- Freeradius-Users - lists.freeradius.org

RE: 802.1x ldap tls
by Paolo Barbato 06 Dec '05

06 Dec '05

Hi list, just to share my solution. Now I've both TTLS+PAP+LDAP and PEAP+MSCHAP+LDAP work. My LDAP server lives on CommunigatePro, and store password in various mode. This is not a problem for bind operation (TTLS+PAP), but have to be configured specifically for ldap search, method used by PEAP+MSCHAP. So problem didn't live in Freeradius. Regards, Paolo. >Still in trouble. > >I've verified differences from TTLS+PAP+LDAP that works, and >PEAP+MSCHAP+LDAP that doesn't work. I've also verified log from LDAP >server. > > >It seems that a succesful bind occurs only with TTLS+PAP+LDAP, but >not occurs with PEAP so authentication fails. > >My LDAP store really clear-text password, but PEAP+MSCHAP seems doesn't care ! > >Some more hints ? > >Regards, >Paolo. > > > >>Since my LDAP store all passwords in clear-text, how can I force >>such way, instead of NT/LM-Password check? >> >>Regards, >>Paolo. >> >>>Hi, >>> >>>as it says >>> >>>rlm_mschap: No User-Password configured. Cannot create LM-Password. >>> rlm_mschap: No User-Password configured. Cannot create NT-Password. >>> rlm_mschap: Told to do MS-CHAPv2 for myRfx with NT-Password >>> rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. >>> rlm_mschap: FAILED: MS-CHAP2-Response is incorrect >>> modcall[authenticate]: module "mschap" returns reject for request 9 >>> >>>you will need a clear-text password or a NT/LM password hash to be in your >>>LDAP directory. Then you have to map that attribute ( for example >>>sambaNTPassword ) to User-Password. You are trying to do MSCHAP but there is >>>simply no defined password for this authorization type. >>> >>>Regards, >>> >>>Edvin >>> >>>-----Original Message----- >>>From: freeradius-users-bounces(a)lists.freeradius.org >>>[mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Paolo >>>Barbato >>>Sent: Donnerstag, 01. Dezember 2005 09:48 >>>To: freeradius-users(a)lists.freeradius.org >>>Subject: 802.1x ldap tls >>> >>>Hi list, >>> >>>yes I know that this question has been discussed so many times but, >>>still I'm in trouble. >>> >>>I've set up freeradius in order to authenticate+authorize Cisco NAS of >>>Aironet. >>> >>>I've successfully connected PC/MAC wireless clients using TTLS+PAP >>>with in backend and LDAP DB. >>> >>>Problem arise when I try to make the same with TLS, I mean >>>PEAP+MSCHAP and LDAP DB. THis doesn't works. If I set a local user in >>>users file, that is good, but if I try a LDAP user nothing come. >>> >>>LDAP store plain password. Some hints ? >>> >>>Here, some extracts from log: >>> >>> >>>rlm_ldap: - authorize rlm_ldap: performing user authorization for myRfx >>>radius_xlat: '(uid=myRfx)' >>>radius_xlat: 'o=Consorzio RFX' >>>rlm_ldap: ldap_get_conn: Checking Id: 0 >>>rlm_ldap: ldap_get_conn: Got Id: 0 >>>rlm_ldap: performing search in o=Consorzio RFX, with filter (uid=myRfx) >>>rlm_ldap: looking for check items in directory... >>>rlm_ldap: looking for reply items in directory... >>>rlm_ldap: user myRfx authorized to use remote access >>>rlm_ldap: ldap_release_conn: Release Id: 0 >>> modcall[authorize]: module "ldap" returns ok for request 9 >>>modcall: group authorize returns updated for request 9 >>> rad_check_password: Found Auth-Type EAP >>>auth: type "EAP" >>> Processing the authenticate section of radiusd.conf >>>modcall: entering group authenticate for request 9 >>> rlm_eap: Request found, released from the list >>> rlm_eap: EAP/mschapv2 >>> rlm_eap: processing type mschapv2 >>> Processing the authenticate section of radiusd.conf >>>modcall: entering group Auth-Type for request 9 >>> rlm_mschap: No User-Password configured. Cannot create LM-Password. >>> rlm_mschap: No User-Password configured. Cannot create NT-Password. >>> rlm_mschap: Told to do MS-CHAPv2 for myRfx with NT-Password >>> rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. >>> rlm_mschap: FAILED: MS-CHAP2-Response is incorrect >>> modcall[authenticate]: module "mschap" returns reject for request 9 >>>modcall: group Auth-Type returns reject for request 9 >>> rlm_eap: Freeing handler >>> modcall[authenticate]: module "eap" returns reject for request 9 >>>modcall: group authenticate returns reject for request 9 >>>auth: Failed to validate the user. >>>Login incorrect: [myRfx/<no User-Password attribute>] (from client >>>localhost port 0) >>> PEAP: Got tunneled reply RADIUS code 3 >>> MS-CHAP-Error = "\tE=691 R=1" >>> EAP-Message = 0x04090004 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> PEAP: Processing from tunneled session code 0x9db3b30 3 >>> MS-CHAP-Error = "\tE=691 R=1" >>> EAP-Message = 0x04090004 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> PEAP: Tunneled authentication was rejected. >>> rlm_eap_peap: FAILURE >>> modcall[authenticate]: module "eap" returns handled for request 9 >>>modcall: group authenticate returns handled for request 9 >>>Sending Access-Challenge of id 239 to 150.178.33.150:1645 >>> EAP-Message = >>>0x010a002a1900170301001f1daf025ff66ee7cba51f42762f540bf78052e745788d4144c970 >>>5681d67359 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x2846493df32aa5a3d90a7d4d8c3b4867 >>>Finished request 9 >>>Going to the next request >>>--- Walking the entire request list --- >>>Waking up in 5 seconds... >>>rad_recv: Access-Request packet from host 150.178.33.150:1645, >>>id=240, length=176 >>> User-Name = "myRfx" >>> Framed-MTU = 1400 >>> Called-Station-Id = "0011.2075.ab11" >>> Calling-Station-Id = "0030.6519.c496" >>> Service-Type = Login-User >>> Message-Authenticator = 0x33f13f5d35c399dbc0f3422dc2c798d9 >>> EAP-Message = >>>0x020a002a1900170301001fa1cae4d87f9f3e55c42ec8b99729dadddf42ba9a8f4eba029615 >>>a9ece90eff >>> NAS-Port-Type = Wireless-802.11 >>> NAS-Port = 12652 >>> State = 0x2846493df32aa5a3d90a7d4d8c3b4867 >>> NAS-IP-Address = 150.178.33.150 >>> NAS-Identifier = "NET26" >>> Processing the authorize section of radiusd.conf >>>modcall: entering group authorize for request 10 >>> modcall[authorize]: module "preprocess" returns ok for request 10 >>> modcall[authorize]: module "chap" returns noop for request 10 >>> modcall[authorize]: module "mschap" returns noop for request 10 >>> rlm_realm: No '@' in User-Name = "myRfx", looking up realm NULL >>> rlm_realm: No such realm "NULL" >>> modcall[authorize]: module "suffix" returns noop for request 10 >>> rlm_eap: EAP packet type response id 10 length 42 >>> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation >>> modcall[authorize]: module "eap" returns updated for request 10 >>> modcall[authorize]: module "files" returns notfound for request 10 >>>rlm_ldap: - authorize >>>rlm_ldap: performing user authorization for myRfx >>>radius_xlat: '(uid=myRfx)' >>>radius_xlat: 'o=Consorzio RFX' >>>rlm_ldap: ldap_get_conn: Checking Id: 0 >>>rlm_ldap: ldap_get_conn: Got Id: 0 >>>rlm_ldap: performing search in o=Consorzio RFX, with filter (uid=myRfx) >>>rlm_ldap: looking for check items in directory... >>>rlm_ldap: looking for reply items in directory... >>>rlm_ldap: user myRfx authorized to use remote access >>>rlm_ldap: ldap_release_conn: Release Id: 0 >>> modcall[authorize]: module "ldap" returns ok for request 10 >>>modcall: group authorize returns updated for request 10 >>> rad_check_password: Found Auth-Type EAP >>>auth: type "EAP" >>> Processing the authenticate section of radiusd.conf >>>modcall: entering group authenticate for request 10 >>> rlm_eap: Request found, released from the list >>> rlm_eap: EAP/peap >>> rlm_eap: processing type peap >>> rlm_eap_peap: Authenticate >>> rlm_eap_tls: processing TLS >>> eaptls_verify returned 7 >>> rlm_eap_tls: Done initial handshake >>> eaptls_process returned 7 >>> rlm_eap_peap: EAPTLS_OK >>> rlm_eap_peap: Session established. Decoding tunneled attributes. >>> rlm_eap_peap: Received EAP-TLV response. >>> rlm_eap_peap: Tunneled data is valid. >>> rlm_eap_peap: Had sent TLV failure, rejecting. >>> rlm_eap: Handler failed in EAP/peap >>> rlm_eap: Failed in EAP select >>> modcall[authenticate]: module "eap" returns invalid for request 10 >>>modcall: group authenticate returns invalid for request 10 >>>auth: Failed to validate the user. >>>Login incorrect: [myRfx/<no User-Password attribute>] (from client >>>rfxnet1 port 12652 cli 0030.6519.c496) >>>Delaying request 10 for 1 seconds >>>Finished request 10 >>>Going to the next request >>> >>>Regards, >>>Paolo. >>>-- >>>---------------------------------------------------------------------------- >>>-------------------- >>>Paolo Barbato email: mailto:paolo.barbato@igi.cnr.it >>>Network Administrator phone: (39-049)-829-5097 >>> (39-049)-829-5000 >>>Corso Stati Uniti,4 www: http://www.igi.cnr.it >>>35127 Camin-Padova PGP: >>>http://www.igi.cnr.it/wwwpgp/rfx_paolo_barbato.pgp >>>ITALY JabberID: rfx_paolo_barbato(a)messenger.efda.org >>>---------------------------------------------------------------------------- >>>-------------------- >>>- >>>List info/subscribe/unsubscribe? See >>>http://www.freeradius.org/list/users.html >>> >>>- >>>List info/subscribe/unsubscribe? See >>>http://www.freeradius.org/list/users.html >> >> >>-- >>------------------------------------------------------------------------------------------------ >>Paolo Barbato email: mailto:paolo.barbato@igi.cnr.it >>Network Administrator phone: (39-049)-829-5097 >> (39-049)-829-5000 >>Corso Stati Uniti,4 www: http://www.igi.cnr.it >>35127 Camin-Padova PGP: >>http://www.igi.cnr.it/wwwpgp/rfx_paolo_barbato.pgp >>ITALY JabberID: rfx_paolo_barbato(a)messenger.efda.org >>------------------------------------------------------------------------------------------------ >>- List info/subscribe/unsubscribe? See >>http://www.freeradius.org/list/users.html > -- ------------------------------------------------------------------------------------------------ Paolo Barbato email: mailto:paolo.barbato@igi.cnr.it Network Administrator phone: (39-049)-829-5097 (39-049)-829-5000 Corso Stati Uniti,4 www: http://www.igi.cnr.it 35127 Camin-Padova PGP: http://www.igi.cnr.it/wwwpgp/rfx_paolo_barbato.pgp ITALY JabberID: rfx_paolo_barbato(a)messenger.efda.org ------------------------------------------------------------------------------------------------

1 0

Filter-Id denying access
by Josh 06 Dec '05

06 Dec '05

I have been successfully authenticating individual users between a PIX 515 VPN and FreeRadius server. I'm using mysql as the data storage on the radius server. Recently I began changing the way I manage the ACLs on the PIX and began setting up user specific ACLs that get set after logging in via the VPN. On the PIX: access-list myvpntest permit ip... and so forth On radius (mysql): insert into radcheck (UserName,Attribute,op,Value) values ('josh','Filter-Id','=','myvpntest'); Now when I attempt to login with my VPN client I get denied. Here's a snippet of the debug: ------ BEGIN DEBUG ------ radius_xlat: 'josh' rlm_sql (sql): sql_set_user escaped user --> 'josh' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'josh' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'josh' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'josh' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'josh' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): No matching entry in the database for request from user [josh] rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Finished request 0 ------ END DEBUG ------ For reference, here's the debug info when I remove the Filter-Id for user 'josh': ------ BEGIN DEBUG ------ radius_xlat: 'josh' rlm_sql (sql): sql_set_user escaped user --> 'josh' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'josh' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'josh' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'josh' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'josh' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_pap: login attempt by "josh" with password ******** rlm_pap: Using password "********" for user josh authentication. rlm_pap: Using MD5 encryption. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 1 modcall: group Auth-Type returns ok for request 1 Sending Access-Accept of id 119 to 10.5.0.1:1812 Finished request 1 ------ END DEBUG ------ Any ideas? __________________________________ Start your day with Yahoo! - Make it your home page! http://www.yahoo.com/r/hs

2 2

XP auth + PEAP
by debik 05 Dec '05

05 Dec '05

Have enybody connect the client running Windows XP SP2 to the radius server with peap auth ???

1 0

RE: RADIUS Auth-Type
by Bohannan, Chad W 05 Dec '05

05 Dec '05

I don't think that is the issue. The NAS authenticates my users just fine so long as the /etc/raddb/users file specifies the users "Auth-Type= System". What I want to figure out is how to make the authentication request proxy out to the AD server. Based on the tutorial & test results everything should be working, but I need to know what auth-type to use. Chad -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Saturday, December 03, 2005 9:08 AM To: FreeRadius users mailing list Subject: Re: RADIUS Auth-Type Bohannan, Chad W wrote: > OK, here is the situation. I have successfully configured RADIUS to > authenticate/authorize NAS requests from my Cisco gear so long as the > user "Auth-Type= System". I have also managed to get Samba working and > have joined the radius server to the AD realm in question. This is > confirmed through the following: The radius server doesn't specify MSCHAP. The NAS *tells* the radius server that this request *is* using MSCHAP by virtue of sending the appropriate MSCHAP attributes. Configure your NAS (dialup server, VPN, IPSec+xauth, whatever) to do MSCHAP, and as long as the mschap module is in the authorize and authenticate sections, it will work. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Update on Samba and PEAP Machine Authentication
by Michael Griego 05 Dec '05

05 Dec '05

The Samba team has recently released Samba version 3.0.21rc2. The 3.0.21 releases include the necessary fixes to Samba to allow for PEAP machine authentication, so those versions of Samba can be used without requiring the patches previously posted to the list. --Mike

1 0

What are the advantage and disadvantage about ntlm_auth and LDAP?
by darkblue 05 Dec '05

05 Dec '05

There two type of method to integrate freeradius with AD, ntlm_auth and ldap, with help by experts such as Alan DeKok and Nicolas Baradakis , I had been setup the 802.1x+freeradius+ntlm_auth+AD. and I wonder what are the advantage and disadvantage about ldap and ntlm_auth.LDAP sounds better than ntlm_auth, is that right? -- He is nothing

2 1

EAP-TTLS/PAP and proxying
by Samuel Degrande 05 Dec '05

05 Dec '05

Hello. I have one other question concerning proxying, and once again excuse me if I don't use the good terminology. I use EAP-TTLS/PAP between a 802.1X supplicant and a radius server. I would like to proxy the authentication to an other radius server. So, is it possible to 'decapsulate' the authentication protocol from EAP on the first radius server, and only send user-name/user-password attributes to the central radius server ? (i guess that my question is stupid, but I don't know how to express it in the good way...) thanks -- Samuel Degrande LIFL - UMR8022 CNRS - INRIA Futurs - Bat M3 Phone: (33)3.28.77.85.30 USTL - Universite de Lille 1 Fax: (33)3.28.77.85.37 59655 VILLENEUVE D'ASCQ CEDEX - FRANCE [CA certs: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html ]

3 2

Free Radius and Squid
by Sean Ali 05 Dec '05

05 Dec '05

Hello, I'm very new to free raduis and would like to know if it will run with squid proxy server. If so how would this work? What I am looking to do is to allow users to access the internet via the transparent squid proxy for limited time sessions. Eg. a user who wishes to use the system would be greeted by a web page asking for a code. The code (which they would get from the system admin) would grant them access for 1 hour. Can this be done using FreeRadius and Squid? Sean.

3 2

FreeRadius Authentication Protocol
by Hamid Salim 05 Dec '05

05 Dec '05

Hi, I have a FreeRadius EAP-TLS working enviornment. Going forward, I would like to avoid installing client certificates on every new mobile client and maintaining the current installs. I think the solution will be EAP-TTLS. However, I would like to get input from the experts about best available option/s. The goal is to authenticate supplicants via FreeRadius without the use of client certificates (server certificate is ok). Any help is appreciated. Regards, Hamid.

1 0

RE: RADIUS Auth-Type
by Bohannan, Chad W 05 Dec '05

05 Dec '05

Alan, You seem to be one of the most knowledgeable folks on the list. Can you provide any input? All help is appreciated. Chad. From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Bohannan, Chad W Sent: Friday, December 02, 2005 12:51 PM To: FreeRadius users mailing list Subject: RADIUS Auth-Type OK, here is the situation. I have successfully configured RADIUS to authenticate/authorize NAS requests from my Cisco gear so long as the user "Auth-Type= System". I have also managed to get Samba working and have joined the radius server to the AD realm in question. This is confirmed through the following: ntlm_auth --request-nt-key --domain=MYDOMAIN --username=MYUID password:xxxxx NT_STATUS_OK: Success (0x0) wbinfo -a MYUID%MYPASSWD plaintext password authentication failed error code was NT_STATUS_NO_SUCH_USER (0xc0000064) error messsage was: No such user Could not authenticate user MYUID%MTPASSWD with plaintext password challenge/response password authentication succeeded However, when I edit the /etc/raddb/users file and change the "Auth-Type= System" to "Auth-Type=MSCAP" all authentication attempts fail. Am I specifying the correct auth-type? Have I missed a step? Is there something I can do (debug maybe) that will better assist in identifying the problem? Any and all suggestions are appreciated. I am attempting to have RADIUS proxy authentication requests to AD, then assign attributes if authentication succeeds. Chad

1 0