June 2009 - Freeradius-Users - lists.freeradius.org

Definitive Word on FreeRadius/LDAP/EAP Requirements
by Aaron Mahler 27 Jun '09

27 Jun '09

Hello! I've been going in circles - as have many (based on the posts I've read all over the web) - trying to assemble a working combination of Freeradius, Fedora Directory Server (LDAP), and a fleet of wireless access points that seem to want to do EAP. I want anyone with a record in my LDAP server to be able to authenticate via 802.1x from these AP's. The records consist of uid, givenName, sn, mail and userPassword. For starters, I was hoping to just ask a few key questions to try to clear up various contradictory comments I've seen in the zillion things I've read in the last 12 hours: - Is it, in fact, possible to combine 802.1X, EAP, Freeradius and Fedora Directory Server in this manner? - If so (and I'm guessing it is possible), can someone clarify the clear-text vs. encryption issues related to EAP and LDAP? By this, I mean: - Some have said EAP and LDAP can't be combined because LDAP requires plain text passwords here and EAP doesn't play ball in that manner - I've seen conflicting comments on whether the passwords need to be clear-text in my LDAP database or not (or at least how Fedora DS needs to handle its password encryption settings) - Again, if this combination is possible, how far off from a -default- install of the latest Freeradius would the configuration be? It's easy to start making changes to the config and lose your bearings in short order... and, of course, hundreds of lines of debug output scroll by when doing a single 802.1X login attempt. I've repeatedly been able to do radtest checks against LDAP with no problems - but I realize that isn't involving EAP. I just say this to confirm that my LDAP server and Freeradius can talk just fine. I've had no problem with a file-based account with a clear-text password working all the way through the 802.1X process from the AP using EAP. It's when I try to combine the two that things go off the rails. I'll wrap this up with a copy from the debug log of the opening request from an AP in case it helps a bit (IP address xxx'd out in my paste): rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx port 32774, id=6, length=156 User-Name = "ldaptest" NAS-IP-Address = 6.48.0.186 NAS-Port = 0 Called-Station-Id = "00-18-0A-30-00-BA:SBC WiFi" Calling-Station-Id = "00-26-08-62-FD-6E" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0201000d016c64617074657374 Message-Authenticator = 0x51deb89362f5b9e1c391e88d255eeefa This is followed by the first query (authorize) to the LDAP server happening with TLS mode set to 1 (port 636 - should be a valid SSL conversation) and it binding successfully using an administrative DN. rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful The account I'm testing (ldaptest) is, for the time being, stored on the LDAP server with a clear-text password due to my questions above. In the test above, I had added: checkItem Cleartext-Password userPassword to my ldap.attrmap. Without that line, the same login test results in: rlm_ldap: performing search in ou=People,dc=sbc,dc=edu, with filter (uid=ldaptest) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user ldaptest authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok The conversation continues on through the TLS segment, offering the example SSL cert to my connecting device (an iPhone talking to the AP in this test), me approving the offered cert on the iPhone and - a moment later - an error that the login/password are wrong. If I start here - with a fresh Freeradius install, references to LDAP uncommented, and basic LDAP parameters properly configured (server, bind dn, base, etc) - could I get some clear points on how to proceed with the configuration? Thanks! - Aaron

6 13

Distinguish RADIUS requests from NAS device
by Andrew Hall 26 Jun '09

26 Jun '09

Hi there. We have a network device using FreeRADIUS 1.x for authentication. This RADIUS server in turn queries an LDAP server. We wish to distinguish between "admin" and "login" requests but are struggling to differentiate between the two. At the moment we identify the device by its NAS address but cannot distinguish which type of login request is being made - so cannot then choose which LDAP groups to query. Our only solution so far is to run separate instances of RADIUS and direct the network device to each instance per the request type it receives. Can anyone this of another way to distinguish the requests ? Thanks very much.

3 2

Unlang authentication help
by Scott Angus 26 Jun '09

26 Jun '09

hello, I'm trying to use unlang to limit LDAP user's access to different network devices. Here is what I have so far in the site-enable/default: Auth-Type LDAP { ldap if(NAS-IP-Address == 10.1.1.1 && LDAP-Group == 'RouterAdmin') { ok } else { reject } } Right now that works if your LDAP radiusGroupName = RouterAdmin and you are trying to connect to 10.1.1.1 but i would like to add NAS-IP-Addresses and associate them with a radiusGroupName. This is were I'm having trouble. It would be nice it I could just reference a file for the IP's like: RouterAdminList = /usr/local/etc/raddbd/devices/RouterAdmin if(NAS-IP-Address == %{RouterAdminList} && LDAP-Group == 'RouterAdmin') { And have multiple lines.: if(NAS-IP-Address == %{RouterAdminList} && LDAP-Group == 'RouterAdmin') OR if(NAS-IP-Address == %{SwitchAdminList} && LDAP-Group == 'SwitchAdmin') OR if(NAS-IP-Address == %{WifiAdminList} && LDAP-Group == 'WifiAdmin') { ok } else { reject } } How would i do that? And how would list the IP address in the files? Thanks for your help, Scott

4 3

RE: EAP-TTLS (PAP) with Win2K3 domain not working
by Petar Marinkovic 26 Jun '09

26 Jun '09

Thing is that, colleague has a software, developed by his company, I cannot disclose which one, that can test eap-gtc,and that works. And the thing is, when he tries to connect to freeradius server I set up, he cannot auth with domain username and pw. He can auth with EAP-TLS, EAP-TTLS with PAP, EAP-mschapv1 and EAP-mschapv2 and the only thing left to try is EAP-GTC. So my question is, what need's to be done on server side to make that happen? This is server output [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop ++? if (!control:Auth-Type) ? Evaluating !(control:Auth-Type) -> FALSE ++? if (!control:Auth-Type) -> FALSE Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/gtc [eap] processing type gtc [gtc] +- entering group PAP {...} [pap] login attempt with password "testpass" [pap] No password configured for the user. Cannot do authentication ++[pap] returns fail [eap] Handler failed in EAP/gtc [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server inner-tunnel [ttls] Got tunneled reply code 3 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 [ttls] Got tunneled Access-Reject SSL: Removing session 28767d93f75a91c5975ff5a5bb2862e3703de9c700b7e4e1a6db061068d2a37a from the cache [eap] Handler failed in EAP/ttls rlm_eap_ttls: Freeing handler for user test [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> Anonymous attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated So my question is, what needs to be setup in order to make eap-gtc work with win2k3 domain? Thanks once again, you've been most helpful Cheers, Petar On Fri, Jun 26, 2009 at 14:10, Ivan Kalik <tnt(a)kalik.net> wrote: > > All of this is for testing purposes. So, I just need all of those methods > > to > > work, if it can't work with domain, then cleartext password will be fine. > > Can you give me some more info about seting up TTLS-GTC, testing is being > > done on Windows XP. Also, for EAP-TTLS with chap, enabling user is > enough, > > right? > > Every method that works with passwords will work with Cleartext-Password > in users file. Working with encrypted passwords is restricting choice. > > wpa_supplicant has a Windows port. It should work with all the mentioned > protocols. For download and documentation (installation, configuration) > look up their site. Their testing tool (eapol_test) is used extensively by > freeradius developers for testing EAP protocols without the hardware. > > Ivan Kalik > Kalik Informatika ISP > >

1 0

Re: EAP-TTLS (PAP) with Win2K3 domain not working
by Petar Marinkovic 26 Jun '09

26 Jun '09

Hi Ivan, All of this is for testing purposes. So, I just need all of those methods to work, if it can't work with domain, then cleartext password will be fine. Can you give me some more info about seting up TTLS-GTC, testing is being done on Windows XP. Also, for EAP-TTLS with chap, enabling user is enough, right? Sorry if some of my questiosn doesn't make sense, still new to all of this On Fri, Jun 26, 2009 at 13:44, Ivan Kalik <tnt(a)kalik.net> wrote: > > What's left for me, I would like to authenticate users in domain with > LEAP > > and TTLS-GTC. > > Leap is rubbish and shouldn't be used ("Cisco LEAP, similar to WEP, has > had well-known security weaknesses since 2003 involving offline password > cracking."). For TTLS-GTC all you need is a supplicant that supports it. I > know only of wpa_supplicant. > > > Also, what's needed to make EAP-TTLS with CHAP work? > > Supplicant that supports it. > > > I know > > you can't use ntlm_auth for that, so what do I need to put inside users > > file? Will creating test user, for example, test Cleartext-Password:= > > "test" > > work? > > Yes, chap can't be made to work with AD; it will work fine with clear > passwords in users file. But storing passwords in several places (AD, > users file, ...) is a bit of an administration nightmare. With AD you tend > to change passwords every 6 weeks - how are you going to keep other > passwords in sync? > > Ivan Kalik > Kalik Informatika ISP > >

1 0

Re: EAP-TTLS (PAP) with Win2K3 domain not working
by Petar Marinkovic 26 Jun '09

26 Jun '09

Ah yes, now it started, thanks a lot. Will see if now EAP-TTLS with PAP works. Thanks a lot mate, you saved my life (for now :) Cheers, Petar On Fri, Jun 26, 2009 at 11:38, Ivan Kalik <tnt(a)kalik.net> wrote: > > Similar error, again when the server is starting > > > > Module: Linked to module rlm_files > > Module: Instantiating files > > files { > > usersfile = "/etc/freeradius/users" > > acctusersfile = "/etc/freeradius/acct_users" > > preproxy_usersfile = "/etc/freeradius/preproxy_users" > > compat = "no" > > } > > /etc/freeradius/sites-enabled/inner-tunnel[157]: ERROR: Unknown value > > ntlm_auth_pap for attribute Auth-Type > > You haven't listed ntlm_auth_pap in authenticate section of inner-tunnel > virtual server. > > Ivan Kalik > Kalik Informatika ISP > >

1 1

Huawei WiMax ASN-GW & FreeRadius as AAA
by Paul Carter-Brown 26 Jun '09

26 Jun '09

Hi, I am looking to utilise FreeRadius as the AAA infrastructure behind a Huawei WASN-Gateway on a bleeding edge WiMax network we have implemented for low cost VOIP in Africa. I was wondering if anyone on the forum has experience with Freeradius on WiMax and would be able to help us achieve this on a paid-for basis? Work would be remote via VPN into our infrastructure, or you could join us in Uganda! Let me know if anyone could help with this, or even just point me in the right direction. Unfortunately we don't have capacity in our current team to do this and are looking for someone to jumpstart the effort. Thanks so much Paul CIO Smile Communications www.smilecoms.com

1 0

EAP-TTLS (PAP) with Win2K3 domain not working
by Petar Marinkovic 26 Jun '09

26 Jun '09

First, thanks Alan for your help, I managed to make it work with AD. Now I want to try to test to make EAP-TTLS with PAP to authenticate users in domain. I saw this link http://lists.freeradius.org/mailman/htdig/freeradius-users/2008-March/msg00… So I added following lines to modules section of radiusd.conf exec ntlm_auth_pap { wait = yes input_pairs = request shell_escape = yes output = none program = "/path/to/ntlm_auth --username=%{User-Name} --domain=EXCHANGE --password=%{User-Password}" } and I edited /etc/freeradius/sites-available/default file and /etc/freeradius/sites-enabled/default, section authenticate to Auth-Type PAP { ntlm_auth_pap } But when user tries to connect, I get following error: [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "testuser" User-Password = "testuserpass" FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "testuser" User-Password = "testuserpass" FreeRADIUS-Proxied-To = 127.0.0.1 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. } # server inner-tunnel [ttls] Got tunneled reply code 3 [ttls] Got tunneled Access-Reject SSL: Removing session 963d9312e7948dc613d384208137728dce44b3071923bb0c257aeaf9229a1a95 from the cache [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. If someone can help, that would be great. Thanks once again for your help with my previous question folks, I really appreciate it.

4 7

Re: EAP-TTLS (PAP) with Win2K3 domain not working
by Petar Marinkovic 26 Jun '09

26 Jun '09

Similar error, again when the server is starting Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } /etc/freeradius/sites-enabled/inner-tunnel[157]: ERROR: Unknown value ntlm_auth_pap for attribute Auth-Type /etc/freeradius/sites-enabled/inner-tunnel[156]: Failed to parse "update" subsection. /etc/freeradius/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. Errors initializing modules That part of code in in /etc/freeradius/sites-enabled/inner-tunnel and /etc/freeradius/sites-available/inner-tunnel files, like this pap if(!control:Auth-Type) { update control { Auth-Type = ntlm_auth_pap } } Thanks in advance! Petar On Fri, Jun 26, 2009 at 11:22, Ivan Kalik <tnt(a)kalik.net> wrote: > > In eap.conf, for eap-ttls there is a line > > > > virtual_server = "inner-tunnel" > > > > I put this part of your code in > /etc/freeradius/sites-enabled/inner-tunnel > > and /etc/freeradius/sites-available/inner-tunnel files, like this > > > > Auth-Type PAP > > { > > pap > > } > > > > if(!control:Auth-Type) { > > update control { > > Auth-Type = ntlm_auth_pap > > } > > } > > Sorry, mistake in my instructions. Put that in authorize (not > authenticate) after pap. > > > and when I try to restart the server, I get following error: > > > > radiusd: #### Loading Virtual Servers #### > > server inner-tunnel { > > modules { > > Module: Checking authenticate {...} for more modules to load > > Module: Linked to module rlm_pap > > Module: Instantiating pap > > pap { > > encryption_scheme = "auto" > > auto_header = no > > } > > /etc/freeradius/sites-enabled/inner-tunnel[186]: ERROR: Unknown value > > ntlm_auth_pap for attribute Auth-Type > > > > /etc/freeradius/sites-enabled/inner-tunnel[185]: Failed to parse > > "update" subsection. > > > > /etc/freeradius/sites-enabled/inner-tunnel[176]: Errors parsing > > authenticate section. > > > > Errors initializing modules > > > > Sorry if I am asking stupid questions, but I am new to linux and > > freeradius, > > and this is all so confusing for me :) What I am doing wrong? > > > > > > On Fri, Jun 26, 2009 at 00:03, Ivan Kalik <tnt(a)kalik.net> wrote: > > > >> > First, thanks Alan for your help, I managed to make it work with AD. > >> Now > >> I > >> > want to try to test to make EAP-TTLS with PAP to authenticate users in > >> > domain. I saw this link > >> > > >> > http://lists.freeradius.org/mailman/htdig/freeradius-users/2008-March/msg00… > >> > > >> > So I added following lines to modules section of radiusd.conf > >> > > >> > exec ntlm_auth_pap { > >> > wait = yes > >> > input_pairs = request > >> > shell_escape = yes > >> > output = none > >> > > >> > program = "/path/to/ntlm_auth --username=%{User-Name} > >> --domain=EXCHANGE > >> > --password=%{User-Password}" > >> > } > >> > > >> > and I edited /etc/freeradius/sites-available/default file and > >> > /etc/freeradius/sites-enabled/default, section authenticate to > >> > > >> > Auth-Type PAP > >> > { > >> > ntlm_auth_pap > >> > } > >> > >> Don't do that. One - it's a wrong virtual server and two - it's not > >> going > >> to work. Use the same technique as in the guide for pap requests. List > >> ntlm_auth_pap in authenticate section of inner-tunnel virtual server > >> (look > >> at ttls section of eap.conf and you will see where will inner tunnel > >> requests end up). Forcing Auth-Type in users file might break a few > >> things > >> so add this to authenticate section of inner-tunnel virtual server > >> *after* > >> pap instead: > >> > >> if(!control:Auth-Type) { > >> update control { > >> Auth-Type = ntlm_auth_pap > >> } > >> } > >> > >> That will set Auth-Type to ntlm_auth_pap for a pap inner tunnel request > >> if > >> password is nowhere to be found. > >> > >> Ivan Kalik > >> Kalik Informatika ISP > >> > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > > > > > Ivan Kalik > Kalik Informatika ISP > >

1 0

freeradius 2.1.6 ldap + mschapv2 to authenticate
by jpablorp 26 Jun '09

26 Jun '09

Hi everyone. I've trying to setup a freeradius 2.1.6 with Ldap and mschapv2 to authenticate. when I send test from my console, this works fine. client: $ radtest user pass 10.14.56.26 0 secret. server in debug mode: Ready to process requests. rad_recv: Access-Request packet from host 172.24.104.12 port 39285, id=52, length=69 User-Name = "user" User-Password = "pass" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop [ldap] performing user authorization for user [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (&(SamAccountName=%{Stripped-User-Name:-%{User-Name})(memberOf=CN=Wireless,OU=Groups,DC=it,DC=test,DC=com)) -> (&(SamAccountName=user)(memberOf=CN=Wireless,OU=Groups,DC=it,DC=test,DC=com)) [ldap] expand: OU=Groups,DC=it,DC=test,DC=com -> OU=Groups,DC=it,DC=test,DC=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.14.56.100:389, authentication 0 rlm_ldap: bind as admin(a)it.test.com/adminpass to 10.14.56.100:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in OU=Groups,DC=it,DC=test,DC=com, with filter (&(SamAccountName=user)(memberOf=CN=Wireless,OU=Groups,DC=it,DC=test,DC=com)) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = ldap [ldap] user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok Found Auth-Type = ldap +- entering group authenticate {...} [ldap] login attempt by "user" with password "pass" [ldap] user DN: CN=user,OU=General Group,OU=Users,DC=it,DC=test,DC=com rlm_ldap: (re)connect to 10.14.56.100:389, authentication 1 rlm_ldap: bind as CN=user,OU=General Group,OU=Users,DC=it,DC=test,DC=com/pass to 10.14.56.100:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful [ldap] user user authenticated succesfully ++[ldap] returns ok Login OK: [user/pass] (from client redprivada1 port 0) Sending Access-Accept of id 52 to 172.24.104.12 port 39285 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 52 with timestamp +10 But when I try to connect. rad_recv: Access-Request packet from host 10.14.56.33 port 32768, id=174, length=189 User-Name = "user" Calling-Station-Id = "00-24-2C-83-AA-92" Called-Station-Id = "00-21-A1-9E-F9-30:redprivada1" NAS-Port = 1 NAS-IP-Address = 10.14.56.33 NAS-Identifier = "acces-ponit-wlc" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020e0016016a75616e7061626c6f5f72616d6972657a Message-Authenticator = 0x76c7af8be679e0867bb2c06d1146d7e6 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop [ldap] performing user authorization for user [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (&(SamAccountName=%{Stripped-User-Name:-%{User-Name})(memberOf=CN=Wireless,OU=Groups,DC=it,DC=test,DC=com)) -> (&(SamAccountName=user)(memberOf=CN=Wireless,OU=Groups,DC=it,DC=test,DC=com)) [ldap] expand: OU=Groups,DC=it,DC=test,DC=com -> OU=Groups,DC=it,DC=test,DC=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Groups,DC=it,DC=test,DC=com, with filter (&(SamAccountName=user)(memberOf=CN=Wireless,OU=Groups,DC=it,DC=test,DC=com)) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "10.14.56.100" port = 389 password = "H4b4cuc69" identity = "juanpablo_ramirez(a)na.foxconn.com" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" basedn = "OU=GDL1,OU=Sites,OU=PCEBG-Sites,DC=na,DC=foxconn,DC=com" filter = "(&(SamAccountName=%{Stripped-User-Name:-%{User-Name})(memberOf =CN=Wireless,OU=Groups,OU=GDL1,OU=Sites,OU=PCEBG-Sites,DC=na,DC=foxconn,DC=com)) " base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-U serDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Ne twork rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group- Id conns: 0x8188780 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NA S-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y %m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/freeradius/freeradius.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/freeradius/freeradius.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.14.56.33 port 32768, id=177, length=189 User-Name = "juanpablo_ramirez" Calling-Station-Id = "00-24-2C-83-AA-92" Called-Station-Id = "00-21-A1-9E-F9-30:foxconnGDL" NAS-Port = 1 NAS-IP-Address = 10.14.56.33 NAS-Identifier = "foxconn-gdl-wlc" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02110016016a75616e7061626c6f5f72616d6972657a Message-Authenticator = 0x5fdfd0ad23a6627e34d4b79a1e5c87c7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "juanpablo_ramirez", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop [ldap] performing user authorization for juanpablo_ramirez [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (&(SamAccountName=%{Stripped-User-Name:-%{User-Name})(memberOf=CN=Wireless,OU=Groups,OU=GDL1,OU=Sites,OU=PCEBG-Sites,DC=na,DC=foxconn,DC=com)) -> (&(SamAccountName=juanpablo_ramirez)(memberOf=CN=Wireless,OU=Groups,OU=GDL1,OU=Sites,OU=PCEBG-Sites,DC=na,DC=foxconn,DC=com)) [ldap] expand: OU=GDL1,OU=Sites,OU=PCEBG-Sites,DC=na,DC=foxconn,DC=com -> OU=GDL1,OU=Sites,OU=PCEBG-Sites,DC=na,DC=foxconn,DC=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.14.56.100:389, authentication 0 rlm_ldap: bind as juanpablo_ramirez(a)na.foxconn.com/H4b4cuc69 to 10.14.56.100:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in OU=GDL1,OU=Sites,OU=PCEBG-Sites,DC=na,DC=foxconn,DC=com, with filter (&(SamAccountName=juanpablo_ramirez)(memberOf=CN=Wireless,OU=Groups,OU=GDL1,OU=Sites,OU=PCEBG-Sites,DC=na,DC=foxconn,DC=com)) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user juanpablo_ramirez authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> juanpablo_ramirez attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 177 to 10.14.56.33 port 32768 Waking up in 4.9 seconds. Cleaning up request 0 ID 177 with timestamp +103 Ready to process requests. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 177 to 10.14.56.33 port 32768 Waking up in 4.9 seconds. Cleaning up request 0 ID 177 with timestamp +103 Ready to process requests. I don't know what I'm missing. here is my radiusd.conf: modules { $INCLUDE ${confdir}/eap.conf ldap { server = "10.14.56.100" basedn = "OU=Groups,DC=it,DC=test,DC=com" identity = "admin(a)it.test.com" password = adminpass filter = "(&(SamAccountName=%{Stripped-User-Name:-%{User-Name})(memberOf=CN=Wireless,OU=Groups,DC=it,DC=test,DC=com))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 } $INCLUDE ${(confdir)}/modules/ } authorize { preprocess suffix eap files ldap } authenticate { ldap unix mschap eap } I don't make changes in users file. It's the original file. Please help me. -- View this message in context: http://www.nabble.com/freeradius-2.1.6-ldap-%2B-mschapv2-to-authenticate-tp… Sent from the FreeRadius - User mailing list archive at Nabble.com.

7 13