- Freeradius-Users - lists.freeradius.org

FW: How to get Hint to match in users file
by Matt Cobb 14 Jun '05

14 Jun '05

-----Original Message----- From: Matt Cobb Sent: Tuesday, June 14, 2005 2:07 PM To: 'freeradius-users-request(a)lists.freeradius.org' Subject: How to get Hint to match in users file What syntax do you use to get Hint to match in the users file? In Hint I have: DEFAULT Prefix == "LOCKDOWN\\", Strip-User-Name = Yes Hint = "LDAP1" DEFAULT Prefix == "testlab\\", Strip-User-Name = Yes Hint = "LDAP2" And in the users file: DEFAULT Hint == "LDAP1", Auth-Type := LDAP1, Autz-Type := LDAP1 DEFAULT Hint == "LDAP2", Auth-Type := LDAP2, Autz-Type := LDAP2 The user name gets stripped before going into the users section, but no Auth-Type is set. >From freeradius 1.0.2... rad_recv: Access-Request packet from host 127.0.0.1:1026, id=16, length=105 User-Name = "testlab\\tester" User-Password = "xyz" Service-Type = Authenticate-Only NAS-Identifier = "localhost.localdomain" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "192.168.10.100" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "tester", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 16 to 127.0.0.1:1026 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 16 with timestamp 42af5799 Nothing to do. Sleeping until we see a request.

1 0

SQL based Simultaneous-Use troubles
by Aaron Paetznick 14 Jun '05

14 Jun '05

I'm having some trouble getting FreeRADIUS to use the SQL tables for determining Simultaneous-Use. I've reviewed the doc/Simultaneous-Use file. I've uncommented the simul_count_query line in sql.conf. I'm already successfully using SQL authentication and accounting. I've entered Simultaneous-Use:=1 in the radgroupcheck table. No matter what I do, this is what I get in the log: Mon Jun 13 09:32:23 2005 : Error: Check-TS: timeout waiting for checkrad You can go to http://www.tnics.com/raddb/ to see my entire etc/raddb directory (with the clients file, passwords, secrets, and other sensitive bits removed). Can anybody offer any suggestions? I'm just trying to use 100% SQL-based Simultaneous-Use checking, so checkrad shouldn't even be called, right? I'm probably missing something really simple. Thanks! --Aaron

2 5

RE: PAM_RADIUS_AUTH setip on RHEL Linux 32 bit
by Talwar, Puneet (NIH/NIAID) 14 Jun '05

14 Jun '05

Well ok, would it be possible to see some examples of some pam file setting for RH environment? I think I am not setting the right pam modules. Thanks, __________________________ Puneet Talwar Contractor/CIPS UNIX Administrator 301-451-9971 ( c ) 301-252-5366 **************************************** Disclaimer: The information in this e-mail and any of its attachments is confidential and may contain sensitive information. It should not be used by anyone who is not the original intended recipient. If you have received this e-mail in error please inform the sender and delete it from your mailbox or any other storage devices. The National Institute of Allergy and Infectious Diseases (NIAID) shall not accept liability for any statement made that are the sender's own and not expressly made on behalf of the NIAID by one of its representatives. -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Tuesday, June 14, 2005 2:57 PM To: FreeRadius users mailing list Subject: Re: PAM_RADIUS_AUTH setip on RHEL Linux 32 bit "Talwar, Puneet (NIH/NIAID)" <PTALWAR(a)niaid.nih.gov> wrote: > Here is the full content of the file. ... > IP Address <XXX.XXX.XXX.XXX> Secret_Key 3 That line is NONSENSE. If it's actually in your configuration file, it WON'T WORK. You have to list the IP address, not the text "IP Address". See the line just above this one, which gives an example ot what to do. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: PAM_RADIUS_AUTH setip on RHEL Linux 32 bit
by Talwar, Puneet (NIH/NIAID) 14 Jun '05

14 Jun '05

Sorry about that, Here is the full content of the file. # cat pam_radius_auth.conf # pam_radius_auth configuration file. Copy to: /etc/raddb/server # # For proper security, this file SHOULD have permissions 0600, # that is readable by root, and NO ONE else. If anyone other than # root can read this file, then they can spoof responses from the server! # # There are 3 fields per line in this file. There may be multiple # lines. Blank lines or lines beginning with '#' are treated as # comments, and are ignored. The fields are: # # server[:port] secret [timeout] # # the port name or number is optional. The default port name is # "radius", and is looked up from /etc/services The timeout field is # optional. The default timeout is 3 seconds. # # If multiple RADIUS server lines exist, they are tried in order. The # first server to return success or failure causes the module to return # success or failure. Only if a server fails to response is it skipped, # and the next server in turn is used. # # The timeout field controls how many seconds the module waits before # deciding that the server has failed to respond. # server[:port] shared_secret timeout (s) #127.0.0.1 secret 1 IP Address <XXX.XXX.XXX.XXX> Secret_Key 3 # # having localhost in your radius configuration is a Good Thing. # # See the INSTALL file for pam.conf hints. -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Tuesday, June 14, 2005 12:48 PM To: FreeRadius users mailing list Subject: Re: PAM_RADIUS_AUTH setip on RHEL Linux 32 bit "Talwar, Puneet (NIH/NIAID)" <PTALWAR(a)niaid.nih.gov> wrote: > Here is the content of the pam_radius_auth.conf file and yes it does exist > in /etc/raddb/server folder. > > # server[:port] shared_secret timeout (s) > #127.0.0.1 secret 1 > IP Address <XXX.XXX.XXX.XXX> Secret_Key 3 Either you've edited it so much as to be useless, or you're using that file as-is. Either way, I have no idea what the ACTUAL contents of the file is, and therefore I have no way to help you. If you don't know how to fix the problem on your own, any editing of the configuration files you do before posting them here is guaranteed to make those files useless. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: LDAP basedn context
by Zawacki Jason D Contr AFRL/IFOS 14 Jun '05

14 Jun '05

> -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Dustin Doris > Sent: Tuesday, June 14, 2005 12:51 PM > To: FreeRadius users mailing list > Subject: Re:LDAP basedn context > > > > Correct, it is unable to find the user. When set at a > higher context I receive the following error: > > > > rlm_ldap: performing search in o=wheaton, with filter (cn=testacct) > > rlm_ldap: object not found or got ambiguous search result > > rlm_ldap: search failed > > > > My ldap config is as follows. If I change the basedn to > where the user is located (ou=cs,ou=srvc,o=wheaton) then it works. > > > > ldap test-ldap{ > > server = "ldapserver.wheaton.edu" > > identity = "cn=admin,o=wheaton" > > password = password > > basedn = "o=wheaton" > > filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" > > start_tls = yes > > > > tls_cacertfile = > /etc/raddb/certs/wheatonCA/wheatonca.b64 > > tls_require_cert = "demand" > > > > access_attr = "cn" > > dictionary_mapping = ${raddbdir}/ldap.attrmap > > ldap_connections_number = 5 > > password_attribute = nspmPassword > > timeout = 4 > > timelimit = 3 > > net_timeout = 1 > > } > > > > matt... > > > > > > >> Is it possible to specify the basedn above where the > users are actually > > >> located and have freeradius find the user in a > subcontext? For instance > > >> if my ldap is setup as ou=users1,ou=loc1,o=org and > > >> ou=users2,ou=loc2,ou=o=org can I specify basedn="o=org" > and find users > > >> in both users1 and users2? > > >> > > > Hmmm, I thought it did a subtree search, maybe not. You could use > configurable_failover to search both trees. FWIW, I am taking advantage of subtree search and it works fine. I don't see anything in his setup that would prevent it from happening. > > in radiusd.conf make two ldap instances with the same config > except the > basedn. > > ldap ldap1 { > config with one basedn > } > > ldap ldap2 { > config with other basedn > } > > in authorize section define them as a group > > authorize { > group { > ldap1 > ldap2 > } > } > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

Multiple Authentication REALMS - I hope in Plain Text
by Shepherd, Dave 14 Jun '05

14 Jun '05

Hi, It's been a long time, as the freeRADIUS software I've being using for the last 3 years hasn't needed looking at since installation. So a big thank you to the development team J However, as with most things it's so good I've now got to redesign and re-implement to encompass more of our infrastructure, and I'm having problems. I have a number of settings in the _users_ file that are based on the _Called_Station_ID_ then proxy the requests to a specified REALM. i.e. DEFAULT Called-Station-Id == "<a telephone number>", Proxy-To-Realm := "NULL" Fall-Through = Yes DEFAULT Called-Station-Id == "<another telephone number>", Proxy-To-Realm := "NULL" Fall-Through = Yes DEFAULT Called-Station-Id == "<yet another number>", Proxy-To-Realm := "SPECIAL" Fall-Through = Yes Now, the NULL realm is defined in the proxy.conf file as: realm NULL { type = radius authhost = radiusserver.some.domain:1645 accthost = radiusserver.some.domain:1646 Secret = radiussecret } This works and actually points to a MS IAS server going against an NT4 Domain. Now I need to authenticate a different set of users (who dial a different number) against an LDAP repository, so as you can see from my _users_ file I direct them at the "SPECIAL" realm, which I have set as follows in proxy.conf: realm SPECIAL { type = radius authhost = LOCAL accthost = LOCAL } My plan was for this to then use the local radius server, which has an _ldap_ module configure, which from what I can make out is working: ldap { server = "127.0.0.1" basedn = "dc=some,dc=domain,dc=co,dc=uk" filter = "(uid=%u)" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } And then in the authorize and authenticate sections simply include _ldap_ authorize { preprocess chap eap ldap files mschap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type { mschap } unix ldap eap } Now all I see when using NTRadping, and sending the additional _Called_Station_Id_ attribute set to the required number is the following in my _radius.log_ Error: Dropping packet from client Dave_Test:2328 - ID: 2 due to dead request 5018 When I run the radiusd with the -X flag (bearing in mind it's an Production Service) I can make out the call being made to my LDAP server and a "rlm_ldap authorize", but then the request just finishes without giving me and Access-Accept packet, and the relevant settings from the _radreply_ table in the Postgres Database? rad_recv: Access-Request packet from host xx.xx.xx.xx:2796, id=4, length=62 User-Name = "unextest20" User-Password = "nexus" Called-Station-Id = "xxxxxxxxxx" rad_lowerpair: User-Name now 'unextest20' modcall: entering group authorize for request 14 modcall[authorize]: module "preprocess" returns ok for request 14 modcall[authorize]: module "chap" returns noop for request 14 modcall[authorize]: module "eap" returns noop for request 14 rlm_realm: No '@' in User-Name = "unextest20", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "unextest20" rlm_realm: Proxying request from user unextest20 to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 14 radius_xlat: 'unextest20' rlm_sql (sql): sql_set_user escaped user --> 'unextest20' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'unextest20' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 8 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'unextest20' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'unextest20' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'unextest20' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radreply ??WHERE Username = 'unextest20' ??ORDER BY id' rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radreply ??WHERE Username = 'unextest20' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'unextest20' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'unextest20' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): Released sql socket id: 8 modcall[authorize]: module "sql" returns ok for request 14 rlm_ldap: - authorize rlm_ldap: performing user authorization for unextest20 radius_xlat: '(uid=unextest20)' radius_xlat: 'dc=some,dc=domain,dc=co,dc=uk' ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=some,dc=domain,dc=co,dc=uk, with filter (uid=unextest20) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user unextest20 authorized to use remote access ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 14 users: Matched DEFAULT at 90 modcall[authorize]: module "files" returns ok for request 14 modcall[authorize]: module "mschap" returns noop for request 14 modcall: group authorize returns updated for request 14 Finished request 14 I'm kinda lost and going round in circles at the minute. If one of you guys has had to do something similar, or can see any glaring omissions in my config (which I seem to think there is) could you please point me in the right direction. TIA Dave Shepherd

2 1

Re:LDAP basedn context
by Matt McFarlane 14 Jun '05

14 Jun '05

Correct, it is unable to find the user. When set at a higher context I receive the following error: rlm_ldap: performing search in o=wheaton, with filter (cn=testacct) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed My ldap config is as follows. If I change the basedn to where the user is located (ou=cs,ou=srvc,o=wheaton) then it works. ldap test-ldap{ server = "ldapserver.wheaton.edu" identity = "cn=admin,o=wheaton" password = password basedn = "o=wheaton" filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes tls_cacertfile = /etc/raddb/certs/wheatonCA/wheatonca.b64 tls_require_cert = "demand" access_attr = "cn" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = nspmPassword timeout = 4 timelimit = 3 net_timeout = 1 } matt... >> Is it possible to specify the basedn above where the users are actually >> located and have freeradius find the user in a subcontext? For instance >> if my ldap is setup as ou=users1,ou=loc1,o=org and >> ou=users2,ou=loc2,ou=o=org can I specify basedn="o=org" and find users >> in both users1 and users2? >> >> Thanks. > >I think so, is it not working for you?

2 1

RE: PAM_RADIUS_AUTH setip on RHEL Linux 32 bit
by Talwar, Puneet (NIH/NIAID) 14 Jun '05

14 Jun '05

Here is the content of the pam_radius_auth.conf file and yes it does exist in /etc/raddb/server folder. # server[:port] shared_secret timeout (s) #127.0.0.1 secret 1 IP Address <XXX.XXX.XXX.XXX> Secret_Key 3 -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Tuesday, June 14, 2005 11:16 AM To: FreeRadius users mailing list Subject: Re: PAM_RADIUS_AUTH setip on RHEL Linux 32 bit "Talwar, Puneet (NIH/NIAID)" <PTALWAR(a)niaid.nih.gov> wrote: > I was able to get the vsftpd working, I can > authenticate but when I go check to the /var/log/messages I see the > following message. > > vsftpd[XXXXX]: pam_radius_auth: No RADIUS server found in configuration file > /etc/raddb/server So... what's the content of that file? Does it even exist? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: restricting access for users
by alan walters 14 Jun '05

14 Jun '05

Yes this is my experience as well. Running v 1.0.2 there was nothing in the change log for 1.0.3 to say this was fixed either. Just as a note when I posted these findings nothing came back. I was using an ldap backend as well. It would be great to have a detailed explaination of this one and maybe confirmation that it is not working or wheather is it syntax that causes the problem Alan -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Martial VdB Sent: 13 June 2005 08:22 To: freeradius-users(a)lists.freeradius.org Subject: restricting access for users Hi there, I’m a newby here so forgive if I ask obvious questions. I’m trying to setup, wel actually I did setup FreeRADIUS Version 1.0.2 on a Linux Debian machine and it is working fine :) But I need to achieve the following setup: We have # cisco routers and switches who are locally managed by on site engineers. So these local engineers have to be able to log in to their devices and not be allowed to log in to devices on other sites. Next to these different site engineers there is a group called NOC. The NOC engineers need to access all devices on all sites. I’ve tried several setups by using the huntgroups and using system as authentication method but I can't get the huntgroup validation to work. It looks like the huntgroups are just ignored. Everyone can just enter any device as soon as their usrname and password is matched on the system. Did someone do a similar setup where users where restricted and with a general group that needs access everywhere or can someone tell me how I should take this on. It should be fairly easy I thought… Thanks for your help, it is highly appreciated, Martial _________________________________________________________________ Free blogging with MSN Spaces http://spaces.msn.com/?mkt=nl-be - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.6.7 - Release Date: 10/06/2005 -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.6.7 - Release Date: 10/06/2005

5 8

Link error (invalid ELF header) in freeradius 1.0.3
by Software Development Group 14 Jun '05

14 Jun '05

Hello, I am getting the following error when running freeradius -X: radiusd.conf[2] Failed to link to module 'rlm_sqlcounter': /usr/lib/freeradius/rlm_sqlcounter.a: invalid ELF header Anyone can help?

1 0