejecting their connection altogether. Any help would be appreciated.... Vlad

7 11

simple Ldap-group search
by cxu 25 Jan '08

25 Jan '08

Background: When a user associated with the ssid Guest, the user will authenticate against a FreeRadius server. If he has a university account, the FreeRadius server will authenticate him via LDAP. If he does not have a university account, the FreeRadius server will do the authentication with a guest account database. Goal: To reduce the chance to do the LDAP search, the LDAP-group search is successful if the user is in the LDAP and no matter which LDAP group he is in. My shot and the problem: I am trying to do a wildcard search in LDAP-Group search, but it looks like the wildcard could not work. Related entries in the file users, <omitted> DEFAULT Called-Station-Id =~ ".*Guest", myldap-Ldap-Group == "*", Autz-Type := Ldap1, Auth-Type := Ldap1 DEFAULT Called-Station-Id =~ ".*Guest", Group == "guest", Autz-Type := Web, Auth-Type := System <omitted> Debug output, <output omitted> rlm_ldap: performing search in ou=people,dc=myuniv,dc=ca, with filter (&(cn=*)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUnique Names)(uniquemember=)))) <output omitted> rlm_ldap::groupcmp: Group * not found or user not a member rlm_ldap: ldap_release_conn: Release Id: 0 ++[files] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [cxu] (from client localhost port 0) Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Questions: 1. Is there any way to make the wildcard LDAP-group search work? 2. Whether unlang could be applied here and how? 3. Any advice? Thanks! Andrew

2 1

SSH-login authentication, using Active Directory credentials.
by suraj shankar 25 Jan '08

25 Jan '08

Hi; For a long time now, I have been trying to unify the login credentials, in a heterogeneous environment. While I am aware of the few available options, I have decided against them, for varied reasons. In the last few days, I have been able to produce the effect which I desired, using pam_radius_auth and IAS. All is well, and I am able to SSH-login using my Active directory login credentials. But before I take this to production, I would like to know if this approach is safe - the IAS setting that works says "Unencrypted authentication (PAP)". >From here http://lists.cistron.nl/pipermail/freeradius-users/2006-July/055010.html, I understand that pam_radius_auth 'encrypts' the password. But if a user has the privileges to change the /etc/raddb/server file (and point it to a freeradius server), wouldn't he/she be able to siphon off the credentials? Our setup would disallow direct 'root' logins, over SSH. However, once the user logs in using his/her credentials, they would then be allowed to do a sudo or a privileges escalation. Thereby, opening the possibility of a /etc/raddb/server edit. I know worse things can happen with superuser privileges; however, I am not worried of the bad that can happen to the client machines. Is there a better way, using radius? Please suggest. If this query is a rerun, pointers/references would do. Thank you. Regards, suraj. ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping

4 5

eap and users file
by theSnail 25 Jan '08

25 Jan '08

I have only this entry in users file: DEFAULT Auth-Type := Accept raiudsd -X users: Matched entry DEFAULT at line 1 but it still try to authenticate against ldap. So the question is: users file and EAP-ttls + PAP schema can work togher? thanks -- View this message in context: http://www.nabble.com/eap-and-users-file-tp15086647p15086647.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

IP Pool defined, but radius does not hand out an IP address.
by Andrew D Kirch 25 Jan '08

25 Jan '08

When I connect a client to freeradius the client authenticates, gets an accept/accept, but does not get an IP address. I've tried it with the Group and Pool-Name directives in each client's block, and I've tried it with them in a DEFAULT by themselves. Neither has handed out an IP address. System vitals: radius:/etc/freeradius# uname -a Linux radius 2.6.18-5-686 #1 SMP Mon Dec 24 16:41:07 UTC 2007 i686 GNU/Linux radius:/etc/freeradius# cat /etc/debian_version 4.0 radius:/etc/freeradius# freeradius -v freeradius: FreeRADIUS Version 1.1.3, for host i486-pc-linux-gnu, built on Dec 16 2006 at 23:48:11 # radtest umcc xxxxxx localhost 0 xxxxxxx Sending Access-Request of id 144 to 127.0.0.1 port 1812 User-Name = "umcc" User-Password = "bts10200" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=144, length=44 Service-Type = Framed-User Framed-IP-Netmask = 255.255.255.255 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP radius.log: Thu Jan 24 11:20:51 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Thu Jan 24 11:20:51 2008 : Info: Ready to process requests. Thu Jan 24 11:32:33 2008 : Auth: Login OK: [umcc] (from client localhost-testing port 0) users: umcc User-Password == "xxxxxx" Service-Type = Framed-User, Framed-IP-Netmask = 255.255.255.255, Group == main_pool, Pool-Name := "main_pool", Framed-Protocol = PPP, Framed-Compression = Van-Jacobsen-TCP-IP radiusd.conf (pertinent sections) ippool main_pool { range-start = 208.64.35.2 range-stop = 208.64.35.254 netmask = 255.255.255.255 cache-size = 253 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = yes maximum-timeout = 0 } accounting { detail unix radutmp main_pool } post-auth { main_pool }

4 5