- Freeradius-Users - lists.freeradius.org

Restricting Access by Group Membership
by jp＠joshmp.com 20 Jul '05

20 Jul '05

Setup: FreeRADIUS 1.0.4 on FreeBSD 4.11 authenticating to eDirectory on Netware 6.5 server. Issue: I have read the FAQ section regaring limiting access to specific groups (http://freeradius.org/faq/#5.2) but I can't get it to work. For one, I am not entirely certain where to add the lines. I have tried using the users file, but this doesn't seem to work. Two, I am not sure that I am using the right syntax. Here is what I have tried: - adding the following lines to users file: ----snip----- DEFAULT Group == "cn=remoteusers,o=services", Auth-Type := Reject Reply-Message = "Your account has been disabled" DEFAULT Auth-Type = LDAP -----snip----- Here is the debug: -----snip----- episd44# /usr/local/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "10.254.8.25" ldap: port = 389 ldap: net_timeout = 20 ldap: timeout = 20 ldap: timelimit = 20 ldap: identity = "cn=raduser,o=services" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "secretrad" ldap: basedn = "o=services" ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = no rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x808b400 Module: Instantiated ldap (ldap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:2254, id=53, length=60 User-Name = "dcitest1" User-Password = "dcitest1" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'o=services' radius_xlat: '(cn=dcitest1)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.254.8.25:389, authentication 0 rlm_ldap: bind as cn=raduser,o=services/secretrad to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=services, with filter (cn=dcitest1) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=cn=dcitest1,ou=GW,o=Services))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn=dcitest1,ou=GW,o=Services)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=remoteusers,o=services, with filter (|(&(objectClass=GroupOfNames)(member=cn=dcitest1,ou=GW,o=Services))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn=dcitest1,ou=GW,o=Services))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group cn=remoteusers,o=services not found or user is not a member. users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "dcitest1" with password "dcitest1" rlm_ldap: user DN: cn=dcitest1,ou=GW,o=Services rlm_ldap: (re)connect to 10.254.8.25:389, authentication 1 rlm_ldap: bind as cn=dcitest1,ou=GW,o=Services/dcitest1 to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user dcitest1 authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 53 to 127.0.0.1:2254 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 53 with timestamp 42de3bed Nothing to do. Sleeping until we see a request. -----snip----- Thanks in advance, Josh

1 0

Re: Multiple Root Contexts
by jp＠joshmp.com 20 Jul '05

20 Jul '05

Great, that worked. Thanks. Quoting Mearl Danner <jmdanner(a)samford.edu>: > > Might try downloading this and reading. It's very helpful. > > http://www.novell.com/documentation/edir_radius/pdfdoc/radadmin/radadmin.pdf > > > If that's 3 separate "o=" at the root of the tree, the this from the above > document. > > > Example for Creating Multiple Instances of LDAP Module > > If you want multiple search bases, you can create multiple LDAP modules, by > using the following > syntax in the module section of the radiusd.conf. > > modules { > ........... > ........... > ldap ldap1 { > attribute = value > attribute = value > ............... > ............... > } > ldap ldap2 { > attribute = value > attribute = value > ............... > ............... > } > ldap ldap3 { > attribute = value > attribute = value > ............... > ............... > } > } > > You can use the configured modules in authorize, authenticate and > post-authenticate sections by > specifying the module name and instance name. For example: > > authorize{ > ..... > ..... > ldap ldap1 > ldap ldap2 > ..... > ..... > }

1 0

Re: No communication between FreeRadius and Chilli
by sean 20 Jul '05

20 Jul '05

Hi, I have Chilli configured to run on Linksys WRT54G AP. I can access the Radius server at radius.chillispot.org with no problems. I have configured FreeRadius to run on a server also running Apache and MySQL.The FreeRadius installation compiled and runs with no errors and Radtest works fine, allowing me to authenticate users. The problem is that Chilli can't communicate with my Radius server. Ethereal tells me that the destination is unreachable when replying to the Chilli box. This is part of the Ethereal output:- No. Time Source Destination Protocol Info 540 142.622909 192.168.1.6 82.141.232.132 RADIUS Access Request(1) (id=0, l=195) Frame 540 (237 bytes on wire, 237 bytes captured) Ethernet II, Src: 00:12:17:b7:a1:71, Dst: 00:00:c5:b1:0c:0c Internet Protocol, Src Addr: 192.168.1.6 (192.168.1.6), Dst Addr: 82.141.232.132 (82.141.232.132) User Datagram Protocol, Src Port: 2051 (2051), Dst Port: radius (1812) Radius Protocol No. Time Source Destination Protocol Info 541 142.623743 82.141.232.132 192.168.1.6 ICMP Destination unreachable Frame 541 (70 bytes on wire, 70 bytes captured) Ethernet II, Src: 00:00:c5:b1:0c:0c, Dst: 00:12:17:b7:a1:71 Internet Protocol, Src Addr: 82.141.232.132 (82.141.232.132), Dst Addr: 192.168.1.6 (192.168.1.6) Internet Control Message Protocol The Radius server and the Chilli AP get their IP's from DHCP on a Caymen DSL modem with static IP. The Modem is 82.141.232.132. The Radius server is 192.168.1.2 and the Chilli AP is 192.168.1.6, its internal address is 192.168.10.1. I'd really appreciate any suggestions anyone might have to help me resolve this. Regards Sean

2 1

attribute checking with AD
by Stefan Winter 20 Jul '05

20 Jul '05

Hello, after having almost successfully set-up authorize {} and authenticate {} section to do AD clear-text logins, only a small problem remains: We want to allow access for only a subset of the AD users. These users are distinguished from the others by the following criterion (you don't want to know why): if the AD attribute "Department" begins with the character "7", the user is allowed access, otherwise not. So far I mapped "Department" as a checkItem to one of our Vendor-Specific attributes in ldap.attrmap and _wanted_ to do regexp matching in the users file for that Vendor-Specific attribute after authorize->ldap passed through. DEFAULT Our-Vendor-Specific-Thing =~ [^7].*, Auth-Type := Reject This doesn't work (sorry, no debug output available, not my machine). Now I wonder: is there another possibility to do regexp matching against items that are retrieved from AD or LDAP? Unfortunately just checking the attributes delivered by the NAS is not enough. Greetings, Stefan Winter -- Stefan WINTER Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingénieur de recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu tél.: +352 424409-1 http://www.restena.lu fax: +352 422473

2 1

Multiple Appearing of the same Attribute & variables
by Metz, Frederic 20 Jul '05

20 Jul '05

Hi, I have a Radius Packet with one Vendor Specific Attribute coming twice in that packet. Since I am writing the information into Mysql database, I wanted to know how to address the first and the second ? I saw that %{Attribute[index]} should work, but it doesn't. The entry (seen in Debug mode) is empty. I am using Radius 1.0.4. What's wrong with my conf ? Frederic

2 1

Freeradius restart snmp
by Reza Toghraee 20 Jul '05

20 Jul '05

Hello Is there any way to restart freeradius 1.0.4 using SNMP ? Regards Reza

2 1

Multiple Root Contexts
by jp＠joshmp.com 20 Jul '05

20 Jul '05

Here is my setup: FreeBSD 4.11 server with FreeRADIUS 1.0.4 authorizing/authenticating users in an eDirectory Tree on a NetWare 6.5 server. My issue: There are three root contexts in the tree. If I set the basedn to context1, I can successfully authorize/authenticate users in context1, but I need FreeRADIUS to search all three contexts for users, and I can't figure out a way to add all three as a basedn at the same time. Thanks in advance, Josh

1 0

re: Searching Subcontexts in eDir
by jp＠joshmp.com 20 Jul '05

20 Jul '05

Sayantan, It was a password error. Thanks. Josh Quoting Sayantan Bhowmick <sbhowmick(a)novell.com>: > Hi, > If you are getting a reply with ldapsearch then you should be able > to authenticate as that user. One of the possible causes of the -669 > error is an invalid password. So check the password and make sure you > are able to log in as that user. > > -Sayantan

1 0

Nas-Port-Type quesiton
by Jandre Olivier 20 Jul '05

20 Jul '05

Hi guys, I use freeradius with poptop, just a question that im trying to figure out, My radius server sees the NAS-Port-Type as Async whenever a vpn connectio is made, is there anyway to change this to let radius see for example as a "vpn" nas-port-type .Must this port-type come from my vpn server? Thanks J -- Regards Jandre "Some people are alive only because it is illegal to kill them." _____________________________________________________

2 3

Raddb missing
by Sharina Ibrahim 20 Jul '05

20 Jul '05

Hi guys, I just started installing freeradius from the Debian package. I'm quiet confused because after I installed the package, I can't found raddb , does raddb exist only when we install Freeradius from source and not from the debian package? Hopefully you guys can help me as I am quiet new in Debian and Freeradius. Thank you. Sincerely, Sharina

2 1