- Freeradius-Users - lists.freeradius.org

CPU - FR1.0.5
by Breuer Nicolas 01 Dec '05

01 Dec '05

Hello all, I've a problem with FR 1.0.5. I've installed it on an old server Pentium Intel 3 (no multi-threading) i've installed FR1.0.5 and radiusd take all CPU !! after a while, requests aren't more served.. kernel : Linux 2.6.9-1.667 #1 When i launch radiusd with -s option there is no problem.. Do you have an explication ? kernel is compiled with no multi-threading. I've an other radiusd on a pentium 4 with multi-threading and i have no problems on this server.. Thanks

3 3

Re: Fall-through and different NAS IP Settings
by Curt LeCaptain 30 Nov '05

30 Nov '05

As always, run it in debugging mode. You would see the answer. In this case, NAS-IP-Address is an attribute in the RADIUS packet. So if the NAS doesn't send it, it doesn't match that entry. Okay, so I'm looking at my radiusd -X output and here's what I get on a access-request: rad_recv: Access-Request packet from host ip.add.re.ss:21737, id=82, length=84 Framed-Protocol = PPP User-Name = "user(a)domain.com" User-Password = "drb2859" NAS-Port-Type = Virtual NAS-Port = 81185 Service-Type = Framed-User NAS-IP-Address = ip.add.re.ss I'm just asking this for my understanding, am I still going to want to use Client-IP-Address even though from what I can see here, the NAS-IP-Address attribute is appearing within the output of debugging? Thanks, Curt LeCaptain

2 1

error in configurable failover?
by Norbert Wegener 30 Nov '05

30 Nov '05

I am trying to get configurable failover working.(ok, this example is not yet that far) With authenticate { #ldap1 group { ldap1 { notfound = return } } } in radiusd.conf I get: rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x8117ff8 Module: Instantiated ldap (ldap1) radiusd.conf[1862] Unknown Auth-Type "_UnNamedGroup" in authenticate section. Errors setting up modules changing this to authenticate { ldap1 #group { #ldap1 { #notfound = return #} #} # } freeradius starts without problems. radiusd -v radiusd: FreeRADIUS Version 1.1.0-pre0, for host i686-pc-linux-gnu, built on Nov 22 2005 at 22:02:26 Norbert Wegener

3 3

Decyhpering error message
by King, Michael 30 Nov '05

30 Nov '05

I have a single user that cannot associate to a AP. By chance, it's actually me. I'm failing 802.1x authentication . (We're using PEAP, with the XP client) with FreeRadius talking to AD Other users get on the AP fine. Watching the radius.log I see this error message. (I have not had a chance to put the server into Debug mode, that would affect a few hundred users, and right now it's just me, ) Wed Nov 30 09:49:40 2005 : Error: rlm_eap: UserIdentity Unknown Wed Nov 30 09:49:40 2005 : Error: rlm_eap: Identity Unknown, authentication failed Wed Nov 30 09:49:40 2005 : Auth: Login incorrect: [<no User-Name attribute>] (from client Wireless-network-2 port 2 cli 00-14-a5-45-e9-22) Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Length Included Wed Nov 30 09:49:41 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Length Included Wed Nov 30 09:49:41 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Length Included Wed Nov 30 09:49:41 2005 : Info: (other): SSL negotiation finished successfully Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Length Included Wed Nov 30 09:49:41 2005 : Info: (other): SSL negotiation finished successfully Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Nov 30 09:49:41 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Nov 30 09:49:42 2005 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Nov 30 09:49:42 2005 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Nov 30 09:49:51 2005 : Error: Discarding duplicate request from client Wireless-network-2:1025 - ID: 227 due to unfinished request 4837665 Wed Nov 30 09:49:51 2005 : Error: rlm_radutmp: Logout entry for NAS Wireless-network-2 port 1 has wrong ID Wed Nov 30 09:49:53 2005 : Error: Discarding duplicate request from client Wireless-network-2:1025 - ID: 227 due to unfinished request 4837665 Wed Nov 30 09:49:53 2005 : Info: rlm_eap_tls: Length Included Wed Nov 30 09:49:53 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Nov 30 09:49:53 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Nov 30 09:49:53 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Nov 30 09:49:53 2005 : Info: rlm_eap_tls: Length Included Wed Nov 30 09:49:53 2005 : Info: (other): SSL negotiation finished successfully Wed Nov 30 09:49:55 2005 : Error: rlm_radutmp: Logout entry for NAS Wireless-network-2 port 2 has wrong ID Now, the first line is not my MAC, so I don't think it's me. I get timed out at 9:49:51 So my question: That last entry Logout entry for NAS Wireless-network-2 port 2 has wrong ID, I think that's an Accounting message. Correct? I know that without the debug logs, it's hard to actually diagnose my acutal problem.

2 1

RADIUS EAP-TLS and Samba-LDAP
by james widanta 30 Nov '05

30 Nov '05

HI list I am using free radius with EAP-TLS for wireless authentication then I add Samba-LDAP for primary domain controller. Both radius and Samba LDAP are working . Now when I login from my windows xp to the domain I have to connect via wired first then install the certificate to make my radius authentication works. Every time I change the password I have toreinstall the certificate to get connected. Is anyone can tell me how to configure Samba-Ldap or Radius to make the authentication works for both radius and Samba-ldap? Thank you

2 1

Re: Freeradius-Users Digest, Vol 7, Issue 119
by Marcos Gonzalez 30 Nov '05

30 Nov '05

freeradius-users-request(a)lists.freeradius.org escribió: >> I think the problem is the NAS configuration. I don't know if some kind >> of misconfiguration made only time being tracked, not bytes sent and >> received. >> > > The NAS may not track that information. If it doesn't track it, it > can't send that data in a RADIUS packet. > > I'd check the Cisco documentation. Thank you Alan, for answering. In the Cisco documentation about the 1200, they show the list of attributes the Aironet 1200 can include in an accounting package: http://www.cisco.com/en/US/products/hw/wireless/ps430/products_configuratio… Here is an extract: * Attributes Sent in Accounting-Request (update) Packets 1 User-Name 4 NAS-IP-Address [...] 42 Acct-Input-Octets 43 Acct-Output-Octets [...] 47 Acct-Input-Packets 48 Acct-Output-Packets * Attributes Sent in Accounting-Request (stop) Packets 1 User-Name 4 NAS-IP-Address [...] 42 Acct-Input-Octets 43 Acct-Output-Octets [...] 47 Acct-Input-Packets 48 Acct-Output-Packets So yes, this NAS is supposed to report those pieces of information. At least, thats what Cisco says. But the fact is it isn't doing so. > I expect the NAS will not send > those attributes, ever. > > Alan DeKok. > > You think the NAS won't send those attributes. I have no experience with NASs, so I'd appreciate a lot if you could explain me why you think so. I don't want to spend time trying to do something that isn't possible. Thank you in advance, again.

2 1

general question
by Norbert Wegener 30 Nov '05

30 Nov '05

I know, that every single of the requirements described below is possible with freeradius. The question is, whether all fits together in a single authentication process: - do an 802.1x authentication using certificates - extract the username (here: a machine name in the form host/26tef001.tde002.mydomain.net) from the certificate and query AD, whether the associated account is valid proceed, if okay, else reject user. -if valid, take that username host/... and ask a mysql database which vlan that client shall get assigned and assign the vlan. Thanks Norbert Wegener

1 0

RE: Freeradius How to integrate Active Directory and return group attribute to VPN Concentrator
by Alhagie Puye 30 Nov '05

30 Nov '05

Here is an ldap query output for a user: waggawagga raddb # ldapsearch -LLL -h w.x.y.z -x -b 'dc=corp,dc=van,dc=dwave' '(&(memberof=CN=rptpcps,OU=DataWave Users,DC=corp,DC=van,DC=dwave)(samaccountname=apuye))' -D apuye(a)corp.van.dwave -w XXXXXXXX dn: CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van ,DC=dwave memberOf: CN=itops-folder,OU=SHARED FOLDERS,OU=DataWave Users,DC=corp,DC=van,D C=dwave memberOf: CN=rptpcps,OU=DataWave Users,DC=corp,DC=van,DC=dwave memberOf: CN=itops,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van, DC=dwave memberOf: CN=datawave,OU=DataWave Users,DC=corp,DC=van,DC=dwave accountExpires: 9223372036854775807 badPasswordTime: 127778245108916810 badPwdCount: 0 codePage: 0 cn: Alhagie Puye countryCode: 0 description: IT Operations displayName: Alhagie Puye givenName: Alhagie homeDirectory: \\fs1\apuye homeDrive: H: instanceType: 4 lastLogoff: 0 lastLogon: 127778426282888816 logonCount: 196 msNPAllowDialin: TRUE distinguishedName: CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users ,DC=corp,DC=van,DC=dwave objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=corp,DC=van,DC=dwave objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user objectGUID:: oO1UkRu8RkScNIOHmaB/qw== objectSid:: AQUAAAAAAAUVAAAAzSmuLihcKk12fipaZwkAAA== primaryGroupID: 513 profilePath: \\fs2\profiles\apuye pwdLastSet: 127771529310887572 name: Alhagie Puye sAMAccountName: apuye sAMAccountType: 805306368 sn: Puye userAccountControl: 512 userParameters:: bTogICAgICAgICAgICAgICAgICAgIGQJICAgICAgICAgICAgICAgICAgICAgI CAgUBAaCAFDdHhDZmdQcmVzZW5045S15pSx5oiw44GiGAgBQ3R4Q2ZnRmxhZ3Mx44Cw44Gm4 6Cy44 C5FggBQ3R4Q2FsbGJhY2vjgLDjgLDjgLDjgLASCAFDdHhTaGFkb3fjhLDjgLDjgLDjgLAoCA FDdHh NYXhDb25uZWN0aW9uVGltZeOAsOOAsOOAsOOAsC4IAUN0eE1heERpc2Nvbm5lY3Rpb25UaW1 l44Cw 44Cw44Cw44CwHAgBQ3R4TWF4SWRsZVRpbWXjgLDjgLDjgLDjgLAiCAFDdHhLZXlib2FyZExh eW91d OOAsOOAsOOAsOOAsCoCAUN0eE1pbkVuY3J5cHRpb25MZXZlbOOEsCACAUN0eFdvcmtEaXJlY 3Rvcn njgLAgAgFDdHhOV0xvZ29uU2VydmVy44CwGAIBQ3R4V0ZIb21lRGly44CwIgIBQ3R4V0ZIb2 1lRGl yRHJpdmXjgLAgAgFDdHhXRlByb2ZpbGVQYXRo44CwIgIBQ3R4SW5pdGlhbFByb2dyYW3jgLA iAgFD dHhDYWxsYmFja051bWJlcuOAsA== userPrincipalName: apuye(a)corp.van.dwave uSNChanged: 7588047 uSNCreated: 5713011 whenChanged: 20051122170851.0Z whenCreated: 20050902184213.0Z # refldap://corp.van.dwave/CN=Configuration,DC=corp,DC=van,DC=dwave I would like the group that the user is a member of to be sent back in the replyItem. I need this value for locking the user into groups on the Cisco VPN Concentrator. That's the only portion I'm missing. Here is an output of the debug when I authenticate the user: put_filter: "(cn=itops)" put_filter: simple put_simple_filter: "cn=itops" ldap_send_initial_request ldap_send_server_request ldap_result msgid 15 ldap_chkResponseList for msgid=15, all=1 ldap_chkResponseList returns NULL wait4msg (timeout 40 sec, 0 usec), msgid 15 wait4msg continue, msgid 15, all 1 ** Connections: * host: SERVER.corp.van.dwave port: 389 (default) refcnt: 2 status: Connected last used: Wed Nov 30 10:18:54 2005 ** Outstanding Requests: * msgid 15, origid 15, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: Empty ldap_chkResponseList for msgid=15, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 15, all 1 ldap_read: message type search-entry msgid 15, original id 15 wait4msg: 39 secs to go wait4msg continue, msgid 15, all 1 ** Connections: * host: SERVER.corp.van.dwave port: 389 (default) refcnt: 2 status: Connected last used: Wed Nov 30 10:18:54 2005 ** Outstanding Requests: * msgid 15, origid 15, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: * msgid 15, type 100 ldap_chkResponseList for msgid=15, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 15, all 1 ldap_read: message type search-result msgid 15, original id 15 new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 15 request 15 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 15, msgid 15) ldap_free_connection ldap_free_connection: refcnt 1 adding response id 15 type 101: ldap_parse_result ldap_msgfree ldap_msgfree rlm_ldap::ldap_groupcmp: User found in group itops rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for apuye radius_xlat: '(&(sAMAccountName=apuye)(objectclass=user))' radius_xlat: 'DC=corp,DC=van,DC=dwave' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in DC=corp,DC=van,DC=dwave, with filter (&(sAMAccountName=apuye)(objectclass=user)) ldap_search put_filter: "(&(sAMAccountName=apuye)(objectclass=user))" put_filter: AND put_filter_list "(sAMAccountName=apuye)(objectclass=user)" put_filter: "(sAMAccountName=apuye)" put_filter: simple put_simple_filter: "sAMAccountName=apuye" put_filter: "(objectclass=user)" put_filter: simple put_simple_filter: "objectclass=user" ldap_send_initial_request ldap_send_server_request ldap_result msgid 16 ldap_chkResponseList for msgid=16, all=1 ldap_chkResponseList returns NULL wait4msg (timeout 40 sec, 0 usec), msgid 16 wait4msg continue, msgid 16, all 1 ** Connections: * host: SERVER.corp.van.dwave port: 389 (default) refcnt: 2 status: Connected last used: Wed Nov 30 10:18:54 2005 ** Outstanding Requests: * msgid 16, origid 16, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: Empty ldap_chkResponseList for msgid=16, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 16, all 1 ldap_read: message type search-entry msgid 16, original id 16 wait4msg: 39 secs to go wait4msg continue, msgid 16, all 1 ** Connections: * host: SERVER.corp.van.dwave port: 389 (default) refcnt: 2 status: Connected last used: Wed Nov 30 10:18:54 2005 ** Outstanding Requests: * msgid 16, origid 16, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: * msgid 16, type 100 ldap_chkResponseList for msgid=16, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 16, all 1 ldap_read: message type search-reference msgid 16, original id 16 ldap_chase_v3referrals ldap_url_parse_ext(ldap://corp.van.dwave/CN=Configuration,DC=corp,DC=van ,DC=dwave) re_encode_request: new msgid 17, new dn <CN=Configuration,DC=corp,DC=van,DC=dwave> re_encode_request new request is: ber_dump: buf=0x0815ec00 ptr=0x0815ef76 end=0x0815fbdc len=886 0000: 72 64 72 64 00 00 00 00 00 00 00 00 00 00 00 00 rdrd............ 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0370: 00 00 00 00 00 00 ...... ldap_chase_v3referral: msgid 16, url "ldap://corp.van.dwave/CN=Configuration,DC=corp,DC=van,DC=dwave" ldap_send_server_request ldap_new_connection ldap_int_open_connection ldap_connect_to_host: TCP corp.van.dwave:389 ldap_new_socket: 7 ldap_prepare_socket: 7 ldap_connect_to_host: Trying w.x.y.z:389 ldap_connect_timeout: fd: 7 tm: 10 async: 0 ldap_ndelay_on: 7 ldap_is_sock_ready: 7 ldap_ndelay_off: 7 anonymous rebind via ldap_bind_s ldap_bind_s ldap_simple_bind_s ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ldap_result msgid 18 ldap_chkResponseList for msgid=18, all=1 ldap_chkResponseList returns NULL wait4msg (infinite timeout), msgid 18 wait4msg continue, msgid 18, all 1 ** Connections: * host: corp.van.dwave port: 0 refcnt: 2 status: Connected last used: Wed Nov 30 10:18:54 2005 rebind in progress queue is empty * host: SERVER.corp.van.dwave port: 389 (default) refcnt: 2 status: Connected last used: Wed Nov 30 10:18:54 2005 ** Outstanding Requests: * msgid 18, origid 18, status InProgress outstanding referrals 0, parent count 0 * msgid 16, origid 16, status InProgress outstanding referrals 1, parent count 0 ** Response Queue: * msgid 16, type 100 ldap_chkResponseList for msgid=18, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 18, all 1 ldap_read: message type search-result msgid 16, original id 16 new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 16 ldap_free_connection ldap_free_connection: refcnt 1 wait4msg continue, msgid 18, all 1 ** Connections: * host: corp.van.dwave port: 0 refcnt: 2 status: Connected last used: Wed Nov 30 10:18:54 2005 rebind in progress queue is empty * host: SERVER.corp.van.dwave port: 389 (default) refcnt: 1 status: Connected last used: Wed Nov 30 10:18:54 2005 ** Outstanding Requests: * msgid 18, origid 18, status InProgress outstanding referrals 0, parent count 0 * msgid 16, origid 16, status Request Completed outstanding referrals 1, parent count 0 ** Response Queue: * msgid 16, type 100 ldap_chkResponseList for msgid=18, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 18, all 1 ldap_read: message type bind msgid 18, original id 18 new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 18 request 18 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 18, msgid 18) ldap_free_connection ldap_free_connection: refcnt 1 ldap_parse_result ldap_msgfree read1msg: 1 new referrals wait4msg: 39 secs to go wait4msg continue, msgid 16, all 1 ** Connections: * host: corp.van.dwave port: 0 refcnt: 1 status: Connected last used: Wed Nov 30 10:18:54 2005 * host: SERVER.corp.van.dwave port: 389 (default) refcnt: 1 status: Connected last used: Wed Nov 30 10:18:54 2005 ** Outstanding Requests: * msgid 17, origid 16, status InProgress outstanding referrals 0, parent count 1 * msgid 16, origid 16, status Request Completed outstanding referrals 1, parent count 0 ** Response Queue: * msgid 16, type 100 ldap_chkResponseList for msgid=16, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 16, all 1 ldap_read: message type search-reference msgid 17, original id 16 ldap_chase_v3referrals ldap_url_parse_ext(ldap://corp.van.dwave/CN=Schema,CN=Configuration,DC=c orp,DC=van,DC=dwave) re_encode_request: new msgid 19, new dn <CN=Schema,CN=Configuration,DC=corp,DC=van,DC=dwave> re_encode_request new request is: ber_dump: buf=0x0815fbe0 ptr=0x0815ff60 end=0x08160bbc len=896 0000: 72 64 72 64 00 00 00 00 00 00 00 00 00 00 00 00 rdrd............ 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 02f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ ldap_chase_v3referral: msgid 17, url "ldap://corp.van.dwave/CN=Schema,CN=Configuration,DC=corp,DC=van,DC=dwav e" ldap_send_server_request read1msg: search ref chased, mark request chasing refs, id = 17 read1msg: 1 new referrals wait4msg: 39 secs to go wait4msg continue, msgid 16, all 1 ** Connections: * host: corp.van.dwave port: 0 refcnt: 2 status: Connected last used: Wed Nov 30 10:18:54 2005 * host: SERVER.corp.van.dwave port: 389 (default) refcnt: 1 status: Connected last used: Wed Nov 30 10:18:54 2005 ** Outstanding Requests: * msgid 19, origid 16, status InProgress outstanding referrals 0, parent count 1 * msgid 17, origid 16, status ChasingRefs outstanding referrals 0, parent count 1 * msgid 16, origid 16, status Request Completed outstanding referrals 2, parent count 0 ** Response Queue: * msgid 16, type 100 ldap_chkResponseList for msgid=16, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 16, all 1 ldap_read: message type search-result msgid 17, original id 16 new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 17 merged parent (id 16) error info: result errno 0, error <>, matched <> ldap_free_connection ldap_free_connection: refcnt 1 wait4msg: 39 secs to go wait4msg continue, msgid 16, all 1 ** Connections: * host: corp.van.dwave port: 0 refcnt: 1 status: Connected last used: Wed Nov 30 10:18:54 2005 * host: SERVER.corp.van.dwave port: 389 (default) refcnt: 1 status: Connected last used: Wed Nov 30 10:18:54 2005 ** Outstanding Requests: * msgid 19, origid 16, status InProgress outstanding referrals 0, parent count 1 * msgid 17, origid 16, status Request Completed outstanding referrals 0, parent count 1 * msgid 16, origid 16, status Request Completed outstanding referrals 1, parent count 0 ** Response Queue: * msgid 16, type 100 ldap_chkResponseList for msgid=16, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 16, all 1 ldap_read: message type search-result msgid 19, original id 16 new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 19 merged parent (id 16) error info: result errno 0, error <>, matched <> request 16 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 16, msgid 16) ldap_free_request (origid 16, msgid 19) ldap_free_request (origid 16, msgid 17) ldap_free_connection ldap_send_unbind ldap_free_connection: actually freed adding response id 16 type 101: ldap_parse_result ldap_get_dn ldap_get_values rlm_ldap: looking for check items in directory... ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values rlm_ldap: looking for reply items in directory... ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values ldap_get_values rlm_ldap: user apuye authorized to use remote access ldap_msgfree rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "apuye" with password "XXXXXXXX2" rlm_ldap: user DN: CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave rlm_ldap: (re)connect to SERVER.corp.van.dwave:389, authentication 1 ldap_create rlm_ldap: bind as CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave/XXXXXXXX2 to SERVER.corp.van.dwave:389 ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection ldap_int_open_connection ldap_connect_to_host: TCP SERVER.corp.van.dwave:389 ldap_new_socket: 7 ldap_prepare_socket: 7 ldap_connect_to_host: Trying w.x.y.z:389 ldap_connect_timeout: fd: 7 tm: 10 async: 0 ldap_ndelay_on: 7 ldap_is_sock_ready: 7 ldap_ndelay_off: 7 ldap_open_defconn: successful ldap_send_server_request rlm_ldap: waiting for bind result ... ldap_result msgid 1 ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL wait4msg (timeout 40 sec, 0 usec), msgid 1 wait4msg continue, msgid 1, all 1 ** Connections: * host: SERVER.corp.van.dwave port: 389 (default) refcnt: 2 status: Connected last used: Wed Nov 30 10:18:54 2005 ** Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: Empty ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 1, all 1 ldap_read: message type bind msgid 1, original id 1 new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 1 request 1 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection ldap_free_connection: refcnt 1 ldap_parse_result ldap_msgfree rlm_ldap: Bind was successful rlm_ldap: user apuye authenticated succesfully ldap_free_connection ldap_send_unbind ldap_free_connection: actually freed modcall[authenticate]: module "ldap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 162 to 127.0.0.1:51232 Service-Type = Login-User Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 162 with timestamp 438ded0e Nothing to do. Sleeping until we see a request. My radiusd.conf: filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(objectclass=user ))" groupname_attribute = "cn" groupmembership_filter = "(&(objectClass=group)(member=%{Ldap-UserDn}))(&(objectClass=top)(unique member=%{Ldap-UserDn}))" groupmembership_attribute = memberOf My ldap.attrmap: replyItem Class group My users file: DEFAULT Ldap-Group == "itops" Auth-Type := LDAP, Service-Type = Login, Thanks in advance Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Dusty Doris > >Sent: November 30, 2005 7:16 AM > >To: FreeRadius users mailing list > >Subject: RE: Freeradius How to integrate Active Directory > >and return group attribute to VPN Concentrator > > > >> Radiusd.conf: > >> > >> filter = > >> > >"(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(membe > >rOf=CN=rp > >> tp cps,OU=Datawave Users,DC=corp,DC=van,DC=dwave))" > >> > >> This works fine. However I can't get it to return any > >replyItems. Has > >> anyone gotten this to work with Active Directory? All the > >docs I see > >> on the Net refeerence OpenLDAP. I'm sure there is a lot of > >folks out > >> there running Windows 2000/2003 Active Directory. > >> > >> I have spent a couple of days on this not having much > >luck. Here are a > >> few questions that would help me a bit. > >> > >> 1) Do I need groupname_attribute to get this to work? > >> > >> 2) What about groupmembership_filter and groupmembership_attribute? > >> > >> My ldap.attrmap looks like this: > >> > >> replyItem Class groupofnames > >> replyItem Class group > >> > >> I think the above is correct. Can some shed some light on this? > > > >Is group and groupofnames something that is an attribute of > >a user? When freeradius searches for reply items it is > >searching for attributes of that user. > > > >eg: > > > >dn: cn=someuser,... > >group: somegroup > > > >Should then add > > > >Class = somegroup > > > >to the reply items. > > > >If you want to make reply items attached to a group, rather > >than in individual, you will need to set the User-Profile attribute. > > > >For example, > > > >dn: cn=somegroup,ou=groups,... > >group: somegroup > > > >Then in the users file. > > > >DEFAULT Ldap-Group == somegroup, User-Profile := > >"cn=somegroup,ou=groups,..." > > > >You may be able to do this dynamically using xlat or > >something like huntgroups too. If you want an example, send > >us an example of a user and group from AD in ldif format and > >an example of a radius packet that you would expect in the > >reply and I'll see if I can come up with an idea for ya. > > > > > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > Disclaimer: This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

IPv6 Support
by Paulo Alexandre Caceres Ferreira 30 Nov '05

30 Nov '05

Hi, I have a question for you. Freeradius support authentication over IPv6? I'm searching a RADIUS Server to perform authentication over IPv6 in my network, and I ask if Freeradius support IPv6 because I used it in IPv4 networks in one school project a few ears ago. If Freeradius doesn't support IPv6, and somebody know a RADIUS that support, please reply to me the name of that application. Thanks in advance, Paulo Ferreira ./Caceres ---------------------

2 1

eap\leap proxy
by carnold＠dancon.com 30 Nov '05

30 Nov '05

I would like to proxy leap authentication requests to a non-leap compatible radius server. This is a feature of the Cisco ACS product that I was hoping FreeRadius would be able to do. I have eap\leap working with my lab wireless access point using the local users file. I have a realm setup and can proxy pap, chap , and mschap successfully to a remote radius server. What I would like to do is have FreeRadius perform the eap\leap authentication request locally, and proxy a chap or mschap(v2) request with username and password ( only ) to a remote ( non-eap ) radius server. Questions: 1) Does the current FreeRadius download have this capability and I just need to configure it correctly? 2) Has anyone done eap\leap proxy this way with any success ( or not ) with FreeRadius? Do you have a code hack you can share? 3) [to the developers] In the processing eap\leap authentication request within the code does the username and password get decoded to plain text in a variable if authenticated to the local users file? C file and line number, please. If I am not able to get this working, I am looking at having to purchase 10 copies of Cisco's ACS at $4K each. I would like to avoid the cost and provide wireless authentication at each of my facilities. Any input is welcome, thanks in advance.... ----------------------------------------------------- Chris Arnold Network Manager & Systems Architect ----------------------------------------------------- This message (including any attachments) contains confidential and/or proprietary information intended only for the addressee. Any unauthorized disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited and may constitute a violation of law. If you are not the intended recipient, please notify the sender immediately by responding to this e-mail, and delete the message from your system. If you have any questions about this e-mail please notify the sender immediately. Ce message (ainsi que les eventuelles pieces jointes) est exclusivement adresse au destinataire et contient des informations confidentielles. La copie, la communication ou la distribution du contenu de ce message sans l'accord prealable de l'expediteur sont strictement interdits et peuvent constituer un delit. Si vous n'etes pas destinataire de ce message, merci de le detruire et d'avertir l'expediteur. Si vous avez des questions se rapportant a ce courrier electronique, merci de bien vouloir notifier l'expediteur immediatement.

2 1