- Freeradius-Users - lists.freeradius.org

Re: group authorization
by Brendan Kearney 30 Mar '14

30 Mar '14

resending. rejected because of size. previously attached screenshot moved to imgur. http://imgur.com/MvEuJXb On Sat, 2014-03-29 at 11:07 -0400, Brendan Kearney wrote: > Reran this test, with a packet capture running to validate the returned > data from my directory. > > As expected, the authN works but the authZ fails. the uid is being > populated with the username and not the DN. The problem is that the > directory is replying with a successful lookup, and is giving back the > DN of my id. See attached screenshot of the packet capture. the blue > highlighted lines indicate the reply from the directory with the DN. > > where do i continue looking for the reason why the DN is not being > populated as the value to the variable "control:Ldap-UserDn"? > > raduisd -X output: > > [root@server modules]# radiusd -X > FreeRADIUS Version 2.2.0, for host x86_64-redhat-linux-gnu, built on Oct > 9 2012 at 17:45:02 > Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > PARTICULAR PURPOSE. > You may redistribute copies of FreeRADIUS under the terms of the > GNU General Public License v2. > Starting - reading configuration files ... > including configuration file /etc/raddb/radiusd.conf > including configuration file /etc/raddb/proxy.conf > including configuration file /etc/raddb/clients.conf > including files in directory /etc/raddb/modules/ > including configuration file /etc/raddb/modules/linelog > including configuration file /etc/raddb/modules/smsotp > including configuration file /etc/raddb/modules/attr_filter > including configuration file /etc/raddb/modules/sql_log > including configuration file /etc/raddb/modules/checkval > including configuration file /etc/raddb/modules/etc_group > including configuration file /etc/raddb/modules/krb5 > including configuration file /etc/raddb/modules/ntlm_auth > including configuration > file /etc/raddb/modules/sqlcounter_expire_on_login > including configuration file /etc/raddb/modules/preprocess > including configuration file /etc/raddb/modules/opendirectory > including configuration file /etc/raddb/modules/digest > including configuration file /etc/raddb/modules/rediswho > including configuration file /etc/raddb/modules/attr_rewrite > including configuration file /etc/raddb/modules/cui > including configuration file /etc/raddb/modules/policy > including configuration file /etc/raddb/modules/mac2vlan > skipping config file, invalid characters in name > "/etc/raddb/modules/&krb5.orig" > including configuration file /etc/raddb/modules/mac2ip > including configuration file /etc/raddb/modules/logintime > including configuration file /etc/raddb/modules/smbpasswd > including configuration file /etc/raddb/modules/sradutmp > including configuration file /etc/raddb/modules/radrelay > including configuration file /etc/raddb/modules/detail.example.com > including configuration file /etc/raddb/modules/expr > including configuration file /etc/raddb/modules/pap > including configuration file /etc/raddb/modules/ippool > including configuration file /etc/raddb/modules/wimax > including configuration file /etc/raddb/modules/mschap > skipping config file, invalid name "/etc/raddb/modules/ldap.rpmnew" > including configuration file /etc/raddb/modules/inner-eap > including configuration file /etc/raddb/modules/passwd > including configuration file /etc/raddb/modules/unix > skipping config file, invalid characters in name > "/etc/raddb/modules/&dhcp_sqlippool.orig" > including configuration file /etc/raddb/modules/perl > including configuration file /etc/raddb/modules/pam > including configuration file /etc/raddb/modules/soh > including configuration file /etc/raddb/modules/ldap > including configuration file /etc/raddb/modules/redis > including configuration file /etc/raddb/modules/counter > including configuration file /etc/raddb/modules/realm > including configuration file /etc/raddb/modules/chap > including configuration file /etc/raddb/modules/cache > skipping config file, invalid characters in name > "/etc/raddb/modules/&ldap.orig" > including configuration file /etc/raddb/modules/always > including configuration file /etc/raddb/modules/replicate > including configuration file /etc/raddb/modules/expiration > including configuration file /etc/raddb/modules/radutmp > including configuration file /etc/raddb/modules/files > including configuration file /etc/raddb/modules/acct_unique > including configuration file /etc/raddb/modules/detail.log > including configuration file /etc/raddb/modules/detail > including configuration file /etc/raddb/modules/exec > including configuration file /etc/raddb/modules/echo > including configuration file /etc/raddb/modules/otp > including configuration file /etc/raddb/modules/dynamic_clients > including configuration file /etc/raddb/eap.conf > including configuration file /etc/raddb/policy.conf > including files in directory /etc/raddb/sites-enabled/ > including configuration file /etc/raddb/sites-enabled/default > including configuration file /etc/raddb/sites-enabled/inner-tunnel > including configuration file /etc/raddb/sites-enabled/control-socket > main { > user = "radiusd" > group = "radiusd" > allow_core_dumps = no > } > including dictionary file /etc/raddb/dictionary > main { > name = "radiusd" > prefix = "/usr" > localstatedir = "/var" > sbindir = "/usr/sbin" > logdir = "/var/log/radius" > run_dir = "/var/run/radiusd" > libdir = "/usr/lib64/freeradius" > radacctdir = "/var/log/radius/radacct" > hostname_lookups = no > max_request_time = 30 > cleanup_delay = 5 > max_requests = 1024 > pidfile = "/var/run/radiusd/radiusd.pid" > checkrad = "/usr/sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > stripped_names = no > auth = yes > auth_badpass = no > auth_goodpass = no > } > security { > max_attributes = 200 > reject_delay = 1 > status_server = yes > } > } > radiusd: #### Loading Realms and Home Servers #### > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > secret = "***REMOVED***" > response_window = 20 > max_outstanding = 65536 > require_message_authenticator = yes > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 120 > status_check_timeout = 4 > coa { > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > } > home_server_pool my_auth_failover { > type = fail-over > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > realm BPK2.COM { > authhost = server.bpk2.com:1812 > accthost = server.bpk2.com:1813 > secret = ***REMOVED*** > } > radiusd: #### Loading Clients #### > client localhost { > ipaddr = 127.0.0.1 > require_message_authenticator = no > secret = "***REMOVED***" > nastype = "other" > } > client 192.168.254.253 { > require_message_authenticator = no > secret = "***REMOVED***" > shortname = "switch" > nastype = "cisco" > } > client test.bpk2.com { > require_message_authenticator = no > secret = "***REMOVED***" > shortname = "splunk" > nastype = "other" > } > radiusd: #### Instantiating modules #### > instantiate { > Module: Linked to module rlm_exec > Module: Instantiating module "exec" from file /etc/raddb/modules/exec > exec { > wait = no > input_pairs = "request" > shell_escape = yes > } > Module: Linked to module rlm_expr > Module: Instantiating module "expr" from file /etc/raddb/modules/expr > Module: Linked to module rlm_expiration > Module: Instantiating module "expiration" from > file /etc/raddb/modules/expiration > expiration { > reply-message = "Password Has Expired " > } > Module: Linked to module rlm_logintime > Module: Instantiating module "logintime" from > file /etc/raddb/modules/logintime > logintime { > reply-message = "You are calling outside your allowed timespan " > minimum-timeout = 60 > } > } > radiusd: #### Loading Virtual Servers #### > server { # from file /etc/raddb/radiusd.conf > modules { > Module: Creating Auth-Type = digest > Module: Creating Post-Auth-Type = REJECT > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_pap > Module: Instantiating module "pap" from file /etc/raddb/modules/pap > pap { > encryption_scheme = "auto" > auto_header = no > } > Module: Linked to module rlm_chap > Module: Instantiating module "chap" from file /etc/raddb/modules/chap > Module: Linked to module rlm_mschap > Module: Instantiating module "mschap" from > file /etc/raddb/modules/mschap > mschap { > use_mppe = yes > require_encryption = no > require_strong = no > with_ntdomain_hack = no > allow_retry = yes > } > Module: Linked to module rlm_krb5 > Module: Instantiating module "krb5" from file /etc/raddb/modules/krb5 > krb5 { > keytab = "/etc/radius.keytab" > service_principal = "radius/server.bpk2.com" > cache = yes > } > rlm_krb5: krb5_init ok > Module: Linked to module rlm_digest > Module: Instantiating module "digest" from > file /etc/raddb/modules/digest > Module: Linked to module rlm_unix > Module: Instantiating module "unix" from file /etc/raddb/modules/unix > unix { > radwtmp = "/var/log/radius/radwtmp" > } > Module: Linked to module rlm_eap > Module: Instantiating module "eap" from file /etc/raddb/eap.conf > eap { > default_eap_type = "md5" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 4096 > } > Module: Linked to sub-module rlm_eap_md5 > Module: Instantiating eap-md5 > Module: Linked to sub-module rlm_eap_leap > Module: Instantiating eap-leap > Module: Linked to sub-module rlm_eap_gtc > Module: Instantiating eap-gtc > gtc { > challenge = "Password: " > auth_type = "PAP" > } > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > CA_path = "/etc/raddb/certs" > pem_file_type = yes > private_key_file = "/etc/raddb/certs/server.pem" > certificate_file = "/etc/raddb/certs/server.pem" > CA_file = "/etc/raddb/certs/ca.pem" > private_key_password = "whatever" > dh_file = "/etc/raddb/certs/dh" > random_file = "/etc/raddb/certs/random" > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > cache { > enable = no > lifetime = 24 > max_entries = 255 > } > verify { > } > ocsp { > enable = no > override_cert_url = yes > url = "http://127.0.0.1/ocsp/" > use_nonce = yes > timeout = 0 > softfail = no > } > } > Module: Linked to sub-module rlm_eap_ttls > Module: Instantiating eap-ttls > ttls { > default_eap_type = "md5" > copy_request_to_tunnel = no > use_tunneled_reply = no > virtual_server = "inner-tunnel" > include_length = yes > } > Module: Linked to sub-module rlm_eap_peap > Module: Instantiating eap-peap > peap { > default_eap_type = "mschapv2" > copy_request_to_tunnel = no > use_tunneled_reply = no > proxy_tunneled_request_as_eap = yes > virtual_server = "inner-tunnel" > soh = no > } > Module: Linked to sub-module rlm_eap_mschapv2 > Module: Instantiating eap-mschapv2 > mschapv2 { > with_ntdomain_hack = no > send_error = no > } > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_preprocess > Module: Instantiating module "preprocess" from > file /etc/raddb/modules/preprocess > preprocess { > huntgroups = "/etc/raddb/huntgroups" > hints = "/etc/raddb/hints" > with_ascend_hack = no > ascend_channels_per_line = 23 > with_ntdomain_hack = no > with_specialix_jetstream_hack = no > with_cisco_vsa_hack = no > with_alvarion_vsa_hack = no > } > reading pairlist file /etc/raddb/huntgroups > reading pairlist file /etc/raddb/hints > Module: Linked to module rlm_realm > Module: Instantiating module "suffix" from > file /etc/raddb/modules/realm > realm suffix { > format = "suffix" > delimiter = "@" > ignore_default = no > ignore_null = no > } > Module: Linked to module rlm_files > Module: Instantiating module "files" from file /etc/raddb/modules/files > files { > usersfile = "/etc/raddb/users" > acctusersfile = "/etc/raddb/acct_users" > preproxy_usersfile = "/etc/raddb/preproxy_users" > compat = "no" > } > reading pairlist file /etc/raddb/users > reading pairlist file /etc/raddb/acct_users > reading pairlist file /etc/raddb/preproxy_users > Module: Linked to module rlm_ldap > Module: Instantiating module "ldap" from file /etc/raddb/modules/ldap > ldap { > server = "ldap2.bpk2.com" > port = 389 > password = "***REMOVED***" > identity = "cn=Manager,dc=bpk2,dc=com" > net_timeout = 1 > timeout = 4 > timelimit = 3 > max_uses = 0 > tls_mode = no > start_tls = no > tls_require_cert = "allow" > tls { > start_tls = no > require_cert = "allow" > } > basedn = "dc=bpk2,dc=com" > filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" > base_filter = "(objectclass=radiusprofile)" > auto_header = no > access_attr_used_for_allow = yes > groupname_attribute = "cn" > groupmembership_filter = "(&(objectClass=GroupOfNames)(member= > %{control:Ldap-UserDn}))" > groupmembership_attribute = "radiusGroupName" > dictionary_mapping = "/etc/raddb/ldap.attrmap" > ldap_debug = 0 > ldap_connections_number = 5 > compare_check_items = no > do_xlat = yes > set_auth_type = yes > keepalive { > idle = 60 > probes = 3 > interval = 3 > } > } > rlm_ldap: Registering ldap_groupcmp for Ldap-Group > rlm_ldap: Registering ldap_xlat with xlat_name ldap > rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed > in the "authenticate" section. > rlm_ldap: reading ldap<->radius mappings from > file /etc/raddb/ldap.attrmap > rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ > rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ > rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type > rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use > rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id > rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS > Calling-Station-Id > rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password > rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password > rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password > rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password > rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password > rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header > rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT > rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration > rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address > rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type > rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol > rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address > rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask > rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route > rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing > rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id > rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU > rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS > Framed-Compression > rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host > rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service > rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port > rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number > rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id > rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS > Framed-IPX-Network > rlm_ldap: LDAP radiusClass mapped to RADIUS Class > rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout > rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout > rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS > Termination-Action > rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service > rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node > rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group > rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS > Framed-AppleTalk-Link > rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS > Framed-AppleTalk-Network > rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS > Framed-AppleTalk-Zone > rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit > rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port > rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message > rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type > rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS > Tunnel-Medium-Type > rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS > Tunnel-Private-Group-Id > conns: 0x7f4fd76d3080 > Module: Checking preacct {...} for more modules to load > Module: Linked to module rlm_acct_unique > Module: Instantiating module "acct_unique" from > file /etc/raddb/modules/acct_unique > acct_unique { > key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, > NAS-Port" > } > Module: Checking accounting {...} for more modules to load > Module: Linked to module rlm_radutmp > Module: Instantiating module "radutmp" from > file /etc/raddb/modules/radutmp > radutmp { > filename = "/var/log/radius/radutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > perm = 384 > callerid = yes > } > Module: Linked to module rlm_attr_filter > Module: Instantiating module "attr_filter.accounting_response" from > file /etc/raddb/modules/attr_filter > attr_filter attr_filter.accounting_response { > attrsfile = "/etc/raddb/attrs.accounting_response" > key = "%{User-Name}" > relaxed = no > } > reading pairlist file /etc/raddb/attrs.accounting_response > Module: Checking session {...} for more modules to load > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > Module: Instantiating module "attr_filter.access_reject" from > file /etc/raddb/modules/attr_filter > attr_filter attr_filter.access_reject { > attrsfile = "/etc/raddb/attrs.access_reject" > key = "%{User-Name}" > relaxed = no > } > reading pairlist file /etc/raddb/attrs.access_reject > } # modules > } # server > server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel > modules { > Module: Checking authenticate {...} for more modules to load > Module: Checking authorize {...} for more modules to load > Module: Checking session {...} for more modules to load > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > } # modules > } # server > radiusd: #### Opening IP addresses and Ports #### > listen { > type = "auth" > ipaddr = * > port = 0 > } > listen { > type = "acct" > ipaddr = * > port = 0 > } > listen { > type = "control" > listen { > socket = "/var/run/radiusd/radiusd.sock" > } > } > listen { > type = "auth" > ipaddr = 127.0.0.1 > port = 18120 > } > ... adding new socket proxy address * port 43742 > Listening on authentication address * port 1812 > Listening on accounting address * port 1813 > Listening on command file /var/run/radiusd/radiusd.sock > Listening on authentication address 127.0.0.1 port 18120 as server > inner-tunnel > Listening on proxy address * port 1814 > Ready to process requests. > > > > rad_recv: Access-Request packet from host 192.168.254.253 port 49181, > id=0, length=88 > User-Name = "brendan" > User-Password = "***REMOVED***" > Cisco-AVPair = "shell:priv-lvl=15" > NAS-IP-Address = 192.168.254.253 > Acct-Session-Id = "05000039" > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++? if (EAP-Message && Access-Request) > ? Evaluating (EAP-Message ) -> FALSE > ? Skipping (Access-Request) > ++? if (EAP-Message && Access-Request) -> FALSE > ++- entering else else {...} > +++[chap] returns noop > +++[mschap] returns noop > +++[digest] returns noop > [suffix] No '@' in User-Name = "brendan", looking up realm NULL > [suffix] No such realm "NULL" > +++[suffix] returns noop > [eap] No EAP-Message, not doing EAP > +++[eap] returns noop > [files] users: Matched entry DEFAULT at line 1 > +++[files] returns ok > [ldap] performing user authorization for brendan > [ldap] expand: %{Stripped-User-Name} -> > [ldap] ... expanding second conditional > [ldap] expand: %{User-Name} -> brendan > [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> > (uid=brendan) > [ldap] expand: dc=bpk2,dc=com -> dc=bpk2,dc=com > [ldap] ldap_get_conn: Checking Id: 0 > [ldap] ldap_get_conn: Got Id: 0 > [ldap] attempting LDAP reconnection > [ldap] (re)connect to ldap2.bpk2.com:389, authentication 0 > [ldap] bind as cn=Manager,dc=bpk2,dc=com/***REMOVED*** to > ldap2.bpk2.com:389 > [ldap] waiting for bind result ... > [ldap] Bind was successful > [ldap] performing search in dc=bpk2,dc=com, with filter (uid=brendan) > [ldap] looking for check items in directory... > [ldap] userPassword -> Password-With-Header == "***REMOVED***" > [ldap] sambaNtPassword -> NT-Password == ***REMOVED*** > [ldap] sambaLmPassword -> LM-Password == ***REMOVED*** > [ldap] looking for reply items in directory... > [ldap] user brendan authorized to use remote access > [ldap] ldap_release_conn: Release Id: 0 > +++[ldap] returns ok > +++[expiration] returns noop > +++[logintime] returns noop > [pap] Normalizing NT-Password from hex encoding > [pap] Normalizing LM-Password from hex encoding > [pap] Normalizing SSHA1-Password from base64 encoding > [pap] WARNING: Auth-Type already set. Not setting to PAP > +++[pap] returns noop > ++- else else returns ok > Found Auth-Type = Kerberos > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group Kerberos {...} > ++[krb5] returns ok > Login OK: [brendan] (from client switch port 0) > # Executing section post-auth from file /etc/raddb/sites-enabled/default > +- entering group post-auth {...} > ++[exec] returns noop > Sending Access-Accept of id 0 to 192.168.254.253 port 49181 > Finished request 0. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 0 ID 0 with timestamp +5 > Ready to process requests. > ^C >

3 2

Wiki down
by Arran Cudbard-Bell 29 Mar '14

29 Mar '14

Just updating to the latest version of Gollum. "Never goes smooth. How come it never goes smooth?" Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 1

Re: group authorization
by brendan kearney 29 Mar '14

29 Mar '14

Not an option for me right now, but is something I will look to do On Mar 29, 2014 4:29 PM, "Arran Cudbard-Bell" <a.cudbardb(a)freeradius.org> wrote: On 29 Mar 2014, at 19:53, Brendan Kearney <bpk678(a)gmail.com> wrote: > resending. rejected because of size. previously attached screenshot > moved to imgur. http://imgur.com/MvEuJXb > > On Sat, 2014-03-29 at 11:07 -0400, Brendan Kearney wrote: >> Reran this test, with a packet capture running to validate the returned >> data from my directory. >> >> As expected, the authN works but the authZ fails. the uid is being >> populated with the username and not the DN. The problem is that the >> directory is replying with a successful lookup, and is giving back the >> DN of my id. See attached screenshot of the packet capture. the blue >> highlighted lines indicate the reply from the directory with the DN. >> >> where do i continue looking for the reason why the DN is not being >> populated as the value to the variable "control:Ldap-UserDn"? Honestly, just move to 3.0.2. The LDAP code in v2.x.x looked like an incontinent Chihuahua or other small kickable type dog, had dragged it's way across a source file. It got rewritten twice, once by Alan to get the code into something understandable by humans, and then once again by me to get rid of all the weird legacy crap like the attrmap file. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

group authorization
by Brendan Kearney 29 Mar '14

29 Mar '14

i am close, but need a pointer... i am using rlm_krb5 for authentication and rlm_ldap for authorization. when i add a radiusReplyItem of Cisco-AVPair = "shell:priv-lvl=15" to my user object, i am able to log into my switch. i want to have the radiusReplyItem given in a reply when the user is a member of a specific group in ldap, but i seem to be having trouble with that. it seems that when the ldap query is made for the group membership, the "short" version of the uid (uid=brendan) is being used and not matching. the actual member "value" in the group is the "long" version of the uid (uid=brendan,ou=Users,dc=bpk2,dc=com). is there something i can do to use the "long" version? radiusd -X output: FreeRADIUS Version 2.2.0, for host x86_64-redhat-linux-gnu, built on Oct 9 2012 at 17:45:02 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/mac2vlan skipping config file, invalid characters in name "/etc/raddb/modules/&krb5.orig" including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/mschap skipping config file, invalid name "/etc/raddb/modules/ldap.rpmnew" including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/unix skipping config file, invalid characters in name "/etc/raddb/modules/&dhcp_sqlippool.orig" including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/cache skipping config file, invalid characters in name "/etc/raddb/modules/&ldap.orig" including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "***REMOVED***" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm BPK2.COM { authhost = server.bpk2.com:1812 accthost = server.bpk2.com:1813 secret = ***REMOVED*** } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "***REMOVED***" nastype = "other" } client 192.168.254.253 { require_message_authenticator = no secret = "***REMOVED***" shortname = "switch" nastype = "cisco" } client test.bpk2.com { require_message_authenticator = no secret = "this" shortname = "splunk" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_krb5 Module: Instantiating module "krb5" from file /etc/raddb/modules/krb5 krb5 { keytab = "/etc/radius.keytab" service_principal = "radius/server.bpk2.com" cache = yes } rlm_krb5: krb5_init ok Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Linked to module rlm_ldap Module: Instantiating module "ldap" from file /etc/raddb/modules/ldap ldap { server = "ldap.bpk2.com" port = 389 password = "***REMOVED***" identity = "cn=Manager,dc=bpk2,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 max_uses = 0 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=bpk2,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member= %{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember= %{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes keepalive { idle = 60 probes = 3 interval = 3 } } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x7fa3421a5d60 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 34812 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.254.253 port 49181, id=0, length=88 User-Name = "brendan" User-Password = "***REMOVED***" Cisco-AVPair = "shell:priv-lvl=15" NAS-IP-Address = 192.168.254.253 Acct-Session-Id = "0500001C" # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++? if (EAP-Message && Access-Request) ? Evaluating (EAP-Message ) -> FALSE ? Skipping (Access-Request) ++? if (EAP-Message && Access-Request) -> FALSE ++- entering else else {...} +++[chap] returns noop +++[mschap] returns noop +++[digest] returns noop [suffix] No '@' in User-Name = "brendan", looking up realm NULL [suffix] No such realm "NULL" +++[suffix] returns noop [eap] No EAP-Message, not doing EAP +++[eap] returns noop [files] users: Matched entry DEFAULT at line 1 +++[files] returns ok [ldap] performing user authorization for brendan [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> brendan [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=brendan) [ldap] expand: dc=bpk2,dc=com -> dc=bpk2,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.bpk2.com:389, authentication 0 [ldap] bind as cn=Manager,dc=bpk2,dc=com/***REMOVED*** to ldap.bpk2.com:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=bpk2,dc=com, with filter (uid=brendan) [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}***REMOVED***" [ldap] sambaNtPassword -> NT-Password == ***REMOVED*** [ldap] sambaLmPassword -> LM-Password == ***REMOVED*** [ldap] looking for reply items in directory... [ldap] user brendan authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 +++[ldap] returns ok +++[expiration] returns noop +++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Normalizing SSHA1-Password from base64 encoding [pap] WARNING: Auth-Type already set. Not setting to PAP +++[pap] returns noop ++- else else returns ok Found Auth-Type = Kerberos # Executing group from file /etc/raddb/sites-enabled/default +- entering group Kerberos {...} ++[krb5] returns ok Login OK: [brendan] (from client switch port 0) # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 0 to 192.168.254.253 port 49181 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +11 Ready to process requests.

8 34

New documentation is available online
by Alan DeKok 29 Mar '14

29 Mar '14

I've been making noises about writing documentation for a long time now. Too long. However, I've had a documentation person working on the problem for a few months now, and we have something ready for release. I hope this news has a positive impact on the FreeRADIUS community. There has been a lot of discussion recently around the subject of documentation, and I'd like people to know that I have been making progress. The documentation is available online at: http://networkradius.com/doc/ The astute reader will notice that the documentation isn't GPLd, and is instead from my company. The simple reason is that it costs money to have a professional person write documentation. So the documentation has to be owned by the entity who paid for it: Network RADIUS SARL. I plan on releasing more documentation in the next few months. There are a number of additional chapters nearly ready to go. There are a number more which need a lot of work. Please provide feedback. Is it good? Are there typos? What else needs documenting? Despite the documents being corporate branded, they are available for free download, for anyone to read. The company will continue to fund development of the documentation, and will continue to release more documentation over the coming months. Alan DeKok.

4 4

FreeRadius Authorizing and Authenticating Anyone if One User Logs in
by Lennon Mazonde 29 Mar '14

29 Mar '14

Hi Lalit, > >set Port-Limit =1 attribute for user and try Tried that, but the problem still prevails. Thanks, Lennon Mazonde

1 0

Re: Freeradius-Users Digest, Vol 107, Issue 113
by Rui Ribeiro 28 Mar '14

28 Mar '14

> > Message: 4 > Date: Fri, 28 Mar 2014 08:37:29 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Why documentation is the way it is > Message-ID: <53356D09.9070101(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > > "You know, I don't want anyone else to go through the same pain I did. > So to help people like me, I'm going to write a quick howto, and put it > on the Wiki". > > No. Every single complainer cares only about their problems, and > cares nothing for anyone else. They complain that other people have to > do MORE work for them, for free. They refuse to contribute anything > themselves. It's pretty obvious after 15 years, the more someone > complains, the less they follow instructions, and the less they get done. > > Hi, I actually wrote a 100+ page wiki (in our EDUROAM federation wiki) in my native tongue Portuguese, to document my ongoing problems and provide an easy path to reconstruct my work to anybody, directed more to AD authentication+EDUROAM in the Portuguese federation. At the moment is directed to freeradius 2. I am thinking into expanding it to freeradius 3, and possibly taking the trouble to put it in iBook format, and distribute it outside of the federation. Rui F. F. Ribeiro ISCTE-IUL http://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

3 4

AIX client to MS RADIUS server
by Lloyd Gill 28 Mar '14

28 Mar '14

Hello all, Got a clean build of pam_radius_auth (v.1.3.17) on aix 6.1, but cannot get PAM configured correctly to use this version. I am now trying with source 2.2.4, but can anyone confirm this works with AIX as a client to a Microsoft RADIUS server? Our goal is multi-factor authentication using token password generators. This is working for Linux and Solaris, both environments using 1.3.17 and PAM configurations. Can someone confirm if AIX should work with this module, and for either version? Thanks, Lloyd

5 26

freeradius 3 cannot initiate eap-sim,
by Bill Yuan 28 Mar '14

28 Mar '14

(1) eap : EAP packet type response id 0 length 56 (1) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = EAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) authenticate { (1) eap : Peer sent Identity (1) (1) eap : Calling eap_sim to process EAP data *(1) eap_sim : Can't initiate EAP-SIM, no RAND1 attribute* (1) ERROR: eap : Failed starting EAP SIM (18) session. EAP sub-module failed (1) eap : Failed in EAP select (1) [eap] = invalid (1) } # authenticate = invalid (1) Failed to authenticate the user. I met this issue when I was trying to use eap-sim module in freeradius 3.0.1

3 12

configuration parameters for perl module in rlm_perl
by Cornelius Kölbel 28 Mar '14

28 Mar '14

Hi list, is there are recommended way to pass configuration parameter to a rlm_perl module? My rlm_perl module, would need to have additional configuration parameters. I would like to avoid having the perl module read an additional configuration file. Is there a possibility to add such paramters somewhere in the freeradius config like in /etc/freeradius/modules/perl and than have the perl module access these parameters? Thanks a lot and kind regards Cornelius

8 20