connect FreeIPA to Freeradius
luckydog xf
luckydogxf at gmail.com
Thu Dec 13 14:46:36 CET 2018
And I don't think WI-FI auth against krb5 is a good idea, better use EAP,
like EAP-TLS, EAP-PEAP-MSchapv2, or EAP-TTLS.
Good luck.
On Thu, Dec 13, 2018 at 9:44 PM luckydog xf <luckydogxf at gmail.com> wrote:
> (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute
>
> Seems you didn't correct setup module/ldap, make sure the identity has the
> permission to read user-pasword. attribute.
> I'm familiar with freeipa, just setup identify = "cn=Manager" and
> password is your FreeIPA's password, you'll see user-password of each user.
> Or use Ldapadmin tool to connect FreeIPA, don't use anonymous bind, to
> see you can see user-password or not.
> And you can set access control of 389 DS to allow other use to access
> user-password attribute.
>
> See https://www.openldap.org/doc/admin24/access-control.html
>
> Once you get user-password, and try to use krb5. I know nothing about krb5.
>
> On Thu, Dec 13, 2018 at 8:58 PM mustafa taha <mustafa.taha.mu95 at gmail.com>
> wrote:
>
>> Hi
>>
>> I am new user of freeradius . I want to connect FreeIPA server to radius
>> server to make WiFi authentication .
>> I have tried to connect them by Kerberos I use what mention in this link
>> :
>>
>> http://freeradius.1045715.n5.nabble.com/Freeradius-3-0-4-authentication-to-FreeIPA-4-1-2-td5731658.html
>>
>> but if I use radtest this logs will show :
>>
>> Sent from Mail for Windows 10
>> (0) Received Access-Request Id 193 from 192.168.205.7:44657 to
>> 192.168.205.7:1812 length 75
>> (0) User-Name = "admin"
>> (0) User-Password = "Password@"
>> (0) NAS-IP-Address = 192.168.205.7
>> (0) NAS-Port = 1812
>> (0) Message-Authenticator = 0xd557b8133468b6cdb1449306dac7fbf5
>> (0) # Executing section authorize from file
>> /etc/raddb/sites-enabled/default
>> (0) authorize {
>> (0) policy filter_username {
>> (0) if (&User-Name) {
>> (0) if (&User-Name) -> TRUE
>> (0) if (&User-Name) {
>> (0) if (&User-Name =~ / /) {
>> (0) if (&User-Name =~ / /) -> FALSE
>> (0) if (&User-Name =~ /@[^@]*@/ ) {
>> (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
>> (0) if (&User-Name =~ /\.\./ ) {
>> (0) if (&User-Name =~ /\.\./ ) -> FALSE
>> (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
>> (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
>> -> FALSE
>> (0) if (&User-Name =~ /\.$/) {
>> (0) if (&User-Name =~ /\.$/) -> FALSE
>> (0) if (&User-Name =~ /@\./) {
>> (0) if (&User-Name =~ /@\./) -> FALSE
>> (0) } # if (&User-Name) = notfound
>> (0) } # policy filter_username = notfound
>> (0) [preprocess] = ok
>> (0) [chap] = noop
>> (0) [mschap] = noop
>> (0) [digest] = noop
>> (0) suffix: Checking for suffix after "@"
>> (0) suffix: No '@' in User-Name = "admin", looking up realm NULL
>> (0) suffix: No such realm "NULL"
>> (0) [suffix] = noop
>> (0) eap: No EAP-Message, not doing EAP
>> (0) [eap] = noop
>> (0) [files] = noop
>> rlm_ldap (ldap): Reserved connection (0)
>> (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})
>> (0) ldap: --> (uid=admin)
>> (0) ldap: Performing search in "cn=users,cn=accounts,dc=exalt,dc=ps" with
>> filter "(uid=admin)", scope "sub"
>> (0) ldap: Waiting for search result...
>> (0) ldap: User object found at DN
>> "uid=admin,cn=users,cn=accounts,dc=exalt,dc=ps"
>> (0) ldap: Processing user attributes
>> (0) ldap: WARNING: No "known good" password added. Ensure the admin user
>> has permission to read the password attribute
>> (0) ldap: WARNING: PAP authentication will *NOT* work with Active
>> Directory (if that is what you were trying to configure)
>> rlm_ldap (ldap): Released connection (0)
>> Need 5 more connections to reach 10 spares
>> rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots
>> used
>> rlm_ldap (ldap): Connecting to ldap://192.168.205.83:389
>> TLSMC: MozNSS compatibility interception begins.
>> tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration
>> is present.
>> tlsmc_intercept_initialization: INFO: successfully intercepted TLS
>> initialization. Continuing with OpenSSL only.
>> TLSMC: MozNSS compatibility interception ends.
>> rlm_ldap (ldap): Waiting for bind result...
>> rlm_ldap (ldap): Bind successful
>> (0) [ldap] = ok
>> (0) if ((ok || updated)) {
>> (0) if ((ok || updated)) -> TRUE
>> (0) if ((ok || updated)) {
>> (0) update {
>> (0) control:Auth-Type := Kerberos
>> (0) } # update = noop
>> (0) } # if ((ok || updated)) = noop
>> (0) [expiration] = noop
>> (0) [logintime] = noop
>> (0) pap: WARNING: No "known good" password found for the user. Not
>> setting Auth-Type
>> (0) pap: WARNING: Authentication will fail unless a "known good" password
>> is available
>> (0) [pap] = noop
>> (0) } # authorize = ok
>> (0) Found Auth-Type = Kerberos
>> (0) # Executing group from file /etc/raddb/sites-enabled/default
>> (0) Auth-Type Kerberos {
>> rlm_krb5 (krb5): Reserved connection (0)
>> (0) krb5: Using client principal "admin at EXALT.PS"
>> (0) krb5: Retrieving and decrypting TGT
>> (0) krb5: Attempting to authenticate against service principal
>> (0) krb5: ERROR: Error verifying credentials (13): Permission denied
>> rlm_krb5 (krb5): Released connection (0)
>> Need 5 more connections to reach 10 spares
>> rlm_krb5 (krb5): Opening additional connection (5), 1 of 27 pending slots
>> used
>> (0) [krb5] = fail
>> (0) } # Auth-Type Kerberos = fail
>> (0) Failed to authenticate the user
>> (0) Using Post-Auth-Type Reject
>> (0) # Executing group from file /etc/raddb/sites-enabled/default
>> (0) Post-Auth-Type REJECT {
>> (0) attr_filter.access_reject: EXPAND %{User-Name}
>> (0) attr_filter.access_reject: --> admin
>> (0) attr_filter.access_reject: Matched entry DEFAULT at line 11
>> (0) [attr_filter.access_reject] = updated
>> (0) [eap] = noop
>> (0) policy remove_reply_message_if_eap {
>> (0) if (&reply:EAP-Message && &reply:Reply-Message) {
>> (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
>> (0) else {
>> (0) [noop] = noop
>> (0) } # else = noop
>> (0) } # policy remove_reply_message_if_eap = noop
>> (0) } # Post-Auth-Type REJECT = updated
>> (0) Delaying response for 1.000000 seconds
>> Waking up in 0.2 seconds.
>> Waking up in 0.7 seconds.
>> (0) Sending delayed response
>> (0) Sent Access-Reject Id 193 from 192.168.205.7:1812 to
>> 192.168.205.7:44657 length 20
>> Waking up in 3.9 seconds.
>>
>>
>> I try to solve “ krb5: ERROR: Error verifying credentials (13):
>> Permission denied “ but I cloudn’t find any useful information about that .
>>
>> Can anybody help ?
>>
>>
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
>
>
More information about the Freeradius-Users
mailing list