- Freeradius-Users - lists.freeradius.org

Re: AP> FR> LDAP authentication reject
by Alan DeKok 28 Dec '12

28 Dec '12

Thanakorn Rattanatikul wrote: > In LDAP server , for user "sun" , store password in clear-text in this test. No, it doesn't. Or, it's not available. Or the user isn't found. Read the debug log. Look for anything related to LDAP. It isn't hard: [ldap] performing search in ou=guest,dc=ku,dc=ac,dc=th, with filter (uid=sun) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Does that mean anything to you? For the latest release, also read raddb/sites-available/inner-tunnel. It gives DETAILED instructions for debugging PEAP. Follow those instructions. Read the debug output. Alan DeKok.

1 0

Issue with Kerberos
by Khapare Joshi 28 Dec '12

28 Dec '12

I am testing Freeradius with kerberos. seems it is returning accept accept Fri Dec 21 15:05:46 2012 : Info: [suffix] No '@' in User-Name = "test66", looking up realm NULL Fri Dec 21 15:05:46 2012 : Info: [suffix] No such realm "NULL" Fri Dec 21 15:05:46 2012 : Info: ++[suffix] returns noop Fri Dec 21 15:05:46 2012 : Info: [eap] No EAP-Message, not doing EAP Fri Dec 21 15:05:46 2012 : Info: ++[eap] returns noop Fri Dec 21 15:05:46 2012 : Info: [files] users: Matched entry DEFAULT at line 1 Fri Dec 21 15:05:46 2012 : Info: ++[files] returns ok Fri Dec 21 15:05:46 2012 : Info: ++[expiration] returns noop Fri Dec 21 15:05:46 2012 : Info: ++[logintime] returns noop Fri Dec 21 15:05:46 2012 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Fri Dec 21 15:05:46 2012 : Info: ++[pap] returns noop Fri Dec 21 15:05:46 2012 : Info: Found Auth-Type = Kerberos Fri Dec 21 15:05:46 2012 : Info: # Executing group from file /etc/raddb/sites-enabled/default Fri Dec 21 15:05:46 2012 : Info: +- entering group kerberos {...} Fri Dec 21 15:05:46 2012 : Debug: rlm_krb5: verify_krb_v5_tgt: host key not found : Permission denied Fri Dec 21 15:05:46 2012 : Info: ++[krb5] returns ok Fri Dec 21 15:05:46 2012 : Info: # Executing section post-auth from file /etc/raddb/sites-enabled/default Fri Dec 21 15:05:46 2012 : Info: +- entering group post-auth {...} Fri Dec 21 15:05:46 2012 : Info: ++[exec] returns noop Sending Access-Accept of id 219 to 192.168.1.1 port 33193 It always says permission denied then returns krb5 ok, What permission denied it is saying ? I generated service and host principal and exported keytab file in my radius server then added /etc/raddb/modules/krb5 file. But I always get permission denied debug output. another this is why PAP saying authentication may fail and then process the kerberos part - is this normal ? Thanks Merry Xmas, KH

2 3

Re: AP> FR> LDAP authentication reject
by Olivier Beytrison 28 Dec '12

28 Dec '12

On 28.12.2012 09:38, Thanakorn Rattanatikul wrote: > Still unable to connect. > Do you have any configuration files for connecting with LDAP form AP> > FR> LDAP ? I tried every way but nothing works. Send a full output of freeradius -X -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mobile: +41 (0)78 619 73 53 Mail: olivier(a)heliosnet.org

1 0

Re: AP> FR> LDAP authentication reject
by Olivier Beytrison 28 Dec '12

28 Dec '12

On 28.12.2012 08:39, Thanakorn Rattanatikul wrote: > In LDAP server , for user "sun" , store password in clear-text in this test So if you have a clear-text password in the ldap, use the ldap attribute-map to add it in the control list. Looking at the logs I guess you are running version 2.x, then you should have a file called /etc/raddb/ldap.attrmap, add a line with checkitem Cleartext-Password <your-ldap-attribute> And reference the ldap.attrmap in the ldap module (if not already done) dictionary_mapping = ${confdir}/ldap.attrmap And finally you need to ensure that the user defined in the ldap module (identity) has sufficient rights in the LDAP to retrieve the attribute containing the clear text password. Olivier -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mobile: +41 (0)78 619 73 53 Mail: olivier(a)heliosnet.org

1 0

Re: AP> FR> LDAP authentication reject
by Olivier Beytrison 28 Dec '12

28 Dec '12

On 28.12.2012 06:17, Thanakorn Rattanatikul wrote: > I'm trying to setup the server to authenticate using LDAP. I'm having > some problem and hope to get some help from the list. > > I'm trying to setup AP->FR->LDAP. FreeRadius is new installation on > CentOS. LDAP is Sun Java System Directory Server. > I'm trying radtest ->FR->LDAP pass but AP->FR->LDAP not pass. It works with radtest because it does pap. The password is sent in cleartext in the request. Freeradius can then bind to the LDAP with the user/password supplied to authenticate the user. With your Access Point, you're doing EAP-PEAP with MSCHAPv2, which mean you need the clear text password or a NT/LM_Password in your backend, or via NTLM_Auth. If Freeradius doesn't have them, it can't do the challenge/response. You have Plenty of warning that this will happen ... > [ldap] expand: ou=guest,dc=ku,dc=ac,dc=th -> ou=guest,dc=ku,dc=ac,dc=th > [ldap] ldap_get_conn: Checking Id: 0 > [ldap] ldap_get_conn: Got Id: 0 > [ldap] attempting LDAP reconnection > [ldap] (re)connect to 158.108.8.214:389, authentication 0 > [ldap] bind as uid=thanakorn,ou=guest,dc=ku,dc=ac,dc=th/testtest to > 158.108.8.214:389 > [ldap] waiting for bind result ... > [ldap] Bind was successful > [ldap] performing search in ou=guest,dc=ku,dc=ac,dc=th, with filter > (uid=sun) > [ldap] looking for check items in directory... > [ldap] looking for reply items in directory... See here ? > WARNING: No "known good" password was found in LDAP. Are you sure that > the user is configured correctly? > [ldap] ldap_release_conn: Release Id: 0 > ++[ldap] returns ok > ++[expiration] returns noop > ++[logintime] returns noop Or Here ? > [pap] WARNING! No "known good" password found > for the user. Authentication may fail because of this. > ++[pap] returns noop And those ? > [mschapv2] # Executing group from file /etc/raddb/sites-enabled/default > [mschapv2] +- entering group MS-CHAP {...} > [mschap] No Cleartext-Password configured. Cannot create LM-Password. > [mschap] No Cleartext-Password configured. Cannot create NT-Password. > [mschap] Creating challenge hash with username: sun > [mschap] Told to do MS-CHAPv2 for sun wit! h NT-Password > [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. > [mschap] FAILED: MS-CHAP2-Response is incorrect And here again ... > [peap] The users session was previously rejected: returning reject (again.) > [peap] *** This means you need to read the PREVIOUS messages in the > debug output > [peap] *** to find out the reason why the user was rejected. > [peap] *** Look for "reject" or "fail". Those earlier messages will > tell you. > [peap] *** what went wrong, and how to fix the problem. > [eap] Handler failed in EAP/peap > [eap] Failed in EAP select > ++[eap] returns invalid In the default LDAP configuration file, it's clearly stated that : # However, LDAP can be used for authentication ONLY when the # Access-Request packet contains a clear-text User-Password # attribute. LDAP authentication will NOT work for any other # authentication method. # This means that LDAP servers don't understand EAP. If you # force "Auth-Type = LDAP", and then send the server a # request containing EAP authentication, then authentication # WILL NOT WORK. You need either the clear-text password in your LDAP, Store the user password in the userfile, or use another way of getting the password (sql database, ntlm_auth to active directory). Read the comments in the default configuration, and look for Warning and error in the debug output. It tells you what goes wrong, and what you should do. In your case : Provide a Cleartext-Password Olivier -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mobile: +41 (0)78 619 73 53 Mail: olivier(a)heliosnet.org

1 0

Re: 802.1x computer authentication config issue/question
by spartan1833＠hushmail.com 27 Dec '12

27 Dec '12

@Phil, Thank you very much for the code snippet - only had to make minor mods for it to work perfectly ("noop" instead of "notfound" in the reject code within the sites-enabled routine). Also I had to do an $INCLUDE in the users file that points to the tls_clients file otherwise I get unpredictable behavior - other than that working as envisioned. Next phase, a remote database for clients (LDAP or SQL....not sure which yet - thats for 2013) Again, many, many thanks for the help - Happy Holidays... On Thu, 27 Dec 2012 10:40:15 -0500 "Phil Mayers" <p.mayers(a)imperial.ac.uk> wrote: >On 12/27/2012 03:19 PM, spartan1833(a)hushmail.com wrote: > >> ...but if not then ok I was simply trying to figure out if I was >> able to control machine-only 802.1x authentication against >> FreeRADIUS in a manner similar to how "simple" user >authentication >> appears to be done (via the users file). From your response, it >> appears that the answer is "NO" and that an LDAP configuration / >> LDAP groups will be required. > >Not so - that's not what Alan said. You mentioned LDAP - he >naturally >assumed you were looking in that direction. > >You can use the "users" file; but you need to alter the config >slightly, >and due to the way EAP-TLS runs in 2.x, you need to use it in a >particular way. > >Try this: > >/etc/raddb/modules/tls_clients: > >files tls_clients { > key = "%{TLS-Client-Cert-Common-Name}" > usersfile = "/etc/raddb/tls_clients" >} > >/etc/raddb/sites-enabled/default > >post-auth { > ... > if (TLS-Client-Cert-Common-Name) { > tls_clients.authorize > if (notfound) { > # reject unknown users > reject > } > } > ... >} > >Modify as appropriate for your needs. > >> >> I'll look into that as time allows...and while I appreciate your >> quick response, I think that your comment below is a bit >> unwarranted - one of the points of user groups is to be able to >ask >> the question "I don't know how...at least this has been the case >> for the last 15 years that I have been doing this stuff." > >Unfortunately, the FreeRADIUS community does not have the depth >and >breadth to provide the level of support and documentation that >something >like Apache or Samba does. This means there is more onus on you to >be >specific. > >I have my theories about *why* this difference exists - >specifically, >that FR is a complex infrastructure daemon, which people set up >and >forget, as opposed to a framework that they constantly use. You >see >similar issues on other projects (ISC bind, for example) that have >these >attributes. But whatever the reason, most people post to this list >a few >times, then vanish - they don't answer questions to people who >follow >them, write docs or wiki articles, or contribute code. > >This leads to a relatively small pool of people who can answer, >and to >the expectation that you be specific so those people can use their >time >efficiently. Don't take it personally - it's just a function of >the >community size. > >Cheers, >Phil >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html

1 0

Re: 802.1x computer authentication config issue/question
by spartan1833＠hushmail.com 27 Dec '12

27 Dec '12

@Phil, Thanks for the example - I'll do some work with it. Appreciate the additional information too...I imagine that there is a huge amount of variation within FR configurations so I get it that requests for assistance need to be as concise as possible....don't always know "exactly" what to ask sometimes though :) Thanks again.... On Thu, 27 Dec 2012 10:40:15 -0500 "Phil Mayers" <p.mayers(a)imperial.ac.uk> wrote: >On 12/27/2012 03:19 PM, spartan1833(a)hushmail.com wrote: > >> ...but if not then ok I was simply trying to figure out if I was >> able to control machine-only 802.1x authentication against >> FreeRADIUS in a manner similar to how "simple" user >authentication >> appears to be done (via the users file). From your response, it >> appears that the answer is "NO" and that an LDAP configuration / >> LDAP groups will be required. > >Not so - that's not what Alan said. You mentioned LDAP - he >naturally >assumed you were looking in that direction. > >You can use the "users" file; but you need to alter the config >slightly, >and due to the way EAP-TLS runs in 2.x, you need to use it in a >particular way. > >Try this: > >/etc/raddb/modules/tls_clients: > >files tls_clients { > key = "%{TLS-Client-Cert-Common-Name}" > usersfile = "/etc/raddb/tls_clients" >} > >/etc/raddb/sites-enabled/default > >post-auth { > ... > if (TLS-Client-Cert-Common-Name) { > tls_clients.authorize > if (notfound) { > # reject unknown users > reject > } > } > ... >} > >Modify as appropriate for your needs. > >> >> I'll look into that as time allows...and while I appreciate your >> quick response, I think that your comment below is a bit >> unwarranted - one of the points of user groups is to be able to >ask >> the question "I don't know how...at least this has been the case >> for the last 15 years that I have been doing this stuff." > >Unfortunately, the FreeRADIUS community does not have the depth >and >breadth to provide the level of support and documentation that >something >like Apache or Samba does. This means there is more onus on you to >be >specific. > >I have my theories about *why* this difference exists - >specifically, >that FR is a complex infrastructure daemon, which people set up >and >forget, as opposed to a framework that they constantly use. You >see >similar issues on other projects (ISC bind, for example) that have >these >attributes. But whatever the reason, most people post to this list >a few >times, then vanish - they don't answer questions to people who >follow >them, write docs or wiki articles, or contribute code. > >This leads to a relatively small pool of people who can answer, >and to >the expectation that you be specific so those people can use their >time >efficiently. Don't take it personally - it's just a function of >the >community size. > >Cheers, >Phil >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html

1 0

Re: 802.1x computer authentication config issue/question
by spartan1833＠hushmail.com 27 Dec '12

27 Dec '12

Hi, Thanks you for the...quick reply - thought I had spelled out what I was trying to figure out in fairly clear terms: > or can guide me in how to do local (to the RADIUS server) > machine policies - I just want to be able to say "laptop1234...", > etc are part of a local group and are authorized (provided that > they are properly provisioned with certs, etc). ...but if not then ok I was simply trying to figure out if I was able to control machine-only 802.1x authentication against FreeRADIUS in a manner similar to how "simple" user authentication appears to be done (via the users file). From your response, it appears that the answer is "NO" and that an LDAP configuration / LDAP groups will be required. I'll look into that as time allows...and while I appreciate your quick response, I think that your comment below is a bit unwarranted - one of the points of user groups is to be able to ask the question "I don't know how...at least this has been the case for the last 15 years that I have been doing this stuff." Regards... On Thu, 27 Dec 2012 09:50:03 -0500 "Alan DeKok" <aland(a)deployingradius.com> wrote: >spartan1833(a)hushmail.com wrote: >> 802.1x appears to be working; any laptop with the certs/config >is >> able to access the wired and/or wireless network and any laptop >> without is denied access. However, in my previous experience >with >> RADIUS (IAS/NPS in the Windows world), I am able to control >access >> at a policy level as well; any machine not part of a specific >group >> is denied access, regardless of what certificate is installed >and >> what configuration is present on the laptop. > > You can do that in FreeRADIUS, too. You can do LDAP group >comparisons: > >http://wiki.freeradius.org/modules/Rlm_ldap > >> I played around with the users file in FreeRADIUS but it didn't >> seem to have any effect unless I put a DEFAULT Auth-Type Reject >in >> the file which blocked everyone regardless of what else I had in > >> the users file. > > Well... playing around isn't useful. You need to first define >the >problem, and then look for a solution. The problem here seems to >be >looking up groups in LDAP, right? > > So... configure the LDAP module. Read it's documentation. > >> I've Googled around a bit but haven't found any >> definitive guides on how I would do a FreeRADIUS analog to >Windows >> IAS/NPS policies other than having to include ldap servers >and/or >> other types of external authentication systems which I'm not >really >> interested (at this point) in doing. > > Are groups are stored in LDAP? If so, you need to configure >FreeRADIUS to talk to the LDAP server. > >> Guessing that I'm missing something so hoping that someone elss >has >> done this or can guide me in how to do local (to the RADIUS >server) >> machine policies - I just want to be able to say >"laptop1234...", >> etc are part of a local group and are authorized (provided that >> they are properly provisioned with certs, etc). > > Where are those groups defined? > > Right now, your question is "I want to do stuff but I don't know >how". > You need to describe what you want to do, in detail. > > Alan DeKok. >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html

3 2

Wiki requires email?
by Phil Mayers 27 Dec '12

27 Dec '12

I can no longer log into the wiki with my github account - seems the wiki now requires that I expose an email publicly in my github profile (something I am not going to do). Is this intentional? What's the rationale?

2 1

Re: 802.1x computer authentication config issue/question
by spartan1833＠hushmail.com 27 Dec '12

27 Dec '12

@Phil, Thanks for the info - appreciate the professional response....I'll do some additional research. On Thu, 27 Dec 2012 10:13:43 -0500 "Phil Mayers" <p.mayers(a)imperial.ac.uk> wrote: >On 12/27/2012 02:32 PM, spartan1833(a)hushmail.com wrote: > >> I played around with the users file in FreeRADIUS but it didn't >> seem to have any effect unless I put a DEFAULT Auth-Type Reject >in >> the file which blocked everyone regardless of what else I had in >> the users file. I've Googled around a bit but haven't found any >> definitive guides on how I would do a FreeRADIUS analog to >Windows >> IAS/NPS policies other than having to include ldap servers >and/or >> other types of external authentication systems which I'm not >really >> interested (at this point) in doing. > >LDAP is not an authentication system (not really). It's a >directory, >which is a form of database. > >You are, obviously, going to need some form of "database" in which >your >policy "memberships" are stored; FreeRADIUS provides several built- >in >modules (LDAP, SQL, files, passwd-style) that can do this. > >However - you're going to run into the fact that EAP-TLS as >implemented >in the 2.x branch doesn't offer very much in the way of >authorization - >the only place you can run a database lookup and be sure you have >the >TLS cert details is post-auth (a virtual server step was added in >master/3.x). > >Basically: > > 1. Define a local attribute in raddb/dictionary to hold your >groups. >Note carefully the stuff in the default dictionary file about >local >attribute numbers. > > 2. Configure one of the various data lookup modules (passwd and >files >are the simplest but least flexible) to lookup the groups based on >the >TLS cert attributes (see below) > > 3. Run this module in the post-auth section, and act on the >result. > >raddb/sites-available/default contains comments to this effect in >post-auth - search for "TLS-Client" in that file, which also tells >you >the various TLS cert attributes you can use. > >About the only difficult bit is step 2; I thought I'd written >something >in the wiki about this, but I can't find it (and I can't log in >anymore). > >If you've got a more specific question, I'll try to reply, but >you'll >need to do a bit of research into the various "database" modules >and >decide which one you want to use first. >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html

1 0