Discussion:
[Freeipa-users] FreeIPA & FreeRadius LDAP auth issue
Boris Cheperis
2016-04-12 12:02:40 UTC
Permalink
Hi,

I’ve started using FreeIPA and got fascinated with it’s capabilities, but recently I tried to configure FreeRadius integration
for WiFi authentication and ran into some issues.

I’ve configured ldap integration and when I run a test everything seems fine:

----
radtest dmitry.fedorov fedor 127.0.0.1 100 testing123
Sending Access-Request Id 93 from 0.0.0.0:54153 to 127.0.0.1:1812
User-Name = 'dmitry.fedorov'
User-Password = 'fedor'
NAS-IP-Address = 10.0.0.12
NAS-Port = 100
Message-Authenticator = 0x00
Received Access-Accept Id 93 from 127.0.0.1:1812 to 127.0.0.1:54153 length 20
-----

But when I try to do a real-world test and run authentication on a wifi device I get this:

——
(10) ERROR: eap : Failed continuing EAP PEAP (25) session. EAP sub-module failed
(10) eap : Failed in EAP select
(10) [eap] = invalid
(10) } # authenticate = invalid
(10) Failed to authenticate the user
(10) Using Post-Auth-Type Reject
(10) # Executing group from file /etc/raddb/sites-enabled/default
(10) Post-Auth-Type REJECT {
(10) attr_filter.access_reject : EXPAND %{User-Name}
(10) attr_filter.access_reject : --> dmitry.fedorov
(10) attr_filter.access_reject : Matched entry DEFAULT at line 11
(10) [attr_filter.access_reject] = updated
(10) eap : Reply already contained an EAP-Message, not inserting EAP-Failure
(10) [eap] = noop
(10) remove_reply_message_if_eap remove_reply_message_if_eap {
(10) if (&reply:EAP-Message && &reply:Reply-Message)
(10) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(10) else else {
(10) [noop] = noop
(10) } # else else = noop
(10) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop
(10) } # Post-Auth-Type REJECT = updated
(10) Delaying response for 1 seconds
Waking up in 0.1 seconds.
Waking up in 0.6 seconds.
(10) Sending delayed response
(10) Sending Access-Reject packet to host 10.0.0.139 port 62980, id=23, length=0
(10) EAP-Message = 0x040a0004
(10) Message-Authenticator = 0x00000000000000000000000000000000
Sending Access-Reject Id 23 from 10.0.0.12:1812 to 10.0.0.139:62980
EAP-Message = 0x040a0004
Message-Authenticator = 0x0000000000000000000000000000000
———

before this I see a couple of other errors in the debug output
—
WARNING: mschap : No Cleartext-Password configured. Cannot create LM-Password
(9) WARNING: mschap : No Cleartext-Password configured. Cannot create NT-Password
(9) mschap : Creating challenge hash with username: dmitry.fedorov
(9) mschap : Client is using MS-CHAPv2
(9) ERROR: mschap : FAILED: No NT/LM-Password. Cannot perform authentication
(9) ERROR: mschap : MS-CHAP2-Response is incorrect
(9) [mschap] = reject
(9) } # Auth-Type MS-CHAP = reject
—

and

---
ldap : Processing user attributes
(2) WARNING: ldap : No "known good" password added. Ensure the admin user has permission to read the password attribute
(2) WARNING: ldap : PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure)
rlm_ldap (ldap): Released connection (4)
(2) [ldap] = ok
(2) if ((ok || updated) && User-Password)
(2) if ((ok || updated) && User-Password) -> FALSE
(2) [expiration] = noop
(2) [logintime] = noop
(2) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type
(2) WARNING: pap : Authentication will fail unless a "known good" password is available
(2) [pap] = noop
—

At first I thought the problem was in the "known good” password, but if it was, most likely the ‘radtest' string would not work.
And if I change the base_dn to a wrong one, the test fails at once. From my point of view it proves that free radius is able to get to ldap, but there is some over error present.
Maybe I’m wrong.

Please help to understand what is wrong with my setup.


Regards,
Boris
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to
David Kreitschmann
2016-04-12 16:33:01 UTC
Permalink
Hi,
you are trying to do different things in both cases. radtest does plain text authentication to ldap while your real world example connects as another user and tries to compare the MSCHAPv2 hash.

For MSCHAPv2 to work you need:
-mschapv2 hashes in ldap (samba schema or activate AD trust feature)
-your users will probably need to change their password to create the hash
-read access to those fields for freeradius (create ACI)

You can use eapol_test from wpa_supplicant to check if it works, use this config:

network={
ssid="example"
key_mgmt=WPA-EAP
eap=PEAP
identity="***@freeipa.local"
anonymous_identity="anonymous"
password="asdfasdf"
phase2="autheap=MSCHAPV2"
}


Regards,
David
Hi,
I’ve started using FreeIPA and got fascinated with it’s capabilities, but recently I tried to configure FreeRadius integration
for WiFi authentication and ran into some issues.
----
radtest dmitry.fedorov fedor 127.0.0.1 100 testing123
Sending Access-Request Id 93 from 0.0.0.0:54153 to 127.0.0.1:1812
User-Name = 'dmitry.fedorov'
User-Password = 'fedor'
NAS-IP-Address = 10.0.0.12
NAS-Port = 100
Message-Authenticator = 0x00
Received Access-Accept Id 93 from 127.0.0.1:1812 to 127.0.0.1:54153 length 20
-----
——
(10) ERROR: eap : Failed continuing EAP PEAP (25) session. EAP sub-module failed
(10) eap : Failed in EAP select
(10) [eap] = invalid
(10) } # authenticate = invalid
(10) Failed to authenticate the user
(10) Using Post-Auth-Type Reject
(10) # Executing group from file /etc/raddb/sites-enabled/default
(10) Post-Auth-Type REJECT {
(10) attr_filter.access_reject : EXPAND %{User-Name}
(10) attr_filter.access_reject : --> dmitry.fedorov
(10) attr_filter.access_reject : Matched entry DEFAULT at line 11
(10) [attr_filter.access_reject] = updated
(10) eap : Reply already contained an EAP-Message, not inserting EAP-Failure
(10) [eap] = noop
(10) remove_reply_message_if_eap remove_reply_message_if_eap {
(10) if (&reply:EAP-Message && &reply:Reply-Message)
(10) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(10) else else {
(10) [noop] = noop
(10) } # else else = noop
(10) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop
(10) } # Post-Auth-Type REJECT = updated
(10) Delaying response for 1 seconds
Waking up in 0.1 seconds.
Waking up in 0.6 seconds.
(10) Sending delayed response
(10) Sending Access-Reject packet to host 10.0.0.139 port 62980, id=23, length=0
(10) EAP-Message = 0x040a0004
(10) Message-Authenticator = 0x00000000000000000000000000000000
Sending Access-Reject Id 23 from 10.0.0.12:1812 to 10.0.0.139:62980
EAP-Message = 0x040a0004
Message-Authenticator = 0x0000000000000000000000000000000
———
before this I see a couple of other errors in the debug output
—
WARNING: mschap : No Cleartext-Password configured. Cannot create LM-Password
(9) WARNING: mschap : No Cleartext-Password configured. Cannot create NT-Password
(9) mschap : Creating challenge hash with username: dmitry.fedorov
(9) mschap : Client is using MS-CHAPv2
(9) ERROR: mschap : FAILED: No NT/LM-Password. Cannot perform authentication
(9) ERROR: mschap : MS-CHAP2-Response is incorrect
(9) [mschap] = reject
(9) } # Auth-Type MS-CHAP = reject
—
and
---
ldap : Processing user attributes
(2) WARNING: ldap : No "known good" password added. Ensure the admin user has permission to read the password attribute
(2) WARNING: ldap : PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure)
rlm_ldap (ldap): Released connection (4)
(2) [ldap] = ok
(2) if ((ok || updated) && User-Password)
(2) if ((ok || updated) && User-Password) -> FALSE
(2) [expiration] = noop
(2) [logintime] = noop
(2) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type
(2) WARNING: pap : Authentication will fail unless a "known good" password is available
(2) [pap] = noop
—
At first I thought the problem was in the "known good” password, but if it was, most likely the ‘radtest' string would not work.
And if I change the base_dn to a wrong one, the test fails at once. From my point of view it proves that free radius is able to get to ldap, but there is some over error present.
Maybe I’m wrong.
Please help to understand what is wrong with my setup.
Regards,
Boris
--
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project
Loading...