- Freeradius-Users - lists.freeradius.org

Re: Troube with matching LDAP group membership in authorize
by Richard Hesse 31 Jan '07

31 Jan '07

> In any case, if you carefully read the text you quoted, you'll see a > solution that doesn't require patches: List ALL ldap modules in the >"instantiate" section, and list "ldap_enable" last. > Alan DeKok. Yes, that's what I ended up doing. However, I lose the ability to do load-balance and redunancy constructs. rlm_ldap indicates that I can list multiple LDAP servers for the host in radius.conf. How exactly does that work compared to redundancy or load-balance? Does it try the first, then the second, etc every time? Does it round-robin? Thanks, -richard ____________________________________________________________________________________ Want to start your own business? Learn how on Yahoo! Small Business. http://smallbusiness.yahoo.com/r-index

2 1

Troube with matching LDAP group membership in authorize
by Richard Hesse 30 Jan '07

30 Jan '07

I'm trying to setup radius authentication for enable access on our networking gear and having a tough time getting a working config. I'd like to have FR check a group in LDAP for membership before authorizing. That is, I only want user's listed in the "uniquemember" attribute of the Operations group object to be granted access. Reading the FR docs this is possible -- I must be missing something. First, here are the relevant portions of my configs: Hint file: DEFAULT NAS-Port-Type == Virtual, Service-Type == NAS-Prompt-User, ldap_enable-Ldap-Group := "operations", Autz-Type := ldap_enable, Auth-Type := LDAP radius.conf: ldap ldap_enable{ server = "fds1.hq.powerset.com" basedn = "dc=powerset,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes tls_cacertfile = /opt/fedora-ds/alias/starfield.pem tls_require_cert = "demand" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # ldap_debug = 1 # groupname_attribute = cn groupmembership_filter = "(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))" timeout = 4 timelimit = 3 net_timeout = 3 # compare_check_items = yes # do_xlat = yes access_attr_used_for_allow = no set_auth_type = no } I have several LDAP instances defined in radius.config, but this is the one I want to use. I instantiate it first in radius.config so that hints can use it: instantiate { ldap_enable exec expr } And a corresponsing Autz-Type in radius.config: authorize { preprocess suffix ntdomain eap autztype ldap{ redundant { fds1 # fds2 } } autztype ldap_enable{ ldap_enable } files pap } Here's the debug output from when I try and connect: rad_recv: Access-Request packet from host 64.13.145.238:1024, id=96, length=71 User-Name = "dick" User-Password = "$$$$$$$$" NAS-IP-Address = 64.13.145.238 NAS-Identifier = "h2848-1" NAS-Port-Type = Virtual Service-Type = NAS-Prompt-User Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 35 <--- This is the correct entry modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "dick", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "dick", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 It appears that FR is ignoring the Autz-Type I set in hints and just processes the entries in authorize in sequential order. This is the default behavior unless an Autz-Type is explicitly set (which I do in hints). How do I get the Autz-Type to kick-in and have FR send the request to the proper LDAP entry? Thanks in advance, -richard ____________________________________________________________________________________ Sucker-punch spam with award-winning protection. Try the free Yahoo! Mail Beta. http://advision.webevents.yahoo.com/mailbeta/features_spam.html

1 0

LAN accounting
by Mohsen Pahlevanzadeh 30 Jan '07

30 Jan '07

I'm newbie,I wanna know that can i use FreeRadius+Dialup_admin as a LAN accounting? --Mohsen

4 5

strange error in freeradius
by Semenenko Pavel 30 Jan '07

30 Jan '07

I have 2.6.18-gentoo-r6 kernel, and freeradius-1.1.3-r2 I correctly configure radius for working with certificates in debug mode (radiusd -fX), then add it into init scripts, and try to start... Ooops!.. it don't start ;( # /usr/sbin/radiusd Sun Jan 28 20:58:13 2007 : Info: Starting - reading configuration files ... # In log only: # cat /var/log/radius/radius.log | tail -n 1 Sun Jan 28 20:58:13 2007 : Info: rlm_eap_tls: Loading the certificate file as a chain # I'll read closely all comments in radiusd.conf, and I check that all rlm_ libs is accessible for radius... I try start radius with root:root user and group, without result. All permissions (/etc/raddb, /var/log, /var/run) set radiusd:radiusd. It won't work. But in debug mode all work correct. strace -f /usr/sbin/radiusd shows that cloned process can't open pipe (I also check all rlm_*'s load correct) clone(Process 25483 attached child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7df66f8) = 25483 [pid 25483] getsockname(3, {sa_family=AF_INET, sin_port=htons(36102), sin_addr=inet_addr("192.168.1.5")}, [16]) = 0 [pid 25482] exit_group(0) = ? [pid 25483] getpeername(3, Process 25482 detached {sa_family=AF_INET, sin_port=htons(636), sin_addr=inet_addr("192.168.1.5")}, [16]) = 0 fcntl64(3, F_GETFD) = 0x1 (flags FD_CLOEXEC) dup(3) = 6 fcntl64(6, F_SETFD, FD_CLOEXEC) = 0 socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 7 close(3) = 0 fcntl64(7, F_GETFD) = 0 dup2(7, 3) = 3 fcntl64(3, F_SETFD, 0) = 0 close(7) = 0 write(3, "\25\3\1\0 \256\376\323d\204\16\217\227\337\343oX\237\5"..., 37) = -1 EPIPE (Broken pipe) --- SIGPIPE (Broken pipe) @ 0 (0) --- Process 25483 detached I try rebuild radius, try version 1.1.4, without result. Any ideas?..

2 3

Freeradius and Oracle under Cygwin
by Brian Atkins 30 Jan '07

30 Jan '07

I'm working on using Freeradius with Chillispot to authenticate from an Oracle database. Freeradius is running on W2K3 server and Oracle is installed on the local machine. At this point, I'm trying to compile the rlr_sql_oracle module, but keep getting: $ ./configure --with-oracle-home-dir=/cygdrive/d/oracle/ora92 ... "configure: WARNING: oracle headers not found. Use \ --with-oracle-home-dir=<path> configure: WARNING: sql submodule 'oracle' disabled" ... I have set ORACLE_HOME to the Cygwin path: ORACLE_HOME=/cygdrive/d/oracle/ora92/ Is anyone currently authenticating against Oracle that might be able to offer pointers? I do have the alternative of compiling on a true linux server as opposed to a W2K3 box, but the architecture is different (AMD em64T instead of x86). -- Brian "An adventure is never an adventure when it's happening. Challenging experiences need time to ferment, and an adventure is simply physical and emotional discomfort recollected in tranquility." -- Tim Cahill

2 3

RPM Build-error
by King, Michael 30 Jan '07

30 Jan '07

I'm trying to create a Redhat RPM from the nightly CVS snapshots. (Following the Wiki instructions) I've tried a few different snapshot dates, and they all die with the attached error. I'm not too familiar with RedHat packaging. Any idea what I've done wrong? Checking for unpackaged file(s): /usr/lib/rpm/check-files /var/tmp/freeradius-root error: Installed (but unpackaged) file(s) found: /usr/include/freeradius/hash.h /usr/include/freeradius/libradius.h /usr/include/freeradius/md4.h /usr/include/freeradius/md5.h /usr/include/freeradius/missing.h /usr/include/freeradius/packet.h /usr/include/freeradius/radius.h /usr/include/freeradius/radpaths.h /usr/include/freeradius/sha1.h /usr/include/freeradius/token.h /usr/include/freeradius/udpfromto.h RPM build errors: Installed (but unpackaged) file(s) found: /usr/include/freeradius/hash.h /usr/include/freeradius/libradius.h /usr/include/freeradius/md4.h /usr/include/freeradius/md5.h /usr/include/freeradius/missing.h /usr/include/freeradius/packet.h /usr/include/freeradius/radius.h /usr/include/freeradius/radpaths.h /usr/include/freeradius/sha1.h /usr/include/freeradius/token.h /usr/include/freeradius/udpfromto.h

2 6

RSA / Smart Cards
by Joseph 30 Jan '07

30 Jan '07

Does anyone have pointers on setting up a solution where freeradius authenticates against an RSA Secure ID or a smart card? Is there a good package that supports some sort of standard password-less authentication? Any experiences using smart cards or RSA Secure IDs with Linux would be welcomed. respectfully, Joseph

3 4

(no subject)
by Jorge Martinez de Salinas Vazquez 30 Jan '07

30 Jan '07

Hello everybody! We are trying to assign configuration parameters to the supplicants based on RADIUS decision. I would like to know is someone else is working on it and if there is an easy way to send this parameters directly to the supplicant. I have read the RFC 4014 which shows a way to assign network configuration to the supplicant through a DHCP server, but it is very specific (just networking options). Thanks in advance.

2 1

radiusd and oracle accounting
by Dourty, Brian R. (IATS) 30 Jan '07

30 Jan '07

We have configured our radius servers to send accounting information to an Oracle database. It works our really well except when the oraclce database server isn't available (I.E. maintenance or cold backups). The radius process dies when it loses connectivity to the oracle server. Has anyone else noticed this problem? Any suggestions on how to make radiusd more robust and able to recover from this? Thanks, Brian Dourty System Administrator - Team Lead IAT Services University of Missouri - Columbia 573-882-1035

4 4

RE: LAN accounting
by Josh Howlett 29 Jan '07

29 Jan '07

> >>>I'm newbie,I wanna know that can i use FreeRadius+Dialup_admin as a > >>>LAN accounting? > >>It means that i use them without dialing? > > > > the name "dialup"_admin is a bit misleading. You can as > well manage LAN users > > with them. > > It's a generic user management system. > > agree if RADIUS is used to authenticate users, > but they're asking about accounting. > Besides there's no way to prevent connection to LAN switches > with RADIUS Yes - 802.1x > and restrict internal communication between local hosts. Kinda - Dynamic VLAN allocation. Josh.

2 1