- Freeradius-Users - lists.freeradius.org

reply-list fed by LDAP
by Florian Prester 01 Feb '06

01 Feb '06

Hello, I use freeradius 1.05 with LDAP. Now I do not use the RADIUS-LDAP-Schemata - because I think I do not need it, all teh required Information is provided by the Schema I use ( I think :-) ). Within the Schema I have an attribute szUserId which I want to return to the client. Now. this LDAP-attribute (szUsesrId) is mapped by ldap.attrmap to User-ID, this Radius-attribute (User-ID) is speziufied as an reply-item in the users-file: DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, User-ID = 576, Fall-Through = Yes But it does not get sent to the client. Now my question, WHY? Do I have to define the RADIUS-Attribute User-ID in the dictionary-file? If I do so, radiusd complaines this attribute is an check-item and no reply-item!?!?!? my Log: Tue Jan 31 12:22:12 2006 : Debug: Processing the authorize section of radiusd.conf Tue Jan 31 12:22:12 2006 : Debug: modcall: entering group authorize for request 0 Tue Jan 31 12:22:12 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Tue Jan 31 12:22:12 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Tue Jan 31 12:22:12 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 0 Tue Jan 31 12:22:12 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 0 Tue Jan 31 12:22:12 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 0 Tue Jan 31 12:22:12 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 0 Tue Jan 31 12:22:12 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Tue Jan 31 12:22:12 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Tue Jan 31 12:22:12 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 0 Tue Jan 31 12:22:12 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 0 Tue Jan 31 12:22:12 2006 : Debug: rlm_realm: No '@' in User-Name = "sz148", looking up realm NULL Tue Jan 31 12:22:12 2006 : Debug: rlm_realm: No such realm "NULL" Tue Jan 31 12:22:12 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Tue Jan 31 12:22:12 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 0 Tue Jan 31 12:22:12 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Tue Jan 31 12:22:12 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Tue Jan 31 12:22:12 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Tue Jan 31 12:22:12 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 0 Tue Jan 31 12:22:12 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Tue Jan 31 12:22:12 2006 : Debug: users: Matched entry DEFAULT at line 43 Tue Jan 31 12:22:12 2006 : Debug: users: Matched entry DEFAULT at line 50 Tue Jan 31 12:22:12 2006 : Debug: users: Matched entry DEFAULT at line 53 Tue Jan 31 12:22:12 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Tue Jan 31 12:22:12 2006 : Debug: modcall[authorize]: module "files" returns ok for request 0 Tue Jan 31 12:22:12 2006 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 0 Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: - authorize Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: performing user authorization for sz148 Tue Jan 31 12:22:12 2006 : Debug: radius_xlat: '(&(objectClass=szUser) (Userid=sz148))' Tue Jan 31 12:22:12 2006 : Debug: radius_xlat: 'ou=AAAuser,o=Domain ,c=DE' Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: attempting LDAP reconnection Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: (re)connect to xxx.xxx.xxx.xxx:400, authentication 0 Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: bind as cn=user,ou=allro,ou=AAAdsadm,o=doamin,c=DE/xxx to xxx.xxx.xxx.xxx:400 Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: waiting for bind result ... request 1 done Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: Bind was successful Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: performing search in ou=AAAuser,o=domain,c=DE, with filter (&(objectClass=szUser) (Userid=sz148)) request 2 done Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: checking if remote access for sz148 is allowed by uid Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: looking for check items in directory... Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: Adding unixPassword as Crypt-Password, value op=21 Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: Adding szVpnPassword as NT-Password, value op=21 Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: looking for reply items in directory... Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: Adding szIpAddress as Framed-IP-Address, value 121.23.32.20 & op=11 Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: Adding szUserid as User-ID, value sz148 & op=11 Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: user sz148 authorized to use remote access Tue Jan 31 12:22:12 2006 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Jan 31 12:22:12 2006 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 0 Tue Jan 31 12:22:12 2006 : Debug: modcall[authorize]: module "ldap" returns ok for request 0 Tue Jan 31 12:22:12 2006 : Debug: modcall: group authorize returns ok for request 0 Tue Jan 31 12:22:12 2006 : Debug: rad_check_password: Found Auth-Type pap Tue Jan 31 12:22:12 2006 : Debug: auth: type "PAP" Tue Jan 31 12:22:12 2006 : Debug: Processing the authenticate section of radiusd.conf Tue Jan 31 12:22:12 2006 : Debug: modcall: entering group Auth-Type for request 0 Tue Jan 31 12:22:12 2006 : Debug: modsingle[authenticate]: calling pap (rlm_pap) for request 0 Tue Jan 31 12:22:12 2006 : Debug: rlm_pap: login attempt by "sz148" with password Tue Jan 31 12:22:12 2006 : Debug: rlm_pap: Using password "" for user sz148 authentication. Tue Jan 31 12:22:12 2006 : Debug: rlm_pap: Using CRYPT encryption. Tue Jan 31 12:22:12 2006 : Debug: rlm_pap: User authenticated succesfully Tue Jan 31 12:22:12 2006 : Debug: modsingle[authenticate]: returned from pap (rlm_pap) for request 0 Tue Jan 31 12:22:12 2006 : Debug: modcall[authenticate]: module "pap" returns ok for request 0 Tue Jan 31 12:22:12 2006 : Debug: modcall: group Auth-Type returns ok for request 0 Tue Jan 31 12:22:12 2006 : Auth: Login OK: [sz148] (from client Windows port 0) Sending Access-Accept of id 13 to xxx.xxx.xxx.xxx:1818 Framed-MTU = 576 Tunnel-Private-Group-Id:0 := "rlan79" Framed-IP-Address = sss.sss.sss.sss Tue Jan 31 12:22:12 2006 : Debug: Finished request 0 Thaks in advance Florian -- Dipl. Inf. Florian Prester Network Administration Regionales RechenZentrum Erlangen Universitaet Erlangen-Nuernberg Martensstr. 1 91052 Erlangen Germany Tel.: +499131 8527813

2 2

User groups, HELP!!!
by Vadimv82 (sent by Nabble.com) 31 Jan '06

31 Jan '06

Hello. I run FreeRadius with MySQL. And need help with authentification groups. Imagine i have many WiFi hot spots each with own NAS and IP. Any user can register and get a password and login, but he can only get access through certain NAS where he registered at, if he goes to another spot he cant login there with it. So i have to create access groups by NAS IP on Radius server, how do i do that? I tried to use huntgroups, but i dont really understand how they work. And i can't put every user into 'users' conf, cuz then every time somebody registeres i need to restart Radius server so it would reload 'users' conf. How can i do that? I need to create a group once for each Hot Spot, and then user registeres for access, he automaticaly gets a certain group status, and when he tries to login, radius server checks his NAS ip and his group, if they match, NAS gives him access to internet. Thank u, for ur help. Vadim. -- View this message in context: http://www.nabble.com/User-groups%2C-HELP%21%21%21-t1024919.html#a2657416 Sent from the FreeRadius - User forum at Nabble.com.

1 2

FW:
by Herman Swensson 31 Jan '06

31 Jan '06

_____ Hello, I have installed freeradius and get the next error rlm_preprocess: Error reading /etc/raddb/huntgroups radiusd.conf[971]: preprocess: Module instantiation failed. -rw-r--r-- 1 root root 1604 jun 23 2005 /etc/raddb/huntgroups What must I change?? Herman -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 267.14.25/247 - Release Date: 31-1-2006 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 267.14.25/247 - Release Date: 31-1-2006

1 0

RE: User groups, HELP!!!
by Jonathan De Graeve 31 Jan '06

31 Jan '06

Use SQL groups based on huntgroups J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be ________________________________ Van: freeradius-users-bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.o rg [mailto:freeradius-users-bounces+jonathan.de.graeve=imelda.be@lists.free radius.org] Namens Vadimv82 (sent by Nabble.com) Verzonden: maandag 30 januari 2006 11:34 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: User groups, HELP!!! Hello. I run FreeRadius with MySQL. And need help with authentification groups. Imagine i have many WiFi hot spots each with own NAS and IP. Any user can register and get a password and login, but he can only get access through certain NAS where he registered at, if he goes to another spot he cant login there with it. So i have to create access groups by NAS IP on Radius server, how do i do that? I tried to use huntgroups, but i dont really understand how they work. And i can't put every user into 'users' conf, cuz then every time somebody registeres i need to restart Radius server so it would reload 'users' conf. How can i do that? I need to create a group once for each Hot Spot, and then user registeres for access, he automaticaly gets a certain group status, and when he tries to login, radius server checks his NAS ip and his group, if they match, NAS gives him access to internet. Thank u, for ur help. Vadim. ________________________________ View this message in context: User groups, HELP!!! <http://www.nabble.com/User-groups%2C-HELP%21%21%21-t1024919.html#a26574 16> Sent from the FreeRadius - User <http://www.nabble.com/FreeRadius---User-f1104.html> forum at Nabble.com.

3 2

RE: FreeRadius - setting up
by Min Qiu 31 Jan '06

31 Jan '06

Fedora Core 4 has prebuild rpm freeradius-1.0.4.-1.FC4.1 "yum install freeradius" will do it. Hope this will help, Min > -----Original Message----- > From: > freeradius-users-bounces+mqiu=globalinternetworking.com@lists. > freeradius.org > [mailto:freeradius-users-bounces+mqiu=globalinternetworking.co > m(a)lists.freeradius.org] On Behalf Of Timolthy Keithy > Sent: Tuesday, January 31, 2006 4:19 PM > To: freeradius-users(a)lists.freeradius.org > Subject: FreeRadius - setting up > > > Hi, I am trying to build the FreeRadius under Fedora > Core 4, I found many info on how to buil FreeRadius on > the Internet, which includes freeradius.org, and I > tried several times and different info from websites > but still without luck. > > Anyone has any info with step-by-step on how to build > the Freeradius from scratch please share or point to > where I can obtain those correct info, I would like to > set it to work with PEAP, LEAP, TLS, and TTLS. > > FreeRadius 1.x and OpenSSL, etc... > > Very appreciated in advance, > > Timolthy > > > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam protection around > http://mail.yahoo.com > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Re: New accounting database each month
by Sean 31 Jan '06

31 Jan '06

Yes. I can do that for you.

1 0

Re: Capturing the inner authentication ID for Radius
by CHui 31 Jan '06

31 Jan '06

>"CHui" <CHui(a)lbl.gov> wrote: >> Although it seems to work for me, I am not sure about the use of attribute >> Class for tracking user ID would interfere with other operation (like the > one attribute Class was originally designed for)? > > It was designed for local sites to do whatever they wanted. So you're doing the right thing. > >> Also, the attribute Class is of type Octet. Does anyone know of a way to >> convert it to text in SQL? > > Edit the dictionary, and change "octets" to "string". > > Alan DeKok. Never thought of simply changing the attribute type in the dictionary file. Works great. Thanks. I use the "use_tunneled_reply = yes" in eap.conf to capture the user name inside of the tunnel. I have observed that the Class attribute now contained both the outer identity and the user name from inside the tunnel. >From the debug output: Sending Access-Accept of id 170 to 198.128.24.10:1645 Class = "SomeoneElse" Cisco-AVPair = "ssid=CiscoTestAP" Session-Timeout = 60 Class = "chui.guest" MS-MPPE-Recv-Key = 0x... MS-MPPE-Send-Key = 0x... EAP-Message = 0x03070004 Message-Authenticator = 0x... User-Name = "SomeoneElse" Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 198.128.24.10:1646, id=112, length=262 Acct-Session-Id = "0600000000000204" Called-Station-Id = "0014.a800.44c0" Calling-Station-Id = "0002.2d27.05e2" Cisco-AVPair = "ssid= CiscoTestAP" Cisco-AVPair = "vlan-id=0" Cisco-AVPair = "nas-location=unspecified" User-Name = "SomeoneElse" Cisco-AVPair = "connect-progress=Call Up" Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "708" NAS-Port = 708 Class = "SomeoneElse" Class = "chui.guest" Service-Type = Framed-User NAS-IP-Address = 198.128.24.10 Acct-Delay-Time = 0 In the users file, I have the default entry as follows: DEFAULT Class = "{User-Name}", Fall-Through = No What should I do to get the Tunnel user name only instead of both send as reply attribute "Class"? Thanks Cedric

2 1

Accounting status type
by Priscilla B 31 Jan '06

31 Jan '06

Hi, just short question. Where should I put the acct-status-type? is it in users file? Many thanks Priscilla __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

rlm_perl
by Chris Knipe 31 Jan '06

31 Jan '06

Hi, Is there any way to get rlm_perl to work with binary code, instead of source? I currently have a perl script executing via rlm_perl that does some fancy stuff in authentication and accounting. Due to popular demand, I now have 3rd parties interested in this code, but I don't feel it is secure enough to provide these vendors with the open source perl code. I don't believe I can accomplish with rlm_exec what I do in rlm_perl, so I'm kinda hoping that someone would have a solution here for me that would allow rlm_perl (or a similar module perhaps), to execute compiled code. Hope I make sense, and that someone can shed some light and pointers for me. Thanks, Chris.

4 4

Stop current session.
by ujin 31 Jan '06

31 Jan '06

How to disconnect on SNMP current session on NAS if the user it is authorized and to be on-line. I think it it is possible to make 1. To use rlm_perl and in parameter acounting will specify a script which to disconnect on snmp session. Whether and there are still variants?

1 0