- Freeradius-Users - lists.freeradius.org

Simultaneous EAP-TLS and PEAP-MSCHAPv2 (machine/user authentication)
by Lukas Haase 28 Dec '15

28 Dec '15

Hi, For my private network I would like to use 802.1X (managed switch) and WPA2 Enterprise via freeradius. I want to allow (1) username/password login with LDAP backend without installing any software/certificates on the clients and (2) machine-level authentication by installing a simple certificate on the client. Both methods should work with as many clients (Windows, Android, iOS, ...) as possible. I assume for (1) PEAP-MSCHAPv2 with LDAP is good. Got this working now. I assume for (2) EAP-TLS is good. Is this true so far? Now I am confused regarding certificates. For (1) I set the certificates in "tls" section of "eap" (since PEAP is based on TLS). Since I do not want to install any certificates on the clients, I would use a certificate officially signed by a CA trusted by the client (e.g. StartSSL, LetsEncrypt, VeriSign, ...). But what to choose an CN? Anything else to consider when creating the certificate? Now the problem for (2) is that I need an own CA. I would assume the configuration for EAP-TLS goes into the "tls" section under "eap" but as written above this is already taken by PEAP! Can't be so difficult ... how to implement this scenario appropriately? Thanks! Luke PS: I use freeradius 2.1.12 in Debian stable.

9 28

Redundant RADIUS Proxy for Auth Request
by SinTeZ Wh1te 28 Dec '15

28 Dec '15

Hello! I want to do if it's possible to proxy auth request in a redundant fashion. On each requests, I want to proxy it to a primary server, if it's success then move on. If the auth fails (Access-Reject), I need to proxy Access-Request to a secondary server. FreeRADIUS Version 2.2.6 Thanks!

2 1

Proxy server rejects/failed auth request
by srithar jeevadurai 23 Dec '15

23 Dec '15

Hi Friends, I have created the proxy setup ready and made configuration changes as per my knowledge. While trying to send request from NAS simulator, it is giving below error message in radius.log *Tue Dec 22 19:36:46 2015 : Auth: Login incorrect: [asdf(a)company.com <asdf(a)company.com>] (from client 234.224.654.123 port 16679 cli 355545455)* config file Users has below difference compare to installation file users. Can you please help me to fix the same? < DEFAULT Service-Type == Framed-User, Framed-Protocol == 7 < Framed-IP-Netmask = 255.255.255.255, < MS-Primary-DNS-Server == 195.68.0.1, < MS-Secondary-DNS-Server == 195.68.0.2, < Service-Type == Framed-User, < Framed-Protocol == 7, < Fall-Through == no One more request, I could not find any connection between proxy radius and home server radius, Is the connection only happen when it is required? i.e. while sending request from proxy to home server. -- Regards, Srithar Durairaj Alternate Mail I.D: srijeevadurai1(a)yahoo.co.in Mobile: +919886251852

1 5

proxy implementation
by srithar jeevadurai 23 Dec '15

23 Dec '15

Dear Friends, I would like to know detail on proxy implementation. *Currently:* NAS ----> Radius stack (1812,1813). *new proxy approach: * NAS -----> Proxy Radius ------> Radius stack1 (1822,1823). 1st change: Proxy radius implementation with one home servers (stack1 ). 2nd change: Changing current radius stack to run on 1822 (auth) and 1825 (acct). What are all configuration change that I have to do for 1st change and 2nd change. As per my knowledge, *1st change includes:* 1) install new freeradius and configure to accept traffic from NAS. 2) configure proxy.conf to send auth and acct request to home server (stack1). *2nd change includes: * only change the etc/raddb/sites-enabled/inner-tunnel change it as below *listen {* * ipaddr = 127.0.0.1* * port = 18220* * type = auth* *}* Please let me know if any other configuration change that I am missing in the step 1 and 2. -- Regards, Srithar Durairaj Alternate Mail I.D: srijeevadurai1(a)yahoo.co.in Mobile: +919886251852

3 5

Re: Freeradius-Users Digest, Vol 128, Issue 64
by dahili.network＠gmail.com 22 Dec '15

22 Dec '15

Dear friends, i read message from http://lists.freeradius.org/pipermail/freeradius-users/2013-January/064662.… so i know many people are experianced with freeradius please let me know if you are available to write custom config file for me? i use FreeRadius + MySQL + Radius Manager (DMA-Soft) ppoe user that created in RM for example test(a)test.com succesfuly loged in to MikroTik nas with radius offered ip pool or radius offered statik ip when users service expired as a user there is no way to know if is fault or service expired what i need regexp user *(a)test.com regexp get ip from sql ip pool named "expired" ip pool from mysql "expired" gateway 1.1.1.1 (this will open status page from our server) update reply { DHCP-Domain-Name-Server = 8.8.8.8 DHCP-Domain-Name-Server += 8.8.4.4 DHCP-Subnet-Mask = 255.255.255.255 DHCP-Router-Address = 1.1.1.1 DHCP-IP-Address-Lease-Time = 7200 DHCP-DHCP-Server-Identifier = 1.1.1.1 } my best regards oguz ----- Original Message ----- From: <freeradius-users-request(a)lists.freeradius.org> To: <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, December 22, 2015 6:13 PM Subject: Freeradius-Users Digest, Vol 128, Issue 64 > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Freeradius + LDAP - WARNING: No "known good" password was > found in LDAP (Anirudh Malhotra) > 2. Re: Freeradius + LDAP - WARNING: No "known good" password was > found in LDAP (Kermes - -) > 3. Proxy server rejects/failed auth request (srithar jeevadurai) > 4. Re: Problem with handshake (Mario Guerri Maglia) > 5. Re: Compilation error (Alan DeKok) > 6. Re: Problem with handshake (Alan DeKok) > 7. Re: Proxy server rejects/failed auth request (srithar jeevadurai) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 22 Dec 2015 17:10:31 +0530 > From: Anirudh Malhotra <amalhotra.sp-dl(a)nkn.in> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius + LDAP - WARNING: No "known good" password was > found in LDAP > Message-ID: <567936AF.8040003(a)nkn.in> > Content-Type: text/plain; CHARSET=US-ASCII; format=flowed > > Hi, > > Your LDAP is returning ok > > So the only problem is > unhash > Auth-Type LDAP { > ldap > } > > from authenticate section and check. > > BR, > Anirudh Malhotra > > On Monday 21 December 2015 07:30 PM, Alan DeKok wrote: >> On Dec 21, 2015, at 3:38 AM, Kermes - - <kermes(a)gmx.es> wrote: >>> I need some help with my freeradius + LDAP configuration, I'm stuck >>> with a "WARNING: No "known good" password was found in LDAP" message, >>> and I don't know how to continue with the debugging of this problem. >> The user isn't found in LDAP. The debug output shows that, including >> the LDAP query. >> >>> First, versions: >>> freeradius-ldap-2.2.6-6.el6_7.x86_64 >>> freeradius-2.2.6-6.el6_7.x86_64 >>> >>> This is the output from "radiusd -X": >> The debug output is from "radiusd -Xx", which adds timestamps... and >> makes the output more difficult to read. Please use just "radiusd -X". >>> Mon Dec 21 08:14:30 2015 : Debug: [ldap] performing search in >>> ou=users,cn=secdb,cn=data,ou=ALL,ou=infra,dc=infra,dc=local with >>> filter >>> (uid=test) >>> Mon Dec 21 08:14:30 2015 : Info: [ldap] looking for check items in >>> directory... >>> Mon Dec 21 08:14:30 2015 : Info: [ldap] looking for reply items in >>> directory... >> And nothing was found. >> >> What happens when you use that LDAP search string in an LDAP client >> utility? >> >> Test it with an LDAP client. Once you get the search string correct, >> fix the FreeRADIUS query to use the correct search string. >> >>> basedn = >>> "ou=users,cn=secdb,cn=data,ou=ALL,ou=infra,dc=infra,dc=local" >>> filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" >> One or both of those is wrong for your LDAP system. >> >> I don't know what the *right* query is, because I don't know your how >> LDAP system is set up. >> >> Alan DeKok. >> >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > > > > ------------------------------ > > Message: 2 > Date: Tue, 22 Dec 2015 15:03:52 +0100 > From: "Kermes - -" <kermes(a)gmx.es> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Freeradius + LDAP - WARNING: No "known good" password was > found in LDAP > Message-ID: > <trinity-c224afb0-39a9-48d3-b0ac-f8cc5577644e-1450793032362@3capp-mailcom-bs05> > > Content-Type: text/plain; charset="UTF-8" > > Hi Anirudh, > > that was exactly my problem, the authenticate section! > > Thanks a lot! > BR > > Enviar: martes 22 de diciembre de 2015 a las 12:40 > De: "Anirudh Malhotra" <amalhotra.sp-dl(a)nkn.in> > Para: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Asunto: Re: Freeradius + LDAP - WARNING: No "known good" password was > found in LDAP > Hi, > Your LDAP is returning ok > So the only problem is > unhash > Auth-Type LDAP { > ldap > } > from authenticate section and check. > BR, > Anirudh Malhotra > On Monday 21 December 2015 07:30 PM, Alan DeKok wrote: > > On Dec 21, 2015, at 3:38 AM, Kermes - - <kermes(a)gmx.es> wrote: > >> I need some help with my freeradius + LDAP configuration, I'm stuck > >> with a "WARNING: No "known good" password was found in LDAP" > message, > >> and I don't know how to continue with the debugging of this problem. > > The user isn't found in LDAP. The debug output shows that, including > the LDAP query. > > > >> First, versions: > >> freeradius-ldap-2.2.6-6.el6_7.x86_64 > >> freeradius-2.2.6-6.el6_7.x86_64 > >> > >> This is the output from "radiusd -X": > > The debug output is from "radiusd -Xx", which adds timestamps... and > makes the output more difficult to read. Please use just "radiusd -X". > >> Mon Dec 21 08:14:30 2015 : Debug: [ldap] performing search in > >> ou=users,cn=secdb,cn=data,ou=ALL,ou=infra,dc=infra,dc=local with > filter > >> (uid=test) > >> Mon Dec 21 08:14:30 2015 : Info: [ldap] looking for check items in > >> directory... > >> Mon Dec 21 08:14:30 2015 : Info: [ldap] looking for reply items in > >> directory... > > And nothing was found. > > > > What happens when you use that LDAP search string in an LDAP client > utility? > > > > Test it with an LDAP client. Once you get the search string correct, > fix the FreeRADIUS query to use the correct search string. > > > >> basedn = > >> "ou=users,cn=secdb,cn=data,ou=ALL,ou=infra,dc=infra,dc=local" > >> filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" > > One or both of those is wrong for your LDAP system. > > > > I don't know what the *right* query is, because I don't know your how > LDAP system is set up. > > > > Alan DeKok. > > > > > > - > > List info/subscribe/unsubscribe? See > [1]http://www.freeradius.org/list/users.html > - > List info/subscribe/unsubscribe? See > [2]http://www.freeradius.org/list/users.html > > References > > 1. http://www.freeradius.org/list/users.html > 2. http://www.freeradius.org/list/users.html > > > ------------------------------ > > Message: 3 > Date: Tue, 22 Dec 2015 19:53:48 +0530 > From: srithar jeevadurai <srijeevadurai1(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Proxy server rejects/failed auth request > Message-ID: > <CAC5rx4xtLWJcytnjhfxeVXzxm2DnvmVLEq6rYs==12nyFA4BAg(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hi Friends, > > I have created the proxy setup ready and made configuration changes as per > my knowledge. > > While trying to send request from NAS simulator, it is giving below error > message in radius.log > > *Tue Dec 22 19:36:46 2015 : Auth: Login incorrect: [asdf(a)company.com > <asdf(a)company.com>] (from client 234.224.654.123 port 16679 cli > 355545455)* > > > config file Users has below difference compare to installation file users. > Can you please help me to fix the same? > > > > < DEFAULT Service-Type == Framed-User, Framed-Protocol == 7 > < Framed-IP-Netmask = 255.255.255.255, > < MS-Primary-DNS-Server == 195.68.0.1, > < MS-Secondary-DNS-Server == 195.68.0.2, > < Service-Type == Framed-User, > < Framed-Protocol == 7, > < Fall-Through == no > > One more request, I could not find any connection between proxy radius and > home server radius, Is the connection only happen when it is required? > i.e. > while sending request from proxy to home server. > > > > -- > Regards, > Srithar Durairaj > Alternate Mail I.D: srijeevadurai1(a)yahoo.co.in > Mobile: +919886251852 > > > ------------------------------ > > Message: 4 > Date: Tue, 22 Dec 2015 12:41:55 -0300 > From: Mario Guerri Maglia <mario.guerri(a)seciu.edu.uy> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Problem with handshake > Message-ID: <56796F43.1000901(a)seciu.edu.uy> > Content-Type: text/plain; charset=utf-8; format=flowed > > Hi, > > sadly the hints you gave me didn't work. > First of all I must say I'm a new user of FreeRadius, so I'll try to > give a detailed explanation of my problem. > > In the begining the radius was functioning ok, the authentication was > ok, it consulted the LDAP and if the user was right, the user could > connect to the Wi-Fi. We had few defined users and for many weeks nobody > connected to it. > > After that we tried to connect again and this error message appeared: > > Tue Nov 17 11:26:04 2015 : Error: TLS Alert read:fatal:handshake failure > Tue Nov 17 11:26:04 2015 : Error: TLS_accept: failed in SSLv3 read > client certificate A > Tue Nov 17 11:26:04 2015 : Error: rlm_eap: SSL error error:14094410:SSL > routines:SSL3_READ_BYTES:sslv3 alert handshake failure > Tue Nov 17 11:26:04 2015 : Error: SSL: SSL_read failed inside of TLS > (-1), TLS session fails. > Tue Nov 17 11:26:04 2015 : Auth: Login incorrect (TLS Alert > read:fatal:handshake failure): [mguerri] (from client AP_RAU_red_2 port > 8 cli CC-AF-78-2B-9F-65) Usuario Rechazado > > > So now the users can't connect, more precisely some devices can't > connect. For example some notebooks with Ubuntu 14.04 and newer mobile > phones with android. But on the other hand some older movile phones with > android can connect to the Wi-Fi, the user is validated. > > Previously to write to the list I found in the Internet the problem was > related to the size of the certification and the solution was to > generate cerfication of 2048 size. Because ours were of 1024. I changed > it the size to 2048 and after that I did these: > > openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem -out > cacert.pem > > openssl req -new -keyout radius.key -out radius.seciu.edu.uy.csr -days > 3650 > > openssl ca -policy policy_anything -out radius.seciu.edu.uy.crt > -extensions xpserver_ext -extfile xpextensions -infiles > radius.seciu.edu.uy.csr > > openssl x509 -inform PEM -outform DER -in cacert.pem -out ca.der > > openssl dhparam -check -text -5 512 -out dh > > dd if=/dev/urandom of=random count=2 > > > But it didn't function, the message is the same. > > I did what you told me to do, I passed cacert.pem, radius.key and > radius.seciu.edu.uy.crt to the client. But I got the same error message. > I don't realize what am I doing wrong... > > Hope you can help me, thanks in advance > > > Mario > > > > ------------------------------ > > Message: 5 > Date: Tue, 22 Dec 2015 10:42:47 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Compilation error > Message-ID: <FD5AC9BB-0D65-46DA-AD54-81EFFEFF918D(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Dec 22, 2015, at 4:27 AM, srithar jeevadurai <srijeevadurai1(a)gmail.com> > wrote: >> I am getting below error message while compiling freeRadius. > > Use a recent version of OpenSSL. > > Alan DeKok. > > > > > ------------------------------ > > Message: 6 > Date: Tue, 22 Dec 2015 10:46:16 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Problem with handshake > Message-ID: <B0DDD21F-20B2-4925-8363-D332753993C8(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Dec 22, 2015, at 10:41 AM, Mario Guerri Maglia > <mario.guerri(a)seciu.edu.uy> wrote: >> sadly the hints you gave me didn't work. > > Did you follow the instructions? > > If so, *which step* failed? Simply saying "it didn't work" is unhelpful. > >> First of all I must say I'm a new user of FreeRadius, so I'll try to give >> a detailed explanation of my problem. > > That's good. But I pointed you to detailed documentation which says how > to get this to work. Did you follow it? > >> In the begining the radius was functioning ok, the authentication was ok, >> it consulted the LDAP and if the user was right, the user could connect >> to the Wi-Fi. We had few defined users and for many weeks nobody >> connected to it. >> >> After that we tried to connect again and this error message appeared: > > Which you already said. There's no need to post it again. > >> Previously to write to the list I found in the Internet the problem was >> related to the size of the certification and the solution was to generate >> cerfication of 2048 size. Because ours were of 1024. I changed it the >> size to 2048 and after that I did these: > > The directory raddb/certs contains configuration files and scripts which > create new certificates. Did you use them? > > Apparently not. > >> But it didn't function, the message is the same. > > Running server-side OpenSSL scripts doesn't change the client > configuration. > >> I did what you told me to do, I passed cacert.pem, radius.key and >> radius.seciu.edu.uy.crt to the client. But I got the same error message. >> I don't realize what am I doing wrong... > > You need to follow the instructions *exactly*. And if something goes > wrong, say *which* step is going wrong. > > Alan DeKok. > > > > > ------------------------------ > > Message: 7 > Date: Tue, 22 Dec 2015 21:43:15 +0530 > From: srithar jeevadurai <srijeevadurai1(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Proxy server rejects/failed auth request > Message-ID: > <CAC5rx4xDxQb7jGC0Gt1pWFtb0HQJZ21O_LmUygV5pcs_Nj8Q3w(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hi Team, > > Do we need to keep listen config as below for proxy server? > > File: radiusd.conf > > -- auth proxy > listen { > ipaddr = 234.223.454.556 > port = 1812 > type = proxy > } > > --account proxy > listen { > ipaddr = 234.223.454.556 > port = 1813 > type = proxy > } > > > > > On Tue, Dec 22, 2015 at 7:53 PM, srithar jeevadurai < > srijeevadurai1(a)gmail.com> wrote: > >> Hi Friends, >> >> I have created the proxy setup ready and made configuration changes as >> per >> my knowledge. >> >> While trying to send request from NAS simulator, it is giving below error >> message in radius.log >> >> *Tue Dec 22 19:36:46 2015 : Auth: Login incorrect: [asdf(a)company.com >> <asdf(a)company.com>] (from client 234.224.654.123 port 16679 cli >> 355545455)* >> >> >> config file Users has below difference compare to installation file >> users. >> Can you please help me to fix the same? >> >> >> >> < DEFAULT Service-Type == Framed-User, Framed-Protocol == 7 >> < Framed-IP-Netmask = 255.255.255.255, >> < MS-Primary-DNS-Server == 195.68.0.1, >> < MS-Secondary-DNS-Server == 195.68.0.2, >> < Service-Type == Framed-User, >> < Framed-Protocol == 7, >> < Fall-Through == no >> >> One more request, I could not find any connection between proxy radius >> and >> home server radius, Is the connection only happen when it is required? >> i.e. >> while sending request from proxy to home server. >> >> >> >> -- >> Regards, >> Srithar Durairaj >> Alternate Mail I.D: srijeevadurai1(a)yahoo.co.in >> Mobile: +919886251852 >> >> >> > > > -- > Regards, > Srithar Durairaj > Alternate Mail I.D: srijeevadurai1(a)yahoo.co.in > Mobile: +919886251852 > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 128, Issue 64 > ************************************************* >

1 0

Problem with handshake
by Mario Guerri Maglia 22 Dec '15

22 Dec '15

Hi, I installed and configured a server Radius and it worked successfully until last week when it began to show the following message This is the error message I got /Thu Dec 10 15:46:14 2015 : Error: TLS Alert read:fatal:handshake failure // //Thu Dec 10 15:46:14 2015 : Error: TLS_accept: failed in SSLv3 read client certificate A // //Thu Dec 10 15:46:14 2015 : Error: rlm_eap: SSL error error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure // //Thu Dec 10 15:46:14 2015 : Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails. // //Thu Dec 10 15:46:14 2015 : Auth: Login incorrect (TLS Alert read:fatal:handshake failure): [mguerri] (from client AP_RAU_red_2 port 17 cli 10 // //-A5-D0-3A-5B-79) Usuario Rechazado / Here goes the version I have installed /OpenSSL> version // //OpenSSL 0.9.8s xx XXX xxxx // //// //radiusd: FreeRADIUS Version 2.1.12, for host i686-pc-linux-gnu, built on Nov 8 2011 at 19:52:18// / Thanks in advance Mario Guerri Maglia

3 4

Compilation error
by srithar jeevadurai 22 Dec '15

22 Dec '15

Dear Friends, I am getting below error message while compiling freeRadius. gcc -o .libs/radeapclient .libs/radeapclient.o libeap/.libs/libfreeradius-eap.so /export/home/lebraaag/PROXY_AAG/RADIUS_STACK/freeradius-server-2.2.0/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lsocket -lposix4 -lpthread -lssl -lcrypto -R/export/home/lebraaag/PROXY_AAG/RADIUS_STACK//lib Undefined first referenced symbol in file *EVP_MD_size* libeap/.libs/libfreeradius-eap.so *BIO_test_flags* libeap/.libs/libfreeradius-eap.so ld: fatal: Symbol referencing errors. No output written to .libs/radeapclient collect2: ld returned 1 exit status I checked the OpenSSL in LD_LIBRARY_PATH variable, it is set /usr/local/ssl/lib/. -- Regards, Srithar Durairaj Alternate Mail I.D: srijeevadurai1(a)yahoo.co.in Mobile: +919886251852

2 1

Freeradius + LDAP - WARNING: No "known good" password was found in LDAP
by Kermes - - 22 Dec '15

22 Dec '15

Morning list, I need some help with my freeradius + LDAP configuration, I'm stuck with a "WARNING: No "known good" password was found in LDAP" message, and I don't know how to continue with the debugging of this problem. First, versions: freeradius-ldap-2.2.6-6.el6_7.x86_64 freeradius-2.2.6-6.el6_7.x86_64 This is the output from "radiusd -X": rad_recv: Access-Request packet from host 10.252.218.2 port 12494, id=176, length=95 User-Name = "test" User-Password = "testpasswd" NAS-IP-Address = 10.252.218.4 NAS-Identifier = "example1" Calling-Station-Id = "10.100.100.10" NAS-Port = 11469 NAS-Port-Type = Virtual Mon Dec 21 08:14:30 2015 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Mon Dec 21 08:14:30 2015 : Info: +group authorize { Mon Dec 21 08:14:30 2015 : Info: ++[preprocess] = ok Mon Dec 21 08:14:30 2015 : Info: ++[chap] = noop Mon Dec 21 08:14:30 2015 : Info: ++[mschap] = noop Mon Dec 21 08:14:30 2015 : Info: ++[digest] = noop Mon Dec 21 08:14:30 2015 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Mon Dec 21 08:14:30 2015 : Info: [suffix] No such realm "NULL" Mon Dec 21 08:14:30 2015 : Info: ++[suffix] = noop Mon Dec 21 08:14:30 2015 : Info: [eap] No EAP-Message, not doing EAP Mon Dec 21 08:14:30 2015 : Info: ++[eap] = noop Mon Dec 21 08:14:30 2015 : Info: [files] users: Matched entry DEFAULT at line 79 Mon Dec 21 08:14:30 2015 : Info: ++[files] = ok Mon Dec 21 08:14:30 2015 : Info: [ldap] performing user authorization for test Mon Dec 21 08:14:30 2015 : Info: [ldap] expand: %{Stripped-User-Name} -> Mon Dec 21 08:14:30 2015 : Info: [ldap] ... expanding second conditional Mon Dec 21 08:14:30 2015 : Info: [ldap] expand: %{User-Name} -> test Mon Dec 21 08:14:30 2015 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=test) Mon Dec 21 08:14:30 2015 : Info: [ldap] expand: ou=users,cn=secdb,cn=data,ou=ALL,ou=infra,dc=infra,dc=local -> ou=users,cn=secdb,cn=data,ou=ALL,ou=infra,dc=infra,dc=local Mon Dec 21 08:14:30 2015 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Mon Dec 21 08:14:30 2015 : Debug: [ldap] ldap_get_conn: Got Id: 0 Mon Dec 21 08:14:30 2015 : Debug: [ldap] attempting LDAP reconnection Mon Dec 21 08:14:30 2015 : Debug: [ldap] (re)connect to 10.252.25.20:389, authentication 0 Mon Dec 21 08:14:30 2015 : Debug: [ldap] bind as cn=binduser,cn=proxy,ou=clients,ou=nfra,dc=infra,dc=local/password to 10.252.25.20:389 Mon Dec 21 08:14:30 2015 : Debug: [ldap] waiting for bind result ... Mon Dec 21 08:14:30 2015 : Debug: [ldap] Bind was successful Mon Dec 21 08:14:30 2015 : Debug: [ldap] performing search in ou=users,cn=secdb,cn=data,ou=ALL,ou=infra,dc=infra,dc=local with filter (uid=test) Mon Dec 21 08:14:30 2015 : Info: [ldap] looking for check items in directory... Mon Dec 21 08:14:30 2015 : Info: [ldap] looking for reply items in directory... Mon Dec 21 08:14:30 2015 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Mon Dec 21 08:14:30 2015 : Debug: [ldap] ldap_release_conn: Release Id: 0 Mon Dec 21 08:14:30 2015 : Info: ++[ldap] = ok Mon Dec 21 08:14:30 2015 : Info: ++[expiration] = noop Mon Dec 21 08:14:30 2015 : Info: ++[logintime] = noop Mon Dec 21 08:14:30 2015 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Dec 21 08:14:30 2015 : Info: ++[pap] = noop Mon Dec 21 08:14:30 2015 : Info: +} # group authorize = ok Mon Dec 21 08:14:30 2015 : Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Mon Dec 21 08:14:30 2015 : Info: Failed to authenticate the user. When I run the "search" command from the OS and ldap tools, the output seems to be good (userPassword is {SHA} hashed): # ldapsearch -D "cn=binduser,cn=proxy,ou=clients,ou=nfra,dc=infra,dc=local" -w password -p 389 -h 10.252.25.20 -b "ou=users,cn=secdb,cn=data,ou=ALL,ou=infra,dc=infra,dc=local" "uid=test" dn: uid=test,ou=users,cn=secdb,cn=data,ou=ALL,ou=infra,dc=infra,dc=local maxFailedLogins: 3 passwordMinAlphaChars: 1 objectclass: account objectclass: top objectclass: posixaccount objectclass: shadowaccount passwordMaxRepeatedChars: 1 uid: test uidNumber: 18001 cn: test loginShell: /bin/bash passwordMinLength: 15 shadowMin: 1 gidNumber: 18000 passwordMinOtherChars: 3 shadowMax: 13 gecos: homeDirectory: /home/test passwordHistSize: 12 unsuccessfulLoginCount: 0 passwordFlags: ADMCHG userPassword:: e1NIQX1mVFA2NUFYOURHMXFPZkhsem5tQzg5NElJM3c9 This is my /etc/raddb/modules/ldap file: # grep -v "#" ldap ldap { server = "10.252.25.20" port = 389 identity = "cn=binduser,cn=proxy,ou=clients,ou=nfra,dc=infra,dc=local" password = password basedn = "ou=users,cn=secdb,cn=data,ou=ALL,ou=infra,dc=infra,dc=local" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 max_uses = 0 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no keepalive { idle = 60 probes = 3 interval = 3 } } Any ideas? I don't know how to get some more debug from the "ldap" module especifcally to try to solve that "No "known good" password" message. Thanks a lot in advance, Regards, Alex

3 3

authentication failure: inner or outer?
by Stefano Zanmarchi 21 Dec '15

21 Dec '15

Hi, my aim is to use linelog to log Access-Rejects differently when authentication fails because the user's home server says so from when it fails because "my" users type in a wrong password. If I'm not wrong the server (2.1.12) does not run the "Post-Auth-Type Reject" when in the inner tunnel, so how can I distinguish where the authentication failure happened? Thank you very much, Stefano

3 2

Re: ERROR: Invalid vendor name in attribute name "radiusCheckItem"
by Amir Tal 21 Dec '15

21 Dec '15

First, thanks for the detailed and helpful reply. For reference, I was able to get this working according to desired scheme. Dropped the use of 'radiusCheckItem' and 'radiusReplyItem'. Changed to : if ( reply:Framed-Pool =~ /fast/i || reply:Framed-Pool =~ /pro/i ) { update control { Pool-Name := "test_pool" } } Added this condition to 'authorize' section of sites-enabled/default, right after ldap item. This results in assigning an IP address from "test_pool" for every user having either "fast" of "pro" set as Framed-Pool in LDAP. No further questions at this time. Amir. [IMG]<http://www.ccc.co.il> Amir Tal [IMG] System Administrator +972 39201471 [IMG] Cloud Systems Support +972 39201442 [IMG]

1 0