- Freeradius-Users - lists.freeradius.org

Auth-Type in post-auth SQL insert
by Brad Robel-Forrest 28 Jul '07

28 Jul '07

I'm pretty new to FreeRADIUS so I apologize if this is a really basic question. I've searched around quite a bit and have been unable to locate an answer. I've successfully configured FreeRADIUS to use a SQL driver for authentication checks as well as inserting records via the post-auth query. Is there a runtime variable that I can reference to save the Auth-Type used for authenticating the user during post-auth? I've tried what I thought to be the obvious (e.g. %{Auth-Type}) but that doesn't seem to be available (just inserts an empty string). Essentially, I'd like to catalog the type of authentication that was used for authorizing a user (assuming it was successful, of course). For example, user Joe authenticated via PAP. -brad

2 1

EXEC question w/ LDAP Attributes
by Reynold McGuire 28 Jul '07

28 Jul '07

Hello all, I have a question regarding returning attributes from LDAP with freeRadius. I need to do some logic comparing and the only way I have been able to get close is to use the post-auth section, enable 'exec' and push out some data to an external program were I can do some patter matching. Now I have this working just fine with LDAP, the DN and search filter is fine etc. What I want to do is return other attributes from LDAP to be included in the radius reply. I have added the following to "dictionary_mapping = ${raddbdir}/ldap.attrmap" checkItem employeeType employeeType When I run the server in debug mode, I see that it is in fact returning the value of the employeeType from LDAP. The question revolves around how to pass that out to my test program for validation? I have been able to pass out everything that is in the initial radius request, but nothing else. I have tried to modify the program line below to also send out %{employeeType} %{check:employeeType} %{request:employeeType} %{reply:employeeType} None of those work. I have even tried along the lines of %{modules.ldap.checkval} I can't seem to get it to work. Any help would be appreciated. Blow is a snip of the radius configuration file, and the little program I have seen in the user groups to echo out the responses that I am using to test. I have verified that if I return a '0' the request is accepted, and a '1' will reject the request... That part works fine. Also below is parts of the debug dump. I don't have the actual connection portion of the log as I am at a remote site currently, I can send that along also if people think it will be of benefit. Thanks for any assistance! - Reynold radius.conf ----------- exec { wait = yes input_pairs = request program = '${raddbdir}/test.sh %u %{Called-Station-Id}' } test.sh ------- #!/bin/bash echo "A: $1" echo "B: $2" echo "C: $3" exit 0 radiusd -X ---------- Module: Loaded exec exec: wait = yes exec: program = "/etc/raddb/test.sh %u %{Called-Station-Id}" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Loaded LDAP ldap: server = "<ldapserver>" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "admin" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "pwd" ldap: basedn = "base-dn" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectClass=user)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userpassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupO fUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP employeeType mapped to RADIUS employeeType conns: 0x8115218 Module: Instantiated ldap (ldap)

1 0

RE: Freeradius & Juniper
by J-P Raymond 27 Jul '07

27 Jul '07

> > I'm using freeradius 0.9.3 (mandrake 10) to authenticate pppoe users ! > > > > When a juniper equipment try to authenticate it fails! (most other brand > > succed) They told me the field order are not send in the good order...> > First of all, I have no idea what you are doing from your explanation... > you are authenticating the PPPoE users, so I would think that you are > the ISP yourself.> As a mather of fact I'm working for an ISP ! > - What is the role of the Juniper device? (The device that is requesting > the connection? The device that is receiving the connection?)> - Exactly what kind of equipment is on the other end of the line?> - Which device is communicating with FreeRADIUS? Our equipment ISP is a Xedia router (Lucent AP) The authentication is done via Freeradius 0.9.3 running on mdk 10 The juniper equipment is on one of our client side, and it's the only equipment that won't authenticate at all In the radius users file we have the following: username(a)domain.com Auth-Type := Local, User-Password == "edc852" Service-Type = Login, Framed-Protocol = PPP, Framed-Address = 200.100.50.25, Xedia-DNS-Server = 175.200.225.250, XEDIA-PPP-ECHO-INTERVAL = 30 To answer the other question : No I didn't try with the latest version I'm having problems installing it (1.1.6) on this distribution (mdk 10) Thanks for your reply> > > : SEND DECODE:(ethernet0/0) ***[IPCP ConfReq ID=0x1> > <ADDR 0.0.0.0> <DNS_P 0.0.0.0> <DNS_S 0.0.0.0> <NBNS_P 0.0.0.0> <NBNS_S > > 0.0.0.0>]***> > > > RECV DECODE:(ethernet0/0)> > ***[IPCP ConfRej ID=0x1 <NBNS_P 0.0.0.0> <DNS_S 0.0.0.0> <NBNS_S > > 0.0.0.0>]***> > > > Can I do something about this rapidely> > This does not look like a RADIUS problem. One of your PPP peers (the one > on the other end of the line) is mangling its responses and the device > from which you posted the logs is not accepting that (as it should, like > you already indicated yourself). This is a PPPoE problem.> > Gtnx> Marcel> - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _________________________________________________________________ Soyez parmi les premiers à essayer Windows Live Mail. http://ideas.live.com/programpage.aspx?versionId=5d21c51a-b161-4314-9b0e-49…

2 1

SQL read_group patch - please apply!
by Roy Walker 27 Jul '07

27 Jul '07

FOR THE SAKE OF MY SANITY!!! Please apply the patch from http://readlist.com/lists/lists.freeradius.org/freeradius-users/2/10462. html, which was posted 3 and a half months ago! PLEASE, pretty please, with sugar on top! Thanks, Roy

2 1

Authorize after checking an LDAP attribute value
by Kenneth Marshall 27 Jul '07

27 Jul '07

Dear Freeradius users: I am trying to set up my authentication to allow only users with a particular value of a particular LDAP attribute to login. I am using freeradius 1.1.7 and I have the authentication going against Kerberos but I do not know how to have the radius server check the value of the attribute before allow access. If they are not in the group, it should send back the reject packet. Does anyone know how to perform a check item check against a particular LDAP attribute? Here is how I can set an attribute to the value and it works correctly: DEFAULT Auth-Type = Kerberos, NAS-IP-Address == 1.2.3.4, NAS-Port == 10 Connect-Info = "%{ldap:ldap:///dc=test,dc=com?testValue?sub?uid=%u}" Any suggestions would be appreciated. Regards, Ken Marshall

1 0

Openldap - Freeradius - auto vlan
by Fabio Silva 27 Jul '07

27 Jul '07

Hi all, i need to configure a system that works with openldap + freeradius and that assign the vlan automatic to the users... does anybody has any howto to do it? I read this one: http://www.freeradius.org/radiusd/doc/ldap_howto.txt but, the versions of the softwares is very old, and in some parts of the howto some options does not work. Regards, Fabio

2 2

Freeradius & Juniper
by J-P Raymond 27 Jul '07

27 Jul '07

Hi, small question I know my version is old but I didn't had any problem until recently ! I'm using freeradius 0.9.3 (mandrake 10) to authenticate pppoe users ! When a juniper equipment try to authenticate it fails! (most other brand succed) They told me the field order are not send in the good order... Here is the detail reason juniper gave me : Root cause found, it is caused by that peer side modifies the options order in REJ packet. RFC1661 requires we keep the order so we think the REJ packet is invalid and drop it. So PPP can not be brought UP. Could we contact the ISP to check how they software work? sending order : [DNS_S]-->[NBNS_P]-->[NBNS_S] : SEND DECODE:(ethernet0/0) ***[IPCP ConfReq ID=0x1 <ADDR 0.0.0.0> <DNS_P 0.0.0.0> <DNS_S 0.0.0.0> <NBNS_P 0.0.0.0> <NBNS_S 0.0.0.0>]*** --------------------------------------------------------------- Receiving order, [NBNS_P]-->[DNS_S]-->[NBNS_S] RECV DECODE:(ethernet0/0) ***[IPCP ConfRej ID=0x1 <NBNS_P 0.0.0.0> <DNS_S 0.0.0.0> <NBNS_S 0.0.0.0>]*** Can I do something about this rapidely Thanks for your help _________________________________________________________________ Soyez parmi les premiers à essayer Windows Live Mail. http://ideas.live.com/programpage.aspx?versionId=5d21c51a-b161-4314-9b0e-49…

3 2

radiusd startup problem
by ram 27 Jul '07

27 Jul '07

Hi all I have installed freeradius-1.1.6 with mysql when i run radiusd -X i get the following error rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" rlm_acct_unique: Cannot find attribute 'NAS-IP-Address' in dictionary radiusd.conf[1159]: acct_unique: Module instantiation failed. radiusd.conf[1753] Unknown module "acct_unique". radiusd.conf[1747] Failed to parse preacct section. any suggestions ram

3 10

SQLIPPool performance issue
by Roy Walker 26 Jul '07

26 Jul '07

I am having a problem with the SQLIPPOOL performance. This is migration of an existing radius server using flat user files (old server is running radius 1.1.0). Running freeradius-server-snapshot-20070705 on a P4 2.8GHZ machine Database is Postgres 8.1.9 running on a monstrous Sun Opteron machine. When radius starts taking requests (it's a lot of requests, about 500/sec), the load on the radius server spikes to 100 and it eventually stops taking requests completely. The database is never above 0.05 load. I see messages like these in the radius logs: Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14696841693 port 0 user 14696841693) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 19723023688 port 0 user 19723023688) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14696845996 port 0 user 14696845996) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14696846177 port 0 user 14696846177) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14696825390 port 0 user 14696825390) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14694415538 port 0 user 14694415538) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 14696883664 port 0 user 14696883664) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 12149915071 port 0 user 12149915071) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 19728908614 port 0 user 19728908614) Wed Jul 25 10:29:15 2007 : Info: IP Allocation FAILED from general_pool (did slogic.t-mobile.com cli 19723023948 port 0 user 19723023948) Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 102 due to unfinished request 3988 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 62 due to unfinished request 3987 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 116 due to unfinished request 3989 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 121 due to unfinished request 3990 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 26 due to unfinished request 3991 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 105 due to unfinished request 3992 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 74 due to unfinished request 3993 Wed Jul 25 10:29:15 2007 : Error: Discarding duplicate request from client nas01 port 1812 - ID: 29 due to unfinished request 3994 Wed Jul 25 10:29:15 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed Jul 25 10:29:15 2007 : Auth: Login OK: [12146063348] (from client nas01 port 0 cli 12146063348) I have tried playing with the numbers of threads (I used the current radius servers setting to start) and the results are the same. Anyone have any ideas? Thanks, Roy

4 15

Freeradius Multiple VLAN assigment
by George Beitis 26 Jul '07

26 Jul '07

Hi everyone, does freeradius support multiple vlan assigment?

3 2