1

I am trying to set up an LDAP server for authenticating multiple servers such as ftp and radius (maybe even ssh?)

I have a router (ddwrt) which I have been able to authenticate with plaintext passwords in freeradius. Now I want to use an ldap server to store the users and passwords

I have set up my ldap server and I can authenticate it using the following:

kevin@kevin-desktop:~$ radtest ldapuser password123 127.0.0.1 2 testing123
Sending Access-Request of id 182 to 127.0.0.1 port 1812
        User-Name = "ldapuser"
        User-Password = "password123"
        NAS-IP-Address = 127.0.1.1
        NAS-Port = 2
        Message-Authenticator = 0x00000000000000000000000000000000
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=182, length=20

But when I try to authenticate using ddwrt -> freeradius I get the following message:

rad_recv: Access-Request packet from host 192.168.11.1 port 52101, id=0, length=129
        User-Name = "ldapuser"
        NAS-IP-Address = 192.168.11.1
        Called-Station-Id = "10da43747fcb"
        Calling-Station-Id = "accf8528974e"
        NAS-Identifier = "10da43747fcb"
        NAS-Port = 49
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        EAP-Message = 0x0200000d016c64617075736572
        Message-Authenticator = 0x99372f408b0979fc103af5112b81501a
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "ldapuser", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] = noop
[eap] EAP packet type response id 0 length 13
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] = updated
[files] users: Matched entry DEFAULT at line 1
++[files] = ok
[ldap] performing user authorization for ldapuser
[ldap]  expand: %{Stripped-User-Name} -> 
[ldap]  ... expanding second conditional
[ldap]  expand: %{User-Name} -> ldapuser
[ldap]  expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ldapuser)
[ldap]  expand: dc=kevin,dc=local -> dc=kevin,dc=local
  [ldap] ldap_get_conn: Checking Id: 0
  [ldap] ldap_get_conn: Got Id: 0
  [ldap] attempting LDAP reconnection
  [ldap] (re)connect to 192.168.11.21:389, authentication 0
  [ldap] bind as cn=admin,dc=kevin,dc=local/pwd to 192.168.11.21:389
  [ldap] waiting for bind result ...
  [ldap] Bind was successful
  [ldap] performing search in dc=kevin,dc=local, with filter (uid=ldapuser)
[ldap] No default NMAS login sequence
[ldap] looking for check items in directory...
  [ldap] userPassword -> User-Password == "{SSHA}fqS7t/ZXimCnTgsXcsGDQF9WP+atmjVG"
  [ldap] userPassword -> Password-With-Header == "{SSHA}fqS7t/ZXimCnTgsXcsGDQF9WP+atmjVG"
[ldap] looking for reply items in directory...
  [ldap] ldap_release_conn: Release Id: 0
++[ldap] = ok
++[expiration] = noop
++[logintime] = noop
[pap] WARNING: Auth-Type already set.  Not setting to PAP
++[pap] = noop
+} # group authorize = updated
Found Auth-Type = LDAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group LDAP {
  [ldap] Attribute "User-Password" is required for authentication.
  You seem to have set "Auth-Type := LDAP" somewhere.
  THAT CONFIGURATION IS WRONG.  DELETE IT.
  YOU ARE PREVENTING THE SERVER FROM WORKING PROPERLY.
++[ldap] = invalid
+} # group LDAP = invalid
Failed to authenticate the user.
Using Post-Auth-Type Reject
# Executing group from file /etc/freeradius/sites-enabled/default
+group REJECT {
[eap] Request was previously rejected, inserting EAP-Failure
++[eap] = updated
[attr_filter.access_reject]     expand: %{User-Name} -> ldapuser
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] = updated
+} # group REJECT = updated
Delaying reject of request 0 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 0
Sending Access-Reject of id 0 to 192.168.11.1 port 52101
        EAP-Message = 0x04000004
        Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 4.9 seconds.
Cleaning up request 0 ID 0 with timestamp +9
Ready to process requests.

How do I properly set up openradius with openldap?

1
  • specify your realm or use pam and sssd (which I found way easier) – Jacob Evans Mar 19 '17 at 14:07
0

The key message here is:

[ldap] Attribute "User-Password" is required for authentication.
You seem to have set "Auth-Type := LDAP" somewhere. THAT CONFIGURATION IS WRONG. DELETE IT. YOU ARE PREVENTING THE SERVER FROM WORKING PROPERLY.

I can't see an update section, but I bet that you've either set set_auth_type to yes, or that entry at line 1 of raddb/users has something like:

DEFAULT Auth-Type := LDAP

For either case, you should remove the entry.

By setting Auth-Type you are forcing the server to perform a particular type of authentication which might not be suitable given the attributes in the request.

A description of how the server decides which authentication method to use is available at the RADIUS Concepts on the FreeRADIUS wiki.

For EAP authentication (which is what DD-WRT is attempting), you need to add the LDAP and PAP modules to the authorize section of sites-available/inner-tunnel, and ensure your Password-With-Header attribute points to the correct LDAP attribute.

0

Apparently You have to store the passwords in cleartext on the ldap server for PEAP to work.

I followed this tutorial (Very basic setup): https://www.youtube.com/watch?v=weTfRslHhZY

Steps:

In /etc/freeradius/modules/ldap modify the settings:

server = "server.address"
        identity = "cn=admin,dc=example,dc=com"
        password = admin_password
        basedn = "dc=example,dc=com"

In /etc/freeradius/sites-available/default authorize section:

comment file
uncomment ldap

In /etc/freeradius/sites-available/inner-tunnel

authorize section:

comment file
uncomment ldap

authenticate section: uncomment:

Auth-Type LDAP {
        ldap
}

They omitted the fact that you have to keep the passwords in clear text which I found out about here:

http://tech.sybreon.com/2011/01/18/freeradius-openldap-dd-wrt/

Apparently you cant create a posix account from a simple organizational group, you have to create it from a posix group which I got from here:

http://www.linuxquestions.org/questions/linux-networking-3/can't-create-ldap-entries-with-phpldapadmin-272376/

In the end I had to use jxexplore and phpldapadmin to add my users since jxexplore does not like to add plaintext passwords. Just create the account without a password on jxexplore then add the password to the user in phpldapadmin. (I will update this when I get the chance)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.