Hello, I just got Freeradius running on Ubuntu and have successfully configured integration Active Directory using Samba and NTLM_AUTH. When I run "radtest" against Freeradius and put in AD credentials, it is successful. My next goal is to configure Freeradius to assign 802.1X VLANs for a wireless environment. In other words, users who are a member of ADGROUP1 get assigned vlan # 111, and users who are a member of ADGROUP2 get assigned vlan #222. I am unclear which direction to go to accomplish this. Any help would be greatly appreciated. Thanks much Mike Whitlow
We are actually looking into doing the same thing. Although we are probably going to add a custom attribute that we can set to the vlan of our choice, that way we can find the vlan by a simple ldap query without adding complex logic to the server. This to us seems the simplest route. It is worth noting that we do not have this in production yet so I cannot vouch for its real world effectiveness. As for getting the ldap query to work, you have already done the hard part. Once your server is able to auth users via ntlm the difficult part is over. We have setup a special account that has almost no privileges, only access to search AD. We use this account to interact with AD. If I remember correct deployingradius.com has an excellent walk through on the initial setup, I would try there for initial config instructions. Jake Sallee Godfather of Bandwidth System Engineer University of Mary Hardin-Baylor 900 College St. Belton, Texas 76513 Fone: 254-295-4658 Phax: 254-295-4221 From: freeradius-users-bounces+jake.sallee=umhb.edu@lists.freeradius.org [mailto:freeradius-users-bounces+jake.sallee=umhb.edu@lists.freeradius.org] On Behalf Of Whitlow, Michael Sent: Friday, October 28, 2011 3:18 PM To: freeradius-users@lists.freeradius.org Subject: AD integration Hello, I just got Freeradius running on Ubuntu and have successfully configured integration Active Directory using Samba and NTLM_AUTH. When I run "radtest" against Freeradius and put in AD credentials, it is successful. My next goal is to configure Freeradius to assign 802.1X VLANs for a wireless environment. In other words, users who are a member of ADGROUP1 get assigned vlan # 111, and users who are a member of ADGROUP2 get assigned vlan #222. I am unclear which direction to go to accomplish this. Any help would be greatly appreciated. Thanks much Mike Whitlow
Jake, Thanks for the reply. Much appreciated. I have worked on this more and from what I have learned I need to configure the "users" file properly. I have a feeling that if I could figure out exactly what I need to put in there I would be in business. I just can't seem to find exactly what I need to do in there to identify AD groups and provide the right IEEE tags to the client. Mike ________________________________ From: freeradius-users-bounces+mwhitlow=bumail.bradley.edu@lists.freeradius.org on behalf of Sallee, Stephen (Jake) Sent: Fri 10/28/2011 3:39 PM To: FreeRadius users mailing list Subject: RE: AD integration We are actually looking into doing the same thing. Although we are probably going to add a custom attribute that we can set to the vlan of our choice, that way we can find the vlan by a simple ldap query without adding complex logic to the server. This to us seems the simplest route. It is worth noting that we do not have this in production yet so I cannot vouch for its real world effectiveness. As for getting the ldap query to work, you have already done the hard part. Once your server is able to auth users via ntlm the difficult part is over. We have setup a special account that has almost no privileges, only access to search AD. We use this account to interact with AD. If I remember correct deployingradius.com has an excellent walk through on the initial setup, I would try there for initial config instructions. Jake Sallee Godfather of Bandwidth System Engineer University of Mary Hardin-Baylor 900 College St. Belton, Texas 76513 Fone: 254-295-4658 Phax: 254-295-4221 From: freeradius-users-bounces+jake.sallee=umhb.edu@lists.freeradius.org [mailto:freeradius-users-bounces+jake.sallee=umhb.edu@lists.freeradius.org] On Behalf Of Whitlow, Michael Sent: Friday, October 28, 2011 3:18 PM To: freeradius-users@lists.freeradius.org Subject: AD integration Hello, I just got Freeradius running on Ubuntu and have successfully configured integration Active Directory using Samba and NTLM_AUTH. When I run "radtest" against Freeradius and put in AD credentials, it is successful. My next goal is to configure Freeradius to assign 802.1X VLANs for a wireless environment. In other words, users who are a member of ADGROUP1 get assigned vlan # 111, and users who are a member of ADGROUP2 get assigned vlan #222. I am unclear which direction to go to accomplish this. Any help would be greatly appreciated. Thanks much Mike Whitlow
On 10/29/2011 08:17 PM, Whitlow, Michael wrote:
Jake,
Thanks for the reply. Much appreciated.
I have worked on this more and from what I have learned I need to configure the "users" file properly. I have a feeling that if I could figure out exactly what I need to put in there I would be in business. I just can't seem to find exactly what I need to do in there to identify AD groups and provide the right IEEE tags to the client.
Something like: DEFAULT Ldap-Group == STAFF Tunnel-Type := VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id := 123, Fall-Through := No DEFAULT Ldap-Group == GUEST Tunnel-Type := VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id := 456, Fall-Through := No ...but of course you need to have configured "modules/ldap" correctly for this to work.
On 10/28/2011 09:18 PM, Whitlow, Michael wrote:
Hello,
I just got Freeradius running on Ubuntu and have successfully configured integration Active Directory using Samba and NTLM_AUTH.
When I run “radtest” against Freeradius and put in AD credentials, it is successful.
Word of caution: radtest does not do EAP authentication, so you're not testing the full authentication path. You may want to download the "wpa_supplicant" sources and do a "make eapol_test" and use that to verify.
My next goal is to configure Freeradius to assign 802.1X VLANs for a wireless environment.
In other words, users who are a member of ADGROUP1 get assigned vlan # 111, and users who are a member of ADGROUP2 get assigned vlan #222.
I am unclear which direction to go to accomplish this.
Unclear in what respect, precisely? If you're asking "how do I lookup a users AD groups", there are several possible ways. A lot of people do it via the "ldap" module. If you're asking something else, please specify.
Whitlow, Michael wrote:
I just got Freeradius running on Ubuntu and have successfully configured integration Active Directory using Samba and NTLM_AUTH.
That's good to hear.
When I run “radtest” against Freeradius and put in AD credentials, it is successful.
Good...
In other words, users who are a member of ADGROUP1 get assigned vlan # 111, and users who are a member of ADGROUP2 get assigned vlan #222.
Configure Active Directory as an LDAP server. See raddb/modules/ldap. List "ldap" in radius.conf, "instantiate" section Then in the "users" file, do: DEFAULT LDAP-Group == "adgroup1" ... set VLAN 1... DEFAULT LDAP-Group == "adgroup2" ... set VLAN 2 ... Alan DeKok.
Ciao. Just wondering if FR supports IPv6 addresses since I'm unable to start the server when using IPv6. I've changed (or uncommented) a couple of lines in radiusd.conf under 'listen' section: ipv6addr = :: and then I tried to start the server but no way. It works ok when using IPv4. FR spits out: Failed binding to authentication address 0:0: .... port 1812: Bad file descriptor. FR server has been built with IPv6 support. Another question is: are you aware of any (client) tool for testing FR when using IPv6 addresses? eapol_test doesn't seem to know anything about :: or ::1 Do the below lines from radiusd.conf require any change when IPv6? ... ... detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d.log } ... ... Sorry about asking many questions at the same time but they're all related. Sergio.
On Mon, Oct 31, 2011 at 3:11 PM, Sergio NNX <sfhacker@hotmail.com> wrote:
Ciao.
Just wondering if FR supports IPv6 addresses
Sure it does. If you want it to listen on both ipv4 and ipv6, just add extra "listen" blocks listen { ipv6addr = :: port = 0 type = auth } listen { ipv6addr = :: port = 0 type = acct } ... which would result in something like this on debug log Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address :: port 1812 Listening on accounting address :: port 1813
since I'm unable to start the server when using IPv6.
You should be. Just to be safe, use latest version (I'm using 2.1.12)
I've changed (or uncommented) a couple of lines in radiusd.conf under 'listen' section: ipv6addr = :: and then I tried to start the server but no way. It works ok when using IPv4.
You might want to add listen blocks instead of editing them.
FR spits out: Failed binding to authentication address 0:0: .... port 1812: Bad file descriptor. FR server has been built with IPv6 support.
Another question is: are you aware of any (client) tool for testing FR when using IPv6 addresses? eapol_test doesn't seem to know anything about :: or ::1
Ask wpa_supplicant developers :) FR's radtest/radclient has both ipv4 and v6 support. So you can do something like $ radtest -4 testuser testpass localhost 0 testing123 $ radtest -6 testuser testpass localhost 0 testing123 ... which would test ipv4 and ipv6 address of localhost (assuming your /etc/hosts is set correctly)
Do the below lines from radiusd.conf require any change when IPv6?
... ... detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d.log }
Probably. FreeRADIUS-Client-IPv6-Address? I use sql, and hardcode detailfile path when necessary (e.g. when using buffered-sql) -- Fajar
Hi,
Just wondering if FR supports IPv6 addresses since I'm unable to start the server when using IPv6.
yes. we use it fine with IPv6 - both receiving and sending RADIUS packets.
Another question is: are you aware of any (client) tool for testing FR when using IPv6 addresses? eapol_test doesn't seem to know anything about :: or ::1
eapol_test - use hostnames (eg in /etc/hosts ?) ?
Do the below lines from radiusd.conf require any change when IPv6?
... ... detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d.log
yes, Client-IP-Address doesnt exist in IPv6 world - you can use one of the source address attributes instead
Thank you all for your help. I added two more listen blocks in radiusd.conf and I updated detail { ... with the following: %{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} and it works but ..... (there's always a but). if we use an IPv6 address, then Packet-Src-APv6-Address value will be, for instance, 0:0:0:0:0:0:0:0, and the path becomes : ${radacctdir}/0:0:0:0:0:0:0:0/detail-%Y%m%d.log but FR crashes since it cannot create a folder with that name. Is there any way of overcoming this issue? replace : with . or so??? Thanks again for your help. Sergio.
Date: Mon, 31 Oct 2011 08:52:46 +0000 From: A.L.M.Buxey@lboro.ac.uk To: freeradius-users@lists.freeradius.org Subject: Re: IPv6 ready?
Hi,
Just wondering if FR supports IPv6 addresses since I'm unable to start the server when using IPv6.
yes. we use it fine with IPv6 - both receiving and sending RADIUS packets.
Another question is: are you aware of any (client) tool for testing FR when using IPv6 addresses? eapol_test doesn't seem to know anything about :: or ::1
eapol_test - use hostnames (eg in /etc/hosts ?) ?
Do the below lines from radiusd.conf require any change when IPv6?
... ... detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d.log
yes, Client-IP-Address doesnt exist in IPv6 world - you can use one of the source address attributes instead
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 31/10/11 15:32, Sergio NNX wrote:
Thank you all for your help. I added two more listen blocks in radiusd.conf and I updated detail { ... with the following: %{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} and it works but ..... (there's always a but). if we use an IPv6 address, then Packet-Src-APv6-Address value will be, for instance, 0:0:0:0:0:0:0:0, and the path becomes :
${radacctdir}/0:0:0:0:0:0:0:0/detail-%Y%m%d.log
but FR crashes since it cannot create a folder with that name. Is there any way of overcoming this issue? replace : with . or so???
Really? Which OS? There's no built-in xlat that allows you to do a substitute; you'll have to use rlm_perl or rlm_python, or an exec script, to translate the name.
Thanks Phil. Can you try 'mkdir 0:0:0:0:0:0:0:0' on a Windows box and let mw know if it works?
Date: Mon, 31 Oct 2011 15:46:47 +0000 From: p.mayers@imperial.ac.uk To: freeradius-users@lists.freeradius.org Subject: Re: IPv6 ready?
On 31/10/11 15:32, Sergio NNX wrote:
Thank you all for your help. I added two more listen blocks in radiusd.conf and I updated detail { ... with the following: %{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} and it works but ..... (there's always a but). if we use an IPv6 address, then Packet-Src-APv6-Address value will be, for instance, 0:0:0:0:0:0:0:0, and the path becomes :
${radacctdir}/0:0:0:0:0:0:0:0/detail-%Y%m%d.log
but FR crashes since it cannot create a folder with that name. Is there any way of overcoming this issue? replace : with . or so???
Really? Which OS?
There's no built-in xlat that allows you to do a substitute; you'll have to use rlm_perl or rlm_python, or an exec script, to translate the name. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Cool, what can i do about it? I'm new to FR so I don't know how to implement a rule or something like that. Can you provide an example or an url where I can find more info? Cheers.
Date: Mon, 31 Oct 2011 16:08:21 +0000 From: p.mayers@imperial.ac.uk To: freeradius-users@lists.freeradius.org Subject: Re: IPv6 ready?
On 31/10/11 15:58, Sergio NNX wrote:
Thanks Phil. Can you try 'mkdir 0:0:0:0:0:0:0:0' on a Windows box and let mw know if it works?
I can tell you for absolute certain it won't without even having to try. It's a Windows limitation. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mon, Oct 31, 2011 at 11:19 PM, Sergio NNX <sfhacker@hotmail.com> wrote:
Cool, what can i do about it? I'm new to FR so I don't know how to implement a rule or something like that. Can you provide an example or an url where I can find more info?
Just edit them. You could put everyting on one file per day: detailfile = ${radacctdir}/detail-%Y%m%d.log ... or better yet, don't use detail if you don't really need it. Use sql instead (which is useful for other things like simultaneous use check, counters, etc) -- Fajar
On 31/10/11 16:19, Sergio NNX wrote:
Cool, what can i do about it? I'm new to FR so I don't know how to
Personally I'd advise running it on a Unix system at the moment.
implement a rule or something like that. Can you provide an example or an url where I can find more info?
wiki.freeradius.org? The docs that come with the server?
Thanks for all your ideas and suggestions. I'm trying to 'patch' (sorry for this) rlm_detail and replace all ':' with '.' (obviously, when on Windows). I'll try sql as well. Let's keep in touch.
Date: Mon, 31 Oct 2011 17:02:36 +0000 From: p.mayers@imperial.ac.uk To: freeradius-users@lists.freeradius.org Subject: Re: IPv6 ready?
On 31/10/11 16:19, Sergio NNX wrote:
Cool, what can i do about it? I'm new to FR so I don't know how to
Personally I'd advise running it on a Unix system at the moment.
implement a rule or something like that. Can you provide an example or an url where I can find more info?
wiki.freeradius.org?
The docs that come with the server? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 2011/10/31 05:58 PM, Sergio NNX wrote:
Thanks Phil. Can you try 'mkdir 0:0:0:0:0:0:0:0' on a Windows box and let mw know if it works?
C:\junk>mkdir 0:0:0:0:0:0:0:0 The system cannot find the drive specified. C:\junk>mkdir '0:0:0:0:0:0:0:0' The filename, directory name, or volume label syntax is incorrect. C:\junk>mkdir "0:0:0:0:0:0:0:0" The system cannot find the drive specified. C:\junk>mkdir 0\:0\:0\:0\:0\:0\:0\:0 The filename, directory name, or volume label syntax is incorrect. Why not simply remove the Ip address from the log path? Do they HAVE to be in directories with the IP address as part of the name? Cheers, -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782 -------------------- Before acting on this email or opening any attachments you should read Cape PC Service's email disclaimer at: http://www.pcservices.co.za/disclaimer.html
Sergio NNX wrote:
Thank you all for your help. I added two more listen blocks in radiusd.conf and I updated detail { ... with the following: %{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} and it works but ..... (there's always a but). if we use an IPv6 address, then Packet-Src-APv6-Address value will be, for instance, 0:0:0:0:0:0:0:0, and the path becomes :
${radacctdir}/0:0:0:0:0:0:0:0/detail-%Y%m%d.log
but FR crashes since it cannot create a folder with that name. Is there any way of overcoming this issue? replace : with . or so???
If it crashes, see doc/BUGS If it doesn't crash, report the *real* error. Alan DeKok.
Hi,
Thank you all for your help. I added two more listen blocks in radiusd.conf and I updated detail { ... with the following: %{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} and it works but ..... (there's always a but). if we use an IPv6 address, then Packet-Src-APv6-Address value will be, for instance, 0:0:0:0:0:0:0:0, and the path becomes :
${radacctdir}/0:0:0:0:0:0:0:0/detail-%Y%m%d.log
but FR crashes since it cannot create a folder with that name. Is there any way of overcoming this issue? replace : with . or so???
well, you asked how it could be done..you didnt say you were trying this on Windows! whats the next surprise? I would do something like use PERL to make %{Packet-Src-IPv6-Address} become sanitized..... eg assign %{Tmp-String-0} and use SED to swap : with - this means no single source code line change and easily adaptable to whatever else you might come across.... then use simly use %{Tmp-String-0} in your detail module config.... alan
participants (8)
-
Alan Buxey -
Alan DeKok -
Fajar A. Nugraha -
Johan Meiring -
Phil Mayers -
Sallee, Stephen (Jake) -
Sergio NNX -
Whitlow, Michael