Encrypted password with FR+LDAP+Wireless Network

Inácio Alves inacioc.alves at gmail.com
Tue May 18 02:06:58 CEST 2010


Good Morning to all.

I would like if is possible use FR+LDAP with Use-Password encrypted? I'm
using FR 2.1.8 + OpenLDAP 2.4.21. I'm trying configure FR to authenticate
users in wireless network.

This is my debug output. When I try a radtest with login/pass from the users
file I don't get warning, but LDAP

...
 home_server localhost {
ipaddr = 127.0.0.1
 port = 1812
 type = "auth"
 secret = "testing123"
 response_window = 20
 max_outstanding = 65536
 require_message_authenticator = no
 zombie_period = 40
 status_check = "status-server"
 ping_interval = 30
 check_interval = 30
 num_answers_to_alive = 3
 num_pings_to_alive = 3
 revive_interval = 120
 status_check_timeout = 4
 irt = 2
 mrt = 16
 mrc = 5
 mrd = 30
 }
...
radiusd: #### Loading Clients ####
 client localhost {
 ipaddr = 127.0.0.1
 require_message_authenticator = no
 secret = "testing123"
 nastype = "other"
 }
 client 192.168.0.0/16 {
 require_message_authenticator = no
 secret = "testing123-2"
 shortname = "private-network-2"
 }
radiusd: #### Instantiating modules ####
 instantiate {
 Module: Linked to module rlm_exec
 Module: Instantiating exec
  exec {
wait = no
 input_pairs = "request"
 shell_escape = yes
  }
 Module: Linked to module rlm_expr
 Module: Instantiating expr
 Module: Linked to module rlm_expiration
 Module: Instantiating expiration
  expiration {
reply-message = "Password Has Expired  "
  }
 Module: Linked to module rlm_logintime
 Module: Instantiating logintime
  logintime {
 reply-message = "You are calling outside your allowed timespan  "
 minimum-timeout = 60
  }
 }
radiusd: #### Loading Virtual Servers ####
server inner-tunnel {
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Linked to module rlm_pap
 Module: Instantiating pap
  pap {
encryption_scheme = "auto"
 auto_header = no
  }
 Module: Linked to module rlm_chap
 Module: Instantiating chap
 Module: Linked to module rlm_mschap
 Module: Instantiating mschap
  mschap {
use_mppe = yes
 require_encryption = no
 require_strong = no
 with_ntdomain_hack = no
  }
 Module: Linked to module rlm_unix
 Module: Instantiating unix
  unix {
radwtmp = "/usr/local/var/log/radius/radwtmp"
  }
 Module: Linked to module rlm_eap
 Module: Instantiating eap
  eap {
default_eap_type = "md5"
 timer_expire = 60
 ignore_unknown_eap_types = no
 cisco_accounting_username_bug = no
 max_sessions = 4096
  }
 Module: Linked to sub-module rlm_eap_md5
 Module: Instantiating eap-md5
 Module: Linked to sub-module rlm_eap_leap
 Module: Instantiating eap-leap
 Module: Linked to sub-module rlm_eap_gtc
 Module: Instantiating eap-gtc
   gtc {
 challenge = "Password: "
 auth_type = "PAP"
   }
 Module: Linked to sub-module rlm_eap_tls
 Module: Instantiating eap-tls
   tls {
 rsa_key_exchange = no
 dh_key_exchange = yes
 rsa_key_length = 512
 dh_key_length = 512
 verify_depth = 0
 pem_file_type = yes
 private_key_file = "/usr/local/etc/raddb/certs/server.pem"
 certificate_file = "/usr/local/etc/raddb/certs/server.pem"
 CA_file = "/usr/local/etc/raddb/certs/ca.pem"
 private_key_password = "whatever"
 dh_file = "/usr/local/etc/raddb/certs/dh"
 random_file = "/usr/local/etc/raddb/certs/random"
 fragment_size = 1024
 include_length = yes
 check_crl = no
 cipher_list = "DEFAULT"
 make_cert_command = "/usr/local/etc/raddb/certs/bootstrap"
    cache {
enable = no
 lifetime = 24
 max_entries = 255
    }
   }
 Module: Linked to sub-module rlm_eap_ttls
 Module: Instantiating eap-ttls
   ttls {
 default_eap_type = "md5"
 copy_request_to_tunnel = no
 use_tunneled_reply = no
 virtual_server = "inner-tunnel"
 include_length = yes
   }
 Module: Linked to sub-module rlm_eap_peap
 Module: Instantiating eap-peap
   peap {
 default_eap_type = "mschapv2"
 copy_request_to_tunnel = no
 use_tunneled_reply = no
 proxy_tunneled_request_as_eap = yes
 virtual_server = "inner-tunnel"
   }
 Module: Linked to sub-module rlm_eap_mschapv2
 Module: Instantiating eap-mschapv2
   mschapv2 {
 with_ntdomain_hack = no
   }
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_realm
 Module: Instantiating suffix
  realm suffix {
format = "suffix"
 delimiter = "@"
 ignore_default = no
 ignore_null = no
  }
 Module: Linked to module rlm_files
 Module: Instantiating files
  files {
usersfile = "/usr/local/etc/raddb/users"
 acctusersfile = "/usr/local/etc/raddb/acct_users"
 preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"
 compat = "no"
  }
 Module: Checking session {...} for more modules to load
 Module: Linked to module rlm_radutmp
 Module: Instantiating radutmp
  radutmp {
filename = "/usr/local/var/log/radius/radutmp"
 username = "%{User-Name}"
 case_sensitive = yes
 check_with_nas = yes
 perm = 384
 callerid = yes
  }
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 Module: Linked to module rlm_attr_filter
 Module: Instantiating attr_filter.access_reject
  attr_filter attr_filter.access_reject {
 attrsfile = "/usr/local/etc/raddb/attrs.access_reject"
 key = "%{User-Name}"
  }
 } # modules
} # server
server {
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_preprocess
 Module: Instantiating preprocess
  preprocess {
 huntgroups = "/usr/local/etc/raddb/huntgroups"
 hints = "/usr/local/etc/raddb/hints"
 with_ascend_hack = no
 ascend_channels_per_line = 23
 with_ntdomain_hack = no
 with_specialix_jetstream_hack = no
 with_cisco_vsa_hack = no
 with_alvarion_vsa_hack = no
  }
 Module: Linked to module rlm_ldap
 Module: Instantiating ldap
  ldap {
server = "localhost"
 port = 389
 password = "1234"
 identity = "cn=admin,dc=ifce,dc=edu,dc=br"
 net_timeout = 1
 timeout = 4
 timelimit = 3
 tls_mode = no
 start_tls = no
 tls_require_cert = "allow"
   tls {
start_tls = no
 require_cert = "allow"
   }
basedn = "dc=ifce,dc=edu,dc=br"
 filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
 base_filter = "(objectclass=radiusprofile)"
 password_attribute = "userPassword"
 auto_header = no
 access_attr_used_for_allow = yes
 groupname_attribute = "cn"
 groupmembership_filter =
"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
 dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap"
 ldap_debug = 0
 ldap_connections_number = 5
 compare_check_items = no
 do_xlat = yes
 set_auth_type = yes
  }
...
rad_recv: Access-Request packet from host 127.0.0.1 port 47202, id=141,
length=58
User-Name = "inacio"
 User-Password = "1"
 NAS-IP-Address = 192.168.56.2
 NAS-Port = 0
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "inacio", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[files] returns noop
[ldap] performing user authorization for inacio
[ldap] expand: %{Stripped-User-Name} ->
[ldap] ... expanding second conditional
[ldap] expand: %{User-Name} -> inacio
[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=inacio)
[ldap] expand: dc=ifce,dc=edu,dc=br -> dc=ifce,dc=edu,dc=br
  [ldap] ldap_get_conn: Checking Id: 0
  [ldap] ldap_get_conn: Got Id: 0
  [ldap] attempting LDAP reconnection
  [ldap] (re)connect to localhost:389, authentication 0
  [ldap] bind as cn=admin,dc=ifce,dc=edu,dc=br/1234 to localhost:389
  [ldap] waiting for bind result ...
  [ldap] Bind was successful
  [ldap] performing search in dc=ifce,dc=edu,dc=br, with filter (uid=inacio)
[ldap] Added User-Password = 1 in check items
[ldap] looking for check items in directory...
[ldap] looking for reply items in directory...
[ldap] user inacio authorized to use remote access
  [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns updated
Found Auth-Type = PAP
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!    Replacing User-Password in config items with Cleartext-Password.
!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!! Please update your configuration so that the "known good"
!!!
!!! clear text password is in Cleartext-Password, and not in User-Password.
!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+- entering group PAP {...}
[pap] login attempt with password "1"
[pap] Using clear text password "1"
[pap] User authenticated successfully
++[pap] returns ok
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 141 to 127.0.0.1 port 47202
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 141 with timestamp +5
Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1 port 57388, id=119,
length=57
 User-Name = "steve"
 User-Password = "testing"
 NAS-IP-Address = 192.168.56.2
 NAS-Port = 0
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "steve", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
[files] users: Matched entry steve at line 76
++[files] returns ok
[ldap] performing user authorization for steve
[ldap] expand: %{Stripped-User-Name} ->
[ldap] ... expanding second conditional
[ldap] expand: %{User-Name} -> steve
[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=steve)
[ldap] expand: dc=ifce,dc=edu,dc=br -> dc=ifce,dc=edu,dc=br
  [ldap] ldap_get_conn: Checking Id: 0
  [ldap] ldap_get_conn: Got Id: 0
  [ldap] performing search in dc=ifce,dc=edu,dc=br, with filter (uid=steve)
  [ldap] object not found
[ldap] search failed
  [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns notfound
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns updated
Found Auth-Type = PAP
+- entering group PAP {...}
[pap] login attempt with password "testing"
[pap] Using clear text password "testing"
[pap] User authenticated successfully
++[pap] returns ok
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 119 to 127.0.0.1 port 57388
Service-Type = Framed-User
 Framed-Protocol = PPP
 Framed-IP-Address = 172.16.3.33
 Framed-IP-Netmask = 255.255.255.0
 Framed-Routing = Broadcast-Listen
 Framed-Filter-Id = "std.ppp"
 Framed-MTU = 1500
 Framed-Compression = Van-Jacobson-TCP-IP
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 1 ID 119 with timestamp +263
Ready to process requests.

-- 
Atenciosamente,

Inácio Alves
Bacharel em Matemática (UFC)/ Técnico em Conectividade(IFCE)
http://www.polluxweb.com/inacioalves/site/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20100517/f76e7c07/attachment.html>


More information about the Freeradius-Users mailing list