- Freeradius-Users - lists.freeradius.org

Authenticate users against the passwd module?
by Scott Lambert 19 Sep '06

19 Sep '06

I am trying to get the ability to authenticate users from a few different password databases on the same server. To that end, I have users in the FreeBSD system password database as well as in a Linux style shadow passwd file. >From a stock FreeRADIUS 1.1.2 radius.conf file have have done: modules { ... + passwd myshadow { + filename = /home/lambert/shadow.txt + format = "*User-Name:Crypt-Password::Group:::::" + # have also tried: + format = "*User-Name:User-Password::Group:::::" + # and supplied the crypted password as the users password + hashsize = 100 + authtype = PAP # have tried with and without + # ignorenislike = no + # allowmultiplekeys = no + } ... } authorization { ... # Read the 'users' file files + myshadow # # Look in an SQL database. The schema of the database ... } authentication { ... + Auth-Type any_is_ok { + myshadow { + reject = 1 + notfound = 2 + ok = return + } + unix + } - unix ... } I've tried to make simpler changes to the authentication section such as just adding "myshadow" on the line above the original "unix" entry. But the above is where I think I want to be. I got the above format from a suggestion which used multiple LDAP instances. The FreeBSD system users are able to authenticate. If I try to list my linux style shadow passwd file module "myshadow" in the authenticate{} section of radius.conf, radiusd -X bombs out with: ... Module: Instantiated mschap (mschap) Module: Loaded passwd passwd: filename = "/home/lambert/shadow.txt" passwd: format = "*User-Name:Crypt-Password::Group:::::" passwd: authtype = "PAP" passwd: delimiter = ":" passwd: ignorenislike = yes passwd: ignoreempty = yes passwd: allowmultiplekeys = no passwd: hashsize = 100 rlm_passwd: nfields: 9 keyfield 0(User-Name) listable: no Module: Instantiated passwd (myshadow) radiusd.conf: "passwd" modules aren't allowed in 'authenticate' sections -- they have no such method. radiusd.conf[1919] Failed to parse "myshadow" subsection. Maybe that's a bug in 1.1.2? I haven't tried 1.1.3 just yet. I'm trying to make the version in the FreeBSD ports collection work before I venture out on my own. If I have to go to 1.1.3, it won't break my heart. If I remove the "myshadow" reference from the authenticate{} section, the "myshadow" users are denied: modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 rlm_passwd: Added User-Password: 'sFE*/CZQF8saE' to config_items rlm_passwd: Added Group: '0' to config_items rlm_passwd: Adding "Auth-Type = PAP" modcall[authorize]: module "myshadow" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns notfound for request 1 modcall: leaving group authenticate (returns notfound) for request 1 auth: Failed to validate the user. I get the feeling that I don't understand how the rlm_passwd module is supposed to be used. I've read docs/rlm_passwd and most, if not all of the other stuff in the docs directory. I'm just missing something. -- Scott Lambert KC5MLE Unix SysAdmin lambert(a)lambertfam.org

2 3

FW: Proxy.conf
by Cliff Hayes 19 Sep '06

19 Sep '06

No reponse. Allow me to restate the question. There in instructions in radiusd.conf that say # To disable proxying, change the "yes" to "no", and comment the # $INCLUDE line. But, it appears that the $INCLUDE for proxy.conf is mandatory regardless of whether proxying is done because it contains the realms. If so, that is an error in the instructions. If not, then I'm missing something and would like to know because I am not proxying. Cliff -----Original Message----- From: freeradius-users-bounces+chayes=afo.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+chayes=afo.net@lists.freeradius.org]On Behalf Of Cliff Hayes Sent: Monday, September 18, 2006 3:49 PM To: FreeRadius users mailing list Subject: RE: Proxy.conf Ok. Thanks. I'm trying to learn. The instructions in radiusd.conf say the following: # To disable proxying, change the "yes" to "no", and comment the # $INCLUDE line. Here's the issue -- how can I comment out the include line if that is what causes my problem. I want to disable proxying. I thought, since that was in the instructions, there must be some other place to put realm info. Cliff -----Original Message----- From: freeradius-users-bounces+chayes=afo.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+chayes=afo.net@lists.freeradius.org]On Behalf Of Alan DeKok Sent: Monday, September 18, 2006 1:20 PM To: FreeRadius users mailing list Subject: Re: Proxy.conf "Cliff Hayes" <chayes(a)afo.net> wrote: > When I comment out the include line for proxy.conf, my users can no longer > authenticate. The logs show their entire username + realm instead of just > the username. I figure it is because it can't strip the realm anymore > because it doesn't know what the realm is. Exactly. > There are REALM sections in the proxy.conf, with type, authhost, and > accthost statements. I have entries there for each of my realms. I have > not found an equivalent to the REALMS section of proxy.conf in MySQL. Do I > use the radgroupcheck table? If so, do I add the authost and accthost > lines? You can't put the REALMS into SQL. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Conditionally adding reply pair
by Garber, Neal 19 Sep '06

19 Sep '06

I need to conditionally add a reply pair based upon Huntgroup-Name and a custom attribute. Pseudocode follows for what I'm trying to accomplish: If Huntgroup-Name == NetSensory then if LDAP-Group-Requirement == "NP-Admin" then pairadd(reply, NetSensory-Permission, "npadmin") Elsif LDAP-Group-Requirement == "NP-Read" then pairadd(reply, NetSensory-Permission, "npread") Elsif LDAP-Group-Requirement == "NP-Insight" pairadd(reply, NetSensory-Permission, "insight") Endif Endif I thought about using an external program (e.g., Perl module) in post-auth to accomplish this. Is this reasonable or is there a better way?

2 1

PGP key of the Freeradius Project
by Thibault Le Meur 19 Sep '06

19 Sep '06

Hi All, Just an email to say that I had difficulties in finding on the web the pgp key used to make the release signature: maybe I have bad eyes... anyway, I think such an important information should be obvious to retrieve. Should it be possible to have a "quick" link in the web site home page (and in the download page) to the PGP key (available at the following URL http://www.freeradius.org/pgp/aland@freeradius.org) Thanks in advance. Regards, Thibault

3 2

huntgroups - doku?
by Michael Messner 19 Sep '06

19 Sep '06

hello mailinglist, in my last mail I got the information to use huntgroups to handle the parameters for different NAS types, but after some research I have not found good documentation of this! Anyone knows some good recources? Here are my new configs, it looks like they are working, but I'm not sure if this is really the correct way: /etc/raddb/huntgroups: enterasys NAS-IP-Address == 141.201.43.115 enterasys NAS-IP-Address == 141.201.43.116 enterasys NAS-IP-Address == 141.201.43.117 cisco NAS-IP-Address == 141.201.43.118 cisco NAS-IP-Address == 141.201.43.119 cisco NAS-IP-Address == 141.201.43.120 one entry in /etc/raddb/users: DEFAULT LDAP-Group == "CN=adminrole,CN=users,DC=isalab,DC=local", Huntgroup-Name == "enterasys" Filter-ID == "Enterasys:version=1:mgmt=su:policy=adminrole", Reply-Message = "Welcome %{Stripped-User-Name:-%{User-Name:-None}} in the %{mschap:NT-Domain} - Domain, there are no restrictions for you in this network", Fall-Through = No DEFAULT LDAP-Group == "CN=adminrole,CN=users,DC=isalab,DC=local", Huntgroup-Name := "cisco" Cisco-AVPair == "aironet:admin-capability=write+snmp+ident+firmware+admin", Tunnel-Type:1 = 13, Tunnel-Medium-Type:1 = 6, Tunnel-Private-Group-ID:1 = 1, Reply-Message = "Welcome %{Stripped-User-Name:-%{User-Name:-None}} in the %{mschap:NT-Domain} - Domain, there are no restrictions for you in this network", Fall-Through = No is this the correct way? thanks mIke

4 5

different NAS types with different parameters
by Michael Messner 19 Sep '06

19 Sep '06

hey list, we have switches from enterasys and access points from cisco, now we have configured the parameters like this example in the users file: DEFAULT LDAP-Group == "CN=xadmins,CN=users,DC=isalab,DC=local" Filter-ID == "Enterasys:version=1:policy=xadmins", Tunnel-Type:1 = 13, Tunnel-Medium-Type:1 = 6, Tunnel-Private-Group-ID:1 = 1, Reply-Message = "Welcome %u", Fall-Through = No so with this entry the enterasys switch also gets the parameters from the aironet and on the other way the same! is this the right way or is there an other possibility to give the differernt types of NAS different parameters? thanks mIke

3 3

advice
by Michelle Gates 19 Sep '06

19 Sep '06

All, We're migrating from our existing FreeRADIUS/MySQL setup to a new one. The new config is up and running in a different colo site and I'm looking for advice as to how I can overlap the two RADIUS servers temporarily without having two DBs running. Would it be best to have the old RADIUS server write to the new MySQL DB, or rather have the old RADIUS server proxy *all* requests to the new RADIUS server, or any other fabulous ideas you all may have? I'm a bit of a newbie, only been working on this for a bit now... so any/all information would be greatly appreciated! Thanks! -michelle.

1 1

Write access to the wiki
by Graham Beneke 19 Sep '06

19 Sep '06

Is access to the wiki exclusive?? I wanted to start working on a sqlcounter page since the current documentation is rather lacking and I plan to 'journal' my exploits in figuring it out... But I can't seem to find the register link that is referred to.

4 4

ERROR! Proxy listen.c error
by Guilherme Franco 19 Sep '06

19 Sep '06

Indeed, but it's happening, and now, even with ADSL modem, as you can see in the radiusd -X output below: This occurs if user mistypes password or if the realm server is down: rad_recv: Access-Request packet from host 192.168.1.1 port 1385, id=21, length=60 User-Name = "user(a)realm.com" User-Password = "password" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 20 rlm_realm: Looking up realm "realm.com" for User-Name = "user(a)realm.com" rlm_realm: Found realm "realm.com" rlm_realm: Proxying request from user user to realm realm.com rlm_realm: Adding Realm = "realm.com" rlm_realm: Preparing to proxy authentication request to realm "realm.com" rlm_eap: No EAP-Message, not doing EAP modcall: group authorize returns noop for request 20 Sending Access-Request of id 16 to 192.168.1.2 port 1645 User-Name = "user(a)realm.com" User-Password = "password" NAS-IP-Address = 192.168.1.1 Proxy-State = 0x3231 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 192.168.1.1 port 1385, id=21, length=60 Sending duplicate proxied request to home server 192.168.1.2 port 1645 - ID: 16 Assertion failed in listen.c, line 558 Aborted Thanks. "Guilherme Franco" <guilhermefranco at gmail.com> wrote: > I was worried about this, but when I tested with the user > authenticating from an ADSL modem, there are no problems. > > So, might be just another of ERX's crazy behaviors. Still... it shouldn't kill the server. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

first auth needs 20s
by Michael Messner 19 Sep '06

19 Sep '06

hey mailinglist, I have a little prob. with the first login via the radiusserver, it looks like this MS-Active directory -- freeradius 1.1.2 -- cisco or enterasys switch If I restart the radiusd the first try for a login needs about 20 seconds: [root@Xradius ~]# time echo "User-Name = mmessner, User-Password = m1k3" | radclient -c1 -s 127.0.0.1:1645 auth testing123 Received response ID 106, code 2, length = 71 Tunnel-Type:1 = VLAN Tunnel-Medium-Type:1 = IEEE-802 Tunnel-Private-Group-Id:1 = "1" Reply-Message = "Welcome mmessner in the - Domain" radclient: received response to request we did not send. Total approved auths: 1 Total denied auths: 0 Total lost auths: 0 real 0m20.285s user 0m0.072s sys 0m0.013s after this time everything goes fast, also the next login attempts! freeradius hangs for this time with the message: radius_xlat: 'CN=Users,DC=isalab,DC=local' radius_xlat: 'sAMAccountName=mmessner' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to labad01:389, authentication 0 If I sniff the packets on the AD-server in this time there are no LDAP requests. any ideas?!? thanks mIke

3 3