- Freeradius-Users - lists.freeradius.org

Re: Two Ldaps Authentication
by Terry J Fike Jr 16 Jun '06

16 Jun '06

Message: 6 Date: Fri, 16 Jun 2006 09:44:29 -0700 (PDT) From: fvt3 <fvt3(a)yahoo.com> Subject: Re: Two Ldaps Authentication To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20060616164429.4187.qmail(a)web42106.mail.mud.yahoo.com> Content-Type: text/plain; charset=iso-8859-1 Alan, This is what I have in my radius.conf Autz-Type LDAP1{ ldap_ldap1{ invalid=return } ldap_ldap2 } Auth-Type LDAP1 { redundant{ ldap_ldap1{ } ldap_ldap2 } users file DEFAULT Auth-Type = LDAP1 Fall-Through = No, Reply-Message = "ldap login" I'm forcing radius to lookup user in ldap1(ldap) and ldap2(Active Directory). The same user name can reside on both db backend. With this setup, radius only works if the user name does not exist on both db. If user John is on both db, it would only authenticate off LDAP1 and not in LDAP2. Here is my log <snip> correct...this is the way you have it configured. as long as ONE ldap server answers the request (whether it be an authentication allowed or rejected) it still answered. so it won't fail over to the next ldap server... --- Alan DeKok -- Terry J Fike Jr System Administrator MTA Solutions 907-793-4100 tfike(a)mtasolutions.com

2 1

FreeRadios rlm_sql dumps if databaase server hiccups
by Matt 16 Jun '06

16 Jun '06

Hi, We use FreeRadius with unixODBC and the rlm_sql to connect to a Microsoft SQL database. All works great... except if the SQL database goes down, firewall has the translate table, someone trips over a network cable.... anything that causes the connection between the radius and SQL to be disturbed, it just says "There are no DB handles available...." instead of reconnecting... the only way I've found to reconnect, is to restart... Any comments or thoughts on this problem?

5 8

Two Ldaps Authentication
by fvt3 16 Jun '06

16 Jun '06

Hi, I am trying to setup Freedius to have multiple ldap authentication. I want to authenticate off ldap1, then ldap2 then mysql. If authentication fail in ldap1, then go to ldap2. Ldap1(ldap) and ldap2(AD). Here is my configuration Modules { ldap ldap1 { } ldap ldap2{ } } instantiate{ ldap1 ldap2 } authorize { Autz-Type LDAP1{ ldap1 } Autz-Type LDAP2{ ldap2 } files } authenticate { Auth-Type LDAP1 { ldap1 } authenticate { Auth-Type LDAP2 { ldap2 } In the users file I have: DEFAULT Autz-Type := "LDAP1", Auth-Type = "LDAP1" Fall-Through = Yes, Reply-Message = "ldap" DEFAULT Autz-Type := "LDAP2", Auth-Type = "LDAP2" Fall-Through = Yes, Reply-Message = "Active D" With this setup, radius is skipping ldap1 and go directly to ldap2. How can I force it to read ldap1 then ldap2 in the user file. Anyone out there knows how I can solve this issue? Thanks in advance... __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 2

Startup message not being logged
by John Horne 16 Jun '06

16 Jun '06

Hello, A minor question really. I have just upgraded a server from Fedora Core 3 (freeradius 1.0.1) to FC5 (freeradius 1.0.5). I notice that when I start freeradius on FC5 (using 'service radiusd start') a message is sent to stdout: Fri Jun 16 12:06:59 2006 : Info: Starting - reading configuration files ... Should this happen? I thought this should be logged in the log file (defined in the radiusd.conf). I'm asking because I'm just wondering if this is indicative of my having misconfigured something? I couldn't find anything in the changelog about this. Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 233839

2 4

rlm_detail perfomances
by Geoffroy Arnoud 16 Jun '06

16 Jun '06

Hi all, I have question for those who use rlm_detail module. I saw in source code that this module is thread unsafe. My understanding is that will not avoid FreeRADIUS to run multi-thread, but that only one thread will be able to log details at a time. Am I right? Second question: does anybody use rlm_detail on a production platform? If yes, what is the request rate that can be supported nicely? Many thanks for any testimonial. Geof.

2 1

Openvpn server and Freeradius client
by hal 16 Jun '06

16 Jun '06

running: Redhat Enterprise Linux version 4 Openvpn 2.0.7 (server) freeradius pam_radius-1.3.16 (client) Using the above the Openvpn server will authenticate an Openvpn client using a radius server on a remote machine. The above ONLY works when the username supplied by the Openvpn client is found in the passwd file on the Openvpn server. Yes it does use the radius server to authenticate. As you can imagine this is not the behavior I want. I have no clue where the problem(s) is/are?! Is it redhat, Openvpn, Freeradius or a combination of the three? Does anyone have a clue, hint, or idea what the problem might be? Can anyone point me in the right direction? hal

2 2

mysql accounting
by Sean Taylor 16 Jun '06

16 Jun '06

I have a quick question on the mysql accounting. I am working on my own interface for managing the freeradius+mysql setup. Everything is working great, I can view all my users, see who's connected, add new users, manage static vs. dynamic IP's, etc..The problem is it doesnt seem to log authentication failures into the radacct table. It logs all the successes just fine, but it would be very beneficial to have it log the failures too. I have the sql module turned on in the accounting section of the config and have uncommented all of the accounting queries. Any help appreciated. Thanks Sean Taylor Systems Administrator Valutel Communications

3 4

rlm_detail bug when "locking = yes"
by Michael Chernyakhovsky 16 Jun '06

16 Jun '06

hello, everybody. my radius use a rlm_perl module, wich open and write some informations to files. also it use rlm_detail but without locking. 2 days ago i add second rlm_detail to config with option "locking = yes". since i got 2 files with corrupted datas which accessed by rlm_perl. i think bug is in rlm_detail.c. there is no close() after successful open and failed filelock! 198: /* 199: * Open & create the file, with the given permissions. 200: */ 201: if ((outfd = open(buffer, O_WRONLY | O_APPEND | O_CREAT, 202: inst->detailperm)) < 0) { 203: radlog(L_ERR, "rlm_detail: Couldn't open file %s: %s", 204: buffer, strerror(errno)); 205: return RLM_MODULE_FAIL; 206: } ... 233: if (!locked && inst->locking && lock_count >= 80) { 234: radlog(L_ERR, "rlm_detail: Failed to aquire filelock for %s, givingup", 235: buffer); 236: return RLM_MODULE_FAIL; 237: } we need close outfd right before "return RLM_MODULE_FAIL;" at line 236. Mike.

2 1

Re: \000 in "octets" attribute?
by Erik Bolsø 16 Jun '06

16 Jun '06

On 2006-06-15 07:50, Stefan Winter <stefan.winter(a)restena.lu> wrote: > Hi, > > I'm having a curious problem with a vendor-specific single-byte > > "octets"-attribute and attr_rewrite. > > > > Essentially, I'm trying to rewrite an ascii "0" to a single-byte > > 0x00 > > value. But after this rewrite rule, a zero-byte value is returned > > instead. Any way to get around this? > > > > With \001, \002, etc, all's well. > > > > (incidentally, this is freeradius version 1.0.1 in RHEL4) > > the RADIUS RFC forbids attributes with a terminating \000. The server > knows > that, and will shorten the octet attribute by cutting off the \000 - > leaving > an empty string behind. If your NAS really requires a trailing \000: > fix the > NAS. It is not RFC-compliant then. Essentially, the vendor-specific attribute value is a 1-byte unsigned integer, not a string. Haven't done a live test yet, so I do not know how it handles the empty value. Perhaps all goes well. I'll let you know. My rfc-reading seems to contradict you a little bit, though? RFC2869 section 5: Note that none of the types in RADIUS terminate with a NUL (hex 00). In particular, types "text" and "string" in RADIUS do not terminate with a NUL (hex 00). The Attribute has a length field and does not use a terminator. Text contains UTF-8 encoded 10646 [8] characters and String contains 8-bit binary data. Servers and servers and clients MUST be able to deal with embedded nulls. RADIUS implementers using C are cautioned not to use strcpy() when handling strings. -- Erik Bolsø Linpro AS

4 19

FreeRADIUS + LDAP Authentication/Authorization + MySQL Accounting
by Dan Brummer 15 Jun '06

15 Jun '06

Hello, I have been researching the use of FreeRADIUS on my network for the past few days. I'm not sure if FreeRADIUS can do what I want. Here is a list of my requirements: -Authentication through LDAP -Authorization through LDAP -Accounting through MySQL I have multiple Cisco and Foundry devices on my network. The RADIUS server will primarily be used for AAA for Telnet/SSH logins and eventually VPN dialin accounts. Is FreeRADIUS the software I should use? Thank you, Dan

2 1