pfSense + PPTP + FreeRADIUS + LDAP
Helo there, I'm relative new to freeradius, and i'm trying to configure a PPTP VPN on pfSense, authenticating in a FreeRADIUS with LDAP module. But, I'm getting the following error : Found Auth-Type = LDAP WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No User-Password or CHAP-Password attribute in the request. Cannot perform authentication. Failed to authenticate the user. The authorize process works fine, but the authentication not. I can't find "Auth-Type = Local" as it says. This is my access request : rad_recv: Access-Request packet from host 192.168.7.1 port 2067, id=132, length=182 NAS-Identifier = "yoda" NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "189.102.177.232" User-Name = "fmathias" MS-CHAP-Challenge = 0xbb1e68338ed8f5047a5224fc502acaf9 MS-CHAP2-Response = 0x0100e017671426d787073d90dcb6a30ab3550000000000000000a5d5fa96e3770592a1df0039fcc812ea53a3684636f16cb3 I've tried many of google searches troubleshooting MS-CHAP problems and most of them is saying me to get a Cleartext-Password entry on my database. But I can't consider this an option, because the security of my accounts in LDAP would be extremely compromised. Can you help me? Thanks in advance, Fábio Rampazzo Mathias
Fabio Rampazzo Mathias wrote:
I'm relative new to freeradius, and i'm trying to configure a PPTP VPN on pfSense, authenticating in a FreeRADIUS with LDAP module. But, I'm getting the following error :
Found Auth-Type = LDAP WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No User-Password or CHAP-Password attribute in the request. Cannot perform authentication. Failed to authenticate the user.
The authorize process works fine, but the authentication not. I can't find "Auth-Type = Local" as it says. This is my access request :
Did you look in the configuration files for "Auth-Type = Local"? Or in your database? And you posted only PART of the debug output. Wy?
I've tried many of google searches troubleshooting MS-CHAP problems and most of them is saying me to get a Cleartext-Password entry on my database. But I can't consider this an option, because the security of my accounts in LDAP would be extremely compromised.
Too bad. You don't really have a choice. http://deployingradius.com/documents/protocols/compatibility.html Alan DeKok.
Alan, Thanks for quick response. On Tue, Feb 2, 2010 at 12:29 PM, Alan DeKok <aland@deployingradius.com>wrote:
Fabio Rampazzo Mathias wrote:
I'm relative new to freeradius, and i'm trying to configure a PPTP VPN on pfSense, authenticating in a FreeRADIUS with LDAP module. But, I'm getting the following error :
Found Auth-Type = LDAP WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No User-Password or CHAP-Password attribute in the request. Cannot perform authentication. Failed to authenticate the user.
The authorize process works fine, but the authentication not. I can't find "Auth-Type = Local" as it says. This is my access request :
Did you look in the configuration files for "Auth-Type = Local"? Or in your database?
yes and couldn't find anything saying "Auth-Type = Local"...but I think this isn't the most important problem. I've used "grep" to search.
And you posted only PART of the debug output. Wy?
I've sent just a part of debug because I've thought this is the part which really matters. Is there any other you need ?
I've tried many of google searches troubleshooting MS-CHAP problems and most of them is saying me to get a Cleartext-Password entry on my database. But I can't consider this an option, because the security of my accounts in LDAP would be extremely compromised.
Too bad. You don't really have a choice.
http://deployingradius.com/documents/protocols/compatibility.html
Ok. This means that PPTP needs MS-CHAP auth, and MS-CHAP needs Clear Password or NT Hash. How do I enable my FreeRADIUS to authenticate in LDAP using NT Hash ? Is there a way to do this ?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Att, Fabio Rampazzo Mathias
Fabio Rampazzo Mathias wrote:
yes and couldn't find anything saying "Auth-Type = Local"...but I think this isn't the most important problem. I've used "grep" to search.
A database?
I've sent just a part of debug because I've thought this is the part which really matters. Is there any other you need ?
The whole debug output, as suggested in the FAQ, README, INSTALL, "man" page...
Ok. This means that PPTP needs MS-CHAP auth, and MS-CHAP needs Clear Password or NT Hash. How do I enable my FreeRADIUS to authenticate in LDAP using NT Hash ? Is there a way to do this ?
Install 2.1.8. Put an NT-hash into the appropriate LDAP attribute. (See ldap.attrmap) It will work. Alan DeKok.
Alan, On Tue, Feb 2, 2010 at 5:27 PM, Alan DeKok <aland@deployingradius.com>wrote:
Fabio Rampazzo Mathias wrote:
yes and couldn't find anything saying "Auth-Type = Local"...but I think this isn't the most important problem. I've used "grep" to search.
A database?
There's no database AFAIK.
I've sent just a part of debug because I've thought this is the part which really matters. Is there any other you need ?
The whole debug output, as suggested in the FAQ, README, INSTALL, "man" page...
this can compromise some information of my organization, since config files expose some passwords and some landscape of my architecture... next time I'll spend some hours to remove them...
Ok. This means that PPTP needs MS-CHAP auth, and MS-CHAP needs Clear Password or NT Hash. How do I enable my FreeRADIUS to authenticate in LDAP using NT Hash ? Is there a way to do this ?
Install 2.1.8. Put an NT-hash into the appropriate LDAP attribute. (See ldap.attrmap) It will work.
I will try 2.1.8.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks a lot! ;-) Fabio Rampazzo Mathias
participants (2)
-
Alan DeKok -
Fabio Rampazzo Mathias