edir + cert problem

[garry crothers]

Sayantan Bhowmick wrote:

>Hi,
>   Make sure that the server name you specify in the LDAP 
>module section matches with the CN in the certificate used
>by the eDirectory LDAP server. e.g if your LDAP server is
>using SSL CERT DNS, write the hostname as the server name.
>If you are using SSL CERT IP, write the IP address of the
>server in the LDAP section.
>
>Hope this helps.
>
>Regards,
>-Sayantan.
>
>  
>
>>>>g.crothers at queens-belfast.ac.uk 07/18/05 4:36 PM >>>
>>>>        
>>>>
>
>freeradius 1.0.4 compiled with -edir support on Solaris 9.
>
>After configuring and running freeradius,  I  issue a query from the 
>command line
>
>radtest VALID-USER VALID-USER-PASSOWRD localhost 389 testing123
>
>I seem to be getting an error
>
>rlm_ldap: could not set LDAP_OPT_X_TLS_CACERTFILE option to 
>/opt/sfw/etc/raddb/certs/barney.b64
>
>
>I have checked that I have correctly exported the certificate from the 
>
>novell server in question....and tried setting the premissions to 777
>I have done a search of the online docs but cant find anything 
>appropriate,   anyone got any ideas...
>
>
>
>Here is the debug  message from   radiusd -X -f
>
>
>bash-2.05# clear
>You have new mail in /var/mail/root
>bash-2.05# radiusd -X -f
>Starting - reading configuration files ...
>reread_config:  reading radiusd.conf
>Config:   including file: /usr/local/etc/raddb/proxy.conf
>Config:   including file: /usr/local/etc/raddb/clients.conf
>Config:   including file: /usr/local/etc/raddb/snmp.conf
>Config:   including file: /usr/local/etc/raddb/eap.conf
>Config:   including file: /usr/local/etc/raddb/sql.conf
>main: prefix = "/usr/local"
>main: localstatedir = "/usr/local/var"
>main: logdir = "/usr/local/var/log/radius"
>main: libdir = "/usr/local/lib"
>main: radacctdir = "/usr/local/var/log/radius/radacct"
>main: hostname_lookups = no
>main: max_request_time = 30
>main: cleanup_delay = 5
>main: max_requests = 1024
>main: delete_blocked_requests = 0
>main: port = 0
>main: allow_core_dumps = no
>main: log_stripped_names = no
>main: log_file = "/usr/local/var/log/radius/radius.log"
>main: log_auth = no
>main: log_auth_badpass = no
>main: log_auth_goodpass = no
>main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid"
>main: user = "(null)"
>main: group = "(null)"
>main: usercollide = no
>main: lower_user = "no"
>main: lower_pass = "no"
>main: nospace_user = "no"
>main: nospace_pass = "no"
>main: checkrad = "/usr/local/sbin/checkrad"
>main: proxy_requests = yes
>proxy: retry_delay = 5
>proxy: retry_count = 3
>proxy: synchronous = no
>proxy: default_fallback = yes
>proxy: dead_time = 120
>proxy: post_proxy_authorize = yes
>proxy: wake_all_if_all_dead = no
>security: max_attributes = 200
>security: reject_delay = 1
>security: status_server = no
>main: debug_level = 0
>read_config_files:  reading dictionary
>read_config_files:  reading naslist
>Using deprecated naslist file.  Support for this will go away soon.
>read_config_files:  reading clients
>read_config_files:  reading realms
>radiusd:  entering modules setup
>Module: Library search path is /usr/local/lib
>Module: Loaded exec
>exec: wait = yes
>exec: program = "(null)"
>exec: input_pairs = "request"
>exec: output_pairs = "(null)"
>exec: packet_type = "(null)"
>rlm_exec: Wait=yes but no output defined. Did you mean output=none?
>Module: Instantiated exec (exec)
>Module: Loaded expr
>Module: Instantiated expr (expr)
>Module: Loaded MS-CHAP
>mschap: use_mppe = yes
>mschap: require_encryption = no
>mschap: require_strong = no
>mschap: with_ntdomain_hack = no
>mschap: passwd = "(null)"
>mschap: authtype = "MS-CHAP"
>mschap: ntlm_auth = "(null)"
>Module: Instantiated mschap (mschap)
>Module: Loaded System
>unix: cache = no
>unix: passwd = "(null)"
>unix: shadow = "(null)"
>unix: group = "(null)"
>unix: radwtmp = "/usr/local/var/log/radius/radwtmp"
>unix: usegroup = no
>unix: cache_reload = 600
>Module: Instantiated unix (unix)
>Module: Loaded LDAP
>ldap: server = "nds02.XXX.COM"
>ldap: port = 389
>ldap: net_timeout = 1
>ldap: timeout = 4
>ldap: timelimit = 3
>ldap: identity = "cn=admin"
>ldap: tls_mode = no
>ldap: start_tls = yes
>ldap: tls_cacertfile = "/opt/sfw/etc/raddb/certs/barney.b64"
>ldap: tls_cacertdir = "(null)"
>ldap: tls_certfile = "(null)"
>ldap: tls_keyfile = "(null)"
>ldap: tls_randfile = "(null)"
>ldap: tls_require_cert = "demand"
>ldap: password = ""
>ldap: basedn = "o=XXX,ou=Staff "
>ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
>ldap: base_filter = "(objectclass=radiusprofile)"
>ldap: default_profile = "(null)"
>ldap: profile_attribute = "(null)"
>ldap: password_header = "(null)"
>ldap: password_attribute = "nspmPassword"
>ldap: access_attr = "uid"
>ldap: groupname_attribute = "cn"
>ldap: groupmembership_filter = 
>"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
>
>
>ldap: groupmembership_attribute = "(null)"
>ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap"
>ldap: ldap_debug = 0
>ldap: ldap_connections_number = 5
>ldap: compare_check_items = no
>ldap: access_attr_used_for_allow = yes
>ldap: do_xlat = yes
>ldap: edir_account_policy_check = yes
>rlm_ldap: Registering ldap_groupcmp for Ldap-Group
>rlm_ldap: Registering ldap_xlat with xlat_name ldap
>rlm_ldap: reading ldap<->radius mappings from file 
>/usr/local/etc/raddb/ldap.attrmap
>rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$
>rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$
>rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type
>rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use
>rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS
>Called-Station-Id
>rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS
>Calling-Station-Id
>rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password
>rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password
>rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT
>rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration
>rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type
>rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol
>rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS
>Framed-IP-Address
>rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS
>Framed-IP-Netmask
>rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route
>rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing
>rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id
>rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU
>rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS
>Framed-Compression
>rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host
>rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service
>rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port
>rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number
>rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id
>rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS
>Framed-IPX-Network
>rlm_ldap: LDAP radiusClass mapped to RADIUS Class
>rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout
>rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout
>rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS
>Termination-Action
>rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS
>Login-LAT-Service
>rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node
>rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group
>rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS 
>Framed-AppleTalk-Link
>rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS 
>Framed-AppleTalk-Network
>rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS 
>Framed-AppleTalk-Zone
>rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit
>rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port
>rlm_ldap: LDAP userPassword mapped to RADIUS User-Password
>rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password
>rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password
>rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type
>rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS
>Tunnel-Medium-Type
>rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS 
>Tunnel-Private-Group-Id
>conns: 104210
>Module: Instantiated ldap (ldap)
>Module: Loaded eap
>eap: default_eap_type = "md5"
>eap: timer_expire = 60
>eap: ignore_unknown_eap_types = no
>eap: cisco_accounting_username_bug = no
>rlm_eap: Loaded and initialized type md5
>rlm_eap: Loaded and initialized type leap
>gtc: challenge = "Password: "
>gtc: auth_type = "PAP"
>rlm_eap: Loaded and initialized type gtc
>mschapv2: with_ntdomain_hack = no
>rlm_eap: Loaded and initialized type mschapv2
>Module: Instantiated eap (eap)
>Module: Loaded preprocess
>preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups"
>preprocess: hints = "/usr/local/etc/raddb/hints"
>preprocess: with_ascend_hack = no
>preprocess: ascend_channels_per_line = 23
>preprocess: with_ntdomain_hack = no
>preprocess: with_specialix_jetstream_hack = no
>preprocess: with_cisco_vsa_hack = no
>Module: Instantiated preprocess (preprocess)
>Module: Loaded CHAP
>Module: Instantiated chap (chap)
>Module: Loaded realm
>realm: format = "suffix"
>realm: delimiter = "@"
>realm: ignore_default = no
>realm: ignore_null = no
>Module: Instantiated realm (suffix)
>Module: Loaded files
>files: usersfile = "/usr/local/etc/raddb/users"
>files: acctusersfile = "/usr/local/etc/raddb/acct_users"
>files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"
>files: compat = "yes"
>Module: Instantiated files (files)
>Module: Loaded Acct-Unique-Session-Id
>acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, 
>Client-IP-Address, NAS-Port"
>Module: Instantiated acct_unique (acct_unique)
>Module: Loaded detail
>detail: detailfile = 
>"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
>detail: detailperm = 384
>detail: dirperm = 493
>detail: locking = no
>Module: Instantiated detail (detail)
>Module: Loaded radutmp
>radutmp: filename = "/usr/local/var/log/radius/radutmp"
>radutmp: username = "%{User-Name}"
>radutmp: case_sensitive = yes
>radutmp: check_with_nas = yes
>radutmp: perm = 384
>radutmp: callerid = yes
>Module: Instantiated radutmp (radutmp)
>Listening on authentication *:1812
>Listening on accounting *:1813
>Listening on proxy *:1814
>Ready to process requests.
>
>
>
>rad_recv: Access-Request packet from host 127.0.0.1:34968, id=195, 
>length=60
>       User-Name = "VALID-USER"
>       User-Password = "VALID-USERS-PASSWORD"
>       NAS-IP-Address = 255.255.255.255
>       NAS-Port = 389
> Processing the authorize section of radiusd.conf
>modcall: entering group authorize for request 0
> modcall[authorize]: module "preprocess" returns ok for request 0
> modcall[authorize]: module "chap" returns noop for request 0
> modcall[authorize]: module "mschap" returns noop for request 0
>   rlm_realm: No '@' in User-Name = "gcrother", looking up realm NULL
>   rlm_realm: No such realm "NULL"
> modcall[authorize]: module "suffix" returns noop for request 0
> rlm_eap: No EAP-Message, not doing EAP
> modcall[authorize]: module "eap" returns noop for request 0
>   users: Matched entry DEFAULT at line 8
> modcall[authorize]: module "files" returns ok for request 0
>rlm_ldap: - authorize
>rlm_ldap: performing user authorization for gcrother
>radius_xlat:  '(uid=VALID-USER)'
>radius_xlat:  'o=XXX,ou=Staff '
>rlm_ldap: ldap_get_conn: Checking Id: 0
>rlm_ldap: ldap_get_conn: Got Id: 0
>rlm_ldap: attempting LDAP reconnection
>rlm_ldap: (re)connect to nds02.XXX.com:389, authentication 0
>rlm_ldap: setting TLS CACert File to
>/opt/sfw/etc/raddb/certs/barney.b64
>rlm_ldap: could not set LDAP_OPT_X_TLS_CACERTFILE option to 
>/opt/sfw/etc/raddb/certs/barney.b64
>rlm_ldap: setting TLS Require Cert to demand
>rlm_ldap: starting TLS
>rlm_ldap: ldap_start_tls_s()
>rlm_ldap: could not start TLS Success
>rlm_ldap: (re)connection attempt failed
>rlm_ldap: search failed
>rlm_ldap: ldap_release_conn: Release Id: 0
> modcall[authorize]: module "ldap" returns fail for request 0
>modcall: group authorize returns fail for request 0
>Finished request 0
>Going to the next request
>--- Walking the entire request list ---
>Waking up in 6 seconds...
>rad_recv: Access-Request packet from host 127.0.0.1:34968, id=195, 
>length=60
>Discarding duplicate request from client localhost:34968 - ID: 195
>--- Walking the entire request list ---
>Waking up in 2 seconds...
>--- Walking the entire request list ---
>Cleaning up request 0 ID 195 with timestamp 42db7619
>Nothing to do.  Sleeping until we see a request.
>rad_recv: Access-Request packet from host 127.0.0.1:34968, id=195, 
>length=60
>       User-Name = "VALID-USER"
>       User-Password = "VALID-USER-PASSWORD"
>       NAS-IP-Address = 255.255.255.255
>       NAS-Port = 389
> Processing the authorize section of radiusd.conf
>modcall: entering group authorize for request 1
> modcall[authorize]: module "preprocess" returns ok for request 1
> modcall[authorize]: module "chap" returns noop for request 1
> modcall[authorize]: module "mschap" returns noop for request 1
>   rlm_realm: No '@' in User-Name = "gcrother", looking up realm NULL
>   rlm_realm: No such realm "NULL"
> modcall[authorize]: module "suffix" returns noop for request 1
> rlm_eap: No EAP-Message, not doing EAP
> modcall[authorize]: module "eap" returns noop for request 1
>   users: Matched entry DEFAULT at line 8
> modcall[authorize]: module "files" returns ok for request 1
>rlm_ldap: - authorize
>rlm_ldap: performing user authorization for gcrother
>radius_xlat:  '(uid=VALID-USER)'
>radius_xlat:  'o=XXX,ou=Staff '
>rlm_ldap: ldap_get_conn: Checking Id: 0
>rlm_ldap: ldap_get_conn: Got Id: 0
>rlm_ldap: attempting LDAP reconnection
>rlm_ldap: (re)connect to nds02.XXX.COM:389, authentication 0
>rlm_ldap: setting TLS CACert File to
>/opt/sfw/etc/raddb/certs/barney.b64
>rlm_ldap: could not set LDAP_OPT_X_TLS_CACERTFILE option to 
>/opt/sfw/etc/raddb/certs/barney.b64
>rlm_ldap: setting TLS Require Cert to demand
>rlm_ldap: starting TLS
>rlm_ldap: ldap_start_tls_s()
>rlm_ldap: could not start TLS Success
>rlm_ldap: (re)connection attempt failed
>rlm_ldap: search failed
>rlm_ldap: ldap_release_conn: Release Id: 0
> modcall[authorize]: module "ldap" returns fail for request 1
>modcall: group authorize returns fail for request 1
>Finished request 1
>Going to the next request
>--- Walking the entire request list ---
>Waking up in 6 seconds...
>rad_recv: Access-Request packet from host 127.0.0.1:34968, id=195, 
>length=60
>Discarding duplicate request from client localhost:34968 - ID: 195
>--- Walking the entire request list ---
>Waking up in 3 seconds...
>^C
>
>
>tia
>
>Garry Crothers
>
>  
>

Just back from Holidays,  I'll try that and let you know how I get on...

many thanks

garry