• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Freeradius with rlm_ldap?

pfSense Packages
2
17
14.7k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • A
    aranel
    last edited by Nov 15, 2011, 7:03 AM

    Hi all. Is the freeradius in pfSense compiled with rlm_ldap? Because when i tried to launch radiusd, i've recieved:

    radiusd.conf[89] Failed to link to module 'rlm_ldap': file not found
    radiusd.conf[329] Unknown module "ldap".
    radiusd.conf[329] Failed to parse "ldap" entry.
    
    1 Reply Last reply Reply Quote 0
    • N
      Nachtfalke
      last edited by Nov 16, 2011, 7:26 PM

      Hi,

      in freeradius.inc there are these options:

              ldap {
                      server = "ldap.your.domain"
                      basedn = "o=My Org,c=UA"
                      filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
                      #base_filter = "(objectclass=radiusprofile)"
                      start_tls = no
                      #tls_cacertfile = /path/to/cacert.pem
                      #tls_cacertdir = /path/to/ca/dir/
                      #tls_certfile = /path/to/radius.crt
                      #tls_keyfile = /path/to/radius.key
                      #tls_randfile = /path/to/rnd
                      #tls_require_cert = "demand"
                      access_attr = "dialupAccess"
                      dictionary_mapping = \${raddbdir}/ldap.attrmap
                      ldap_connections_number = 5
                      #groupname_attribute = cn
                      #groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserD
      n})))"
                      #groupmembership_attribute = radiusGroupName
                      timeout = 4
                      timelimit = 3
                      net_timeout = 1
                      #compare_check_items = yes
                      #do_xlat = yes
                      #access_attr_used_for_allow = yes
              }
      
      

      Did you change them according to your setup ?

      Further if you scroll down you can find these entries:

      authorize {
              preprocess
              #auth_log
              #attr_filter
              chap
              mschap
              #digest
              #IPASS
              suffix
              #ntdomain
              eap
              files
              #sql
              #etc_smbpasswd
      [b]        #ldap[/b]
              daily
              weekly
              monthly
              forever
              #checkval
      }
      
      authenticate {
              Auth-Type PAP {
                      pap
              }
              Auth-Type CHAP {
                      chap
              }
              Auth-Type MS-CHAP {
                      mschap
              }
              #digest
              #pam
              unix
              #Auth-Type LDAP {
      [b]        #       ldap[/b]
              #}
              eap
      }
      

      Perhaps you have to uncomment (one/both) them.

      I do not use it with ldap but it would be nice if you could post feedback.

      1 Reply Last reply Reply Quote 0
      • A
        aranel
        last edited by Nov 17, 2011, 6:57 AM

        I have been guided this: http://oss.sgi.com/LDP/HOWTO/LDAP-Implementation-HOWTO/radius.html

        1 Reply Last reply Reply Quote 0
        • A
          aranel
          last edited by Nov 24, 2011, 11:23 AM

          No suggestions?

          1 Reply Last reply Reply Quote 0
          • N
            Nachtfalke
            last edited by Nov 24, 2011, 7:12 PM

            hmm, did you change the thread/posts ?
            I thought you had a solution for that…

            Did you try that ?
            http://wiki.freeradius.org/Rlm_ldap

            1 Reply Last reply Reply Quote 0
            • N
              Nachtfalke
              last edited by Nov 24, 2011, 11:14 PM

              Perhaps we can download the rlm_ldap module and compile it
              https://github.com/alandekok/freeradius-server/tree/master/src/modules

              and after that copy the files to

              /usr/local/etc/raddb/modules/
              
              1 Reply Last reply Reply Quote 0
              • A
                aranel
                last edited by Nov 25, 2011, 7:16 AM

                @Nachtfalke:

                Perhaps we can download the rlm_ldap module and compile it
                https://github.com/alandekok/freeradius-server/tree/master/src/modules

                and after that copy the files to

                /usr/local/etc/raddb/modules/
                

                Emm, but how i can download and compile external module?

                1 Reply Last reply Reply Quote 0
                • N
                  Nachtfalke
                  last edited by Nov 25, 2011, 1:45 PM

                  You can click on "Downloads" and then download all the modules.
                  But in every folder there is a "makefile" so I think you have to compile the files first and that is my problem:
                  pfsense itself does not have developement tools installed (because you don't need them) and I do not have any other freeBSD 8.x environment where I could compile these files and then just copy them on pfsense.

                  perhaps someone else can do this for us?!

                  Download.jpg_thumb
                  Download.jpg

                  1 Reply Last reply Reply Quote 0
                  • N
                    Nachtfalke
                    last edited by Nov 28, 2011, 12:23 PM

                    Hi,

                    I played around with freeRADIUS and the rlm_ldap module.

                    First I downloaded the freeRADIUS 1.1.8 source from here:
                    ftp://ftp.freeradius.org/pub/radius/freeradius-1.1.8.tar.gz

                    Then I downloaded the PC-BSD8.2 (amd64) from here:
                    http://www.pcbsd.org/

                    Then I installed PC-BSD8.2 on VMware Workstation and installed freeradius on the machine:

                    ./configure
                    make
                    make install
                    

                    This worked for me. All additional modules were installed in

                    /usr/local/lib/
                    

                    They all start with "rlm_"

                    There is the rlm_ldap module, too and freeRADIUS is starting when enabling ldap in radius.conf.
                    After this I thought I just need to copy this module from PC-BSD to pfsense. pfsense stores the freeRADIUS modules is /usr/local/lib/ ,too.
                    But it didn't work.

                    I attached you the rlm_ldap module I copiled with PC-BSD and I attached you alle the modules I compiled with PC-BSD.
                    Perhaps someone can help us to find out why this module isn't working. Not sure if these modules are independent from i386 and amd64 but I tried with pfsense amd64 and PC-BSD8.2 amd64

                    All freeRADIUS modules:
                    http://www.file-upload.net/download-3912854/rlm_ALLE.tar.html

                    rlm_ldap.tar.txt

                    1 Reply Last reply Reply Quote 0
                    • A
                      aranel
                      last edited by Nov 28, 2011, 12:44 PM

                      Can you upload all rlm_* modules to mediafire/rapidshare/email?

                      1 Reply Last reply Reply Quote 0
                      • N
                        Nachtfalke
                        last edited by Nov 28, 2011, 2:59 PM

                        http://www.mediafire.com/?ouydb2ekk8ozqqu

                        1 Reply Last reply Reply Quote 0
                        • A
                          aranel
                          last edited by Nov 29, 2011, 8:32 AM

                          Thanks.

                          1 Reply Last reply Reply Quote 0
                          • N
                            Nachtfalke
                            last edited by Nov 29, 2011, 3:41 PM

                            I searched for this problem and found something in the FAQ.
                            It is related to mySQL but it seems that the problem is the same as for LDAP.

                            http://wiki.freeradius.org/FAQ#It+says+%22Could+not+link+…+file+not+found%22%2C+what+do+I+do%3F

                            Perhaps we have to modify the    $PATH    variable in pfsense.
                            But I really don't know.

                            1 Reply Last reply Reply Quote 0
                            • N
                              Nachtfalke
                              last edited by Nov 30, 2011, 10:30 PM

                              Hi,

                              I got the solution and I got it running with the rlm_ldap module on my pfsense 2.0 final amd64:

                              This are the additional files you need:
                              rlm_ldap:
                              http://www.mediafire.com/?966eei7qg46avvu
                              I uploaded this file via GUI "Diagnostics -> Command Promt" to pfsense. The rlm_ldap.tar is now locates in /tmp.
                              Then I did this:

                              
                              cd /tmp
                              tar -xf rlm_ldap.tar
                              cd /usr/local/lib
                              mv /tmp/usr/local/lib/rlm_* .
                              
                              

                              After doing a ldd on rlm_ldap.so I got the solution. Some libraries are missing.

                              ldd /usr/local/lib/rlm_ldap.so
                              

                              will give you the solution.

                              I uploaded libldap.tar to my pfsense:
                              http://www.mediafire.com/?nclfti7ndz8yr6o

                              Then I did this:

                              
                              cd /tmp
                              tar -xf libldap.tar
                              cd /usr/local/lib
                              mv /tmp/libldap* .
                              
                              

                              After doing a ldd on rlm_ldap.so again I got the last missing libraries:
                              I uploaded liblber.tar to my pfsense:
                              http://www.mediafire.com/?08hpaghl26lky0k

                              Then I did this:

                              
                              cd /tmp
                              tar -xf liblber.tar
                              cd /usr/local/lib
                              mv /tmp/liblber* .
                              
                              

                              To make the changes in radius.conf permanent I edited the following file:

                              /usr/local/pkg/freeradius.inc
                              

                              I uncommented four lines in these two sections:

                              authorize {
                              (.....)
                                      ldap
                              (.....)
                              
                              authenticate {
                              (.....)
                                      Auth-Type LDAP {
                                              ldap
                                      }
                              (.....)
                              
                              

                              This is the LDAP output after starting freeRADIUS with radiusd -X

                              Module: Loaded LDAP
                               ldap: server = "ldap.your.domain"
                               ldap: port = 389
                               ldap: net_timeout = 1
                               ldap: timeout = 4
                               ldap: timelimit = 3
                               ldap: identity = ""
                               ldap: tls_mode = no
                               ldap: start_tls = no
                               ldap: tls_cacertfile = "(null)"
                               ldap: tls_cacertdir = "(null)"
                               ldap: tls_certfile = "(null)"
                               ldap: tls_keyfile = "(null)"
                               ldap: tls_randfile = "(null)"
                               ldap: tls_require_cert = "allow"
                               ldap: password = ""
                               ldap: basedn = "o=My Org,c=UA"
                               ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
                               ldap: base_filter = "(objectclass=radiusprofile)"
                               ldap: default_profile = "(null)"
                               ldap: profile_attribute = "(null)"
                               ldap: password_header = "(null)"
                               ldap: password_attribute = "(null)"
                               ldap: access_attr = "dialupAccess"
                               ldap: groupname_attribute = "cn"
                               ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
                               ldap: groupmembership_attribute = "(null)"
                               ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap"
                               ldap: ldap_debug = 0
                               ldap: ldap_connections_number = 5
                               ldap: compare_check_items = no
                               ldap: access_attr_used_for_allow = yes
                               ldap: do_xlat = yes
                               ldap: set_auth_type = yes
                              rlm_ldap: Registering ldap_groupcmp for Ldap-Group
                              rlm_ldap: Registering ldap_xlat with xlat_name ldap
                              rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap
                              rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$
                              rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$
                              rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type
                              rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use
                              rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id
                              rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id
                              rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password
                              rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password
                              rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT
                              rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration
                              rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address
                              rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type
                              rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol
                              rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address
                              rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask
                              rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route
                              rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing
                              rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id
                              rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU
                              rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression
                              rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host
                              rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service
                              rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port
                              rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number
                              rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id
                              rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network
                              rlm_ldap: LDAP radiusClass mapped to RADIUS Class
                              rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout
                              rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout
                              rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action
                              rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service
                              rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node
                              rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group
                              rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link
                              rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network
                              rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone
                              rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit
                              rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port
                              rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message
                              conns: 0x8012e1880
                              Module: Instantiated ldap (ldap)
                              
                              

                              Please let me know if this works for you.
                              And if yes please add here what you need to change to make freeRADIUS work with your LDAP.
                              Perhaps we are able to implement the changes you are doing by hand in the radiusd.conf to the GUI.

                              1 Reply Last reply Reply Quote 0
                              • A
                                aranel
                                last edited by Dec 1, 2011, 8:28 AM

                                After added liblber, "ldd /usr/local/lib/rlm_ldap.so" still gives:

                                ldd: /usr/local/lib/rlm_ldap.so: not a dynamic executable
                                

                                And after all of this, radiusd -X gives:

                                radiusd.conf[256] Failed to link to module 'rlm_exec': file not found
                                
                                ls /usr/local/lib/rlm_exec*
                                /usr/local/lib/rlm_exec-1.1.8.la /usr/local/lib/rlm_exec.a        /usr/local/lib/rlm_exec.so
                                /usr/local/lib/rlm_exec-1.1.8.so /usr/local/lib/rlm_exec.la
                                
                                

                                Strangely.

                                1 Reply Last reply Reply Quote 0
                                • N
                                  Nachtfalke
                                  last edited by Dec 1, 2011, 4:55 PM Dec 1, 2011, 11:01 AM

                                  Hi,

                                  please go to /usr/local/lib and delete all "rlm_*" files.
                                  Then deinstall freeradius package from the GUI and the reinstall the freeradius package from the GUI.

                                  Then use then just add the three files from my last post:
                                  rlm_ldap.tar
                                  libldap.tar
                                  liblber.tar

                                  And pay attention. I used the "move" command "mv" NOT the "copy" "cp".

                                  If you use the "ls -la" command in /user/local/lub than you can see that there are several links on the files. Cannot explain that exact.
                                  The extracted files you downloaded from my .tar files have these links. But if you copy them they lose these link. That's the reason why I used "mv" instead of "cp".

                                  Please try that again and post back.
                                  If it does not work I will do a complete clean install of pfsense this afternoon/evening and try again.
                                  I just think that you or I mixed up some libraries and so it is working for me but not for you. But we know that it will work with this minor fixes ;o)

                                  –--- edit -----

                                  I did a complete and fresh reinstallation of pfsense and then did the steps I described above and freeRADIUS is starting.

                                  ----- edit 2 -----

                                  I did a test with like it is described in the tutorial you posted and I got this output:

                                  radtest username "password" localhost 1 testing123
                                  
                                  [2.0-RELEASE][admin@pfSense.localdomain]/root(2): radtest username "password" localhost 1 testing123
                                  Sending Access-Request of id 1 to 127.0.0.1 port 1812
                                          User-Name = "username"
                                          User-Password = "password"
                                          NAS-IP-Address = 255.255.255.255
                                          NAS-Port = 1
                                  ^C
                                  [2.0-RELEASE][admin@pfSense.localdomain]/root(3):
                                  
                                  /usr/local/sbin/radiusd  -X -A
                                  
                                  rad_recv: Access-Request packet from host 127.0.0.1:57602, id=1, length=60
                                          User-Name = "username"
                                          User-Password = "password"
                                          NAS-IP-Address = 255.255.255.255
                                          NAS-Port = 1
                                  
                                  

                                  Logging to syslog gave me this output - of course I do not have any ldap server:

                                  Dec 1 16:53:21 	radiusd[31420]: rlm_ldap: (re)connection attempt failed
                                  Dec 1 16:53:21 	radiusd[31420]: rlm_ldap: (re)connection attempt failed
                                  Dec 1 16:53:21 	radiusd[31420]: rlm_ldap: bind to ldap.your.domain:389 failed: Can't contact LDAP server
                                  Dec 1 16:53:21 	radiusd[31420]: rlm_ldap: bind to ldap.your.domain:389 failed: Can't contact LDAP server
                                  Dec 1 16:53:00 	radiusd[31420]: Ready to process requests.
                                  
                                  1 Reply Last reply Reply Quote 0
                                  • N
                                    Nachtfalke
                                    last edited by Dec 23, 2011, 6:57 PM

                                    @aranel

                                    Is LDAP working for you now ?

                                    It would be greate to know if it is working now with the compiled module. I do not have any LDAP here to test with.

                                    Thanks for your feedback!

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.