freeRadius with LDAP for MSCHAP & mac auth

[Seferovic Edvin]

Hello everyone...

Ive set up a freeradius server with LDAP backend for MSCHAP, but now I have
to set up a mac based auth on the same server also with the same LDAP
backend ( but the mac info is found in another subtree ). So I have made two
ldap instances under modules including MSCHAP...

modules {

mschap {
         authtype = MS-CHAP
         use_mppe = yes
         require_encryption = yes
         require_strong = yes
        }

ldap ldap_users 
{
	server = "81.yyy.xxx.xxx"
	basedn = "ou=People,dc=xxx,dc=xxx"
	filter = "(&(objectClass=posixAccount)(uid=%u))"
	start_tls = no
	dictionary_mapping = ${raddbdir}/ldap.attrmap
	ldap_connections_number = 10
	timeout = 4
	timelimit = 3
	net_timeout = 1
}

ldap ldap_mac 
{
	server = "81.xxx.xxx.xxx"
      basedn = "ou=Hosts,dc=xxx,dc=xxx"
      filter = "(&(objectClass=ipHost)(ipHostNumber=%u))"
      start_tls = no
      dictionary_mapping = ${raddbdir}/ldap.attrmap
      ldap_connections_number = 10
      timeout = 4
      timelimit = 3
      net_timeout = 1
}
... } // modules end

instantiate {
        weekly_traffic // just a counter
}

authorize {
        mschap
        ldap_users
        ldap_mac
        weekly_traffic
}
 
authenticate {
        #  MSCHAP authentication.
        Auth-Type MS-CHAP {
                mschap
        }
	  
        Auth-Type LDAP {
                ldap_mac
                ldap_users
        }
}

So what I actually need is - when my vpn server sends Access-Request packets
with MS-CHAP attributes, I would like mschap module to use the "ldap_users"
part. And when an Access-Request packet with the mac address is recieved I
would like to use ldap_mac ONLY ! here is a part of my log file... 

rad_recv: Access-Request packet from host 172.19.10.2:1024, id=22,
length=193
        Framed-MTU = 1480
        NAS-IP-Address = 172.19.10.2
        NAS-Identifier = "HP2626-Verwaltung"
        User-Name = "00:0a:e4:22:c5:9d"
        Service-Type = Administrative-User
        Framed-Protocol = PPP
        NAS-Port = 10
        NAS-Port-Type = Ethernet
        NAS-Port-Id = "10"
        Called-Station-Id = "00-14-38-2e-2c-76"
        Calling-Station-Id = "00-0a-e4-22-c5-9d"
        Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
        CHAP-Password = 0x1525d56e4e21bbbc83d5e49fa3be8173a5
Debug:   Processing the authorize section of radiusd.conf
Debug: modcall: entering group authorize for request 0
Debug:   modsingle[authorize]: calling mschap (rlm_mschap) for request 0
Debug:   modsingle[authorize]: returned from mschap (rlm_mschap) for request
0
Debug:   modcall[authorize]: module "mschap" returns noop for request 0
Debug:   modsingle[authorize]: calling ldap_users (rlm_ldap) for request 0
Debug: rlm_ldap: - authorize
Debug: rlm_ldap: performing user authorization for 00:0a:e4:22:c5:9d
Debug: radius_xlat:  '(&(objectClass=posixAccount)(uid=00:0a:e4:22:c5:9d))'
Debug: radius_xlat:  'ou=People,dc=kolp,dc=at'
Debug: rlm_ldap: ldap_get_conn: Checking Id: 0
Debug: rlm_ldap: ldap_get_conn: Got Id: 0
Debug: rlm_ldap: attempting LDAP reconnection
Debug: rlm_ldap: (re)connect to 81.189.101.10:389, authentication 0
Debug: rlm_ldap: bind as / to 81.189.101.10:389
Debug: rlm_ldap: waiting for bind result ...
Debug: rlm_ldap: Bind was successful
Debug: rlm_ldap: performing search in ou=People,dc=kolp,dc=at, with filter
(&(objectClass=posixAccount)(uid=00:0a:e4:22:c5:9d))
Debug: rlm_ldap: object not found or got ambiguous search result
Debug: rlm_ldap: search failed
Debug: rlm_ldap: ldap_release_conn: Release Id: 0
Debug:   modsingle[authorize]: returned from ldap_users (rlm_ldap) for
request 0
Debug:   modcall[authorize]: module "ldap_users" returns notfound for
request 0
Debug:   modsingle[authorize]: calling ldap_mac (rlm_ldap) for request 0
Debug: rlm_ldap: - authorize
Debug: rlm_ldap: performing user authorization for 00:0a:e4:22:c5:9d
Debug: radius_xlat:
'(&(objectClass=ipHost)(ipHostNumber=00:0a:e4:22:c5:9d))'
Debug: radius_xlat:  'ou=Hosts,dc=kolp,dc=at'
Debug: rlm_ldap: ldap_get_conn: Checking Id: 0
Debug: rlm_ldap: ldap_get_conn: Got Id: 0
Debug: rlm_ldap: attempting LDAP reconnection
Debug: rlm_ldap: (re)connect to 81.189.101.10:389, authentication 0
Debug: rlm_ldap: bind as / to 81.189.101.10:389
Debug: rlm_ldap: waiting for bind result ...
Debug: rlm_ldap: Bind was successful
Debug: rlm_ldap: performing search in ou=Hosts,dc=kolp,dc=at, with filter
(&(objectClass=ipHost)(ipHostNumber=00:0a:e4:22:c5:9d))
Debug: rlm_ldap: looking for check items in directory...
Debug: rlm_ldap: looking for reply items in directory...
Debug: rlm_ldap: Adding description as vid, value 20 & op=11
Debug: rlm_ldap: user 00:0a:e4:22:c5:9d authorized to use remote access
Debug: rlm_ldap: ldap_release_conn: Release Id: 0
Debug:   modsingle[authorize]: returned from ldap_mac (rlm_ldap) for request
0
Debug:   modcall[authorize]: module "ldap_mac" returns ok for request 0
Debug:   modsingle[authorize]: calling weekly_traffic (rlm_counter) for
request 0
Debug: rlm_counter: Entering module authorize code
Debug: rlm_counter: Could not find Check item value pair
Debug:   modsingle[authorize]: returned from weekly_traffic (rlm_counter)
for request 0
Debug:   modcall[authorize]: module "weekly_traffic" returns noop for
request 0
Debug: modcall: group authorize returns ok for request 0
Debug: auth: No authenticate method (Auth-Type) configuration found for the
request: Rejecting the user

Sorry for the long mail :(

Thank you in advance !

Regards,

Edvin Seferovic