- Freeradius-Users - lists.freeradius.org

Re:
by Eric Faden 09 Nov '06

09 Nov '06

Debug log is below, censored of course. It seems to be pulling the correct things out of the LDAP database, e.g. the NT-Password, but then mschap returns noop instead of anything. After that it seems to default to Auth-Type System which won't work because the user is only on LDAP. Ignore the first attempt, in which I forgot to have the dialupAccess attribute set. -Eric #################### DEBUG LOG ######################3 halogen:/BACKUP_DRIVE# freeradius -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded LDAP ldap: server = "127.0.0.1" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "<REMOVED>" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "<REMOVED>" ldap: basedn = "<REMOVED>" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "dialupAccess" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x8145378 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32771, id=213, length=58 User-Name = "<REMOVED>" User-Password = "<REMOVED>" NAS-IP-Address = 255.255.255.255 NAS-Port = 1801 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/freeradius/radacct/127.0.0.1/auth-detail-20061106' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20061106 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "<REMOVED>", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for <REMOVED> radius_xlat: '(uid=REMOVED>)' radius_xlat: '<REMOVED>' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: bind as <REMOVED> to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in <REMOVED>, with filter (uid=<REMOVED>) rlm_ldap: no dialupAccess attribute - access denied by default rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns userlock for request 0 modcall: leaving group authorize (returns userlock) for request 0 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 213 to 127.0.0.1 port 32771 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 213 with timestamp 45500c67 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:32771, id=217, length=58 User-Name = "<REMOVED>" User-Password = "<REMOVED>" NAS-IP-Address = 255.255.255.255 NAS-Port = 1801 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/log/freeradius/radacct/127.0.0.1/auth-detail-20061106' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20061106 modcall[authorize]: module "auth_log" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "<REMOVED>", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for <REMOVED> radius_xlat: '(uid=<REMOVED>)' radius_xlat: '<REMOVED>' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in <REMOVED>, with filter (uid=<REMOVED>) rlm_ldap: checking if remote access for MREMOVED> is allowed by dialupAccess rlm_ldap: Added password <REMOVED, NT-Password> in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNTPassword as NT-Password, value <REMOVED> & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value <REMOVED> & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user <REMOVED> authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 217 to 127.0.0.1 port 32771 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 217 with timestamp 45500c97 Nothing to do. Sleeping until we see a request.

3 6

Re: Server logs say users authenticate, but they don't (Now with more details!)
by Ernie Dunbar 09 Nov '06

09 Nov '06

> G'day Ernie, > > Can you sniff on the AS5300 and ensure the Access-Accept packets are > arriving before the 3 second (default) timeout? Yes, we tried that. The access-accept packets aren't arriving at all! > Does it work if you temporarily disable the Simultaneous-Use check? No, that doesn't work either.

2 4

RE: Multiple LDAP (Not failover) lookup...
by Garber, Neal 09 Nov '06

09 Nov '06

> If(authentication in ldap1 success) { Use ldap1 in the authenticate stage of radiusd.conf > if(productCode attribute exists in ldap2 success) { Use ldap2 in the authorize stage of radiusd.conf Authorize is performed first in FreeRadius (you show authenticate First), but it shouldn't matter for what you're trying to do. Configure ldap.attrmap to obtain the productCode attribute.

3 3

RE: Assign IP based on CallingStationID.
by John Longland 09 Nov '06

09 Nov '06

The idea is to do IP-assignment based on the Calling-Station-ID and disregarding the username,password that is passed to radius. JOhn -----Original Message----- From: freeradius-users-bounces+jlongland=grintek.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+jlongland=grintek.com@lists.freeradius. org]On Behalf Of Collen Blijenberg Sent: 09 November 2006 15:40 To: FreeRadius users mailing list Subject: Re: Assign IP based on CallingStationID. Hmm i tried this, but it ain't working.. ?! i have: id - 1 username - blah attribute - Calling-Stattion-Id op - == value - [mac adress] still get username ask ?! no connection. dunno, what's the idea behinf this query ? mac = username ? no username, auth is done true mac ? Cheers Collen John Longland wrote: > > authorize_check_query = "select id,UserName,Attribute,Value,op FROM > ${authcheck_table} WHERE UserName in > (select UserName from ${authcheck_table} WHERE Value = > '%{Calling-Station-ID}') > ORDER BY id" > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Assign IP based on CallingStationID.
by John Longland 09 Nov '06

09 Nov '06

Here is the query that I put into sql.conf Maybe use it and build on it for your specific example ?? authorize_check_query = "select id,UserName,Attribute,Value,op FROM ${authcheck_table} WHERE UserName in (select UserName from ${authcheck_table} WHERE Value = '%{Calling-Station-ID}') ORDER BY id" John -----Original Message----- From: freeradius-users-bounces+jlongland=grintek.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+jlongland=grintek.com@lists.freeradius. org]On Behalf Of banga Sent: 08 November 2006 15:14 To: freeradius-users(a)lists.freeradius.org Subject: Assign IP based on CallingStationID. I use dafault table-layout. How I understand you just change username authentication to callingstationid authentication inside sql.conf. Thx, it’s really good idea. I think that I could do the same by myself, but it will take a time. Therefore any examples will be very useful. Can you post it here? If It’s too big you can send it to me - “nebula-at-inbox-lv”. >From other side, I need username/password authentication also (for other users) therefore it will be difficult to implement this ( may be I’ll install another freeradius specially for that). In my situation radius for some users check username/password, for other users it should do the next: check username/password/callingstationid (in fact username and password always the same) if callingstationid has specific value (can be dosen specifc callingstationid_s) then replay accept and some specific IP for each specific callingstationid or just assign ip from radius pool. if callingstationid is not in the list of “specific callingstationid” then just replay accept and NAS will assign ip from equipment’s IP pool Main Idea: For now most users has the same username and password and it is not possible to change anything in that. Some callingstationid is not friendly for my network (they should have only http traffic). That’s why I want to assign them IP from specific pool – I going to setup firewall rules for a such IPs. Any idea ? John Longland wrote: > > Yes, I have just done it. > > You need to change the sql-statement in /etc/raddb/sql.conf > > That is the > autorize_check_query.Depending on how you use your tables, the query > that I am using may or may not work. If you want I can give you the > one that works for me if you supply your table-layout. > > JOhn > P.S> The statement I use does NOT check username/password !!! > > -----Original Message----- > From: > freeradius-users-bounces+jlongland=grintek.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+jlongland=grintek.com@lists.freeradius. > org]On Behalf Of banga > Sent: 08 November 2006 11:37 > To: freeradius-users(a)lists.freeradius.org > Subject: Assign IP based on CallingStationID. > > > > Hello all. > I use freeradius ver. 1.1.1 + mysql. > I use same login/password for couple of users but they has different > callingstationid. > Is it possible to check callingstationid and asiighn IP based on it? > Do I need to create some additional tables in mysql for that? > > Thx. > > -- > View this message in context: > http://www.nabble.com/Assign-IP-based-on-CallingStationID.-tf2594146.html#a7 > 235317 > Sent from the FreeRadius - User mailing list archive at Nabble.com. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > -- View this message in context: http://www.nabble.com/Assign-IP-based-on-CallingStationID.-tf2594146.html#a7 238235 Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

RE: Assign IP based on CallingStationID.
by John Longland 09 Nov '06

09 Nov '06

Yes, I have just done it. You need to change the sql-statement in /etc/raddb/sql.conf That is the autorize_check_query.Depending on how you use your tables, the query that I am using may or may not work. If you want I can give you the one that works for me if you supply your table-layout. JOhn P.S> The statement I use does NOT check username/password !!! -----Original Message----- From: freeradius-users-bounces+jlongland=grintek.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+jlongland=grintek.com@lists.freeradius. org]On Behalf Of banga Sent: 08 November 2006 11:37 To: freeradius-users(a)lists.freeradius.org Subject: Assign IP based on CallingStationID. Hello all. I use freeradius ver. 1.1.1 + mysql. I use same login/password for couple of users but they has different callingstationid. Is it possible to check callingstationid and asiighn IP based on it? Do I need to create some additional tables in mysql for that? Thx. -- View this message in context: http://www.nabble.com/Assign-IP-based-on-CallingStationID.-tf2594146.html#a7 235317 Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 4

how to NOT expand varaibles in a sql-query
by info＠w3welt.de 08 Nov '06

08 Nov '06

Hello, i need to pass the string '%d %b %Y %T' inside a query to mysql (as a date format). Unfortunately this gets expanded to '07 0 2006 2006-11-07-00.06.18.000000' which leads to an sql error and crashes freeradius with a segmentation fault. I found a post from Nicolas Baradakis who advises to double the percentage-signs. I tried this too, but this creates a string like this '%0d %0b %0Y %0T' which again leads to a sql error (but without crash) How can i pass this string literaly without any variable-substitution? I'm running "FreeRADIUS Version 1.0.0" Thanks in advance for your help... Yours Olaf Kolling -- ******************************************************************** W³Welt Web-Entwicklung -------------------------------------------------------------------- Olaf Kolling eMail: info#w3welt.de Mörikestraße 67 Tel.: +49 711 96666-200 70199 Stuttgart Fax: +49 711 96666-201 ********************************************************************

1 0

Windows-Domain login without local users
by Michael Messner 08 Nov '06

08 Nov '06

hey freeRADIUS users, PEAP auth. works now with *X and MS-clients, the backend is a freeradius server on centOS with active directory connection. Now, the user needs a local account to login to the clientmachine and then he is able to start the PEAP authentication process. A local login for every user is a big overhead! What is the normal way to handle this? thanks ca mIke

2 3

Assign IP based on CallingStationID.
by banga 08 Nov '06

08 Nov '06

Hello all. I use freeradius ver. 1.1.1 + mysql. I use same login/password for couple of users but they has different callingstationid. Is it possible to check callingstationid and asiighn IP based on it? Do I need to create some additional tables in mysql for that? Thx. -- View this message in context: http://www.nabble.com/Assign-IP-based-on-CallingStationID.-tf2594146.html#a… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

(no subject)
by Mike May 07 Nov '06

07 Nov '06

"Mike May" <mmay3(a)nd.edu> wrote: > Hello everyone, is it possible to have NAS entries for a subnet, if so > could someone give me an example raddb/clients.conf Alan DeKok. -- http://deployingradius.com <http://deployingradius.com/> - The web site of the book http://deployingradius.com/blog/ - The blog Thanks for example Alan, I thought it may be helpful for me to provide you some more information, I am not a Radius expert but have managed to keep a somewhat large client base using radius. I currently use the clients file to allow connections, but not to do any real authorization. Example of my clients file is below, this is only a small section as my radius servers handles modem pool, vpn, wireless, 802.1x etc and soon wired 802.1x. I use LDAP/ Kerberos as the authn backend I use huntgroup entries to point to matches in my users file see examples below. in the users file is where I am using ldaps.conf to connect to the directory servers, verifying what group the user is in and at the end authn to Kerberos store. After the authn I set some authz like Cisco-AVPair = "priv-lvl=15" used by Cisco routers and switches for network engineers who live in the proper LDAP group, here is where the problem is. PIX firewalls do not like me setting the priv lvl, and the reason is that the PIX will only accept authz from a tacacs server(it seems like). What I need to do is specify a "netauth" == NAS-IP-ADDRESS 192.168.20.0/23 subnet. Instead of "netauth" == NAS-IP-ADDRESS 192.168.20.15, this way I can use my users file and not set the Cisco priv lvl for those devices that live on the firewall subnets. Thank you for all your help Mike ========= clients.conf============================= #This are for network engineering devices (outside wireless and dialup) # 2/20/06 client 172.16.255.2/29 { secret shortname = devicenet-15 } client 172.16.240.0/20 { secret = shortname = devicenet-16 } client 172.17.240.0/20 { secret = shortname = devicenet-17 } client 172.18.240.0/20 { secret = shortname = devicenet-18 } client 172.19.240.0/20 { secret = shortname = devicenet-19 } client 172.20.240.0/20 { secret = shortname = devicenet-20 } client 172.21.240.0/20 { secret = shortname = devicenet-21 } client 172.22.240.0/20 { secret = shortname = devicenet-22 Huntgroups wireless-prime NAS-IP-Address == xxx.xxx.xxx.xxx wireless-backup NAS-IP-Address == xxx.xxx.xxx.xxx spam1 NAS-IP-Address == xxx.xxx.xxx.xxx spam2 NAS-IP-Address == xxx.xxx.xxx.xxx ciscovpnadmin NAS-IP-Address == xxx.xxx.xxx.xxx dialup8 NAS-IP-Address == xxx.xxx.xxx.xxx ciscovpnadmin2 NAS-IP-Address == xxx.xxx.xxx.xxx dialup9 NAS-IP-Address == xxx.xxx.xxx.xxx dialup10 NAS-IP-Address == xxx.xxx.xxx.xxx netautz NAS-Port-Type == "Virtual" netautz_fw NAS-IP-Address == xxxx netautz_fw1 NAS-IP-Address == xxxxx =================================================== Users file DEFAULT Huntgroup-Name == "netautz", Ldap-Group == ndeg6qr2, Autz-Type := ldap-vpn, Auth-Type := ldap-vpn Service-Type = 6, Cisco-AVPair = "priv-lvl=15", Fall-Through = Yes DEFAULT Huntgroup-Name == "netautz_fw", Ldap-Group == ndeg6qr2, Autz-Type := ldap-vpn, Auth-Type := ldap-vpn Service-Type = 6, Fall-Through = Yes DEFAULT Huntgroup-Name == "netautz_fw1", Ldap-Group == ndeg6qr2, Autz-Type := ldap-vpn, Auth-Type := ldap-vpn Service-Type = 6, Fall-Through = Yes # VPN Group Definition note please make additions at the begining of the stanza not the end DEFAULT Huntgroup-Name == "ciscovpnadmin", Hint =="NETENG", Ldap-Group == ndbx2jj5, Autz-Type := ldap-vpn, Auth-Type := ldap-vpn CVPN3000-IPSec-Banner1 = "Welcome to VPN group NETENG!", Class = "OU=neteng;", Fall-Through = No

2 1