- Freeradius-Users - lists.freeradius.org

FreeRadius as PEAP proxy to IAS
by Radim KUPKA 06 Jan '08

06 Jan '08

Hi all, I found very much usefull information about this configuration on the internet. But I have still problem with this configuration. I need terminated PEAP locally on the Freeradius and redirect only mschapv2 to IAS server for authentication. Authentication server: FreeRadius.net version: 1.1.7 Supplicant: Win XP SP2 (with PEAP) Authenticator: Ovislink WL-5460AP v2 - users.conf DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := Safeword - proxy.conf realm Safeword { type = radius authhost = <ip>:1645 accthost = <ip>:1646 secret = <secret> } - eap.conf peap { default_eap_type = mschapv2 proxy_tunneled_request_as_eap = no } Everything work OK, Ovislink send request to FreeRadius server, FreeRadius send Access-Request to IAS (mschapv2) IAS send Access-Accept, but Ovislink received Access-Challenge from FreeRadius, one two, three ... and on the end authetication failed. If I use user database on FreeRadius everything work OK. (Access-Request, Access-Accept) no problem. Is it possible configure FreeRadius as only resend reply from IAS to Ovislink? Or I have problem with configuration. If you want I send you configuration files and log from debug mode. I want this configuration because I want use one time password authetication, but Safeword plugin on Active Directory doesn't understand PEAP protocol. Only one way is use FreeRadius as proxy. Thank you for your help. Rgdrs, Radim

2 1

Re : freeradius & sql server with high loads
by A.Dupont 06 Jan '08

06 Jan '08

hi, I want to ask you for a service, can you please send me an example for radiusd.conf and rlm_sql.c and sql.c files for only accounting use of freeradius without any authentication or authorization. I have very high loads and just 5% of the accounting wich is registred in the database. I don't have problem in database the problem is that freeradius can't relay all request to database server. Thank you in advance ----- Message d'origine ---- De : "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Jeudi, 3 Janvier 2008, 11h32mn 51s Objet : Re: freeradius & sql server with high loads hi, your database is too slow to handle all the accounting in real time. hence the error messages. hence the lack of accounting either speed the DB up - and/or add more handles - or move to putting the details in in 'after real time' - eg with SQL-Relay - putting them into a file then using the sql-relay script to put them into the DB - therefore the process wont wait at the accounting stage. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail http://mail.yahoo.fr

2 1

PEAP help!
by Dave Gibelli 06 Jan '08

06 Jan '08

All Here is a snippet from radiusd -X I just want mschap to allow the user on without checking the password, but I cannot work out where to configure freeradius to allow access without checking the password. All I want to do is place the port into the correct vlan. (I assume I have to use PEAP with XP.) Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for daveg with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 Dave

2 1

Re: Configuring LDAP for query ONLY...
by Eric Martell 05 Jan '08

05 Jan '08

Hi, Is it possible to altogether avoid authenticate section and just do ldap lookups in the authorize section? authorize { ldap { notfound = reject } } The problem is in the authenticate section, radius gets the userDN from the authorize and tries to "bind" ldap with password which we don't have. I also tried in users file Ldap-UserDN := `cn=Manager,dc=eng,dc=com/answer2` But for some reason it is not working. Please help. Let me know if you need more information or please guide me to any documentation. Thanks and Regards, Eric. --- Eric Martell <workoutexcite(a)yahoo.com> wrote: > I am little bit confused as how to configure > radiusd.conf in the authorize and/or authenticate > section. So password is going to act like ldap > attribute. > > We are going to pass, username and ldap attribute > (home phone #) as input for each user. > > The way it is configured now is in the modules, > > ldap { > server = "10.11.12.2" > identity = "cn=Manager,dc=eng,dc=com" > password = answer2 > basedn = "dc=eng,dc=com" > > filter = > "(&(uid=%{Stripped-User-Name:-%{User-Name}})(phone=1231313128))" > // just for testing > > ldap_connections_number = 5 > > timeout = 4 > > timelimit = 3 > > net_timeout = 1 > > } > > > > > > authorize { > .. > .. > .. > ldap > ... > > } > > authenticate { > Auth-Type LDAP { > ldap > } > } > > > In the logs it says: > > rlm_ldap: - authorize > rlm_ldap: performing user authorization for test1 > radius_xlat: '(&(uid=test1)(phone=1231313128))' > radius_xlat: 'dc=eng,dc=com' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: attempting LDAP reconnection > rlm_ldap: bind as cn=Manager,dc=eng,dc=com/answer2 > rlm_ldap: waiting for bind result ... > rlm_ldap: Bind was successful > rlm_ldap: performing search in dc=eng,dc=com, with > filter (&(uid=test1)(phone=1231313128)) > rlm_ldap: looking for check items in directory... > rlm_ldap: looking for reply items in directory... > rlm_ldap: user test1 authorized to use remote access > > > this is good.... > But in the authenticate section > > > rlm_ldap: - authenticate > rlm_ldap: login attempt by "test1" with password > "1231313128" > rlm_ldap: user DN: id=1967816, dc=eng,dc=com > rlm_ldap: bind as id=1967816, > dc=eng,dc=com/1231313128 > > rlm_ldap: waiting for bind result ... > rlm_ldap: id=1967816, dc=eng,dc=com bind to > 10.11.12.2:389 failed Inappropriate authentication > rlm_ldap: ldap_connect() failed > > > > Not sure why it is trying to bind as id=1967816, > dc=eng,dc=com/1231313128 > > The only thing I want to do it, just authorize the > ldap and pass the user through. > > > Please let me know if I am missing something. > > Thanks so much. > > Regards, > Erik. > > > > > ____________________________________________________________________________________ > Be a better sports nut! Let your teams follow you > with Yahoo Mobile. Try it now. > http://mobile.yahoo.com/sports;_ylt=At9_qDKvtAbMuh1G1SQtBI7ntAcJ > ____________________________________________________________________________________ Get easy, one-click access to your favorites. Make Yahoo! your homepage. http://www.yahoo.com/r/hs

5 20

latest CVS 2.0 beta hang problem
by A.L.M.Buxey＠lboro.ac.uk 05 Jan '08

05 Jan '08

hi, a 2.0 beta (latest CVS head) install server locked up on us today in its early test deployment case secnario a request was proxied off to another RADIUS server. no response came back. server totally fails to respond to anything else. the only entry in the 'radiusd -X' is the last 2 lines Fri Jan 4 13:40:23 2008 : Error: Rejecting request 12643 due to lack of any response from home server 10.1.2.3 port 1812 Fri Jan 4 13:40:23 2008 : Error: WARNING: Unresponsive child (id 0) for request 12643, in module <server-core> component <server-core> thats all. no further debug i'm afraid. alan

2 10

Virtual Hosts conflicting
by Nicholas Hall 05 Jan '08

05 Jan '08

Hello all *My Goal*: PAP on legacy port 1645, CHAP on 1812 working simultaneously. *My Environment*: FreeRADIUS 2.0.0-pre2, LDAP user database, MySQL Accounting. *Problem*: I'm running a virtual host for each AUTH port. Each works fine when placed in sites-enabled individually but my CHAP virtualhost fails when both are enabled. The vhost listening on 1812 appears to be referencing an LDAP module that is not listed in it's server{ ... } block. You will see "ou=Dialup" in the debugging output below of a CHAP request to 1812 that is only contained in the legacy PAP vhost. Any ideas are appreciated!! I have 4 LDAP servers configured, two point to a different OU on the same servers for legacy PAP users. Is there maybe a way to change the basedn on the fly with NAS-IP-Address as the condition? This may be easier than sorting out my mess. Right now i'm differentiating requests using clients.conf: # CHAP NAS *client x.x.x.x { secret = test shortname = test nastype = other server = alexssa_dsl } *##################### # Stripped LDAP config # ##################### *ldap ldap01.alexssa.net { <snip> basedn = "ou=users,ou=radius,dc=alexssa,dc=net" ldap ldap02.alexssa.net { <snip> basedn = "ou=users,ou=radius,dc=alexssa,dc=net" ldap ldap01.alexssa.net_dialin { <snip> basedn = "ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net" } ldap ldap02.alexssa.net_dialin { <snip> basedn = "ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net" }* ############################## # Below is my DSL (CHAP) vhost # ############################## *server alexssa_dsl { listen { ipaddr = * port = 1812 type = auth } listen { ipaddr = * port = 1813 type = acct } authorize { if ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) { update request { Stripped-User-Name = "%{1}" } } preprocess auth_log files redundant-load-balance { ldap01.alexssa.net ldap02.alexssa.net } daily chap } authenticate { Auth-Type CHAP { chap } } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess acct_unique files } # # Accounting. Log the accounting data. # accounting { # acctdetail sql # daily radutmp attr_filter.accounting_response } # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { radutmp } # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } } # dsl server block* ###################### # Dialin (PAP) vhost # ###################### *server alexssa_dialin { listen { ipaddr = * port = 1645 type = auth } listen { ipaddr = * port = 1646 type = acct } authorize { if ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) { update request { Stripped-User-Name = "%{1}" } } preprocess auth_log files redundant-load-balance { ldap01.alexssa.net_dialin ldap02.alexssa.net_dialin } daily pap } authenticate { Auth-Type PAP { pap } } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess acct_unique files } # # Accounting. Log the accounting data. # accounting { # acctdetail sql # daily dialup radutmp attr_filter.accounting_response } # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { radutmp } # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } }* } # dialin server block ####################################### # debugging output of CHAP request to 1812 # ####################################### Listening on authentication address * port 1812 as server alexssa_dsl Listening on accounting address * port 1813 as server alexssa_dsl Listening on authentication address * port 1645 as server alexssa_dialin Listening on accounting address * port 1646 as server alexssa_dialin Ready to process requests. Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 38.119.185.62 port 3563, id=15, length=63 User-Name = "1000copyme(a)alexssa.net" CHAP-Password = 0x0f4e646219d84c7c72d88e920c879d2a01 server alexssa_dsl { +- entering group authorize ++? if ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) expand: %{User-Name} -> 1000copyme(a)alexssa.net ? Evaluating ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) -> TRUE ++? if ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) -> TRUE ++- entering if ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) expand: %{1} -> 1000copyme +++[request] returns notfound ++- if ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) returns notfound ++[preprocess] returns ok expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/38.119.185.62/auth-detail-20080103 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/38.119.185.62/auth-detail-20080103 expand: %t -> Thu Jan 3 15:19:46 2008 ++[auth_log] returns ok rlm_ldap: Entering ldap_groupcmp() expand: ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net -> ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net expand: %{Stripped-User-Name} -> 1000copyme expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=1000copyme) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap02.alexssa.net:389, authentication 0 rlm_ldap: bind as cn=xxxxx,dc=alexssa,dc=net/xxxxxx to ldap02.alexssa.net:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net, with filter (uid=1000copyme) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() expand: ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net -> ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net expand: %{Stripped-User-Name} -> 1000copyme expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=1000copyme) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net, with filter (uid=1000copyme) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 16 ++[files] returns ok ++- entering redundant-load-balance group rlm_ldap: - authorize rlm_ldap: performing user authorization for 1000copyme(a)alexssa.net expand: %{Stripped-User-Name} -> 1000copyme expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=1000copyme) expand: ou=users,ou=radius,dc=alexssa,dc=net -> ou=users,ou=radius,dc=alexssa,dc=net rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap02.alexssa.net:389, authentication 0 rlm_ldap: bind as cn=xxxxx,dc=alexssa,dc=net/xxxxxx to ldap02.alexssa.net:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=users,ou=radius,dc=alexssa,dc=net, with filter (uid=1000copyme) rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute userPassword as RADIUS attribute Cleartext-Password == "test1234" rlm_ldap: looking for reply items in directory... rlm_ldap: user 1000copyme(a)alexssa.net authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap02.alexssa.net] returns ok ++- redundant-load-balance group returns ok rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair ++[daily] returns noop rlm_chap: WARNING: Auth-Type already set. Not setting to CHAP ++[chap] returns noop rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [1000copyme(a)alexssa.net/<CHAP-Password>] (from client test port 0) } # server alexssa_dsl Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 1000copyme(a)alexssa.net attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Sending delayed reject for request 0 Sending Access-Reject of id 15 to 38.119.185.62 port 3563 Reply-Message = "Please call the helpdesk. Alexssa can be reached at 262-338-3742" Waking up in 4 seconds... Cleaning up request 0 ID 15 with timestamp +17 Nothing to do. Sleeping until we see a request. -- Nicholas Hall ngharo(a)gmail.com 262.208.6271

4 5

2nd instance of freeradius 1.1.7 fails to run
by Jack Murgia 05 Jan '08

05 Jan '08

I'm trying to run 2 separate instances of freeradius for testing another .sql authorization database. I've created a second .conf file location- /etc/raddb2 and similarly created locations for the run and log files (/var/log/radiusd2, /var/run/radiusd2) and edited the 2nd radiusd.conf file appropirately, so I thought- binding it to an IP not used by my other instance of the freeradius server and specifying port 1820 in my second radiusd.conf file. But when I try to run in debug mode, I get this: [root@srv run]# /usr/sbin/radiusd2 -d /etc/raddb2 -XX Fri Jan 4 18:38:47 2008 : Info: Starting - reading configuration files ... Fri Jan 4 18:38:47 2008 : Debug: reread_config: reading radiusd.conf Fri Jan 4 18:38:47 2008 : Debug: Config: including file: /etc/raddb2/proxy.conf Fri Jan 4 18:38:47 2008 : Debug: Config: including file: /etc/raddb2/clients.conf Fri Jan 4 18:38:47 2008 : Debug: Config: including file: /etc/raddb2/snmp.conf Fri Jan 4 18:38:47 2008 : Debug: Config: including file: /etc/raddb2/eap.conf Fri Jan 4 18:38:47 2008 : Debug: Config: including file: /etc/raddb2/sql.conf Fri Jan 4 18:38:47 2008 : Debug: Config: including file: /etc/raddb2/sqlcounter.conf Fri Jan 4 18:38:47 2008 : Debug: main: prefix = "/usr" Fri Jan 4 18:38:47 2008 : Debug: main: localstatedir = "/var" Fri Jan 4 18:38:47 2008 : Debug: main: logdir = "/var/log/radius2" Fri Jan 4 18:38:47 2008 : Debug: main: libdir = "/usr/lib" Fri Jan 4 18:38:47 2008 : Debug: main: radacctdir = "/var/log/radius2/radacct" Fri Jan 4 18:38:47 2008 : Debug: main: hostname_lookups = no Fri Jan 4 18:38:47 2008 : Debug: main: snmp = no Fri Jan 4 18:38:47 2008 : Debug: main: max_request_time = 30 Fri Jan 4 18:38:47 2008 : Debug: main: cleanup_delay = 5 Fri Jan 4 18:38:47 2008 : Debug: main: max_requests = 1024 Fri Jan 4 18:38:47 2008 : Debug: main: delete_blocked_requests = 0 Fri Jan 4 18:38:47 2008 : Debug: main: port = 1820 Fri Jan 4 18:38:47 2008 : Debug: main: allow_core_dumps = no Fri Jan 4 18:38:47 2008 : Debug: main: log_stripped_names = no Fri Jan 4 18:38:47 2008 : Debug: main: log_file = "/var/log/radius2/radius.log" Fri Jan 4 18:38:47 2008 : Debug: main: log_auth = no Fri Jan 4 18:38:47 2008 : Debug: main: log_auth_badpass = no Fri Jan 4 18:38:47 2008 : Debug: main: log_auth_goodpass = no Fri Jan 4 18:38:47 2008 : Debug: main: pidfile = "/var/run/radiusd2/radiusd2.pid" Fri Jan 4 18:38:47 2008 : Debug: main: bind_address = 6X.XX.XXX.XXX IP address [69.59.117.122] Fri Jan 4 18:38:47 2008 : Debug: main: user = "(null)" Fri Jan 4 18:38:47 2008 : Debug: main: group = "(null)" Fri Jan 4 18:38:47 2008 : Debug: main: usercollide = no Fri Jan 4 18:38:47 2008 : Debug: main: lower_user = "no" Fri Jan 4 18:38:47 2008 : Debug: main: lower_pass = "no" Fri Jan 4 18:38:47 2008 : Debug: main: nospace_user = "no" Fri Jan 4 18:38:47 2008 : Debug: main: nospace_pass = "no" Fri Jan 4 18:38:47 2008 : Debug: main: checkrad = "/usr/sbin/checkrad" Fri Jan 4 18:38:47 2008 : Debug: main: proxy_requests = yes Fri Jan 4 18:38:47 2008 : Debug: proxy: retry_delay = 5 Fri Jan 4 18:38:47 2008 : Debug: proxy: retry_count = 3 Fri Jan 4 18:38:47 2008 : Debug: proxy: synchronous = no Fri Jan 4 18:38:47 2008 : Debug: proxy: default_fallback = yes Fri Jan 4 18:38:47 2008 : Debug: proxy: dead_time = 120 Fri Jan 4 18:38:47 2008 : Debug: proxy: post_proxy_authorize = no Fri Jan 4 18:38:47 2008 : Debug: proxy: wake_all_if_all_dead = no Fri Jan 4 18:38:47 2008 : Debug: security: max_attributes = 200 Fri Jan 4 18:38:47 2008 : Debug: security: reject_delay = 1 Fri Jan 4 18:38:47 2008 : Debug: security: status_server = no Fri Jan 4 18:38:47 2008 : Debug: main: debug_level = 0 Fri Jan 4 18:38:47 2008 : Debug: read_config_files: reading dictionary Fri Jan 4 18:38:47 2008 : Debug: read_config_files: reading naslist Fri Jan 4 18:38:47 2008 : Info: Using deprecated naslist file. Support for this will go away soon. Fri Jan 4 18:38:47 2008 : Debug: read_config_files: reading clients Fri Jan 4 18:38:47 2008 : Debug: read_config_files: reading realms Fri Jan 4 18:38:47 2008 : Error: There appears to be another RADIUS server running on the authentication port 1820 netstat -tunelup shows only this for radiusd: udp 0 0 69.59.138.117:1812 0.0.0.0:* 0 22764540 16572/radiusd udp 0 0 69.59.138.117:1813 0.0.0.0:* 0 22764541 16572/radiusd -- Jack Murgia General Manager HubbaDubba Internet Services http://www.hubbadubba.com

1 0

Nübie
by Javier Basisty 04 Jan '08

04 Jan '08

Hi list, i realy need help. Im trying to use pppoe-server + Freeradius + OpenLDAP. My problem is Freeradius + LDAP. I followed the manual, step by step, but it doesnt work. My radius.conf is: ldap { server = "127.0.0.1" basedn = "dc=PPP,dc=cicomsa" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" start_tls = no #access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 #password_header = "{clear}" password_attribute = "userPassword" edir_account_policy_check=no # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes # set_auth_type = yes } authorize { ldap } authenticate { Auth-Type LDAP { ldap } } and my ldif schema is: dn: uid=pepe,ou=People,dc=PPP,dc=cicomsa structuralObjectClass: account objectClass: top objectClass: account objectClass: posixAccount cn: pepe uid: pepe userPassword: 123 uidNumber: 1001 gidNumber: 1024 homeDirectory: /home/pepe1 loginShell: /bin/bash When i try to test the radius server i got this problem: [root@tna-080 javier.basisty]# radtest pepe 123 127.0.0.1:0 1 testing123 Sending Access-Request of id 131 to 127.0.0.1 port 1812 User-Name = "pepe" User-Password = "123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Re-sending Access-Request of id 131 to 127.0.0.1 port 1812 User-Name = "pepe" User-Password = "123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=131, length=20 [root@tna-080 javier.basisty]# and the log is: Fri Jan 4 15:11:53 2008 : Info: Using deprecated naslist file. Support for this will go away soon. Fri Jan 4 15:11:53 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Fri Jan 4 15:11:54 2008 : Info: Ready to process requests. Fri Jan 4 15:11:59 2008 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow Fri Jan 4 15:11:59 2008 : Auth: Login incorrect: [pepe/123] (from client localhost port 2) Is there something missing? Where is my error? is the ldif wrong or the config file? Please, if somebody can send me a tutorial will be glad! Regards

2 1

Freeradius and eDirectory
by Generic Generic 04 Jan '08

04 Jan '08

Hi, I'm setting up Freeradius 1.1.4 on a SUSE 10 server for our wireless users with XP SP2 using PEAP. Because we use eDirectory I strip the computer name from the username, not every users uses the Novell client. The user get authorize but I can't get the authentication to work. For some reason the first character of the users password is change for a "a", if the first character is a "a" then it is change for something else. ??? I installed the 885453 and 917021 patches for Windows XP SP2 and changed the supplicant mode to 3, didn't help. This problem does not occur with users using the Novell client SP4. I included a few lines from the debug, the password should be mypassw instead of aypassw. Robert rlm_ldap: bind as cn=User1,ou=Techs,o=ORG/aypassw to rep01.mydomain.ca:389 <http://rep01.mydomain.ca:389/> ... res_errno: 49, res_error: <NDS error: failed authentication (-669)>, res_matched: <>

3 2

Radius Load-Balancing concept
by Sebastian Ganschow 04 Jan '08

04 Jan '08

Hi, we're planing to reinstall our Radius servers. Currently we have two servers running, each with an own mysql server for the accounting records. If server 1 fails server 2 takes over. The accounting data is exchange with radrelay, I'm thinking to switch from this fail-over concept to a load-balancing concept and I would like to ask, if this concept would work. I want to install 2 radius servers and a postgres database cluster. Both radius servers will write their accounting data into the same database. Some of our NASes will use the first, the others the second server as primary radius server. If one of the server fails the other server will take over all NASes. Does it work, if both servers will write into the same database? Do I need to set up radrelay to exchange the accounting data between the two servers? Will this concept work in general? Thanks in advance Regards Sebastian

5 8