- Freeradius-Users - lists.freeradius.org

Accounting replication issue
by Chris Adams 27 Jul '17

27 Jul '17

I have two servers running FreeRADIUS (CentOS 7 with freeradius-3.0.4). They are logging accounting records to local MySQL servers. For redundancy, I configured FreeRADIUS to replicate the accounting records to each other, based on the robust-proxy-accounting sample config. This works, except when one server is unavailable (call it server A), the other (server B) stops replicating the records until I restart FreeRADIUS on server B. Server B logs that server A went away, and logs that it came back (in this case, somebody did something dumb on server A and triggered the kernel oom_killer - didn't touch the FreeRADIUS or MySQL processes, just the dumb grep): Jul 24 09:25:38 srvB radiusd[20768]: Marking home server srvA port 1813 as zombie (it has not responded in 6.000000 seconds). Jul 24 09:25:38 srvB radiusd[20768]: (52212975) ERROR: Failing proxied request, due to lack of any response from home server srvA port 1813 Jul 24 09:25:42 srvB radiusd[20768]: No response to status check 52213042 for home server srvA port 1813 Jul 24 09:26:05 srvB radiusd[20768]: No outstanding request was found for reply from host srvA port 1813 - ID 197 Jul 24 09:26:06 srvB radiusd[20768]: No outstanding request was found for reply from host srvA port 1813 - ID 198 Jul 24 09:26:06 srvB radiusd[20768]: (52213350) Received response to status check 52213350 (1 in current sequence) Jul 24 09:26:06 srvB radiusd[20768]: (52213350) Marking home server srvA port 1813 alive The comments in the sample config just say "When the home servers come back up, the packets are forwarded, and the detail file processed as normal." - I don't see any configuration related to that, but it defintely did not happen for me; the records were just written to the detail file until I restarted the service (which then processed the backlog correctly). Any suggestions for what to look at? -- Chris Adams <linux(a)cmadams.net>

2 2

please remove my name from this group
by Nepolean AC 27 Jul '17

27 Jul '17

Hi Team, Can you please remove my name from this group asap. Regards, Nepolean

2 1

Re: How freeradius responds in json format to the request to authorize
by Fiorella De Luca 26 Jul '17

26 Jul '17

Hello! Regarding checks like bandwidth limits and session time limit, when authorizing through a REST API, I guess we can do these checks in the authorization phase via the REST API too and return an appropiate response accordingly, is this correct? Example: check the user exists, check password matches, check user has not exhausted their allocated daily bandwidth. If it's not correct, what's the current best practice in this case? Thank you for the help! Il Lunedì 24 Luglio 2017 15:48, Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> ha scritto: > I've tried your suggestion and it worked! Great! > I wanted to ask you: are there any publicly available examples of implementations using authorize, authenticate, accounting, postauth (and any other operation) with a REST API? No, unfortunately not. If you've got some specific scenarios I can add some examples to wiki.freeradius.org. > Another question: If we perform the username & password check in authorize, I suppose there's not much we will need to do in authenticate, correct? For PAP (Plaintext auth) that's correct. When you have more complex authentication mechanisms like EAP-PEAP, EAP-TTLS, MSCHAPv2, then the authentication flow is different. For those methods, you generally need to retrieve the "known good" password via the REST interface, then call the appropriate module in authenticate to actually do something with it. Could you do this with pap too if you're interested to see how it works. authorize { rest pap } authenticate { pap } Then your JSON would be: { control:Cleartext-Password := "<users password>" } You can also return hashed passwords. The attributes that hold them are in dictionary.freeradius.internal (https://github.com/FreeRADIUS/freeradius-server/blob/89380b053b3c85d7150cd1…) Search for -Password. Note: Only Cleartext-Password will work for all authentication mechanisms. > Thank you! No problem. -Arran

2 1

user group allowed just a specific device.
by Kalil de A. Carvalho 26 Jul '17

26 Jul '17

Hello all. I'm running a FreeRADIUS which search user groups on the LDAP and permid or denny the access. Every think works fine but now I'm needing a new kind of restriction. There is a user group that they just can access some specific defice. So what I want is put this configuration to work. What I think: Is this configuration is possible? Is this configuration is made on user file? Today my enviroment is working but the user group has access on all device. If I put the this new group, ou users, on the same where is working they will have access to all equipament and this is not what is needed. Bast regards. -- Atenciosamente, Kalil de A. Carvalho

4 9

Query Regarding IPV6 address support in RADIUS
by Javed 26 Jul '17

26 Jul '17

Hello Team, I am glad with few of this group support I was able to deploy FREERadius client to support over TLS.Now our aim is to support IPV6 Query I am trying to upgrade my FreeRADIUS client library to support IPv6 address(vs 1.7) and I almost did it and while testing I came across traces: Jul 26 10:59:14 rc_get_ipaddr: couldn't resolve hostname: 2009:4600:5840:2004:3530::8 Jul 26 10:59:14 rc_send_server: unable to find server: 2009:4600:5840:2004:3530::8 Jul 26 10:59:14 Unexpected return value Call flow across files : sendserver.c -> config.c -> ip_util.c Call flow across functions : rc_findserver() -> rc_get_ipaddr() -> rc_good_ipaddr() This seems to return negative value(rc_good_ipaddr() ) and followed by rc_gethostbyname(host) results the error saying rc_send_server: unable to find server: 2009:4600:5840:2004:3530::8 Am I missing something ? Is rc_good_ipaddr() not expect to validate ipv6 address also ? Kindly share your opinion . Thanks & Regards, Javed Akhtar Technical Lead <mailto:jaakhtar@cisco.com> jaakhtar(a)cisco.com Tel: Cisco Systems, Inc. India cisco.com Think before you print. This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message. Please <http://www.cisco.com/web/about/doing_business/legal/cri/index.html> click here for Company Registration Information.

2 1

Authorization for Oracle DB
by Arvind Gupta 26 Jul '17

26 Jul '17

Hi All I have Oracle DB configured for RADIUS authentication and now having issue with Authorization part. My use case is as follows: 1. Oracle DB sends RADIUS AUthentication request to RADIUS server, which performs authentication against LDAP. 2. After succesfull authentication it retrieves group and role information for authenticated user and that group and role information it has to sent as part of authorization. 3. After receiving group and role info Oracle DB should provide him access of schemas associated with group and role. I am facing issue during Authorization. If anybody know Authorization steps then please let me know. Any help is highly appreciated. Thanks Arvind Kumar Gupta

2 1

LDAP group check not working with SQL expansion
by Klara Mall 25 Jul '17

25 Jul '17

Hi, I'm using FreeRADIUS Version 3.0.12. I'm doing EAP-TTLS/PAP and I have the following policy in the authorize section of the inner tunnel virtual server (same behaviour when it's in post-auth): w2vgroupcheck { if("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) { if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) { if (LDAP-Group == "%{sql:SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}") { update reply { Tunnel-Private-Group-Id := "%{sql:SELECT vlan_id FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 } } else { reject } } } } Which results in: (8) policy w2vgroupcheck { (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) { (8) EXPAND %{Stripped-User-Domain} (8) --> vlan-1.w2v.kit.edu (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) -> TRUE (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) { (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) { rlm_sql (sql): Reserved connection (0) (8) Executing select query: SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('vlan-1.w2v.kit.edu', '\.w2v\.kit\.edu$', '') rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (0) (8) EXPAND %{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')} (8) --> 1 (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) -> TRUE (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) { (8) if (LDAP-Group == "%{sql:SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}") { rlm_sql (sql): Reserved connection (1) (8) Executing select query: SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('vlan-1.w2v.kit.edu', '\.w2v\.kit\.edu$', '') rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (1) (8) EXPAND %{sql:SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')} (8) --> KIT-Group-1 (8) if (LDAP-Group == "%{sql:SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}") -> FALSE (8) else { (8) [reject] = reject (8) } # else = reject (8) } # if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) = reject (8) } # if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) = reject (8) } # policy w2vgroupcheck = reject I don't understand it because the SQL expansion works but then there is no try to do the LDAP group check. It just says FALSE and rejects. When I replace (LDAP-Group == "%{sql:SELECT group_name FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}") with (LDAP-Group == "KIT-Group-1") it works: (8) policy w2vgroupcheck { [50/1950] (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) { (8) EXPAND %{Stripped-User-Domain} (8) --> vlan-1.w2v.kit.edu (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) -> TRUE (8) if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) { (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) { rlm_sql (sql): Reserved connection (0) (8) Executing select query: SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('vlan-1.w2v.kit.edu', '\.w2v\.kit\.edu$', '') rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (0) (8) EXPAND %{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')} (8) --> 1 (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) -> TRUE (8) if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) { (8) if (LDAP-Group == "KIT-Group-1") { (8) Searching for user in group "KIT-Group-1" rlm_ldap (ldap): Reserved connection (1) (8) Using user DN from request "uid=abc123,ou=People,ou=unix,ou=IDM,dc=kit,dc=edu" (8) Checking for user in group objects (8) EXPAND (&(cn=KIT-Group-1)(objectClass=posixGroup)(memberUid=%{%{Stripped-User-Name}:-%{User-Name}})) (8) --> (&(cn=KIT-Group-1)(objectClass=posixGroup)(memberUid=abc123)) (8) Performing search in "ou=unix,ou=IDM,dc=kit,dc=edu" with filter "(&(cn=KIT-Group-1)(objectClass=posixGroup)(memberUid=abc123))", scope "sub" (8) Waiting for search result... (8) User found in group object "ou=unix,ou=IDM,dc=kit,dc=edu" rlm_ldap (ldap): Released connection (1) (8) if (LDAP-Group == "KIT-Group-1") -> TRUE (8) if (LDAP-Group == "KIT-Group-1") { (8) update reply { rlm_sql (sql): Reserved connection (1) (8) Executing select query: SELECT vlan_id FROM w2v WHERE vlan_name=regexp_replace('vlan-1.w2v.kit.edu', '\.w2v\.kit\.edu$', '') rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released connection (1) (8) EXPAND %{sql:SELECT vlan_id FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')} (8) --> 22 (8) Tunnel-Private-Group-Id := 22 (8) Tunnel-Type := VLAN (8) Tunnel-Medium-Type := IEEE-802 (8) } # update reply = noop (8) } # if (LDAP-Group == "KIT-Group-1") = noop (8) ... skipping else: Preceding "if" was taken (8) } # if ("%{sql:SELECT COUNT(*) FROM w2v WHERE vlan_name=regexp_replace('%{Stripped-User-Domain}', '\.w2v\.kit\.edu$', '')}" > 0) = noop (8) } # if ("%{Stripped-User-Domain}" =~ /^([^\.]+)\.w2v\.kit\.edu$/) = noop (8) } # policy w2vgroupcheck = noop Thanks in advance Klara

3 7

Browser and Device information
by Safiullah Tariq 25 Jul '17

25 Jul '17

Dear All, I hope you are doing great. I want to know that when as user is authenticated via freeradius, is there a possibility that I can also get the clients device's type, browser information and other sort of info along with it. If yes, can anyone please point me - I will do my best to move in that direction. Regards, Safiullah Tariq PRIVILEGED AND CONFIDENTIAL INFORMATION: This e-mail and attachments, if any, may contain confidential and/or proprietary information. Please be advised that the unauthorized use or disclosure of the information is strictly prohibited. The information herein is intended only for use by the intended recipient(s) named above. If you have received this transmission in error, please notify the sender immediately and permanently delete the e-mail and any copies, printouts or attachments thereof.

4 4

Questions pam_radius and accounting logs
by Junk XL 24 Jul '17

24 Jul '17

I am trying to utilize the pam_radius client (1.4.0) on several RHEL 6 servers for authentication and accounting with ssh and sudo, against a Cisco ACS (ver 5.5) The authentication works as expected for both, however i am not seeing what i would expect in the accounting. My first question is, is there a setting that i am missing that enables pam_radius to send the full accounting back to the ACS? I do see the start/stop packets, however i only ever see the "sudo" issued as a NAS identifier, and never anything else. ==== output from /var/log/messages Jul 24 10:04:00 secutil sshd[6148]: Accepted password for test_user from XXX.XXX.XXX.XXX port 53291 ssh2 Jul 24 10:04:00 secutil sshd[6148]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument Jul 24 10:04:24 secutil sudo: pam_radius_auth: Got user name test_user Jul 24 10:04:24 secutil sudo: pam_radius_auth: ignore last_pass, force_prompt set Jul 24 10:04:29 secutil sudo: pam_radius_auth: Sending RADIUS request code 1 Jul 24 10:04:29 secutil sudo: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 0x7f3b816089a0. Jul 24 10:04:29 secutil sudo: pam_radius_auth: Got RADIUS response code 2 Jul 24 10:04:29 secutil sudo: pam_radius_auth: authentication succeeded Jul 24 10:04:29 secutil sudo: test_user : TTY=pts/1 ; PWD=/home/test_user ; USER=root ; COMMAND=/bin/cat /etc/named.conf ==== output from ACS Start Accounting Details : Diagnostics Details ACS Configuration Changes Logged At : Jul 24,17 10:04:29.336 AM ACS Time : Jul 24,17 10:04:29.313 AM ACS Server : scrubbed User Name : root Failure Reason : Identity Store : Identity Group : Network Device Name : Linux_Servers Network Device Group : Device Type:All Device Types, Location:All Locations Service Selection Rule Name : Access Service : Security Group : AD Domain : Authorization Profile: MAC Address : Endpoint IP Address : NAS IP Address : scrubbed NAS Port : 6171 NAS Port Id: NAS Identifier : sudo Account Status Type : Start Account Session Id : 00006171 Account MultiSession Id : Audit Session Id : ACS Session Id : scrubbed/230060300/66963046 Account Authentic : RADIUS Account Terminate Cause : Terminate Action : Account Interim Intervals : Account Delay Time : Account Session Time : Account Input Octets : Account Output Octets : Account Input Packets : Account Output Packets : Account Tunnel Connection : Account Tunnel Packet Lost : Session Timeout : Idle Timeout : Event Timestamp : Service Type : Response Time : 1 Class : Framed Protocol : Tunnel Details : Cisco H323 : Cisco SSG : Cisco-AvPairs : Other Attributes : ACSVersion=acs-5.5.0.46-B.723 ConfigVersionId=200 NAS-Port-Type=Virtual Device IP Address=scrubbed Audit Session Key root:sudo:6171 Steps Received RADIUS Accounting-Request RADIUS created a new session Evaluating Service Selection Policy Matched rule Selected Access Service - Accounting start was received for non-existing session. Returned RADIUS Accounting-Response ==== output from ACS Stop Accounting Details : Diagnostics Details ACS Configuration Changes Logged At : Jul 24,17 10:04:29.336 AM ACS Time : Jul 24,17 10:04:29.320 AM ACS Server : scrubbed User Name : root Failure Reason : Identity Store : Identity Group : Network Device Name : Linux_Servers Network Device Group : Device Type:All Device Types, Location:All Locations Service Selection Rule Name : Access Service : Security Group : AD Domain : Authorization Profile: MAC Address : Endpoint IP Address : NAS IP Address : scrubbed NAS Port : 6171 NAS Port Id: NAS Identifier : sudo Account Status Type : Stop Account Session Id : 00006171 Account MultiSession Id : Audit Session Id : ACS Session Id : scrubbed/230060300/66963047 Account Authentic : RADIUS Account Terminate Cause : Terminate Action : Account Interim Intervals : Account Delay Time : Account Session Time : 0 Account Input Octets : Account Output Octets : Account Input Packets : Account Output Packets : Account Tunnel Connection : Account Tunnel Packet Lost : Session Timeout : Idle Timeout : Event Timestamp : Service Type : Response Time : 1 Class : Framed Protocol : Tunnel Details : Cisco H323 : Cisco SSG : Cisco-AvPairs : Other Attributes : ACSVersion=acs-5.5.0.46-B.723 ConfigVersionId=200 NAS-Port-Type=Virtual Device IP Address=scrubbed Audit Session Key root:sudo:6171 Received RADIUS Accounting-Request RADIUS created a new session Evaluating Service Selection Policy Matched rule Selected Access Service - Audit session was not found. Returned RADIUS Accounting-Response ==== /etc/pam.d/sshd auth sufficient pam_radius_auth.so debug account sufficient pam_radius_auth.so debug session sufficient pam_radius_auth.so debug #auth include tacacs auth required pam_sepermit.so auth include password-auth #account include tacacs account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule #session include tacacs session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session required pam_namespace.so session optional pam_keyinit.so force revoke session include password-auth ==== /etc/pam.d/sudo auth sufficient pam_radius_auth.so debug account sufficient pam_radius_auth.so debug session sufficient pam_radius_auth.so debug auth include system-auth account include system-auth password include system-auth session optional pam_keyinit.so revoke session required pam_limits.so /etc/raddb/server (scrubbed) XXX.XXX.XXX.XXX test 3 Am i just incorrect in my assumptions on what i think i should be seeing with the accounting? I know with other devices, I can see the full accounting commands issued, but i do not know if that is a limitation with Linux and pam_radius, or if i have something set incorrectly. Thanks in advance, GR

2 2

Re: LDAP group authentication
by Jake L. 23 Jul '17

23 Jul '17

Thanks again Bogdan and sorry for my long delay on this. If you or anyone else can assist in our question below that would be awesome. Just getting back to it with my co-workers and we are running into the following issue. We've set it up using your examples below, but it says it's unable to find the user via ldap. When we disable checking via the "memberOf" method, it is able to find the user. The part I may have wrong is the commented out section inside of the ldap stanza underneath 'update'. However, anything I uncommented there failed to work. Any thoughts? Here are our tests and setups: If anyone has any suggestions, please let me know (or if you need more details!). Much thanks!! Testing using radtest (on the same machine running radiusd -X): [root@radius-server ~]# radtest "intopstest" 'testing123' localhost 2 'secret' Sending Access-Request Id 139 from 0.0.0.0:45099 to 127.0.0.1:1812 User-Name = 'intopstest' User-Password = 'testing123' NAS-IP-Address = 100.64.67.30 NAS-Port = 2 Message-Authenticator = 0x00 Received Access-Reject Id 139 from 127.0.0.1:1812 to 127.0.0.1:45099 length 20 (0) -: Expected Access-Accept got Access-Reject LOG ERROR using radiusd -X: (snipped for readability) (0) ldap : EXPAND (|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=cn=netops_radius,cn=groups,cn=accounts,dc=example,dc=com))) (0) ldap : --> (|(&(uid=intopstest)(memberOf=cn=netops_radius,cn=groups,cn=accounts,dc=example,dc=com))) (0) ldap : EXPAND cn=users,cn=accounts,dc=example,dc=com (0) ldap : --> cn=users,cn=accounts,dc=example,dc=com (0) ldap : Performing search in 'cn=users,cn=accounts,dc=example,dc=com' with filter '(|(&(uid=intopstest)(memberOf=cn=netops_radius,cn=groups,cn=accounts,dc=example,dc=com)))', scope 'sub' (0) ldap : Waiting for search result... (0) ldap : Search returned no results rlm_ldap (ldap): Released connection (4) (0) [ldap] = notfound (0) if ((ok || updated) && User-Password) (0) if ((ok || updated) && User-Password) -> FALSE (0) [expiration] = noop (0) [logintime] = noop (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user /etc/radiusd/mods-available/ldap: (snipped for readability) ldap { server = "ldap.lxi.example.com" port = 389 identity = "uid=svc_ovirt,cn=users,cn=accounts,dc=example,dc=com" password = "password" base_dn = "cn=users,cn=accounts,dc=example,dc=com" rad_group = "cn=netops_radius,cn=groups,cn=accounts,dc=example,dc=com" sasl { } update { control:Password-With-Header += 'userPassword' # control:NT-Password := 'ntPassword' # reply:Reply-Message := 'radiusReplyMessage' # reply:Tunnel-Type := 'radiusTunnelType' # reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' # reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' # control: += 'radiusCheckAttributes' # reply: += 'radiusReplyAttributes' } user { base_dn = "${..base_dn}" filter = "(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=${..rad_group})))" sasl { } # Search scope, may be 'base', 'one', sub' or 'children' scope = 'sub' } group { base_dn = "${..base_dn}" filter = "(objectClass=posixGroup)" memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" } ..... Thank you, Jake -------------------------------------------- On Wed, 6/28/17, Bogdan Rudas via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: Subject: Re: LDAP group authentication To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Wednesday, June 28, 2017, 3:23 AM Hi, Something like this: ldap { server = 'ldap.int' identity = 'cn=raidus-ro,ou=users,dc=company,dc=int' password = '12345' base_dn = 'ou=users,dc=company,dc=int' ldapgroup = 'cn=WiFi,ou=group,dc=company,dc=int' sasl { } update { control:Password-With-Header += 'userPassword' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" filter = "(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=${..ldapgroup})))" sasl { } } ...... cut here... On Tue, Jun 27, 2017 at 6:53 PM, Jake L. <jake_homs(a)yahoo.com> wrote: > Hi Bogdan, > Thank you for the information. This looks like a good method for us as > well. Are you setting up the 'ldapgroup' inside the group section of the > ldap module? If so, can you show me the stanza you're using? Thank you! > > > On Tuesday, June 27, 2017 1:20 AM, Bogdan Rudas via Freeradius-Users < > freeradius-users(a)lists.freeradius.org> wrote: > > > Hi Jake, > > We are useing *memberOf* in filter of "user { }" section in > */etc/freeradius/mods-available/ldap* > > user { > base_dn = "${..base_dn}" > > filter = > "(|(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})( > memberOf=${..ldapgroup})))" > > sasl { > } > } > > I suspect FreeIPA have similar attribute for reverse group membership > lookups. > > On Tue, Jun 27, 2017 at 1:36 AM, Jake L. via Freeradius-Users < > freeradius-users(a)lists.freeradius.org> wrote: > > > Hello - I successfully got our Freeradius server to authenticate against > > our FreeIPA LDAP environment, allowing user access. Currently, all users > in > > here will be granted successful access. However, I'm having trouble > trying > > to identify what to setup to get only a single group in our FreeIPA > > environment allowed to authenticate while all other groups are denied. > In a > > nutshell, I want to only allow the "network-team" group authenticated > > access via the Freeradius server, and any/all other groups to be denied. > In > > my wiki and google searches, I've found reference to > "group_authorization", > > but I can't find that module in the policy.d or mods-available folder. > > Also, I've seen the reference to huntgroups, but only when queried > against > > SQL, which shouldn't be needed in my case. Can anyone point me in the > right > > direction to get this working? > > TL;DR = Need info on setting up Freeradius authentication to LDAP only > for > > a specific group, denying all other groups. > > Thank you!Jake > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > > list/users.html > > > > > -- > Bogdan Rudas > Director of IT offshore > Exadel Inc. > http://www.exadel.com/ > E-mail: brudas(a)exadel.com > Skype ID: bogdan.rudas > > -- > > > CONFIDENTIALITY NOTICE: This email and files attached to it are > confidential. If you are not the intended recipient you are hereby > notified > that using, copying, distributing or taking any action in reliance on the > contents of this information is strictly prohibited. If you have received > this email in error please notify the sender and delete this email. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html > > > -- Bogdan Rudas Director of IT offshore Exadel Inc. http://www.exadel.com/ E-mail: brudas(a)exadel.com Skype ID: bogdan.rudas -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2