<div dir="ltr"><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">Dear Good Peoples Greetings</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">Version Information: FreeRADIUS 2.2.0. </font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><span style="font-family:georgia,serif">Question: What does the following means? Is it not authentication area in "default" virtual server? i have listed "ldap" there. </span><br>
</p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif" color="#ff00ff">1.) rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed in the "authenticate" section.</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"><br></font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">2.) i have one Linux open-ldap server, FreeRADIUS Auth works from that LDAP server, with following configuration. </font><span style="font-family:georgia,serif">Please note, the passport storage in destination Linux LDAP Server is cleartext. i do check using the following command.</span></p>
<p style="font-family:arial,sans-serif;font-size:13px"><b><span style="font-family:georgia,serif"> </span><span style="font-family:georgia,serif">radtest mike aabb88@ localhost 1812 HYbbunINFDR$88</span><span style="font-family:georgia,serif"> </span></b><font face="georgia, serif"><br>
</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"># CentOS Open-ldap Server</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> server = "<a href="http://ldap.digital-infotech.net/" target="_blank">ldapserver-mydomain.net</a>"</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> identity = "cn=Administrator,dc=ldap-mydomain,dc=net"</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> password = "password"</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> basedn = "dc=mydomain,dc=net"</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> base_filter = "(objectclass=radiusprofile)"</font></p><p style="font-family:arial,sans-serif;font-size:13px"><span style="font-family:georgia,serif"> </span></p>
<p style="font-family:arial,sans-serif;font-size:13px"><span style="font-family:georgia,serif">i receive, a</span><span style="font-family:georgia,serif">ccess Accept !!! - NO problem</span></p><p style="font-family:arial,sans-serif;font-size:13px">
<font face="georgia, serif"><br></font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">3.) When i do user query from FreeRADIUS to Windows Domain Controller Server 2012 x64. </font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"># Windows Domain Controller Server 2012 64-Bit AD </font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> server = "<a href="http://ldap-teledataict.com/" target="_blank">ldap-mydomain.com</a>"</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> identity = "cn=Administrator,cn=Users,dc=ldap-mydomain,dc=com"</font></p><p style="font-family:arial,sans-serif;font-size:13px">
<font face="georgia, serif"> password = "password"</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> basedn = "dc=ldap-mydomain,dc=com"</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><span style="font-family:georgia,serif"><br></span></p><p style="font-family:arial,sans-serif;font-size:13px"><span style="font-family:georgia,serif"># Enable One Filter Only</span><br>
</p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> #filter = "(SamAccountName=%u)"</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})"</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> </font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">3a) Following is the out-put with REJECT access, Perhaps because password storage in AD is not clear text, is it due to that? Perhaps it cannot be tested with redtest? </font><span style="font-family:georgia,serif"> i am using the following to test, is it correct test</span></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"><b> radtest mike aabb88@ localhost 1812 HYbbunINFDR$88</b></font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">4.) rad_recv: Access-Request packet from host 127.0.0.1 port 46861, id=137, length=75</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> User-Name = "mike"</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> User-Password = "aabb88@"</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> NAS-IP-Address = 14.14.14.14</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> NAS-Port = 1812</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> Message-Authenticator = 0x4a3417dcf9e80de96f2274fbfa6f5c4d</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"># Executing section authorize from file /etc/freeradius/sites-enabled/default</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">+- entering group authorize {...}</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">++[preprocess] returns ok</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">++[digest] returns noop</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">[suffix] No '@' in User-Name = "mike", looking up realm NULL</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">[suffix] No such realm "NULL"</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">++[suffix] returns noop</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">[eap] No EAP-Message, not doing EAP</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">++[eap] returns noop</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">[ldap] performing user authorization for mike</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">[ldap] expand: (SamAccountName=%u) -> (SamAccountName=mike)</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">[ldap] expand: dc=ldap-teledataict,dc=com -> dc=ldap-teledataict,dc=com</font></p><p style="font-family:arial,sans-serif;font-size:13px">
<font face="georgia, serif"> [ldap] ldap_get_conn: Checking Id: 0</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> [ldap] ldap_get_conn: Got Id: 0</font></p><p style="font-family:arial,sans-serif;font-size:13px">
<font face="georgia, serif"> [ldap] attempting LDAP reconnection</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> [ldap] (re)connect to <a href="http://ldap-teledataict.com:389/" target="_blank">ldap-mydomain.net:389</a>, authentication 0</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> [ldap] bind as cn=Administrator,cn=Users,dc=ldap-teledataict,dc=com/rootadmin to <a href="http://ldap-teledataict.com:389/" target="_blank">ldap-mydomain.net:389</a></font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> [ldap] waiting for bind result ...</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> [ldap] Bind was successful</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"> [ldap] performing search in dc=ldap-teledataict,dc=com, with filter (SamAccountName=mike)</font></p><p style="font-family:arial,sans-serif;font-size:13px">
<font face="georgia, serif">[ldap] No default NMAS login sequence</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">[ldap] looking for check items in directory...</font></p><p style="font-family:arial,sans-serif;font-size:13px">
<font face="georgia, serif">[ldap] looking for reply items in directory...</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif" color="#ff00ff">WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly?</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">[ldap] <font color="#0000ff">user mike authorized to use remote access</font></font></p><p style="font-family:arial,sans-serif;font-size:13px">
<font face="georgia, serif"> [ldap] ldap_release_conn: Release Id: 0</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">++[ldap] returns ok</font></p><p style="font-family:arial,sans-serif;font-size:13px">
<font face="georgia, serif">rlm_sqlcounter: Entering module authorize code</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">rlm_sqlcounter: Could not find Check item value pair</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">++[dailycounter] returns noop</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">rlm_sqlcounter: Entering module authorize code</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">rlm_sqlcounter: Could not find Check item value pair</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">++[forevertimecounter] returns noop</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">++[expiration] returns noop</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">++[logintime] returns noop</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">rlm_sqlcounter: Entering module authorize code</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">rlm_sqlcounter: Could not find Check item value pair</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">++[gigawordcounter] returns noop</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif" color="#ff00ff">[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">++[pap] returns noop</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif" color="#ff00ff">ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user </font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">Failed to authenticate the user.</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">Using Post-Auth-Type REJECT</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"># Executing group from file /etc/freeradius/sites-enabled/auth_all</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">+- entering group REJECT {...}</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">[attr_filter.access_reject] expand: %{User-Name} -> mike</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">attr_filter: Matched entry DEFAULT at line 11</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">++[attr_filter.access_reject] returns updated</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">Delaying reject of request 0 for 1 seconds</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">Going to the next request</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">Waking up in 0.9 seconds.</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">Sending delayed reject for request 0</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif" color="#ff00ff">Sending Access-Reject of id 137 to 127.0.0.1 port 46861</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">Waking up in 4.9 seconds.</font></p><p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">Cleaning up request 0 ID 137 with timestamp +3</font></p>
<p style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">Ready to process requests.</font></p><div style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif"><br></font></div>
<div style="font-family:arial,sans-serif;font-size:13px"><font face="georgia, serif">Thanks / Regards</font></div></div>