- Freeradius-Users - lists.freeradius.org

RE: Reject reason
by Garber, Neal 13 Nov '06

13 Nov '06

>I am authenticating users based on Calling-Station-Id in addition to password. >All accepts and rejects are logged to the postauth table in my database. Using what type of authentication? Are you really checking Calling-Station-Id during authenticate or are you checking it during authorize? What module are you using to validate it?

2 1

Re: freeradius child processes
by dan1＠gmx.net 13 Nov '06

13 Nov '06

Alan & Alan, Thank you for your help. I did not think of the different kernel versions. the ps aux -L does the job. Thanks Dan aland(a)deployingradius.com wrote: > > Is this because freeradius is using multiple threads within one > > process, and only one process is visible in the process list? > > Yes. This is a feature of Linux 2.6. > > > However on a different server with a very similar configuration ps > > aux will list me several freeradius processes which are running. > > Yes. This is a feature of Linux 2.4. > A.L.M.Buxey(a)lboro.ac.uk wrote: > > > Is there a way how to see how many threads are currently running? > > > > "man ps" > > adding the 'L' argument often shows what you need -- "Ein Herz für Kinder" - Ihre Spende hilft! Aktion: www.deutschlandsegelt.de Unser Dankeschön: Ihr Name auf dem Segel der 1. deutschen America's Cup-Yacht!

1 0

machine authentication (was: Windows-Domain login without local users)
by Michael Messner 13 Nov '06

13 Nov '06

hey freeRADIUS users, the testlab looks like Windows 2003 (AD) <---> Freeradius <---> Enterasys switch/Cisco WLAN <---> Linux/MS-Client 802.1x via PEAP works, so the next step is machine authentication to get also a 802.1x Domain login. like in this post (http://lists.freeradius.org/mailman/htdig/freeradius-users/2006-November/05…) we have upgradet our releases: Samba: Version 3.0.23c FreeRADIUS Version 1.1.2 the supplicant is the original Windows supplicant and machine authentication is activated. Because we are working with the policy system from enterasys the normal user authentication starts with a ldap request to the active directory for group to policy mapping. Therefore we have such user-entries: DEFAULT LDAP-Group == "CN=adminrole,CN=users,DC=isalab,DC=local", Huntgroup-Name == "enterasys", Realm == ISALAB.local Filter-ID == "Enterasys:version=1:mgmt=su:policy=adminrole", Reply-Message = "Welcome %{Stripped-User-Name:-%{User-Name:-None}} in the %{Realm} - Domain, there are no restrictions for you in this network", Fall-Through = No So there will be the LDAP request for the group adminrole and then it will be sent to the switch with the above filter-ID. This works good for user-auth, but with machine auth now there are problems because I see the machine LDAP-request now for host/it88.isalab.local and that fails: ============================================= .... Nov 9 15:30:02 Xradius radius: rlm_ldap: object not found or got ambiguous search result Nov 9 15:30:02 Xradius radius: rlm_ldap::ldap_groupcmp: search failed Nov 9 15:30:02 Xradius radius: rlm_ldap: ldap_release_conn: Release Id: 0 Nov 9 15:30:02 Xradius radius: rlm_ldap: Entering ldap_groupcmp() Nov 9 15:30:02 Xradius radius: rlm_ldap: ldap_get_conn: Checking Id: 0 Nov 9 15:30:02 Xradius radius: rlm_ldap: ldap_get_conn: Got Id: 0 Nov 9 15:30:02 Xradius radius: rlm_ldap: object not found or got ambiguous search result Nov 9 15:30:02 Xradius radius: rlm_ldap::ldap_groupcmp: search failed Nov 9 15:30:02 Xradius radius: rlm_ldap: ldap_release_conn: Release Id: 0 Nov 9 15:30:02 Xradius radius: rlm_ldap: - authorize Nov 9 15:30:02 Xradius radius: rlm_ldap: performing user authorization for host/it88.isalab.local Nov 9 15:30:02 Xradius radius: rlm_ldap: ldap_get_conn: Checking Id: 0 Nov 9 15:30:02 Xradius radius: rlm_ldap: ldap_get_conn: Got Id: 0 Nov 9 15:30:02 Xradius radius: rlm_ldap: object not found or got ambiguous search result Nov 9 15:30:02 Xradius radius: rlm_ldap: search failed Nov 9 15:30:02 Xradius radius: rlm_ldap: ldap_release_conn: Release Id: 0 Nov 9 15:30:02 Xradius radius: Login incorrect (rlm_ldap: User not found): [host/it88.isalab.local/<no User-Password attribute>] (from client enterasys port 31005 cli 00-04-75-18-1B-82) Nov 9 15:30:20 Xradius radius: rad_recv: Access-Request packet from host 141.201.43.115:41722, id=8, length=167 Nov 9 15:30:20 Xradius radius: Sending Access-Reject of id 10 to 141.201.43.115 port 41721 Nov 9 15:30:20 Xradius radius: Reply-Message = "Authentication failed ... no access" Nov 9 15:30:20 Xradius radius: Sending Access-Reject of id 35 to 141.201.43.115 port 41720 Nov 9 15:30:20 Xradius radius: Reply-Message = "Authentication failed ... no access" Nov 9 15:30:20 Xradius radius: Message-Authenticator = 0x59025dcce5cd0abfa5433e98b7716282 Nov 9 15:30:20 Xradius radius: User-Name = "host/it88.isalab.local" Nov 9 15:30:20 Xradius radius: NAS-IP-Address = 141.201.43.115 Nov 9 15:30:20 Xradius radius: Called-Station-Id = "00-E0-63-93-75-B3" Nov 9 15:30:20 Xradius radius: NAS-Port = 31005 Nov 9 15:30:20 Xradius radius: NAS-Port-Id = "fe.3.5" Nov 9 15:30:20 Xradius radius: NAS-Port-Type = Ethernet Nov 9 15:30:20 Xradius radius: Service-Type = Framed-User Nov 9 15:30:20 Xradius radius: Calling-Station-Id = "00-04-75-18-1B-82" Nov 9 15:30:20 Xradius radius: EAP-Message = 0x0201001b01686f73742f697438382e6973616c61622e6c6f63616c Nov 9 15:30:20 Xradius radius: Framed-MTU = 1300 ============================================= Then I've tested a bit with ntlm_auth: 16:11:57 Xradius /etc/raddb [root]ntlm_auth --request-key --domain=ISALAB.LOCAL --username=host/it88.isalab.local password: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) ... so I think this is the wrong request! with: 16:12:38 Xradius /etc/raddb [root]ntlm_auth --request-key --domain=ISALAB.LOCAL --username=it88$ password: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) I get the wrong password, so I think this user/machine is available! any ideas how to go on?!? thanks mIke

1 0

Re: Multiple search contexts in LDAP
by Peter Param 13 Nov '06

13 Nov '06

multiple 'ldap { }' in radiusd.conf? cheers Peter >>> jamesw(a)deakin.edu.au 11/13/06 11:49 AM >>> Peter Param wrote: > hey all, > > I would like to have multiple search contexts to get around ambiguous > search results due to duplicate object names found in branches under the > same basedn = "ou=darlinghurst,ou=nsw,o=myorg,c=au" > > Peter > Hi Peter, You could try using multiple instances of the ldap module, one to search one ou and the other to search the other ou, then invoke them one after the other wherever you currently invoke the single ldap instance. Cheers, -- James Wakefield, Unix Administrator, Information Technology Services Division Deakin University, Geelong, Victoria 3217 Australia. Phone: 03 5227 8690 International: +61 3 5227 8690 Fax: 03 5227 8866 International: +61 3 5227 8866 E-mail: james.wakefield(a)deakin.edu.au Website: http://www.deakin.edu.au - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

1 0

Multiple search contexts in LDAP
by Peter Param 13 Nov '06

13 Nov '06

hey all, I would like to have multiple search contexts to get around ambiguous search results due to duplicate object names found in branches under the same basedn = "ou=darlinghurst,ou=nsw,o=myorg,c=au" For instance, I would like to search ou=people,ou=darlinghurst,ou=nsw,o=myorg,c=au & ou=roles,ou=darlinghurst,ou=nsw,o=myorg,c=au only and not all other branches under the ou=darlinghurst branch. Is this possible? currently I've got set in radiusd.conf for LDAP searches: ldap { server = myldap identity = "cn=superuser,o=myorg,c=au" password = <mypassword> filter = "(cn=%u)" basedn = "ou=darlinghurst,ou=nsw,o=myorg,c=au" #basedn = "ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au" - - } cheers Peter ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

2 1

Accounting : server and port 1813
by Bruno Costacurta 12 Nov '06

12 Nov '06

Hello, I already had a working Freeradius configuration and intend now to install accounting. As far I undestand accounting is a server using port 1813 (as a default value). But where is this value setup on the client ? (ie. 1812 port for autorization is setup and used on the NAS) More generally is there any good doc or sample about accounting configuration or best practices ? Thanks. Bye, Bruno -- Register Linux User 353844 http://counter.li.org/ --

3 5

Choice database
by Marilene Lima 11 Nov '06

11 Nov '06

Hi, I am setting up my first radius server, and I have two databases. Someone could tell me if there is a file in freeradius where I can choice what database I will to use? Thanks a lot, Marilene

3 2

RE: sync hungroups, clients files, users across multiple servers
by Charles Tompkins 11 Nov '06

11 Nov '06

That is exactly what I want to do! I just started using subversion with RANCID and am not very knowledgeable about svn. How can I get a 'diff' spread around like that? I am thinking about what you have said and it could be completely wrong, 1. A change is commited on a watched file like 'huntgroups.' 2. A local script diffs it against a remote subversion repo copy (or a local copy?) via a cron job 3. The diff gets checked in to svn. 4. The scripts on the other RADIUS servers then notice the diff in the repo copy and apply it to their own files? Sounds like I need to build up my script writing skills... Regards, -Charles ------------ Master timed out! Holding election... I am declaring myself the master! -----Original Message----- From: freeradius-users-bounces+crt=thig.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+crt=thig.com@lists.freeradius.org] On Behalf Of A.L.M.Buxey(a)lboro.ac.uk Sent: Friday, November 10, 2006 3:20 PM To: FreeRadius users mailing list Subject: Re: sync hungroups, clients files, users across multiple servers Hi, > Greets! > > What is a good way or considered best practice for folks to sync changes to > critical files in use by radius like huntgroups and clients.conf and users > across multiple RADIUS servers. I am not using MySQL backend, but rather > relaying requests for auth off to PAM which checks against a > samba/NT-Domain, thus the user account existing locally on the server. With > several servers it becomes a PIA and can lead to misconfiguration errors due > to human data entry when you have to enter everything into each server. > > Does anyone want to share a script they have written to do this? you could use rsync, http://samba.anu.edu.au/rsync/ or subversion, http://subversion.tigris.org/ and actually keep your configurations all held on such a central repository. you can then actually update the configuration from any one of your servers and get them all to autometically get the latest version... be that with a frequent cronjob that checks for changes (and if there have been any, download them!) or from a forced update. this way you also have a centralised way of seeing what changed, when and who by. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html CONFIDENTIAL NOTICE: This email including any attachments, contains confidential information belonging to the sender. It may also be privileged or otherwise protected by work product immunity or other legal rules. This information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking of any action in reliance on the contents of this emailed information is strictly prohibited. If you have received this email in error, please immediately notify us by reply email of the error and then delete this email immediately.

2 1

How to handle EAP/LDAP or files with same server
by Keith Moores 10 Nov '06

10 Nov '06

I'm trying to finally rid myself of Cisco ACS with FR 1.1.3 and mostly having great success (performance is so much better!) but can't seem to figure out how to handle two different types of wireless authentication in separate non-overlapping ways. Case 1 is EAP/TLS where user ID (email address from cleint cert) is also looked up via LDAP. Case 2 is MAC authentication using the users file. I have both of these working with one issuse, MACs that are not in the users file are being sent to LDAP server adding unnecessary load. authorize { preprocess files ldap { notfound = return } eap } The solution I can think of is to only send user name's that are email addresses to ldap. Is this something that can be done with a proxy conf and realms? I'm having trouble understanding if/how those can influence the authorize section. Thanks, -Keith ------------------------------------------------------------------------ Keith Moores <mailto:kmm6b@virginia.edu> Network Systems ITC-Communications and Systems Division University of Virginia, ITC-2015 Ivy Rd Phone (434) 924-0621 Box 400324, Charlottesville, VA 22904-4324 Fax (434) 982-4715

2 1

limiting sessions
by Andrew Long 10 Nov '06

10 Nov '06

I need to boot users at one property after a specified time period. We have adjusted the "max-daily-session" to "1800" (30 minutes), but users still seem to be staying on. Can someone point me in the right direction. The NAS is a Colubris cn3000. The other attribute we have that may apply is "max-acct-age". I am pretty new to this, so any detail is most appreciated. -- Regards, Andrew Long EscapeWire Solutions, LLC 617 Dingens Street Buffalo, NY 14206 Office: (716) 893-4984 Mobile: (716) 830-5169 Fax: (716) 891-4288 Web: http://www.escapewire.com E-mail: along(a)escapewire.com

5 14