TransWikia.com

Freeradius LDAP through AP

Server Fault Asked by smoK on January 9, 2021

I need help with a connection to RADIUS throught Access Point LevelOne EAP-110.

I configured RADIUS + LDAP, tried with radiusd -X I get this message:

radtest fsobarzo ********** localhost 100 testing123
Sending Access-Request of id 243 to 127.0.0.1 port 1812
    User-Name = "fsobarzo"
    User-Password = "***********"
    NAS-IP-Address = 10.10.0.119
    NAS-Port = 100
    Message-Authenticator = 0x00000000000000000000000000000000
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=243, length=20

Then in debugg of freeradius get this message:

rad_recv: Access-Request packet from host 127.0.0.1 port 42229, id=243, length=78
    User-Name = "fsobarzo"
    User-Password = "**********"
    NAS-IP-Address = 10.10.0.119
    NAS-Port = 100
    Message-Authenticator = 0xb5333cce6b6870d3e08794835b1f2719
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "fsobarzo", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
[ldap] performing user authorization for fsobarzo
[ldap]  expand: %{Stripped-User-Name} -> 
[ldap]  ... expanding second conditional
[ldap]  expand: %{User-Name} -> fsobarzo
[ldap]  expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=fsobarzo)
[ldap]  expand: ou=inf,o=utfsm,c=cl -> ou=inf,o=utfsm,c=cl
  [ldap] ldap_get_conn: Checking Id: 0
  [ldap] ldap_get_conn: Got Id: 0
  [ldap] attempting LDAP reconnection
  [ldap] (re)connect to 10.10.0.122:389, authentication 0
  [ldap] bind as cn=Directory Manager/holahola to 10.10.0.122:389
  [ldap] waiting for bind result ...
  [ldap] Bind was successful
  [ldap] performing search in ou=inf,o=utfsm,c=cl, with filter (uid=fsobarzo)
[ldap] looking for check items in directory...
  [ldap] userPassword -> Password-With-Header == "{SSHA}4IO5oaEY64B+mjoaWbTzZFl0Z0Gnj08cAN2RQQ=="
[ldap] looking for reply items in directory...
[ldap] Setting Auth-Type = LDAP
[ldap] user fsobarzo authorized to use remote access
  [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
Found Auth-Type = LDAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group LDAP {...}
[ldap] login attempt by "fsobarzo" with password "epilef17702"
[ldap] user DN: uid=fsobarzo,ou=cuentas,ou=valparaiso,ou=alumnos,ou=inf,o=utfsm,c=cl
  [ldap] (re)connect to 10.10.0.122:389, authentication 1
  [ldap] bind as uid=fsobarzo,ou=cuentas,ou=valparaiso,ou=alumnos,ou=inf,o=utfsm,c=cl/epilef17702 to 10.10.0.122:389
  [ldap] waiting for bind result ...
  [ldap] Bind was successful
[ldap] user fsobarzo authenticated succesfully
++[ldap] returns ok
# Executing section post-auth from file /etc/raddb/sites-enabled/default
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 243 to 127.0.0.1 port 42229
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 243 with timestamp +48
Ready to process requests.

This response is from RADIUS + LDAP without AP.

Then when I try connect throught AP not work. I get this:

rad_recv: Access-Request packet from host 10.10.10.87 port 3072, id=185, length=136
    User-Name = "fsobarzo"
    NAS-IP-Address = 10.10.10.87
    NAS-Identifier = "RalinkAP0"
    NAS-Port = 0
    Called-Station-Id = "00-1F-D4-02-D9-C0"
    Calling-Station-Id = "B4-52-7D-D4-76-8D"
    Framed-MTU = 1400
    NAS-Port-Type = Wireless-802.11
    EAP-Message = 0x0201000d0166736f6261727a6f
    Message-Authenticator = 0x49fa779829c40803d885138cf112971d
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "fsobarzo", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 1 length 13
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[ldap] performing user authorization for fsobarzo
[ldap]  expand: %{Stripped-User-Name} -> 
[ldap]  ... expanding second conditional
[ldap]  expand: %{User-Name} -> fsobarzo
[ldap]  expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=fsobarzo)
[ldap]  expand: ou=inf,o=utfsm,c=cl -> ou=inf,o=utfsm,c=cl
  [ldap] ldap_get_conn: Checking Id: 0
  [ldap] ldap_get_conn: Got Id: 0
  [ldap] performing search in ou=inf,o=utfsm,c=cl, with filter (uid=fsobarzo)
[ldap] looking for check items in directory...
  [ldap] userPassword -> Password-With-Header == "{SSHA}4IO5oaEY64B+mjoaWbTzZFl0Z0Gnj08cAN2RQQ=="
[ldap] looking for reply items in directory...
[ldap] user fsobarzo authorized to use remote access
  [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
[eap] EAP packet type response id 1 length 13
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
Found Auth-Type = EAP
Found Auth-Type = EAP
Warning:  Found 2 auth-types on request for user 'fsobarzo'
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 185 to 10.10.10.87 port 3072
    EAP-Message = 0x010200061920
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x0133a0760131b9340c4aebd2ec9d5479
Finished request 12.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.10.10.87 port 3072, id=186, length=349
    User-Name = "fsobarzo"
    NAS-IP-Address = 10.10.10.87
    NAS-Identifier = "RalinkAP0"
    NAS-Port = 0
    Called-Station-Id = "00-1F-D4-02-D9-C0"
    Calling-Station-Id = "B4-52-7D-D4-76-8D"
    Framed-MTU = 1400
    NAS-Port-Type = Wireless-802.11
    EAP-Message = 0x020200d01980000000c616030100c1010000bd0301546e5195b1497083040fe964e706bcfefd2360bfe3361e123dab868f9481b907000054c014c00ac022c02100390038c00fc0050035c012c008c01cc01b00160013c00dc003000ac013c009c01fc01e00330032c00ec004002fc011c007c00cc002000500040015001200090014001100080006000300ff01000040000b000403000102000a00340032000e000d0019000b000c00180009000a00160017000800060007001400150004000500120013000100020003000f00100011
    State = 0x0133a0760131b9340c4aebd2ec9d5479
    Message-Authenticator = 0xb7b3606d6c040314e7f506c32b240f45
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "fsobarzo", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 2 length 208
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
  TLS Length 198
[peap] Length Included
[peap] eaptls_verify returned 11 
[peap]     (other): before/accept initialization
[peap]     TLS_accept: before/accept initialization
[peap] <<< TLS 1.0 Handshake [length 00c1], ClientHello  
[peap]     TLS_accept: SSLv3 read client hello A
[peap] >>> TLS 1.0 Handshake [length 0039], ServerHello  
[peap]     TLS_accept: SSLv3 write server hello A
[peap] >>> TLS 1.0 Handshake [length 085e], Certificate  
[peap]     TLS_accept: SSLv3 write certificate A
[peap] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange  
[peap]     TLS_accept: SSLv3 write key exchange A
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone  
[peap]     TLS_accept: SSLv3 write server done A
[peap]     TLS_accept: SSLv3 flush data
[peap]     TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase 
In SSL Accept mode  
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 186 to 10.10.10.87 port 3072
    EAP-Message = 0x0103040019c0000009fa1603010039020000350301546e51cde6b2807eeb6eb046ec77af768311847ee4c6fc76a48e74de3cb37e6800c01400000dff01000100000b000403000102160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966
    EAP-Message = 0x696361746520417574686f72697479301e170d3134313132303034303834385a170d3135303131393034303834385a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100abed61a5c45a3b24107a586b28a6327b18df32c2c890bd30f936a9d618cb4cbe4b63c4e78bac4ae97109e21e3338b5
    EAP-Message = 0x29c58b480f71def645952eff1dfa992c92f81295141c8968aadeb7392473854472dc1052fc660c1fe9bb1ac77ab78da2ff9fd9c5d28b916080cd41005291a89c8a4ed41ffc899524e78a9a8de37120c0fa2af9a24863a1ceb9bbf25f57fb83f2f27a1ae0805c1ad1ae1306c6f685d81ea376c6ab06e9c6cf7013fd14d24440ccbe0c1ee9330744e70060b6adb56ea93221b1d2438e53951e58f14e4d53136d8b4df783d0ccf411798f4eed5523492a6f0dc087cec9fc60ea5f8b88406e3fad97da3b2f52584d213878282da0f6b54c80690203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505
    EAP-Message = 0x00038201010043f8255083f0bfd416918c26c579198bce73f19b1ea612a9da3d27ca5ad9ccb5d8e27d3ebf2320916c07c1b4aab575060d6c31af741d783f3a1ace48dca975c671e8a007a104f758b6ef1fe8d01d5dc71092aaed7a96f94becf8ad10e60f5a8732a135d28731908162cd767a38581f390ec9fcc677be5471bcc2dc46c1d9f49d6a5c5da2d5f8af14ed11db74294e3b17ad3668a9690ccca6d5ad0273c144f8de3ca9497cc238c9bcf5248b03f982d45881dc00c5b810b4f10baa496ef727ae9fb00a089143e74781f15e5d55f3c378380104681a873446517b2d4489c326e1bded47df82b8695106c4762c98772e39b84da6a6f8dd8631
    EAP-Message = 0xb05c3cda20e60ac5330004ab
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x0133a0760030b9340c4aebd2ec9d5479
Finished request 13.
Going to the next request
Waking up in 4.9 seconds.
.......
Many log here. :'(
.......
rad_recv: Access-Request packet from host 10.10.10.87 port 3072, id=193, length=221
    User-Name = "fsobarzo"
    NAS-IP-Address = 10.10.10.87
    NAS-Identifier = "RalinkAP0"
    NAS-Port = 0
    Called-Station-Id = "00-1F-D4-02-D9-C0"
    Calling-Station-Id = "B4-52-7D-D4-76-8D"
    Framed-MTU = 1400
    NAS-Port-Type = Wireless-802.11
    EAP-Message = 0x0209005019001703010020087ae0c7152592a866de5c13fb7b4e30349b34c623dc847a8598f0a420057ba717030100204bea371d95badb4d4ff30dc41d27992109533be65daa117509fbe04133334ed6
    State = 0x0133a076063ab9340c4aebd2ec9d5479
    Message-Authenticator = 0x4698457f36ab884b48d6c3900edbd6c1
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "fsobarzo", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 9 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state send tlv failure
[peap] Received EAP-TLV response.
[peap]  The users session was previously rejected: returning reject (again.)
[peap]  *** This means you need to read the PREVIOUS messages in the debug output
[peap]  *** to find out the reason why the user was rejected.
[peap]  *** Look for "reject" or "fail".  Those earlier messages will tell you.
[peap]  *** what went wrong, and how to fix the problem.
[eap] Handler failed in EAP/peap
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
Using Post-Auth-Type Reject
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject]     expand: %{User-Name} -> fsobarzo
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 20 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
rad_recv: Access-Request packet from host 10.10.10.87 port 3072, id=193, length=221
Waiting to send Access-Reject to client AP-RADIUS port 3072 - ID: 193
Waking up in 0.1 seconds.
Sending delayed reject for request 20
Sending Access-Reject of id 193 to 10.10.10.87 port 3072
    EAP-Message = 0x04090004
    Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.8 seconds.
Cleaning up request 12 ID 185 with timestamp +277
Cleaning up request 13 ID 186 with timestamp +277
Cleaning up request 14 ID 187 with timestamp +277
Cleaning up request 15 ID 188 with timestamp +277
Cleaning up request 16 ID 189 with timestamp +277
Cleaning up request 17 ID 190 with timestamp +277
Cleaning up request 18 ID 191 with timestamp +277
Cleaning up request 19 ID 192 with timestamp +277
Waking up in 1.0 seconds.
Cleaning up request 20 ID 193 with timestamp +277
Ready to process requests.

Always get this message.. LDAP always respond OK, but i dont know.

I dont understund why work without AP then AP not work. 🙁

access pointfreeradius2ldap

One Answer

The protocol you use when sending test packets to the server is RADIUS-PAP.

This protocol will work if the password in your ldap directory is hashed.

The protocol you are using when performing authentication using the access point is likely EAP-PEAP over RADIUS.

PEAP will not work if the RADIUS server doesn't have access to the NT-Password or Cleartext forms of the user's password.

If you just want to get something working locally, you can install the SecureW2 supplicant, and configure it to use EAP-TTLS-PAP, which like RADIUS-PAP, will work with a hashed password.

Answered by Arran Cudbard-Bell on January 9, 2021

Add your own answers!

Ask a Question

Get help from others!

Recent Questions

Recent Answers

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP