- Freeradius-Users - lists.freeradius.org

AW: Freeradius vs. ActiveDirectory
by Völker, Christian 14 Nov '05

14 Nov '05

Yohoo! > What about the password? Which password? The User-Password? Or the shared secret? The Password for the Proxy-User is written down in the radiusd.conf. > I thought this was a kerberos one and didn't reside into the ldap itself? Kerberos ist installed, but I don't use it (I think so! ;-)) Greets Christian

1 0

RE: Freeradius vs. ActiveDirectory
by Jonathan De Graeve 14 Nov '05

14 Nov '05

What about the password? I thought this was a kerberos one and didn't reside into the ldap itself? -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- ________________________________ Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Völker, Christian Verzonden: maandag 14 november 2005 11:22 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: Freeradius vs. ActiveDirectory Yohoo! Yes! I did it! ;) My freeradius (1.0.1-1.RHEL3) authenticates again our ActiveDirectory (on 2003 Server). Without ntlm_auth! Below I have added a short summary how I realized it here. But now I have a question and I can't solve it for myself. I want to retreive some group informations from AD. In an users account I find several values "memberOf" and the DN of the group, where the user belong to. Now I want to give access via freeradius only to some special groups. I have figuered out, that there are these parameters: groupname_attribute, groupmembership_filter and groupmembership_attribute combined with some entries in the users-file. I've read the doc/rlm_ldap, but I didn't find any deeper hints or explanation. Questions: 1. Where can I find some docs about the %{...} Values in groupmebership_filter? Which one should I use in combination with my AD? 2. Which value should I use then in the users-file? 3. Is there anyone who can give a little help in further authenticating with group? -------------short summary how to authenticate vs. ActiveDirectory ----------------------- /etc/raddb/radiusd.conf [...] ldap { #servername with an AD-Server running Win2003Srv server = "adsrv.qsc.de" #The Useraccount for querying AD (anonymous query is disabled) identity = "cn=man,ou=ServiceAdmins,dc=qsc,dc=de" #The password for the Query-User password = 'xxxxxx' #base DN for user search; all our Users are in ou=employees. Without this "ou=...", no user will be found. \ #I don't understand why basedn = "ou=employees,dc=qsc,dc=de" # I've copied the below string, because I didn't understand the meanings of the %{...} filter = "(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})" # I had to increase the timeouts timeout = 40 timelimit = 30 net_timeout = 10 } The users-file left on default, no changes. I hope, I could help some people trying to use AD for radius. And, I hope, someone will help me with my user-problem. Greets Christian

1 0

RE: assigning a vlan-id after successful authentication
by Jeff Reilly 14 Nov '05

14 Nov '05

3 2

radiusd error AFTER ok
by Drew S. Dupont 14 Nov '05

14 Nov '05

When I run radiusd from the command line in a Fedora Core 1/RedHat 9 base system, it will start w/o any problems. However, when I try to start radiusd from inside a helper app., it says it is ready to process requests but then throws the following error to the radius.log file: Sun Nov 13 22:39:10 2005 : Info: Using deprecated naslist file. Support for this will go away soon. Sun Nov 13 22:39:10 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Sun Nov 13 22:39:10 2005 : Info: Ready to process requests. Sun Nov 13 22:39:10 2005 : Error: Error receiving packet: Socket operation on non-socket Sun Nov 13 22:39:10 2005 : Error: Error receiving packet: Socket operation on non-socket Sun Nov 13 22:39:10 2005 : Error: Error receiving packet: Socket operation on non-socket The helper script is as follows: ======================= /* This program is distributed under the terms of the GNU General Public * Licence. See the file COPYING for details. * * filename: radctrl * Simple program intended to be installed setuid(0) that can be used for * controling the Captive Portal service (FreeRadius). */ #include "setuid.h" int main(int argc, char *argv[]) { int fd = -1; if (!(initsetuid(1))) exit(1); if (argc < 2) { fprintf(stderr, "Missing arg\n"); exit(1); } if (((fd = open("/var/smoothwall/mods/captiveportal/enable", O_RDONLY)) != -1) || (strcmp(argv[1], "X") == 0)) { close(fd); } else { return 0; } // Declare used vars FILE *radpidfile = NULL; FILE *radstatusfile = NULL; char radstatusfilepath[STRING_SIZE]; memset(radstatusfilepath, 0, STRING_SIZE); char command[STRING_SIZE]; memset(command, 0, STRING_SIZE); char radpid[STRING_SIZE]; memset(radpid, 0, STRING_SIZE); int radrunning = 0; // Open freeradius's pid file if ((radpidfile = fopen("/var/run/radiusd/radiusd.pid", "r"))) { // Read in freeradius's pid fgets(radpid, STRING_SIZE, radpidfile); if (radpid[strlen(radpid) - 1] == '\n') { radpid[strlen(radpid) - 1] = '\0'; } fclose (radpidfile); } else { // Set -1 flag snprintf(radpid, STRING_SIZE - 1, "-1"); } // Null out file pointer radpidfile = NULL; // Check to see if have a valid pid if (strcmp(radpid, "-1")) { // Get freeradius status file path snprintf(radstatusfilepath, STRING_SIZE - 1, "/proc/%s/status", radpid); // Open freeradius's status file if ((radstatusfile = fopen(radstatusfilepath, "r"))) { // Set status and close file radrunning = 1; fclose (radstatusfile); } else { radrunning = 0; } // Null out file poinnter radstatusfile = NULL; } else { radrunning = 0; } // Check for start if (strcmp(argv[1], "S") == 0) { if (radrunning == 0) { system("/usr/local/sbin/radiusd > /dev/null"); system("/usr/bin/logger -t smoothwall 'FreeRadius has been started'"); } else { system("/usr/bin/logger -t smoothwall 'FreeRadius is already running'"); } // Check for restart } else if (strcmp(argv[1], "R") == 0) { if (radrunning == 1) { snprintf(command, STRING_SIZE - 1, "/bin/kill -9 %s > /dev/null", radpid); system(command); sleep(1); system("/usr/local/sbin/radiusd > /dev/null"); system("/usr/bin/logger -t smoothwall 'FreeRadius has been restarted'"); } else { system("/usr/bin/logger -t smoothwall 'Can not restart FreeRadius since it is not running'"); } // Check for stop } else if (strcmp(argv[1], "X") == 0) { if (radrunning == 1) { snprintf(command, STRING_SIZE - 1, "/bin/kill -1 %s > /dev/null", radpid); system(command); system("/usr/bin/logger -t smoothwall 'FreeRadius has been stopped'"); } else { system("/usr/bin/logger -t smoothwall 'Can not stop FreeRadius since it is not running'"); } } else { fprintf(stderr, "Bad arg\n"); exit(1); } return 0; } ================ This app used to work just fine before my recent HD and MoBo crashes today. I had to restore the system from a backup and the app. will no longer work. Like I said, radiusd from the command line starts FreeRadius just fine. It is only in this app. that it is now causing me problems. Thank you, Drew Dupont -- ------------------------------------------------------------------------------------------------------ Drew S. Dupont dsdupont(a)alumni.indiana.edu AIM: NetWhizOne FWD #: 271144 YIM: dsdupont ------------------------------------------------------------------------------------------------------

2 1

RE: assigning a vlan-id after successful authentication
by Jeff Reilly 13 Nov '05

13 Nov '05

2 1

Computer Logon with PEAP-MSCHAPv2
by Sebastian Mauer 13 Nov '05

13 Nov '05

Hello there, after setting up our new central Radius Server I now want to finally set up PEAP-MSCHAPv2 with support for Computer acces, that my users can log in to the Samba administered Domain from Wireless Terminals (like their Laptops). I found a lot of helpful HowTos and Documentations but never managed to get Information about Computer Logons with PEAP. I understand that PEAP only uses certificates to identify the Radius Server, but uses Username/Password for connecting Users to the Wireless Network. Can someone point me to a resource or tell me how to do this all for Machines that they can authenticate when no user has logged in, to manage connection to the Domain when it comes to specific User login. Greetings, Sebastian Mauer

2 3

RE: sqlcounter and session-timeout
by Jonathan De Graeve 12 Nov '05

12 Nov '05

> > > I am trying to use sqlcounter to count octets and am having the same > problem. It seems that sqlcounter module was designed to handle the > amount of time a user is allowed online and as such is hardcoded to > return the Session-Timeout value according to the sql query. > > >how can i override the value of session-timeout, lets say for 10 minutes > (i dont > >care if a user can stay connected until 0:10) ?? > > > I put a seperate entry in the radcheckgroup table with the > session-timeout value but freeradius seems to always return the lower of > the two values... again presumably to limit online usage. > > Anyway let me know if you find a way... I am going to see if I can make > sense of "rlm_sqlcounter.c" with my limited c knowledge :-) > I have the same problem and this by configured my nas to discard the session timeout. It would be nice if you could have a config parameter if the system should return session-timeout for the specific sqlcounter or return it as another 'defined by admin' radius attribute (for octets in the case of Nomadix lets say: Nomadix-MaxBytesDown/Nomadix-MaxBytesUp) J.

2 1

sqlcounter and session-timeout
by Markus Krause 12 Nov '05

12 Nov '05

hi all, i have set up freeradius v1.0.5 with experimental modules on a sles 9 system. i am storing the user information in a mysql db, which works. then i wanted to set configure some "short term accounts" which are only valid for some days, to be more exact: after the first usage of a username the account should be valid until midnight (the same, following, .. days). testing with ntradping worked. to achieve this i use the following in radiusd.conf, sqlcounter.conf and dictionary: +++++ radiusd.conf authorize { preprocess eap files sql shorttermaccount } authenticate { eap } accounting { detail unix radutmp sql } ----- (radiusd.conf) +++++ sqlcounter.conf sqlcounter shorttermaccount { counter-name = Short-Term-Account check-name = Max-Days-Passed sqlmod-inst = sql key = User-Name reset = never query = "SELECT TO_DAYS( NOW() ) - TO_DAYS( AcctStartTime ) FROM radacct WHERE UserName = '%{%k}' LIMIT 1;" } ----- (sqlcounter.conf) +++++ dictionary ATTRIBUTE Max-Days-Passed 3000 integer ----- (dictionary) in the mysql db i have: +++++ mysql output mysql> select * from radcheck; +----+----------+-----------------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+-----------------+----+----------+ | 6 | guest2 | Password | := | secret99 | | 7 | guest2 | Max-Days-Passed | := | 1 | +----+----------+-----------------+----+----------+ ----- (mysql output) testing with ntradping shows access-accept (unil midnight after first accounting). but when using an ironpoint 200 ap i run into the following problem: the reply message contains "Session-Timeout := 1" which is (as it seems) sent by sqlcounter, which means the client (a windows xp sp2 with intel pro 2200bg) reconnects every second!! i already tried to enter the user "guest2" in mysql in the table "radreply": ++++ mysql output: mysql> select * from radreply; +----+----------+-----------------+----+-------+------+ | id | UserName | Attribute | op | Value | prio | +----+----------+-----------------+----+-------+------+ | 1 | guest2 | Session-Timeout | := | 600 | 1 | +----+----------+-----------------+----+-------+------+ 1 row in set (0.00 sec) ----- (mysql output) but this only affects user which have no attribute "Max-Days-Passed"... how can i override the value of session-timeout, lets say for 10 minutes (i dont care if a user can stay connected until 0:10) ?? thanks in advance for any hints!! with best regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 1

rlm_radutmp: No NAS-Port seen
by Markus Krause 12 Nov '05

12 Nov '05

hi all! when running freeradius in debug mode i am finding the following message: +++++ [snipp] rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent [snipp] radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'anonymous' rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! ----- is this really jsut a warning or does it mean the accounting (done for short term accounts using mysql) will not work? (as reported in another mail i only got accounting entries for user "anonymous" which comes from eap-ttls) thanks in advance for your help! with best regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 1

assigning a vlan-id after successful authentication
by Sven Juergensen 12 Nov '05

12 Nov '05

hello people, how does the above mentioned work? i am not quite sure where to start. is it embedded in the 'Reply-Message' or does it have to do with the tunnel-types? i'm trying to supply a vlan-id to an hp2626 with mac-based authentication. couldn't find this in the faq or relevant conf-files either - what am i missing? thanks alot in advance, sven

2 1