My PPTP+802.1X+MS-CHAP+EAP+OpenLDAP+MySQL Project.
I'm a hard core Linux User with a Linux infrastructure I am attempting to expand upon and include FreeRadius, with my existing Linux-only OpenLDAP, Kerberos, Samba, Bind Infrastructure. Here is my situation. I want to be able to create MS-CHAPv2 VPNs, that use pptpd, pppd and freeRadius. I want to secure my Wireless Access points using 802.1X and PEAP, or EAP-TLS that are operated by my Cisco Aironet 340. I'm not interested in encrypting traffic. I have UDP Protocols like Quake 3 that are degraded by WPA, WEP and IPSec. IPSec may get implemented in due time, but for now, thats not on the agenda. My current issue is securing the APs from unauthorized access. My Progess so far: The issue with the VPNs is that even through Client Side PPP uses MS-CHAP, FreeRadius is causing pppd to think its authenticating normal CHAP. Jan 9 03:09:00 kurama pppd[12373]: Peer User failed CHAP authentication rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: No MS-CHAP-Challenge in the request Now, The Server works fine when I turn off the Radius plugin and enter the and enter stuff in the chap-secrets. This is the output of radisd -fX rad_recv: Access-Request packet from host 127.0.0.1:35034, id=77, length=62 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "User" Calling-Station-Id = "192.168.0.3" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for User radius_xlat: '(uid=User)' radius_xlat: 'dc=pukey' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to kurama.pukey:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=pukey/password to kurama.pukey:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=pukey, with filter (uid=User) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U ] & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value AA6D039ED308809C... & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value AEC210AF99DB43C... & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user User authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "User", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 54 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: No MS-CHAP-Challenge in the request modcall[authenticate]: module "mschap" returns reject for request 0 modcall: leaving group MS-CHAP (returns reject) for request 0 auth: Failed to validate the user. Why is this happening? I haven't started on the AP security yet, because this is holding me back.
Hi,
The issue with the VPNs is that even through Client Side PPP uses MS-CHAP, FreeRadius is causing pppd to think its authenticating normal CHAP.
Jan 9 03:09:00 kurama pppd[12373]: Peer User failed CHAP authentication rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: No MS-CHAP-Challenge in the request
Now, The Server works fine when I turn off the Radius plugin and enter the and enter stuff in the chap-secrets. This is the output of radisd -fX
Humm... have you checked possible error messages in /var/log/messages (where pppd and the radius plugin output by default) ? I remember I had an equivalent problem once... could you check that your radiusclient on the VPN side has got the dictionary.microsoft file in its dictionary directory ? ---- # # Microsoft's VSA's, from RFC 2548 # # $Id: dictionary.microsoft,v 1.1 2002/03/06 13:23:09 dfs Exp $ # VENDOR Microsoft 311 Microsoft ATTRIBUTE MS-CHAP-Response 1 string Microsoft ATTRIBUTE MS-CHAP-Error 2 string Microsoft ATTRIBUTE MS-CHAP-CPW-1 3 string Microsoft ATTRIBUTE MS-CHAP-CPW-2 4 string Microsoft ATTRIBUTE MS-CHAP-LM-Enc-PW 5 string Microsoft ATTRIBUTE MS-CHAP-NT-Enc-PW 6 string Microsoft ATTRIBUTE MS-MPPE-Encryption-Policy 7 string Microsoft # This is referred to as both singular and plural in the RFC. # Plural seems to make more sense. ATTRIBUTE MS-MPPE-Encryption-Type 8 string Microsoft ATTRIBUTE MS-MPPE-Encryption-Types 8 string Microsoft ATTRIBUTE MS-RAS-Vendor 9 integer Microsoft ATTRIBUTE MS-CHAP-Domain 10 string Microsoft ATTRIBUTE MS-CHAP-Challenge 11 string Microsoft ATTRIBUTE MS-CHAP-MPPE-Keys 12 string Microsoft ATTRIBUTE MS-BAP-Usage 13 integer Microsoft ATTRIBUTE MS-Link-Utilization-Threshold 14 integer Microsoft ATTRIBUTE MS-Link-Drop-Time-Limit 15 integer Microsoft ATTRIBUTE MS-MPPE-Send-Key 16 string Microsoft ATTRIBUTE MS-MPPE-Recv-Key 17 string Microsoft ATTRIBUTE MS-RAS-Version 18 string Microsoft ATTRIBUTE MS-Old-ARAP-Password 19 string Microsoft ATTRIBUTE MS-New-ARAP-Password 20 string Microsoft ATTRIBUTE MS-ARAP-PW-Change-Reason 21 integer Microsoft ATTRIBUTE MS-Filter 22 string Microsoft ATTRIBUTE MS-Acct-Auth-Type 23 integer Microsoft ATTRIBUTE MS-Acct-EAP-Type 24 integer Microsoft ATTRIBUTE MS-CHAP2-Response 25 string Microsoft ATTRIBUTE MS-CHAP2-Success 26 string Microsoft ATTRIBUTE MS-CHAP2-CPW 27 string Microsoft ATTRIBUTE MS-Primary-DNS-Server 28 ipaddr Microsoft ATTRIBUTE MS-Secondary-DNS-Server 29 ipaddr Microsoft ATTRIBUTE MS-Primary-NBNS-Server 30 ipaddr Microsoft ATTRIBUTE MS-Secondary-NBNS-Server 31 ipaddr Microsoft #ATTRIBUTE MS-ARAP-Challenge 33 string Microsoft # # Integer Translations # # MS-BAP-Usage Values VALUE MS-BAP-Usage Not-Allowed 0 VALUE MS-BAP-Usage Allowed 1 VALUE MS-BAP-Usage Required 2 # MS-ARAP-Password-Change-Reason Values VALUE MS-ARAP-PW-Change-Reason Just-Change-Password 1 VALUE MS-ARAP-PW-Change-Reason Expired-Password 2 VALUE MS-ARAP-PW-Change-Reason Admin-Requires-Password-Change 3 VALUE MS-ARAP-PW-Change-Reason Password-Too-Short 4 # MS-Acct-Auth-Type Values VALUE MS-Acct-Auth-Type PAP 1 VALUE MS-Acct-Auth-Type CHAP 2 VALUE MS-Acct-Auth-Type MS-CHAP-1 3 VALUE MS-Acct-Auth-Type MS-CHAP-2 4 VALUE MS-Acct-Auth-Type EAP 5 # MS-Acct-EAP-Type Values VALUE MS-Acct-EAP-Type MD5 4 VALUE MS-Acct-EAP-Type OTP 5 VALUE MS-Acct-EAP-Type Generic-Token-Card 6 VALUE MS-Acct-EAP-Type TLS 13 ---------------
Now, The Server works fine when I turn off the Radius plugin and enter the and enter stuff in the chap-secrets. This is the output of radisd -fX
Humm... have you checked possible error messages in /var/log/messages (where pppd and the radius plugin output by default) ?
I remember I had an equivalent problem once... could you check that your radiusclient on the VPN side has got the dictionary.microsoft file in its dictionary directory ?
Also remeber to add the following line at the end of your radiusclient 'dictionary' file: INCLUDE /path/to/dictionary/directory/dictionary.microsoft For your information: If you are using radiusclient, your dictionaries might be in /etc/radiusclient. If you are using radiusclient-ng, check the /usr/share/radiusclient-ng directory. HTH, Thibault
Hi,
The issue with the VPNs is that even through Client Side PPP uses MS-CHAP, FreeRadius is causing pppd to think its authenticating normal CHAP.
Jan 9 03:09:00 kurama pppd[12373]: Peer User failed CHAP authentication rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: No MS-CHAP-Challenge in the request
Now, The Server works fine when I turn off the Radius plugin and enter the and enter stuff in the chap-secrets. This is the output of radisd -fX
Humm... have you checked possible error messages in /var/log/messages (where pppd and the radius plugin output by default) ? I remember I had an equivalent problem once... could you check that your radiusclient on the VPN side has got the dictionary.microsoft file in its dictionary directory ? ---- # # Microsoft's VSA's, from RFC 2548 # # $Id: dictionary.microsoft,v 1.1 2002/03/06 13:23:09 dfs Exp $ # VENDOR Microsoft 311 Microsoft ATTRIBUTE MS-CHAP-Response 1 string Microsoft ATTRIBUTE MS-CHAP-Error 2 string Microsoft ATTRIBUTE MS-CHAP-CPW-1 3 string Microsoft ATTRIBUTE MS-CHAP-CPW-2 4 string Microsoft ATTRIBUTE MS-CHAP-LM-Enc-PW 5 string Microsoft ATTRIBUTE MS-CHAP-NT-Enc-PW 6 string Microsoft ATTRIBUTE MS-MPPE-Encryption-Policy 7 string Microsoft # This is referred to as both singular and plural in the RFC. # Plural seems to make more sense. ATTRIBUTE MS-MPPE-Encryption-Type 8 string Microsoft ATTRIBUTE MS-MPPE-Encryption-Types 8 string Microsoft ATTRIBUTE MS-RAS-Vendor 9 integer Microsoft ATTRIBUTE MS-CHAP-Domain 10 string Microsoft ATTRIBUTE MS-CHAP-Challenge 11 string Microsoft ATTRIBUTE MS-CHAP-MPPE-Keys 12 string Microsoft ATTRIBUTE MS-BAP-Usage 13 integer Microsoft ATTRIBUTE MS-Link-Utilization-Threshold 14 integer Microsoft ATTRIBUTE MS-Link-Drop-Time-Limit 15 integer Microsoft ATTRIBUTE MS-MPPE-Send-Key 16 string Microsoft ATTRIBUTE MS-MPPE-Recv-Key 17 string Microsoft ATTRIBUTE MS-RAS-Version 18 string Microsoft ATTRIBUTE MS-Old-ARAP-Password 19 string Microsoft ATTRIBUTE MS-New-ARAP-Password 20 string Microsoft ATTRIBUTE MS-ARAP-PW-Change-Reason 21 integer Microsoft ATTRIBUTE MS-Filter 22 string Microsoft ATTRIBUTE MS-Acct-Auth-Type 23 integer Microsoft ATTRIBUTE MS-Acct-EAP-Type 24 integer Microsoft ATTRIBUTE MS-CHAP2-Response 25 string Microsoft ATTRIBUTE MS-CHAP2-Success 26 string Microsoft ATTRIBUTE MS-CHAP2-CPW 27 string Microsoft ATTRIBUTE MS-Primary-DNS-Server 28 ipaddr Microsoft ATTRIBUTE MS-Secondary-DNS-Server 29 ipaddr Microsoft ATTRIBUTE MS-Primary-NBNS-Server 30 ipaddr Microsoft ATTRIBUTE MS-Secondary-NBNS-Server 31 ipaddr Microsoft #ATTRIBUTE MS-ARAP-Challenge 33 string Microsoft # # Integer Translations # # MS-BAP-Usage Values VALUE MS-BAP-Usage Not-Allowed 0 VALUE MS-BAP-Usage Allowed 1 VALUE MS-BAP-Usage Required 2 # MS-ARAP-Password-Change-Reason Values VALUE MS-ARAP-PW-Change-Reason Just-Change-Password 1 VALUE MS-ARAP-PW-Change-Reason Expired-Password 2 VALUE MS-ARAP-PW-Change-Reason Admin-Requires-Password-Change 3 VALUE MS-ARAP-PW-Change-Reason Password-Too-Short 4 # MS-Acct-Auth-Type Values VALUE MS-Acct-Auth-Type PAP 1 VALUE MS-Acct-Auth-Type CHAP 2 VALUE MS-Acct-Auth-Type MS-CHAP-1 3 VALUE MS-Acct-Auth-Type MS-CHAP-2 4 VALUE MS-Acct-Auth-Type EAP 5 # MS-Acct-EAP-Type Values VALUE MS-Acct-EAP-Type MD5 4 VALUE MS-Acct-EAP-Type OTP 5 VALUE MS-Acct-EAP-Type Generic-Token-Card 6 VALUE MS-Acct-EAP-Type TLS 13 ---------------
Evan Vittitow wrote:
I want to secure my Wireless Access points using 802.1X and PEAP, or EAP-TLS that are operated by my Cisco Aironet 340. I'm not interested in encrypting traffic. I have UDP Protocols like Quake 3 that are degraded
You can't use EAP on any wireless point that I know of *without* encrypting the data. It wouldn't make any sense. Anyway...
by WPA, WEP and IPSec. IPSec may get implemented in due time, but for now, thats not on the agenda. My current issue is securing the APs from unauthorized access.
My Progess so far:
The issue with the VPNs is that even through Client Side PPP uses MS-CHAP, FreeRadius is causing pppd to think its authenticating normal CHAP.
Jan 9 03:09:00 kurama pppd[12373]: Peer User failed CHAP authentication rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: No MS-CHAP-Challenge in the request
This is a pppd configuration issue. You need (probably) the following in /etc/ppp/options.pptpd: -chap -mschap +mschap-v2 require-mppe
participants (3)
-
Evan Vittitow -
Phil Mayers -
Thibault Le Meur