- Freeradius-Users - lists.freeradius.org

Re: Problem with LDAP and Groups
by Bryan Evege 11 Oct '07

11 Oct '07

Message: 6 > Date: Thu, 11 Oct 2007 21:13:21 +0100 > From: <tnt(a)kalik.co.yu> > Subject: Re: Problem with LDAP and Groups > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <bS0cz6Hw.1192133601.8730890.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > >> If I change the fall through to yes it still matches as many groups as the user is in. How can I tell freeradius which attributes to send back? >> > > If you want to send sets of attributes according to the NAS user is > trying to log into use huntgroups. > > >> For example, bevege is a member of the following groups, packetshapper, cisco_priv_15, cisco_priv_1, linux. >> > > Your group allocation is wrong. You can't have the same user(name) on > the same device having priv levels 1 and 15. Pick one. Or have him log > in as username@1 and username@15 and use realms to allocate correct set > of attributes. > > Ivan Kalik > Kalik Informatika ISP > > Could you please explain a bit more. From what I understand you cannot use Huntgroups to lookup what group a user is in. I only uses /etc/group /etc/password. What I would like to do is this. User bevege logs in from Cisco router. Have the users file somehow detect that the request has come from a cisco router (by IP I would guess) then validate that the user is in the correct group and then pass back the specific attributes just for the cisco. Same thing for packetshapper etc. Thanks, Bryan

2 1

Using freeradius and 802.1x for dynamic VLAN
by lvizcardof＠unsa.edu.pe 11 Oct '07

11 Oct '07

Hello, I use freeradius-1.0.4-1.FC4.1 version in a PC Linux Fedora Core 4. This radius server authenticates to user in function to his login and key, if the information is correct the radius server must send to user to the vlan 2 according to forms in the file users of the radius server. This is the configuration in the file users from radius server: ***************************************************************** carlos Auth-Type := EAP, User-Password == "carlos" Service-Type = Framed-User, Tunne-type = VLAN, Tunnel-medium-type = IEEE-802, Tunnel-Private-Group-Id = 2 ***************************************************************** I have the followin problem . When I authenticate to the user with login and key It sends by defect to the vlan 1. I have a switch DELL PowerConnect 5324. In this switch I have formed the ports to 802.1x and I have two vlans: the vlan2 and vlan3 This is all the configuration in my switch: ***************************************************************** console# show running-config vlan database vlan 2-3 exit interface ethernet g1 switchport access vlan 2 exit dot1x system-auth-control interface range ethernet g(7-10) dot1x port-control auto exit interface range ethernet g(7-10) dot1x re-authentication exit interface vlan 2 ip address 10.20.10.253 255.255.255.0 exit interface vlan 3 ip address 192.168.2.253 255.255.255.0 exit ip default-gateway 10.20.10.1 radius-server host 10.20.10.13 auth-port 1645 timeout 3 radius-server key misecreto aaa authentication dot1x default radius username admin password 7d8c9c8b116cdfe3fb091f4c1ac684de level 15 encrypted ***************************************** The problem that I have is that when I authenticate to user with his login and key, The radius server sends the user to the vlan 1. Who can I do so that radius server sends the user to the vlan that I select? , in this case is the vlan 2. I think that. I review all the information about how to form the radius server but, I don't know what more do. do you have an idea of, how can I solve this problem? ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 1

Get raddb/certs/bootstrap to work on systems where make is not gnu make
by Scott Lambert 11 Oct '07

11 Oct '07

Attached is a simplistic patch to get raddb/certs/bootstrap to work on systems where make is not GNU make. The patch is to: radiusd/configure to add ./raddb/certs/bootstrap to the ac_config_files. radiusd/raddb/certs/bootstrap to get it ready to be repo-copied to radiusd/raddb/certs/bootstrap.in. I think radiusd/raddb/certs/bootstrap with then need to be "cvs rm"ed. Hopefully it will be useful. -- Scott Lambert KC5MLE Unix SysAdmin lambert(a)lambertfam.org

2 3

Re: 802.1x & kerberos
by Reynolds, Walter 11 Oct '07

11 Oct '07

We also have this working with the below settings. However in running ver 1.1.6 (maybe others) we have found that there is some sort of problem that will cause the Freeradius server to crash. This seems to be tied to request with incorrect passwords as notated by the following in the log: Thu Oct 11 10:01:03 2007 : Auth: rlm_krb5: [UserName] krb5_g_i_t_w_p failed: Decrypt integrity check failed Has anyone else seen this or have suggestions for me on this. > Date: Thu, 11 Oct 2007 15:00:39 +0100 > From: A.L.M.Buxey(a)lboro.ac.uk > Subject: Re: 802.1x & kerberos > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20071011140039.GA23584(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > It works w/o EAP. I can do a radtest with a valid userid and > password > > on the kerberos server and get authorized (and not get authorized > with > > bad information). > > right > > > I can get EAP-TTLS to work if I put a user and a password in the > radius > > users file but that's not what we want. We need the kerberos piece > to > > work. I'd be happy to send some config files along if that would > help. > > I feel like I'm missing something small that's so obvious no one has > > thought to document it. > > no. you dont need to use the users file for the userid/password. > you simply need to ensure that the krb5 module is in the Authorize > section and that you have PAP enabled...and that you are using EAP-TTLS > with PAP inner method. > > so....your FR config needs at least the following configs... > > radiusd.conf > > in the authorize section > > krb5 { > > } > > in the authenticate section (radiusd.conf for 1.1.x, sites- > enabled/default for 2.x) > > Auth-Type krb5 { > krb5 > } > > you MAY configure krb5 in radiusd.... we havent found this actually > necessary(!) > > # krb5 { > # keytab = /path/to/keytab > # service_principal = name_of_principle > # } > > > > finally. if you are facing issues and you dont help with supplying > a log file then please ensure that your RADIUS request isnt being > b0rked > by something in the users file eg > > DEFAULT Auth-Type = System > > you can at least change this to.... > > DEFAULT Auth-Type = krb5 > > just for checking(!!) > > alan > >

2 1

eDirectory Authentication
by Brad Lachel 11 Oct '07

11 Oct '07

We are currently using our RADIUS server to do one thing. It is authenticating wireless users via Mac address through access points. Very clean, very simple. We would like to increase the security a bit by having the users authenticate against eDirectory as well. If a user tries to get on the network, his MAC is passed to the RADIUS server. If the MAC is validated, the request is passed to the Novell Server, the user is asked to enter his password, and then he is allowed in. I have setup my config files according to several eDirectory/FreeRADIUS FAQ articles that I have found, but I am still having a few issues. 1: I am never asked for a password 2: rlm_ldap: When I attempt to get access, I get an error message "could not start TLS operations error" Below are some clips from my configurations as well as the access messages as I receive: ACCESS ATTEMPT: rad_recv: Access-Request packet from host 172.16.14.23:1812, id=1, length=73 User-Password = "xxxxxx" User-Name = "0016cb-b64f93" NAS-Identifier = "172.16.14.23" NAS-IP-Address = 172.16.14.23 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/172.16.14.23/auth- detail-20071011' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/ auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/ 172.16.14.23/auth-detail-20071011 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "0016cb-b64f93", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry 0016cb-b64f93 at line 222 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for 0016cb-b64f93 radius_xlat: '(uid=0016cb-b64f93)' radius_xlat: 'o=dist-155' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 172.16.13.10:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/ cacert.pem rlm_ldap: setting TLS CACert Directory to /usr/local/etc/raddb/certs/ rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Operations error rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 0 modcall: leaving group authorize (returns fail) for request 0 Finished request 0 Going to the next request RADIUSD.CONF # MODULE CONFIGURATION # modules { # pap { encryption_scheme = crypt auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 # passwd = /etc/passwd # shadow = /etc/shadow # group = /etc/group radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { #use_mppe = no #require_encryption = yes #require_strong = yes #with_ntdomain_hack = no #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=% {Stripped-User-Name:-%{User-Name:-None}} --challenge=% {mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } ldap { server = 172.16.13.10 identity = "cn=ProxyUser,ou=District,o=dist-155" password = "xxxxxx" basedn = "o=dist-155" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" start_tls = yes tls_mode = yes port = 636 tls_cacertfile = /usr/local/etc/raddb/certs/cacert.pem tls_cacertdir = /usr/local/etc/raddb/certs/ # tls_certfile = /usr/local/etc/raddb/certs/radius.crt # tls_keyfile = /usr/local/etc/raddb/certs/radius.key # tls_randfile = /path/to/rnd tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 Set: password_attribute = nspmPassword # password_attribute = userPassword edir_account_policy_check=yes # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=% {Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap- UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes # set_auth_type = yes } EAP.CONF eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no # Supported EAP-types md5 { } leap { } gtc { auth_type = PAP } ## EAP-TLS tls { private_key_password = ch$d!s$ private_key_file = ${raddbdir}/certs/cert-key.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes # check_crl = yes # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" # check_cert_cn = %{User-Name} # cipher_list = "DEFAULT" } ttls { default_eap_type = md5 copy_request_to_tunnel = yes use_tunneled_reply = yes } peap { default_eap_type = mschapv2 # copy_request_to_tunnel = no # use_tunneled_reply = no # proxy_tunneled_request_as_eap = yes } mschapv2 { } } USERS #Dist - Lachel "0016cb-b64f93" Auth-Type := Local, User-Password == "xxxxxx" I am using freeRADIUS 1.1.7 on an OS X 10.4.10 Server machine. My Access Points are currently Apple Airports, but we will be replacing those with Cisco 1131s. Any help at getting this going would be greatly appreciated. Thanks Brad Lachel Community High School District #155 stuff(a)d155.org ----------------------------- All e-mail to and from this address is subject to the Acceptable Use Policies of Community High School District #155. All e-mail may be monitored and/or disclosed to third parties. Any views or opinions presented in an e-mail are solely those of the author and may not represent those of Community High School District #155. Community High School District #155 http://www.d155.org

4 4

weird problem
by Kris 11 Oct '07

11 Oct '07

i`m using Mikrotik (Hotspot) + Freeradius + Mysql + perl postscript to check auth , on perl script i do check quota based on radacct table. if quota more than xxx Gb then you cant login. the problem are like this what the result of accounting different with value that send to NAS. like this modcall: leaving group session (returns ok) for request 1 radius_xlat: '/usr/local/bin/rmauth.pl ADMIN 00:16:17:52:8F:94 172.1.1.248' Exec-Program: /usr/local/bin/rmauth.pl ADMIN 00:16:17:52:8F:94 172.1.1.248 Exec-Program output: Mikrotik-Xmit-Limit = _*762**2654321*_, Mikrotik-Recv-Limit = _*50000000000*_, Ascend-Data-Rate=_*98304*_, Ascend-Xmit-Rate=_*262144*_, Exec-Program-Wait: value-pairs: Mikrotik-Xmit-Limit = _*762**2654321*_, Mikrotik-Recv-Limit = _*50000000000*_, Ascend-Data-Rate=_*98304*_,, Ascend-Xmit-Rate=_*262144*_, Exec-Program: returned: 0 Sending Access-Accept of id 1 to 10.128.3.3 port 1024 Mikrotik-Xmit-Limit = _*3502655261*_ <= Above value is 7622654321 but it send 3502655261 Mikrotik-Recv-Limit = _*2755359744*_ <= Above value is 5000000000 but it send 2755359744 Ascend-Data-Rate = 98304 Ascend-Xmit-Rate = 262144 Finished request 1 any clue bout this problem ?

4 11

Re: configure MSCHAPV2 authentication protocol
by tnt＠kalik.co.yu 11 Oct '07

11 Oct '07

You can start by deleting that. It's totally wrong. That's not a CHAP-Password (it' not encrypted at all) and you can't use that attribute with MS-CHAPv2 anyway. Than read available information: http://wiki.freeradius.org/SQL_HOWTO Start by populating radcheck table, test it, and (when it works) then populate the rest. Ivan Kalik Kalik Informatika ISP Dana 11/10/2007, "yangcuilin" <yangcuilin(a)use.com.cn> piše: >Hi, brother >Yes, I using the Mysql, the data in mysql is attached file (sql.bmp). >What I should do? >

1 0

configure MSCHAPV2 authentication protocol
by yangcuilin 11 Oct '07

11 Oct '07

Hi, Attached is my configuration file. I want to use MSCHAPv2 authentication protocol in my FreeRADIUS. This is my first time to configuration about MSCHAPV2. May be something wrong with the file. Does it need configuration at other file? Please give me some advice. Thank you very much! Appreciated in advance. Rock

5 4

Problem with LDAP and Groups
by Bryan Evege 11 Oct '07

11 Oct '07

Hello all. First off here's what I want to accomplish in the end. Use LDAP as the backend to store all user information including radius attributes, shell info and access to specific devices in specific locations. For example, Johnny needs access to all linux boxes in Atlanta and priv-level 15 on cisco routers in Denver. Fred needs read/write access to all packet shappers in Denver and read only to all cisco devices in Atlanta and Denver. You get the picture. I've setup a test server following the document in /opt/freeradius/share/doc/freeradius/ldap_howto.txt without much difficulty. This method does a good job of allowing only certain groups to access certain devices without messing with the huntgroups. Here's the problem. When a user logs in and is a member of more than one group radius only uses the first one to match. I've included the users file below. For example, if the user is a member of the cisco group and the packeteer group only the packeteer group information gets passed back because it is found before the cisco group. Is there a way to say that the request is from a Cisco box so only look for the user in the cisco group? If the user is then found in that group then pass back the correct attributes from their profile. I know I would have to define what a "cisco box" is, probably by IP. Please let me know if this is even possible and if so provide an example. If it is not possible please provide some direction on how to go about doing this. Freeradius 1.1.7 *_Users file_* DEFAULT Ldap-Group == acct_disabled, Auth-Type := Reject Reply-Message = "Account disabled. Please call the helpdesk." DEFAULT Ldap-Group == packeteer_read_only,User-Profile := "uid=packeteer_read_only,ou=profiles,ou=radius,dc=csctus,dc=net", Auth-Type := LDAP Fall-Through = no DEFAULT Ldap-Group == Packeteer,User-Profile := "uid=Packeteer,ou=profiles,ou=radius,dc=csctus,dc=net", Auth-Type := LDAP Fall-Through = no DEFAULT Ldap-Group == netscreen,User-Profile := "uid=netscreen,ou=profiles,ou=radius,dc=csctus,dc=net", Auth-Type := LDAP Fall-Through = no DEFAULT Ldap-Group == cisco_priv_15,User-Profile := "uid=cisco_priv_15,ou=profiles,ou=radius,dc=csctus,dc=net", Auth-Type := LDAP Fall-Through = no DEFAULT Ldap-Group == cisco_priv_1,User-Profile := "uid=cisco_priv_1,ou=profiles,ou=radius,dc=csctus,dc=net", Auth-Type := LDAP Fall-Through = no DEFAULT Ldap-Group == netscreen,User-Profile := "uid=netscreen,ou=profiles,ou=radius,dc=csctus,dc=net", Auth-Type := LDAP DEFAULT Auth-Type := Reject Reply-Message = "Please call the helpdesk." DEFAULT Auth-Type = System fall-Through = 1 Radiusd.conf ldap section ldap { server = "localhost" identity = "cn=Manager,dc=csctus,dc=net" password = xxxxxxx basedn = "ou=users,ou=radius,dc=csctus,dc=net" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections #start_tls = yes # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" #default_profile = "uid=Packeteer,ou=profiles,ou=radius,dc=csctus,dc=net" #profile_attribute = "radiusProfileDn" #access_attr = "DialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 ldap_cache_timeout = 120 ldap_cache_size = 0 ldap_connections_number = 10 # # NOTICE: The password_header directive is NOT case insensitive # # password_header = "{clear}" # # Set: # password_attribute = nspmPassword # # to get the user's password from a Novell eDirectory # backend. This will work *only if* freeRADIUS is # configured to build with --with-edir option. # # # The server can usually figure this out on its own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # password_attribute = userPassword # # Un-comment the following to disable Novell eDirectory account # policy check and intruder detection. This will work *only if* # FreeRADIUS is configured to build with --with-edir option. # edir_account_policy_check=no # groupname_attribute = radiusGroupName #groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_filter = (&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile)) groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes # # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # You can disable this behavior by setting the following # configuration entry to "no". # # allowed values: {no, yes} # set_auth_type = yes } dn: dc=csctus,dc=net objectClass: dcObject objectClass: organizationUnit ou: csctus.net Radius dc: csctus dn: ou=radius,dc=csctus,dc=net objectclass: organizationalunit ou: radius dn: ou=profiles,ou=radius,dc=csctus,dc=net objectclass: organizationalunit ou: profiles dn: ou=users,ou=radius,dc=csctus,dc=net objectclass: organizationalunit ou: users dn: ou=admins,ou=radius,dc=csctus,dc=net objectclass: organizationalunit ou: admins dn: uid=dial,ou=profiles,ou=radius,dc=csctus,dc=net objectclass: radiusprofile uid: dial radiusServiceType: Framed-User radiusFramedProtocol: PPP radiusFramedIPNetmask: 255.255.255.0 radiusFramedRouting: None dn: uid=cisco,ou=profiles,ou=radius,dc=csctus,dc=net objectclass: radiusprofile uid: cisco radiusReplyItem: Cisco-AVPair ="priv-lvl=15" dn: uid=packeteer,ou=profiles,ou=radius,dc=csctus,dc=net objectclass: radiusprofile uid: packeteer radiusReplyItem: Packeteer-AVPair = "access=touch" dn: uid=isdn,ou=profiles,ou=radius,dc=csctus,dc=net objectclass: radiusprofile uid: isdn radiusServiceType: Framed-User radiusFramedProtocol: PPP radiusFramedIPNetmask: 255.255.255.0 radiusFramedRouting: None dn: uid=example,ou=users,ou=radius,dc=csctus,dc=net objectclass: radiusProfile uid: example userPassword: test radiusGroupName: dial radiusGroupName: isdn dn: uid=bevege,ou=users,ou=radius,dc=csctus,dc=net radiusGroupName: cisco_priv_15 radiusGroupName: Packeteer objectClass: radiusprofile uid: bevege userPassword: {MD5}xxxxxxxxx dn: cn=freeradius,ou=admins,ou=radius,dc=csctus,dc=net objectclass: person sn: freeradius cn: freeradius userPassword: freeradius dn: cn=billing,ou=admins,ou=radius,dc=csctus,dc=net objectclass: person sn: billing cn: billing userPassword: billing dn: cn=replica,ou=admins,ou=radius,dc=csctus,dc=net objectclass: person sn: replica cn: replica userPassword: replica Thanks, BE

3 2

Post-Proxy attr_filter on Access-Accept Packets only
by Mike O'Connor 10 Oct '07

10 Oct '07

Hi Guys How do I only add a radius attribute via attr_filter on Accept-Accept Packets ? My current config is adding the attribute on accounting reply packets also. Thanks Mike

2 4