Hi freeradius-list, I'm trying to configure v3.0.11 and have some problems to understand how freeradius requests the configuration. The plan is to process requests via PEAP/MS-CHAPv2 to check MD4-Hashes against NT-Password-Attribute at a LDAP database. As I understand, PEAP gets processed within the outer default-virtual server and this passes the inner MS-CHAPv2 to inner-tunnel. Now I'm not shure if it has to be processed through the mschap-module or through ldap-module. If mschap-module where or when does freeradius get the NT-Password from LDAP? Does the mschap-module trigger the ldap-module? In details I want to upgrade a working 2.0.0 configuration to 3.0.11 (and then update to the upcoming 3.0.12 release). Another point I'm struggeling are the mappings of the LDAP attributes. I have the old ldap.attrmap, but don't know how to bring checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem to the new configuration. changing the NT-Password is more simple ;) Later on some requests should get proxied via RadSec depending on their REALM, but for now having the above working would make me quite happy. I'm very thankful for your help! Thanks!
On Sep 28, 2016, at 1:21 PM, Philipp Trenz <mail@philipptrenz.de> wrote:
I'm trying to configure v3.0.11 and have some problems to understand how freeradius requests the configuration.
The plan is to process requests via PEAP/MS-CHAPv2 to check MD4-Hashes against NT-Password-Attribute at a LDAP database.
1) configure theLDAP module 2) enable it in the raddb/mods-enabled/ directory 3) test PEAP 4) it will work.
As I understand, PEAP gets processed within the outer default-virtual server and this passes the inner MS-CHAPv2 to inner-tunnel. Now I'm not shure if it has to be processed through the mschap-module or through ldap-module. If mschap-module where or when does freeradius get the NT-Password from LDAP? Does the mschap-module trigger the ldap-module?
The authentication data inside of the TLS tunnel gets passed to the inner-tunnel virtual server. There, the LDAP module is queried for the known password. Then, the MS-CHAP module uses the known password to authenticate the user.
In details I want to upgrade a working 2.0.0 configuration to 3.0.11 (and then update to the upcoming 3.0.12 release). Another point I'm struggeling are the mappings of the LDAP attributes. I have the old ldap.attrmap, but don't know how to bring checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem to the new configuration. changing the NT-Password is more simple ;)
See raddb/mods-available/ldap. Look for the "update" block in that file. This is documented. Alan DeKok.
On 28/09/2016 18:21, Philipp Trenz wrote:
As I understand, PEAP gets processed within the outer default-virtual server and this passes the inner MS-CHAPv2 to inner-tunnel. Now I'm not shure if it has to be processed through the mschap-module or through ldap-module.
Both.
If mschap-module where or when does freeradius get the NT-Password from LDAP? Does the mschap-module trigger the ldap-module?
You use the ldap module during the "authorize" phase, which finds the account and reads out the NT password hash. Then you use the mschap module during the "authenticate" phase, which actually checks the supplied password against the NT password hash. It is very important to remember that FreeRADIUS runs the authorize modules *first*, and the authenticate modules at the end. There are a couple of good articles here, specifically for using FreeRADIUS with a FreeIPA backend: http://firstyear.id.au/blog/html/2016/01/13/FreeRADIUS:_Using_mschapv2_with_... http://firstyear.id.au/blog/html/2015/07/06/FreeIPA:_Giving_permissions_to_s... They also gives the fu required to get FreeIPA to store the ipaNTHash attribute, and to selectively expose it to the RADIUS server. (You don't want to expose your NT password hashes to the whole world; they are essentially plain text passwords in their own right. A client can use the NT password hash by itself to authenticate, without having to brute force it) Regards, Brian.
participants (3)
-
Alan DeKok -
Brian Candler -
Philipp Trenz