Freeradius in an AD environment on opensuse server
I've been struggling with this for months. I found a doc HOW TO on the opensuse website. It says I have to use Samba in order to have the users authenticate. For some reason every time I get that thing configured, it works for a few days then...it's gone. I cover a large geographic area and have not been able to focus on this until today and tomorrow. SO any help would be appreciated. We've moved from a Novell eDirectory solution to . . . . Active Directory. Can I set up freeradius to authenticate with ldaps and be secure? The ldap would be Microsoft and is on my domain controller. I have websites using the ldap process but OR do I have to do that samba thing? I would really be grateful for any help you could give me. I now have the radius server back to it's original configuration....clean. So I'm ready to do your bidding. Liz M
Hi Liz, Murray, Elizabeth [DNR] wrote:
We’ve moved from a Novell eDirectory solution to . . . . Active Directory.
I'm not an AD expert, but they say ( http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/distrib/... ) that AD is accessible using the LDAPv3 protocol; so it should be possible to use it like any other LDAP server.
Can I set up freeradius to authenticate with ldaps and be secure?
What do you mean with "to be secure" ? Do you mean the connection between the radius server and the AD ? Are you familiar with the SCHEMAs used in AD (I'm not, by the way) ? Have you already planned the access rules that you will need on the AD to complete the authentication/authorization procedure ? (These are questions intented for yourself, in the first place).
The ldap would be Microsoft and is on my domain controller. I have websites using the ldap process but OR do I have to do that samba thing?
First of all, I think that you should take a moment to put down the architecture that you're working with (just to have a complete picture), your goals and the expertise that is available to you and/or your collegues/organization. Then, you can start planning your setup.
Thanks. Glad I didn't get this last night or I wouldn't have slept!!! I will have multiple access points spread across a large geographic area that will authenticate to a series of Radius servers located in the internal network. Any other suggestions would be appreciated. I've got most of this in my head so I need to do some writing. I'm here for 2 days then vacation. I almost don't want to go because this has been such a frustrating task for me. Thanks again. Any more ideas would be appreciated. Liz M -----Original Message----- From: freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org [mailto:freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org] On Behalf Of Maurizio Cimaschi Sent: Wednesday, August 13, 2008 5:44 PM To: FreeRadius users mailing list Subject: Re: Freeradius in an AD environment on opensuse server Hi Liz, Murray, Elizabeth [DNR] wrote:
We’ve moved from a Novell eDirectory solution to . . . . Active Directory.
I'm not an AD expert, but they say ( http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/distrib/... ) that AD is accessible using the LDAPv3 protocol; so it should be possible to use it like any other LDAP server.
Can I set up freeradius to authenticate with ldaps and be secure?
What do you mean with "to be secure" ? Do you mean the connection between the radius server and the AD ? Are you familiar with the SCHEMAs used in AD (I'm not, by the way) ? Have you already planned the access rules that you will need on the AD to complete the authentication/authorization procedure ? (These are questions intented for yourself, in the first place).
The ldap would be Microsoft and is on my domain controller. I have websites using the ldap process but OR do I have to do that samba thing?
First of all, I think that you should take a moment to put down the architecture that you're working with (just to have a complete picture), your goals and the expertise that is available to you and/or your collegues/organization. Then, you can start planning your setup. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
You can't get cleartext password from AD, but you can extract encrypted (nt hashed) password as NT-Password with ldap. You will be able to authenticate pap and mschap requests with that. Ivan Kalik Dana 14/8/2008, "Murray, Elizabeth [DNR]" <Elizabeth.Murray@dnr.iowa.gov> piše:
Thanks. Glad I didn't get this last night or I wouldn't have slept!!!
I will have multiple access points spread across a large geographic area that will authenticate to a series of Radius servers located in the internal network. Any other suggestions would be appreciated. I've got most of this in my head so I need to do some writing. I'm here for 2 days then vacation. I almost don't want to go because this has been such a frustrating task for me.
Thanks again. Any more ideas would be appreciated.
Liz M
-----Original Message----- From: freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org [mailto:freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org] On Behalf Of Maurizio Cimaschi Sent: Wednesday, August 13, 2008 5:44 PM To: FreeRadius users mailing list Subject: Re: Freeradius in an AD environment on opensuse server
Hi Liz,
Murray, Elizabeth [DNR] wrote:
Weâve moved from a Novell eDirectory solution to . . . . Active Directory.
I'm not an AD expert, but they say ( http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/distrib/... ) that AD is accessible using the LDAPv3 protocol; so it should be possible to use it like any other LDAP server.
Can I set up freeradius to authenticate with ldaps and be secure?
What do you mean with "to be secure" ? Do you mean the connection between the radius server and the AD ? Are you familiar with the SCHEMAs used in AD (I'm not, by the way) ? Have you already planned the access rules that you will need on the AD to complete the authentication/authorization procedure ? (These are questions intented for yourself, in the first place).
The ldap would be Microsoft and is on my domain controller. I have websites using the ldap process but OR do I have to do that samba thing?
First of all, I think that you should take a moment to put down the architecture that you're working with (just to have a complete picture), your goals and the expertise that is available to you and/or your collegues/organization. Then, you can start planning your setup.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ivan Kalik wrote:
You can't get cleartext password from AD, but you can extract encrypted (nt hashed) password as NT-Password with ldap. You will be able to authenticate pap and mschap requests with that.
I was lurking in the attribute list of the AD: http://msdn.microsoft.com/en-us/library/ms675480(VS.85).aspx There's a particoular attribute that may do the trick: "DBCS-Pwd Attribute". It is said to be the account's LAN manager password. Since rlm_mschap should be able to authenticate using one of clear-text pwd, LAN mgr pwd and NT pwd this should be enought. Via ldap.attrmap should be possible to map that attribute to the radius attribute LM-Password. What do you think ?
Maurizio Cimaschi wrote:
Ivan Kalik wrote:
You can't get cleartext password from AD, but you can extract encrypted (nt hashed) password as NT-Password with ldap. You will be able to authenticate pap and mschap requests with that.
I was lurking in the attribute list of the AD: http://msdn.microsoft.com/en-us/library/ms675480(VS.85).aspx
There's a particoular attribute that may do the trick: "DBCS-Pwd Attribute". It is said to be the account's LAN manager password.
Cute... but not good enough for doing MS-CHAP. MS-CHAP has fields for LAN manager passwords... which are usually blank. The passwords are pretty much always NT-hashed passwords.
Since rlm_mschap should be able to authenticate using one of clear-text pwd, LAN mgr pwd and NT pwd this should be enought.
The *client* has to supply the MS-CHAP magic using the LAN-manager password. Since the client always chooses NT-hashed passwords... using LAN manager passwords is not possible.
Via ldap.attrmap should be possible to map that attribute to the radius attribute LM-Password.
Yup.
What do you think ?
Nice, if the clients did LM passwords. Which they don't, unfortunately. Still, it's worth adding to the default ldap.attrmap. Alan DeKok.
Alan DeKok wrote:
The *client* has to supply the MS-CHAP magic using the LAN-manager password. Since the client always chooses NT-hashed passwords... using LAN manager passwords is not possible.
From the README is src/modules/rlm_mschap ***** The method just described is called NT-encryption by the RFC. MS-CHAP is actually designed for compatability with Microsoft LAN Manager as well. The response returned by the client actually contains an LM encrypted response as well as the NT-encrypted password. This implementation only uses the NT-encrypted response, which seems to work fine for Windows 98 and Windows 2000. ***** So it seems more a limit of the server. Could it be possible to see in the debug if the two encrypted pwd are available ? if thy're there it could be possible to write a patch and, possibly, to attach directly to the AD (which seems to make that LM pwd available).
Maurizio Cimaschi wrote:
Alan DeKok wrote:
The *client* has to supply the MS-CHAP magic using the LAN-manager password. Since the client always chooses NT-hashed passwords... using LAN manager passwords is not possible.
From the README is src/modules/rlm_mschap ... So it seems more a limit of the server.
No. The server ALREADY can use LM passwords to authenticate users, IF one is supplied, AND the client supplies the LM fields of the MS-CHAP response. Go read the source code to rlm_mschap.c
Could it be possible to see in the debug if the two encrypted pwd are available ? if thy're there it could be possible to write a patch and, possibly, to attach directly to the AD (which seems to make that LM pwd available).
You don't need a patch. You can just add the dBCSpwd to ldap.attrmap. But it won't help. Why? Take a look at RFC 2548, and compare MS-CHAP v*1* to MS-CHAP v*2*. There's no LM-Password fields on MS-CHAPv2. And PEAP uses EAP-MSCHAPv2, not v1. Newer versions of Windows also do MS-CHAPv2, not v1. So... the dBCSpwd field will only help if the client is doing MS-CHAPv1. Which means PPP. Sometimes. For very old versions of Windows. Nice, but not very helpful. Alan DeKok.
Murray, Elizabeth [DNR] wrote:
Thanks. Glad I didn't get this last night or I wouldn't have slept!!!
I'm happy not do have disrupted you sleep ;-)
I will have multiple access points spread across a large geographic area that will authenticate to a series of Radius servers located in the internal network. Any other suggestions would be appreciated. I've got most of this in my head so I need to do some writing. I'm here for 2 days then vacation. I almost don't want to go because this has been such a frustrating task for me. Thanks again. Any more ideas would be appreciated.
Just one consideration. Do your IT envirnonment have to be resilient to a loss of a server or WAN line ? If not I would not bother to have more than one radius server; if yes you should already have in place backup domain controllers, so I'd map a radius server for every backup domain controller.
OK. Following the suggestions, I installed the application for the application to track changes. Not so easy to do. I now give up. I followed the instructions and when I run the test it asks me about the .hgrc file. Not to be found anywhere. This will have to be step by step for me. Good way to check you site though!!! Liz M -----Original Message----- From: freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org [mailto:freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org] On Behalf Of Maurizio Cimaschi Sent: Thursday, August 14, 2008 12:47 PM To: FreeRadius users mailing list Subject: Re: Freeradius in an AD environment on opensuse server Murray, Elizabeth [DNR] wrote:
Thanks. Glad I didn't get this last night or I wouldn't have slept!!!
I'm happy not do have disrupted you sleep ;-)
I will have multiple access points spread across a large geographic area that will authenticate to a series of Radius servers located in the internal network. Any other suggestions would be appreciated. I've got most of this in my head so I need to do some writing. I'm here for 2 days then vacation. I almost don't want to go because this has been such a frustrating task for me. Thanks again. Any more ideas would be appreciated.
Just one consideration. Do your IT envirnonment have to be resilient to a loss of a server or WAN line ? If not I would not bother to have more than one radius server; if yes you should already have in place backup domain controllers, so I'd map a radius server for every backup domain controller. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Murray, Elizabeth [DNR] wrote:
OK. Following the suggestions, I installed the application for the application to track changes. Not so easy to do. I now give up.
That is about as vague a description as I've ever seen. If it's not possible for you to describe accurately what you're doing, you won't have much luck solving *any* problems.
I followed the instructions and when I run the test it asks me about the .hgrc file. Not to be found anywhere.
Followed "the instructions"? On what page? Can you say? Is it a secret?
This will have to be step by step for me. Good way to check you site though!!!
I think the problems you're running into are not with the documentation or examples. Alan DeKok.
http://deployingradius.com/documents/configuration/setup.html Sorry. It's on this page having to do with the Mercurial installation. -----Original Message----- From: freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org [mailto:freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, August 14, 2008 2:34 PM To: FreeRadius users mailing list Subject: Re: Freeradius in an AD environment on opensuse server Murray, Elizabeth [DNR] wrote:
OK. Following the suggestions, I installed the application for the application to track changes. Not so easy to do. I now give up.
That is about as vague a description as I've ever seen. If it's not possible for you to describe accurately what you're doing, you won't have much luck solving *any* problems.
I followed the instructions and when I run the test it asks me about the .hgrc file. Not to be found anywhere.
Followed "the instructions"? On what page? Can you say? Is it a secret?
This will have to be step by step for me. Good way to check you site though!!!
I think the problems you're running into are not with the documentation or examples. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
If that's difficult, save raddb configuration directory (and subdirectories) as cfgbkp1, cfgbkp2, ... When you mess up and don't know how to fix it you can copy back. Ivan Kalik Kalik Informatika ISP Dana 14/8/2008, "Murray, Elizabeth [DNR]" <Elizabeth.Murray@dnr.iowa.gov> piše:
http://deployingradius.com/documents/configuration/setup.html
Sorry. It's on this page having to do with the Mercurial installation.
-----Original Message----- From: freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org [mailto:freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, August 14, 2008 2:34 PM To: FreeRadius users mailing list Subject: Re: Freeradius in an AD environment on opensuse server
Murray, Elizabeth [DNR] wrote:
OK. Following the suggestions, I installed the application for the application to track changes. Not so easy to do. I now give up.
That is about as vague a description as I've ever seen.
If it's not possible for you to describe accurately what you're doing, you won't have much luck solving *any* problems.
I followed the instructions and when I run the test it asks me about the .hgrc file. Not to be found anywhere.
Followed "the instructions"? On what page? Can you say? Is it a secret?
This will have to be step by step for me. Good way to check you site though!!!
I think the problems you're running into are not with the documentation or examples.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Murray, Elizabeth [DNR] wrote:
OK. Following the suggestions, I installed the application for the application to track changes. Not so easy to do. I now give up. I followed the instructions and when I run the test it asks me about the .hgrc file. Not to be found anywhere.
Given this error, it seems that you're busy installing Mercurial; but I did not sugest you to install any Source Control Management system. At least is not related with the installation of freeradius.
OK. I'll pass that by. It does make this suggestion on http://deployingradius.com/documents/configuration/setup.html link. I just finished rebuilding my opensuse server and will start with the PAP settings. -----Original Message----- From: freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org [mailto:freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org] On Behalf Of Maurizio Cimaschi Sent: Thursday, August 14, 2008 4:22 PM To: FreeRadius users mailing list Subject: Re: Freeradius in an AD environment on opensuse server Murray, Elizabeth [DNR] wrote:
OK. Following the suggestions, I installed the application for the application to track changes. Not so easy to do. I now give up. I followed the instructions and when I run the test it asks me about the .hgrc file. Not to be found anywhere.
Given this error, it seems that you're busy installing Mercurial; but I did not sugest you to install any Source Control Management system. At least is not related with the installation of freeradius. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Sorry. I'm really new at this and I took this as a good suggestion. I was just trying to follow the instructions. I will begin again and leave that out. I do appreciate having the ability to communicate with everyone on the list and will try to be more exact. Right now I have installed 11.0 opensuse. Radius -X does not load error message is First error I found says "/etc/raddb/certs/bootstrap: line 15: make: command not found" -----Original Message----- From: freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org [mailto:freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org] On Behalf Of Maurizio Cimaschi Sent: Thursday, August 14, 2008 4:22 PM To: FreeRadius users mailing list Subject: Re: Freeradius in an AD environment on opensuse server Murray, Elizabeth [DNR] wrote:
OK. Following the suggestions, I installed the application for the application to track changes. Not so easy to do. I now give up. I followed the instructions and when I run the test it asks me about the .hgrc file. Not to be found anywhere.
Given this error, it seems that you're busy installing Mercurial; but I did not sugest you to install any Source Control Management system. At least is not related with the installation of freeradius. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Murray, Elizabeth [DNR] wrote:
"/etc/raddb/certs/bootstrap: line 15: make: command not found"
you need to install "make" package. Try here: http://packages.opensuse-community.org/
________________________________________ From: freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org [freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org] On Behalf Of Maurizio Cimaschi [mauri@unixrulez.org] Sent: Friday, August 15, 2008 10:03 AM To: FreeRadius users mailing list Subject: Re: Freeradius in an AD environment on opensuse server Murray, Elizabeth [DNR] wrote:
"/etc/raddb/certs/bootstrap: line 15: make: command not found"
you need to install "make" package. Try here: http://packages.opensuse-community.org/ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Murray, Elizabeth [DNR] wrote:
I’ve been struggling with this for months.
That's always a bad sign. If something goes wrong... ask.
I found a doc HOW TO on the opensuse website. It says I have to use Samba in order to have the users authenticate. For some reason every time I get that thing configured, it works for a few days then…it’s gone.
Computers aren't magic. If data disappears, it's because something is making it disappear.
Can I set up freeradius to authenticate with ldaps and be secure?
No. Active Directory pretends to be an LDAP server. But it doesn't supply clear-text passwords when LDAP clients ask for them. So... the only way for FreeRADIUS to authenticate against AD is via Samba.
I would really be grateful for any help you could give me. I now have the radius server back to it’s original configuration….clean. So I’m ready to do your bidding.
See my web site for configuring FreeRADIUS && AD. http://deployingradius.com/documents/configuration/active_directory.html Alan DeKok.
I'll give it a try again. I did find your website but came to a spot that I couldn't get past. I'll start again with a clean server and let you k now when I get stuck. Thanks. Nice to know I’m not alone. -----Original Message----- From: freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org [mailto:freeradius-users-bounces+elizabeth.murray=dnr.iowa.gov@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, August 14, 2008 2:12 AM To: FreeRadius users mailing list Subject: Re: Freeradius in an AD environment on opensuse server Murray, Elizabeth [DNR] wrote:
I’ve been struggling with this for months.
That's always a bad sign. If something goes wrong... ask.
I found a doc HOW TO on the opensuse website. It says I have to use Samba in order to have the users authenticate. For some reason every time I get that thing configured, it works for a few days then…it’s gone.
Computers aren't magic. If data disappears, it's because something is making it disappear.
Can I set up freeradius to authenticate with ldaps and be secure?
No. Active Directory pretends to be an LDAP server. But it doesn't supply clear-text passwords when LDAP clients ask for them. So... the only way for FreeRADIUS to authenticate against AD is via Samba.
I would really be grateful for any help you could give me. I now have the radius server back to it’s original configuration….clean. So I’m ready to do your bidding.
See my web site for configuring FreeRADIUS && AD. http://deployingradius.com/documents/configuration/active_directory.html Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
Ivan Kalik -
Maurizio Cimaschi -
Murray, Elizabeth [DNR]