- Freeradius-Users - lists.freeradius.org

Problem with two ldap connections
by Jörn Volkhausen 15 Mar '17

15 Mar '17

Hello at all i have a small problem an dhope anyone can help me. First my configuration and the debug output: --- sites-available/radius-staging --- (is also linked in sites-enabled) authorize { if ("%{User-Name}" =~ /^(.*)#(.*)(a)domain.de$/) { update request { Group-Name := "%{1}" Stripped-User-Name := "%{2}" } } else { reject } #"%{exec:/usr/bin/printenv}" ldap-kap-costumertype if ("%{ldap-kap-costumertype:ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name}}" == unmanaged) { update control { Proxy-to-Realm := unmanagedCostumers } # updated } else { ldap-kap-staging # updated } } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap-kap-staging } } --- modules/ldap-kap-staging --- ldap ldap-kap-staging { server := "test" identity := "cn=radiusbinduser,ou=admins,dc=domain,dc=de" password := "XXXXXXX" basedn := "ou=%{Group-Name},dc=domain,dc=de" filter := "(&(uid=%{Stripped-User-Name})(userEnabled=true))" dictionary_mapping = ${confdir}/ldap.attrmap set_auth_type = yes } --- modules/ldap-kap-costumertype --- ldap ldap-kap-costumertype { server := "test" identity := "cn=radiusbinduser,ou=admins,dc=domain,dc=de" password := "XXXXX" basedn := "dc=domain,dc=de" filter := "ou=%{Group-Name}" dictionary_mapping = ${confdir}/ldap.attrmap set_auth_type = no } --- debug output from freeradius --- Ready to process requests. rad_recv: Access-Request packet from host 10.10.20.100 port 55835, id=1, length=131 User-Name = "rplus.dt#test(a)domain.de" Acct-Session-Id = "1489473128K1snz" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "Localhost" NAS-Port = 0 Calling-Station-Id = "1115551212" User-Password = "testpass" Message-Authenticator = 0xb33a7beab35041d5b1c179deef4d6376 server radius-staging { # Executing section authorize from file /etc/freeradius/sites-enabled/radius-staging +group authorize { ++? if ("%{User-Name}" =~ /^(.*)#(.*)(a)domain.de$/) expand: %{User-Name} -> rplus.dt#test(a)domain.de ? Evaluating ("%{User-Name}" =~ /^(.*)#(.*)(a)domain.de$/) -> TRUE ++? if ("%{User-Name}" =~ /^(.*)#(.*)(a)domain.de$/) -> TRUE ++if ("%{User-Name}" =~ /^(.*)#(.*)(a)domain.de$/) { +++update request { expand: %{1} -> domain.dt expand: %{2} -> test +++} # update request = noop ++} # if ("%{User-Name}" =~ /^(.*)#(.*)(a)domain.de$/) = noop ++ ... skipping else for request 0: Preceding "if" was taken [ldap-kap-costumertype] performing user authorization for test [ldap-kap-costumertype] expand: ou=%{Group-Name} -> ou=rplus.dt [ldap-kap-costumertype] expand: dc=domain,dc=de -> dc=domain,dc=de [ldap-kap-costumertype] ldap_get_conn: Checking Id: 0 [ldap-kap-costumertype] ldap_get_conn: Got Id: 0 [ldap-kap-costumertype] attempting LDAP reconnection [ldap-kap-costumertype] (re)connect to test:636, authentication 0 [ldap-kap-costumertype] setting TLS mode to 1 [ldap-kap-costumertype] bind as cn=radiusbinduser,ou=admins,dc=domain,dc=de/XXXXX to test:636 [ldap-kap-costumertype] waiting for bind result ... [ldap-kap-costumertype] Bind was successful [ldap-kap-costumertype] performing search in dc=domain,dc=de, with filter ou=rplus.dt [ldap-kap-costumertype] No default NMAS login sequence [ldap-kap-costumertype] looking for check items in directory... [ldap-kap-costumertype] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap-kap-costumertype] ldap_release_conn: Release Id: 0 ++[ldap-kap-costumertype] = ok ++? if ("%{ldap-kap-costumertype:ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name}}" == unmanaged) [ldap-kap-costumertype] - ldap_xlat expand: ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name} -> ldap:///dc=domain,dc=de?businessCategory?one?ou=rplus.dt [ldap-kap-costumertype] ldap_get_conn: Checking Id: 0 [ldap-kap-costumertype] ldap_get_conn: Got Id: 0 [ldap-kap-costumertype] performing search in dc=domain,dc=de, with filter ou=rplus.dt [ldap-kap-costumertype] Adding attribute businessCategory, value: managed [ldap-kap-costumertype] ldap_release_conn: Release Id: 0 [ldap-kap-costumertype] - ldap_xlat end expand: %{ldap-kap-costumertype:ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name}} -> managed ? Evaluating ("%{ldap-kap-costumertype:ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name}}" == unmanaged) -> FALSE ++? if ("%{ldap-kap-costumertype:ldap:///dc=domain,dc=de?businessCategory?one?ou=%{Group-Name}}" == unmanaged) -> FALSE ++else else { [ldap-kap-staging] performing user authorization for test [ldap-kap-staging] expand: (&(uid=%{Stripped-User-Name})(userEnabled=true)) -> (&(uid=test)(userEnabled=true)) <--------------------------------------- [ldap-kap-staging] expand: ou=%{Group-Name},dc=domain,dc=de -> ou=rplus.dt,dc=domain,dc=de <--------------------------------------- [ldap-kap-staging] ldap_get_conn: Checking Id: 0 [ldap-kap-staging] ldap_get_conn: Got Id: 0 [ldap-kap-staging] attempting LDAP reconnection [ldap-kap-staging] (re)connect to test:636, authentication 0 [ldap-kap-staging] setting TLS mode to 1 [ldap-kap-staging] bind as cn=radiusbinduser,ou=admins,dc=domain,dc=de/XXXXX to test:636 [ldap-kap-staging] waiting for bind result ... [ldap-kap-staging] Bind was successful [ldap-kap-staging] performing search in ou=rplus.dt,dc=domain,dc=de, with filter (&(uid=test)(userEnabled=true)) [ldap-kap-staging] No default NMAS login sequence [ldap-kap-staging] looking for check items in directory... [ldap-kap-staging] userPassword -> Password-With-Header == "{SSHA}ac2cE0LcZb04Hr9mGf5RIvfeoDlDkT5BaEB4tw==" [ldap-kap-staging] looking for reply items in directory... [ldap-kap-staging] Setting Auth-Type = LDAP [ldap-kap-staging] ldap_release_conn: Release Id: 0 +++[ldap-kap-staging] = ok ++} # else else = ok +} # group authorize = ok Found Auth-Type = LDAP # Executing group from file /etc/freeradius/sites-enabled/radius-staging +group LDAP { [ldap-kap-staging] login attempt by "test" with password "testpass" [ldap-kap-staging] user DN: ou=rplus.dt,dc=domain,dc=de <--------------------------------------- [ldap-kap-staging] (re)connect to test:636, authentication 1 [ldap-kap-staging] setting TLS mode to 1 [ldap-kap-staging] bind as ou=rplus.dt,dc=telekom,dc=de/testpass to test:636 <--------------------------------------- [ldap-kap-staging] waiting for bind result ... [ldap-kap-staging] Bind failed with invalid credentials ++[ldap-kap-staging] = reject +} # group LDAP = reject Failed to authenticate the user. } # server radius-staging Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/radius-staging +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> rplus.dt#test(a)domain.de attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 0 for 1 seconds Can anyone explain me why freeradius use two different userdn's for the same ldap configuration [ldap-kap-staging]? That he is authorizing the user is good, but why is freeradius using the wrong dn at the authenticate stage for the same ldapconfig? Thank you very much Jörn Volkhausen

2 6

freeradius for vpn pptp
by Jan-Christoph Fuchs 14 Mar '17

14 Mar '17

Hello Mailinglist, I am using freeradius + mysql for dynamic vlan assignment. It works fine. Now I want to use the same radius for connecting via VPN pptp from a Unifi Security Gateway 4 pro. I had success connecting to vpn with local Users from the Unifi, but when I switch to use radius for authentication, the connection failed. I can see in radpostauth that the radius send access-accept and I dont now further. Is ther anything special I have to send with radreply? At the moment This is sending the Information for Dynamic vlan. Thank you Foxy

2 1

Initialize a variable at python script initialization time.
by Anuruddha Premalal 13 Mar '17

13 Mar '17

Hello Community, Is there a method in python extension to load an external data structure?. I just need to initialize a large MAC address array from a JSON. And use it in all the auth requests without re-reading it from the file every time. Is there a way to achieve this? Thanks, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>*

3 2

How to manipulate NAS-Port-ID from freeswitch using libfreeradius v1.1.7 ?
by Dmitriy Borisov 13 Mar '17

13 Mar '17

Hello, All! I`ve a problem :( I must interoperate with PortaBilling Radius server, which requires from me to send 5060 in NAS-Port-Id attribute. I can`t understood, how can I do this. It always equal to zero. I found that I must write something to /etc/freeradius/port-id-map, but I don`t know what port freeswitch using (eg /dev/tty0) Help me, please!

2 2

system startup/stop scripts when building from source
by Bill Schoolfield 13 Mar '17

13 Mar '17

When you build from source are there any scripts for starting and stopping the server? I'm running FreeRADIUS Version 3.0.13 on centos 6.x Bill

4 8

SQL-Group outside of sql module
by Andrea Gabellini 13 Mar '17

13 Mar '17

Hi, is it possible to use the attribute SQL-Group outside of the sql module after calling it? During the server startup in debug mode, i see: ... rlm_sql (sql): Driver rlm_sql_oracle (module rlm_sql_oracle) loaded and linked Creating attribute SQL-Group ... I tried to use it but expanding it results in an empty string. Thanks, Andrea -- ---------------------------------------------------------------- If you smoke after sex, you're doing it too fast ---------------------------------------------------------------- Ing. Andrea Gabellini Email: andrea.gabellini(a)telecomitalia.sm Skype: andreagabellini Tel: (+378) 0549 886111 Fax: (+378) 0549 886188 Telecom Italia San Marino S.p.A. Via XXVIII Luglio, 212 - Piano -2 47893 Borgo Maggiore Republic of San Marino http://www.telecomitalia.sm

2 1

Support Ntdomain and Suffix For Ad authentication
by Arnab Roy 13 Mar '17

13 Mar '17

Hi , I am just trying to see if its possible to get usernames of both formats to authenticate on FR. Based on the howto here http://wiki.freeradius.org/guide/freeradius-active-directory-integ ration-howto It seems to be either or in the mschap module. I tried a few combination like so in the username expansion --username=%{%{mschap:User-Name}:-00} --> Domain\username works , but username@d omain breaks because we are not passing the Stripped username --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} user@domain works but domain\user breaks. Any way I can combine the above to expansions and support both username formats .. Your help is appreciated. Many Thanks Arnab

2 1

Broken link
by Brian Candler 13 Mar '17

13 Mar '17

http://freeradius.org/freeradius-client/ links to http://wiki.freeradius.org/Radiusclient But if I click it, I get: http://wiki.freeradius.org/__omnigollum__/auth/github/callback?code=a959d3e… " Authentication failed Insufficient data from authentication provider, email not provided or empty Try again <http://wiki.freeradius.org/__omnigollum__login?origin=%2Fcreate%2FRadiuscli…> " I *think* this is because the wiki thinks I'm trying to create a non-existent page. Perhaps this is the right link instead? http://wiki.freeradius.org/project/Radiusclient (although that page may be old, since it links to freeradius-client-1.1.6 rather than 1.1.7) Regards, Brian.

2 1

Freeradius with LDAP and in second LDAP Authorization or Proxying
by Jörn Volkhausen 13 Mar '17

13 Mar '17

Good Morning i have a problem with the Set-Up i have to do. we have two types of costumers (managed and unmanaged). In our Setup we get all access-requests to the same radius server. In this radius Server then we have to decide if we have to proxying the request (unmanaged costumer) or authorize against our LDAP server (unmanaged costumer). The information if the costumer ist managed/unmanaged along with proxy and user information is in the same ldap and i have to query it first for deciding what to do. Is such a setup possible with freeradius? My specs: Ubuntu 16.04 FreeRADIUS Version 2.2.8 (2.2.8+dfsg-0.1build2 from apt) The basic setup with authorization/authentication against the ldap is running very well, but the extension with the unmanaged costumers give my head ache. I need help to find the right direction to run. Thanks Jörn

2 2

Problem with huntgroups upgrading from 2.2.9 to 3.0.x
by Andrea Gabellini 13 Mar '17

13 Mar '17

Hi, I'm upgrading from FR 2.2.9 to FR 3.0.13. I'm testing the configuration in my lab. I've a problem with huntgroups. This is my huntgroups file: adsl NAS-IP-Address == 1.2.3.4 Group == adslhome, Group == adslbusiness, Group == adslpro Suppose a user is in the group adslbusiness. I get the "No Huntgroup" error. exchanging the last two lines the same user can log in: adsl NAS-IP-Address == 1.2.3.4 Group == adslhome, Group == adslpro, Group == adslbusiness It seems that it works only if the last condition is true. The same huntgroups file works fine in FR 2.2.9. Is it changed some logic from 2.x to 3.x? Thanks, Andrea -- ---------------------------------------------------------------- Una candela accesa infiamma un'altra candela, e in tal modo si riesce ad accendere migliaia di candele, cos ---------------------------------------------------------------- Ing. Andrea Gabellini Email: andrea.gabellini(a)telecomitalia.sm Skype: andreagabellini Tel: (+378) 0549 886111 Fax: (+378) 0549 886188 Telecom Italia San Marino S.p.A. Via XXVIII Luglio, 212 - Piano -2 47893 Borgo Maggiore Republic of San Marino http://www.telecomitalia.sm

2 2