- Freeradius-Users - lists.freeradius.org

LDAP->RADIUS Attribute Mapping
by Owen DeLong 08 Dec '06

08 Dec '06

I have an environment where I am already using LDAP for AAA for a number of things. We have historically used the AuthorizedService attribute in LDAP to control the level of access available to the user. We would like to continue to do so. However, in order for that to work, I need to map AuthorizedService to different RADIUS attributes in the response depending on the authentication client. Ideally, I'd like to be able to map RADIUS clients into "groups" and have a mapping of AuthorizedService values for each group. The client groups would, ideally, be defined by matching the client IP address. An example of what I'd like that mapping to look like is below: Client Group AuthorizedService RADIUS Attribute in Reply ============== ====================== ======================= PIX Group 1 Pix1Auth1 cisco-avpair="shell:priv-lvl=1" PIX Group 1 Pix1Auth7 cisco-avpair="shell:priv-lvl=7" PIX Group 1 Pix1Auth15 cisco-avpair="shell:priv-lvl=15" PIX Group 2 Pix2auth1 cisco-avpair="shell:priv-lvl=1" ... Router Grp 1 Rtr1Auth1 cisco-avpair="shell:priv-lvl=1" ... LB Group 1 LBAdmin Service-Type="Authenticate-Only" ... etc. Is there any way to do this kind of dynamic mapping in FreeRadius? As near as I can tell, all I can do is statically map the contents of a particular LDAP attribute to a single RADIUS attribute. I'd also like to avoid mapping values of AuthorizedService which don't apply to the particular RADIUS client. I'm assuming I probably need to use something like rlm_perl to do this, and, I have no problem doing that, but, I have been unable to decipher the documentation to rlm_perl enough to have any confidence in creating a working solution. If anyone could provide a configuration example or a pointer to documentation that actually describes the various pieces of solving this problem, I'd be very grateful. Alan, your flames and RTFM comments are welcome, but, please understand, I've done my best to RTFM before posting this. Owen

2 1

FreeRadius + Ldap + EAP-TTLS + WPA - Need your help
by Tho Nguyen 08 Dec '06

08 Dec '06

Hello Everyone, I am trying to configure our system to authenticate through LDAP. I have hard time to figure out what cause my system not working. Please view the log and let me know what I can fix. Thanks very much for your help in advance. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 2560 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "before" main: nospace_pass = "before" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "clear" Module: Instantiated pap (pap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "134.29.247.4" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=ldapbs,o=mctc" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "blue" ldap: basedn = "o=mctc" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "memberUid" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x8143ff8 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 120 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/cacert.pem" tls: private_key_password = "(null)" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "mschapv2" ttls: copy_request_to_tunnel = yes ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = yes peap: use_tunneled_reply = yes peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 134.29.241.113:1645, id=21, length=138 User-Name = "nguyenth" Framed-MTU = 1400 Called-Station-Id = "0013.7f9c.4540" Calling-Station-Id = "0090.96a8.4ba8" Service-Type = Login-User Message-Authenticator = 0x52337bcf72211a5860ac267041436532 EAP-Message = 0x0202000d016e677579656e7468 NAS-Port-Type = Wireless-802.11 NAS-Port = 263 NAS-IP-Address = 134.29.241.113 NAS-Identifier = "TestAP-1230" rad_rmspace_pair: User-Name now 'nguyenth' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "nguyenth", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for nguyenth radius_xlat: '(uid=nguyenth)' radius_xlat: 'o=mctc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 134.29.247.4:389, authentication 0 rlm_ldap: bind as cn=ldapbs,o=mctc/blue to 134.29.247.4:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=mctc, with filter (uid=nguyenth) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user nguyenth authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 21 to 134.29.241.113 port 1645 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7dfc4b2266e4a6b1bb83e9deb151890a Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 134.29.241.113:1645, id=22, length=149 User-Name = "nguyenth" Framed-MTU = 1400 Called-Station-Id = "0013.7f9c.4540" Calling-Station-Id = "0090.96a8.4ba8" Service-Type = Login-User Message-Authenticator = 0x9186ac40b5451c140582accf952af964 EAP-Message = 0x020300060319 NAS-Port-Type = Wireless-802.11 NAS-Port = 263 State = 0x7dfc4b2266e4a6b1bb83e9deb151890a NAS-IP-Address = 134.29.241.113 NAS-Identifier = "TestAP-1230" rad_rmspace_pair: User-Name now 'nguyenth' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "nguyenth", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for nguyenth radius_xlat: '(uid=nguyenth)' radius_xlat: 'o=mctc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=mctc, with filter (uid=nguyenth) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user nguyenth authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 22 to 134.29.241.113 port 1645 EAP-Message = 0x010400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x24998debc7b4e81250bc4802815043b9 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 134.29.241.113:1645, id=23, length=223 User-Name = "nguyenth" Framed-MTU = 1400 Called-Station-Id = "0013.7f9c.4540" Calling-Station-Id = "0090.96a8.4ba8" Service-Type = Login-User Message-Authenticator = 0xe1b509abc0e1c7c6e03b28c2b085372c EAP-Message = 0x0204005019800000004616030100410100003d03014578dbab47aec1acc6aa12b3578cf154ec4d8bdc63f30d0509eda11dbe5d6dd700001600040005000a000900640062000300060013001200630100 NAS-Port-Type = Wireless-802.11 NAS-Port = 263 State = 0x24998debc7b4e81250bc4802815043b9 NAS-IP-Address = 134.29.241.113 NAS-Identifier = "TestAP-1230" rad_rmspace_pair: User-Name now 'nguyenth' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "nguyenth", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for nguyenth radius_xlat: '(uid=nguyenth)' radius_xlat: 'o=mctc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=mctc, with filter (uid=nguyenth) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user nguyenth authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization TLS_accept: SSLv3 read client hello A TLS_accept: SSLv3 write server hello A TLS_accept: SSLv3 write certificate A TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 23 to 134.29.241.113 port 1645 EAP-Message = 0x010503201900160301004a020000460301457983f6da9f7ae228ff4e8f219624a0ecc610d7009bd606d54567e8f105c35a20625e0b932be8e4a5e60b4ed079b865e96da2db8feeaefb0db7764fe29daa47fe00040016030102bd0b0002b90002b60002b3308202af30820218a003020102020101300d06092a864886f70d0101050500308190310b3009060355040613025553310b3009060355040813024d4e311430120603550407130b4d696e6e6561706f6c6973310d300b060355040a13044d435443310c300a060355040b1303495453311630140603550403130d467265657261646975732043413129302706092a864886f70d010901161a74 EAP-Message = 0x686f2e6e677579656e406d696e6e6561706f6c69732e656475301e170d3036313131353230313835375a170d3136313131323230313835375a308190310b3009060355040613025553310b3009060355040813024d4e311430120603550407130b4d696e6e6561706f6c6973310d300b060355040a13044d435443310c300a060355040b1303495453311630140603550403130d467265657261646975732043413129302706092a864886f70d010901161a74686f2e6e677579656e406d696e6e6561706f6c69732e65647530819f300d06092a864886f70d010101050003818d0030818902818100d95e830f5ee64dd1200530e83fef1e1453ea41fa EAP-Message = 0x89cf579e33536c4e393d259d6067f1a29416bf58a40780264b5bb4e8b4cafc4424bc5385ddf6922953ceca1e089cab0e836eb2473c7b1b5cb895020f028bff4b484b55a73ea467f70cb81e34114ca9338ad9652a09710927e1d91beaa88675886bd28f128cb50555408ccb250203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038181003f7e3553d683d1deafc1f78df534b19723c4e17e371b0062c2c7cbe70a3e9447cae190ade2bbe2739f052bffd86355764ee0dc9dcbd4c621d44496e777250410f52dd576335acef5757f3d7777d4d211b9194aa72d567dbd76842a81b466f690 EAP-Message = 0x10f132fbe9669c8116b4c045b9f18abe42a83a623ed026dd5443b01f5a1b473d16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe49fded8f29186fb0b0b9ef766db17f4 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 134.29.241.113:1645, id=24, length=149 User-Name = "nguyenth" Framed-MTU = 1400 Called-Station-Id = "0013.7f9c.4540" Calling-Station-Id = "0090.96a8.4ba8" Service-Type = Login-User Message-Authenticator = 0x725ba5a11789db0be97bcbc7658b656c EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 263 State = 0xe49fded8f29186fb0b0b9ef766db17f4 NAS-IP-Address = 134.29.241.113 NAS-Identifier = "TestAP-1230" rad_rmspace_pair: User-Name now 'nguyenth' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "nguyenth", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for nguyenth radius_xlat: '(uid=nguyenth)' radius_xlat: 'o=mctc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=mctc, with filter (uid=nguyenth) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user nguyenth authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: No SSL info available. Waiting for more SSL data. eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 24 to 134.29.241.113 port 1645 EAP-Message = 0x010600061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd5e9afceeb8c7e9157b88cd7da19719 Finished request 3 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 21 with timestamp 457983f6 Cleaning up request 1 ID 22 with timestamp 457983f6 Cleaning up request 2 ID 23 with timestamp 457983f6 Cleaning up request 3 ID 24 with timestamp 457983f6 Nothing to do. Sleeping until we see a request.

2 1

compile problem on tru64
by Matthias Henze 08 Dec '06

08 Dec '06

hi, i try to build freeradius 1.1.3 on tru64. at first every thing worked as expected. near the end of the buildprocess i get the following message i'm unable to interpret: creating .libs/radiusdS.c (cd .libs && gcc -pthread -c -fno-builtin "radiusdS.c") rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/exec.o .libs/files.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/nas.o .libs/proxy.o .libs/radiusd.o .libs/radius_snmp.o .libs/request_list.o .libs/session.o .libs/smux.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/timestr.o .libs/xlat.o -lresolv ../lib/.libs/libradius.so /usr/local/lib/libltdl.so __pthread_cancel sem_post pthread_sigmask sem_wait sem_init collect2: ld returned 1 exit status make[4]: *** [radiusd] Error 1 i'm using gcc 3.4.6. please help. TIA -- Matthias Henze matthias(a)mhcsoftware.de Use PGP!! http://www.mhcsoftware.de/MatthiasHenze.asc - - - - - - - - - - - - - - - - - - - - - - - - - - - MHC SoftWare GmbH voice: +49-(0)9533-92006-0 Fichtera 17 fax: +49-(0)9533-92006-6 96274 Itzgrund/Germany e-Mail: info(a)mhcsoftware.de - - - - - - - - - - - - - - - - - - - - - - - - - - -

1 1

Mulitple sql groups
by Stavros Patiniotis 08 Dec '06

08 Dec '06

Hi all, If I have mulitple sql groups, radgroupreply items that are returned are not restricted to the groups which the radgroupcheck items match. It seems that the first row of the radgroupreply table is returned to the nas (as long as the user is a member of this group however EVEN if the radreplyceck items do not match for this group). I assume that this is not correct? Is there therefore a way to get multiple sql groups to work correctly? Cheers, Stavros EscapeNet

2 3

help
by John Wan 08 Dec '06

08 Dec '06

Hi All, My freeradius version is 1.3 I have managed to get the freeradius and the chillispot on my Linux EL 4.0 box, with the user name and password in the file "/etc/raddb/users" and everything works fine. But I would like to use the Windows 2k3 AD to authenticate the username and password instead of using the user name and password from the file "/etc/raddb/users" or in mysql. Alexandre Coninx (From: freeradius-users(a)lists.freeradius.org) claimed : " I authenticate the users against a Windows (AD) domain with PEAP +MSCHAPv2 + ntlm_auth. It works well." which you can find from the following webpage: http://lists.cistron.nl/pipermail/freeradius-users/2005-April.txt I would like to have some documentation/procedures to configure my freeradius to authenticate the username and password from the Windows 2k3 AD instead of from the file "/etc/raddb/users" or the mysql database. Any idea? Please help. Many thanks in advance. John -- _______________________________________________________________________________ Notice from Melbourne Business School Ltd The information contained in this e-mail is confidential, and is intended for the named person's use only. It may contain proprietary or legally privileged information. If you have received this email in error, please notify the sender and delete it immediately. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient Internet communications are not secure. You should scan this message and any attachments for viruses. Melbourne Business School does not accept any liability for loss or damage which may result from receipt of this message or any attachments. ______________________________________________________________________________

2 1

FreeRadius Framed-IP-Address
by Daniel Romero 08 Dec '06

08 Dec '06

Hi. I have freeradius working with eap/peap. The users can autenthicate them, but the Framed-IP-Address don't work, they can't get an ip address... but, if I connect an DHCP to the network, all work fine: authentication->get address-> network access What can be wrong with the Framed-IP-Address??? This is an example of successfuly connection: ... Sending Access-Accept of id 44 to 192.168.100.185 port 1391 Framed-IP-Address := 192.168.100.211 Framed-IP-Netmask := 255.255.255.0 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP Tunnel-Medium-Type:0 := IEEE-802 Tunnel-Type:0 := VLAN MS-MPPE-Recv-Key = 0x1714c6bb40821fd973e97f7bbfa7a05110206fb083138414a453fb4c08ab3b56 MS-MPPE-Send-Key = 0x6d7baa66c5cea48be8998e1bf9b04a46ae59905700e923b6f9a1462da7ce3b22 EAP-Message = 0x032c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "profesor01" Finished request 8

2 3

Global address pool
by Paul Khavkine 07 Dec '06

07 Dec '06

Hi folks. I'm looking into ways to implement a "global address pool" for multiple NASes and multiple RADIUS servers. I see that there's 2 possible ways of doing it with FreeRADIUS. 1) use rlm_ippool 2) use rlm_sqlippool I'm leaning towards rlm_sqlippool since it can be used to "lease" an address to a subscriber for a period of time so they get same ip address for the duration of the "lease". Is there any other ways to implement NAS independent address pool and be able to "lease" same address to a subscriber ? Is anyone using sqlippool in production ? Thanx Paul

2 1

RE: Problem with EAP/MD5 behind proxy
by Josh Howlett 07 Dec '06

07 Dec '06

You're stripping the realm at the proxy; add "nostrip" to the realm stanza defined in realms.conf for the server you're proxying to. Josh. > -----Original Message----- > From: > freeradius-users-bounces+j.howlett=ukerna.ac.uk(a)lists.freeradi > us.org > [mailto:freeradius-users-bounces+j.howlett=ukerna.ac.uk@lists. > freeradius.org] On Behalf Of Hans Bornemann > Sent: 07 December 2006 10:57 > To: freeradius-users(a)lists.freeradius.org > Subject: Problem with EAP/MD5 behind proxy > > Hi, > > I run into this problem: > > Config: > > 802.1x client (Windows XP with 802.1x / md5 ) --> freeradius-proxy --> > freeradius-server > > Same prg-version on both server (1.1.0) > same radius.conf > same users file > > if i try to authenticate against the proxy without realm, > everything ist > o.k. > > if i try this with a realm the second radius-server shows this error: > > rlm_eap: Identity does not match User-Name, setting from EAP Identity > rlm_eap: Failed in handler > > > any ideas? > > Hans > > > -- > Hans Bornemann > Universitaet Dortmund - Hochschulrechenzentrum > Tel. ++49 231 755 2132 Fax. ++49 231 755 2731 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

3 5

Authentication registers on MySQL
by Felipe Neuwald 07 Dec '06

07 Dec '06

Hi Folks, I'm building a new freeradius server here, and I wanna make some implementations: 1. Log every authentication (sucessfull or not) to MySQL database; 2. but, log *only* the last 10 registers of authentication in database. The database connection is already working ok, and I'm retrieving the user information from radcheck table. Does anybody knows how to implement this? Thanks, Felipe Neuwald.

1 0

Error rlm_exec
by Serg Max 07 Dec '06

07 Dec '06

I can't start freeradius 1.1.3_1 on FreeBSD6 radius.log: Error: radiusd.conf[226] Failed to link to module 'rlm_exec': /usr/local/lib/rlm_exec.a: invalid file format ??? Sergu

2 1