Newbie questions for freeradius
I am looking into using freeradius here for multiple client setups and I'm learning as I go. My configuration is CentOS 7, and freeradius 3.0.13 - straight from the CentOS repos. I have 2 different setups, one using the normal flat files, and one using mysql. So my first problem. The flat file machine. It rejects every request. And I have just the most basic example from the FreeRadius Beginners Guide. That is actually written for FreeRadius 2.0 , it could be a problem. All configs are stock, I just created clients.conf client localhost { ipaddr = 127.0.0.1 secret = testing123 require_message_authenticator = no nastype = other } And users "alice" Cleartext-Password := "passme" Framed-IP-Address = 192.168.0.65 Reply-Message = "Hello, %{User-Name}" It looks like it isn't finding alice: Ready to process requests (0) Received Access-Request Id 109 from 127.0.0.1:50213 to 127.0.0.1:1812 length 75 (0) User-Name = "alice" (0) User-Password = "passme" (0) NAS-IP-Address = 127.0.0.1 (0) NAS-Port = 100 (0) Message-Authenticator = 0x6a97c763afbc595a33152977c6df6fb7 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /@\./) { (0) if (&User-Name =~ /@\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "alice", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> alice (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 109 from 127.0.0.1:1812 to 127.0.0.1:50213 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 109 with timestamp +4 Ready to process requests So does that mean the server isn't seeing the users file? Or do I have to put alice in a group? The second question. The mysql instance is working better, following directions from daloradius, I've got it working for users that aren't in User-groups. With various clients: radtest locally radtest on a second system NTRadPing from a windows 10 box
From a Cisco switch with AAA authentication.
What I need though, is to authenticate from a cisco (and probably other vendors) machines to a group. There will be groups of NASes that need to authenticate to specific groups inside radius. And maybe multiple groups (one group and users that aren't in a group would probably be acceptable). Does that make sense? I don't understand the difference in daloradius between "User-Groups", "Profiles", "HuntGroups", and "Realms". Thanks, Paul. Paul Root Lead Operations Engineer - IT Managed Services 390 Commerce Dr Woodbury, Mn 55125 651-312-5207 paul.root@centurylink.com This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.
On Jul 2, 2019, at 11:24 PM, Root, Paul T <Paul.Root@CenturyLink.com> wrote:
I am looking into using freeradius here for multiple client setups and I'm learning as I go.
My configuration is CentOS 7, and freeradius 3.0.13 - straight from the CentOS repos.
I have 2 different setups, one using the normal flat files, and one using mysql.
So my first problem. The flat file machine. It rejects every request. And I have just the most basic example from the FreeRadius Beginners Guide. That is actually written for FreeRadius 2.0 , it could be a problem.
You're editing file A. The server is reading file B. Read the debug output to see what he "files" module is doing. It will print out the name of the file it's reading. Then, edit that file.
The mysql instance is working better, following directions from daloradius, I've got it working for users that aren't in User-groups. With various clients: radtest locally radtest on a second system NTRadPing from a windows 10 box From a Cisco switch with AAA authentication.
What I need though, is to authenticate from a cisco (and probably other vendors) machines to a group. There will be groups of NASes that need to authenticate to specific groups inside radius. And maybe multiple groups (one group and users that aren't in a group would probably be acceptable).
Does that make sense? I don't understand the difference in daloradius between "User-Groups", "Profiles", "HuntGroups", and "Realms".
Huntgroups are historically groups of NASes or lines for telephone numbers. Realm are domain names. Ignore the rest. FreeRADIUS uses databases for group membership. You can create a custom file-based group list with the "passwd" module. See mods-available/etc_group for an example. You can change the attribute name from "Etc-Group-Name" to "NAS-Group", and then point the "filename" to a local file that you create. e.g. passwd nas_group { filename = ${confdir}/nas_group format = "=NAS-Group-Name:::*,NAS-IP-Address" hash_size = 50 ignore_nislike = yes allow_multiple_keys = yes delimiter = ":" } Also add "NAS-Group-Name" to the dictionary, too. Then create a "nas_group" file in the configuration directory. Use the same format as /etc/groups, but use IP addresses instead of names. Then add it to the "authorize" section: authorize { nas_group ... } And after the "nas_group" module runs, you can do things like: if (NAS-Group == "named-group") { ... stuff ... } and it will match. You can do the same with other modules / files / attributed. Alan DeKok.
Ah, that was it for the first one. I moved users out of the way and made my own, so it would be simple. The users was actually a symbolic link to ./mod-config/files/authorize. Thanks for the response. Paul. -----Original Message----- From: Freeradius-Users <freeradius-users-bounces+paul.root=centurylink.com@lists.freeradius.org> On Behalf Of Alan DeKok Sent: Wednesday, July 03, 2019 1:41 AM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Newbie questions for freeradius On Jul 2, 2019, at 11:24 PM, Root, Paul T <Paul.Root@CenturyLink.com> wrote:
I am looking into using freeradius here for multiple client setups and I'm learning as I go.
My configuration is CentOS 7, and freeradius 3.0.13 - straight from the CentOS repos.
I have 2 different setups, one using the normal flat files, and one using mysql.
So my first problem. The flat file machine. It rejects every request. And I have just the most basic example from the FreeRadius Beginners Guide. That is actually written for FreeRadius 2.0 , it could be a problem.
You're editing file A. The server is reading file B. Read the debug output to see what he "files" module is doing. It will print out the name of the file it's reading. Then, edit that file.
The mysql instance is working better, following directions from daloradius, I've got it working for users that aren't in User-groups. With various clients: radtest locally radtest on a second system NTRadPing from a windows 10 box From a Cisco switch with AAA authentication.
What I need though, is to authenticate from a cisco (and probably other vendors) machines to a group. There will be groups of NASes that need to authenticate to specific groups inside radius. And maybe multiple groups (one group and users that aren't in a group would probably be acceptable).
Does that make sense? I don't understand the difference in daloradius between "User-Groups", "Profiles", "HuntGroups", and "Realms".
Huntgroups are historically groups of NASes or lines for telephone numbers. Realm are domain names. Ignore the rest. FreeRADIUS uses databases for group membership. You can create a custom file-based group list with the "passwd" module. See mods-available/etc_group for an example. You can change the attribute name from "Etc-Group-Name" to "NAS-Group", and then point the "filename" to a local file that you create. e.g. passwd nas_group { filename = ${confdir}/nas_group format = "=NAS-Group-Name:::*,NAS-IP-Address" hash_size = 50 ignore_nislike = yes allow_multiple_keys = yes delimiter = ":" } Also add "NAS-Group-Name" to the dictionary, too. Then create a "nas_group" file in the configuration directory. Use the same format as /etc/groups, but use IP addresses instead of names. Then add it to the "authorize" section: authorize { nas_group ... } And after the "nas_group" module runs, you can do things like: if (NAS-Group == "named-group") { ... stuff ... } and it will match. You can do the same with other modules / files / attributed. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.
participants (2)
-
Alan DeKok -
Root, Paul T