- Freeradius-Users - lists.freeradius.org

EAP-MD5 with LDAP
by Rohaizam Abu Bakar 26 Jun '06

26 Jun '06

Hi.. Using FB 6.0 FR 1.0.5 trying to configure EAP-MD5 with LDAP backend... But it keep reporting: rlm_ldap: Attribute "User-Password" is required for authentication. No EAP been processed... please see full debug log below.. Below is my config with multiple DEFAULT entry... for Wireless services & normal Dialup authentication i) users ===== DEFAULT NAS-Identifier == "Wireless-802.11", Autz-Type := Y5, Auth-Type :=Y5 DEFAULT Autz-Type := LDAP, Auth-Type := LDAP ii) eap.conf ======== eap { default_eap_type = md5 } md5 { } } iii) radiusd.conf ============ $INCLUDE ${confdir}/eap.conf authorize { eap Autz-Type LDAP { ldap1 } Autz-Type Y5 { ldapy51 } } authenticate { Auth-Type LDAP { ldap1 } Auth-Type Y5 { ldapy51 } eap } ldap ldap1 { server = "localhost" identity = "cn=root,dc=jaring,dc=my" password = xxxxxx basedn = "ou=RADIUS,ou=People,dc=jaring,dc=my" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 } ldap ldapy51 { server = "localhost" identity = "cn=root,dc=jaring,dc=my" password = xxxxxx basedn = "ou=Y5,ou=People,dc=jaring,dc=my" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 } rad_recv: Access-Request packet from host 202.73.10.12:1814, id=133, length=197 Framed-MTU = 1466 NAS-IP-Address = 10.220.0.2 NAS-Identifier = "OCEPOP" User-Name = "jaroce" Service-Type = Framed-User NAS-Port = 129 NAS-Port-Type = Ethernet NAS-Port-Id = "ether9_129" Called-Station-Id = "00-11-95-e1-ce-8a" Calling-Station-Id = "00-13-46-86-c3-93" Connect-Info = "CONNECT Ethernet 2Mbps Full duplex" EAP-Message = 0x02020015016a61726f6365406d793031352e636f6d Message-Authenticator = 0x6d5b3fff40ff4c920b88d100ed80a209 Proxy-State = 0x3433 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '/' in User-Name = "jaroce", skipping NULL due to config. modcall[authorize]: module "IPASS" returns noop for request 1 rlm_realm: No '@' in User-Name = "jaroce", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "jaroce" rlm_realm: Proxying request from user jaroce to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 68 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 Processing the authorize section of radiusd.conf modcall: entering group Autz-Type for request 1 modcall: entering group redundant for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for jaroce radius_xlat: '(uid=jaroce)' radius_xlat: 'ou=RADIUS,ou=People,dc=jaring,dc=my' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=RADIUS,ou=People,dc=jaring,dc=my, with filter (uid=jaroce) rlm_ldap: checking if remote access for jaroce is allowed by dialupAccess rlm_ldap: Added password j4r1ng in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFramedCompression as Framed-Compression, value Van-Jacobson-TCP-IP & op=11 rlm_ldap: Adding radiusFramedMTU as Framed-MTU, value 1500 & op=11 rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol, value PPP & op=11 rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & op=11 rlm_ldap: user jaroce authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 1 modcall: group redundant returns ok for request 1 modcall: group Autz-Type returns ok for request 1 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap1" returns invalid for request 1 modcall: group redundant returns invalid for request 1 modcall: group Auth-Type returns invalid for request 1 auth: Failed to validate the user. Login incorrect: [jaroce] (from client OCE_JARING port 129 cli 00-13-46-86-c3-93)

4 6

help
by sarah oveisi 25 Jun '06

25 Jun '06

hello. I couldn't run radius server. I use the following command: service radiusd start Also I couldn't see the radius database in /var/lib/mysql it seems that freeradius did not install correctly on my computer. --------------------------------- Do you Yahoo!? Everyone is raving about the all-new Yahoo! Mail Beta.

2 1

RE: Checking SSID via A/D Group
by Garber, Neal 25 Jun '06

25 Jun '06

>> FreeBSD with OpenSSL 0.9.7d-p1 17 and Samba 3.0.20b. If the server is >> joined to an >> Active Directory domain, would it be possible to not just authenticate >> user/pwd through >> Samba, but also to check for Windows group membership based upon the >> SSID > Yes. For the purposes of group checking, AD is just an LDAP >directory. You should be able to edit the LDAP group membership >checks to do this. Thank you for your quick response Alan. I'm currently using 802.1x with eap-peap and mschapv2 to a Cisco ACS to authenticate WinXP 802.11 users. Would I use eap-peap/mschapv2 and LDAP within FR to do the authentication and will this also support changing AD passwords when they are expired? Also, I've done some google searches and I read the rlm_ldap doc. I found examples on how to do checking for a static LDAP group, but can't find any examples on how to check for a dynamic group name. Can you give me an example of checking AD group membership, using rlm_ldap, where the group varies based upon the NAS group and literal string + attribute value? For example: for NAS group "mobile", user must be a member of "Mobile Users" group; for NAS group "APs" and cisco-av-pair request attr. == "ssid=myssid", the user would need to be a member of "Wireless myssid Users" group in AD (if the attribute isn't present, then reject). If this is possible, can you give me an example of how this would be done? Thanks again for your assistance.

1 0

Re: Freeradius-Users Digest, Vol 14, Issue 99 (Vacation)
by Michael Castillo 24 Jun '06

24 Jun '06

I will be out of the office from June 26 through July 7th, returning July 10th. If you have a network issue please contact Steve Fouchek at 463-2216. Thank you and have a pleasant day. Michael

1 0

sqlcounter, always does the lookup or conditional
by Dennis Skinner 23 Jun '06

23 Jun '06

I was hoping someone could save me a few cycles on a hectic Friday since my test system is down at the moment and the info in radiusd.conf doesn't mention it. With the sqlcounter module, will it always do the sql lookup on an incoming auth request or only if the check-name attribute is among the check items? The latter would really save some overhead if only a few customers were time limited. Thanks! -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

1 0

Checking SSID via A/D Group
by Garber, Neal 23 Jun '06

23 Jun '06

We use Cisco 1232 AP's with EAP-PEAP-MSCHAPv2 to a Cisco ACS (RADIUS server). We would like to restrict access to SSIDs based upon Windows group membership. The ACS server is not capable of doing this. I currently have FreeRadius (1.1.2) installed under FreeBSD with OpenSSL 0.9.7d-p1 17 and Samba 3.0.20b. If the server is joined to an Active Directory domain, would it be possible to not just authenticate user/pwd through Samba, but also to check for Windows group membership based upon the SSID to which the user is trying to authenticate? If this is possible, can you suggest the general approach to implementing this? For instance, if we have SSID's: ssid1, ssid2 and ssid3 and we want to map ssid1 -> Windows group "ssid1 users" ssid2 -> Windows group "ssid2 users" ssid3 -> Windows group "ssid3 users" such that if the user is a member of the group and their credentials are valid, FreeRadius would return Access-Accept. If they aren't a member of the group or their credentials are invalid, it would return Access-Reject. I've seen some threads talking about putting a SSID attribute in LDAP. But, user's could be authorized for more than one SSID so it doesn't seem like that approach would work. Also, administratively, it's easier to identify/manage who is authorized for which SSIDs if it is done via group membership as opposed to a user attribute. Also, does FreeRadius support changing of passwords via MSCHAP to Active Directory when the password is expired? Thank you in advance for any help/guidance you can provide. Neal

2 1

Compiling Problem concerning `crypt' !!!
by Ravi pandey 23 Jun '06

23 Jun '06

Hi all, Attached the codes of error when I am compiling freeradius-1.1.2 When I finish ./configure, then MAKE, the error happens. I am not able to figure out where is the problem Please give any comment on the problem. Log created while creating MAKE is as follows : make[1]: Entering directory `/Home/ochome/rpathak/freeradius-1.1.2' Making all in libltdl... make[2]: Entering directory `/Home/ochome/rpathak/freeradius-1.1.2/libltdl' /bin/sh ./libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -c ltdl.c mkdir .libs gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -c ltdl.c -fPIC -DPIC -o .libs/ltdl.lo ltdl.c: In function `lt_dlopenext': ltdl.c:2926: warning: unused variable `file_found' gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -c ltdl.c -o ltdl.o >/dev/null 2>&1 mv -f .libs/ltdl.lo ltdl.lo /bin/sh ./libtool --mode=link gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -o libltdl.la -rpath /usr/local/lib -no-undefined -version-info 4:0:1 ltdl.lo -ldl -lnsl -lresolv -lsocket -lposix4 -lpthread rm -fr .libs/libltdl.la .libs/libltdl.* .libs/libltdl.* /usr/ccs/bin/ld -G -z defs -h libltdl.so.3 -o .libs/libltdl.so.3.1.0 ltdl.lo -ldl -lnsl -lresolv -lsocket -lposix4 -lpthread -lc (cd .libs && rm -f libltdl.so.3 && ln -s libltdl.so.3.1.0 libltdl.so.3) (cd .libs && rm -f libltdl.so && ln -s libltdl.so.3.1.0 libltdl.so) ar cru .libs/libltdl.a ltdl.o ranlib .libs/libltdl.a creating libltdl.la (cd .libs && rm -f libltdl.la && ln -s ../libltdl.la libltdl.la) make[2]: Leaving directory `/Home/ochome/rpathak/freeradius-1.1.2/libltdl' Making all in src... make[2]: Entering directory `/Home/ochome/rpathak/freeradius-1.1.2/src' make[3]: Entering directory `/Home/ochome/rpathak/freeradius-1.1.2/src' Making all in include... make[4]: Entering directory `/Home/ochome/rpathak/freeradius-1.1.2/src/include' make[4]: Nothing to be done for `all'. make[4]: Leaving directory `/Home/ochome/rpathak/freeradius-1.1.2/src/include' Making all in lib... make[4]: Entering directory `/Home/ochome/rpathak/freeradius-1.1.2/src/lib' /Home/ochome/rpathak/freeradius-1.1.2/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I../include -c crypt.c mkdir .libs gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I../include -c crypt.c -fPIC -DPIC -o .libs/crypt.lo In file included from crypt.c:31: /usr/include/pthread.h:299: error: parse error before '*' token /usr/include/pthread.h:300: error: parse error before '*' token /usr/include/pthread.h:301: error: parse error before '*' token /usr/include/pthread.h:302: error: parse error before '*' token /usr/include/pthread.h:303: error: parse error before '*' token /usr/include/pthread.h:304: error: parse error before '*' token /usr/include/pthread.h:305: error: parse error before '*' token /usr/include/pthread.h:306: error: parse error before '*' token /usr/include/pthread.h:308: error: parse error before '*' token /usr/include/pthread.h:309: error: parse error before '*' token /usr/include/pthread.h:311: error: parse error before '*' token /usr/include/pthread.h:312: error: parse error before '*' token make[4]: *** [crypt.lo] Error 1 make[4]: Leaving directory `/Home/ochome/rpathak/freeradius-1.1.2/src/lib' make[3]: *** [common] Error 2 make[3]: Leaving directory `/Home/ochome/rpathak/freeradius-1.1.2/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/Home/ochome/rpathak/freeradius-1.1.2/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/Home/ochome/rpathak/freeradius-1.1.2' make: *** [all] Error 2 Ravi Kant Pandey --------------------------------- Do you Yahoo!? Next-gen email? Have it all with the all-new Yahoo! Mail Beta.

2 1

Re: Freeradius-Users Digest, Vol 14, Issue 95
by Walter Reynolds 23 Jun '06

23 Jun '06

Great, this worked. Now the question is what example config file had the suppress stanza under the detail auth_log section as well? Mine just listed it under the detail section so I did not know I needed to put it in both places. On Thu, 22 Jun 2006, freeradius-users-request(a)lists.freeradius.org wrote: > Date: Thu, 22 Jun 2006 20:15:54 +0100 > From: A.L.M.Buxey(a)lboro.ac.uk > Subject: Re: So how do you suppress > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060622191554.GC23362(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > >> So how do I actually suppress the user password from the detail log based >> on this? Looking at the rlm_detail file and I might as well be looking at >> a foreign language. > > you can, for example, do somthing like this in radiusd.conf > > # Write a detailed log of all accounting records received. > # > detail { > # Note that we do NOT use NAS-IP-Address here, as > # that attribute MAY BE from the originating NAS, and > # blah blah blah > detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d > > detailperm = 0600 > suppress { > User-Password > } > > } > > > detail auth_log { > detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y% > m%d > > detailperm = 0600 > suppress { > User-Password > } > > } > > its SO much easier if you read the example config files that come with the > new release as they often contain HOW to use a feature/option/argument :-) > > alan > > -- Walter Reynolds University of Michigan

2 1

Radius Logs
by Grant Wright 23 Jun '06

23 Jun '06

Hi there Freeradius 1.1.2, Fedora Core 4, MySQL 4.1.16 I use the RADIUS logs to calculate usage for a client. What I want to do is separate the internal FTP traffic (which is classified as free traffic) from the rest of the traffic so that I can charge the client accordingly. Any Help would be appreciated, I am fairly new to this. Thanks

2 1

huntgroups and rlm_ldap
by adincov＠noos.fr 23 Jun '06

23 Jun '06

Hello, I need to store in a OpenLDAP backend some access control information based on NAS IP address. Normally this can be done via huntgoups and clients local configuration files. Does anyone know a simple method to put access control based on NAS IP in the LDAP backend? Thanks Alex

1 0