[RADIATOR] Auth By LDAP against AD
McNealy, Justin S
mcnealy at musc.edu
Tue Apr 20 15:16:06 CDT 2010
Hugh,
We’re having an issue getting our authby LDAP2 against AD working properly. We’re running version 4.5.1 on a RHEL 5 server. We see it doing the lookup but then we get ether a bad password (with TTLS) or "EAP result: 1, Not authenticated by this AuthBy" (with PEAP). Seems like there’s a failure passing the password but authby NTLM works fine. Our config is below along with what we were seeing in the trace 4’s.
We’re doing this to stem worries that the hold caused by AuthBy NTLM could cause issues. How much havoc does that block cause. Are we chasing our tails to prevent an issue that we most likely will not notice? We have roughly 2000-3000 users a day and are using WPA2 Enterprise.
Any thoughts
Thanks
Jay
<Client 10.24.97.0/24>
IdenticalClients 10.24.238.41,10.24.238.42
Secret fsdfsdfsd
Identifier wlan
DupInterval 2
NasType Cisco
SNMPCommunity private
IgnoreAcctSignature 1
<AuthBy LDAP2>
Identifier LDAPAuthentication
Host aD.Host.clean
AuthDN CN=Radiator,OU=System Admin,OU=adsf,DC=adsf ,DC=local
AuthPassword asdfasdfasdf
BaseDN OU=AD Users,DC=clinlan,DC=local
UsernameAttr sAMAccountName
ServerChecksPassword
#Debug 255
Timeout 2
FailureBackoffTime 1
</AuthBy>
<AuthBy NTLM>
Identifier NTLMAuthentication
Domain clinlan
#Group Domain Users
#DomainController zulu
EAPType MSCHAP-V2
</AuthBy>
<Handler TunnelledByPEAP=1>
AuthByPolicy ContinueUntilAccept
RewriteUsername s/(.*)\\(.*)/$2/
AuthBy LDAPAuthentication
AuthBy NTLMAuthentication
AcctLogFileName %L/%{Client:Identifier}/%m%d%y.log
#PostAuthHook file:"%D/scripts/eap_anon_hook.pl"
PostProcessingHook file:"%D/scripts/eap_acct_username.pl"
</Handler>
<Handler Client-Identifier=wlan>
#AuthByPolicy ContinueUntilAccept
AddToRequestIfNotExist Framed-IP-Address=%{Calling-Station-Id}
StripFromRequest Class
<AuthBy FILE>
Filename %D/users
EAPType PEAP,TTLS
EAPTLS_CAFile %D/certificates/production/verisign-combo.crt
EAPTLS_CertificateFile %D/certificates/production/%h.pem
EAPTLS_CertificateType PEM
EAPTLS_PrivateKeyFile %D/certificates/production/%h.pem
EAPTLS_PrivateKeyPassword pass
EAPTLS_VerifyDepth 3
EAPTLS_MaxFragmentSize 1000
AutoMPPEKeys
SSLeayTrace 4
EAPTLS_PEAPVersion 1
EAPTLS_PEAPBrokenV1Label
EAPAnonymous %0
</AuthBy>
#PreProcessingHook file:"%D/scripts/eap_anon_hook.pl"
AcctLogFileName %L/%{Client:Identifier}/%m%d%y.log
</Handler>
Tue Apr 20 14:51:29 2010: DEBUG: Handling request with Handler 'TunnelledByPEAP=1'
Tue Apr 20 14:51:29 2010: DEBUG: Rewrote user name to Name
Tue Apr 20 14:51:29 2010: DEBUG: Deleting session for Name, 10.24.238.42, 29
Tue Apr 20 14:51:29 2010: DEBUG: Handling with Radius::AuthLDAP2: LDAPAuthentication
Tue Apr 20 14:51:29 2010: DEBUG: Handling with EAP: code 2, 2, 6, 26
Tue Apr 20 14:51:29 2010: DEBUG: Response type 26
Tue Apr 20 14:51:29 2010: DEBUG: EAP result: 1, Not authenticated by this AuthBy
Tue Apr 20 14:51:29 2010: DEBUG: AuthBy LDAP2 result: REJECT, Not authenticated by this AuthBy
Tue Apr 20 14:51:29 2010: DEBUG: Handling with Radius::AuthNTLM: NTLMAuthentication
Tue Apr 20 14:51:29 2010: DEBUG: Handling with EAP: code 2, 2, 6, 26
Tue Apr 20 14:51:29 2010: DEBUG: Response type 26
Tue Apr 20 14:51:29 2010: DEBUG: EAP result: 0,
Tue Apr 20 14:51:29 2010: DEBUG: AuthBy NTLM result: ACCEPT,
Tue Apr 20 14:51:29 2010: DEBUG: Access accepted for Name
Tue Apr 20 14:51:29 2010: DEBUG: Returned PEAP tunnelled packet dump:
Code: Access-Accept
Identifier: UNDEF
Authentic: 1<234><183><138><210><208><170><248><161>=<164><249><150><209><26><238>
Attributes:
EAP-Message = <3><2><0><4>
Message-Authenticator = <0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0>
User-Name = "Name"
Disabling NTLM
Tue Apr 20 15:15:47 2010: DEBUG: Radius::AuthLDAP2 looks for match with Name [Name]
Tue Apr 20 15:15:47 2010: DEBUG: Radius::AuthLDAP2 ACCEPT: : Name [Name]
Tue Apr 20 15:15:47 2010: DEBUG: EAP result: 1, EAP MSCHAP-V2 Authentication failure
Tue Apr 20 15:15:47 2010: DEBUG: AuthBy LDAP2 result: REJECT, EAP MSCHAP-V2 Authentication failure
Tue Apr 20 15:15:47 2010: INFO: Access rejected for Name: EAP MSCHAP-V2 Authentication failure
Tue Apr 20 15:15:47 2010: DEBUG: Returned PEAP tunnelled packet dump:
Code: Access-Reject
Identifier: UNDEF
Authentic: <195>{l<182><252><138>m<151><134>E<225><157>i')M
Attributes:
EAP-Message = <4><1><0><4>
Message-Authenticator = <0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0>
Reply-Message = "Request Denied"
Tue Apr 20 15:15:47 2010: DEBUG: EAP result: 3, EAP PEAP inner authentication redispatched to a Handler
Tue Apr 20 15:15:47 2010: DEBUG: AuthBy FILE result: CHALLENGE, EAP PEAP inner authentication redispatched to a Handler
Tue Apr 20 15:15:47 2010: DEBUG: Access challenged for Name: EAP PEAP inner authentication redispatched to a Handler
Tue Apr 20 15:15:47 2010: DEBUG: Packet dump:
*** Sending to 10.24.238.42 port 32769 ....
Code: Access-Challenge
Identifier: 229
Authentic: <178>]<220><177>d<250>W<220>'<145><174>$<199><2>h<19>
Attributes:
EAP-Message = <1><11><0>+<25><1><23><3><1><0> <216>{<239><130>o3<138>+<129><223>t<130>7<19><171>A(<200><146><191><193>V<255>Z<208>mF<134><162>C<232><5>
Message-Authenticator = <0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0>
TTLS Authentication
G: Radius::AuthLDAP2 looks for match with Nameoss [Nameoss]
Tue Apr 20 15:19:08 2010: DEBUG: Radius::AuthLDAP2 REJECT: Bad Encrypted password: Nameoss [Nameoss]
Tue Apr 20 15:19:08 2010: INFO: Connecting to dc1.emr.co.edu:389
Tue Apr 20 15:19:08 2010: INFO: Attempting to bind to LDAP server dc1.emr.co.edu:389
Tue Apr 20 15:19:08 2010: DEBUG: No entries for DEFAULT found in LDAP database
Tue Apr 20 15:19:08 2010: DEBUG: AuthBy LDAP2 result: REJECT, Bad Encrypted password
Tue Apr 20 15:19:08 2010: DEBUG: Handling with Radius::AuthNTLM: NTLMAuthentication
Tue Apr 20 15:19:08 2010: DEBUG: Radius::AuthNTLM looks for match with Nameoss [Nameoss]
Tue Apr 20 15:19:08 2010: INFO: Starting NtlmAuthProg: /usr/bin/ntlm_auth --helper-protocol=ntlm-server-1
Tue Apr 20 15:19:08 2010: DEBUG: Passing attribute Request-User-Session-Key: Yes
Tue Apr 20 15:19:08 2010: DEBUG: Passing attribute Request-LanMan-Session-Key: Yes
Tue Apr 20 15:19:08 2010: DEBUG: Passing attribute LANMAN-Challenge: 62fd1d38a76dc97e
Tue Apr 20 15:19:08 2010: DEBUG: Passing attribute NT-Response: 5fc23e2aa9e5c1401a805d10051f9c20bfeb2009b4065853
Tue Apr 20 15:19:08 2010: DEBUG: Passing attribute NT-Domain:: ;sdfjk
Tue Apr 20 15:19:08 2010: DEBUG: Passing attribute Username:: Yjklssdfjk
Tue Apr 20 15:19:08 2010: DEBUG: Received attribute: Authenticated: Yes
Tue Apr 20 15:19:08 2010: DEBUG: Received attribute: LANMAN-Session-Key: E8A85EB0FD85800C
Tue Apr 20 15:19:08 2010: DEBUG: Received attribute: User-Session-Keykjkljkl;j;jk;jkl;j
Tue Apr 20 15:19:08 2010: DEBUG: Received attribute: .
Tue Apr 20 15:19:08 2010: DEBUG: Radius::AuthNTLM ACCEPT: : Nameoss [Nameoss]
Tue Apr 20 15:19:08 2010: DEBUG: AuthBy NTLM result: ACCEPT,
Tue Apr 20 15:19:08 2010: DEBUG: Access accepted for Nameoss
Tue Apr 20 15:19:08 2010: DEBUG: Returned TTLS tunnelled Diameter Packet dump:
Code: Access-Accept
PEAP auth.
Tue Apr 20 15:27:05 2010: DEBUG: Radius::AuthLDAP2 looks for match with Nameoss [Nameoss]
Tue Apr 20 15:27:05 2010: DEBUG: Radius::AuthLDAP2 ACCEPT: : Nameoss [Nameoss]
Tue Apr 20 15:27:05 2010: DEBUG: EAP result: 1, EAP MSCHAP-V2 Authentication failure
Tue Apr 20 15:27:05 2010: DEBUG: AuthBy LDAP2 result: REJECT, EAP MSCHAP-V2 Authentication failure
Tue Apr 20 15:27:05 2010: INFO: Access rejected for Nameoss: EAP MSCHAP-V2 Authentication failure
Tue Apr 20 15:27:05 2010: DEBUG: Returned PEAP tunnelled packet dump:
Code: Access-Reject
Identifier: UNDEF
Authentic: <136>z<135><133>X<162><215>:#C<186><148><31><224>{<165>
Attributes:
EAP-Message = <4><1><0><4>
Message-Authenticator = <0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0>
Reply-Message = "Request Denied"
Tue Apr 20 15:27:05 2010: DEBUG: EAP result: 3, EAP PEAP inner authentication redispatched to a Handler
Tue Apr 20 15:27:05 2010: DEBUG: AuthBy FILE result: CHALLENGE, EAP PEAP inner authentication redispatched to a Handler
Tue Apr 20 15:27:05 2010: DEBUG: Access challenged for anonymous: EAP PEAP inner authentication redispatched to a Handler
Tue Apr 20 15:27:05 2010: DEBUG: Packet dump:
*** Sending to 10.24.238.42 port 32769 ....
Code: Access-Challenge
Identifier: 0
Authentic: <161>![j<183><224><248><130><161><2><175><207><186><179><195><131>
Attributes:
EAP-Message = <1><10><0>+<25><1><23><3><1><0> <242>yF<225><136>E<211><198><134><178>Ka<213><220><247><229><171><150><30><227>e<0><151>N<213><15><254>tt<252><17><140>
Message-Authenticator = <0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0>
Tue Apr 20 15:27:05 2010: DEBUG: Calling-Station-Id = 0026.bb02.4b2b
Tue Apr 20 15:27:05 2010: DEBUG: Called-Station-Id = 0027.0d07.cc00:n
Tue Apr 20 15:27:05 2010: DEBUG: Packet dump:
*** Received from 10.24.238.42 port 32769 ....
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.open.com.au/pipermail/radiator/attachments/20100420/3c24bc15/attachment-0001.html
More information about the radiator
mailing list