- Freeradius-Users - lists.freeradius.org

return-codes on reject
by Guido 01 Feb '07

01 Feb '07

Hello list, Im using freeradius-1.1.2 whit ms-sql. I'm having serius problems with return-codes on reject messages. All was working fine with previus version of freeradius. I was reading something about that is not allowed return-codes on reject, but I think it is wrong because most of return-codes goes on reject messages. Only return-code = 0 (authorization succeeded) goes on access=accept. The rest, for example 2 (invalid pin), 9 destination number blocked, 12 insufficient balance, etc etc, are return-codes that go on reject. Please, I need solve this ASAP, Regards, Guido

2 1

FR not honoring AutzType
by Sam Schultz 01 Feb '07

01 Feb '07

I've been trying to set up FR in a realm-based configuration using only LOCAL realms that are passed to different MySQL tables via different instances. This setup, like several previous questions posted to this list for similar setups, requires conditional branching. The solution as suggested in those posts was to use an Autz-Type block within the authorize block, and an Auth-Type block within the authenticate block to use appropriate module instances for the given realm. The problem I am having is that no matter what I set Autz-Type to, or where I set it, FR doesn't seem to honor it. I've tried putting it in hints entries, user entries, and realm entries; all suggestions that had been posted in response to similar issues. Another problem that compounds this one is that different posters refer to Autz-Type differently: autztype, AutzType, & Autz-Type. Is the difference significant, or is this one of those cases where they ALL are valid, but do exactly the same thing? I would have thought there would be some way to use the Realm variable that the rlm_realm strips from the User-Name attribute directly within the Authorize & Authenticate blocks, but it appears the most straight-forward way of using a block like 'realm bogus {}' causes FR to confuse the block for another module instance definition. Any insights anyone may have on this would be appreciated. Following are the relevant configuration & output segments: radiusd.conf, authorize block: Autz-Type SQL-BOGUS { sql-bogus } radiusd.conf, authenticate block: Auth-Type SQL-BOGUS { sql-bogus } hints: DEFAULT Prefix == "BOGUS\", Strip-User-Name = Yes Hint = "MIE Login", Service-Type = Framed-User, Autz-Type := SQL-BOGUS, Auth-Type := SQL-BOGUS users: DEFAULT Realm == "bogus", Autz-Type := SQL-BOGUS mysql bogus realms' radcheck table: +----+----------+---------------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+----------+ | 6 | user | User-Password | == | password | | 7 | user | Auth-Type | := | Local | +----+----------+---------------+----+----------+ radiusd -X -A (snippet 1, module instantiation): rlm_sql (sql-bogus): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql-bogus): Attempting to connect to root@localhost:/radius rlm_sql (sql-bogus): starting 0 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #0 rlm_sql (sql-bogus): Connected new DB handle, #0 rlm_sql (sql-bogus): starting 1 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #1 rlm_sql (sql-bogus): Connected new DB handle, #1 rlm_sql (sql-bogus): starting 2 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #2 rlm_sql (sql-bogus): Connected new DB handle, #2 rlm_sql (sql-bogus): starting 3 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #3 rlm_sql (sql-bogus): Connected new DB handle, #3 rlm_sql (sql-bogus): starting 4 rlm_sql (sql-bogus): Attempting to connect rlm_sql_mysql #4 rlm_sql (sql-bogus): Connected new DB handle, #4 Module: Instantiated sql (sql-bogus) radiusd -X -A (snippet 2, module *NOT* getting used): modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: Looking up realm "bogus" for User-Name = "bogus\user" rlm_realm: Found realm "bogus" rlm_realm: Adding Stripped-User-Name = "user" rlm_realm: Proxying request from user user to realm bogus rlm_realm: Adding Realm = "bogus" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 NOTE: My module order, and the fact that radius found the "bogus" realm means that there should be SQL auth lines appearing immediately after the "mschap returns noop" line. They don't show up, which means FR either wasn't seeing Autz-Type at that point, or some other module changed it. Concerned about your privacy? Instantly send FREE secure email, no account required http://www.hushmail.com/send?l=480 Get the best prices on SSL certificates from Hushmail https://www.hushssl.com?l=485 Concerned about your privacy? Instantly send FREE secure email, no account required http://www.hushmail.com/send?l=480 Get the best prices on SSL certificates from Hushmail https://www.hushssl.com?l=485

2 1

Re: Troube with matching LDAP group membership in authorize
by Richard Hesse 31 Jan '07

31 Jan '07

Nevermind I found the problem. There's a limitation in ldap_groupcmp() such that only the last LDAP module instantiated is actually checked -- ignoring whatever you specify. I found this info from http://lists.cistron.nl/pipermail/freeradius-users/2004-June/033220.html. "In any case the ldap module which will be instantiated last will be the one that will handle ldap-group comparisons. If we add a check that will change to the first ldap module which is instantiated. I think it's more or less a matter of personal taste, which module we 'd like to handle ldap-group comparisons. Is it really worth the effort. Users can just change the order in which the ldap modules are instantiated in order to achieve what they want." Rather disappointing that this limitation still exists from 2 years ago. Does FR2.0 have some sort of object-based virtualization that would support this? Like, a "LDAP group" object which you could tie LDAP instances to and make the check there? -richard ----- Original Message ---- From: Richard Hesse <rhesse(a)yahoo.com> To: freeradius-users(a)lists.freeradius.org Sent: Tuesday, January 30, 2007 12:40:36 PM Subject: Troube with matching LDAP group membership in authorize I'm trying to setup radius authentication for enable access on our networking gear and having a tough time getting a working config. I'd like to have FR check a group in LDAP for membership before authorizing. That is, I only want user's listed in the "uniquemember" attribute of the Operations group object to be granted access. Reading the FR docs this is possible -- I must be missing something. First, here are the relevant portions of my configs: Hint file: DEFAULT NAS-Port-Type == Virtual, Service-Type == NAS-Prompt-User, ldap_enable-Ldap-Group := "operations", Autz-Type := ldap_enable, Auth-Type := LDAP radius.conf: ldap ldap_enable{ server = "fds1.hq.powerset.com" basedn = "dc=powerset,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes tls_cacertfile = /opt/fedora-ds/alias/starfield.pem tls_require_cert = "demand" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # ldap_debug = 1 # groupname_attribute = cn groupmembership_filter = "(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))" timeout = 4 timelimit = 3 net_timeout = 3 # compare_check_items = yes # do_xlat = yes access_attr_used_for_allow = no set_auth_type = no } I have several LDAP instances defined in radius.config, but this is the one I want to use. I instantiate it first in radius.config so that hints can use it: instantiate { ldap_enable exec expr } And a corresponsing Autz-Type in radius.config: authorize { preprocess suffix ntdomain eap autztype ldap{ redundant { fds1 # fds2 } } autztype ldap_enable{ ldap_enable } files pap } Here's the debug output from when I try and connect: rad_recv: Access-Request packet from host 64.13.145.238:1024, id=96, length=71 User-Name = "dick" User-Password = "$$$$$$$$" NAS-IP-Address = 64.13.145.238 NAS-Identifier = "h2848-1" NAS-Port-Type = Virtual Service-Type = NAS-Prompt-User Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 35 <--- This is the correct entry modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "dick", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "dick", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 It appears that FR is ignoring the Autz-Type I set in hints and just processes the entries in authorize in sequential order. This is the default behavior unless an Autz-Type is explicitly set (which I do in hints). How do I get the Autz-Type to kick-in and have FR send the request to the proper LDAP entry? Thanks in advance, -richard ____________________________________________________________________________________ Sucker-punch spam with award-winning protection. Try the free Yahoo! Mail Beta. http://advision.webevents.yahoo.com/mailbeta/features_spam.html ____________________________________________________________________________________ Now that's room service! Choose from over 150,000 hotels in 45,000 destinations on Yahoo! Travel to find your fit. http://farechase.yahoo.com/promo-generic-14795097

3 2

Re: Troube with matching LDAP group membership in authorize
by Richard Hesse 31 Jan '07

31 Jan '07

> In any case, if you carefully read the text you quoted, you'll see a > solution that doesn't require patches: List ALL ldap modules in the >"instantiate" section, and list "ldap_enable" last. > Alan DeKok. Yes, that's what I ended up doing. However, I lose the ability to do load-balance and redunancy constructs. rlm_ldap indicates that I can list multiple LDAP servers for the host in radius.conf. How exactly does that work compared to redundancy or load-balance? Does it try the first, then the second, etc every time? Does it round-robin? Thanks, -richard ____________________________________________________________________________________ Want to start your own business? Learn how on Yahoo! Small Business. http://smallbusiness.yahoo.com/r-index

2 1

Troube with matching LDAP group membership in authorize
by Richard Hesse 30 Jan '07

30 Jan '07

I'm trying to setup radius authentication for enable access on our networking gear and having a tough time getting a working config. I'd like to have FR check a group in LDAP for membership before authorizing. That is, I only want user's listed in the "uniquemember" attribute of the Operations group object to be granted access. Reading the FR docs this is possible -- I must be missing something. First, here are the relevant portions of my configs: Hint file: DEFAULT NAS-Port-Type == Virtual, Service-Type == NAS-Prompt-User, ldap_enable-Ldap-Group := "operations", Autz-Type := ldap_enable, Auth-Type := LDAP radius.conf: ldap ldap_enable{ server = "fds1.hq.powerset.com" basedn = "dc=powerset,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes tls_cacertfile = /opt/fedora-ds/alias/starfield.pem tls_require_cert = "demand" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # ldap_debug = 1 # groupname_attribute = cn groupmembership_filter = "(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))" timeout = 4 timelimit = 3 net_timeout = 3 # compare_check_items = yes # do_xlat = yes access_attr_used_for_allow = no set_auth_type = no } I have several LDAP instances defined in radius.config, but this is the one I want to use. I instantiate it first in radius.config so that hints can use it: instantiate { ldap_enable exec expr } And a corresponsing Autz-Type in radius.config: authorize { preprocess suffix ntdomain eap autztype ldap{ redundant { fds1 # fds2 } } autztype ldap_enable{ ldap_enable } files pap } Here's the debug output from when I try and connect: rad_recv: Access-Request packet from host 64.13.145.238:1024, id=96, length=71 User-Name = "dick" User-Password = "$$$$$$$$" NAS-IP-Address = 64.13.145.238 NAS-Identifier = "h2848-1" NAS-Port-Type = Virtual Service-Type = NAS-Prompt-User Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 35 <--- This is the correct entry modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "dick", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "dick", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 It appears that FR is ignoring the Autz-Type I set in hints and just processes the entries in authorize in sequential order. This is the default behavior unless an Autz-Type is explicitly set (which I do in hints). How do I get the Autz-Type to kick-in and have FR send the request to the proper LDAP entry? Thanks in advance, -richard ____________________________________________________________________________________ Sucker-punch spam with award-winning protection. Try the free Yahoo! Mail Beta. http://advision.webevents.yahoo.com/mailbeta/features_spam.html

1 0

LAN accounting
by Mohsen Pahlevanzadeh 30 Jan '07

30 Jan '07

I'm newbie,I wanna know that can i use FreeRadius+Dialup_admin as a LAN accounting? --Mohsen

4 5

strange error in freeradius
by Semenenko Pavel 30 Jan '07

30 Jan '07

I have 2.6.18-gentoo-r6 kernel, and freeradius-1.1.3-r2 I correctly configure radius for working with certificates in debug mode (radiusd -fX), then add it into init scripts, and try to start... Ooops!.. it don't start ;( # /usr/sbin/radiusd Sun Jan 28 20:58:13 2007 : Info: Starting - reading configuration files ... # In log only: # cat /var/log/radius/radius.log | tail -n 1 Sun Jan 28 20:58:13 2007 : Info: rlm_eap_tls: Loading the certificate file as a chain # I'll read closely all comments in radiusd.conf, and I check that all rlm_ libs is accessible for radius... I try start radius with root:root user and group, without result. All permissions (/etc/raddb, /var/log, /var/run) set radiusd:radiusd. It won't work. But in debug mode all work correct. strace -f /usr/sbin/radiusd shows that cloned process can't open pipe (I also check all rlm_*'s load correct) clone(Process 25483 attached child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7df66f8) = 25483 [pid 25483] getsockname(3, {sa_family=AF_INET, sin_port=htons(36102), sin_addr=inet_addr("192.168.1.5")}, [16]) = 0 [pid 25482] exit_group(0) = ? [pid 25483] getpeername(3, Process 25482 detached {sa_family=AF_INET, sin_port=htons(636), sin_addr=inet_addr("192.168.1.5")}, [16]) = 0 fcntl64(3, F_GETFD) = 0x1 (flags FD_CLOEXEC) dup(3) = 6 fcntl64(6, F_SETFD, FD_CLOEXEC) = 0 socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 7 close(3) = 0 fcntl64(7, F_GETFD) = 0 dup2(7, 3) = 3 fcntl64(3, F_SETFD, 0) = 0 close(7) = 0 write(3, "\25\3\1\0 \256\376\323d\204\16\217\227\337\343oX\237\5"..., 37) = -1 EPIPE (Broken pipe) --- SIGPIPE (Broken pipe) @ 0 (0) --- Process 25483 detached I try rebuild radius, try version 1.1.4, without result. Any ideas?..

2 3

Freeradius and Oracle under Cygwin
by Brian Atkins 30 Jan '07

30 Jan '07

I'm working on using Freeradius with Chillispot to authenticate from an Oracle database. Freeradius is running on W2K3 server and Oracle is installed on the local machine. At this point, I'm trying to compile the rlr_sql_oracle module, but keep getting: $ ./configure --with-oracle-home-dir=/cygdrive/d/oracle/ora92 ... "configure: WARNING: oracle headers not found. Use \ --with-oracle-home-dir=<path> configure: WARNING: sql submodule 'oracle' disabled" ... I have set ORACLE_HOME to the Cygwin path: ORACLE_HOME=/cygdrive/d/oracle/ora92/ Is anyone currently authenticating against Oracle that might be able to offer pointers? I do have the alternative of compiling on a true linux server as opposed to a W2K3 box, but the architecture is different (AMD em64T instead of x86). -- Brian "An adventure is never an adventure when it's happening. Challenging experiences need time to ferment, and an adventure is simply physical and emotional discomfort recollected in tranquility." -- Tim Cahill

2 3

RPM Build-error
by King, Michael 30 Jan '07

30 Jan '07

I'm trying to create a Redhat RPM from the nightly CVS snapshots. (Following the Wiki instructions) I've tried a few different snapshot dates, and they all die with the attached error. I'm not too familiar with RedHat packaging. Any idea what I've done wrong? Checking for unpackaged file(s): /usr/lib/rpm/check-files /var/tmp/freeradius-root error: Installed (but unpackaged) file(s) found: /usr/include/freeradius/hash.h /usr/include/freeradius/libradius.h /usr/include/freeradius/md4.h /usr/include/freeradius/md5.h /usr/include/freeradius/missing.h /usr/include/freeradius/packet.h /usr/include/freeradius/radius.h /usr/include/freeradius/radpaths.h /usr/include/freeradius/sha1.h /usr/include/freeradius/token.h /usr/include/freeradius/udpfromto.h RPM build errors: Installed (but unpackaged) file(s) found: /usr/include/freeradius/hash.h /usr/include/freeradius/libradius.h /usr/include/freeradius/md4.h /usr/include/freeradius/md5.h /usr/include/freeradius/missing.h /usr/include/freeradius/packet.h /usr/include/freeradius/radius.h /usr/include/freeradius/radpaths.h /usr/include/freeradius/sha1.h /usr/include/freeradius/token.h /usr/include/freeradius/udpfromto.h

2 6

RSA / Smart Cards
by Joseph 30 Jan '07

30 Jan '07

Does anyone have pointers on setting up a solution where freeradius authenticates against an RSA Secure ID or a smart card? Is there a good package that supports some sort of standard password-less authentication? Any experiences using smart cards or RSA Secure IDs with Linux would be welcomed. respectfully, Joseph

3 4