- Freeradius-Users - lists.freeradius.org

RE: rlm_ldap: ldap_search() failed: Bad search filter:
by Alhagie Puye 07 Dec '05

07 Dec '05

Look like your syntax is wrong Why don't you have parenthesis around "sAMAccountName userAccountControl"? You are also missing an "=" between the two words. Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Norbert Wegener > >Sent: December 7, 2005 12:30 PM > >To: FreeRadius users mailing list > >Subject: rlm_ldap: ldap_search() failed: Bad search filter: > > > >I am still trying to let freeradius query AD, but not yet > >too successfull. > > > >Using the following vars with ldapsearch, gives me the > >desired result, as shown below, but fails with rlm_ldap. > >########################################## > >server="mchm967a.tww006.sitest.net " > >port=3268 > >identity="testrad(a)TDE002.SITEST.NET " > >mypass="mypass" > >basedn="dc=TDE002,dc=SITEST,dc=NET" > >filter="(&(sAMAccountName=28TEF003$)(objectclass=computer)) > >sAMAccountName userAccountControl" > >######################################### > >ldapsearch -x -h $server -p $port -b $basedn $filter -D > >$identity -w $mypass -x > > > ># extended LDIF > ># > ># LDAPv3 > ># base <dc=TDE002,dc=SITEST,dc=NET> with scope sub # filter: > >(&(sAMAccountName=28TEF003$)(objectclass=computer)) > ># requesting: sAMAccountName userAccountControl # > > > ># 28TEF003, CAT-Computers, OU16, MchP, tde002.sitest.net > >dn: > >CN=28TEF003,OU=CAT-Computers,OU=OU16,OU=MchP,DC=tde002,DC=sit > >est,DC=net > >userAccountControl: 4096 > >sAMAccountName: 28TEF003$ > > > ># search result > >search: 2 > >result: 0 Success > > > ># numResponses: 2 > ># numEntries: 1 > >################################################## > >So far, so good. > >When I take the same vars in radiusd.conf, I get: > >rlm_ldap: ldap_search() failed: Bad search filter > >radiusd.conf: > > > > > > ldap ldap1 { > >server="mchm967a.tww006.sitest.net " > >port=3268 > >identity="testrad(a)TDE002.SITEST.NET " > >mypass="mypass" > >basedn="dc=TDE002,dc=SITEST,dc=NET" > >filter="(&(sAMAccountName=28TEF003$)(objectclass=computer)) > >sAMAccountName userAccountControl" > > ldap_debug= 0xFFFF > > ldap_connections_number = 5 > > timeout = 40 > > timelimit = 30 > > net_timeout = 10 > > tls { > > } > > dictionary_mapping = ${raddbdir}/ldap.attrmap > > } > > > >rlm_ldap: Bind was successful^M > >rlm_ldap: performing search in dc=TDE002,dc=SITEST,dc=NET, > >with filter > >(&(sAMAccountName=28TEF003$)(objectclass=computer)) > >sAMAccountName userAccountControl^M ldap_search^M > >put_filter: "(&(sAMAccountName=28TEF003$)(objectclass=computer)) > >sAMAccountName userAccountControl"^M > >put_filter: AND^M > >put_filter_list "(sAMAccountName=28TEF003$)(objectclass=computer)"^M > >put_filter: "(sAMAccountName=28TEF003$)"^M > >put_filter: simple^M > >put_simple_filter: "sAMAccountName=28TEF003$"^M > >put_filter: "(objectclass=computer)"^M > >put_filter: simple^M > >put_simple_filter: "objectclass=computer"^M > >put_filter: default^M > >put_simple_filter: "sAMAccountName userAccountControl"^M > >rlm_ldap: ldap_search() failed: Bad search filter: > >(&(sAMAccountName=28TEF003$)(objectclass=computer)) > >sAMAccountName userAccountControl^M ldap_msgfree^M > >rlm_ldap: search failed^M > > > >What am I doing wrong? > >Thanks > >Norbert Wegener > > > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

2 1

Question about AcctUniqueID
by Dennis Skinner 07 Dec '05

07 Dec '05

Hello all, I read the docs and hunted down some messages from this list about it. Here is what is in my radiusd.conf on both servers: acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port-Id" } (forgive the line wrap) I noticed this in my radacct table: *************************** 1. row *************************** RadAcctId: 13988509 AcctSessionId: 00000B80 AcctUniqueId: 00eff1fb2a906db0 UserName: user(a)bluefrognet.net Realm: bluefrognet.net NASIPAddress: 192.168.1.210 NASPortId: 127 NASPortType: Async AcctStartTime: 2005-08-30 08:52:54 AcctStopTime: 2005-08-30 08:55:14 AcctSessionTime: 135 AcctAuthentic: RADIUS ConnectInfo_start: ConnectInfo_stop: 26400/24000 V34=2B/V44/LAPM AcctInputOctets: 31080 AcctOutputOctets: 118434 CalledStationId: ########## CallingStationId: ########## AcctTerminateCause: User-Request ServiceType: Framed-User FramedProtocol: PPP FramedIPAddress: 192.168.100.101 AcctStartDelay: 0 AcctStopDelay: 5 *************************** 2. row *************************** RadAcctId: 16960699 AcctSessionId: 00000B80 AcctUniqueId: 00eff1fb2a906db0 UserName: user(a)bluefrognet.net Realm: bluefrognet.net NASIPAddress: 192.168.1.210 NASPortId: 144 NASPortType: Async AcctStartTime: 2005-12-05 08:54:43 AcctStopTime: 2005-12-05 09:11:08 AcctSessionTime: 986 AcctAuthentic: RADIUS ConnectInfo_start: 46666/26400 V90/V42bis/LAPM =285 ConnectInfo_stop: 26400 V34=2B/V44/LAPM =2826400/2 AcctInputOctets: 184798 AcctOutputOctets: 1271017 CalledStationId: ########## CallingStationId: ########## AcctTerminateCause: User-Request ServiceType: Framed-User FramedProtocol: PPP FramedIPAddress: 192.168.100.66 AcctStartDelay: 0 AcctStopDelay: 0 2 rows in set (0.03 sec) I have obviously obfuscated some of the data, but I kept it sane to the original. The part that has me puzzled is the NASPortId (I didn't change that in the data above). I assume that is the same as NAS-Port-ID in the key above, but FreeRADIUS has created identical AcctUniqueId's with diff ports. I am using 0.9.3 at the moment. I am working on uprading, but was wondering if this is a bug, or something that I may have missed in the ChangeLog, or am I missing something else? Thanks! -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

1 1

Compatibility Question: Will FreeRADIUS work with Quintum NAS for VoIP?
by Henk Crafford 07 Dec '05

07 Dec '05

Hi All! I am quite new to RADIUS, both protocol and FreeRadius. I am developing a billing application for VoIP, and need to use Quintum Nas as well as JRadius! The things I am wondering is as follows: I need to know if FreeRADIUS, the great program it is, supports VSA's from a Quintum NAS? I need a tutorial or something to integrate JRADIUS into FreeRadius. These might seem like dumb questions - for that I am sorry - but I've been troubleshooting my FreeRadius for 3 days, finally got it to simulate and I'm running out of time( By the way Thanks to the guys for the comments! As well as such a great debug mode. I'm still new to all this but if I was more experienced it wouldn't have taken 4 hours). So please forgive me if it seems I am taking an easy way out. All the theory is worked out, algorithms the works just the programs need to be installed and physical coding. Thanks. _______________________________________________________________ Get the FREE email that has everyone talking at <a href=http://www.mail2world.com target=new>http://www.mail2world.com</a> Unlimited Email Storage POP3 Calendar SMS Translator Much More!

2 1

(no subject)
by Landon Cox 07 Dec '05

07 Dec '05

Nicolas Baradakis wrote: > libssl.so.0.9.7 => /usr/lib/libssl.so.0.9.7 (0x40145000) > ^^^^^^ >This has nothing to do with your problem, but can you please indicate >whether you're using a binary package from Suse? If that's the case, >Suse is distributing software with incompatible licenses linked >together. I think maybe they are violating either the GPL or the >OpenSSL license. The file was rlm_exec so file was timestamped 11-01-05 and I know I haven't built anything from source for a long time on that box, so would have to think it was a binary package unless somehow the SuSE update pulls and compiles source on my behalf...I don't think so. Landon

1 0

Dialupadmin wont connect to mysql
by Sean Ali 07 Dec '05

07 Dec '05

Hello, I've got Dialupadmin running however when I click through the various menus it keeps telling me that it cannot connect to sql database. This is no surprise to me as I have not setup anything on the mysql side of things for dialupadmin nor have I told dialupadmin what user and password to connect with. My question is where do I go to set the database options? And what, if any, database items do I need to create on the mysql side for it to work? Thanks, Sean.

2 1

Dialupadmin wont connect to mysql
by Sean Ali 07 Dec '05

07 Dec '05

Hello, I've got Dialupadmin running however when I click through the various menus it keeps telling me that it cannot connect to sql database. This is no surprise to me as I have not setup anything on the mysql side of things for dialupadmin nor have I told dialupadmin what user and password to connect with. My question is where do I go to set the database options? And what, if any, database items do I need to create on the mysql side for it to work? Thanks, Sean.

1 0

question on ldap_escape_func in rlm_ldap.c (author: Kostas Kalevras)
by Qin Zhen 07 Dec '05

07 Dec '05

Hi All, I'm new to Radius, now encountered problems with ldap_escape_func in rlm_ldap. please help me since it's really a bit urgent. the comments regarding to this function is 'Add an ldap_escape_func. Escape the * character from the filter so that we can avoid the trivial DoS of username=*'. if i was not wrong, this function intends to filter out the * which follows the username, i.e, if username is 'userid*' in access-request packet, ldapsearch is only based on 'userid'. but what's the purpose for doing this and is it secure? or did i misunderstand the comments? the lastest version freeradius-1.0.5 has a slightly different version for this piece of code, ***************************************************************** freeradius-1.0.5 if (strchr("*=\\,()", *in)) { static const char *hex = "0123456789abcdef"; if (outlen <= 3) break; *(out++) = '\\'; *(out++) = hex[((*in) >> 4) & 0x0f]; *(out++) = hex[(*in) & 0x0f]; outlen -= 3; continue; } ************************************************************** freeradius-1.0.4 and previous if (strchr("*", *in)) { in++; outlen--; continue; } i couldn't figure out what does the change intend to do, is it to filter out '*', '\\', '()' and '=' from username? and why should it be in that way? please help me. thanks a lot in advance.

2 5

RE: question on ldap_escape_func in rlm_ldap.c
by Guy Davies 07 Dec '05

07 Dec '05

-----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Nicolas Baradakis Sent: 07 December 2005 13:18 To: FreeRadius users mailing list Subject: Re: question on ldap_escape_func in rlm_ldap.c Qin Zhen wrote: > so in lastest version (1.0.5), a username 'jam\' will be converted > into 'jam\5c' and ldapsearch will be based on 'jam\5c' right? so this > username is supposed not to be found in ldap in this case? > but how come in my server, the ldapsearch will base on 'jam' and those > invalid charactors r just simply eliminated? scratching head...pls > assist..thanks so much That's what is said in http://www.ietf.org/rfc/rfc2254.txt <<<<< If a value should contain any of the following characters Character ASCII value --------------------------- * 0x2a ( 0x28 ) 0x29 \ 0x5c NUL 0x00 the character must be encoded as the backslash '\' character (ASCII 0x5c) followed by the two hexadecimal digits representing the ASCII value of the encoded character. The case of the two hexadecimal digits is not significant. >>>>> -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

multiple groups behind one NAS
by nl 07 Dec '05

07 Dec '05

Hi, I have problem with multiple groups behind one NAS after upgrade from freeradius0.9.x to 1.0.4-1. There was no problem with this configuration before upgrade. Scenario: 2 groups: GPRS_1 and GPRS_2 both groups are behind NAS 1.1.1.1 user_1 is member of group GPRS_2 and he and all members of GPRS_2 are rejected. It looks that only members of first group matched in huntgroups file are positive processed. #################### my users file: DEFAULT Huntgroup-Name == DENY, Auth-Type := Reject Reply-Message = "!!! You are NOT allowed to access the resource !!!" DEFAULT Huntgroup-Name == GPRS_1, Ldap-Group == "cn=GPRS_1,cn=radius,dc=my,dc=domain" Fall-Through = no DEFAULT Huntgroup-Name == GPRS_2, Ldap-Group == "cn=GPRS_2,cn=radius,dc=my,dc=domain" Fall-Through = no #(I tried Fall-Through = yes but without success ) #################### my huntgroups file: GPRS_1 NAS-IP-Address == 1.1.1.1 GPRS_2 NAS-IP-Address == 1.1.1.1 #################### debug> rad_recv: Access-Request packet from host 1.1.1.1:49152, id=113, length=282 User-Name = "user_1" User-Password = "*******" Acct-Session-Id = "C35B9B41550234E2DB" NAS-IP-Address = 1.1.1.1 Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context Calling-Station-Id = "01234567898" Called-Station-Id = "apn" NAS-Port-Type = Wireless-Other NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_checkval: Item Name: NAS-IP-Address, Value: 1.1.1.1 rlm_checkval: Could not find attribute named NAS-IP-Address in check pairs modcall[authorize]: module "nas-ip" returns notfound for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for user_1 radius_xlat: '(uid=user_1)' radius_xlat: 'cn=radius,dc=my, dc=domain' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=my,dc=domain/******* to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in cn=radius ,dc=my, dc=domain, with filter (uid=user_1) rlm_ldap: Password header not found in password {MD5}M6SF989545MZxq0dPLluAAoY for user user_1 rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 01234567898 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFramedIPAddress as Framed-IP-Address, value 10.10.10.10 & op=11 rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol, value PPP & op=11 rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & op=11 rlm_ldap: user user_1 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'cn=radius ,dc=my, dc=domain' radius_xlat: '(&(objectClass=groupOfUniqueNames)(uniquemember=uid=user_1,cn=GPRS_1,dc=my,dc=domain))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=GPRS_1,cn=radius,dc=my,dc=domain, with filter (&(objectClass=groupOfUniqueNames)(uniquemember=uid=user_1,cn=GPRS_1,cn=radius,dc=my,dc=domain)) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group cn=GPRS_1,cn=radius,dc=my,dc=domain not found or user is not a member. users: Matched entry DEFAULT at line 128 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Thanx for adviced :) Aktivujte si aj vy schranku s neobmedzenou kapacitou na ATLAS.SK. http://mail.atlas.sk

1 0

Re: OS Update broke FR - rlm_exec-1.0.0.so not found
by Landon Cox 07 Dec '05

07 Dec '05

Thanks, Alan. FYI - more research on the topic, I did an ldd on the rlm_exec file: On a freeradius box I have which is working, I did: radius1:/usr/lib/freeradius # ldd rlm_exec-1.0.0.so linux-gate.so.1 => (0xffffe000) libnsl.so.1 => /lib/libnsl.so.1 (0x40018000) libresolv.so.2 => /lib/libresolv.so.2 (0x4002f000) libpthread.so.0 => /lib/tls/libpthread.so.0 (0x40042000) libcrypto.so.0.9.7 => /usr/lib/libcrypto.so.0.9.7 (0x40054000) libssl.so.0.9.7 => /usr/lib/libssl.so.0.9.7 (0x40145000) libc.so.6 => /lib/tls/libc.so.6 (0x40175000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x80000000) libdl.so.2 => /lib/libdl.so.2 (0x4028b000) Then on the radius box I updated and broke I did: radius2:/usr/lib/freeradius # ldd rlm_exec-1.0.0.so linux-gate.so.1 => (0xffffe000) libnsl.so.1 => /lib/libnsl.so.1 (0x55577000) libresolv.so.2 => /lib/libresolv.so.2 (0x5558e000) libpthread.so.0 => /lib/tls/libpthread.so.0 (0x555a1000) libcrypto.so.0.9.7 => /usr/lib/libcrypto.so.0.9.7 (0x555b3000) libssl.so.0.9.7 => /usr/lib/libssl.so.0.9.7 (0x556a4000) libc.so.6 => /lib/tls/libc.so.6 (0x556d4000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x56555000) libdl.so.2 => /lib/libdl.so.2 (0x557ea000) I hunted down and verified that every library that was pointed to by rlm_exec indeed existed on the file system. On both systems, they had everything except both had no linux-gate.so.1. But then radius1 works fine and it shows the same paths and library existence as the radius2 box which fails. Also, googling linux-gate.so.1 I saw: "What is linux-gate.so.1?": http://www.trilithium.com/johan/2005/08/ linux-gate/ and http://kerneltrap.org/node/3405 The first link explains that an ldd report of linux-gate.so.1 that doesn't point to a file/path is normal in recent kernels and goes into detail of what it is. In any case, it's not a problem. After verifying that every library that is pointed to by rlm_exec-1.0.0.so actually exists on both the machine that works fine and the one that doesn't, I understand a little more but don't see what the problem is. There's something else bizarre going on...or perhaps I still need to run ldd on each of the dependent libraries - maybe there's one in that tree of dependencies that's missing. I'll also try going to 1.0.5. Thanks, Landon

2 1