- Freeradius-Users - lists.freeradius.org

RE: FreeRADIUS v1.0.4, rlm_ldap module, and redundancy
by Zawacki Jason D Ctr AFRL/IFOS 14 Jul '05

14 Jul '05

Thanks Dusty. I just implemented your suggestions and it's working very well. Once again I am pleasantly surprised by the flexibility of FreeRADIUS. Great job! Jason > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Dusty Doris > Sent: Wednesday, July 13, 2005 4:53 PM > To: FreeRadius users mailing list > Subject: RE: FreeRADIUS v1.0.4, rlm_ldap module, and redundancy > > > > > > > You're using the LDAP-Group attribute, which is set to use svr1, > > > which is down. There's currently no fail-over for the LDAP-Group > > > attribute. > > > > > > > I dig, that's kind of what I thought (even if I didn't word > it correctly). > > Thanks for your help! > > > > You can simulate redundancy for the Ldap-Group attribute, by > doing this. > > Instantiate your ldap modules in radiusd.conf. > > instantiate { > srv1 > srv2 > srv3 > } > > In users file, add multiple lines of the same ldap-group > lookup, for each > srv. > > For example, say you must have ldap-group of dial if coming > from a dial > huntgroup. > > DEFAULT Huntgroup-Name == dial, srv1-Ldap-Group == dial > > DEFAULT Huntgroup-Name == dial, srv2-Ldap-Group == dial > > DEFAULT Huntgroup-Name == dial, srv3-Ldap-Group == dial > > What will happen is if the huntgroup matches, then the server > will lookup > on the srv1 instance if ldap-group = dial. If so, it matches and the > users file ends. If not, it continues down the file, where > it will then > try srv2. If that fails, it continues to srv3. > > So, if one and two are down, then this will require 3 > different lookups to > finally get to srv3, but it will provide you with some type > of redundancy. > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

FreeRadius and PIX 520 accounting
by lmarante＠aerolineas.com.ar 14 Jul '05

14 Jul '05

Hello everyone This subject was once asked but I've never seen a clear answer about it. I'm using FreeRadius 0.9.3 to authenticate our VPN users connecting through our PIX 520 with OS version 6.3. I'd like to enable accounting also so I can restrict only one connection per user simultaneously. Last I checked, there was some kind of incompatibility between the packets the firewall is sending and what FreeRadius is expecting to recieve. I wanted to know if this is somehow "patched" in 1.0.4 or if it will still not work. Also, if it's not fixed in freeradius, anyone knows if upgrading to the OS version 7 will fix it ? Thanks in advance. Lior Marantenboim.

2 1

eap id bug
by DALE REAMER 14 Jul '05

14 Jul '05

When using freeradius with wpa_supplicant I have noticed freeradius does not bump the EAP id when sending back the Access-Accept packet. wpa_supplicant notices this and has a work around. Will the WPA drop this packet (it is important because it has the keys in the attributes). Has anyone reported this bug? The reason I ask is because after receiving the accept packet, wpa_supplicant goes into AUTHENTICATED state but cannot connect to the network, or associate. Any ideas? the wpa_supplicant (last part) trace: WPA: Sending EAPOL-Key 2/4 RX EAPOL from 00:0f:b5:7a:17:bc EAPOL: Ignoring WPA EAPOL-Key frame in EAPOL state machines IEEE 802.1X RX: version=1 type=3 length=119 EAPOL-Key type=254 WPA: RX message 3 of 4-Way Handshake from 00:0f:b5:7a:17:bc (ver=1) WPA: IE KeyData - hexdump(len=24): dd 16 00 50 f2 01 01 00 00 50 f2 02 01 00 00 50 f2 02 01 00 00 50 f2 01 WPA: No WPA/RSN IE for this AP known. Trying to get from scan results WPA: Found the current AP from updated scan results WPA: Sending EAPOL-Key 4/4 WPA: Installing PTK to the driver. WPA: RSC - hexdump(len=6): 00 00 00 00 00 00 RX EAPOL from 00:0f:b5:7a:17:bc EAPOL: Ignoring WPA EAPOL-Key frame in EAPOL state machines IEEE 802.1X RX: version=1 type=3 length=127 EAPOL-Key type=254 WPA: RX message 1 of Group Key Handshake from 00:0f:b5:7a:17:bc (ver=1) WPA: Group Key - hexdump(len=32): [REMOVED] WPA: Installing GTK to the driver (keyidx=1 tx=0). WPA: RSC - hexdump(len=6): 00 00 00 00 00 00 WPA: Sending EAPOL-Key 2/2 WPA: Key negotiation completed with 00:0f:b5:7a:17:bc [PTK=TKIP GTK=TKIP] Cancelling authentication timeout Removed BSSID 00:0f:b5:7a:17:bc from blacklist EAPOL: External notification - portValid=1 EAPOL: SUPP_PAE entering state AUTHENTICATED Signal 2 received - terminating ndis_get_oid: oid=0xd010101 len (6) failed ndis_set_oid: oid=0xd010114 len (4) failed ndis_get_oid: oid=0xd010101 len (6) failed ndis_set_oid: oid=0xd010114 len (4) failed ndis_get_oid: oid=0xd010101 len (6) failed ndis_set_oid: oid=0xd010114 len (4) failed ndis_get_oid: oid=0xd010101 len (6) failed ndis_set_oid: oid=0xd010114 len (4) failed EAPOL: External notification - portEnabled=0 EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED EAPOL: External notification - portValid=0 wpa_driver_ndis_set_wpa: enabled=0 No keys have been configured - skip key clearing rmdir[ctrl_interface]: No such file or directory EAP: deinitialize previously used EAP method (25, PEAP) at EAP deinit the freeradius (last part trace): ending Access-Challenge of id 12 to 192.168.0.229:1075 EAP-Message = 0x010c00501900170301002028f83aa4e802c2965c29685e7521a11ea189ad707d72f340478950afc820a3dd1703010020c159819f4919952b824a4c2e7d71d92338cfeb7e35842ecca2590d0ec5e9a91f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed25ce47ac6c8028e663a2f6f53414e7 rad_recv: Access-Request packet from host 192.168.0.229:1075, id=13, length=251 Message-Authenticator = 0x508b7cdf35912a2b07a9f6f461200076 Service-Type = Framed-User User-Name = "dreamer" Framed-MTU = 1488 State = 0xed25ce47ac6c8028e663a2f6f53414e7 Called-Station-Id = "000FB57A17BC:NETGEAR" Calling-Station-Id = "00070EB38E2D" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020c005019001703010020d636529b1ced029a7bc635638d3d21e9e6eeff64ba0e2bbdae2f362655442a601703010020653e43e16142b6e7535d53a7306aad5bc40cf157a9fa7f38c067a870a649c184 NAS-IP-Address = 192.168.0.229 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sending Access-Accept of id 13 to 192.168.0.229:1075 MS-MPPE-Recv-Key = 0x2ae009c01dc4c8af6bbf63b3a03eae0bf36d5f74277cd979e0aab0c7c0208b00 MS-MPPE-Send-Key = 0xed2e0e7f8242205404cecb7894a82d742f43a225b2f1ddae8231128e413f00ec EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "dreamer"

2 2

Re: MySQL Connection Failure
by Marcin Jessa 14 Jul '05

14 Jul '05

On Mon, 11 Jul 2005 17:18:00 -0500 "Thomas Tinsley" <ttinsley(a)everyones-wireless.com> wrote: > Marcin, > > > >> Hi my name is Tom and I am installing FreeRadius for the first time. > >> > >> Specifications: > >> OS: Fedora Core 4 > >> Linux Kernel 2.6.11smp > >> Freeradius version : 1.0.2 > > >1.0.2 has security holes. Use 1.0.4 > > Update complete. Problem still present. > > >> MySQL version : 4.1.11 > >> > >> DEBUG Info: > >> > >> Mon Jul 11 14:05:01 2005 : Error: rlm_sql (sql): Failed to connect DB > >> handle > >> #4 > >> Mon Jul 11 14:05:01 2005 : Info: rlm_sql (sql): There are no DB > >> handles to use! skipped 5, tried to connect 1 Mon Jul 11 14:05:10 2005 > >> : Info: rlm_sql (sql): Trying to (re)connect unconnected handle 4.. > >> Mon Jul 11 14:05:10 2005 : Info: rlm_sql_mysql: Starting connect to > >> MySQL server for #4 Mon Jul 11 14:05:10 2005 : Error: rlm_sql_mysql: > >> Couldn't connect socket to MySQL server root@localhost:radius Mon Jul > >> 11 14:05:10 2005 : Error: rlm_sql_mysql: Mysql error 'Can't connect to > >> local MySQL server through socket '/var/lib/mysql/mysql.sock' (13)' > > >Your MySQL is not running or you have wrong username and pass or no > database to connect to or wrong database name. > > MySQL is running. Username, Password, and Database have been confirmed > using Dialup-Admin to connect and administrate data records. > > >> Question? > >> > >> Does anyone have a method to trace the connection attempt? MySQL is > > >> not kicking out any log info that would help. > > >Read above. > I have been through the basic troubleshooting steps. Downloaded the newest > version (./configure, make, makeinstall) and still get an error. The error > points to a specific socket that does exist and is part of the MySQL > configuration. Ok, try to use this config: http://www.yazzy.org/configs/linux/my.cnf It's a standard config for gentoo but I am sure you can addapt it to RedHat. Pay attention to the socket variable. > >>I have confirmed the MySQL > >> server is running, and can connect to databases using PHP & PERL. > > >type mysql -u root -p > >You will be prompted to type in your pass if mysql is running ok. > > I do not have trouble using the mysql client to connect to the server and > select the radius database. I can even execute select statements against > tables to view the test data. > > Is there any chance that freeradius is not compatible with my current > version of MySQL? No. I run it on MySQL 5.x on FreeBSD. > > MyADMINPHP and Dialup-Admin are installed, configured, and tested > > successfully for the MySQL server. I just need to get Radius to do the > > same. Radius.conf & sql.conf are modified accordingly. > > > > Any help would be appreciated. Thank you. > > Cheers, > Marcin Jessa >

2 1

RE: sql counter clarification and issues
by Ross Tsolakidis 13 Jul '05

13 Jul '05

Thanks for clearing that up Marcin :) Does anyone else have any other suggestions on how to extract daily totals ? Regards, -- Ross -----Original Message----- From: Marcin Jessa [mailto:lists@yazzy.org] Sent: Wednesday, 13 July 2005 4:38 PM To: Ross Tsolakidis Cc: freeradius-users(a)lists.freeradius.org Subject: Re: sql counter clarification and issues On Wed, 13 Jul 2005 12:15:45 +1000 "Ross Tsolakidis" <Ross.Tsolakidis(a)day3.com.au> wrote: > > Thanks for responding Marcin, just to double check: > > > I added those details into radgroupcheck: > mysql> select * from radgroupcheck; > +----+-----------+---------------------+----+-------+ > | id | GroupName | Attribute | op | Value | > +----+-----------+---------------------+----+-------+ > | 1 | 24Hours | Max-Daily-Session | := | 86400 | > | 2 | 24Hours | Max-Weekly-Session | := | 86400 | > | 3 | 24Hours | Max-Monthly-Session | := | 86400 | > | 4 | 24Hours | Max-All-Session | := | 86400 | > | 5 | 10Mins | Max-Daily-Session | := | 600 | > | 6 | 10Mins | Max-Weekly-Session | := | 600 | > | 7 | 10Mins | Max-Monthly-Session | := | 600 | > | 8 | 10Mins | Max-All-Session | := | 600 | > +----+-----------+---------------------+----+-------+ > 8 rows in set (0.00 sec) > > mysql> > > == > > My sqlcounter.conf is exactly the same. > > I have added this: > $INCLUDE ${confdir}/sqlcounter.conf > Into the radiusd.conf > > == > > When I fire up radius in debug mode I get these messages for sqlcounter: > > Module: Loaded SQL Counter > sqlcounter: counter-name = "Daily-Session-Time" > sqlcounter: check-name = "Max-Daily-Session" > sqlcounter: key = "User-Name" > sqlcounter: sqlmod-inst = "sql" > sqlcounter: query = "SELECT SUM(AcctSessionTime - GREATEST((%b - > UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' > AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" > sqlcounter: reset = "daily" > rlm_sqlcounter: Counter attribute Daily-Session-Time is number 1671 > rlm_sqlcounter: Check attribute Max-Daily-Session is number 1672 > rlm_sqlcounter: Current Time: 1121220718 [2005-07-13 12:11:58], Next > reset 1121263200 [2005-07-14 00:00:00] > rlm_sqlcounter: Current Time: 1121220718 [2005-07-13 12:11:58], Prev > reset 1121176800 [2005-07-13 00:00:00] > Module: Instantiated sqlcounter (dailycounter) > > == > > I read the experimental.conf but I can't seem to understand where the > counters are reset, which table ? > Could you give me an example of the table so I can see what it should > look like ? (daily totals) I don't really have any need to disconnect > people after a certain period of time, just need daily and monthly > totals. Then sqlcounter is not for you. If you need stats, those are stored in radacct table and can be sorted with SQL queries + maybe some code. Take a look at dialupadmin, how it's done there. > Thanks again, greatly appreciated ! :) > > > Regards, > -- > Ross > > -----Original Message----- > From: Marcin Jessa [mailto:lists@yazzy.org] > Sent: Tuesday, 12 July 2005 6:03 PM > To: FreeRadius users mailing list > Cc: Ross Tsolakidis > Subject: Re: sql counter clarification and issues > > On Tue, 12 Jul 2005 15:21:52 +1000 > "Ross Tsolakidis" <Ross.Tsolakidis(a)day3.com.au> wrote: > > > Ok, now I'm really confused :( > > > > Can someone please clarify exactly what does the sqlcounter module > > do > ? > > Basically I need to calculate the data on a daily basis for each user. > > sqlcounter works fine. > Your radgroupcheck or radcheck needs to have the same attributes you > have in your sqlcounter config. > Check out mine: > http://www.yazzy.org/configs/linux/freeradius/sqlcounter.conf > > mysql> select * from radgroupcheck; > +----+-----------+---------------------+----+-------+ > | id | GroupName | Attribute | op | Value | > +----+-----------+---------------------+----+-------+ > | 1 | 24hours | Max-Daily-Session | := | 86400 | > | 2 | 24hours | Max-Weekly-Session | := | 86400 | > | 3 | 24hours | Max-Monthly-Session | := | 86400 | > | 4 | 24hours | Max-All-Session | := | 86400 | > | 5 | 10mins | Max-Daily-Session | := | 600 | > | 6 | 10mins | Max-Weekly-Session | := | 600 | > | 7 | 10mins | Max-Monthly-Session | := | 600 | > | 8 | 10mins | Max-All-Session | := | 600 | > +----+-----------+---------------------+----+-------+ > 8 rows in set (0.00 sec) > > Read experimental.conf, it describes the module. > It count's user's online time stored in the raddacct table and based > on that info allows user to log in if her allowed session time is not > exceeded. > This can be done on daily, weekly, monthly or total basis. > > > Thanks for your patience :) > > Read former postings to the list describing the behaviour and > functionality of the module. > People tend to be more patient if they know you did some work on your > own. > > Cheers, > Marcin Jessa > > > > > > -----Original Message----- > > From: freeradius-users-bounces(a)lists.freeradius.org > > [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of > > Ross Tsolakidis > > Sent: Tuesday, 5 July 2005 2:14 PM > > To: FreeRadius users mailing list > > Subject: RE: sql counter clarification and issues > > > > Yes the server is receiving accounting packets. > > The SQL rows are updating every 5 mins, (I have the NAS set to send > > accounting packets every 5 mins). > > > > I run it in debug mode, I see: > > Module: Loaded SQL Counter > > sqlcounter: counter-name = "Daily-Session-Time" > > sqlcounter: check-name = "Max-Daily-Session" > > sqlcounter: key = "User-Name" > > sqlcounter: sqlmod-inst = "sqlcca3" > > sqlcounter: query = "SELECT SUM(AcctSessionTime - GREATEST((%b - > > UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE > UserName='%{%k}' > > AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" > > sqlcounter: reset = "1h" > > rlm_sqlcounter: Counter attribute Daily-Session-Time is number 1671 > > rlm_sqlcounter: Check attribute Max-Daily-Session is number 1672 > > rlm_sqlcounter: num=1, last=h > > rlm_sqlcounter: Current Time: 1120532709 [2005-07-05 13:05:09], Next > > reset 1120536000 [2005-07-05 14:00:00] > > rlm_sqlcounter: num=1, last=h > > rlm_sqlcounter: Current Time: 1120532709 [2005-07-05 13:05:09], Prev > > reset 1120532400 [2005-07-05 13:00:00] > > Module: Instantiated sqlcounter (dailycounter) > > > > But no reset. > > > > Does anyone have this working, if so, what am I looking for, what am > > I > > > supposed to see ? > > > > Thanks :) > > > > Regards, > > -- > > Ross > > > > -----Original Message----- > > From: freeradius-users-bounces(a)lists.freeradius.org > > [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of > > Alan DeKok > > Sent: Tuesday, 5 July 2005 2:05 AM > > To: FreeRadius users mailing list > > Subject: Re: sql counter clarification and issues > > > > "Ross Tsolakidis" <Ross.Tsolakidis(a)day3.com.au> wrote: > > > At midnight every night will it begin a new row in SQL ? > > > > I don't know, I've never used the module. > > > > > Because at the moment there are no new rows being created, no > > > counters > > > > > being reset. > > > > Is the server receiving accounting packets? > > > > Run it in debug mode with "reset=hour", and spend some time > > looking at what it's doing. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html

1 0

No SSL info available. Waiting for more SSL data with Red Hat 7.1
by Dick 13 Jul '05

13 Jul '05

Hi all, At home I've configured a perfectly working freeradius with PEAP/MSCHAPv2, I'd like to transfer it to my work to some really old red hat 7.1 boxes. First I configured and freeradius from source and installed in prefix /usr/local but it crashed on the old ssl, so I grabbed the latest openssl configured it and installed in /usr/local as well, recompiled freeradius with the appropiate ssl directories and it ran! I transferred the configuration from my server at home and converted the appropiate paths. I tried authenticating on but it failed, the only suspicious thing I could find is: rlm_eap_tls: No SSL info available. Waiting for more SSL data. After three of these attempts the supplicant (winxp sp2) seems to bail out, xsupplicant seems to give it some more tries. What am I missing? TIA Dick

2 8

RE: Aruba-Switch_NAS-Problem
by Guy Davies 13 Jul '05

13 Jul '05

Ready to process requests. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown ! client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.1.2.254:32773, id=8, length=113 Ignoring request from unknown client 10.1.2.254:32773 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. [GD] Looks to me like you didn't configure 10.1.2.254 as a valid client of the RADIUS server. Look in clients.conf. Rgds, Guy This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

2 1

RE: FreeRADIUS v1.0.4, rlm_ldap module, and redundancy
by Zawacki Jason D Ctr AFRL/IFOS 13 Jul '05

13 Jul '05

> -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Alan DeKok > Sent: Wednesday, July 13, 2005 2:20 PM > To: FreeRadius users mailing list > Subject: Re: FreeRADIUS v1.0.4, rlm_ldap module, and redundancy > > Zawacki Jason D Ctr AFRL/IFOS <Jason.Zawacki.ctr(a)rl.af.mil> wrote: > > I've been trying to get this to work, but it appears, to > me, that the > > redundancy is only used for part of the auth process. > > What "auth" process? Authorize or authenticate? > > > When looking up the > > DN for the user who is trying to authenticate, redundancy works. > > During the "authorize" stage. > > > After that > > though, it appears that only the first module in the > redundant list is > > tried. > > Which redundant list? You listed two. > > > authenticate { > > Auth-Type LDAP { > > redundant { # wasn't sure if this was necessary > > svr1 > > If you want redundancy for authentication, you can list that. > > > I test by simulating a failure of svr1 using: > > Ok. The debug log shows: > > > modcall[authorize]: module "svr1" returns fail for request 0 > ... > > modcall[authorize]: module "svr3" returns fail for request 0 > ... > > modcall[authorize]: module "svr2" returns ok for request 0 > > So the redundancy in the "authorize" section works. > > > rlm_ldap::ldap_groupcmp: Search returned error > > You're using the LDAP-Group attribute, which is set to use svr1, > which is down. There's currently no fail-over for the LDAP-Group > attribute. > I dig, that's kind of what I thought (even if I didn't word it correctly). Thanks for your help! Jason > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

LDAP authentication
by Florin Andrei 13 Jul '05

13 Jul '05

Description of situation first, freeradius question at the end: I am doing plain user/pass authentication against an LDAP server using ldapsearch: $ ldapsearch -H ldap://XXXXXXXX -b 'o=XXXXXXXXXXXXX,c=us' -D 'uid=XXXXX,o=XXXXXXXXXXXXXX,c=us' -x -W uid=XXXXX Enter LDAP Password: [snip] result: 0 Success [snip] The packet trace looks like this: #################################################### No. Time Source Destination Protocol Info 4 0.001468 somecomputer.somedomain.com someserver.somedomain.com LDAP MsgId=1 Bind Request, DN=uid=XXXXX,o=YYYYYYYYYY,c=us Frame 4 (123 bytes on wire, 123 bytes captured) Internet Protocol, Src Addr: somecomputer.somedomain.com (XXX.YYY.ZZZ.38), Dst Addr: someserver.somedomain.com (AAA.BBB.CCC.18) Lightweight Directory Access Protocol LDAP Message, Bind Request Message Id: 1 Message Type: Bind Request (0x00) Message Length: 50 Response In: 6 Version: 3 DN: uid=XXXXX,o=YYYYYYYYYY,c=us Auth Type: Simple (0x00) Password: 1234567890 No. Time Source Destination Protocol Info 6 0.067801 someserver.somedomain.com somecomputer.somedomain.com LDAP MsgId=1 Bind Result Frame 6 (96 bytes on wire, 96 bytes captured) Internet Protocol, Src Addr: someserver.somedomain.com (AAA.BBB.CCC.18), Dst Addr: somecomputer.somedomain.com (XXX.YYY.ZZZ.38) Lightweight Directory Access Protocol LDAP Message, Bind Result Message Id: 1 Message Type: Bind Result (0x01) Message Length: 23 Response To: 4 Time: 0.066333000 seconds Result Code: success (0x00) Matched DN: (null) Error Message: +0gg4KMBV5FZkjyC #################################################### I don't really care about any information that's returned, I only want to authenticate against LDAP. Can I configure freeradius to do the same? I tried a few configurations in radiusd.conf but everything seems to trigger a behaviour that's different from ldapsearch. LDAP is currently used to authenticate various things, and I'd like to point a Radius server to it to use the same user passwords. -- Florin Andrei http://florin.myip.org/

3 3

FreeRADIUS v1.0.4, rlm_ldap module, and redundancy
by Zawacki Jason D Ctr AFRL/IFOS 13 Jul '05

13 Jul '05

Hey folks, Has anyone gotten redundancy working when using LDAP to perform authentication and authorization? I've been trying to get this to work, but it appears, to me, that the redundancy is only used for part of the auth process. When looking up the DN for the user who is trying to authenticate, redundancy works. After that though, it appears that only the first module in the redundant list is tried. Then it ultimately fails. The LDAP servers are 3 Windows DCs. authorize { redundant { svr1 svr3 svr2 notfound = return } files } authenticate { Auth-Type LDAP { redundant { # wasn't sure if this was necessary svr1 svr3 svr2 } } } I test by simulating a failure of svr1 using: route add -host <svr1 IP> 127.0.0.1 -blackhole Svr3 happens to be down for maintenance at the moment Thanks for any help, Jason Log: rad_recv: Access-Request packet from host x.x.x.x:3104, id=14, length=54 User-Name = "username" User-Password = "XXXXX" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall: entering group redundant for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for usersname radius_xlat: 'XXXXXXXX' radius_xlat: 'XXXXXXXX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to <svr1 IP>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /path/to/cacert.pem rlm_ldap: bind as XXXXXXXX to XXXXXXXXXXXX rlm_ldap: XXXXXXXXXX bind to XXXXXXXXXXX failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "svr1" returns fail for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: 'XXXXXXXXXXXXXXXXXXX' radius_xlat: 'XXXXXXXXXXXXXXXXXXX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to <svr3 IP>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /path/to/cacert.pem rlm_ldap: bind as XXXXXXXXXX to XXXXXXXXXXXXXX rlm_ldap: XXXXXXXXXXXx bind to XXXXXXXXXXXXXXX failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "svr3" returns fail for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: 'XXXXXXXXXXXXXXXxxxxxx' radius_xlat: 'XXXXXXXXXXXXXXXXXXXXX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to <svr2 IP>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /path/to/cacert.pem rlm_ldap: bind as XXXXXXXXX to XXXXXXXXXXXXXXXX rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in XXXXXXXXXXXXXXXXXX, with filter (&(XXXXXXXX)(XXXXXXXXXX)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user username authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "svr2" returns ok for request 0 modcall: group redundant returns ok for request 0 radius_xlat: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' radius_xlat: '(&(objectClass=group)(member=XXXXXXXXXXXXXXXXXXXXXXXXXXXX))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to <svr1 IP>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /path/to/cacert.pem rlm_ldap: bind as XXXXXXXXXXXXXXXXXXXXXX to XXXXXXXXXXXXXXXXXXXXXXXx rlm_ldap: XXXXXXXXXXXXXXXXXXXX bind to XXXXXXXXXXXXXXXXXXXXXXXX Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Search returned error radius_xlat: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXX' rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'XXXXXXXXXXXXXXXXXXXXXXXXX' radius_xlat: '(&(objectClass=group)(member=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXxx))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to <svr1 IP>, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /path/to/cacert.pem rlm_ldap: bind as XXXXXXXXXXXXXXXXXXXXX to XXXXXXXXXXXXXXXXXXXXXXXX rlm_ldap: XXXXXXXXXXXXXXXXXXXXXXXXXXXXX bind to XXXXXXXXXXXXXXXXXXXXXXXX failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Search returned error users: Matched entry DEFAULT at line 224 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [username] (from client client port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 14 to x.x.x.x:3104 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 14 with timestamp 42d548f0 Nothing to do. Sleeping until we see a request.

3 3