- Freeradius-Users - lists.freeradius.org

Machine auth without cert - EAP-PEAP/MSCHAPV2
by Ryan Kramer 25 Feb '08

25 Feb '08

I've been experimenting with machine auth without using a cert, but I seem to be stuck on the fact that FreeRadius will not authenticate a local user. I see the request come across through debugging with a username of "host/mymachine.mydomain.com", and no password, and in my users file I have "host/mymachine.mydomain.com" Cleartext-Password="", Auth-Type := Local, MS-CHAP-Use-NTLM-Auth := 0 Filter-ID = "WIRELESS-USER", Fall-Through = 0 but for some reason it never authenticates... I've tried every both without the MS-CHAP option, that doesn't seem to change it. Also tried User-Password instead of cleartext password, no change. Any suggestions? Ryan

3 2

RE: EAP-PEAP with LDAP for 802.1x authentication
by Ryan 25 Feb '08

25 Feb '08

Passwords are currently encrypted in LDAP. In this case, am I correct to say that I will need to add both nt hash and NT-Password to LDAP using smb-ldap related tools for it to work with PEAP? Will samba be required to be configured on my LDAP server? Thanks/Regards, Ryan

2 1

LDAP and Groups.
by David W Bell 25 Feb '08

25 Feb '08

Ok been fiddling some more. What I need to now do is work out which group a user belongs to based on LDAP users and groups. I am assuming this is in the radius.conf @ the section about groups. For Example, This LDAP user. # belld, people, dxi.net dn: uid=belld,ou=people,dc=dxi,dc=net cn: David Bell gidNumber: 100 givenName: David homeDirectory: /home/belld loginShell: /bin/bash objectClass: top objectClass: posixAccount objectClass: shadowAccount objectClass: inetOrgPerson shadowInactive: -1 shadowMax: 99999 shadowMin: 0 shadowWarning: 7 sn: Bell uid: belld uidNumber: 1000 shadowLastChange: 13920 is a member of this LDAP group # Engineering, group, dxi.net dn: cn=Engineering,ou=group,dc=dxi,dc=net cn: Engineering gidNumber: 1000 member: uid=belld,ou=people,dc=dxi,dc=net objectClass: top objectClass: posixGroup objectClass: groupOfNames How do I do this, so that I can then have my users file grant Cisco-AVPair information based on group membership Thanks David

2 1

RE: EAP-PEAP with LDAP for 802.1x authentication
by debug afone 25 Feb '08

25 Feb '08

Hello, I use FreeRadius with OpenLDAP to authenticate device using EAP-PEAP and it works fine. The only problem I had was the encrypted password in my LDAP database. I by-passed this problem using clear-text Password in LDAP Database and it works fine. You can also have a look at this : http://deployingradius.com/documents/protocols/compatibility.html Regards, Nicolas SOULEMAN.

1 0

RE: EAP-PEAP with LDAP for 802.1x authentication
by debug afone 25 Feb '08

25 Feb '08

Hello, I use FreeRadius with OpenLDAP to authenticate device using EAP-PEAP and it works fine. The only problem I had was the encrypted password in my LDAP database. I by-passed this problem using clear-text Password in LDAP Database and it works fine. You can also have a look at this : http://deployingradius.com/documents/protocols/compatibility.html Regards, Nicolas SOULEMAN. -----Message d'origine----- De : freeradius-users-bounces+debug=afone.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+debug=afone.com@lists.freeradius.org] De la part de freeradius-users-request(a)lists.freeradius.org Envoyé : lundi 25 février 2008 11:59 À : freeradius-users(a)lists.freeradius.org Objet : Freeradius-Users Digest, Vol 34, Issue 124 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. rlm_dbm can not work? (Hangjun He) 2. EAP-PEAP with LDAP for 802.1x authentication (Ryan) 3. Re: EAP-PEAP with LDAP for 802.1x authentication (Arjuna Scagnetto) 4. Re: rlm_dbm can not work? (A.L.M.Buxey(a)lboro.ac.uk) 5. Re: EAP-PEAP with LDAP for 802.1x authentication (Ivan Kalik) 6. Re: EAP-PEAP with LDAP for 802.1x authentication (Sergio Belkin) 7. radius users update after NAS downing (Zahra Bahar) 8. ldap configuration parameters in radiusd.conf file (Gopinath Reddy N) ---------------------------------------------------------------------- Message: 1 Date: Mon, 25 Feb 2008 11:15:38 +0800 (CST) From: Hangjun He <elmerhe(a)yahoo.com.cn> Subject: rlm_dbm can not work? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <182021.24135.qm(a)web15107.mail.cnb.yahoo.com> Content-Type: text/plain; charset="gb2312" Hi, I am using freeRADIUS 1.1.6. I can not let rlm_dbm work. Result of rlm_dbm_cat: [root@Jack-Linux raddb]# pwd /usr/local/etc/raddb [root@Jack-Linux raddb]# rlm_dbm_cat -f users.db "hhe4" Cleartext-Password := "hhe123" Reply-Message = "Hello" "hhe123" Cleartext-Password := "hhe123" Reply-Message = "Hello" [root@Jack-Linux raddb]# [root@Jack-Linux raddb]# ls users.* users.db.dir users.db.pag [root@Jack-Linux raddb]# Debug message: Module: Loaded dbm dbm: usersfile = "/usr/local/etc/raddb/users.db" Module: Instantiated dbm (dbm) Listening on authentication *:1812 Listening on accounting *:1813 ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:1033, id=26, length=58 User-Name = "hhe123" User-Password = "hhe123" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 rlm_dbm: try open database file: /usr/local/etc/raddb/users.db rlm_dbm: Call parse_user: sm_parse_user.c: check for loops Add hhe123 to user list rlm_dbm: User <hhe123> not foud in database Remove hhe123 from user list sm_parse_user.c: check for loops Add DEFAULT to user list rlm_dbm: User <DEFAULT> not foud in database Remove DEFAULT from user list modcall[authorize]: module "dbm" returns notfound for request 0 modcall: leaving group authorize (returns noop) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Sending Access-Reject of id 26 to 127.0.0.1 port 1033 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 26 with timestamp 47c220be Nothing to do. Sleeping until we see a request. John. --------------------------------- ???????????????????

1 0

radius users update after NAS downing
by Zahra Bahar 25 Feb '08

25 Feb '08

Hi, We have a freeradius server for accounting of AS5300 dial users. there is a problem: Some users stay in accounting list when AS is restarted, and they not go to stop then can't dial after that until admin makes them out of list . why this happen?

2 1

ldap configuration parameters in radiusd.conf file
by Gopinath Reddy N 25 Feb '08

25 Feb '08

Hi, Does any body has idea whether the below parameters are mandatory in radiusd.conf file ldap section. groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=group)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember==%{Ldap-UserDn})))" groupmembership_attribute = radiusGroupName Iam trying to see whether ldap group search functionality can be avoided using radiusd.conf file. Thanks in advance. regards -gnr

1 0

EAP-PEAP with LDAP for 802.1x authentication
by Ryan 25 Feb '08

25 Feb '08

Hi All, Understand that it is not possible to authenticate using EAP-PEAP against OpenLDAP due to encrypted password. Can someone advise on how exactly OpenLDAP needs be configured so that it can be used in EAP-PEAP? I found out from http://vuksan.com/linux/dot1x/802-1x-LDAP.html that to do so additional attributes needs to be added to LDAP. Is this the only way? Thanks/Regards, Ryan

4 3

Configuring radrelay using proxy.conf in v2.0.1
by Ryan 25 Feb '08

25 Feb '08

Upgraded to 2.0.2 and got the radrelay working using proxy.conf Ryan

1 0

Error LDAP module not available
by C A 24 Feb '08

24 Feb '08

Hi, I've compiled and installed the FreeRADIUS 2.0.0 version. Everything works OK, I can run the radtest example. The problem happens when I try to activate the LDAP module. After that when I run "radiusd -X" a get the error: .... /usr/local/etc/raddb/radiusd.conf[696]: Failed to link to module 'rlm_ldap': rlm_ldap.so: cannot open shared object file: No such file or directory /usr/local/etc/raddb/sites-enabled/default[135]: Failed to find module "ldap". /usr/local/etc/raddb/sites-enabled/default[34]: Errors parsing authorize section. } } Errors initializing modules ..... Then I issue the command "locate rlm_ldap" I don't get any files but those on src. What I've done wrong? Do I have to write any flag when compiling radius to activate/compile the LDAP Module? BR. Antares

3 3