- Freeradius-Users - lists.freeradius.org

EAP/TLS Problem
by Hamid Salim 21 Jul '05

21 Jul '05

I have set up all components and I am getting following message. any help will be appreciated. using openssl fedora core 3 radius latest release Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory radiusd.conf[9]: eap: Module instantiation failed.

2 1

grouping services - LDAP
by Rohaizam Abu Bakar 21 Jul '05

21 Jul '05

Hi all, Using Freeradius 1.0.4 (FB 4.11) I want to grouping between dialup & adsl... refer to users file below by if if Ldap-Group ==ADSL is found, should authenticate/authorize by "ldapadsl" and if not found, assuming dialup user and should authenticate/authorize by "ldap1/ldap2" (DIALUP) But the problem, referring to debug log.. doesn't matter whether Ldap-Group=ADSL is found or not, it still check at both ldap1/ldap2 & ldapadsl i.e checking "adslAccess & dialAcess" atttribute. What i want is that.. If Ldap-Group ==ADSL is found, it should be handled by "ldapadsl" and not checking "ldap1/ldap2" and same goes when not found, it will be handled by "ldap1/ldap2" and not checking "ldapadsl" anyone can help.?? thanks --haizam ################################## users file: DEFAULT Ldap-Group == "ADSL", Auth-Type := ADSL DEFAULT Auth-Type := LDAP #####################################################################3 Debug:- rlm_ldap: performing search in ou=RADIUS,ou=People,dc=jaring,dc=my, with filter (&(jaringConnectionType=ADSL)(&(uid=organza)(objectclass=radiusprofile))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group ADSL not found or user is not a member. users: Matched entry DEFAULT at line 147 . . . rlm_ldap: checking if remote access for organza is allowed by dialupAccess . .. rlm_ldap: no adslAccess attribute - access denied by default ############################ authenticate { Auth-Type LDAP { redundant { ldap1 ldap2 } } Auth-Type ADSL { ldapadsl } } ############################# authorize { redundant { ldap1 ldap2 } ldapadsl } ##################################### ldap ldap1 { server = "10.1.1.1" basedn = "ou=RADIUS,ou=People,dc=jaring,dc=my" access_attr = "dialupAccess" groupname_attribute = jaringConnectionType groupmembership_filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile))" } ldap ldap2 { server = "10.1.1.2" basedn = "ou=RADIUS,ou=People,dc=jaring,dc=my" access_attr = "dialupAccess" groupname_attribute = jaringConnectionType groupmembership_filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile))" } ldap adsl { server = "10.1.1.3" basedn = "ou=ADSL,ou=People,dc=jaring,dc=my" access_attr = "adslAccess" groupname_attribute = jaringConnectionType groupmembership_filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile))" } ############################################

2 2

RE: FW: TTLS and PAP
by martin.p.bradley＠bt.com 20 Jul '05

20 Jul '05

Alan, Sorry about duplicating my original email. I found your reply about 3 seconds after doing that. Here is the stack trace. Maybe my version of ssl is too old? [mbradley@mars bin]$ openssl OpenSSL> version OpenSSL 0.9.7b 10 Apr 2003 #0 0x402d4a97 in eaptls_gen_mppe_keys (reply_vps=0x8179c08, s=0x8157790, prf_label=0x402da5d9 "ttls keying material") at mppe_keys.c:136 136 memcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE); (gdb) bt #0 0x402d4a97 in eaptls_gen_mppe_keys (reply_vps=0x8179c08, s=0x8157790, prf_label=0x402da5d9 "ttls keying material") at mppe_keys.c:136 #1 0x402d8912 in eapttls_authenticate (arg=0x814dcb0, handler=0x81576e8) at rlm_eap_ttls.c:253 #2 0x4002a627 in eaptype_call (atype=0x814dba0, handler=0x81576e8) at eap.c:167 #3 0x4002a9f5 in eaptype_select (inst=0x810fe60, handler=0x81576e8) at eap.c:353 #4 0x40029d89 in eap_authenticate (instance=0x810fe60, request=0x8179b38) at rlm_eap.c:271 #5 0x08054c7a in call_modsingle (component=0, sp=0x810ebe8, request=0x8179b38, default_result=0) at modcall.c:219 #6 0x08054e6e in modcall (component=0, c=0x810ebe8, request=0x8179b38) at modcall.c:344 #7 0x08054d37 in call_modgroup (component=0, g=0x814f3e0, request=0x8179b38, default_result=0) at modcall.c:252 #8 0x08054e1d in modcall (component=0, c=0x814f3e0, request=0x8179b38) at modcall.c:335 #9 0x0805492b in module_authenticate (auth_type=6, request=0x8179b38) at modules.c:891 #10 0x0805198b in rad_check_password (request=0x8179b38) at auth.c:353 #11 0x08051d53 in rad_authenticate (request=0x8179b38) at auth.c:644 #12 0x0804d5a9 in rad_respond (request=0x8179b38, fun=0x8051a9c <rad_authenticate>) at radiusd.c:1642 #13 0x0804d2ea in main (argc=2, argv=0xbffff514) at radiusd.c:1427 #14 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6 123 void eaptls_gen_mppe_keys(VALUE_PAIR **reply_vps, SSL *s, 124 const char *prf_label) 125 { 126 unsigned char out[2*EAPTLS_MPPE_KEY_LEN], buf[2*EAPTLS_MPPE_KEY_LEN]; 127 unsigned char seed[64 + 2*SSL3_RANDOM_SIZE]; (gdb) l 128 unsigned char *p = seed; 129 size_t prf_size; 130 131 prf_size = strlen(prf_label); 132 133 memcpy(p, prf_label, prf_size); 134 p += prf_size; 135 136 memcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE); 137 p += SSL3_RANDOM_SIZE; (gdb) print s $2 = (SSL *) 0x8157790 (gdb) print s->s3 $3 = (struct ssl3_state_st *) 0x0 Regards, Martin. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 19 July 2005 20:01 To: FreeRadius users mailing list Subject: Re: FW: TTLS and PAP <martin.p.bradley(a)bt.com> wrote: > I'm trying to get TTLS/PAP working using freeradius 1.0.4. I must have > it configured incorrectly because its giving a Segmentation fault just > before giving the Access-Accept & EAP-Success back to the switch. I > have searched the archives for a solution but not found help to sort my > problem out. See doc/bugs > I don't understand is why the modcall[authorise] appear often in request > processing before modcall[authenticate]. I thought the order was to > authenticate a user and then once we are sure they are who they say they > are then we authorise them to use the network. Due to historical issues, FreeRADIUS has pre-authenticate, authenticate, and post-authenticate. The pre-authenticate is called "authorize". The sections could just as easily be called "foo", "bar", and "baz". It makes no difference to the operation of the server. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 3

re: Restricting Access by Group Membership
by jp＠joshmp.com 20 Jul '05

20 Jul '05

My fault...members of that group are DENIED access. Now I get. So, that leads me to another question. How do I change the syntax so that users are ALLOWED access if they are a member of the specified group? I tried changing the line in the users file to Auth-Type := Allow, but this didn't work. Unfortunately, I can't find anything on this in rlm_ldap or FAQ. Thanks in advance, Josh -----Original Message----- Setup: FreeRADIUS 1.0.4 on FreeBSD 4.11 authenticating to eDirectory on Netware 6.5 server. Issue: I have read the FAQ section regaring limiting access to specific groups (http://freeradius.org/faq/#5.2) but I can't get it to work. For one, I am not entirely certain where to add the lines. I have tried using the users file, but this doesn't seem to work. Two, I am not sure that I am using the right syntax. Here is what I have tried: - adding the following lines to users file: ----snip----- DEFAULT Group == "cn=remoteusers,o=services", Auth-Type := Reject Reply-Message = "Your account has been disabled" DEFAULT Auth-Type = LDAP -----snip----- Here is the debug: -----snip----- episd44# /usr/local/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "10.254.8.25" ldap: port = 389 ldap: net_timeout = 20 ldap: timeout = 20 ldap: timelimit = 20 ldap: identity = "cn=raduser,o=services" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "secretrad" ldap: basedn = "o=services" ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = no rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x808b400 Module: Instantiated ldap (ldap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:2254, id=53, length=60 User-Name = "dcitest1" User-Password = "dcitest1" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'o=services' radius_xlat: '(cn=dcitest1)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.254.8.25:389, authentication 0 rlm_ldap: bind as cn=raduser,o=services/secretrad to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=services, with filter (cn=dcitest1) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=cn=dcitest1,ou=GW,o=Services))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn=dcitest1,ou=GW,o=Services)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=remoteusers,o=services, with filter (|(&(objectClass=GroupOfNames)(member=cn=dcitest1,ou=GW,o=Services))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn=dcitest1,ou=GW,o=Services))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group cn=remoteusers,o=services not found or user is not a member. users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "dcitest1" with password "dcitest1" rlm_ldap: user DN: cn=dcitest1,ou=GW,o=Services rlm_ldap: (re)connect to 10.254.8.25:389, authentication 1 rlm_ldap: bind as cn=dcitest1,ou=GW,o=Services/dcitest1 to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user dcitest1 authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 53 to 127.0.0.1:2254 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 53 with timestamp 42de3bed Nothing to do. Sleeping until we see a request. -----snip----- Thanks in advance, Josh

2 1

Restricting Access by Group Membership
by jp＠joshmp.com 20 Jul '05

20 Jul '05

Setup: FreeRADIUS 1.0.4 on FreeBSD 4.11 authenticating to eDirectory on Netware 6.5 server. Issue: I have read the FAQ section regaring limiting access to specific groups (http://freeradius.org/faq/#5.2) but I can't get it to work. For one, I am not entirely certain where to add the lines. I have tried using the users file, but this doesn't seem to work. Two, I am not sure that I am using the right syntax. Here is what I have tried: - adding the following lines to users file: ----snip----- DEFAULT Group == "cn=remoteusers,o=services", Auth-Type := Reject Reply-Message = "Your account has been disabled" DEFAULT Auth-Type = LDAP -----snip----- Here is the debug: -----snip----- episd44# /usr/local/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "10.254.8.25" ldap: port = 389 ldap: net_timeout = 20 ldap: timeout = 20 ldap: timelimit = 20 ldap: identity = "cn=raduser,o=services" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "secretrad" ldap: basedn = "o=services" ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = no rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x808b400 Module: Instantiated ldap (ldap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:2254, id=53, length=60 User-Name = "dcitest1" User-Password = "dcitest1" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'o=services' radius_xlat: '(cn=dcitest1)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.254.8.25:389, authentication 0 rlm_ldap: bind as cn=raduser,o=services/secretrad to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=services, with filter (cn=dcitest1) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=cn=dcitest1,ou=GW,o=Services))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn=dcitest1,ou=GW,o=Services)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=remoteusers,o=services, with filter (|(&(objectClass=GroupOfNames)(member=cn=dcitest1,ou=GW,o=Services))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn=dcitest1,ou=GW,o=Services))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group cn=remoteusers,o=services not found or user is not a member. users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "dcitest1" with password "dcitest1" rlm_ldap: user DN: cn=dcitest1,ou=GW,o=Services rlm_ldap: (re)connect to 10.254.8.25:389, authentication 1 rlm_ldap: bind as cn=dcitest1,ou=GW,o=Services/dcitest1 to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user dcitest1 authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 53 to 127.0.0.1:2254 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 53 with timestamp 42de3bed Nothing to do. Sleeping until we see a request. -----snip----- Thanks in advance, Josh

1 0

Re: Multiple Root Contexts
by jp＠joshmp.com 20 Jul '05

20 Jul '05

Great, that worked. Thanks. Quoting Mearl Danner <jmdanner(a)samford.edu>: > > Might try downloading this and reading. It's very helpful. > > http://www.novell.com/documentation/edir_radius/pdfdoc/radadmin/radadmin.pdf > > > If that's 3 separate "o=" at the root of the tree, the this from the above > document. > > > Example for Creating Multiple Instances of LDAP Module > > If you want multiple search bases, you can create multiple LDAP modules, by > using the following > syntax in the module section of the radiusd.conf. > > modules { > ........... > ........... > ldap ldap1 { > attribute = value > attribute = value > ............... > ............... > } > ldap ldap2 { > attribute = value > attribute = value > ............... > ............... > } > ldap ldap3 { > attribute = value > attribute = value > ............... > ............... > } > } > > You can use the configured modules in authorize, authenticate and > post-authenticate sections by > specifying the module name and instance name. For example: > > authorize{ > ..... > ..... > ldap ldap1 > ldap ldap2 > ..... > ..... > }

1 0

Re: No communication between FreeRadius and Chilli
by sean 20 Jul '05

20 Jul '05

Hi, I have Chilli configured to run on Linksys WRT54G AP. I can access the Radius server at radius.chillispot.org with no problems. I have configured FreeRadius to run on a server also running Apache and MySQL.The FreeRadius installation compiled and runs with no errors and Radtest works fine, allowing me to authenticate users. The problem is that Chilli can't communicate with my Radius server. Ethereal tells me that the destination is unreachable when replying to the Chilli box. This is part of the Ethereal output:- No. Time Source Destination Protocol Info 540 142.622909 192.168.1.6 82.141.232.132 RADIUS Access Request(1) (id=0, l=195) Frame 540 (237 bytes on wire, 237 bytes captured) Ethernet II, Src: 00:12:17:b7:a1:71, Dst: 00:00:c5:b1:0c:0c Internet Protocol, Src Addr: 192.168.1.6 (192.168.1.6), Dst Addr: 82.141.232.132 (82.141.232.132) User Datagram Protocol, Src Port: 2051 (2051), Dst Port: radius (1812) Radius Protocol No. Time Source Destination Protocol Info 541 142.623743 82.141.232.132 192.168.1.6 ICMP Destination unreachable Frame 541 (70 bytes on wire, 70 bytes captured) Ethernet II, Src: 00:00:c5:b1:0c:0c, Dst: 00:12:17:b7:a1:71 Internet Protocol, Src Addr: 82.141.232.132 (82.141.232.132), Dst Addr: 192.168.1.6 (192.168.1.6) Internet Control Message Protocol The Radius server and the Chilli AP get their IP's from DHCP on a Caymen DSL modem with static IP. The Modem is 82.141.232.132. The Radius server is 192.168.1.2 and the Chilli AP is 192.168.1.6, its internal address is 192.168.10.1. I'd really appreciate any suggestions anyone might have to help me resolve this. Regards Sean

2 1

attribute checking with AD
by Stefan Winter 20 Jul '05

20 Jul '05

Hello, after having almost successfully set-up authorize {} and authenticate {} section to do AD clear-text logins, only a small problem remains: We want to allow access for only a subset of the AD users. These users are distinguished from the others by the following criterion (you don't want to know why): if the AD attribute "Department" begins with the character "7", the user is allowed access, otherwise not. So far I mapped "Department" as a checkItem to one of our Vendor-Specific attributes in ldap.attrmap and _wanted_ to do regexp matching in the users file for that Vendor-Specific attribute after authorize->ldap passed through. DEFAULT Our-Vendor-Specific-Thing =~ [^7].*, Auth-Type := Reject This doesn't work (sorry, no debug output available, not my machine). Now I wonder: is there another possibility to do regexp matching against items that are retrieved from AD or LDAP? Unfortunately just checking the attributes delivered by the NAS is not enough. Greetings, Stefan Winter -- Stefan WINTER Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingénieur de recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu tél.: +352 424409-1 http://www.restena.lu fax: +352 422473

2 1

Multiple Appearing of the same Attribute & variables
by Metz, Frederic 20 Jul '05

20 Jul '05

Hi, I have a Radius Packet with one Vendor Specific Attribute coming twice in that packet. Since I am writing the information into Mysql database, I wanted to know how to address the first and the second ? I saw that %{Attribute[index]} should work, but it doesn't. The entry (seen in Debug mode) is empty. I am using Radius 1.0.4. What's wrong with my conf ? Frederic

2 1

Freeradius restart snmp
by Reza Toghraee 20 Jul '05

20 Jul '05

Hello Is there any way to restart freeradius 1.0.4 using SNMP ? Regards Reza

2 1