On May 3, 2010, at 6:14 AM, Daniel Soto wrote: > as I have read, > http://deployingradius.com/documents/protocols/compatibility.html, isn´t > possible authenticate users with peap (mschapv2) in ldap. > > when we use EAP to authenticate in ldap, only EAP-TTLS (PAP) works.
Its possible, but you can't do authentication with LDAP binds. For MSCHAPv2 to work, you need to store the NT-Password hashes/ or plain-text passwords of all users in the LDAP directory. The default attribute is 'NT-Password' and must be filled with a MD4 hash of the 16Bit Unicode encoding of the users password. -Arran > > > > > ----- Mensaje original ----- > De: "Daniel Soto" <[email protected]> > Para: "FreeRadius users mailing list" <[email protected]> > Enviados: Lunes, 3 de Mayo 2010 8:56:34 > Asunto: Re: supplicant winxp+freeradius+ldap > > sorry, didn´t include the log, > > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /etc/raddb/proxy.conf > Config: including file: /etc/raddb/clients.conf > Config: including file: /etc/raddb/snmp.conf > Config: including file: /etc/raddb/eap.conf > main: prefix = "/usr" > main: localstatedir = "/var" > main: logdir = "/var/log/radius" > main: libdir = "/usr/lib64" > main: radacctdir = "/var/log/radius/radacct" > main: hostname_lookups = no > main: snmp = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 1645 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/radius/radius.log" > main: log_auth = yes > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/lib64 > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "md5" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = yes > mschap: require_strong = yes > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: ntlm_auth = "(null)" > Module: Instantiated mschap (mschap) > Module: Loaded Pam > pam: pam_auth = "radiusd" > Module: Instantiated pam (pam) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "/etc/shadow" > unix: group = "(null)" > unix: radwtmp = "/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded LDAP > ldap: server = "10.40.30.80" > ldap: port = 389 > ldap: net_timeout = 1 > ldap: timeout = 15 > ldap: timelimit = 15 > ldap: identity = "" > ldap: tls_mode = no > ldap: start_tls = no > ldap: tls_cacertfile = "(null)" > ldap: tls_cacertdir = "(null)" > ldap: tls_certfile = "(null)" > ldap: tls_keyfile = "(null)" > ldap: tls_randfile = "(null)" > ldap: tls_require_cert = "allow" > ldap: password = "" > ldap: basedn = "ou=prf,dc=uax,dc=es" > ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > ldap: base_filter = "(objectclass=radiusprofile)" > ldap: default_profile = "(null)" > ldap: profile_attribute = "(null)" > ldap: password_header = "{md5}" > ldap: password_attribute = "(null)" > ldap: access_attr = "(null)" > ldap: groupname_attribute = "cn" > ldap: groupmembership_filter = > "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > ldap: groupmembership_attribute = "(null)" > ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" > ldap: ldap_debug = 0 > ldap: ldap_connections_number = 5 > ldap: compare_check_items = no > ldap: access_attr_used_for_allow = yes > ldap: do_xlat = yes > ldap: set_auth_type = yes > rlm_ldap: Registering ldap_groupcmp for Ldap-Group > rlm_ldap: Registering ldap_xlat with xlat_name ldap > rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap > rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ > rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ > rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password > rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type > rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use > rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id > rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id > rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password > rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password > rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT > rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration > rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address > rlm_ldap: LDAP userPassword mapped to RADIUS User-Password > rlm_ldap: LDAP chapPassword mapped to RADIUS CHAP-Password > rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type > rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol > rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address > rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask > rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route > rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing > rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id > rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU > rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression > rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host > rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service > rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port > rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number > rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id > rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network > rlm_ldap: LDAP radiusClass mapped to RADIUS Class > rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout > rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout > rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action > rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service > rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node > rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group > rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS > Framed-AppleTalk-Link > rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS > Framed-AppleTalk-Network > rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS > Framed-AppleTalk-Zone > rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit > rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port > rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message > conns: 0x2ac416410640 > Module: Instantiated ldap (ldap) > Module: Loaded eap > eap: default_eap_type = "tls" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" > tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" > tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" > tls: private_key_password = "whatever" > tls: dh_file = "/etc/raddb/certs/dh" > tls: random_file = "/etc/raddb/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" > tls: cipher_list = "DEFAULT" > tls: check_cert_issuer = "(null)" > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap: Loaded and initialized type tls > ttls: default_eap_type = "gtc" > ttls: copy_request_to_tunnel = no > ttls: use_tunneled_reply = no > rlm_eap: Loaded and initialized type ttls > peap: default_eap_type = "mschapv2" > peap: copy_request_to_tunnel = no > peap: use_tunneled_reply = no > peap: proxy_tunneled_request_as_eap = yes > rlm_eap: Loaded and initialized type peap > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/etc/raddb/huntgroups" > preprocess: hints = "/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > preprocess: with_alvarion_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded attr_filter > attr_filter: attrsfile = "/etc/raddb/attrs" > rlm_attr_filter: Authorize method will be deprecated. > Module: Instantiated attr_filter (attr_filter) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/etc/raddb/users" > files: acctusersfile = "/etc/raddb/acct_users" > files: preproxy_usersfile = "/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1645 > Listening on accounting *:1646 > Ready to process requests. > rad_recv: Access-Request packet from host x.x.x.x:32840, id=183, length=148 > User-Name = "peter" > NAS-IP-Address = x.x.x.x > NAS-Port = 6145 > Called-Station-Id = "00-02-B6-33-58-B2:rad_pru" > Calling-Station-Id = "00-22-74-A6-91-BD" > Framed-MTU = 1250 > NAS-Port-Type = Wireless-802.11 > Connect-Info = "CONNECT 802.11a" > EAP-Message = 0x0201000c016461786f63616d > Message-Authenticator = 0xe74d9538d9499f002e149f972005f7af > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "attr_filter" returns noop for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "peter", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 1 length 12 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > modcall[authorize]: module "files" returns notfound for request 0 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for peter > radius_xlat: '(uid=peter)' > radius_xlat: 'ou=x,dc=x,dc=x' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: attempting LDAP reconnection > rlm_ldap: (re)connect to x.x.x:389, authentication 0 > rlm_ldap: bind as / to x.x.x.x:389 > rlm_ldap: waiting for bind result ... > rlm_ldap: Bind was successful > rlm_ldap: performing search in ou=prf,dc=uax,dc=es, with filter (uid=peter) > rlm_ldap: looking for check items in directory... > rlm_ldap: looking for reply items in directory... > rlm_ldap: user peter authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns ok for request 0 > modcall: leaving group authorize (returns updated) for request 0 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type tls > rlm_eap_tls: Requiring client certificate > rlm_eap_tls: Initiate > rlm_eap_tls: Start returned 1 > modcall[authenticate]: module "eap" returns handled for request 0 > modcall: leaving group authenticate (returns handled) for request 0 > Sending Access-Challenge of id 183 to x.x.x.x port 32840 > EAP-Message = 0x010200060d20 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x2ee2998b9fe8c4f9698291efe30cde7c > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 183 with timestamp 4bde771b > Nothing to do. Sleeping until we see a request. > > > > > > > > > > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > -- > > > > > Daniel Soto > > Dep. Comunicaciones U.A.X > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
