error start freeradius -x
Hello to all, I state that I am a beginner and I followed some guidelines to install the freeradius, I wanted to connect wifi via radius to the active directories, but when I configured ldap I always find this error rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap//xxx.xxxxx.local:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 52e, v4563. rlm_ldap (ldap): Opening connection failed (0) whit ldapsearch -H ldap://xxx.xxx.local -x -D 'cn=xxxxx,cn=users,dc=xxxxxxx,dc=local' -w P12344555551 -b "DC=bxxxxxxxx,DC=local" -a always "(objectClass=User)" cn it works perfectly I don't know what to feel anymore, I find nothing to help me overcome the rock, the ad server is a windows server 2019. you can help me ?
On Nov 18, 2021, at 12:39 PM, Flavio Bono <flavio@cbitsrl.it> wrote:
I state that I am a beginner and I followed some guidelines to install the freeradius, I wanted to connect wifi via radius to the active directories, but when I configured ldap I always find this error
rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap//xxx.xxxxx.local:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 52e, v4563. rlm_ldap (ldap): Opening connection failed (0)
Read mods-available/ldap. It has instructions for converting the LDAP module configuration to the arguments use by ldapsearch.
whit
ldapsearch -H ldap://xxx.xxx.local -x -D 'cn=xxxxx,cn=users,dc=xxxxxxx,dc=local' -w P12344555551 -b "DC=bxxxxxxxx,DC=local" -a always "(objectClass=User)" cn
it works perfectly
I don't know what to feel anymore, I find nothing to help me overcome the rock, the ad server is a windows server 2019.
What you've configured in mods-available/ldap is different from what you're passing to ldapsearch. Alan DeKok.
Sorry I'm confused, maybe I have not explained well, my intent is to configure the freeradius so that it verifies username and password in the active directories of windows server 2019 through the ldap service. I configured the ldap file and I symlinked the mod_enable directory, I followed some sites and posts to check my error but I always get the same "wrong credentials" result The freeradius at the start keeps saying that the credentials are wrong, but as you can see I have checked them with ldapsearch and they work. I followed what is reported in the ldap file to insert the pameters, but I think I should see an example to understand where I am wrong. Can I find configuration examples to verify my error? I believe that many IT have connected freeradius to the AD of windows 2019, and will certainly have changed a few parameters to do so but I cannot find a guide that explains it in detail. Can you recommend a guide? Grazie. Il giorno gio 18 nov 2021 alle ore 19:01 Alan DeKok < aland@deployingradius.com> ha scritto:
On Nov 18, 2021, at 12:39 PM, Flavio Bono <flavio@cbitsrl.it> wrote:
I state that I am a beginner and I followed some guidelines to install the freeradius, I wanted to connect wifi via radius to the active directories, but when I configured ldap I always find this error
rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap//xxx.xxxxx.local:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 52e, v4563. rlm_ldap (ldap): Opening connection failed (0)
Read mods-available/ldap. It has instructions for converting the LDAP module configuration to the arguments use by ldapsearch.
whit
ldapsearch -H ldap://xxx.xxx.local -x -D 'cn=xxxxx,cn=users,dc=xxxxxxx,dc=local' -w P12344555551 -b "DC=bxxxxxxxx,DC=local" -a always "(objectClass=User)" cn
it works perfectly
I don't know what to feel anymore, I find nothing to help me overcome the rock, the ad server is a windows server 2019.
What you've configured in mods-available/ldap is different from what you're passing to ldapsearch.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Nov 18, 2021, at 2:37 PM, Flavio Bono <flavio@cbitsrl.it> wrote:
Sorry I'm confused, maybe I have not explained well, my intent is to configure the freeradius so that it verifies username and password in the active directories of windows server 2019 through the ldap service.
Yes, I understand that.
I configured the ldap file and I symlinked the mod_enable directory, I followed some sites and posts to check my error but I always get the same "wrong credentials" result
The freeradius at the start keeps saying that the credentials are wrong, but as you can see I have checked them with ldapsearch and they work.
Only if you're passing the same things to ldapsearch.
I followed what is reported in the ldap file to insert the pameters, but I think I should see an example to understand where I am wrong.
The "ldapsearch" command you posted doesn't match what's in the mods-available/ldap file. It says: ldapsearch -D ${identity} -w ${password} -h ${server} -b 'CN=user,${base_dn}' Where you replace ${identity} , etc. with the values you configured in the ldap module. You're passing *different* arguments to ldapsearch. Which means you're testing *something different*. Which means that the tests aren't helpful.
Can I find configuration examples to verify my error?
The documentation in the server is correct. The configuration examples in the server are correct.
I believe that many IT have connected freeradius to the AD of windows 2019, and will certainly have changed a few parameters to do so but I cannot find a guide that explains it in detail.
There's no magic here. Follow the documentation. Follow the examples. It will work. The only reason it won't work is: a) you're passing different things to FreeRADIUS and to ldapsearch b) you're running ldapsearch from a different machine than FreeRADIUS, and AD doesn't let the FreeRADIUS machine do the queries There really isn't much else. FreeRADIUS uses the same LDAP libraries that ldapsearch uses. So if ldapsearch works, then FreeRADIUS works. You just have to pass the same things to FreeRADIUS and to ldapsearch.
Can you recommend a guide?
There's no need for more than what's in the server already. It works. Alan DeKok.
thank you for your patience you are very kind to help me, the server was created today specifically for freeradius, the commands I launch them from the same server a ubuntu 20.04. Here are the copies from the console, I replaced the domain with foo and pluto the password and I did not touch the ' ldap { # Note that this needs to match the name(s) in the LDAP server # certificate, if you're using ldaps. See OpenLDAP documentation # for the behavioral semantics of specifying more than one host. # # Depending on the libldap in use, server may be an LDAP URI. # In the case of OpenLDAP this allows additional the following # additional schemes: # - ldaps:// (LDAP over SSL) # - ldapi:// (LDAP over Unix socket) # - ldapc:// (Connectionless LDAP) server = 'srv-dc6.pippo.local' # server = 'srv-dc4.pippo.local' # server = 'ldap.rrdns.example.org' # Port to connect on, defaults to 389, will be ignored for LDAP URIs. # port = 389 # Administrator account for searching and possibly modifying. # If using SASL + KRB5 these should be commented out. identity = 'cn=Adminfr,cn=Users,dc=pippo,dc=local' password = pluto # Unless overridden in another section, the dn from which all # searches will start from. base_dn = 'dc=pippo,dc=local' ping srv-dc6.pippo.local Risposta da 192.168.17.19: byte=32 durata=30ms TTL=62 Risposta da 192.168.17.19: byte=32 durata=30ms TTL=62 Risposta da 192.168.17.19: byte=32 durata=29ms TTL=62 ldapsearch -H ldap://srv-dc6.pippo.local -x -D 'cn=adminfr,cn=users,dc=pippo,dc=local' -w pluto -b "DC=pippo,DC=local" -a always "(objectClass=User)" cn Il giorno gio 18 nov 2021 alle ore 21:06 Alan DeKok < aland@deployingradius.com> ha scritto:
On Nov 18, 2021, at 2:37 PM, Flavio Bono <flavio@cbitsrl.it> wrote:
Sorry I'm confused, maybe I have not explained well, my intent is to configure the freeradius so that it verifies username and password in the active directories of windows server 2019 through the ldap service.
Yes, I understand that.
I configured the ldap file and I symlinked the mod_enable directory, I followed some sites and posts to check my error but I always get the same "wrong credentials" result
The freeradius at the start keeps saying that the credentials are wrong, but as you can see I have checked them with ldapsearch and they work.
Only if you're passing the same things to ldapsearch.
I followed what is reported in the ldap file to insert the pameters, but I think I should see an example to understand where I am wrong.
The "ldapsearch" command you posted doesn't match what's in the mods-available/ldap file.
It says:
ldapsearch -D ${identity} -w ${password} -h ${server} -b 'CN=user,${base_dn}'
Where you replace ${identity} , etc. with the values you configured in the ldap module.
You're passing *different* arguments to ldapsearch. Which means you're testing *something different*. Which means that the tests aren't helpful.
Can I find configuration examples to verify my error?
The documentation in the server is correct. The configuration examples in the server are correct.
I believe that many IT have connected freeradius to the AD of windows 2019, and will certainly have changed a few parameters to do so but I cannot find a guide that explains it in detail.
There's no magic here. Follow the documentation. Follow the examples. It will work.
The only reason it won't work is:
a) you're passing different things to FreeRADIUS and to ldapsearch
b) you're running ldapsearch from a different machine than FreeRADIUS, and AD doesn't let the FreeRADIUS machine do the queries
There really isn't much else. FreeRADIUS uses the same LDAP libraries that ldapsearch uses. So if ldapsearch works, then FreeRADIUS works. You just have to pass the same things to FreeRADIUS and to ldapsearch.
Can you recommend a guide?
There's no need for more than what's in the server already. It works.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Nov 18, 2021, at 3:34 PM, Flavio Bono <flavio@cbitsrl.it> wrote:
thank you for your patience you are very kind to help me, the server was created today specifically for freeradius, the commands I launch them from the same server a ubuntu 20.04.
Here are the copies from the console, I replaced the domain with foo and pluto the password and I did not touch the '
That's nice. Did you try using the ldapsearch string I suggested? Again: ldapsearch -D ${identity} -w ${password} -h ${server} -b 'CN=user,${base_dn}' Maybe you're using a version of FreeRADIUS which is many years old, and doesn't have the updated documentation I was talking about. You can read here: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-avail... Look for the text which begins: You can run the 'ldapsearch' command line tool and READ IT. Then, do what it says.
ldap {
None of that configuration will help debug the issue. You don't need to post it to the list.
ping srv-dc6.pippo.local Risposta da 192.168.17.19: byte=32 durata=30ms TTL=62 Risposta da 192.168.17.19: byte=32 durata=30ms TTL=62 Risposta da 192.168.17.19: byte=32 durata=29ms TTL=62
That isn't relevant, either.
ldapsearch -H ldap://srv-dc6.pippo.local -x -D 'cn=adminfr,cn=users,dc=pippo,dc=local' -w pluto -b "DC=pippo,DC=local" -a always "(objectClass=User)" cn
That isn't the ldapsearch command I asked you to run. Or, follow the documentation from GitHub, It's newer than the version you have. It will work. Alan DeKok.
Hi Again, I did the installation with the ubuntu repository (apt-get install freeradius-ldap) I think it's the 1/20/2020 here is the result of the command you suggested to me. root@srv-radius02:/home/adminfr# ldapsearch -D cn=adminfr,cn=users,dc=pippo,dc=local -w pluto -h srv-dc6.pippo.local -b cn=adminfr,cn=users,DC=pippo,DC=local # extended LDIF # # LDAPv3 # base <cn=adminfr,cn=users,DC=pippo,DC=local> with scope subtree # filter: (objectclass=*) # requesting: ALL # # Adminfr, Users, pippo.local dn: CN=Adminfr,CN=Users,DC=pippo,DC=local objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: Adminfr givenName: Adminfr distinguishedName: CN=Adminfr,CN=Users,DC=pippo,DC=local instanceType: 4 whenCreated: 20211118161155.0Z whenChanged: 20211118170348.0Z displayName: Adminfr uSNCreated: 3038881 memberOf: CN=Administrators,CN=Builtin,DC=pippo,DC=local uSNChanged: 3040068 name: Adminfr objectGUID:: Ee userAccountControl: 66048 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 132817293862211680 lastLogoff: 0 lastLogon: 132817304997880836 pwdLastSet: 132817286288634373 primaryGroupID: 513 objectSid:: xxxxxxxxxxxxxxxxxxxxxxxx adminCount: 1 accountExpires: 9223372036854775807 logonCount: 0 sAMAccountName: adminfr sAMAccountType: 805306368 userPrincipalName: adminfr@pippo.local lockoutTime: 0 objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=pippo,DC=local dSCorePropagationData: 20211118170212.0Z dSCorePropagationData: 20211118161156.0Z dSCorePropagationData: 16010101000000.0Z lastLogonTimestamp: 132817262760193886 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 root@srv-radius02:/home/adminfr# could it be the version? Grazie. Il giorno gio 18 nov 2021 alle ore 21:40 Alan DeKok < aland@deployingradius.com> ha scritto:
On Nov 18, 2021, at 3:34 PM, Flavio Bono <flavio@cbitsrl.it> wrote:
thank you for your patience you are very kind to help me, the server was created today specifically for freeradius, the commands I launch them from the same server a ubuntu 20.04.
Here are the copies from the console, I replaced the domain with foo and pluto the password and I did not touch the '
That's nice.
Did you try using the ldapsearch string I suggested? Again:
ldapsearch -D ${identity} -w ${password} -h ${server} -b 'CN=user,${base_dn}'
Maybe you're using a version of FreeRADIUS which is many years old, and doesn't have the updated documentation I was talking about. You can read here:
https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-avail...
Look for the text which begins:
You can run the 'ldapsearch' command line tool
and READ IT. Then, do what it says.
ldap {
None of that configuration will help debug the issue. You don't need to post it to the list.
ping srv-dc6.pippo.local Risposta da 192.168.17.19: byte=32 durata=30ms TTL=62 Risposta da 192.168.17.19: byte=32 durata=30ms TTL=62 Risposta da 192.168.17.19: byte=32 durata=29ms TTL=62
That isn't relevant, either.
ldapsearch -H ldap://srv-dc6.pippo.local -x -D 'cn=adminfr,cn=users,dc=pippo,dc=local' -w pluto -b "DC=pippo,DC=local" -a always "(objectClass=User)" cn
That isn't the ldapsearch command I asked you to run.
Or, follow the documentation from GitHub, It's newer than the version you have. It will work.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 18/11/2021 21:17, Flavio Bono wrote:
Hi Again, I did the installation with the ubuntu repository (apt-get install freeradius-ldap) I think it's the 1/20/2020 here is the result of the command you suggested to me.
The FreeRADIUS LDAP code hasn't changed much in a long while, that should work fine.
could it be the version?
You'd be better to paste the full debug output, as it says here: https://wiki.freeradius.org/list-help There are a few different ways you can use LDAP. If you're e.g. using PEAP/MSCHAPv2 with AD then it just won't work, you have to use Samba. If it's e.g. EAP-TTLS/PAP then you can auth with LDAP. If you're using the former and want to check groups only then LDAP is fine. Without the full debug, all we're doing is guessing about what's happening. Alan's suggestions are all good - the password has to match, and it's obvious that it is with ldapsearch and not with FreeRADIUS. The full debug will show *why* it's not matching. -- Matthew
participants (3)
-
Alan DeKok -
Flavio Bono -
Matthew Newton