- Freeradius-Users - lists.freeradius.org

rlm_ldap filter problem
by Norbert Wegener 21 Dec '05

21 Dec '05

When I set my vars to the values below, ldapsearch succeeds: server="TDE002.mydomain.NET"^M identity="testrad(a)TDE002.mydomain.NET"^M password="!QAY2wsx3edc4"^M basedn="dc=TDE002,dc=mydomain,dc=NET"^M filter="(&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID "^M ^M #ldapsearch -LLL -b "DC=TDE002,dc=mydomain,dc=NET" -s sub $FILTER -x $LOGON ^M ldapsearch -LLL -h $server -b "$basedn" -s sub $filter -x -D $identity -w $password ^M lnxad:/usr/local/etc/raddb # sh x^M dn: CN=26TEF001,OU=CAT-Computers,OU=OU16,OU=MchP,DC=tde002,DC=mydomain,DC=net^M primaryGroupID: 515^M servicePrincipalName: HOST/26TEF001^M servicePrincipalName: HOST/26tef001.tde002.mydomain.net^M ^M # refldap://DomainDnsZones.tde002.mydomain.net/DC=DomainDnsZones,DC=tde002,DC… itest,DC=net^M Having the same variables with the same values set on the same machine in radiusd.conf: ldap ldap1 { server = "tde002.mydomain.net" identity = "testrad(a)TDE002.SITEST.NET" password = "!QAY2wsx3edc4" basedn = "dc=TDE002,dc=SITEST,dc=NET" filter="(&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID" ldap_debug=0xFFFF base_filter = "(objectclass=computer)" ldap_connections_number = 5 timeout = 40 timelimit = 30 net_timeout = 10 tls { start_tls = no } dictionary_mapping = ${raddbdir}/ldap.attrmap } radiusd fails to get the values from the ldap server, claiming "Bad search filter": ..... rlm_ldap: performing user authorization for host/26tef001.tde002.mydomain.net radius_xlat: '(&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID' radius_xlat: 'dc=TDE002,dc=MYDOMAIN,dc=NET' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=TDE002,dc=MYDOMAIN,dc=NET, with filter (&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID ldap_search put_filter: "(&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID" put_filter: AND put_filter_list "(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))" put_filter: "(servicePrincipalName=host/26tef001.tde002.mydomain.net)" put_filter: simple put_simple_filter: "servicePrincipalName=host/26tef001.tde002.mydomain.net" put_filter: "(objectclass=computer)" put_filter: simple put_simple_filter: "objectclass=computer" put_filter: "(!(userAccountControl:1.2.840.113556.1.4.803:=2))" put_filter: NOT put_filter_list "(userAccountControl:1.2.840.113556.1.4.803:=2)" put_filter: "(userAccountControl:1.2.840.113556.1.4.803:=2)" put_filter: simple put_simple_filter: "userAccountControl:1.2.840.113556.1.4.803:=2" put_filter: default put_simple_filter: "servicePrincipalName primaryGroupID" rlm_ldap: ldap_search() failed: Bad search filter: (&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID ldap_msgfree rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns fail for request 2 modcall: leaving group authorize (returns fail) for request 2 There was no response configured: rejecting request 2 Delaying request 2 for 1 seconds Finished request 2 Going to the next request Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 206 with timestamp 43942d52 Sending Access-Reject of id 207 to 222.25.36.124 port 1645 What did I forget to obey? Thanks Norbert Wegener

2 2

rlm_ldap behavior: authorize v.s. authenticate
by Brian A. Seklecki 21 Dec '05

21 Dec '05

>From reading debug logs, am I correct in concluding that rlm_ldap's behavior: - when processing authorize{ } is to bind to the LDAP as the provided administrative DN and search for the DN of the user in the Access-Request packet - when processing authenticate{ } is to, if successful during authorize, then re-bind to the LDAP using the provided username and password and return Access-Accept only if the bind-as-the-user succeeds? Correct, as the default behavior? ~BAS

3 4

RE: rlm_sqlcounter and something else than Session-Timeout
by Jonathan De Graeve 21 Dec '05

21 Dec '05

> So if they're under the limit at the start of the session, they can > go over during the session, and no one will notice. This has NOTHING > to do with changing the limits during a session. The problem I think most people (and also me) now have appears when you have max-octet limits. If a user exceeded his monthly usage, he can't login anymore until the next month starts. But if he didn't so the remainder is returned as Session-Timeout. The problem with this is that all nasses take this value as 'seconds' instead as octets which will logout a user. Lets say if he got 4GB as remainder, the system will logout the user in 4s (which isn't the behaviour we want offcourse) That's the reason (IMHO) most people want the possibility to set the reply attribute. J.

2 1

Re: Problem with CHAP, users file and radclient
by Andreas Engler 21 Dec '05

21 Dec '05

> Andreas Engler <freeradius(a)arcor.de> wrote: > >>> rlm_chap: login attempt by "hubba" with CHAP password >>> rlm_chap: Using clear text password bubba for user hubba >>> authentication. >>> rlm_chap: Pasword check failed >> >> > > > The password entered in the client does not match the password you > configured on the server. Nothing else will cause this error. > > Alan DeKok. > > thank you for response. One question remains. Is it possible to resend an auth-detail file with Access-Requests that once where successfully authenticated via radclient and authenticate them successfully again, even if there are Chap-Password and Chap-Challenge attributes in the auth-detail file and so the Auth-Type will be CHAP? I expected that would work, but it seems not to function. Is that an CHAP related issue? Andreas Engler

2 1

rlm_sqlcounter and something else than Session-Timeout
by Damjan 21 Dec '05

21 Dec '05

Currently rlm_sqlcounter sums all the session time used by a user, via a MySQL query (summing all the AcctSessionTime) and returns a coresponding Session-Timeout reply to the nas. Now, in my application, I limit users by bytes transfered, so I need to sum AcctInputOctets and AcctOutputOctets, compare that sum to a check attribute (let's call it Max-All-Transfer) and return a coresponding ChilliSpot-Max-Total-Octets. I beleive this is not configurable in rlm_sqlcounter? I could try to make a patch if someone is willing to help me and guide me a bit. -- damjan | дамјан This is my jabber ID --> damjan(a)bagra.net.mk <-- not my mail address!!!

6 9

Multiple accounting hosts for one realm?
by Johan Ramm-Ericson 21 Dec '05

21 Dec '05

Hello Freeradius-users! While configuring freeradius 1.0.5 on Solaris 9 I began to look at setting up different accounting hosts for users depending on which realm users orginated from. That worked fine. However; I have now come across a situation where it might be valuable to send the same accounting information to multiple accounting hosts. I am hoping to do this by changing the accthost variable in etc/raddb/proxy.conf. Does anyone on the list know if (a) this is possible, and if it is possible (b) how to do it - i.e can I add further hosts in a list to the existing variable or do I need to use some other method? Thanks! /jre

2 1

bug or feature? attr_rewrite rule in post-proxy cannot create config items
by Bastiaan Bakker 21 Dec '05

21 Dec '05

Hi, We have a freeradius 'frontend' server that proxies requests to several legacy radius servers. The frontend server is responsible for IP pool management, but the backend radius server should be able to determine on a per user basis from which IP pool the frontend server should allocate IP addresses. The backend servers return the name of the desired pool in the reply attribute Framed-Pool. On the frontend server I've added a rewrite rule to the post-proxy section in order to copy the Framed-Pool value to the Pool-Name attribute used by rlm_ippool: modules { ... attr_rewrite framedpool2poolname { attribute = Pool-Name searchin = config new_attribute=yes searchfor="" replacewith="%{proxy-reply:Framed-Pool}" append=no } } post-proxy { framedpool2poolname ... } If I run freeradius in debuging mode 'radiusd -X -y', it says it sets the Framed-Pool attribute: rlm_attr_rewrite: Added attribute Pool-Name with value 'eln1' modcall[post-proxy]: module "framedpool2poolname" returns ok for request 0 However the 'eln1' IP pool module fails to find the Pool-Name config item and consequently does not assign an address. Do I misunderstand how the attr_rewrite module is supposed to work or is this a bug? I'm using freeradius-1.0.1-3.RHEL4 on CentOS 4.2. BTW, I did manage to get freeradius to do what I wanted but the 'solution' looks very much like an ugly kludge: I changed the framedpool2poolname module to add a Pool-Name attribute as reply item instead of config item and copy the reply item to the config item in post-auth: modules { ... attr_rewrite poolname2poolname { attribute = Pool-Name searchin = config new_attribute=yes searchfor="" replacewith="%{reply:Pool-Name}" append=no } attr_rewrite framedpool2poolname { attribute = Pool-Name searchin = reply new_attribute=yes searchfor="" replacewith="%{proxy-reply:Framed-Pool}" append=no } } post-auth { poolname2poolname ... } The reason why I can't directly copy Framed-Pool to Pool-Name in post-auth is that I don't want to send the Framed-Pool attribute to the client and the last place where I can filter it out AFAIK is in an attr_filter in post-proxy. Any help in simplifying this setup or confirmation that the current behaviour is indeed a bug would be appreciated very much. Best regards, Bastiaan Bakker E.Novation Lifeline Networks bv

1 0

Problem with rlm_counter in compiling
by Rafael Roldán 21 Dec '05

21 Dec '05

Hy all, I am trying to install freeradius 1.0.5 in a solaris 8 machine. When I run make, I obtain the following error: ... rlm_counter.c:38:18: gdbm.h: No such file or directory rlm_counter.c:84: parse error before "GDBM_FILE" rlm_counter.c:84: warning: no semicolon at end of struct or union rlm_counter.c:88: parse error before '}' token rlm_counter.c:88: warning: type defaults to `int' in declaration of `rlm_counter_t' rlm_counter.c:88: warning: data definition has no type or storage class rlm_counter.c:116: parse error before ')' token rlm_counter.c:116: initializer element is not constant rlm_counter.c:116: (near initialization for `module_config[0].offset') rlm_counter.c:116: warning: missing initializer rlm_counter.c:116: warning: (near initialization for `module_config[0].offset') rlm_counter.c:116: initializer element is not constant rlm_counter.c:116: (near initialization for `module_config[0]') rlm_counter.c:117: parse error before ')' token rlm_counter.c:117: initializer element is not constant rlm_counter.c:117: (near initialization for `module_config[1].offset') rlm_counter.c:117: warning: missing initializer rlm_counter.c:117: warning: (near initialization for `module_config[1].offset') rlm_counter.c:117: initializer element is not constant rlm_counter.c:117: (near initialization for `module_config[1]') rlm_counter.c:118: parse error before ')' token rlm_counter.c:118: initializer element is not constant rlm_counter.c:118: (near initialization for `module_config[2].offset') rlm_counter.c:118: warning: missing initializer rlm_counter.c:118: warning: (near initialization for `module_config[2].offset') rlm_counter.c:118: initializer element is not constant rlm_counter.c:118: (near initialization for `module_config[2]') rlm_counter.c:119: parse error before ')' token rlm_counter.c:119: initializer element is not constant rlm_counter.c:119: (near initialization for `module_config[3].offset') rlm_counter.c:119: warning: missing initializer rlm_counter.c:119: warning: (near initialization for `module_config[3].offset') rlm_counter.c:119: initializer element is not constant rlm_counter.c:119: (near initialization for `module_config[3]') rlm_counter.c:120: parse error before ')' token rlm_counter.c:120: initializer element is not constant rlm_counter.c:120: (near initialization for `module_config[4].offset') rlm_counter.c:120: warning: missing initializer rlm_counter.c:120: warning: (near initialization for `module_config[4].offset') rlm_counter.c:120: initializer element is not constant rlm_counter.c:120: (near initialization for `module_config[4]') rlm_counter.c:121: parse error before ')' token rlm_counter.c:121: initializer element is not constant rlm_counter.c:121: (near initialization for `module_config[5].offset') rlm_counter.c:121: warning: missing initializer rlm_counter.c:121: warning: (near initialization for `module_config[5].offset') rlm_counter.c:121: initializer element is not constant rlm_counter.c:121: (near initialization for `module_config[5]') rlm_counter.c:122: parse error before ')' token rlm_counter.c:122: initializer element is not constant rlm_counter.c:122: (near initialization for `module_config[6].offset') rlm_counter.c:122: warning: missing initializer rlm_counter.c:122: warning: (near initialization for `module_config[6].offset') rlm_counter.c:122: initializer element is not constant rlm_counter.c:122: (near initialization for `module_config[6]') rlm_counter.c:123: parse error before ')' token rlm_counter.c:123: initializer element is not constant rlm_counter.c:123: (near initialization for `module_config[7].offset') rlm_counter.c:123: warning: missing initializer rlm_counter.c:123: warning: (near initialization for `module_config[7].offset') rlm_counter.c:123: initializer element is not constant rlm_counter.c:123: (near initialization for `module_config[7]') rlm_counter.c:124: initializer element is not constant rlm_counter.c:124: (near initialization for `module_config[8]') rlm_counter.c: In function `counter_cmp': rlm_counter.c:138: `data' undeclared (first use in this function) rlm_counter.c:138: (Each undeclared identifier is reported only once rlm_counter.c:138: for each function it appears in.) rlm_counter.c:138: parse error before ')' token rlm_counter.c:139: `datum' undeclared (first use in this function) rlm_counter.c:156: `key_datum' undeclared (first use in this function) rlm_counter.c:159: `count_datum' undeclared (first use in this function) rlm_counter.c:159: warning: implicit declaration of function `gdbm_fetch' rlm_counter.c:133: warning: unused parameter `instance' rlm_counter.c: At top level: rlm_counter.c:171: parse error before '*' token rlm_counter.c:172: warning: function declaration isn't a prototype rlm_counter.c: In function `add_defaults': rlm_counter.c:173: `datum' undeclared (first use in this function) rlm_counter.c:173: parse error before "key_datum" rlm_counter.c:180: `key_datum' undeclared (first use in this function) rlm_counter.c:180: warning: cast discards qualifiers from pointer target type rlm_counter.c:182: `time_datum' undeclared (first use in this function) rlm_counter.c:182: `data' undeclared (first use in this function) rlm_counter.c:185: warning: implicit declaration of function `gdbm_store' rlm_counter.c:185: `GDBM_REPLACE' undeclared (first use in this function) rlm_counter.c:187: warning: implicit declaration of function `gdbm_strerror' rlm_counter.c:187: `gdbm_errno' undeclared (first use in this function) rlm_counter.c:187: warning: format argument is not a pointer (arg 4) rlm_counter.c:192: warning: cast discards qualifiers from pointer target type rlm_counter.c:199: warning: format argument is not a pointer (arg 4) rlm_counter.c: At top level: rlm_counter.c:208: parse error before '*' token rlm_counter.c:209: warning: function declaration isn't a prototype rlm_counter.c: In function `reset_db': rlm_counter.c:210: `data' undeclared (first use in this function) rlm_counter.c:214: warning: implicit declaration of function `gdbm_close' rlm_counter.c:219: warning: implicit declaration of function `gdbm_open' rlm_counter.c:220: `GDBM_NEWDB' undeclared (first use in this function) rlm_counter.c:226: warning: implicit declaration of function `gdbm_setopt' rlm_counter.c:226: `GDBM_CACHESIZE' undeclared (first use in this function) rlm_counter.c: At top level: rlm_counter.c:242: parse error before '*' token rlm_counter.c:243: warning: function declaration isn't a prototype rlm_counter.c: In function `find_next_reset': rlm_counter.c:250: `timeval' undeclared (first use in this function) rlm_counter.c:254: `data' undeclared (first use in this function) rlm_counter.c: In function `counter_instantiate': rlm_counter.c:320: `data' undeclared (first use in this function) rlm_counter.c:327: `datum' undeclared (first use in this function) rlm_counter.c:327: parse error before "key_datum" rlm_counter.c:463: `GDBM_WRCREAT' undeclared (first use in this function) rlm_counter.c:470: `GDBM_CACHESIZE' undeclared (first use in this function) rlm_counter.c:486: `key_datum' undeclared (first use in this function) rlm_counter.c:486: warning: cast discards qualifiers from pointer target type rlm_counter.c:489: `time_datum' undeclared (first use in this function) rlm_counter.c:507: warning: cast discards qualifiers from pointer target type rlm_counter.c:320: warning: statement with no effect rlm_counter.c: In function `counter_accounting': rlm_counter.c:546: `data' undeclared (first use in this function) rlm_counter.c:546: parse error before ')' token rlm_counter.c:547: `datum' undeclared (first use in this function) rlm_counter.c:632: `key_datum' undeclared (first use in this function) rlm_counter.c:637: `count_datum' undeclared (first use in this function) rlm_counter.c:676: warning: comparison between signed and unsigned rlm_counter.c:676: warning: signed and unsigned type in conditional expression rlm_counter.c:699: `GDBM_REPLACE' undeclared (first use in this function) rlm_counter.c:703: `gdbm_errno' undeclared (first use in this function) rlm_counter.c:703: warning: format argument is not a pointer (arg 4) rlm_counter.c:544: warning: unused parameter `instance' rlm_counter.c: In function `counter_authorize': rlm_counter.c:719: `data' undeclared (first use in this function) rlm_counter.c:719: parse error before ')' token rlm_counter.c:721: `datum' undeclared (first use in this function) rlm_counter.c:721: parse error before "key_datum" rlm_counter.c:769: `key_datum' undeclared (first use in this function) rlm_counter.c:781: `count_datum' undeclared (first use in this function) rlm_counter.c:827: warning: comparison between signed and unsigned rlm_counter.c:725: warning: `key_vp' might be used uninitialized in this function rlm_counter.c: In function `counter_detach': rlm_counter.c:873: `data' undeclared (first use in this function) rlm_counter.c:873: parse error before ')' token make[6]: *** [rlm_counter.o] Error 1 make[6]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5/src/modules/rlm_counter' make[5]: *** [common] Error 2 make[5]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/users/telemati/FreeRadius/freeradius-1.0.5' make: *** [all] Error 2 It is the first time I use a UNIX machine. How can I resolve this problem? Thank you very much, Rafa

2 2

users file logic?
by Maqbool Hashim 21 Dec '05

21 Dec '05

Hi, I have this in my users file: user Auth-Type := Local, User-Password = "pass" Tunnel-Type = 13, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 4016, Fall-Through = No I would like to assign a different vlan-id if the user doesn't authenticate successfully, i.e. the username is the same but he enters the wrong password. Is this actually possible, as the processing will stop once it matches the first entry for the user "user"? Regards, Maqbool Hashim

1 0

Cisco WLSE status?
by Jeffrey C. Ollie 21 Dec '05

21 Dec '05

Ok, I know that the problems getting Cisco WLSE to authenticate properly with FreeRadius is a problem with the Cisco supplicant, but I'm wondering: 1) Has anyone opened up a ticket with Cisco trying to get them to fix the problem? If so, what is the status of the ticket? 2) Has anyone polished up a patch that will allow WLSE to authenticate agianst FreeRadius? It'd be nice to have a hack that could be enabled conditionally so it doesn't break other hosts but if I have to run a separate server on a different host or port that'd probably work until we can get Cisco to fix their problem. Jeff Ollie

1 0