- Freeradius-Users - lists.freeradius.org

Reid Canavan/FortErie is on Vacation
by Reid Canavan 20 Jun '05

20 Jun '05

I will be out of the office starting Mon 06/20/2005 and will not return until Mon 06/27/2005. I will respond to your message when I return.

1 0

Re: Problem with LDAP group searches
by Graham, Robert 20 Jun '05

20 Jun '05

>> I'm trying to get Freeradius configured to authenicate our vpn users >> from a Cisco 3005 concentrator against Active Directory using the ldap >> module. When I authenicated a vpn user on a per user basis - it works >> fine. However, I want authenicate not only the user, but also verify >> that the user is a member of a "group" in active directory. I was >> following Dustin Doris's suggestion on Per-Client "group" matching and >> configured the huntgroups, users, and radiusd.conf accordingly. >> However, it seems to fail doing a group lookup. I don't know if it >> matters, but the user object and group object in Active Directory are in >> different containers (OU's). Any help would be appreciated. >> > >You need to specify where the groups are located in AD. But isn't this the purpose of setting the basedn in radiusd.conf? Or is there another seeting that I need to configure for ldap group searches? > >> rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=mem >> users,dc=mem-ins,dc=com' radius_xlat: >> '(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM >> Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM >> Users,DC=mem-ins,DC=com)))' rlm_ldap: ldap_get_conn: Checking Id: 0 >> rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=mem >> users,dc=mem-ins,dc=com, with filter >> (&(cn=MEMVPNFlex)(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM >> Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM >> Users,DC=mem-ins,DC=com)))) rlm_ldap: object not found or got ambiguous >> search result rlm_ldap: ldap_release_conn: Release Id: 0 >> rlm_ldap::ldap_groupcmp: Group MEMVPNFlex not found or user is not a >> member. >> users: Matched DEFAULT at 166 > >The user was not found in that group, based on the lookup above. The user is a member of the MEMVPNFlex group in AD > >> groupname_attribute = cn >> groupmembership_filter = >> "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn})) >> (&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" >> groupmembership_attribute = radiusGroupName > >You have to modify these so you can find the group memberships. For >example, how would you perform an ldapsearch from the command line to >find group memberships? Take that info and put it there. Make sure the >user you are binding with has access to read those groups. > >Hope that is a little helpful. > > >

2 1

(no subject)
by Graham, Robert 20 Jun '05

20 Jun '05

Dustin, Thanks for the response. I was kind of wondering if the location of the group in Active Directory was an issue. But that brings up another question. Doesn't a ldapsearch use the basedn as a starting point? If instance, I have the basedn set as follows in radiusd.conf: basedn = "ou=mem users,dc=mem-ins,dc=com" And the structure of our AD is: MEM-INS.COM | | |_MEM Users | | | | And why is it that it can find the user "rgraham" but not the group. > I'm trying to get Freeradius configured to authenicate our vpn users > from a Cisco 3005 concentrator against Active Directory using the ldap > module. When I authenicated a vpn user on a per user basis - it works > fine. However, I want authenicate not only the user, but also verify > that the user is a member of a "group" in active directory. I was > following Dustin Doris's suggestion on Per-Client "group" matching and > configured the huntgroups, users, and radiusd.conf accordingly. > However, it seems to fail doing a group lookup. I don't know if it > matters, but the user object and group object in Active Directory are in > different containers (OU's). Any help would be appreciated. > You need to specify where the groups are located in AD. > rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=mem > users,dc=mem-ins,dc=com' radius_xlat: > '(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM > Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM > Users,DC=mem-ins,DC=com)))' rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=mem > users,dc=mem-ins,dc=com, with filter > (&(cn=MEMVPNFlex)(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM > Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM > Users,DC=mem-ins,DC=com)))) rlm_ldap: object not found or got ambiguous > search result rlm_ldap: ldap_release_conn: Release Id: 0 > rlm_ldap::ldap_groupcmp: Group MEMVPNFlex not found or user is not a > member. > users: Matched DEFAULT at 166 The user was not found in that group, based on the lookup above. > groupname_attribute = cn > groupmembership_filter = > "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn})) > (&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > groupmembership_attribute = radiusGroupName You have to modify these so you can find the group memberships. For example, how would you perform an ldapsearch from the command line to find group memberships? Take that info and put it there. Make sure the user you are binding with has access to read those groups. Hope that is a little helpful.

2 1

dialup_admin $nas_list empty
by Aaron Paetznick 20 Jun '05

20 Jun '05

I originally sent this to the list on June 12th. My original email is below. I'd write the missing code myself, but I want to make sure that somebody else isn't working on the same problem. By the way, is there somebody I should be working with directly on issues relating to dialup_admin? Thanks. ----- I'm using FreeRADIUS v1.0.2 and dialup_admin v1.70. FreeRADIUS and nas_admin.php3 in dialup_admin are using the nas table in the database correctly, but pages like user_finger.php3 user_stats.php3, stats.php3, and failed_logins.php3 are not detecting any NASes in the database. The problem seems to be caused by the $nas_list variable in each of those files being empty. I looked into it a little, and I can't see where $nas_list is even being created, aside from nas_admin.php3. I noticed that the $nas_list variable is a very new addition. I think some code needs to be added to generate $nas_list at the top of each of these files. Thanks. --Aaron

1 0

username+password wi-fi authentication with freeradius
by Milver Nisay 19 Jun '05

19 Jun '05

nice to be back again with the list. what are some pros and cons of adding user-name and password attribute together with authentication type eap/tls attributes? would appreciate some feedbacks. what i would like to achieve is for wi-fi enabled laptop to get a pop-up screen authentication, asking for username and password (besides from certificates) after getting a dynamic IP from router or radius . this process can enable us to sell the service inside an internet cafe or coffee shop, any links that can get me started and get on with the right track besides from the dead link from Mr. McKay???

2 2

Re: use_tunneled_reply
by ragan_davis＠colstate.edu 19 Jun '05

19 Jun '05

Ahh, I see. Based on the syntax you used it looks like I'd do this using local users file. However, I'm using edirectory for the user db. I have seen in the debug output where radius is checking for any reply items in the directory. Maybe I could use radiusReplyItem as an attribute in edir with a value "User-Name = ${User-Name}"? thanks, mack ----- Original Message ----- From: Alan DeKok <aland(a)ox.org> Date: Saturday, June 18, 2005 4:21 pm Subject: Re: use_tunneled_reply > -ragan_davis(a)colstate.edu wrote: > > > Did you set "User-Name = novelluser" in the *reply* for the > tunneled> > session? > > > > Hmmmm...I did not explicitly do this. How to? > > Set it as a reply attribute? > > user blah-blah = blah > User-Name = `%{User-Name}` > > > > You can verify that, independent of EAP, but using "radtest" with > > > the name & password of the tunneled user. > > > > I'm testing this now, but don't see the same "Access-Accept" > message in > > the debug output. Guess I'm still missing something. > > You will see the INNER TUNNEL Access-Accept. The reply attributes > in that Access accept are the ones which will be copied to the outer > tunnel, when TTLS is used. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Re: use_tunneled_reply
by Stefan.Neis＠t-online.de 18 Jun '05

18 Jun '05

Hi, > > You can verify that, independent of EAP, but using "radtest" with > > the name & password of the tunneled user. > > I'm testing this now, but don't see the same "Access-Accept" message in > the debug output. Guess I'm still missing something. Keep in mind that contrary to the "normal" RADIUS protocols where you just send a request and get an answer, EAP protocols are rather involved beasts, exchanging several packets between client and server before you get the final answer. Regards, Stefan

1 0

Re: use_tunneled_reply
by ragan_davis＠colstate.edu 18 Jun '05

18 Jun '05

----- Original Message ----- From: Alan DeKok <aland(a)ox.org> Date: Saturday, June 18, 2005 11:46 am Subject: Re: use_tunneled_reply > ragan_davis(a)colstate.edu wrote: > > This leads a dunce like me to believe that radius will send a > reply > > back to AP/NAS that has User-Name equaling "novelluser", rather > > than "anonymous". > > Did you set "User-Name = novelluser" in the *reply* for the tunneled > session? Hmmmm...I did not explicitly do this. How to? > > You can verify that, independent of EAP, but using "radtest" with > the name & password of the tunneled user. I'm testing this now, but don't see the same "Access-Accept" message in the debug output. Guess I'm still missing something. > > > I looked in the debug output (radiusd -A -X, right?). I think > this is > > what I am supposed to look for: > > Look at the REST of the debug output. It tells you what the reply > is in the tunnel, and what it's copying back to the outer session. > > Please, when you're reading the debug log, do MORE than just look at > the last few lines. Will do. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

FreeRadius & BSDi 4.2
by Edward Rempala 18 Jun '05

18 Jun '05

I have compiled FR on BSDi and got it working. But I seem to be having a strange problem. Once Auth. users can't go anywhere. They get a IP# and a gateway addy. (Our Modem Racks gives that out - USR Total Control). When you try to go to a webpage 99% of the time it just times out. So we turn off FR and turn on the old radius server, and everything is fine again. Has anyone seen something like this before? Edward Rempala WorldNet Access

2 1

warning "configure: error: no acceptable cc found in $PATH".
by freeradius 18 Jun '05

18 Jun '05

Hi all: My OS is fedora 3. I download <ftp://ftp.freeradius.org/pub/radius/freeradius-1.0.4.tar.gz> freeradius-1.0.4.tar.gz. After tar -zxvf it, I do # ./configure first. But the system warning "configure: error: no acceptable cc found in $PATH". Any idea why this could happen? Thanks for any idea. Tommy

2 1