Using mschap authentication without EAP

Giuseppina Venezia giusy.venezia at gmail.com
Thu Jul 20 21:45:13 CEST 2006


Sorry,
"dc=xxxx,dc=it" is the correct not "dc=uniroma1,dc=it" as appear in the
other configuration file.

Giusy Venezia

On 7/20/06, Giuseppina Venezia <giusy.venezia at gmail.com> wrote:
>
> Here is mi slapd.conf
>
> #
> # See slapd.conf(5) for details on configuration options.
> # This file should NOT be world readable.
> #
> include         /usr/local/etc/openldap/schema/core.schema
> include         /usr/local/etc/openldap/schema/cosine.schema
> include         /usr/local/etc/openldap/schema/inetorgperson.schema
> include         /usr/local/etc/openldap/schema/samba.schema
> include         /usr/local/etc/openldap/schema/RADIUS-LDAPv3.schema
> # Define global ACLs to disable default read access.
>
> # Do not enable referrals until AFTER you have a working directory
> # service AND an understanding of referrals.
> #referral       ldap://root.openldap.org
>
> #Aggiungiamo il livello di logging
> loglevel        296
> pidfile         /usr/local/var/run/slapd.pid
> argsfile        /usr/local/var/run/slapd.args
>
> #Direttive SSL
> #TLSCipherSuite HIGH
> #TLSCertificateFile /usr/local/etc/openldap/slapd-cert.pem
> #TLSCertificateKeyFile /usr/local/etc/openldap/slapd- key.pem
> # Load dynamic backend modules:
> # modulepath    /usr/local/libexec/openldap
> # moduleload    back_bdb.la
> # moduleload    back_ldap.la
> # moduleload    back_ldbm.la
> # moduleload    back_passwd.la
> # moduleload    back_shell.la
>
> # Sample security restrictions
> #       Require integrity protection (prevent hijacking)
> #       Require 112-bit (3DES or better) encryption for updates
> #       Require 63-bit encryption for simple bind
> # security ssf=1 update_ssf=112 simple_bind=64
>
> # Sample access control policy:
> #       Root DSE: allow anyone to read it
> #       Subschema (sub)entry DSE: allow anyone to read it
> #       Other DSEs:
> #               Allow self write access
> #               Allow authenticated users read access
> #               Allow anonymous users to authenticate
> #       Directives needed to implement policy:
> # access to dn.base= "" by * read
> # access to dn.base="cn=Subschema" by * read
> # access to *
> #       by self write
> #       by users read
> #       by anonymous auth
> #
> # if no access controls are present, the default policy
> # allows anyone and everyone to read anything but restricts
> # updates to rootdn.  (e.g., "access to * by * read")
> #
> # rootdn can always read and write EVERYTHING!
>
> #######################################################################
> # BDB database definitions
> #######################################################################
>
> database        bdb
> suffix          "dc=xxxx,dc=it"
> rootdn          "cn=Manager,dc=xxxx,dc=it"
> # Cleartext passwords, especially for the rootdn, should
> # be avoid.  See slappasswd(8) and slapd.conf(5) for details.
> # Use of strong authentication encouraged.
> rootpw  {SSHA}gUlr8Lqr7eYgfSti9+Dl76lbkbgK3fqc
> # The database directory MUST exist prior to running slapd AND
> # should only be accessible by the slapd and slap tools.
> # Mode 700 recommended.
> directory       /usr/local/var/openldap-data/xxxx.it
> mode 0600
> # Indices to maintain
> index   objectClass     eq,pres
> index   cn              eq,pres
> index   uid             eq,pres
> index   userPassword    eq,pres
> cachesize       2000
>
> Thanks in advance
> Giusy Venezia
>
>
> On 7/20/06, Thibault Le Meur <Thibault.LeMeur at supelec.fr> wrote:
> >
> > > rad_recv: Access-Request packet from host 127.0.0.1:32801, id=0,
> > length=217
> > >        User-Name = "misterc"
> > >        CHAP-Challenge = 0xa26932d73791f27d1314426f740ab34e
> > >        CHAP-Password = 0x002e07a2cc1f27e7fbd22e7bb3721a3986
> > >        NAS-IP-Address = 0.0.0.0
> > >        Service-Type = Login-User
> > >        Framed-IP-Address = 192.168.182.2
> > >        Calling-Station-Id = "XX-XX-XX-XX-XX-XX"
> > >        Called-Station-Id = "AA-AA-AA-AA-DD-AA"
> > >        NAS-Identifier = "nas01"
> > >        Acct-Session-Id = "44bfd15d00000000"
> > >        NAS-Port-Type = Wireless-802.11
> > >        NAS-Port = 0
> > >        Message-Authenticator = 0xf61479bee3c987c66cca254dcfa39c0a
> > >        WISPr-Logoff-URL = " http://192.168.182.1:3990/logoff"
> > >
> >
> > > Thu Jul 20 20:54:50 2006 : Debug: rlm_ldap: - authorize
> > > Thu Jul 20 20:54:50 2006 : Debug: rlm_ldap: performing user
> > authorization
> > > for misterc
> > > Thu Jul 20 20:54:50 2006 : Debug: radius_xlat:  '(uid=misterc)'
> > > Thu Jul 20 20:54:50 2006 : Debug:
> > radius_xlat:  'ou=utenti,dc=XXXX,dc=it'
> >
> > Ok rlm_ldap is initialized
> >
> >
> > > Thu Jul 20 20:54:50 2006 : Debug: rlm_ldap: bind as / to
> > 192.168.1.221:389
> > > Thu Jul 20 20:54:50 2006 : Debug: rlm_ldap: waiting for bind result
> > ...
> > > Thu Jul 20 20:54:51 2006 : Debug: rlm_ldap: Bind was successful
> >
> > bind to the directory is Ok
> >
> > > Thu Jul 20 20:54:51 2006 : Debug: rlm_ldap: performing search in
> > > ou=utenti,dc=XXXX,dc=it, with filter (uid=misterc)
> > > Thu Jul 20 20:54:51 2006 : Debug: rlm_ldap: object not found or got
> > > ambiguous search result
> > > Thu Jul 20 20:54:51 2006 : Debug: rlm_ldap: search failed
> >
> > Ah...
> > Seems that the used bound to the ldap directory can't find uid=misterc
> > in ou=utenti,dc=XXXX,dc=it
> >
> >
> > > Thu Jul 20 20:54:51 2006 : Debug: auth: No authenticate method
> > (Auth-Type)
> > > configuration found for the request: Rejecting the user
> >
> > So Auth-Type isn't setted to Ldap
> >
> > > Thu Jul 20 20:54:51 2006 : Debug: auth: Failed to validate the user.
> >
> > This is logical
> >
> > >    ldap {
> > >                server="192.168.1.221"
> > >                port="389"
> > >                basedn="ou=utenti,dc=uniroma1,dc=it"
> > >                filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
> > >                start_tls = no
> > >           access_attr = "uid"
> > >                dictionary_mapping = ${raddbdir}/ldap.attrmap
> > >                authtype = ldap
> > >                ldap_connections_number = 5
> > >                password_header = "{SHA}"
> > >                password_attribute = userPassword
> > >                 }
> > >           }
> >
> > Well isn't it a pb of rights ? Is the anonymous user able to search the
> > openldap directory for users entries ?
> >
> > What is the result of a simple "ldapsearch" with the same ldap filter.
> >
> > > If you need any other information please ask us; sorry if we are
> > boring you
> > > but we are trying and trying without any significant result.
> > > Thanks.
> >
> > Have you got ACLs in your openldap directory configuration files ?
> >
> > Regards,
> > Thibault
> >
> >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20060720/dcae5aa4/attachment.html>


More information about the Freeradius-Users mailing list