- Freeradius-Users - lists.freeradius.org

Problem with LDAP group searches
by Graham, Robert 17 Jun '05

17 Jun '05

I'm trying to get Freeradius configured to authenicate our vpn users from a Cisco 3005 concentrator against Active Directory using the ldap module. When I authenicated a vpn user on a per user basis - it works fine. However, I want authenicate not only the user, but also verify that the user is a member of a "group" in active directory. I was following Dustin Doris's suggestion on Per-Client "group" matching and configured the huntgroups, users, and radiusd.conf accordingly. However, it seems to fail doing a group lookup. I don't know if it matters, but the user object and group object in Active Directory are in different containers (OU's). Any help would be appreciated. Thanks Robert Graham ########## Debug out: ########## rad_recv: Access-Request packet from host 172.16.1.91:1054, id=40, length=119 User-Name = "rgraham" User-Password = "XXXXXXXXXX" NAS-Port = 1036 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "192.168.15.1" Calling-Station-Id = "192.168.15.2" Tunnel-Client-Endpoint:0 = "192.168.15.2" NAS-IP-Address = 172.16.1.91 NAS-Port-Type = Virtual rad_lowerpair: User-Name now 'rgraham' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for rgraham radius_xlat: '(sAMAccountName=rgraham)' radius_xlat: 'ou=mem users,dc=mem-ins,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to mem_co_dept1.mem-ins.com:389, authentication 0 rlm_ldap: bind as cn=administrator,ou=admin,ou=mem users,dc=mem-ins,dc=com/XXXXXXXXXX to mem_co_dept1.mem-ins.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=mem users,dc=mem-ins,dc=com, with filter (sAMAccountName=rgraham) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user rgraham authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "rgraham", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=mem users,dc=mem-ins,dc=com' radius_xlat: '(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=mem users,dc=mem-ins,dc=com, with filter (&(cn=MEMVPNFlex)(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM Users,DC=mem-ins,DC=com)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group MEMVPNFlex not found or user is not a member. users: Matched DEFAULT at 166 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 40 to 172.16.1.91:1054 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 40 with timestamp 42b1c93a Nothing to do. Sleeping until we see a request. ############ Users file: ############ DEFAULT Huntgroup-Name == vpnusers, LDAP-Group == MEMVPNFlex, Auth-Type := LDAP OU = TestGroup Fall-Through = 1 ############ huntgroup ############ vpnusers NAS-IP-Address == 172.16.1.91 ####################### ldap section of radiusd.conf ####################### ldap { server = "mem_co_dept1.mem-ins.com" basedn = "ou=mem users,dc=mem-ins,dc=com" filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" identity = "cn=administrator,ou=admin,ou=mem users,dc=mem-ins,dc=com" password = XXXXXXXXXX start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 }

2 1

RE: proxy wildcard realms (subdomains)
by Tariq Rashid 17 Jun '05

17 Jun '05

thanks - this works very well. i'm replying so that future searchers of the mailing list archives can see that it does indeed work. working example (etc/raddb/users file for that that couldn't fine which file to edit!) # following is used to map subdomains of *.easynet.co.uk # to be proxied according to the realm easynet.co.uk DEFAULT User-Name =~ "@.*\.easynet\.co\.uk$", Proxy-To-Realm := "easynet.co.uk" # following is used to map subdomains of *.ukonline.co.uk # to be proxied according the realm ukonline.co.uk DEFAULT User-Name =~ "@.*\.ukonline\.co\.uk$", Proxy-To-Realm := "ukonline.co.uk" t -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Alan DeKok Sent: 16 June 2005 17:59 To: FreeRadius users mailing list Subject: Re: proxy wildcard realms (subdomains) Tariq Rashid <tariq.rashid(a)uk.easynet.net> wrote: > hi - i after much searching the archives i couldn't find a good way to proxy > to subdomains of a domain: > > user(a)xxx.yyy.zz.domain.com > > for any number of subdomains under a given domain.com (inlcuding nil). > > is this possible? (i don't want the username stripped) yes. DEFAULT User-Name =~ "domain\.com$", Proxy-To-Realm := "domain.com" Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Protection of accounting files
by Karl-Jose Filler 17 Jun '05

17 Jun '05

The file protection of the radius accounting files is currently 0600 [948]> ll /var/log/radius/radacct/135.246.192.119/ total 24 -rw------- 1 radiusd radiusd 2595 Jun 13 15:25 detail-20050613 -rw------- 1 radiusd radiusd 5193 Jun 14 15:33 detail-20050614 -rw------- 1 radiusd radiusd 6018 Jun 15 15:06 detail-20050615 -rw------- 1 radiusd radiusd 3477 Jun 16 15:38 detail-20050616 Is there a parameter in one of the config files to change this protection ? JIse Filler

2 1

upgrade from 1.0.1 --> 1.0.3
by Rohaizam Abu Bakar 17 Jun '05

17 Jun '05

OS: FreeBSD 4.11 Upgrade : from 1.0.1 to 1.0.3 Receive below error # ./configure --with-logdir=/var/log --with-radacctdir=/var/adm/radacct --with-raddbdir=/usr/local/etc/raddb # make Should be no problem compiling for 1.0.2 ################ In file included from rlm_attr_rewrite.c:31: /usr/include/regex.h:46: syntax error before `regoff_t' /usr/include/regex.h:46: warning: type defaults to `int' in declaration of `regoff_t' /usr/include/regex.h:46: warning: data definition has no type or storage class /usr/include/regex.h:56: syntax error before `regoff_t' rlm_attr_rewrite.c: In function `do_attr_rewrite': rlm_attr_rewrite.c:314: structure has no member named `rm_so' rlm_attr_rewrite.c:316: structure has no member named `rm_so' rlm_attr_rewrite.c:318: structure has no member named `rm_eo' rlm_attr_rewrite.c:318: structure has no member named `rm_so' rlm_attr_rewrite.c:330: structure has no member named `rm_eo' rlm_attr_rewrite.c:348: structure has no member named `rm_so' rlm_attr_rewrite.c:357: structure has no member named `rm_so' rlm_attr_rewrite.c:358: structure has no member named `rm_eo' rlm_attr_rewrite.c:358: structure has no member named `rm_so' rlm_attr_rewrite.c:359: structure has no member named `rm_eo' rlm_attr_rewrite.c:359: structure has no member named `rm_so' gmake[5]: *** [rlm_attr_rewrite.o] Error 1 gmake[5]: Leaving directory `/var/src/freeradius-1.0.3/src/modules/rlm_attr_rewrite' gmake[4]: *** [common] Error 2 gmake[4]: Leaving directory `/var/src/freeradius-1.0.3/src/modules' gmake[3]: *** [all] Error 2 gmake[3]: Leaving directory `/var/src/freeradius-1.0.3/src/modules' gmake[2]: *** [common] Error 2 gmake[2]: Leaving directory `/var/src/freeradius-1.0.3/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/var/src/freeradius-1.0.3/src' gmake: *** [common] Error 2 *** Error code 2 Stop in /var/src/freeradius-1.0.3.

1 0

restricting access for users
by Martial VdB 17 Jun '05

17 Jun '05

Hi there, Im a newby here so forgive if I ask obvious questions. Im trying to setup, wel actually I did setup FreeRADIUS Version 1.0.2 on a Linux Debian machine and it is working fine :) But I need to achieve the following setup: We have # cisco routers and switches who are locally managed by on site engineers. So these local engineers have to be able to log in to their devices and not be allowed to log in to devices on other sites. Next to these different site engineers there is a group called NOC. The NOC engineers need to access all devices on all sites. Ive tried several setups by using the huntgroups and using system as authentication method but I can't get the huntgroup validation to work. It looks like the huntgroups are just ignored. Everyone can just enter any device as soon as their usrname and password is matched on the system. Did someone do a similar setup where users where restricted and with a general group that needs access everywhere or can someone tell me how I should take this on. It should be fairly easy I thought Thanks for your help, it is highly appreciated, Martial _________________________________________________________________ Free blogging with MSN Spaces http://spaces.msn.com/?mkt=nl-be

3 5

Re: Radius attributes necessary for PPP connection into Cisco modem-bank
by Mike Partyka 17 Jun '05

17 Jun '05

On Jun 16, 2005, at 1:29 PM, Alan DeKok wrote: > You are trying to authenticate a modem connection... which means you > can't use it until it's authenticated. Which means you can't use it > to get data from the other end to do the authentication. > > Maybe I'm confused by your description, but what you described is > impossible Let me take another stab at describing it and maybe it'll help. The modem dials out to the Cisco modem bank, the modem bank (i am guessing here, as i am not this far) is configured to authenticate against Radius. Radius is configured to talk to Mysql and uses a query that checks the username/password, based on the exit status it accepts or denies the connection request to the modem. As i said my PPP knowledge is weak, but isn't what i described part of the PAP/CHAP handshake process that Radius is configured to use? Please correct me if i am mistaken. Thanks,

3 3

Freeradius Mysql
by synackrst 16 Jun '05

16 Jun '05

Hello, I have freeradius + mysql plus rlm_sqlcounter. And chillispot for wireless captive portal. The connection to mysql is ok. I create users in mysql databases, but running radius in debug mode, I can see the always "Access-Rejected of id 0 to 127.0.0.1" when I make a test with "radtest". So.. chillispot users don't login in wireless lan. Any suggestions? Thank you Regards, Paulo Leitao

2 2

FW: freeradius accounting
by james 16 Jun '05

16 Jun '05

Hi One question, when A call B at the start record, the calling_station_id is A, called_station_id is B. When the call ends, B hung up first, then at the stop record, the calling_station_id should be B or A? Thanks James

1 0

FW: radwho
by james 16 Jun '05

16 Jun '05

Hi, When run radwho, it only display the last user to log on. Why? Best regards, James

1 0

load balancing
by Lucas Aimaretto 16 Jun '05

16 Jun '05

Hi all, Is it possible to have freeradius as a proxy, but also, doing some load-balancing within N other freeradius-servers ? Has anybody done something like this before ? I've seen at freeradius.org that some used LinuxVirtualServer for doing this. But, I believe that, having a freeradius as proxy+load-balancer, it should have a better connection-handling. Am I wrong ? Any suggestion would be appreciated. Best regards, Lucas -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.7.3/15 - Release Date: 14/06/2005

2 1