From vilius@lnk.lt Thu Sep  1 11:32:14 2005
From: Vilius =?utf-8?q?=C5=A0umskas?= <vilius@lnk.lt>
To: freeradius-users@lists.freeradius.org
Subject: CHAP/MS-CHAP/MS-CHAPv2 + LDAP problem
Date: Thu, 01 Sep 2005 12:32:11 +0300
Message-ID: <20050901123211.l177g6qcwckk88wo@mail.lnk.lt>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============3770819786281215558=="

--===============3770819786281215558==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit

Hello,

I'm having trouble authenticating from VPN box through Radius server to LDAP.
My VPN uses MS-CHAP challenge/response system for authentification. 
Packet that comes from VPN to Radius server looks like this:

User-Name = "admin"
MS-CHAP-Challenge = 0x45bc0700dd22f6795f77bbe0d986328c
MS-CHAP2-Response = 
0x0100313396a8ea58cd1155c817c50a00715b0000000000000000b03e5340a5ae3c2ac4e
9408d57eae02fcfdbffab3f983a1b
NAS-Port = 0
NAS-Port-Type = Virtual
Service-Type = Framed-User
Framed-Protocol = PPP
Framed-IP-Address = 10.1.1.202

But Radius can't autenticate to LDAP as there is no User-Password 
attribute in the packet. (rlm_ldap: Attribute "User-Password" is 
required for authentication).

Is there a way to do this authentification and NOT turning MS-CHAP 
protocol in VPN box? Are there some kind of preauth hooks in Radius?

I'm using freeradius-1.0.1-1.1.RHEL3 with openldap-2.0.27-17 and 
Netware 6.0 Directory Services.


P.S. I tried to turn MS-CHAP protocol and it works great with PAP or 
plain-text passwords. So everything is configured to work well with 
LDAP.

-- 
  Best Regards,

  Vilius Šumskas
  LNK TV system administrator
  mob.: +370 614 75713




--===============3770819786281215558==--


From aland@ox.org Thu Sep  1 23:05:05 2005
From: Alan DeKok <aland@ox.org>
To: freeradius-users@lists.freeradius.org
Subject: Re: CHAP/MS-CHAP/MS-CHAPv2 + LDAP problem 
Date: Thu, 01 Sep 2005 17:06:30 -0400
Message-ID: <20050901210630.5E05316FAB@mail.nitros9.org>
In-Reply-To: <20050901123211.l177g6qcwckk88wo@mail.lnk.lt>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1846611613088974153=="

--===============1846611613088974153==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

Vilius =?utf-8?b?xaB1bXNrYXM=?= <vilius@lnk.lt> wrote:
> But Radius can't autenticate to LDAP as there is no User-Password 
> attribute in the packet. (rlm_ldap: Attribute "User-Password" is 
> required for authentication).

  Use LDAP as a database, not as an authentication server.

  See many, many, posts on this topic to this list.

> Is there a way to do this authentification and NOT turning MS-CHAP 
> protocol in VPN box? Are there some kind of preauth hooks in Radius?

  Have FreeRADIUS get the password from LDAP, and let FreeRADIUS do
the authentication.

  Alan DeKok.

--===============1846611613088974153==--


From l13614@alunos.uevora.pt Thu Sep  1 23:16:24 2005
From: Tiago Fernandes <l13614@alunos.uevora.pt>
To: freeradius-users@lists.freeradius.org
Subject: Re: CHAP/MS-CHAP/MS-CHAPv2 + LDAP problem
Date: Thu, 01 Sep 2005 22:16:11 +0100
Message-ID: <1125609371.3607.7.camel@pyka.crinnet.net>
In-Reply-To: <20050901123211.l177g6qcwckk88wo@mail.lnk.lt>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============5732660569516250799=="

--===============5732660569516250799==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

On Thu, 2005-09-01 at 12:32 +0300, Vilius =C5=A0umskas wrote:
> Hello,
>=20
> I'm having trouble authenticating from VPN box through Radius server to LDA=
P.
> My VPN uses MS-CHAP challenge/response system for authentification.=20
> Packet that comes from VPN to Radius server looks like this:
>=20
> User-Name =3D "admin"
> MS-CHAP-Challenge =3D 0x45bc0700dd22f6795f77bbe0d986328c
> MS-CHAP2-Response =3D=20
> 0x0100313396a8ea58cd1155c817c50a00715b0000000000000000b03e5340a5ae3c2ac4e
> 9408d57eae02fcfdbffab3f983a1b
> NAS-Port =3D 0
> NAS-Port-Type =3D Virtual
> Service-Type =3D Framed-User
> Framed-Protocol =3D PPP
> Framed-IP-Address =3D 10.1.1.202
>=20
> But Radius can't autenticate to LDAP as there is no User-Password=20
> attribute in the packet. (rlm_ldap: Attribute "User-Password" is=20
> required for authentication).
>=20

insert the NT-Password (ntPassword) attribute into ldap user. this
attibute is field with a NT hash value

example:=20
 password: test
 NT Hash: 0CB6948805F797BF2A82807973B89537

> Is there a way to do this authentification and NOT turning MS-CHAP=20
> protocol in VPN box? Are there some kind of preauth hooks in Radius?
>=20
> I'm using freeradius-1.0.1-1.1.RHEL3 with openldap-2.0.27-17 and=20
> Netware 6.0 Directory Services.
>=20
>=20
> P.S. I tried to turn MS-CHAP protocol and it works great with PAP or=20
> plain-text passwords. So everything is configured to work well with=20
> LDAP.
>=20

--===============5732660569516250799==
Content-Type: application/pgp-signature
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="signature.asc"
MIME-Version: 1.0

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbjogR251UEcgdjEuNC4xIChHTlUv
TGludXgpCgppRDhEQlFCREYyK2JWYzU2czlLdU16MFJBa0UyQUo5b3FTdXF2Qko5c0YwWW4vQnMw
ZWl3WHc2T1JBQ2ZlMzR2Ckh6V21jd0VDNHBJS2lNNW5XQ1o0MDlzPQo9T0dXdgotLS0tLUVORCBQ
R1AgU0lHTkFUVVJFLS0tLS0K

--===============5732660569516250799==--


From vilius@lnk.lt Fri Sep  2 10:00:03 2005
From: Vilius =?utf-8?q?=C5=A0umskas?= <vilius@lnk.lt>
To: freeradius-users@lists.freeradius.org
Subject: Re: CHAP/MS-CHAP/MS-CHAPv2 + LDAP problem
Date: Fri, 02 Sep 2005 11:00:01 +0300
Message-ID: <20050902110001.73sglbiinps88swc@mail.lnk.lt>
In-Reply-To: <20050901210630.5E05316FAB@mail.nitros9.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============5056596540424459791=="

--===============5056596540424459791==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit

Alan DeKok <aland@ox.org> rašė:

>  Use LDAP as a database, not as an authentication server.
>
>  See many, many, posts on this topic to this list.
>
>> Is there a way to do this authentification and NOT turning MS-CHAP
>> protocol in VPN box? Are there some kind of preauth hooks in Radius?
>
>  Have FreeRADIUS get the password from LDAP, and let FreeRADIUS do
> the authentication.
>
>  Alan DeKok.

Thanks. I finally figured it out by myself. Sorry for posting early.

I have another problem though.

When I connect to VPN, user and password are verified and radius says 
their are ok. After that VPN client registers me on the network (gets 
IP address and so on). But in the middle of registration something 
happens and I get disconnected. There are no errors in Radius server 
log. However there are some in VPN server's:

Connect: ppp0 <--> /dev/ttyp0
MSCHAP-v2 peer authentication succeeded for admin
found interface eth0 for proxy arp
local IP address 10.1.1.1
remote IP address 10.1.1.202
executing firewall rules
signal SIGUSR1 received - rebuilding portmappings
RADIUS: server 213.190.40.42 not responding
RADIUS: server 213.190.40.42 not responding

Is is because of some strange external/internal IP problems? What 
Radius server must do after I authenticate?

-- 
  Best Regards,

  Vilius



--===============5056596540424459791==--


From aland@ox.org Fri Sep  2 16:54:50 2005
From: Alan DeKok <aland@ox.org>
To: freeradius-users@lists.freeradius.org
Subject: Re: CHAP/MS-CHAP/MS-CHAPv2 + LDAP problem 
Date: Fri, 02 Sep 2005 10:56:12 -0400
Message-ID: <20050902145612.D7DC316FAB@mail.nitros9.org>
In-Reply-To: <20050902110001.73sglbiinps88swc@mail.lnk.lt>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1689982067284921691=="

--===============1689982067284921691==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

Vilius =?utf-8?b?xaB1bXNrYXM=?= <vilius@lnk.lt> wrote:
> When I connect to VPN, user and password are verified and radius says 
> their are ok. After that VPN client registers me on the network (gets 
> IP address and so on). But in the middle of registration something 
> happens and I get disconnected.

  If something happens after RADIUS sends an Access-Accept, it's not a
RADIUS authentication problem.

> RADIUS: server 213.190.40.42 not responding
> RADIUS: server 213.190.40.42 not responding
> 
> Is is because of some strange external/internal IP problems? What 
> Radius server must do after I authenticate?

  Nothing.  RADIUS is driven by the client, not the server.

  Your client is trying to RADIUS after it's authenticated.  Find out
why.

  Alan DeKok.



--===============1689982067284921691==--


From vilius@lnk.lt Sat Sep  3 12:53:31 2005
From: Vilius =?utf-8?q?=C5=A0umskas?= <vilius@lnk.lt>
To: freeradius-users@lists.freeradius.org
Subject: Re: CHAP/MS-CHAP/MS-CHAPv2 + LDAP problem
Date: Sat, 03 Sep 2005 13:53:26 +0300
Message-ID: <1666467263.20050903135326@lnk.lt>
In-Reply-To: <20050902145612.D7DC316FAB@mail.nitros9.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============4146854185057888177=="

--===============4146854185057888177==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

Hello Alan,

Friday, September 2, 2005, 5:56:12 PM, you wrote:

> Vilius =?utf-8?b?xaB1bXNrYXM=?= <vilius@lnk.lt> wrote:
>> When I connect to VPN, user and password are verified and radius says 
>> their are ok. After that VPN client registers me on the network (gets 
>> IP address and so on). But in the middle of registration something 
>> happens and I get disconnected.

>   If something happens after RADIUS sends an Access-Accept, it's not a
> RADIUS authentication problem.

>> RADIUS: server 213.190.40.42 not responding
>> RADIUS: server 213.190.40.42 not responding
>> 
>> Is is because of some strange external/internal IP problems? What 
>> Radius server must do after I authenticate?

>   Nothing.  RADIUS is driven by the client, not the server.

>   Your client is trying to RADIUS after it's authenticated.  Find out
> why.

I finally solved all my problems with RADIUS. It seems that my client
required MPPE encryption from the server, and this options was turned
off in RADIUS. So client got Access-Accept packet without MS-CHAP-MPPE
keys. Solved this by turning use_mppe to yes.

Thanks for the help everyone!

-- 
Best regards,
 Vilius



--===============4146854185057888177==--


