Hi, I'm running a configuration where a Cisco 1600 router is running a PPPoE server and check user passwords against a freeRadius server running under FreeBSD. This Radius server checks passwords against a LDAP database running on another BSD server. The authentication is working great, the Radius replies with an "Access-Accept" reply to the Cisco router but it seems that the router needs two attributes to accept this reply : Service-Type = Framed-User, Framed-Protocol = PPP, So I did the following configuration in users.conf : DEFAULT Framed-Protocol == PPP Service-Type = Framed-User, Framed-Protocol = PPP, Fall-Through = Yes But freeradius still replies with no attributes in Access-Accept packet... I read a lot of documentation about this and I'm quite confused since I don't really see any other mean to add attributes to replies... Any Ideas ? Thanks
Default users file has DEFAULT entries for that Service-Type and protocol. Default radiusd.conf uses files. You have changed the defaults and it's not working anymore. In default configuration make changes only to the ldap section and leave the rest as it was. Ivan Kalik Kalik Informatika ISP Dana 10/12/2007, "Lucien RENAULT" <loupitour@gmail.com> piše:
Hi, I'm running a configuration where a Cisco 1600 router is running a PPPoE server and check user passwords against a freeRadius server running under FreeBSD. This Radius server checks passwords against a LDAP database running on another BSD server. The authentication is working great, the Radius replies with an "Access-Accept" reply to the Cisco router but it seems that the router needs two attributes to accept this reply :
Service-Type = Framed-User, Framed-Protocol = PPP,
So I did the following configuration in users.conf :
DEFAULT Framed-Protocol == PPP Service-Type = Framed-User, Framed-Protocol = PPP, Fall-Through = Yes
But freeradius still replies with no attributes in Access-Accept packet... I read a lot of documentation about this and I'm quite confused since I don't really see any other mean to add attributes to replies...
Any Ideas ?
Thanks - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Yes indeed, I changed the default entries of the users.conf because freeradius wasn't replying with the attributes so I tried many tricks in order to improve this but I never managed to get those attributes in Access-Accept packets... I also modified the ldap section of radiusd.conf but this one is working fine so I guess I wont have to change this anymore. I really think the problem comes from this users.conf file but I really can't figure out why the modifications I bring to this file don't affect radius behavior. Are there options I'm missing in other conf files maybe ? tnt@kalik.co.yu wrote:
Default users file has DEFAULT entries for that Service-Type and protocol. Default radiusd.conf uses files. You have changed the defaults and it's not working anymore. In default configuration make changes only to the ldap section and leave the rest as it was.
Ivan Kalik Kalik Informatika ISP
Dana 10/12/2007, "Lucien RENAULT" <loupitour@gmail.com> piše:
Hi, I'm running a configuration where a Cisco 1600 router is running a PPPoE server and check user passwords against a freeRadius server running under FreeBSD. This Radius server checks passwords against a LDAP database running on another BSD server. The authentication is working great, the Radius replies with an "Access-Accept" reply to the Cisco router but it seems that the router needs two attributes to accept this reply :
Service-Type = Framed-User, Framed-Protocol = PPP,
So I did the following configuration in users.conf :
DEFAULT Framed-Protocol == PPP Service-Type = Framed-User, Framed-Protocol = PPP, Fall-Through = Yes
But freeradius still replies with no attributes in Access-Accept packet... I read a lot of documentation about this and I'm quite confused since I don't really see any other mean to add attributes to replies...
Any Ideas ?
Thanks - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Yes, I checked the Access-Accept packet with tcpdump/Wireshark and they weren't any attributes. Here are the radiusd -X lines ( password & shared keys are for testing purpose only...) : Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded LDAP ldap: server = "192.168.1.2" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=root,dc=projet3,dc=com" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "bonjour" ldap: basedn = "dc=user,dc=projet3,dc=com" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "{MD5}" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x8066680 Module: Instantiated ldap (ldap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = yes Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.253:1645, id=155, length=77 NAS-IP-Address = 192.168.1.253 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "Asterix" User-Password = "bonjour" Service-Type = Framed-User Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 36 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "Asterix", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for Asterix radius_xlat: '(uid=Asterix)' radius_xlat: 'dc=user,dc=projet3,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.1.2:389, authentication 0 rlm_ldap: bind as cn=root,dc=projet3,dc=com/bonjour to 192.168.1.2:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=user,dc=projet3,dc=com, with filter (uid=Asterix) rlm_ldap: Added password 8CNolFcm1fwqFOtXb3J2wA== in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user Asterix authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "ldap" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "Asterix" with password "bonjour" rlm_ldap: user DN: uid=Asterix,dc=user,dc=projet3,dc=com rlm_ldap: (re)connect to 192.168.1.2:389, authentication 1 rlm_ldap: bind as uid=Asterix,dc=user,dc=projet3,dc=com/bonjour to 192.168.1.2:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user Asterix authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: leaving group authenticate (returns ok) for request 0 Login OK: [Asterix/bonjour] (from client Cisco port 1) Sending Access-Accept of id 155 to 192.168.1.253 port 1645 Finished request 0 tnt@kalik.co.yu wrote:
Yes indeed, I changed the default entries of the users.conf because freeradius wasn't replying with the attributes
Why? Are you sure that server didn't respont the way it was supposed to? Send the output from radiusd -X from the request.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Lucien RENAULT wrote:
Yes, I checked the Access-Accept packet with tcpdump/Wireshark and they weren't any attributes. Here are the radiusd -X lines ( password & shared keys are for testing purpose only...) :
The reason to use "radiusd -X" is to *read* it. In this case, it's telling you which configuration files it's using when it receives the request, and which parts of those configuration files it's using. Use the debug output to go read those configuration file entries, and see why it's not doing what you want. Also read "man users" to see how the "users" file works. Alan DeKok.
Yes I actually read the radius -X by myself, as well as doc about users and man 5 users, so I don't really understand why the following lines don't add attributes to the reply : DEFAULT Framed-Protocol == PPP Service-Type = Framed-User, Framed-Protocol = PPP, Fall-Through = Yes Alan DeKok wrote:
Lucien RENAULT wrote:
Yes, I checked the Access-Accept packet with tcpdump/Wireshark and they weren't any attributes. Here are the radiusd -X lines ( password & shared keys are for testing purpose only...) :
The reason to use "radiusd -X" is to *read* it.
In this case, it's telling you which configuration files it's using when it receives the request, and which parts of those configuration files it's using.
Use the debug output to go read those configuration file entries, and see why it's not doing what you want. Also read "man users" to see how the "users" file works.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Lucien RENAULT wrote:
Yes I actually read the radius -X by myself, as well as doc about users and man 5 users, so I don't really understand why the following lines don't add attributes to the reply :
The output of "radiusd -X" shows which lines in the "users" file are matched. In your case, it shows that it doesn't even look in the "users" file during the "authorize" phase. i.e. you edited "radiusd.conf", and broke it. Don't do that. The default "radiusd.conf" file works. Use it. Alan DeKok.
Ok, thanks for your help, I found the problem in radiusd.conf : In the authorize section, the "files" line was commented because it created errors when authorizing with ldap so I uncommented and placed this line *after* the ldap line, which allowed to authorize using LDAP and parse the users file. Thanks a lot for your help Alan DeKok wrote:
Lucien RENAULT wrote:
Yes I actually read the radius -X by myself, as well as doc about users and man 5 users, so I don't really understand why the following lines don't add attributes to the reply :
The output of "radiusd -X" shows which lines in the "users" file are matched.
In your case, it shows that it doesn't even look in the "users" file during the "authorize" phase.
i.e. you edited "radiusd.conf", and broke it.
Don't do that.
The default "radiusd.conf" file works.
Use it.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Lucien RENAULT -
tnt＠kalik.co.yu