- Freeradius-Users - lists.freeradius.org

Proble with an Accounting query
by Santiago Balaguer García 21 Jul '05

21 Jul '05

2 2

allow access only from specific networks
by Christian Seitz 21 Jul '05

21 Jul '05

Hi there, I tried to solve my problem using huntgroups, but after several days I couldn't find a solution. Perhaps someone has an idea... There are accounts that should only be able to connect when the callingstationid is an ip address within 10.0.0.0/8 or 192.168.0.0/16. Otherwise the user must be rejected. Other accounts should be able to connect from everywhere. Any ideas? Chris -- Christian Seitz <chris(a)in-berlin.de> http://www.in-berlin.de/ Individual Network Berlin e.V. PGP Fingerprint: A9 17 03 0D 36 AB 07 4E D0 1E C3 8E 3F B0 66 9A

1 0

howto log the activity of my user
by Dominique Lambert 21 Jul '05

21 Jul '05

hello i search to log the activity of my users i want to know date,time,url please thank's

3 4

Re: howto log the activity of my user
by Marcin Jessa 21 Jul '05

21 Jul '05

On Thu, 21 Jul 2005 11:26:47 +0200 Dominique Lambert <dlambert(a)hotel-sofibra.com> wrote: > Marcin Jessa a écrit : > > >On Thu, 21 Jul 2005 11:07:40 +0200 > >Dominique Lambert <dlambert(a)hotel-sofibra.com> wrote: > > > > > > > >>hello > >>i search to log the activity of my users > >> > >> > >What kind of activity? > > > > > > > >>i want to know date,time,url > >>please > >>thank's > >> > >> > >> > hello > i want know welch url my users visit, when etc... You'd need a traffic logger on your gateway to be able to see that or a http proxy. Radius cannot log such a thing. Radius can log following: Client IP Address Download/Upload Login/Logout Time NAS IP Address NAS Port Session Time User Name

1 0

disconnect user from terminal
by yuniva wati 21 Jul '05

21 Jul '05

hello, I have a problem using freeradius. when one user connect to freeradius can we disconnect them if we want to do that. Can we use terminal on Linux to disconnect??? thank you __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

re: Restricting Access by Group Membership
by Sayantan Bhowmick 21 Jul '05

21 Jul '05

Hi, To allow access the (regardless of password) you can set Auth-Type := Accept (See FreeRADIUS FAQ 5.5). I am not sure that is what you want though, as in this case irrespective of what password a user enters he will be granted access. You can use the configuration suggested by Dusty Doris. That should work for you. -Sayantan. >>> jp(a)joshmp.com 07/21/05 1:04 AM >>> My fault...members of that group are DENIED access. Now I get. So, that leads me to another question. How do I change the syntax so that users are ALLOWED access if they are a member of the specified group? I tried changing the line in the users file to Auth-Type := Allow, but this didn't work. Unfortunately, I can't find anything on this in rlm_ldap or FAQ. Thanks in advance, Josh -----Original Message----- Setup: FreeRADIUS 1.0.4 on FreeBSD 4.11 authenticating to eDirectory on Netware 6.5 server. Issue: I have read the FAQ section regaring limiting access to specific groups (http://freeradius.org/faq/#5.2) but I can't get it to work. For one, I am not entirely certain where to add the lines. I have tried using the users file, but this doesn't seem to work. Two, I am not sure that I am using the right syntax. Here is what I have tried: - adding the following lines to users file: ----snip----- DEFAULT Group == "cn=remoteusers,o=services", Auth-Type := Reject Reply-Message = "Your account has been disabled" DEFAULT Auth-Type = LDAP -----snip----- Here is the debug: -----snip----- episd44# /usr/local/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "10.254.8.25" ldap: port = 389 ldap: net_timeout = 20 ldap: timeout = 20 ldap: timelimit = 20 ldap: identity = "cn=raduser,o=services" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "secretrad" ldap: basedn = "o=services" ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = no rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x808b400 Module: Instantiated ldap (ldap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:2254, id=53, length=60 User-Name = "dcitest1" User-Password = "dcitest1" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'o=services' radius_xlat: '(cn=dcitest1)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.254.8.25:389, authentication 0 rlm_ldap: bind as cn=raduser,o=services/secretrad to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=services, with filter (cn=dcitest1) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=cn=dcitest1,ou=GW,o=Services))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn=dcitest1,ou=GW,o=Services)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=remoteusers,o=services, with filter (|(&(objectClass=GroupOfNames)(member=cn=dcitest1,ou=GW,o=Services))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn=dcitest1,ou=GW,o=Services))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group cn=remoteusers,o=services not found or user is not a member. users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "dcitest1" with password "dcitest1" rlm_ldap: user DN: cn=dcitest1,ou=GW,o=Services rlm_ldap: (re)connect to 10.254.8.25:389, authentication 1 rlm_ldap: bind as cn=dcitest1,ou=GW,o=Services/dcitest1 to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user dcitest1 authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 53 to 127.0.0.1:2254 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 53 with timestamp 42de3bed Nothing to do. Sleeping until we see a request. -----snip----- Thanks in advance, Josh - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

EAP/TLS Problem
by Hamid Salim 21 Jul '05

21 Jul '05

I have set up all components and I am getting following message. any help will be appreciated. using openssl fedora core 3 radius latest release Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory radiusd.conf[9]: eap: Module instantiation failed.

2 1

grouping services - LDAP
by Rohaizam Abu Bakar 21 Jul '05

21 Jul '05

Hi all, Using Freeradius 1.0.4 (FB 4.11) I want to grouping between dialup & adsl... refer to users file below by if if Ldap-Group ==ADSL is found, should authenticate/authorize by "ldapadsl" and if not found, assuming dialup user and should authenticate/authorize by "ldap1/ldap2" (DIALUP) But the problem, referring to debug log.. doesn't matter whether Ldap-Group=ADSL is found or not, it still check at both ldap1/ldap2 & ldapadsl i.e checking "adslAccess & dialAcess" atttribute. What i want is that.. If Ldap-Group ==ADSL is found, it should be handled by "ldapadsl" and not checking "ldap1/ldap2" and same goes when not found, it will be handled by "ldap1/ldap2" and not checking "ldapadsl" anyone can help.?? thanks --haizam ################################## users file: DEFAULT Ldap-Group == "ADSL", Auth-Type := ADSL DEFAULT Auth-Type := LDAP #####################################################################3 Debug:- rlm_ldap: performing search in ou=RADIUS,ou=People,dc=jaring,dc=my, with filter (&(jaringConnectionType=ADSL)(&(uid=organza)(objectclass=radiusprofile))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group ADSL not found or user is not a member. users: Matched entry DEFAULT at line 147 . . . rlm_ldap: checking if remote access for organza is allowed by dialupAccess . .. rlm_ldap: no adslAccess attribute - access denied by default ############################ authenticate { Auth-Type LDAP { redundant { ldap1 ldap2 } } Auth-Type ADSL { ldapadsl } } ############################# authorize { redundant { ldap1 ldap2 } ldapadsl } ##################################### ldap ldap1 { server = "10.1.1.1" basedn = "ou=RADIUS,ou=People,dc=jaring,dc=my" access_attr = "dialupAccess" groupname_attribute = jaringConnectionType groupmembership_filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile))" } ldap ldap2 { server = "10.1.1.2" basedn = "ou=RADIUS,ou=People,dc=jaring,dc=my" access_attr = "dialupAccess" groupname_attribute = jaringConnectionType groupmembership_filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile))" } ldap adsl { server = "10.1.1.3" basedn = "ou=ADSL,ou=People,dc=jaring,dc=my" access_attr = "adslAccess" groupname_attribute = jaringConnectionType groupmembership_filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile))" } ############################################

2 2

RE: FW: TTLS and PAP
by martin.p.bradley＠bt.com 20 Jul '05

20 Jul '05

Alan, Sorry about duplicating my original email. I found your reply about 3 seconds after doing that. Here is the stack trace. Maybe my version of ssl is too old? [mbradley@mars bin]$ openssl OpenSSL> version OpenSSL 0.9.7b 10 Apr 2003 #0 0x402d4a97 in eaptls_gen_mppe_keys (reply_vps=0x8179c08, s=0x8157790, prf_label=0x402da5d9 "ttls keying material") at mppe_keys.c:136 136 memcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE); (gdb) bt #0 0x402d4a97 in eaptls_gen_mppe_keys (reply_vps=0x8179c08, s=0x8157790, prf_label=0x402da5d9 "ttls keying material") at mppe_keys.c:136 #1 0x402d8912 in eapttls_authenticate (arg=0x814dcb0, handler=0x81576e8) at rlm_eap_ttls.c:253 #2 0x4002a627 in eaptype_call (atype=0x814dba0, handler=0x81576e8) at eap.c:167 #3 0x4002a9f5 in eaptype_select (inst=0x810fe60, handler=0x81576e8) at eap.c:353 #4 0x40029d89 in eap_authenticate (instance=0x810fe60, request=0x8179b38) at rlm_eap.c:271 #5 0x08054c7a in call_modsingle (component=0, sp=0x810ebe8, request=0x8179b38, default_result=0) at modcall.c:219 #6 0x08054e6e in modcall (component=0, c=0x810ebe8, request=0x8179b38) at modcall.c:344 #7 0x08054d37 in call_modgroup (component=0, g=0x814f3e0, request=0x8179b38, default_result=0) at modcall.c:252 #8 0x08054e1d in modcall (component=0, c=0x814f3e0, request=0x8179b38) at modcall.c:335 #9 0x0805492b in module_authenticate (auth_type=6, request=0x8179b38) at modules.c:891 #10 0x0805198b in rad_check_password (request=0x8179b38) at auth.c:353 #11 0x08051d53 in rad_authenticate (request=0x8179b38) at auth.c:644 #12 0x0804d5a9 in rad_respond (request=0x8179b38, fun=0x8051a9c <rad_authenticate>) at radiusd.c:1642 #13 0x0804d2ea in main (argc=2, argv=0xbffff514) at radiusd.c:1427 #14 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6 123 void eaptls_gen_mppe_keys(VALUE_PAIR **reply_vps, SSL *s, 124 const char *prf_label) 125 { 126 unsigned char out[2*EAPTLS_MPPE_KEY_LEN], buf[2*EAPTLS_MPPE_KEY_LEN]; 127 unsigned char seed[64 + 2*SSL3_RANDOM_SIZE]; (gdb) l 128 unsigned char *p = seed; 129 size_t prf_size; 130 131 prf_size = strlen(prf_label); 132 133 memcpy(p, prf_label, prf_size); 134 p += prf_size; 135 136 memcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE); 137 p += SSL3_RANDOM_SIZE; (gdb) print s $2 = (SSL *) 0x8157790 (gdb) print s->s3 $3 = (struct ssl3_state_st *) 0x0 Regards, Martin. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 19 July 2005 20:01 To: FreeRadius users mailing list Subject: Re: FW: TTLS and PAP <martin.p.bradley(a)bt.com> wrote: > I'm trying to get TTLS/PAP working using freeradius 1.0.4. I must have > it configured incorrectly because its giving a Segmentation fault just > before giving the Access-Accept & EAP-Success back to the switch. I > have searched the archives for a solution but not found help to sort my > problem out. See doc/bugs > I don't understand is why the modcall[authorise] appear often in request > processing before modcall[authenticate]. I thought the order was to > authenticate a user and then once we are sure they are who they say they > are then we authorise them to use the network. Due to historical issues, FreeRADIUS has pre-authenticate, authenticate, and post-authenticate. The pre-authenticate is called "authorize". The sections could just as easily be called "foo", "bar", and "baz". It makes no difference to the operation of the server. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 3

re: Restricting Access by Group Membership
by jp＠joshmp.com 20 Jul '05

20 Jul '05

My fault...members of that group are DENIED access. Now I get. So, that leads me to another question. How do I change the syntax so that users are ALLOWED access if they are a member of the specified group? I tried changing the line in the users file to Auth-Type := Allow, but this didn't work. Unfortunately, I can't find anything on this in rlm_ldap or FAQ. Thanks in advance, Josh -----Original Message----- Setup: FreeRADIUS 1.0.4 on FreeBSD 4.11 authenticating to eDirectory on Netware 6.5 server. Issue: I have read the FAQ section regaring limiting access to specific groups (http://freeradius.org/faq/#5.2) but I can't get it to work. For one, I am not entirely certain where to add the lines. I have tried using the users file, but this doesn't seem to work. Two, I am not sure that I am using the right syntax. Here is what I have tried: - adding the following lines to users file: ----snip----- DEFAULT Group == "cn=remoteusers,o=services", Auth-Type := Reject Reply-Message = "Your account has been disabled" DEFAULT Auth-Type = LDAP -----snip----- Here is the debug: -----snip----- episd44# /usr/local/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "10.254.8.25" ldap: port = 389 ldap: net_timeout = 20 ldap: timeout = 20 ldap: timelimit = 20 ldap: identity = "cn=raduser,o=services" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "secretrad" ldap: basedn = "o=services" ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = no rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x808b400 Module: Instantiated ldap (ldap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:2254, id=53, length=60 User-Name = "dcitest1" User-Password = "dcitest1" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'o=services' radius_xlat: '(cn=dcitest1)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.254.8.25:389, authentication 0 rlm_ldap: bind as cn=raduser,o=services/secretrad to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=services, with filter (cn=dcitest1) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=cn=dcitest1,ou=GW,o=Services))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn=dcitest1,ou=GW,o=Services)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=remoteusers,o=services, with filter (|(&(objectClass=GroupOfNames)(member=cn=dcitest1,ou=GW,o=Services))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn=dcitest1,ou=GW,o=Services))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group cn=remoteusers,o=services not found or user is not a member. users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "dcitest1" with password "dcitest1" rlm_ldap: user DN: cn=dcitest1,ou=GW,o=Services rlm_ldap: (re)connect to 10.254.8.25:389, authentication 1 rlm_ldap: bind as cn=dcitest1,ou=GW,o=Services/dcitest1 to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user dcitest1 authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 53 to 127.0.0.1:2254 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 53 with timestamp 42de3bed Nothing to do. Sleeping until we see a request. -----snip----- Thanks in advance, Josh

2 1