- Freeradius-Users - lists.freeradius.org

Ldap/freeradius gidnumber attribute check issue
by David Francisco Rodriguez Perez 04 Sep '15

04 Sep '15

HI all I am using freeradius to do 802.1x authentication (Peap/mschapv2) to an LDAP (openldap). Freeradius version 2.1.10 in Ubuntu 12.04. This is a Proof of Concept so far. The authentication is working fine but I have not been able to match a group number in order to return a specificattribute. My directory looks like: dn: ou=Gente,dc=testexample,dc=com objectClass: organizationalUnit ou: Gente dn: ou=Groups,dc=testexample,dc=com objectClass: organizationalUnit ou: Groups dn: cn=students,ou=Groups,dc=testexample,dc=com objectClass: posixGroup cn: students gidNumber: 5000 dn: uid=david,ou=Gente,dc=testexample,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: radiusprofile objectClass: sambaSamAccount uid: david sn: Rodriguez givenName: David cn: David Rodriguez displayName: David Rodriguez uidNumber: 10000 gidNumber: 5000 dialupAccess: access_attr sambaSID: S-1-0-0-201000 sambaNTPassword: sambaLMPassword: So as I read i should use groupmembership_attribute but I did not found a way to use it. So I put in the dictionary: ATTRIBUTE GroupNumber 3003 integer And then I put in the ldap.attrmap file: checkItem GroupNumber gidNumber And then I put in the users file: DEFAULT GroupNumber == 5000 Filter-Id :="UNP-test" But I do not see that the match is working. Even I tried to put in the authorize part of default file update reply { Filter-Id:= %(GroupNumber) } But it did not expand anything. So how should I derive the gidNumber in order to return an attribute to the authenticator. Thanks a lot, David

3 8

Re: *TLS* Session caching in v3.0.9
by Jason Alderfer 04 Sep '15

04 Sep '15

On Fri, Sep 4, 2015 at 2:38 PM, Alan DeKok <aland(a)deployingradius.com> wrote: > On Sep 4, 2015, at 12:16 PM, Jason Alderfer <jha2(a)emu.edu> wrote: > > > 2. With the above in place, caching appears to work correctly. All > > expected attributes are in the cache, and on session resumption they are > > read correctly from the cache, however they are not sent back in the > final > > reply. See below. > > You're not putting anything into session-state. So when you're taking > the reply attributes from the &session-state, nothing is there. > > There's a lot of moving parts here. > > a) attributes which need to be saved across multiple Access-Challenges > MUST be put into the "session-state" list. > > b) you must set Cached-Session-Policy some time BEFORE the session > finishes, so that the TLS session is cached, with the policy. > > c) on session resumption, the Cached-Session-Policy is read from the cache > and put back into the reply list. The "inner tunnel" isn't executed. > > d) if the next packet is an Access-Accept, you can key off of > Cached-Session-Policy in the post-auth section, to set your reply attributes > > e) if the next packet is an Access-Challenge, you MUST copy > Cached-Session-Policy to &session-state, so that it can be used in the next > Access-Accept > > Success! The crucial missing piece was wrapping my policy processing code in a "Post-Auth-Type Challenge" so it would be called on session resumption, and setting values in session-state, not reply, like so: Post-Auth-Type Challenge { if ( reply:Cached-Session-Policy ) { if ( reply:Cached-Session-Policy =~ /vlan=(.+)/ ) { update session-state { Reply-Message += "Cached policy:%{reply:Cached-Session-Policy}" Tunnel-Private-Group-ID := "%{1}" Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 } } } } Thanks for your help with this, Alan. I appreciate your time. Jason Alderfer

1 0

Re: *TLS* Session caching in v3.0.9
by Jason Alderfer 04 Sep '15

04 Sep '15

On Mon, Aug 31, 2015 at 3:12 PM, Alan DeKok <aland(a)deployingradius.com> wrote: > On Aug 31, 2015, at 2:06 PM, Jason Alderfer <jha2(a)emu.edu> wrote: > > I'm having trouble getting session caching to work in 3.0.9. > > It's not clear what you mean by "session caching". > I want to use TLS session caching to enable TLS session resumption aka MS "fast reconnect". In the TLS session cache I want to store a VLAN value to be sent back in the TLS session resumptions. Did you configure the TLS session caching in raddb/mods-available/eap? > Yes. It is enabled. This is NOT the same thing as the "cache" module. And it's NOT the same > thing as the session-state. > > > Question 2: See attached debug log. When a session resumes, the cached > > info appears to be read correctly from the cache (see "Debug: (41)") but > it > > never gets sent back in the reply (see "Debug: (42)"). > > Try using v3.0.x from github. It may be better. I've put a few fixes > in which should help. Testing with v3.0.x. What I found: 1. In order to get TLS sessions to be cached without needing to enable use_tunneled_reply = yes, I had to put the following in the "authorize" section of "default" so that it came before the eap module was called. Otherwise eap didn't find anything to cache. update { &reply: += &session-state: } if ( &reply:Cached-Session-Policy ) { if ( &reply:Cached-Session-Policy =~ /vlan=(.+)/ ) { update reply { Reply-Message += "Cached policy:%{reply:Cached-Session-Policy}" Tunnel-Private-Group-ID := "%{1}" Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 } } } 2. With the above in place, caching appears to work correctly. All expected attributes are in the cache, and on session resumption they are read correctly from the cache, however they are not sent back in the final reply. See below. [...] Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: SSL Connection Established Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: SSL Application Data Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: Adding cached attributes from session f2da74c194f913b553b402be956fef89d955c31ac3438cfd3d173e803d37c269 Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: reply:User-Name += "alderfjh" Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: reply:Cached-Session-Policy += "vlan=3" Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: [eaptls process] = success Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: Session established. Decoding tunneled attributes Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: PEAP state TUNNEL ESTABLISHED Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: Skipping Phase2 because of session resumption Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: SUCCESS Fri Sep 4 11:41:29 2015 : Debug: (14) eap: Sending EAP Request (code 1) ID 5 length 43 Fri Sep 4 11:41:29 2015 : Debug: (14) eap: EAP session adding &reply:State = 0x0a356ef1083077e4 Fri Sep 4 11:41:29 2015 : Debug: (14) modsingle[authenticate]: returned from eap (rlm_eap) for request 14 Fri Sep 4 11:41:29 2015 : Debug: (14) [eap] = handled Fri Sep 4 11:41:29 2015 : Debug: (14) } # authenticate = handled Fri Sep 4 11:41:29 2015 : Debug: (14) Using Post-Auth-Type Challenge Fri Sep 4 11:41:29 2015 : Debug: (14) Post-Auth-Type sub-section not found. Ignoring. Fri Sep 4 11:41:29 2015 : Debug: (14) # Executing group from file /usr/local/etc/raddb/sites-enabled/default Fri Sep 4 11:41:29 2015 : Debug: (14) session-state: Nothing to cache Fri Sep 4 11:41:29 2015 : Debug: (14) Sent Access-Challenge Id 161 from 10.3.20.8:1812 to 10.3.20.20:32858 length 0 Fri Sep 4 11:41:29 2015 : Debug: (14) User-Name += "alderfjh" Fri Sep 4 11:41:29 2015 : Debug: (14) EAP-Message = 0x0105002b1900170301002089c927cc662723556271f795130acfbd6f74cf74844c6194fc8edf6008822831 Fri Sep 4 11:41:29 2015 : Debug: (14) Message-Authenticator = 0x00000000000000000000000000000000 Fri Sep 4 11:41:29 2015 : Debug: (14) State = 0x0a356ef1083077e4f2094fd2b79c8abb Fri Sep 4 11:41:29 2015 : Debug: (14) Finished request [...] Fri Sep 4 11:41:29 2015 : Debug: (15) Received Access-Request Id 141 from 10.3.20.20:32858 to 10.3.20.8:1812 length 317 Fri Sep 4 11:41:29 2015 : Debug: (15) User-Name = "alderfjh" Fri Sep 4 11:41:29 2015 : Debug: (15) NAS-IP-Address = 192.168.20.2 Fri Sep 4 11:41:29 2015 : Debug: (15) NAS-Port = 0 Fri Sep 4 11:41:29 2015 : Debug: (15) NAS-Identifier = "192.168.20.2" Fri Sep 4 11:41:29 2015 : Debug: (15) NAS-Port-Type = Wireless-802.11 Fri Sep 4 11:41:29 2015 : Debug: (15) Calling-Station-Id = "BC6E64721BDA" Fri Sep 4 11:41:29 2015 : Debug: (15) Called-Station-Id = "000B86612D64" Fri Sep 4 11:41:29 2015 : Debug: (15) Service-Type = Login-User Fri Sep 4 11:41:29 2015 : Debug: (15) Framed-MTU = 1100 Fri Sep 4 11:41:29 2015 : Debug: (15) EAP-Message = 0x0205005019001703010020b1e84bef14eb5dc34d86f50ad057aab7481972c63dcb75bcb83bdd08af79d8aa17030100206040b54b4046a27a7e464b0c4168296c41675fd2fd609d882b352a400c8e8fbb Fri Sep 4 11:41:29 2015 : Debug: (15) State = 0x0a356ef1083077e4f2094fd2b79c8abb Fri Sep 4 11:41:29 2015 : Debug: (15) Aruba-Essid-Name = "EMU-testdad" Fri Sep 4 11:41:29 2015 : Debug: (15) Aruba-Location-Id = "NL1-1st-great-lounge-103-ap65" Fri Sep 4 11:41:29 2015 : Debug: (15) Aruba-AP-Group = "NL-master-only-normal-ARM" Fri Sep 4 11:41:29 2015 : Debug: (15) Message-Authenticator = 0xe57b4ba73dfd4ebcb4fcd80cf4f1cbe3 Fri Sep 4 11:41:29 2015 : Debug: (15) session-state: No cached attributes Fri Sep 4 11:41:29 2015 : Debug: (15) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Fri Sep 4 11:41:29 2015 : Debug: (15) authorize { Fri Sep 4 11:41:29 2015 : Debug: (15) update { Fri Sep 4 11:41:29 2015 : Debug: (15) No attributes updated Fri Sep 4 11:41:29 2015 : Debug: (15) } # update = noop Fri Sep 4 11:41:29 2015 : Debug: (15) if ( &reply:Cached-Session-Policy ) { Fri Sep 4 11:41:29 2015 : Debug: (15) if ( &reply:Cached-Session-Policy ) -> FALSE [...] Fri Sep 4 11:41:29 2015 : Debug: (15) Sent Access-Accept Id 141 from 10.3.20.8:1812 to 10.3.20.20:32858 length 0 Fri Sep 4 11:41:29 2015 : Debug: (15) MS-MPPE-Recv-Key = 0x9f85989d1bc6533c26517adb7a130fa621c778ebd0d6fcc46319384e279481b4 Fri Sep 4 11:41:29 2015 : Debug: (15) MS-MPPE-Send-Key = 0xebbb603a80d0fe376d053c7101e5d8f8e35464c55efa82305133b0668bcc440a Fri Sep 4 11:41:29 2015 : Debug: (15) User-Name = "alderfjh" Fri Sep 4 11:41:29 2015 : Debug: (15) Finished request

2 1

NAS IP address for usergroup
by Tevfik Ceydeliler 04 Sep '15

04 Sep '15

Hi Does NAS-IP-Address attribute work under usergroup? +-----+-------------------------+-----------------------------+------+----------+ | id | username | attribute | op | value | +-----+-------------------------+-----------------------------+------+----------+ | 595 | tevfikceydeliler | Cleartext-Password | := | Test01 | +-----+-------------------------+-----------------------------+------+--------+ +-----------------------+--------------------+----------+ | username | groupname | priority | +-----------------------+---------------------+----------+ | tevfikceydeliler | UGR_Test_Wifi | 0 | +-----------------------+----------------------+----------+ +----+-----------------------+------------------------+-----+------------------+ | id | groupname | attribute | op | value | +----+---------------+--------------------------------+----+-------------- -----+ | 45 | UGR_Test_Wifi | NAS-IP-Address | == | 10.65.8.117 | +----+-----------------------+-------------------------+----+-------------------+ I test it but user can get access-accept" from dşfferent NAS also Or something wrong? --

2 4

User authentication by some couple conditions
by Tevfik Ceydeliler 04 Sep '15

04 Sep '15

Hi, I Use freeradius to assign IP address by using MySQL But due to some need I try to find some answer. 1) Is it possible one of those two scenarios: - Authentication by using Client AND Username+Password - Authentication by using Usergroup AND Username+Password 2) And second question is : Is is possible to Authentication expiration date on MySQL? Can you give me some reference I will be really appreciated. Regards.. -- Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

1 0

Re: Postgresql groupreply problem
by georg＠wojti.de 04 Sep '15

04 Sep '15

Alan DeKok schrieb am 31.08.2015 14:30: > On Aug 31, 2015, at 4:15 AM, georg(a)wojti.de wrote: >> I want to change the user MAC-authentication with an HP-Switch from the >> users-file to postgresql. The first thing is, that I have a some lines which >> check whether it is a Call-Check or not. If not then the radius has to reject >> this. But I think it's ok if I put this into the users-file. I have written >> the Cleartext-Password in this file, too, because I get an chap error (chap: >> ERROR: &control:Cleartext-Password is required for authentication), when I put >> this into the database. > > The server doesn't care where it gets the Cleartext-Password from. It doesn't > matter if it's in a database, or in the "users" file > >> In the Moment my configurations looks like this: >> >> -------------- users file -------------- >> DEFAULT Service-Type != Call-Check, Auth-Type := Reject >> Fall-Through = Yes > > You should delete that "Fall-Through". It does nothing useful. > >> DEFAULT Cleartext-Password := "xxxXXXxxx" >> Fall-Through = Yes >> >> DEFAULT >> Egress-VLANID := 0x3200005C #<-- check in server.conf; reject if it's >> the same > > Why is this entry here? It ALWAYS matches ALL incoming requests. So... > you'll always reject all requests. > > That doesn't make any sense. I have removed the files section. So the server has to test sql. looks like this: -------------- server.conf -------------- ... authorize { suffix if (Realm != "NULL") { reject } chap sql.sw-hp-mac-v3 } I have read the Rlm_sql wiki many times but there is no resolution to my problem. I tried many differen constellations for Example: Test #1: If "The user IS NOT found in radcheck" freeradius should start the group processing. In the usergroup table ist the username (in my case the MAC of the client) and the group, in groupcheck tabe is an entry with the Cleartext-Password and in the groupreply table is an entry for Egress-VLANID. Test #2: If "The user IS found in radcheck, the check items DO match AND Fall-Through is set in the radreply table" the group processing starts, too. In this case i have the Cleartext-Password in the check table and in the reply table is an entry with Fall-Through=Yes. In the usergroup table ist the MAC and the group,too, and in the groupreply table is an enty for Egress-VLANID. There is nothing to check for the groups so this table is empty. Result for both: The Group-Problem still exists! 1. Freeradius checks the usergroups and -> "rlm_sql_postgresql: query affected rows = 1 , fields = 5". I tested the sql-command manually and I get the Group "abc" -> this is OK 2. Next, freeradius calls the command "SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id" but freeradius does not insert any group name into the sql-command. Why?! Looks like this "SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '' ORDER BY id" And so no attributes from the group tables were checked. >> -------------- Database -------------- >> (Hope that the format is ok. The tables radreply and radgroupcheck are empty) >> >> +----------------------------------------------------------------------+ >> | radcheck | >> +----+-------------------+--------------------+----+-------------------+ >> | id | username | attribute | op | value | >> +----+-------------------+--------------------+----+-------------------+ >> | 0 | 00:11:22:33:44:55 | Calling-Station-Id | == | 00-11-22-33-44-55 | >> +----+-------------------+--------------------+----+-------------------+ > > Which does nothing other than check the Calling-Station-Id. It does NOT add a > Cleartext-Password. > >> +-----------------------------------------------+ >> | radusergroup | >> +----+-------------------+-----------+----------+ >> | id | username | groupname | priority | >> +----+-------------------+-----------+----------+ >> | 0 | 00:11:22:33:44:55 | abc | 0 | >> +----+-------------------+-----------+----------+ >> >> +--------------------------------------------------+ >> | radgroupreply | >> +----+-----------+---------------+----+------------+ >> | id | groupname | attribute | op | value | >> +----+-----------+---------------+----+------------+ >> | 0 | abc | Egress-VLANID | := | 0x320000E0 | >> +----+-----------+---------------+----+------------+ >> >> >> >> The main problem is that the freeradius does not insert the GroupName in the >> sql-commands and so there is no correct reply. > > Because the radgroupcheck is empty. > > If you want to know how the SQL module works, go to the wiki, and search for > "rlm_sql". It has an entire page devoted to explaining exactly how the module > works, including processing of radcheck / radreply, and radgroupcheck / > radgroupreply. > > i.e. this is documented. Read the documentation, and you will fi the problem. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Auth-Type LDAP and "WARNING: Unknown value specified for Auth-Type. Cannot perform requested action"
by José Ignacio Siles Rueda 03 Sep '15

03 Sep '15

Hi, I'm well aware about not setting Auth-Type and let freeradius choose properly auth method, but I need LDAP authentication, and IT staff of LDAP server is very hostile to give freeradius userPassword info. So, my only choice is binding user to LDAP, and pray for the best... AFAIK, if I can't get proper userPassword (stored in SHA1 in LDAP), I'll never reach PAP module, and my only way out is using LDAP binding in authorize and authenticate sections of inner-tunnel. I'm using 2.1.12 version, and my inner-tunnel is as follows: server inner-tunnel { authorize { suffix eap { ok = return } switch "%{Realm}" { case "alumno.upo.es" { LDAP_estudiantes } case "upo.es" { LDAP_docentes } } } authenticate { eap Auth-Type LDAP_estudiantes { LDAP_estudiantes } Auth-Type LDAP_docentes { LDAP_docentes } Auth-Type PAP { pap } } session { radutmp } post-auth { reply_log Post-Auth-Type REJECT { attr_filter.access_reject } update outer.reply { User-Name = "%{request:User-Name}" } } And modules/ldap is as follows: ldap LDAP_estudiantes { server = "ldap.XXX.XX" basedn = "o=XXX, c=XX" filter = (&(|(uid=%{User-Name})(mail=%{Stripped-User-Name}@alumno.XX.XX)(mailAlternateAddress=%{Stripped-User-Name}@alumno.XX.XX))<mailto:mail=%25%7bStripped-User-Name%7d@alumno.XX.XX)(mailAlternateAddress=%25%7bStripped-User-Name%7d@alumno.XX.XX))> (IrisUserEntitlement=urn:mace:XXX.XX:XX.XX:entitlement:ServiciosRed:wifi:estudiantes) base_filter = "(objectclass=irisperson)" groupname_attribute = "IrisUserEntitlement" groupmembership_attribute = "IrisUserEntitlement" ldap_connections_number = 100 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no cacertfile=/etc/raddb/certs/SCSChain.XX.XX } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } ldap LDAP_docentes { server = "ldap.XXX.XX" basedn = "o=XXX, c=XX" filter = (&(|(uid=%{User-Name})(mail=%{Stripped-User-Name}@XX.XX)(mailAlternateAddress=%{Stripped-User-Name}@XX.XX))<mailto:mail=%25%7bStripped-User-Name%7d@XX.XX)(mailAlternateAddress=%25%7bStripped-User-Name%7d@XX.XX))> (IrisUserEntitlement=urn:mace:XXX.XX:XX.XX:entitlement:ServiciosRed:wifi:Docentes) base_filter = "(objectclass=irisperson)" groupname_attribute = "IrisUserEntitlement" groupmembership_attribute = "IrisUserEntitlement" ldap_connections_number = 100 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no cacertfile=/etc/raddb/certs/SCSChain.XX.XX } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } And, if I try one user with "alumno.XX.XX" realm, I'm getting: [ttls] Got tunneled request User-Name = "uwifialumno(a)alumno.XX.XX<mailto:uwifialumno@alumno.XX.XX>" User-Password = "XXXX" FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "uwifialumno(a)alumno.XX.XX<mailto:uwifialumno@alumno.XX.XX>" User-Password = "XXXXX" FreeRADIUS-Proxied-To = 127.0.0.1 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} [suffix] Looking up realm "alumno.XXX.XX" for User-Name = "uwifialumno(a)alumno.XXX.XX<mailto:uwifialumno@alumno.XXX.XX>" [suffix] Found realm "alumno.XXX.XX" [suffix] Adding Stripped-User-Name = "uwifialumno" [suffix] Adding Realm = "alumno.XXX.XX" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop expand: %{Realm} -> alumno.XXX.XX ++- entering switch %{Realm} {...} +++- entering case alumno.XXX.XX {...} [LDAP_estudiantes] performing user authorization for uwifialumno [LDAP_estudiantes] expand: (&(|(uid=%{User-Name})(mail=%{Stripped-User-Name}@alumno.XXX.XX)(mailAlternateAddress=%{Stripped-User-Name}@alumno.XXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))<mailto:mail=%25%7bStripped-User-Name%7d@alumno.XXX.XX)(mailAlternateAddress=%25%7bStripped-User-Name%7d@alumno.XXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))> -> (&(|(uid=uwifialumno@alumno.XXX.XX)(mail=uwifialumno@alumno.XXX.XX)(mailAlternateAddress=uwifialumno@alumno.XXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))<mailto:uid=uwifialumno@alumno.XXX.XX)(mail=uwifialumno@alumno.XXX.XX)(mailAlternateAddress=uwifialumno@alumno.XXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))> [LDAP_estudiantes] expand: o=XXXXXX, c=XX -> o=XXXXX, c=XX [LDAP_estudiantes] ldap_get_conn: Checking Id: 0 [LDAP_estudiantes] ldap_get_conn: Got Id: 0 [LDAP_estudiantes] performing search in o=XXXXX, c=XX, with filter (&(|(uid=uwifialumno@alumno.XXX.XX)(mail=uwifialumno@alumno.XXX.XX)(mailAlternateAddress=uwifialumno@alumno.XXXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))<mailto:uid=uwifialumno@alumno.XXX.XX)(mail=uwifialumno@alumno.XXX.XX)(mailAlternateAddress=uwifialumno@alumno.XXXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))> [LDAP_estudiantes] looking for check items in directory... [LDAP_estudiantes] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [LDAP_estudiantes] Setting Auth-Type = LDAP_estudiantes [LDAP_estudiantes] user uwifialumno authorized to use remote access [LDAP_estudiantes] ldap_release_conn: Release Id: 0 ++++[LDAP_estudiantes] returns ok +++- case alumno.upo.es returns ok ++- switch %{Realm} returns ok Found Auth-Type = LDAP_estudiantes WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Failed to authenticate the user. Login incorrect: [uwifialumno] (from client RedAPs-oviwan port 0 via TLS tunnel) } # server inner-tunnel [ttls] Got tunneled reply code 3 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Why am I getting "Unknown value specified for Auth-Type", if I define: Auth-Type LDAP_estudiantes { LDAP_estudiantes } In my inner-tunnel config file? Thanks in advance, Ignacio Siles Jefe de Proyecto- Infraestructuras / Sol. y Prod. Wireless Dirección de Servicios y Soluciones I.T. Teléfono: +34 672.283.836 Skype jisiles.ingenia C/Severo Ochoa, 43 Parque Tecnológico de Andalucía 29590. Málaga Tel: +34 952029300 | Fax: +34 952029309 www.ingenia.es<http://www.ingenia.es>

2 5

poptop dns query
by Edwardo Garcia 02 Sep '15

02 Sep '15

Howdy, The poptop mailing list seem defunct? So I ask here, since also relevant. Trying to get DNS assignments from radius, I have verified that freeradius is sending it along with all other goodies verify by running with -X, so satisfy not a freeradius server problem. I have the required follow guide from wiki and many google site, the dictionary.microsoft and .merit in radiusclient from freeradius-client 1.1.7 too, and pptpd v1.4 and ppp 2.4.7, if I use in pppd it assigns OK, but for our new network project we need radius to assign, which it sends but the poptop client ignore, so not sure how to get ppptd/pppd to accept this value and send it to connections, has anyone got this setup and got this work? Willy

2 3

stale session
by Sergio Diaz 02 Sep '15

02 Sep '15

Hello Guys, I am simulating the problem on what if the AP goes down (due to various reasons). I observed that user is not properly disconnected and result is stale session. When the AP is up and when the previous user tries to log in he/she gets login failed message because "Simultaneous-Use" is in effect while previous session is still ticking. How can prevent and fix this? Saludos Cordiales, Sergio Diaz Infraestructura TI 01(55) 5265.0145 (044) 55.28.99.95.71 sdiazf(a)logitel.com.mx www.logitel.com.mx

3 10

authorize file not being reread on HUP
by Jay Rouman 02 Sep '15

02 Sep '15

I am sure I am doing something wrong. We have all our user data in "authorize" and a HUP doesn't reread the file in 3.0.9. That version added the feature of ignoring a HUP unless a file had changed. It seems to recognize that a file has changed but it doesn't actually reload. After a HUP in 3.0.8: server inner-tunnel { # from file /usr/local/freeradius/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel Ready to process requests 3.0.9: Listening on proxy address * port 53399 Ready to process requests Ready to process requests Received HUP signal HUP - No files changed. Ignoring <-- "authorize" changed here Ready to process requests Ready to process requests Received HUP signal HUP - Files loaded by a module have changed. Ready to process requests <-- no indication of an actual reload At this point radiusd doesn't answer queries with the new information in "authorize." -- Jay Rouman (jsr(a)dexter.mi.org jsr(a)edzone.net) Gratiot/Isabella RESD, Ithaca, Michigan

2 1