- Freeradius-Users - lists.freeradius.org

Allowing Access based on Group Membership
by Jay Lee 16 Feb '06

16 Feb '06

After a bit of effort I have managed to get Wireless with WPA encryption working with FreeRadius and an eDirectory LDAP Backend (using Universal password). My last task is to allow Wireless authentication only to members of a given LDAP Group. I seem to be having some issues though. Here is my ldap config in /etc/raddb/radiusd.conf: ldap { server = "ldap.pbu.edu" identity = "cn=admin,o=PBU" password = "password" basedn = "o=PBU" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" start_tls = yes tls_cacertfile = /etc/raddb/certs/rootder.b64 access_attr = "cn" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = nspmPassword edir_account_policy_check=yes groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 } If I empty out /etc/raddb/users completely, authentication works. If I put the following in users: DEFAULT LDAP-Group == "Wireless", Auth-Type := Accept Fall-Through = No DEFAULT Auth-Type := Reject and start freeradius with "radiusd -X -A" I get: rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'o=PBU' radius_xlat: '(uid=jlee)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=PBU, with filter (uid=jlee) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=cn=jlee,o=PBU))(&(objectCla ss=GroupOfUniqueNames)(uniquemember=cn=jlee,o=PBU)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=PBU, with filter (&(cn=Wireless)(|(&(objectClas s=GroupOfNames)(member=cn=jlee,o=PBU))(&(objectClass=GroupOfUniqueNames)(uniquem ember=cn=jlee,o=PBU)))) rlm_ldap::ldap_groupcmp: User found in group Wireless rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 1 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for jlee radius_xlat: '(uid=jlee)' radius_xlat: 'o=PBU' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=PBU, with filter (uid=jlee) rlm_ldap: checking if remote access for jlee is allowed by cn rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jlee authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 1 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: ldap_release_conn: Release Id: 0 modcall[post-auth]: module "ldap" returns ok for request 1 modcall: group post-auth returns ok for request 1 Sending Access-Accept of id 194 to 10.1.1.44:32769 Finished request 1 However, the wireless client never quite seems to finish associating. Any ideas what I'm doing wrong here? What should the users file look like to allow anyone who is a member of the Wireless LDAP group and deny everyone else? Jay Lee -- Jay Lee Network / Systems Administrator Information Technology Dept. Philadelphia Biblical University --

2 2

Re: Re: how to disconnect user after quota given to him finishes ?
by Rupesh Amatya 16 Feb '06

16 Feb '06

Dear all, The user gets logged out exactly after the time set in Session Time Out. But I am trying to create package like 4hours per day, 2 hours perday. If I put 4hours in Session time and after using 3 hours , if he disconnects and then reconnects, he can again use 4 hours. Is there a way that he can no more log in after he uses 4 hours/day ? Thanking you all, Rupesh Amatya -------- Original Message -------- ==> From: Lewis Bergman <lbergman(a)wtxs.net> ==> Date: Wed, 15 Feb 2006 08:38:33 -0600 Dear all, I am using Freeradius(with mysql as database for users ) with Mikrotik as NAS. This for PPPOE users. I used Dialup Admin to manage freeradius. There is default package of 4hours/day but the users do not get > disconnect after 4 hours. It just shows " Out of Quota". What needs > to be done to automatically disconnect user after the daily quota is > finished ? ************************************** There a few session attrbutes you could use for this. Session-Timeout is the first one that springs to mind. I don't know if the client will pay attention to it though.

3 2

Possibility to set acct_table1 outside of sql.conf?
by Andreas Engler 16 Feb '06

16 Feb '06

Dear All, i would like to insert Accounting-Information in different tables for different NASs. Therefor i would use different sql-Instances and the acct_users file. The instances would only differ in acct_tabl1 and acct_table2. I tryed to set the variables in the sections of every instance in radiusd.conf before including sql.conf. In sql.conf i commented out the variables. But then there is reported an error, that the variable acct_table1 is unknown. Is there a possibility to set the variables acct_table1 and acct_table2 in the sections for the different instances in radiusd.conf? Or have i to provide for every instance an own sql.conf. Hopefully my problem gets clear!? Thank you Andreas Engler

2 1

Adding Extra Attribute
by Abdul Lateef 16 Feb '06

16 Feb '06

Hi all, Is possible to send some extra cisco VSA attribute in AccessResponse Packet? This is what i want to include in the packet: Cisco VSA(252): GWname/option//CalledID//CallerID/GWip:172 I tried in user file with the following configuration but it doesnot seems to work 12122 Auth-Type := Login-User h323-credit-time = 500 Cisco VSA(252): GWname/option//CalledID//CallerID/GWip:1719 Please advice me to add this thing in response packet. -------- Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 ICQ: 276994704 MSN: abdulzu(a)hotmail.com GoogleTalk: lateef.np(a)gmail.com YM!: abdul_zu Doha Qatar http://www.hatif.com __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

rlm_perl
by freeradius＠singularity.co.za 16 Feb '06

16 Feb '06

Hi All, I'm keen to start using the rlm_perl module now that it has been made stable. However I find that the documentation relating to the module is sparse. Is there any official documentation on this module that anyone knows of? I would also like to know whether the perl module loaded is persistent. Thanks Philip

2 3

flat file user
by Priscilla B 16 Feb '06

16 Feb '06

Hi everyone, I have a question, have anyone of you using flat file for user database? If so, Can we use some script to update the content? If so do you guys have some examples? For example if i limited user A to use only 4 hours. and after he use 2 hours, and log out, I want to update the detail file, so user A data will become only 2 hours now. I know we can do that with sql and others . but how about flat file. Need a light here. thanks a lot Priscilla --------------------------------- What are the most popular cars? Find out at Yahoo! Autos

1 0

pam_radius and Cisco ACS
by Tom 16 Feb '06

16 Feb '06

I have been tasked with having all non windows devices on our network to authenticate against our Active Directory, which is the reason we are using Cisco ACS. ACS currently authenticates for all cisco devices against our AD, via the external windows database option. I am now trying to get pam_radius to do the same with ACS's radius. I have compiled pam_radius and it appears to be working as intended, however Cisco ACS reports "External DB User Invalid or bad password" anytime I try to use the same credentials that properly authenticate with ACS's tacacs on a linux or freebsd server. The username shows up properly on the ACS server, so I am assuming that the NAS is sending the proper username, but it appears that the password is not being sent correctly. I know the ACS server is trying to authenticate against AD because after so many tries the account get's locked out. Has anyone been able to accomplish what I am trying to do here? Any suggestions besides "lose ACS" to get this to work? Is there something I can pass to the pam_radius module to have it transmit the password the way the ACS server is expecting to see it? I appreciate any help or suggestions anyone can provide in advance. Thank you, Tom

2 3

Re: (Cannot assign requested address) bind() failed
by Sean 16 Feb '06

16 Feb '06

On Mon, 2006-02-13 at 12:08 +0100, freeradius-users-request(a)lists.freeradius.org wrote: > Re: (Cannot assign requested address) bind() failed Hi Tommy, If you are using DD-WRT you might be making a common mistake. It won't accept a Web name for re-direction. You have to use an IP address. EG 123.123.123.123/hotspotlogin.cgi/ It is also vital to put a / at the end of the address. I've written a tutorial that might help you at http://swarmhotspots.com/faq.html and I also provide free FreeRadius testing for Chillispot at http://swarmhotspots.com/Chilli-Test-Area Regards, Sean Bracken http://swarmhotspots.com

2 1

Multiple LDAP Search Bases - Per NAS
by Ben Plimpton 15 Feb '06

15 Feb '06

Hello all Is it possible to setup FreeRadius so that requests coming from a certain NAS will use a different search base than the default? For example: We have an ou=radius,dc=test,dc=com and we stick dsl users records in there. These user records have attributes that would be dsl specific like static IP addressing. We would like to be able to provide users with a backup dialup in case anything goes really wrong with our dsl service. Could we configure FreeRadius to look in a different ou, say ou=dialup,ou=radius,dc=test,dc=com, when it received an authentication request from the dialup NASes? Is this possible? We have also considered running two instances of FreeRadius, one on the higher ports and one on the lower, and then pointing the DSL customers to one and the dialup to another, but I would like to avoid this if there is a cleaner solution that I am not aware of. Our FreeRadius server is running Fedora Core 4 and FreeRadius 1.0.4 OpenLDAP is our LDAP backend. Thanks for any replies. -- "Microsoft is not the answer, it's the question. NO is the answer." Ben Plimpton Network Engineer bplimpton(a)sopris.net 970-963-SURF(7873) ext 5174 www.sopris.com

2 1

Cisco aaa authorization network
by Stefan Winter 15 Feb '06

15 Feb '06

Hello, while migrating a NAS (Cisco AS5300) from TACACS+ to RADIUS I stumbled over some peculiarities of the equipment. When configuring with aaa authentication network default group radius aaa authorization network default group radius and having a user logging in with PPP, it seems that the NAS expects some of the Cisco-AVPairs, but I don't exactly know what to send him. Since I send the wrong things, I'm in the situation that authentication succeeds (Access-Accept), but subsequent authorization fails. I know this is slightly off-topic for the list, sorry, but I'm really at the end of my knowledge here, maybe someone has a clue. The old TACACS+ config was group = DialupUser { maxsess = 2 service = ppp protocol = ip {} service = ppp protocol = multilink {} } which I thought I could convert into the following entry in the users file DEFAULT NAS-IP-Address == 158.64.2.6 Framed-Protocol := PPP, Cisco-AVPair += "ppp:protocol=ip", Cisco-AVPair += "ppp:protocol=multilink" but either that was not sufficient and I need more Cisco-AVPairs or it's plain wrong (the attributes get sent alright, it's just not what the NAS likes). Instead of "ppp:" I also tried "lcp:" "ipcp:" and "network:". None of this impresses the AS5300, and turning on debugging didn't reveal what he would expect instead. Can someone help out? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1