[WhitePangolin]

Логи slapd и radiusd сначала покажите.

p.s.
Модераторы, прицепите эту тему к http://forum.oszone.net/thread-150168.html

[shtirlic053]

Немного конкретизирую проблему, в лдап не могу найти созданого пользователя:

на freeBSD7.0 установлен openLDAP

slapd.conf:

Код:

include         /usr/local/etc/openldap/schema/core.schema

include         /usr/local/etc/openldap/schema/cosine.schema
include         /usr/local/etc/openldap/schema/inetorgperson.schema
include         /usr/local/etc/openldap/schema/misc.schema
include         /usr/local/etc/openldap/schema/nis.schema
include         /usr/local/etc/openldap/schema/openldap.schema
include        /usr/local/etc/openldap/schema/freeradius.schema

pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args

loglevel    256

moduleload      back_bdb

modulepath      /usr/local/libexec/openldap

access to attrs=userPassword
    by self write
    by anonymous auth
    by dn="uid=root,dc=tim,dc=ru" write
    by * none
access to *
    by dn="uid=root,dc=tim,dc=ru" write
    by * read

database        bdb

suffix          "dc=tim,dc=ru"
rootdn          "cn=root,dc=tim,dc=ru"
rootpw password
directory       /var/db/openldap-data

Корневой объект:
base.ldif:

Код:

dn: dc=tim,dc=ru
objectClass: dcObject
objectClass: organization
objectClass: top
dc:tim
o:tim

добавил его:

Код:

ldapadd -x -D "cn=root,dc=tim,dc=ru" -W -f base.ldif
Enter LDAP password:
adding new entry "dc=tim,dc=ru"

Создаю контейнер test.ldif:

Код:

dn: ou=test,dc=tim,dc=ru
objectClass: top
objectClass: organizationalUnit
ou: test

Добавляю его.

Код:

ldapadd -x -D "cn=root,dc=tim,dc=ru" -W -f test.ldif

создаю пользователя lucky
lucky.ldif:

Код:

dn: cn=lucky,ou=test,dc=tim,dc=ru
objectClass: top
objectClass: person
objectClass: posixAccount
objectClass: shadowAccount
cn: lucky
sn: lucky's sername
uid: lucky
userpassword: 1234 
uidNumber: 1000
gidNumber: 1000
gecos: lucky
homeDirectory: /home/lucky

Добавляю его.

Код:

ldapadd -x -D "cn=root,dc=tim,dc=ru" -W -f lucky.ldif

Пытаюсь найти созданного пользователя:

Код:

ldapsearch -x -LLL "dc=tim,dc=ru" -b uid=lucky
No such object(32)

Вот логи LDAP.
/var/log/debug.log:

Код:

Sep 17 01:52:18 OO7 slapd[556]: conn=4 fd=12 ACCEPT from IP=127.0.0.1:58252 (IP=0.0.0.0:389)
Sep 17 01:52:18 OO7 slapd[556]: conn=4 op=0 BIND dn="" method=128
Sep 17 01:52:18 OO7 slapd[556]: conn=4 op=0 RESULT tag=97 err=0 text=
Sep 17 01:52:18 OO7 slapd[556]: conn=4 op=1 SRCH base="dc=pupkin,dc=com,dc=ru" scope=2 deref=0 filter="(dc=tim,dc=ru)"
Sep 17 01:52:18 OO7 slapd[556]: conn=4 op=1 SRCH attr=-b uid=lucky
Sep 17 01:52:18 OO7 slapd[556]: conn=4 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text=
Sep 17 01:52:18 OO7 slapd[556]: conn=4 op=2 UNBIND
Sep 17 01:52:18 OO7 slapd[556]: conn=4 fd=12 closed

В чем может быть моя ошибка?

[WhitePangolin]

В неверном применении параетров команды. Команда:

ldapsearch -x -LLL "dc=tim,dc=ru" -b uid=lucky »

должна выглядеть как:

Код:

ldapsearch -x -LLL -b 'dc=tim,dc=ru' 'uid=lucky'

p.s.
Не факт что проблема только в этом ибо:

Sep 17 01:52:18 OO7 slapd[556]: conn=4 op=1 SRCH base="dc=pupkin,dc=com,dc=ru" scope=2 deref=0 filter="(dc=tim,dc=ru)" »

наталкивает на мысли о неверном предоставлении исходных данных для ее решения

[shtirlic053]

спасибо, проблема была именно в неверном применении параметров команд.

а

Не факт что проблема только в этом ибо: Цитата shtirlic053:Sep 17 01:52:18 OO7 slapd[556]: conn=4 op=1 SRCH base="dc=pupkin,dc=com,dc=ru" scope=2 deref=0 filter="(dc=tim,dc=ru)" » наталкивает на мысли о неверном предоставлении исходных данных для ее решения »

это просто "эксперементировал", создавал другого юзера

[shtirlic053]

появилась новая проблема:

при подключении юзера freeRADIUS находит юзера lucky, но не может получить пароль...

лог openldap:

Код:

Sep 18 03:56:26 OO7 slapd[556]: conn=0 op=2 SRCH base="dc=tim,dc=ru" scope=2 deref=0 filter="(uid=lucky)"
Sep 18 03:56:26 OO7 slapd[556]: conn=0 op=2 SRCH attr=radiusNASIpAddress radiusExpiration acctFlags ntPassword lmPassword radiusCallingStationId radiusCalledStationId radiusSimultaneousUse radiusAuthType radiusCheckItem radiusReplyMessage radiusLoginLATPort radiusPortLimit radiusFramedAppleTalkZone radiusFramedAppleTalkNetwork radiusFramedAppleTalkLink radiusLoginLATGroup radiusLoginLATNode radiusLoginLATService radiusTerminationAction radiusIdleTimeout radiusSessionTimeout radiusClass radiusFramedIPXNetwork radiusCallbackId radiusCallbackNumber
Sep 18 03:56:26 OO7 slapd[556]: conn=0 op=2 SRCH attr=radiusLoginTCPPort radiusLoginService radiusLoginIPHost radiusFramedCompression radiusFramedMTU radiusFilterId radiusFramedRouting radiusFramedRoute radiusFramedIPNetmask radiusFramedIPAddress radiusFramedProtocol radiusServiceType radiusReplyItem userpassword dialupAccess
Sep 18 03:56:26 OO7 slapd[556]: <= bdb_equality_candidates: (objectClass) not indexed
Sep 18 03:56:26 OO7 slapd[556]: <= bdb_equality_candidates: (uid) not indexed
Sep 18 03:56:26 OO7 slapd[556]: conn=0 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text=

лог freeRADIUS:

Код:

Fri Sep 18 03:40:12 2009 : Info: Using deprecated naslist file.  Support for this will go away soon.
Fri Sep 18 03:40:12 2009 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Fri Sep 18 03:40:12 2009 : Info: rlm_eap_tls: Loading the certificate file as a chain
Fri Sep 18 03:40:12 2009 : Info: WARNING: rlm_eap_tls: Unable to set DH parameters.  DH cipher suites may not work!
Fri Sep 18 03:40:12 2009 : Info: Ready to process requests.
Fri Sep 18 03:55:45 2009 : Info: Using deprecated naslist file.  Support for this will go away soon.
Fri Sep 18 03:55:45 2009 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Fri Sep 18 03:55:45 2009 : Info: rlm_eap_tls: Loading the certificate file as a chain
Fri Sep 18 03:55:45 2009 : Info: WARNING: rlm_eap_tls: Unable to set DH parameters.  DH cipher suites may not work!
Fri Sep 18 03:55:45 2009 : Info: Ready to process requests.

slapd.conf:

Код:

include         /usr/local/etc/openldap/schema/core.schema

include         /usr/local/etc/openldap/schema/cosine.schema
include         /usr/local/etc/openldap/schema/inetorgperson.schema
include         /usr/local/etc/openldap/schema/misc.schema
include         /usr/local/etc/openldap/schema/nis.schema
include         /usr/local/etc/openldap/schema/openldap.schema
include        /usr/local/etc/openldap/schema/freeradius.schema

pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args

loglevel    256

moduleload      back_bdb

modulepath      /usr/local/libexec/openldap

access to attrs=userPassword
    by self write
    by self read
    by anonymous auth
    by dn="uid=root,dc=tim,dc=ru" write
    by * none
access to *
    by dn="uid=root,dc=tim,dc=ru" write
    by * read

#access to attrs=userPassword by self write by * auth


database        bdb

suffix          "dc=tim,dc=ru"
rootdn          "cn=root,dc=tim,dc=ru"
rootpw password
directory       /var/db/openldap-data

radiusd.conf:

Код:

    prefix = /usr/local
exec_prefix = ${prefix}
sysconfdir = ${prefix}/etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log
raddbdir = ${sysconfdir}/raddb
radacctdir = ${logdir}/radacct

confdir = ${raddbdir}
run_dir = ${localstatedir}/run/radiusd

log_file = ${logdir}/radius.log

libdir = ${exec_prefix}/lib

pidfile = ${run_dir}/radiusd.pid

max_request_time = 30

delete_blocked_requests = no

cleanup_delay = 5

max_requests = 1024

bind_address = *

port = 0

hostname_lookups = no

allow_core_dumps = no

regular_expressions    = yes
extended_expressions    = yes

log_stripped_names = no

log_auth = no

log_auth_badpass = no
log_auth_goodpass = no

usercollide = no

lower_user = no
lower_pass = no

nospace_user = no
nospace_pass = no


security {
    max_attributes = 200
    reject_delay = 1
    status_server = no
}

proxy_requests  = yes
$INCLUDE  ${confdir}/proxy.conf

$INCLUDE  ${confdir}/clients.conf

snmp    = no
$INCLUDE  ${confdir}/snmp.conf

thread pool {
    start_servers = 5

    max_servers = 32

    min_spare_servers = 3
    max_spare_servers = 10

    max_requests_per_server = 0
}

modules {
    pap {
        auto_header = yes
    }

    chap {
        authtype = CHAP
    }

    pam {
        pam_auth = radiusd
    }

    unix {
        cache = no

        cache_reload = 600

        radwtmp = ${logdir}/radwtmp
    }

$INCLUDE ${confdir}/eap.conf

    ldap {
        server = "ldapi://%2fvar%2frun%2fopenldap%2fldapi"
        identity = "cn=root,dc=tim,dc=ru"
        password = password
        basedn = "dc=tim,dc=ru"
        filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"

        start_tls = no

        access_attr = "dialupAccess"

        dictionary_mapping = ${raddbdir}/ldap.attrmap

        ldap_connections_number = 5

        password_attribute = userpassword
        edir_account_policy_check=no

        timeout = 4
        timelimit = 3
        net_timeout = 1
    }

    mschap    {
        use_mppe = yes
        require_encryption = yes
        require_strong = yes
        with_ntdomain_hack = yes
    }


    realm IPASS {
        format = prefix
        delimiter = "/"
        ignore_default = no
        ignore_null = no
    }

    realm suffix {
        format = suffix
        delimiter = "@"
        ignore_default = no
        ignore_null = no
    }

    realm realmpercent {
        format = suffix
        delimiter = "%"
        ignore_default = no
        ignore_null = no
    }

    realm ntdomain {
        format = prefix
        delimiter = "\\"
        ignore_default = no
        ignore_null = no
    }    

    checkval {
        item-name = Calling-Station-Id

        check-name = Calling-Station-Id

        data-type = string
    }
    
    preprocess {
        huntgroups = ${confdir}/huntgroups
        hints = ${confdir}/hints

        with_ascend_hack = no
        ascend_channels_per_line = 23

        with_ntdomain_hack = no

        with_specialix_jetstream_hack = no

        with_cisco_vsa_hack = no
    }

    files {
        usersfile = ${confdir}/users
        acctusersfile = ${confdir}/acct_users
        preproxy_usersfile = ${confdir}/preproxy_users

        compat = no
    }

    detail {
        detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d

        detailperm = 0600

    }

    acct_unique {
        key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
    }

    $INCLUDE  ${confdir}/sql.conf

    radutmp {
        filename = ${logdir}/radutmp

        username = %{User-Name}

        case_sensitive = yes

        check_with_nas = yes        

        perm = 0600

        callerid = "yes"
    }

    radutmp sradutmp {
        filename = ${logdir}/sradutmp
        perm = 0644
        callerid = "no"
    }

    attr_filter {
        attrsfile = ${confdir}/attrs
    }

    counter daily {
        filename = ${raddbdir}/db.daily
        key = User-Name
        count-attribute = Acct-Session-Time
        reset = daily
        counter-name = Daily-Session-Time
        check-name = Max-Daily-Session
        allowed-servicetype = Framed-User
        cache-size = 5000
    }

    sqlcounter dailycounter {
        counter-name = Daily-Session-Time
        check-name = Max-Daily-Session
        reply-name = Session-Timeout
        sqlmod-inst = sql
        key = User-Name
        reset = daily

        query = "SELECT SUM(AcctSessionTime - \
                 GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \
                 FROM radacct WHERE UserName='%{%k}' AND \
                 UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'"
    }

    sqlcounter monthlycounter {
        counter-name = Monthly-Session-Time
        check-name = Max-Monthly-Session
        reply-name = Session-Timeout
        sqlmod-inst = sql
        key = User-Name
        reset = monthly

        query = "SELECT SUM(AcctSessionTime - \
                 GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \
                 FROM radacct WHERE UserName='%{%k}' AND \
                 UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'"
    }

    always fail {
        rcode = fail
    }
    always reject {
        rcode = reject
    }
    always ok {
        rcode = ok
        simulcount = 0
        mpp = no
    }

    expr {
    }

    digest {
    }

    exec {
        wait = yes
        input_pairs = request
    }

    exec echo {
        wait = yes

        program = "/bin/echo %{User-Name}"

        input_pairs = request

        output_pairs = reply
    }

    ippool main_pool {

        range-start = 192.168.1.1
        range-stop = 192.168.3.254

        netmask = 255.255.255.0

        cache-size = 800

        session-db = ${raddbdir}/db.ippool

        ip-index = ${raddbdir}/db.ipindex

        override = no

        maximum-timeout = 0
    }
}

instantiate {
    exec

    expr
}

authorize {
    preprocess

    ldap

    mschap

    suffix
    ntdomain
}

authenticate {
    Auth-Type MS-CHAP {
        mschap
    }

    unix

    eap
}

preacct {
    preprocess

    acct_unique

    suffix
    files
}

accounting {
    detail

    unix

    radutmp
}

session {
    radutmp
}

post-auth {
}
pre-proxy {
}

post-proxy {
    eap
}

В чем может быть ошибка?

[WhitePangolin]

Могу ошибаться, но, быть может, дело в индексах?

Sep 18 03:56:26 OO7 slapd[556]: <= bdb_equality_candidates: (uid) not indexed »

Попробуйте команду slapindex