LDAP and freeRADIUS problem

The Cesspool Forum Index

Post new topic Reply to topic The Cesspool Forum Index -> Programming & Development
View posts since last visit

View previous topic :: View next topic  
Author Message
charlie
Post Posted: Thu Dec 22, 2005 12:43 pm   Post subject: LDAP and freeRADIUS problem
charlie
NOT WORK SAFE



Joined: 22 Dec 2004
Posts: 2400
Location: vagrant

Post Posted: Thu Dec 22, 2005 12:43 pm   Post subject: LDAP and freeRADIUS problem
Reply with quote
I'm not sure how many of you are familiar with LDAP and/or freeRadius, but I'll post anyway.

I can get my PPP box to make the RADIUS request, but I get an error.

Freeradius is able to bind with LDAP ok, and the user TestEntry is authorised to use remote access, but it fails after that.
The guts of the error is (I think) "rlm_ldap: Attribute "User-Password" is required for authentication"
Unfortunately I cant see what I'm missing here, and I have tried a shitload of stuff.

Any help at all would be appreciated.

here is the output of the freeradius command (well, as much as I can see)

debian#freeradius -X -A
Code:

mschap: authtype = "MS-CHAP"
 mschap: ntlm_auth = "(null)"
Module: Instantiated mschap (mschap)
Module: Loaded System
 unix: cache = no
 unix: passwd = "(null)"
 unix: shadow = "/etc/shadow"
 unix: group = "(null)"
 unix: radwtmp = "/var/log/freeradius/radwtmp"
 unix: usegroup = no
 unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded LDAP
 ldap: server = "localhost"
 ldap: port = 389
 ldap: net_timeout = 1
 ldap: timeout = 4
 ldap: timelimit = 3
 ldap: identity = "cn=admin,dc=maurinet"
 ldap: tls_mode = no
 ldap: start_tls = no
 ldap: tls_cacertfile = "(null)"
 ldap: tls_cacertdir = "(null)"
 ldap: tls_certfile = "(null)"
 ldap: tls_keyfile = "(null)"
 ldap: tls_randfile = "(null)"
 ldap: tls_require_cert = "allow"
 ldap: password = "secret"
 ldap: basedn = "dc=maurinet"
 ldap: filter = "(description=open)"
 ldap: base_filter = "(objectclass=radiusprofile)"
 ldap: default_profile = "(null)"
 ldap: profile_attribute = "(null)"
 ldap: password_header = "(null)"
 ldap: password_attribute = "(null)"
 ldap: access_attr = "(null)"
 ldap: groupname_attribute = "cn"
 ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
 ldap: groupmembership_attribute = "(null)"
 ldap: dictionary_mapping = "/etc/freeradius/ldap.attrmap"
 ldap: ldap_debug = 0
 ldap: ldap_connections_number = 5
 ldap: compare_check_items = no
 ldap: access_attr_used_for_allow = yes
 ldap: do_xlat = yes
 ldap: edir_account_policy_check = yes
rlm_ldap: Registering ldap_groupcmp for Ldap-Group
rlm_ldap: Registering ldap_xlat with xlat_name ldap
rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap
rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP userPassword mapped to RADIUS Auth-Type
rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use
rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id
rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id
rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT
rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration
rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type
rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol
rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address
rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask
rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route
rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing
rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id
rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU
rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression
rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host
rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service
rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port
rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number
rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id
rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network
rlm_ldap: LDAP radiusClass mapped to RADIUS Class
rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout
rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout
rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action
rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service
rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node
rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group
rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link
rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network
rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone
rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit
rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port
conns: 0x8116a88
Module: Instantiated ldap (ldap)
Module: Loaded eap
 eap: default_eap_type = "md5"
 eap: timer_expire = 60
 eap: ignore_unknown_eap_types = no
 eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
 gtc: challenge = "Password: "
 gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
 mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
 preprocess: huntgroups = "/etc/freeradius/huntgroups"
 preprocess: hints = "/etc/freeradius/hints"
 preprocess: with_ascend_hack = no
 preprocess: ascend_channels_per_line = 23
 preprocess: with_ntdomain_hack = no
 preprocess: with_specialix_jetstream_hack = no
 preprocess: with_cisco_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded attr_filter
 attr_filter: attrsfile = "/etc/freeradius/attrs"
 rlm_attr_filter: Authorize method will be deprecated.
Module: Instantiated attr_filter (attr_filter)
Module: Loaded realm
 realm: format = "suffix"
 realm: delimiter = "@"
 realm: ignore_default = no
 realm: ignore_null = no
Module: Instantiated realm (suffix)
Module: Loaded files
 files: usersfile = "/etc/freeradius/users"
 files: acctusersfile = "/etc/freeradius/acct_users"
 files: preproxy_usersfile = "/etc/freeradius/preproxy_users"
 files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
 acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
 detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
 detail: detailperm = 384
 detail: dirperm = 493
 detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
 radutmp: filename = "/var/log/freeradius/radutmp"
 radutmp: username = "%{User-Name}"
 radutmp: case_sensitive = yes
 radutmp: check_with_nas = yes
 radutmp: perm = 384
 radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on authentication *:1812
Listening on accounting *:1813
Listening on proxy *:1814
Ready to process requests.
 



Then when I try and authenticate with PPP, it has this:
Code:

rad_recv: Access-Request packet from host 10.10.10.1:32768, id=28, length=188
        Service-Type = Framed-User
        Framed-Protocol = PPP
        NAS-Port = 34
        NAS-Port-Type = Ethernet
        User-Name = "TestEntry"
        Calling-Station-Id = "00:03:0D:20:AC:21"
        Called-Station-Id = "PPPoE_server"
        NAS-Port-Id = "Local"
        MS-CHAP-Challenge = 0x88f5ebbfaf555bb4a8650368aa37169d
        MS-CHAP2-Response = 0x0100821e78330f8ef611fe3111f6dead4cb30000000000000000ce80187e265518da1b85fead7bbd58acb3592d4c432d37f0
        NAS-Identifier = "MauriNet"
        NAS-IP-Address = 10.10.10.1
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
  modcall[authorize]: module "preprocess" returns ok for request 0
  modcall[authorize]: module "attr_filter" returns noop for request 0
  modcall[authorize]: module "chap" returns noop for request 0
  rlm_mschap: Found MS-CHAP attributes.  Setting 'Auth-Type  = MS-CHAP'
  modcall[authorize]: module "mschap" returns ok for request 0
    rlm_realm: No '@' in User-Name = "TestEntry", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 0
  rlm_eap: No EAP-Message, not doing EAP
  modcall[authorize]: module "eap" returns noop for request 0
    users: Matched entry DEFAULT at line 74
    users: Matched entry DEFAULT at line 153
    users: Matched entry DEFAULT at line 172
    users: Matched entry DEFAULT at line 184
  modcall[authorize]: module "files" returns ok for request 0
rlm_ldap: - authorize
rlm_ldap: performing user authorization for TestEntry
radius_xlat:  '(description=open)'
radius_xlat:  'dc=maurinet'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: attempting LDAP reconnection
rlm_ldap: (re)connect to localhost:389, authentication 0
rlm_ldap: bind as cn=admin,dc=maurinet/secret to localhost:389
rlm_ldap: waiting for bind result ...
rlm_ldap: Bind was successful
rlm_ldap: performing search in dc=maurinet, with filter (description=open)
rlm_ldap: looking for check items in directory...
rlm_ldap: Adding userPassword as Auth-Type, value OOHGDCVQniCS. & op=21
rlm_ldap: looking for reply items in directory...
rlm_ldap: user TestEntry authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
  modcall[authorize]: module "ldap" returns ok for request 0
modcall: group authorize returns ok for request 0
  rad_check_password:  Found Auth-Type LDAP
auth: type "LDAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group Auth-Type for request 0
rlm_ldap: - authenticate
rlm_ldap: Attribute "User-Password" is required for authentication.
  modcall[authenticate]: module "ldap" returns invalid for request 0
modcall: group Auth-Type returns invalid for request 0
auth: Failed to validate the user.
Delaying request 0 for 1 seconds
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
rad_recv: Access-Request packet from host 10.10.10.1:32768, id=28, length=188
Sending Access-Reject of id 28 to 10.10.10.1:32768
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 5 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 28 with timestamp 43a9fe2a
Nothing to do.  Sleeping until we see a request.
 



my radiusd.conf file ldap section has this:
Code:

   ldap {
      server = "localhost"
      identity = "cn=admin,dc=maurinet"
      password = "secret"
      basedn = "dc=maurinet"
      filter = "(description=open)"
      #base_filter = "(objectclass=mauriUser)"

      # set this to 'yes' to use TLS encrypted connections
      # to the LDAP database by using the StartTLS extended
      # operation.
      # The StartTLS operation is supposed to be used with normal
      # ldap connections instead of using ldaps (port 689) connections
      start_tls = no

      # tls_cacertfile   = /path/to/cacert.pem
      # tls_cacertdir      = /path/to/ca/dir/
      # tls_certfile      = /path/to/radius.crt
      # tls_keyfile      = /path/to/radius.key
      # tls_randfile      = /path/to/rnd
      # tls_require_cert   = "demand"

      # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA"
      # profile_attribute = "radiusProfileDn"
      #access_attr = "dialupAccess"

      # Mapping of RADIUS dictionary attributes to LDAP
      # directory attributes.
      dictionary_mapping = ${raddbdir}/ldap.attrmap

      ldap_connections_number = 5

      #
      # NOTICE: The password_header directive is NOT case insensitive
      #
      # password_header = "{clear}"
      #
      # Set:
      #   password_attribute = smsomethingPassword
      #
      # to get the user's password from a Novell eDirectory
      # backend. This will work *only if* freeRADIUS is
      # configured to build with --with-edir option.
      #
      #
      #  The server can usually figure this out on its own, and pull
      #  the correct User-Password or NT-Password from the database.
      #
      #  Note that NT-Passwords MUST be stored as a 32-digit hex
      #  string, and MUST start off with "0x", such as:
      #
      #   0x000102030405060708090a0b0c0d0e0f
      #
      #  Without the leading "0x", NT-Passwords will not work.
      #  This goes for NT-Passwords stored in SQL, too.
      #
      #password_attribute = "userPassword"
      #
      # Un-comment the following to disable Novell eDirectory account
      # policy check and intruder detection. This will work *only if*
      # FreeRADIUS is configured to build with --with-edir option.
      #
      # edir_account_policy_check=no
      #
      groupname_attribute = cn
      # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
      # groupmembership_attribute = radiusGroupName
      timeout = 4
      timelimit = 3
      net_timeout = 1
      # compare_check_items = yes
      # do_xlat = yes
      # access_attr_used_for_allow = yes
   }

_________________
Code pink
Back to top
View user's profile Send private message Send e-mail Visit poster's website MSN Messenger ICQ Number
Display posts from previous:

Post new topic Reply to topic The Cesspool Forum Index -> Programming & Development

Page 1 of 1
All times using Australia/Hobart timezone



Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Powered by phpBB © 2001, 2002 phpBB Group
Modified by: John 'KRiSPY' Kristensen