Thank you Alan DeKok. I will go recheck my configs! ________________________________ From: Freeradius-Users <freeradius-users-bounces+kevin.virk=faithlife.com@lists.freeradius.org> on behalf of freeradius-users-request@lists.freeradius.org <freeradius-users-request@lists.freeradius.org> Sent: Wednesday, August 8, 2018 3:00 AM To: freeradius-users@lists.freeradius.org Subject: Freeradius-Users Digest, Vol 160, Issue 10 Send Freeradius-Users mailing list submissions to freeradius-users@lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users<http://lists.freeradius.org/mailman/listinfo/freeradius-users> or, via email, send a message with subject or body 'help' to freeradius-users-request@lists.freeradius.org You can reach the person managing the list at freeradius-users-owner@lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Dynamic vlan assignment (Deepak Sehrawat) 2. Re: Dynamic vlan assignment (Alan DeKok) 3. Re: ldap module for user and mac authentication (Alan DeKok) 4. Re: ldap module for user and mac authentication (Dave Macias) 5. Accounting-Request packet shared secret fail (Kevin Virk) 6. Re: Accounting-Request packet shared secret fail (Alan DeKok) ---------------------------------------------------------------------- Message: 1 Date: Tue, 7 Aug 2018 22:38:47 +0530 From: Deepak Sehrawat <d.sehrawat@gmail.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Dynamic vlan assignment Message-ID: <A1C9AE51-ED3D-4394-9887-274F1A2F210B@gmail.com> Content-Type: text/plain; charset=us-ascii Can we configure it via MySQL as well?
On 07-Aug-2018, at 5:19 PM, Elias Pereira <empbilly@gmail.com> wrote:
You can configure it in the post-auth option of the sites-enable/default configuration file.
E.g:
... ldap if (Ldap-Group == "CN=ADM,OU=GRUPOS,DC=mycompany,DC=intra") { update reply { &Tunnel-Type = VLAN &Tunnel-Medium-Type = IEEE-802 &Tunnel-Private-Group-Id = "51" } } elsif (Ldap-Group == "CN=ALUNOS,OU=GRUPOS,DC=mycompany,DC=intra") { update reply { &Tunnel-Type = VLAN &Tunnel-Medium-Type = IEEE-802 &Tunnel-Private-Group-Id = "40" elseif ... ...
On Tue, Aug 7, 2018 at 8:05 AM aseem kaushal <aseemkaushal91@gmail.com> wrote:
Need to configure freeradius for dynamic vlan assignment. What could be the various methods for the above. Thanks in advance.
Regards -Aseem Kaushal - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<http://www.freeradius.org/list/users.html>
-- Elias Pereira - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<http://www.freeradius.org/list/users.html>
------------------------------ Message: 2 Date: Tue, 7 Aug 2018 14:16:32 -0400 From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Dynamic vlan assignment Message-ID: <EC8BA115-117B-408F-ADB3-C81489452CA3@deployingradius.com> Content-Type: text/plain; charset=us-ascii On Aug 7, 2018, at 1:08 PM, Deepak Sehrawat <d.sehrawat@gmail.com> wrote:
Can we configure it via MySQL as well?
The documentation has lots of information on how the SQL module works. Read it. Ask questions if you don't understand. Alan DeKok. ------------------------------ Message: 3 Date: Tue, 7 Aug 2018 15:08:48 -0400 From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: ldap module for user and mac authentication Message-ID: <76519810-BEB1-40AC-A1E2-A3E6FA28B6E6@deployingradius.com> Content-Type: text/plain; charset=us-ascii On Aug 7, 2018, at 11:50 AM, Dave Macias <davama@gmail.com> wrote:
On the SLAVE, I am able to use the ldap module to auth a mac address On the MASTER, i am also able to auth a mac but by doing something like the links below: http://lists.freeradius.org/pipermail/freeradius-users/2015-April/076948.html<http://lists.freeradius.org/pipermail/freeradius-users/2015-April/076948.html> http://lists.freeradius.org/pipermail/freeradius-users/2018-August/092319.html<http://lists.freeradius.org/pipermail/freeradius-users/2018-August/092319.html>
Is there a way on the MASTER to use the ldap module to also auth macs?
You can do any kind of LDAP query in FreeRADIUS. Why not just do the same %{ldap:...} checks there? Alan DeKok. ------------------------------ Message: 4 Date: Tue, 7 Aug 2018 16:04:10 -0400 From: Dave Macias <davama@gmail.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: ldap module for user and mac authentication Message-ID: <CA+nFYV-f2c+ZB4k7WxPf_tznrc3hdRb_WB+DCTAzqvT7Y6D_oA@mail.gmail.com> Content-Type: text/plain; charset="UTF-8" Thank you for the reply Alan!
You can do any kind of LDAP query in FreeRADIUS. Why not just do the same %{ldap:...} checks there?
Yes, I had thought of something to the effect of (suggestions welcomed) : * if (!"%{ldap:ldap://master1/ou=%{client:shortname},ou=macs,dc=myorg,dc=net?cn?sub?(* *&(objectClass=ieee802Device)(macAddress=%{Calling-Station-Id}))}") {* * if (!"%{ldap:ldap://master2/ou=%{client:shortname},ou=macs,dc=myorg,dc=net?c* *n?sub?(&(objectClass=ieee802Device)(macAddress=%{Calling-Station-Id}))}") {* * reject* * }* * }* * update {* * control:Auth-Type := Accept* * }* But this does not account for the scenario of openldap being dead. The 1st "if" statement will be always be FALSE and never attempt the next "if" statement and therefore 'Accept' We currently use do_not_respond in conjunction with the ldap module so that radius never response if openldap it were down http://lists.freeradius.org/pipermail/freeradius-users/2018-May/091477.html<http://lists.freeradius.org/pipermail/freeradius-users/2018-May/091477.html> The nice feature of the module is that you can configure multiple ldap servers. If one fails then it will automatically try the next and so forth. *mods-enabled/ldap* *ldap {* *server = host1 # <- this one is dead* *server = host2 # <- this one is alive so use this one in the query* *...* *}* Unless there is a way to query the "live" ldap server which the ldap module found %{ldap:ldap://%{live.ldap.server}/...} , if that makes sense Thanks! ------------------------------ Message: 5 Date: Tue, 7 Aug 2018 22:04:17 +0000 From: Kevin Virk <Kevin.Virk@faithlife.com> To: "freeradius-users@lists.freeradius.org" <freeradius-users@lists.freeradius.org> Subject: Accounting-Request packet shared secret fail Message-ID: <1533679457716.32160@faithlife.com> Content-Type: text/plain; charset=WINDOWS-1252 I am having an issue with configuring my cisco switch to authenticate with freeradius. My secret is the same on both sides but I keep getting error that the shared secret is not correct. I did a tcpdump of the traffic and then opened in wireshark to see. The password is coming through encrypted as I would suspect. Could this encrypted password be the reason that I am not able to authenticate. Side note: Using wpa supplicant and eapol_test I was able to get a successful test. Only non success is this cisco switch. ready to process requests. rad_recv: Accounting-Request packet from host 172.17.17.227 port 49181, id=0, length=97 Received Accounting-Request packet from client 172.17.17.227 with invalid Request Authenticator! (Shared secret is incorrect.) Dropping packet without response ------------------------------ Message: 6 Date: Tue, 7 Aug 2018 18:24:30 -0400 From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Accounting-Request packet shared secret fail Message-ID: <D7FE269D-82BB-4365-A2A5-170524AF30E2@deployingradius.com> Content-Type: text/plain; charset=us-ascii On Aug 7, 2018, at 6:04 PM, Kevin Virk <Kevin.Virk@faithlife.com> wrote:
I am having an issue with configuring my cisco switch to authenticate with freeradius. My secret is the same on both sides but I keep getting error that the shared secret is not correct.
Then the shared secret isn't correct.
I did a tcpdump of the traffic and then opened in wireshark to see. The password is coming through encrypted as I would suspect. Could this encrypted password be the reason that I am not able to authenticate.
The password is encrypted with the shared secret. If the shared secret is wrong, then FreeRADIUS can't decrypt the password.
Side note: Using wpa supplicant and eapol_test I was able to get a successful test. Only non success is this cisco switch.
Likely because they're using different IP addresses. Are you editing the "client" configuration for the Cisco switch? Have you tried setting the shared secret to something like "hello" ? TBH, your choices here are: a) the Cisco firmware works for everyone else, but not for you b) FreeRADIUS works for everyone else, but not for you c) you're entering the wrong shared secret, or maybe the correct shared secret, but in the wrong place. Alan DeKok. ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<http://www.freeradius.org/list/users.html> ------------------------------ End of Freeradius-Users Digest, Vol 160, Issue 10 *************************************************