- Freeradius-Users - lists.freeradius.org

LDAP authorizedService attribute matching
by Owen DeLong 12 Oct '06

12 Oct '06

I've got an LDAP database which works with PAM and uses PosixAccounts to describe users. It uses the authorizedService attribute to specify which services the user is allowed to log into. I've configured freeradius to map authorizedService -> Service-Type and have set up Service-Type as a check attribute. I'm running: (radiusd: FreeRADIUS Version 1.1.3, for host i686-pc-linux-gnu, built on Oct 10 2006 at 13:13:55) For example, say user foo has: dn: uid=foo, ou=people, dc=zone, dc=example, dc=com ... authorizedService: sshd authorizedService: vpn authorizedService: xdm ... I would like this user to succeed authenticating against RADIUS if Service-Type in the request matches sshd, vpn, or xdm, but, not if it contains anything else. Is there a way to set up this comparison in freeradius? I've read the FAQ, but, I haven't found a way to do this. I've included debug output below, just in case. Any help, especially a sepecific set of "put this in x configuration file here and it should work" type help is greatly appreciated. Thanks, Owen Test authentication command (the username, password, and domain name have been replaced to preserve the anonymity of the implementation in question): In this case, user foo has authorizedService attributes with the following values: passwd login sshd xdm gdm sudo su (echo "User-Name = foo" ; echo "User-Password = xyzzy"; echo "Service- type = sshd" ) | \ radclient localhost auth testing123 results in: rad_recv: Access-Request packet from host 127.0.0.1:32772, id=37, length=50 User-Name = "foo" User-Password = "xyzzy" Service-Type = sshd Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "foo", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "foo" rlm_realm: Proxying request from user owen to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for foo radius_xlat: '(uid=foo)' radius_xlat: 'ou=people,dc=zone,dc=example,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as / to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=zone,dc=example,dc=com, with filter (uid=foo) rlm_ldap: checking if remote access for owen is allowed by authorizedService rlm_ldap: looking for check items in directory... rlm_ldap: Adding authorizedService as Service-Type, value passwd & op=21 rlm_ldap: Adding authorizedService as Service-Type, value login & op=21 rlm_ldap: Adding authorizedService as Service-Type, value sshd & op=21 rlm_ldap: Adding authorizedService as Service-Type, value xdm & op=21 rlm_ldap: Adding authorizedService as Service-Type, value gdm & op=21 rlm_ldap: Adding authorizedService as Service-Type, value sudo & op=21 rlm_ldap: Adding authorizedService as Service-Type, value su & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user foo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "foo" with password "xyzzy" rlm_ldap: user DN: uid=foo,ou=people,dc=zone,dc=example,dc=com rlm_ldap: (re)connect to localhost:389, authentication 1 rlm_ldap: bind as uid=foo,ou=people,dc=zone,dc=example,dc=com/xyzzy to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user owen authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: leaving group LDAP (returns ok) for request 0 Sending Access-Accept of id 37 to 127.0.0.1 port 32772 Finished request 0 Going to the next request --- Walking the entire request list --- Received response ID 37, code 2, length = 20 Waking up in 6 seconds... Which is correct. However, because the following does not fail: (echo "User-Name = foo" ; echo "User-Password = xyzzy"; echo "Service- type = vpn" ) | \ radclient localhost auth testing123 I suspect it's just that anything succeeds whether it matches or not. Here is the debug output for the VPN test: rad_recv: Access-Request packet from host 127.0.0.1:32772, id=39, length=50 User-Name = "foo" User-Password = "xyzzy" Service-Type = vpn Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "foo", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "foo" rlm_realm: Proxying request from user foo to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for foo radius_xlat: '(uid=foo)' radius_xlat: 'ou=people,dc=zone,dc=example,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=zone,dc=example,dc=com, with filter (uid=foo) rlm_ldap: checking if remote access for foo is allowed by authorizedService rlm_ldap: looking for check items in directory... rlm_ldap: Adding authorizedService as Service-Type, value passwd & op=21 rlm_ldap: Adding authorizedService as Service-Type, value login & op=21 rlm_ldap: Adding authorizedService as Service-Type, value sshd & op=21 rlm_ldap: Adding authorizedService as Service-Type, value xdm & op=21 rlm_ldap: Adding authorizedService as Service-Type, value gdm & op=21 rlm_ldap: Adding authorizedService as Service-Type, value sudo & op=21 rlm_ldap: Adding authorizedService as Service-Type, value su & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user foo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 1 rlm_ldap: - authenticate rlm_ldap: login attempt by "foo" with password "xyzzy" rlm_ldap: user DN: uid=foo,ou=people,dc=zone,dc=example,dc=com rlm_ldap: (re)connect to localhost:389, authentication 1 rlm_ldap: bind as uid=foo,ou=people,dc=zone,dc=example,dc=com/ n0t4u2c! to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user foo authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 1 modcall: leaving group LDAP (returns ok) for request 1 Sending Access-Accept of id 39 to 127.0.0.1 port 32772 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... Received response ID 39, code 2, length = 20

2 1

RE: SQL Accounting oddness
by Sean 12 Oct '06

12 Oct '06

Hi, Check that you have all the ports used by FreeRadius open. It looks as if the accounting traffic is not getting through to the server. Let me know if I'm right. Regards, Sean Bracken http://swarmhotspots.com

3 2

AKA Digest Support in FRadius
by Vineet.Asati＠t-systems.com 12 Oct '06

12 Oct '06

Hi, Would any of you, please confirm me whether AKA Digest Support is there in the Freeradius Server (Version 1.1.3). Thanks in Advance Vineet

1 0

windows login using freeradius?
by Leo Lei 12 Oct '06

12 Oct '06

hi list, can we use freeradius to authenticate the windows login users? if yes, can we guide me to some related materials? thanks. -------------- Leo Lei 2006-10-12

2 1

pam_radius_auth.so : talk_radius() go by 2 second( max 4 second)
by 나종현 12 Oct '06

12 Oct '06

1 0

Huntgroups
by Brad McAllister 11 Oct '06

11 Oct '06

I got past my last config problem that I was having and now I running into what is probably more of a design issue on my side. I am not sure if I am trying to use huntgroups for more than they were intended for and perhaps there is another method of achieving what I am looking to do. To start our current radius server uses "identifiers" which allow users to connect from specific NASs. In the current system I can assign multiple identifiers to an account. For example a wireless user can connect with both the wireless equipment and a dialup as a backup. When I started working with freeRadius I figured I would create huntgroups for each service type, wireless, dialup, dsl, etc. Add the appropriate NASs to the list. Then in my SQL DB I would add the user to the groups they belong to. Unfortunately, when I add multiple entries to the "usergroup" table with different group names, the authentication is rejected with the following error: modcall: group authorize returns ok for request 2 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. To sum things up, I need to know how to let clients connect from multiple NASs with the ability to block them from other NASs. Thanks for the help. -- Brad McAllister bmcallister(a)noc.dls.net

2 1

SQL Accounting oddness
by John Williams 11 Oct '06

11 Oct '06

I’ve just setup a new freeradius server using the exact same config files from our other radius server. We are using a different MySQL database for the second freeradius server so we have changed the database name in sql.conf to reflect this. Authentication is working fine and it’s authenticating from the database. However accounting information is not being entered into the radacct table, its currently empty but we are getting accounting packets back. I run freeradius in debug mode and found the following sql accounting queries that don’t look right: sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" Surely the values should be replaced by the actual information it should be entering into the table? If that’s the case that’s why the radacct table is empty, MySQL won’t insert the data showing there and must be erroring. Anyone got any ideas? Thanks John -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.0.407 / Virus Database: 268.13.1/469 - Release Date: 09/10/2006

1 1

lots of duplicated user logins via cisco aironet
by Michael Messner 11 Oct '06

11 Oct '06

hey freeRADIUS users, [root@Xradius ~]# radwho -r ISALAB.local\\mmessner,ISALAB.local\\mmessner,shell,S31005,Thu 12:15,141.201.43.115, mmessnerO,mmessnerO,shell,S310,Wed 11:33,141.201.43.118, mmessnerO,mmessnerO,shell,S279,Tue 12:45,141.201.43.118, mmessnerO,mmessnerO,shell,S453,Thu 15:13,141.201.43.118, mmessnerO,mmessnerO,shell,S468,Thu 15:24,141.201.43.118, mmessnerO,mmessnerO,shell,S268,Thu 09:44,141.201.43.118, mmessnerO,mmessnerO,shell,S273,Tue 12:33,141.201.43.118, mmessnerO,mmessnerO,shell,S259,Mon 14:49,141.201.43.118, mmessnerO,mmessnerO,shell,S325,Tue 16:28,141.201.43.118, mmessnerO,mmessnerO,shell,S372,Mon 12:07,141.201.43.118, 02-01-8D-C9-2B-19,02-01-8D-C9-2B-19,shell,S31003,Mon 15:44,141.201.43.115, ISALAB.LOCAL\\schernhorst,ISALAB.LOCAL\\schernhorst,shell,S31009,Thu 13:42,141.201.43.115, mmessnerO,mmessnerO,shell,S295,Thu 10:05,141.201.43.118, mmessnerO,mmessnerO,shell,S301,Thu 10:52,141.201.43.118, X.115 is a enterasys switch and the X.118 device is a cisco aironet access point, whats going wrong with this device? acutally there is just one mmessner connected! why is the username as mmessner0 displayed, while if I connect via the enterasys switch I got also the domainpart?!? thanks mIke

1 1

syslog - 1.1.2
by Michael Messner 11 Oct '06

11 Oct '06

hey freeRADIUS users, I'm trying to syslog the radius-messages with freeradius 1.1.2! Now I've added the line log_destination = files to the radiusd.conf, and I also tried to start the radius with the parameter -lsyslog but nothing goes to syslog! Any ideas?!? thanks mIke

4 8

rlm_sql_mysql: safe characters
by Stefan Winter 11 Oct '06

11 Oct '06

Hi, is it a problem to add the equal sign (=) to the list of safe characters for SQL databases? I imagine it might be because it is used to escape MIME-encoded special chars and that might confuse the FR server... I don't want to just try it on our production server; maybe someone has experience with this? As a side-note, I wonder why the safe_characters list is so small. I know it is to prevent SQL injections, but the default queries are all encoded in single quotes ('...'), so there are more safe characters IMO. In particular, how about # ! $ & * + none of these should make problems within single quotes, or am I wrong here? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

1 0