- Freeradius-Users - lists.freeradius.org

Freeradius 2.1.12 Second LDAP Server
by Kevin Bigalke 14 Sep '13

14 Sep '13

Hello, i`m running a Freeradius Server 2.1.12 on a Ubuntu 13.04 VM. The Login with 802.1 works perfectly. I`m using a Windows LDAP Server for the Login and want to add a second LDAP-Server for a Fail Over. I`m following the Tutorials to setup my Freeradius Server: *Click*. I`cant find a suitable Tutorial to adding a second LDAP Server for a Fail Over. Which files are responsible for the integration of a second LDAP server? These are my current Settings: /etc/freeradius/modules/ldap: ldap ldap1 { server = "serv01.xyz.local" basedn = "dc=xyz,dc=local" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no set_auth_type = no keepalive { # LDAP_OPT_X_KEEPALIVE_IDLE idle = 60 # LDAP_OPT_X_KEEPALIVE_PROBES probes = 3 # LDAP_OPT_X_KEEPALIVE_INTERVAL interval = 3 } } ldap ldap2 { server = "serv02.xyz.local" basedn = "dc=xyz,dc=local" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no set_auth_type = no keepalive { # LDAP_OPT_X_KEEPALIVE_IDLE idle = 60 # LDAP_OPT_X_KEEPALIVE_PROBES probes = 3 # LDAP_OPT_X_KEEPALIVE_INTERVAL interval = 3 } } /etc/samba/smb.conf: [global] workgroup = XYZ dns proxy = no security = ads password server = serv01.xyz.local password server = serv02.xyz.local winbind separator = + /etc/freeradius/sites-enabled/inner-tunnel: authenticate { ntlm_auth … /etc/freeradius/sites-enabled/default: authenticate { ntlm_auth … /etc/freeradius/users: DEFAULT Auth-Type = ntlm_auth Thanks for Help! BeliarsFire

5 7

FreeRadius DHCP against LDAP
by Nikolaos Milas 13 Sep '13

13 Sep '13

Hello, A couple of quick questions. 1. Is DHCP functionality supported against an LDAP Server (in v2.2.0)? 2. If so, is there a planned freeradius ldap schema change (in future versions) to include DHCP-* attributes? Please advise. Thanks, Nick

3 15

Problem with multiple groups
by Volker Lieder 13 Sep '13

13 Sep '13

Hi there, we have a setup running for ppp user on a freeradius/mysql base. We recognized that not all group values are given to the user while the login is running. After some debugging we found out, that freeradius didn't get all information from the database while its inside of the tables. Attached you find our used versions, database setting and a sql debug log from a testing user. Tested on debian 6.0.7, 2.1.10+dfsg-2+squeeze1 and debian 7.1, 2.1.12+dfsg-1.2 mysql> select * from radusergroup where username like 'dsluser%';+-----------------+------------------------------+----------+ | username | groupname | priority | +-----------------+------------------------------+----------+ | dsluser(a)realm.net | Default | 1 | | dsluser(a)realm.net | 5Uhr-Trennung | 2 | | dsluser(a)realm.net | Default_dsl-mobile.de | 1 | | dsluser(a)realm.net | PM_DSL_8000 | 1 | +-----------------+------------------------------+----------+ select * from radgroupreply where groupname='PM_DSL_8000'; +----+------------------------------+--------------+----+-------------------------------------------------------------------------+ | id | groupname | attribute | op | value | +----+------------------------------+--------------+----+-------------------------------------------------------------------------+ | 35 | PM_DSL_8000 | Cisco-AVPair | := | lcp:interface-config=service-policy output PM_DSL_8000_DSCP46_50PROZENT | +----+------------------------------+--------------+----+-------------------------------------------------------------------------+ mysql> select * from radgroupreply where groupname='Default'; +----+-----------+-----------------+----+----------------------------------+ | id | groupname | attribute | op | value | +----+-----------+-----------------+----+----------------------------------+ | 9 | Default | Framed-Protocol | = | PPP | | 10 | Default | Framed-Routing | = | None | | 11 | Default | Service-Type | = | Framed-User | | 24 | Default | Cisco-AVPair | += | lcp:interface-config=ip mtu 1492 | +----+-----------+-----------------+----+----------------------------------+ mysql> select * from radgroupreply where groupname='5Uhr-Trennung'; +----+----------------+-----------------+----+-----------------+ | id | groupname | attribute | op | value | +----+----------------+-----------------+----+-----------------+ | 2 | 5Uhr-Trennung | Session-Timeout | = | `%{expr:05:00}` | +----+----------------+-----------------+----+-----------------+ mysql> select * from radgroupreply where groupname='Default_dsl-mobile.de'; +----+--------------------------+-----------------+----+----------------------------------+ | id | groupname | attribute | op | value | +----+--------------------------+-----------------+----+----------------------------------+ | 44 | Default_dsl-mobile.de | Framed-Protocol | = | PPP | | 45 | Default_dsl-mobile.de | Framed-Routing | = | None | | 46 | Default_dsl-mobile.de | Service-Type | = | Framed-User | | 48 | Default_dsl-mobile.de | Cisco-AVPair | += | lcp:interface-config=ip mtu 1448 | +----+--------------------------+-----------------+----+----------------------------------+ Output from "/usr/sbin/freeradius -d /etc/freeradius -X -f" and a new dsl login try: [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dsluser(a)realm.net' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dsluser(a)realm.net' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'dsluser(a)realm.net' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'dsluser(a)realm.net' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'Default' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'Default' ORDER BY id Invalid operator for item Framed-Protocol: reverting to '==' [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'Default_dsl-mobile.de' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'Default_dsl-mobile.de' ORDER BY id Invalid operator for item Framed-Protocol: reverting to '==' [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'PM_DSL_8000' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupreply WHERE groupname = 'PM_DSL_8000' ORDER BY id [sql] User found in group PM_DSL_8000 [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'PM_DSL_8000' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'PM_DSL_8000' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok As you can see, the radius didn't get infos about the group 5Uhr-Trennung and the group PM_DSL_8000 seems to be there two times. It doesn't matter on what position a group is, we can reproduce it with any settings. Any idea or restrictions known, why freeradius won't lookup all groups? Or any hint, what to test? Regards, Volker

1 0

unsubscribe
by Romeo Mihalcea 13 Sep '13

13 Sep '13

unsubscribe

2 1

Building FreeRadius with custom LDAP libraries
by Nikolaos Milas 12 Sep '13

12 Sep '13

Hello, I am trying to use http://www.packetfence.org/downloads/PacketFence/freeradius/freeradius-2.2.… to create custom FreeRadius RPMs for RHEL/CentOS 6. The main aim is to add --with-dhcp compile option which is not included in the standard build. The secondary aim is to build using custom ldap libraries, because we are using LTB OpenLDAP RPM packages (http://ltb-project.org/wiki/download#openldap) The libraries as installed by these RPM packages are in /usr/local/openldap/lib64/ and /usr/local/openldap/include/ In the src.rpm I see: BuildRequires: openldap-devel which I can change to: BuildRequires: openldap-ltb-debuginfo but how can I define custom LDAP libraries? Can I use something like: export CPPFLAGS="${CPPFLAGS} -I/usr/local/openldap/include" export LDFLAGS="${LDFLAGS} -L/usr/local/openldap/lib64" ...as we do for building Dovecot, or CXXFLAGS="${CXXFLAGS} -I/usr/local/openldap/include"; export CXXFLAGS LDFLAGS="${LDFLAGS} -L/usr/local/openldap/lib64 -lldap -llber -R/usr/local/openldap/lib64"; export LDFLAGS ...as we do for building PowerDNS? ( We have found the above for other software after significant effort. I hope it'll be easier with FreeRadius! :-) ) Please advise! Thanks, Nick

4 6

Replicating to multiple servers.
by Cooper, Tom 12 Sep '13

12 Sep '13

Hi all, How can I replicate to more than 1 server? I have set up replication to one host, but when I set up a second host it does not replicate to it. However the first host works perfectly. I am using freeradius-2.2.0-1 This is what I have in my proxy.conf file. home_server ALOTT-SMP { type = acct ipaddr = 192.168.xx.xx port = 1813 secret = xxxxxxxx src_ipaddr = 192.168.xx.xx require_message_authenticator = no response_window = 4 zombie_period = 40 status_check = status-server check_interval = 30 num_answers_to_alive = 3 max_outstanding = 65536 } home_server_pool ALLOT-SMP { # type = fail-over home_server = ALOTT-SMP } home_server PROCERA-SMP { type = acct ipaddr = 192.168.xx.xx port = 1813 secret = xxxxxxx src_ipaddr = 192.168.xx.xx require_message_authenticator = no response_window = 4 zombie_period = 40 status_check = status-server check_interval = 30 num_answers_to_alive = 3 max_outstanding = 65536 } home_server_pool PROCERA-SMP { type = fail-over home_server = PROCERA-SMP } realm example.com { authhost = LOCAL accthost = LOCAL type = radius preacct { update control { #Replicate-To-Realm := 'ALLOT-SMP' Proxy-To-Realm := 'ALLOT-SMP' Proxy-To-Realm += 'PROCERA-SMP' } } accounting { replicate } } To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

2 4

free radius setup
by Swenson, Chris 11 Sep '13

11 Sep '13

I understand a bit more why people were bring up plain text passwords now. My radius server is being presented with peap ms-chapV2 credentials and I want it to receive authentication from my openldap server. It seems that the credentials in this format cannot be digested by openldap and acknowledged. The passwords in my openldap are encrypted as SHA Do I have this right? Is there an alternative. Maybe that FreeRadius 3.0.0 rc1 mentioned in one of the emails the other day? Thanks for your attention

5 9

radclient error
by Mehdi Ravanbakhsh 11 Sep '13

11 Sep '13

Hi All I have this Error when using radclient: radclient: Nothing to send. radclient:: Expected end of line or comma I do not know what is means ? (radclient is run by PlPerl script in my postgresql database engine) Best regards.

2 2

Debug show cleartext password
by Marco Aresu 11 Sep '13

11 Sep '13

Hi All i am getting a problem on Freeradius installed on CentOS. When i set the service Radiusd in debug mode and send an access request (default type PAP) through Radtest the debug show the password in cleartext. Is there an option to do not show the fiedl User-Password in cleartext? Many Thanks Marco Aresu

3 4

Re: sql_counter module doesn't count
by Russell Mike 10 Sep '13

10 Sep '13

Hi, I am willing to help, What kind of NAS do you use? Does your NAS support accounting ? Thanks RM -- On Mon, Aug 12, 2013 at 9:50 PM, lucia <j.eskobar(a)gmx.de> wrote: > Thanks for quick reply, > > well I guess not. Can you give me a hint how I can figure it out how I can > configure this ? > > I'm I right that I have to configure the accounting in the RADIUS > conf-files or is it part of the NAS it self. > Well OK I had a look into Wikipedia RADIUS and it looks like it is part of > the NAS. > But I do not find any comments via google about Synology and accounting.... > > I'm a bit confused now ... > > Regards, > Lu > > > > > > On 12.08.2013 23:34, Alan Buxey wrote: > > Hi > > That's just an authentication request.... accounting packets is what you > need. Is your kit configured to send accounting to this RADIUS server? > > alan > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0