OpenDirectory Authentication fails with eap but works with pap
I have recently had to migrate my FreeRADIUS from one sick OpenDirectory server to a "fresh" one. FreeRadius was hard crashing whenever it got an eap authentication request on the "sick" server, on the newly promoted server it runs without crashing. the config checks out with XC and running as X works as expected. when I use (from a remote machine) radtest -x -t pap radiustest 2020Password 192.168.9.23 0 testing123 I get Received Access-Accept Id 139 from 192.168.9.23:1812 to 0.0.0.0:0 length 20 from the debug:- suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "radiustest", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: No EAP-Message, not doing EAP (3) [eap] = noop (3) [files] = noop (3) opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. (3) opendirectory: The host 192.168.9.9 does not have an access group. (3) opendirectory: no access control groups, all users allowed (3) opendirectory: Setting Auth-Type = opendirectory (3) [opendirectory] = ok (3) [expiration] = noop (3) [logintime] = noop Not doing PAP as Auth-Type is already set. (3) [pap] = noop (3) } # authorize = ok so with pap it seems to talk to OD nicely.. however... if i try and authenticate with the same id trying to auth for WiFI (unifi access points) i get a fail and the offending stanza in the debug is (11) eap_mschapv2: authenticate { (11) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (11) mschap: No NT-Password configured. Trying OpenDirectory Authentication (11) mschap: OD username_string = radiustest, OD shortUserName= (length = 0) (11) mschap: Stepbuf server challenge : 7972ffffffca6a52ffffffeb695bffffff87fffffffd46ffffffa4ffffffef18ffffffc9ffffffa0 (11) mschap: Stepbuf peer challenge : 37ffffffa043ffffffcdffffffe62503fffffffeffffffdf6f5cffffffd849ffffffb4ffffff8dffffffd2 (11) mschap: Stepbuf p24 : ffffffcdffffffc2ffffffd727472866ffffffd0fffffffe2fffffffa8263e5bffffffc150ffffff997fffffff90ffffffbbffffffb13dffffffeeffffff86 (11) mschap: ERROR: rlm_mschap: authentication failed - status = eUndefinedError I am a bit stuck with this, I am unsure why pap it works and it fails with eap. I did not fill this post with random logs, but if you have any ideas I can capture logs/configs etc as needed. Thanks in advance. I did have this working on the previous OD master, but a security update seemed to stop it working hence my migration efforts, I have followed the same "migration" document from Apple, but to be honest, after several days messing around I am just about ready to run up a VM and put FreeNAS into an Ubuntu box (if only I could be sure it would get its auth from OD) Ash -- -- ****Conciliation Resources | ****www.c-r.org <http://www.c-r.org/> **********Burghley Yard, 106 Burghley Road, London NW5 1AL UK *Why does inclusion matter for peace? Download our Accord <https://www.c-r.org/accord/inclusion-peace-processes> and explore our infographic <https://www.c-r.org/news-and-views/news/infographic-inclusion-why-does-it-matter-peace> to find out.* Sign up <http://www.c-r.org/newsletter/subscribe> to our e-newsletter. See our latest updates on Twitter @CRbuildpeace <https://twitter.com/crbuildpeace> and _Facebook <https://www.facebook.com/ConciliationResources>*.*_ ***Charity registered in England and Wales (1055436). Company limited by guarantee registered in England and Wales (03196482) *** -- ***** **********This email is intended only for the named addressee(s) and may contain confidential and/or privileged material. If you have received this email in error, please notify Conciliation Resources immediately by emailing cr@c-r.org <mailto:cr@c-r.org> and delete the message. * * * *** ** ******* * *
On Feb 22, 2020, at 12:27 PM, Ashley Drees <adrees@c-r.org> wrote:
I have recently had to migrate my FreeRADIUS from one sick OpenDirectory server to a "fresh" one. FreeRadius was hard crashing whenever it got an eap authentication request on the "sick" server, on the newly promoted server it runs without crashing.
Hmm... FreeRADIUS shouldn't crash. I suspect there are issues in older versions which have since been fixed.
the config checks out with XC and running as X works as expected.
That's good.
so with pap it seems to talk to OD nicely.. however...
if i try and authenticate with the same id trying to auth for WiFI (unifi access points) i get a fail and the offending stanza in the debug is
Some magic OpenDirectory failure. :( I've pushed a fix which makes the debug output look a little cleaner. But I don't think it will help this issue.
I am a bit stuck with this, I am unsure why pap it works and it fails with eap.
Magic :(
I did not fill this post with random logs, but if you have any ideas I can capture logs/configs etc as needed.
Thanks in advance.
I did have this working on the previous OD master, but a security update seemed to stop it working hence my migration efforts, I have followed the same "migration" document from Apple, but to be honest, after several days messing around I am just about ready to run up a VM and put FreeNAS into an Ubuntu box (if only I could be sure it would get its auth from OD)
OpenDirectory is a bit of a "black box", unfortunately. If following Apple's documentation doesn't work, there isn't a lot more we can do. I'd suggest trying the latest FreeRADIUS code from GitHub: https://github.com/FreeRADIUS/freeradius-server/archive/v3.0.x.zip There are a number of small fixes in the OpenDirectory "glue" code which may help. But if that doesn't work, I'm not sure what else to suggest. Alan DeKok.
participants (2)
-
Alan DeKok -
Ashley Drees