RADIUS + LDAP + TLS

[Francisco Orozco/Upcnet]

Hello to all,

I've been using FreeRadius for a year, but now I'd like to implement
RADIUS with LDAP authentication, I've test it and It works great.

Now I'd like to protect radius - ldap server comunication using TLS. But
I'm not able to do it.

My LDAP server is Notes Domino and I've been able to configure it
correctly. I can connect to it using LDAP SSL/TLS, but I don't know how to
implement this in FreeRadius.

I'm using freeradius-0.8.1 and this is my radiusd.conf



Can you help me?

When I try i view this log:

rad_recv: Access-Request packet from host 127.0.0.1:32792, id=101,
length=60
User-Name = "test"
User-Password = "1234567890"
NAS-IP-Address = 255.255.255.255
NAS-Port = 1
rad_lowerpair: User-Name now 'test'
rad_lowerpair: User-Password now '1234567890'
modcall: entering group authorize
rlm_ldap: - authorize
rlm_ldap: performing user authorization for test
radius_xlat: '(uid=test)'
radius_xlat: 'o=Prova'
ldap_get_conn: Got Id: 0
rlm_ldap: attempting LDAP reconnection
rlm_ldap: (re)connect to ldap.server.mycompany.es:636, authentication 0
rlm_ldap: setting TLS mode to 1
rlm_ldap: starting TLS
rlm_ldap: ldap_start_tls_s()
rlm_ldap: could not start TLS Protocol error
rlm_ldap: (re)connection attempt failed
rlm_ldap: search failed
ldap_release_conn: Release Id: 0
modcall[authorize]: module "ldap" returns fail
modcall: group authorize returns fail
There was no response configured: rejecting request 0
Server rejecting request 0.
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Sending Access-Reject of id 101 to 127.0.0.1:32792
Waking up in 4 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 101 with timestamp 3ef0694c
Nothing to do. Sleeping until we see a request.

______________________________________
Paco Orozco (***@upcnet.es)
Divisió de Telecomunicacions
UPCNet
Edifici Vèrtex - Pl. Eusebi Güell, 6
Telèfon centraleta: 93.40.11600

[Owen DeLong]

I don't know how to get TLS to work, but you should be able to do
SSL by specifying that the LDAP port to use is 669 (LDAPs) in
your radius.conf. I'm, however, having a similar problem in that
I am unable to get it to work because of a complaint about a self-signed
certificate. If you have any ideas on how to rectify that one, I'd
appreciate it. I've posted my question to the list twice and have
received zero response.

Owen


--On Wednesday, June 18, 2003 12:32 PM +0200 "Francisco Orozco/Upcnet"
<***@upcnet.es> wrote:

> Hello to all,
>
> I've been using FreeRadius for a year, but now I'd like to implement
> RADIUS with LDAP authentication, I've test it and It works great.
>
> Now I'd like to protect radius - ldap server comunication using TLS. But
> I'm not able to do it.
>
> My LDAP server is Notes Domino and I've been able to configure it
> correctly. I can connect to it using LDAP SSL/TLS, but I don't know how
> to implement this in FreeRadius.
>
> I'm using freeradius-0.8.1 and this is my radiusd.conf
>
>
>
> Can you help me?
>
> When I try i view this log:
>
> rad_recv: Access-Request packet from host 127.0.0.1:32792, id=101,
> length=60
> User-Name = "test"
> User-Password = "1234567890"
> NAS-IP-Address = 255.255.255.255
> NAS-Port = 1
> rad_lowerpair: User-Name now 'test'
> rad_lowerpair: User-Password now '1234567890'
> modcall: entering group authorize
> rlm_ldap: - authorize
> rlm_ldap: performing user authorization for test
> radius_xlat: '(uid=test)'
> radius_xlat: 'o=Prova'
> ldap_get_conn: Got Id: 0
> rlm_ldap: attempting LDAP reconnection
> rlm_ldap: (re)connect to ldap.server.mycompany.es:636, authentication 0
> rlm_ldap: setting TLS mode to 1
> rlm_ldap: starting TLS
> rlm_ldap: ldap_start_tls_s()
> rlm_ldap: could not start TLS Protocol error
> rlm_ldap: (re)connection attempt failed
> rlm_ldap: search failed
> ldap_release_conn: Release Id: 0
> modcall[authorize]: module "ldap" returns fail
> modcall: group authorize returns fail
> There was no response configured: rejecting request 0
> Server rejecting request 0.
> Finished request 0
> Going to the next request
> --- Walking the entire request list ---
> Waking up in 1 seconds...
> --- Walking the entire request list ---
> Waking up in 1 seconds...
> --- Walking the entire request list ---
> Sending Access-Reject of id 101 to 127.0.0.1:32792
> Waking up in 4 seconds...
> --- Walking the entire request list ---
> Cleaning up request 0 ID 101 with timestamp 3ef0694c
> Nothing to do. Sleeping until we see a request.
>
> ______________________________________
> Paco Orozco (***@upcnet.es)
> Divisió de Telecomunicacions
> UPCNet
> Edifici Vèrtex - Pl. Eusebi Güell, 6
> Telèfon centraleta: 93.40.11600



-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Kostas Kalevras]

On Fri, 20 Jun 2003, Kostas Kalevras wrote:

> On Wed, 18 Jun 2003, Owen DeLong wrote:
>
> > I don't know how to get TLS to work, but you should be able to do
> > SSL by specifying that the LDAP port to use is 669 (LDAPs) in
> > your radius.conf. I'm, however, having a similar problem in that
> > I am unable to get it to work because of a complaint about a self-signed
> > certificate. If you have any ideas on how to rectify that one, I'd
> > appreciate it. I've posted my question to the list twice and have
> > received zero response.
> >
> > Owen
>
> Try the attached patch. I haven't tested it though.

Also you could also just try to change the configuration of the ldap client
library:
http://www.openldap.org/doc/admin21/tls.html

>
>
> --
> Kostas Kalevras Network Operations Center
> ***@noc.ntua.gr National Technical University of Athens, Greece
> Work Phone: [phone]
> 'Go back to the shadow' Gandalf

--
Kostas Kalevras Network Operations Center
***@noc.ntua.gr National Technical University of Athens, Greece
Work Phone: [phone]
'Go back to the shadow' Gandalf

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Kostas Kalevras]

On Wed, 18 Jun 2003, Owen DeLong wrote:

> I don't know how to get TLS to work, but you should be able to do
> SSL by specifying that the LDAP port to use is 669 (LDAPs) in
> your radius.conf. I'm, however, having a similar problem in that
> I am unable to get it to work because of a complaint about a self-signed
> certificate. If you have any ideas on how to rectify that one, I'd
> appreciate it. I've posted my question to the list twice and have
> received zero response.
>
> Owen

Try the attached patch. I haven't tested it though.


--
Kostas Kalevras Network Operations Center
***@noc.ntua.gr National Technical University of Athens, Greece
Work Phone: [phone]
'Go back to the shadow' Gandalf

[Ron Wahler]

Is there a description someplace that would show how
to setup an SSL connection from Freeradius to an external LDAP database.

Thanks,
Ron.

-----Original Message-----
From: Owen DeLong [mailto:***@delong.com]
Sent: Wednesday, June 18, 2003 9:05 AM
To: freeradius-***@lists.cistron.nl
Subject: Re: RADIUS + LDAP + TLS

I don't know how to get TLS to work, but you should be able to do
SSL by specifying that the LDAP port to use is 669 (LDAPs) in
your radius.conf. I'm, however, having a similar problem in that
I am unable to get it to work because of a complaint about a self-signed
certificate. If you have any ideas on how to rectify that one, I'd
appreciate it. I've posted my question to the list twice and have
received zero response.

Owen


--On Wednesday, June 18, 2003 12:32 PM +0200 "Francisco Orozco/Upcnet"
<***@upcnet.es> wrote:

> Hello to all,
>
> I've been using FreeRadius for a year, but now I'd like to implement
> RADIUS with LDAP authentication, I've test it and It works great.
>
> Now I'd like to protect radius - ldap server comunication using TLS.
But
> I'm not able to do it.
>
> My LDAP server is Notes Domino and I've been able to configure it
> correctly. I can connect to it using LDAP SSL/TLS, but I don't know
how
> to implement this in FreeRadius.
>
> I'm using freeradius-0.8.1 and this is my radiusd.conf
>
>
>
> Can you help me?
>
> When I try i view this log:
>
> rad_recv: Access-Request packet from host 127.0.0.1:32792, id=101,
> length=60
> User-Name = "test"
> User-Password = "1234567890"
> NAS-IP-Address = 255.255.255.255
> NAS-Port = 1
> rad_lowerpair: User-Name now 'test'
> rad_lowerpair: User-Password now '1234567890'
> modcall: entering group authorize
> rlm_ldap: - authorize
> rlm_ldap: performing user authorization for test
> radius_xlat: '(uid=test)'
> radius_xlat: 'o=Prova'
> ldap_get_conn: Got Id: 0
> rlm_ldap: attempting LDAP reconnection
> rlm_ldap: (re)connect to ldap.server.mycompany.es:636, authentication
0
> rlm_ldap: setting TLS mode to 1
> rlm_ldap: starting TLS
> rlm_ldap: ldap_start_tls_s()
> rlm_ldap: could not start TLS Protocol error
> rlm_ldap: (re)connection attempt failed
> rlm_ldap: search failed
> ldap_release_conn: Release Id: 0
> modcall[authorize]: module "ldap" returns fail
> modcall: group authorize returns fail
> There was no response configured: rejecting request 0
> Server rejecting request 0.
> Finished request 0
> Going to the next request
> --- Walking the entire request list ---
> Waking up in 1 seconds...
> --- Walking the entire request list ---
> Waking up in 1 seconds...
> --- Walking the entire request list ---
> Sending Access-Reject of id 101 to 127.0.0.1:32792
> Waking up in 4 seconds...
> --- Walking the entire request list ---
> Cleaning up request 0 ID 101 with timestamp 3ef0694c
> Nothing to do. Sleeping until we see a request.
>
> ______________________________________
> Paco Orozco (***@upcnet.es)
> Divisió de Telecomunicacions
> UPCNet
> Edifici Vèrtex - Pl. Eusebi Güell, 6
> Telèfon centraleta: 93.40.11600



-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Owen DeLong]

Yes... Don't remember exactly where I found it, but, if you have LDAP
working, then it's just a matter of adding a port=669 phrase to the
configuration file (radiusd.conf) where you specify the ldap server.

Owen

--On Wednesday, June 18, 2003 9:40 AM -0600 Ron Wahler
<***@rovingplanet.com> wrote:

>
> Is there a description someplace that would show how
> to setup an SSL connection from Freeradius to an external LDAP database.
>
> Thanks,
> Ron.
>
> -----Original Message-----
> From: Owen DeLong [mailto:***@delong.com]
> Sent: Wednesday, June 18, 2003 9:05 AM
> To: freeradius-***@lists.cistron.nl
> Subject: Re: RADIUS + LDAP + TLS
>
> I don't know how to get TLS to work, but you should be able to do
> SSL by specifying that the LDAP port to use is 669 (LDAPs) in
> your radius.conf. I'm, however, having a similar problem in that
> I am unable to get it to work because of a complaint about a self-signed
> certificate. If you have any ideas on how to rectify that one, I'd
> appreciate it. I've posted my question to the list twice and have
> received zero response.
>
> Owen
>
>
> --On Wednesday, June 18, 2003 12:32 PM +0200 "Francisco Orozco/Upcnet"
> <***@upcnet.es> wrote:
>
>> Hello to all,
>>
>> I've been using FreeRadius for a year, but now I'd like to implement
>> RADIUS with LDAP authentication, I've test it and It works great.
>>
>> Now I'd like to protect radius - ldap server comunication using TLS.
> But
>> I'm not able to do it.
>>
>> My LDAP server is Notes Domino and I've been able to configure it
>> correctly. I can connect to it using LDAP SSL/TLS, but I don't know
> how
>> to implement this in FreeRadius.
>>
>> I'm using freeradius-0.8.1 and this is my radiusd.conf
>>
>>
>>
>> Can you help me?
>>
>> When I try i view this log:
>>
>> rad_recv: Access-Request packet from host 127.0.0.1:32792, id=101,
>> length=60
>> User-Name = "test"
>> User-Password = "1234567890"
>> NAS-IP-Address = 255.255.255.255
>> NAS-Port = 1
>> rad_lowerpair: User-Name now 'test'
>> rad_lowerpair: User-Password now '1234567890'
>> modcall: entering group authorize
>> rlm_ldap: - authorize
>> rlm_ldap: performing user authorization for test
>> radius_xlat: '(uid=test)'
>> radius_xlat: 'o=Prova'
>> ldap_get_conn: Got Id: 0
>> rlm_ldap: attempting LDAP reconnection
>> rlm_ldap: (re)connect to ldap.server.mycompany.es:636, authentication
> 0
>> rlm_ldap: setting TLS mode to 1
>> rlm_ldap: starting TLS
>> rlm_ldap: ldap_start_tls_s()
>> rlm_ldap: could not start TLS Protocol error
>> rlm_ldap: (re)connection attempt failed
>> rlm_ldap: search failed
>> ldap_release_conn: Release Id: 0
>> modcall[authorize]: module "ldap" returns fail
>> modcall: group authorize returns fail
>> There was no response configured: rejecting request 0
>> Server rejecting request 0.
>> Finished request 0
>> Going to the next request
>> --- Walking the entire request list ---
>> Waking up in 1 seconds...
>> --- Walking the entire request list ---
>> Waking up in 1 seconds...
>> --- Walking the entire request list ---
>> Sending Access-Reject of id 101 to 127.0.0.1:32792
>> Waking up in 4 seconds...
>> --- Walking the entire request list ---
>> Cleaning up request 0 ID 101 with timestamp 3ef0694c
>> Nothing to do. Sleeping until we see a request.
>>
>> ______________________________________
>> Paco Orozco (***@upcnet.es)
>> Divisió de Telecomunicacions
>> UPCNet
>> Edifici Vèrtex - Pl. Eusebi Güell, 6
>> Telèfon centraleta: 93.40.11600
>
>
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>



-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Ron Wahler]

Yes, but how do you set up the SSL tunnel and get the certificates to
validate to the LDAP server? are you using stunnel ?

Ron.

-----Original Message-----
From: Owen DeLong [mailto:***@delong.com]
Sent: Wednesday, June 18, 2003 9:55 AM
To: freeradius-***@lists.cistron.nl
Subject: RE: RADIUS + LDAP + TLS

Yes... Don't remember exactly where I found it, but, if you have LDAP
working, then it's just a matter of adding a port=669 phrase to the
configuration file (radiusd.conf) where you specify the ldap server.

Owen

--On Wednesday, June 18, 2003 9:40 AM -0600 Ron Wahler
<***@rovingplanet.com> wrote:

>
> Is there a description someplace that would show how
> to setup an SSL connection from Freeradius to an external LDAP
database.
>
> Thanks,
> Ron.
>
> -----Original Message-----
> From: Owen DeLong [mailto:***@delong.com]
> Sent: Wednesday, June 18, 2003 9:05 AM
> To: freeradius-***@lists.cistron.nl
> Subject: Re: RADIUS + LDAP + TLS
>
> I don't know how to get TLS to work, but you should be able to do
> SSL by specifying that the LDAP port to use is 669 (LDAPs) in
> your radius.conf. I'm, however, having a similar problem in that
> I am unable to get it to work because of a complaint about a
self-signed
> certificate. If you have any ideas on how to rectify that one, I'd
> appreciate it. I've posted my question to the list twice and have
> received zero response.
>
> Owen
>
>
> --On Wednesday, June 18, 2003 12:32 PM +0200 "Francisco Orozco/Upcnet"
> <***@upcnet.es> wrote:
>
>> Hello to all,
>>
>> I've been using FreeRadius for a year, but now I'd like to implement
>> RADIUS with LDAP authentication, I've test it and It works great.
>>
>> Now I'd like to protect radius - ldap server comunication using TLS.
> But
>> I'm not able to do it.
>>
>> My LDAP server is Notes Domino and I've been able to configure it
>> correctly. I can connect to it using LDAP SSL/TLS, but I don't know
> how
>> to implement this in FreeRadius.
>>
>> I'm using freeradius-0.8.1 and this is my radiusd.conf
>>
>>
>>
>> Can you help me?
>>
>> When I try i view this log:
>>
>> rad_recv: Access-Request packet from host 127.0.0.1:32792, id=101,
>> length=60
>> User-Name = "test"
>> User-Password = "1234567890"
>> NAS-IP-Address = 255.255.255.255
>> NAS-Port = 1
>> rad_lowerpair: User-Name now 'test'
>> rad_lowerpair: User-Password now '1234567890'
>> modcall: entering group authorize
>> rlm_ldap: - authorize
>> rlm_ldap: performing user authorization for test
>> radius_xlat: '(uid=test)'
>> radius_xlat: 'o=Prova'
>> ldap_get_conn: Got Id: 0
>> rlm_ldap: attempting LDAP reconnection
>> rlm_ldap: (re)connect to ldap.server.mycompany.es:636, authentication
> 0
>> rlm_ldap: setting TLS mode to 1
>> rlm_ldap: starting TLS
>> rlm_ldap: ldap_start_tls_s()
>> rlm_ldap: could not start TLS Protocol error
>> rlm_ldap: (re)connection attempt failed
>> rlm_ldap: search failed
>> ldap_release_conn: Release Id: 0
>> modcall[authorize]: module "ldap" returns fail
>> modcall: group authorize returns fail
>> There was no response configured: rejecting request 0
>> Server rejecting request 0.
>> Finished request 0
>> Going to the next request
>> --- Walking the entire request list ---
>> Waking up in 1 seconds...
>> --- Walking the entire request list ---
>> Waking up in 1 seconds...
>> --- Walking the entire request list ---
>> Sending Access-Reject of id 101 to 127.0.0.1:32792
>> Waking up in 4 seconds...
>> --- Walking the entire request list ---
>> Cleaning up request 0 ID 101 with timestamp 3ef0694c
>> Nothing to do. Sleeping until we see a request.
>>
>> ______________________________________
>> Paco Orozco (***@upcnet.es)
>> Divisió de Telecomunicacions
>> UPCNet
>> Edifici Vèrtex - Pl. Eusebi Güell, 6
>> Telèfon centraleta: 93.40.11600
>
>
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>



-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Owen DeLong]

No... The OpenLDAP libraries used to build Freeradius already handle
all of that for you. At least in my case, it just worked, except for
that niggling issue of the self-signed certificate. If your LDAP
server is already set up to handle SSL connections, that should be
all you need.

Owen


--On Wednesday, June 18, 2003 9:58 AM -0600 Ron Wahler
<***@rovingplanet.com> wrote:

>
> Yes, but how do you set up the SSL tunnel and get the certificates to
> validate to the LDAP server? are you using stunnel ?
>
> Ron.
>
> -----Original Message-----
> From: Owen DeLong [mailto:***@delong.com]
> Sent: Wednesday, June 18, 2003 9:55 AM
> To: freeradius-***@lists.cistron.nl
> Subject: RE: RADIUS + LDAP + TLS
>
> Yes... Don't remember exactly where I found it, but, if you have LDAP
> working, then it's just a matter of adding a port=669 phrase to the
> configuration file (radiusd.conf) where you specify the ldap server.
>
> Owen
>
> --On Wednesday, June 18, 2003 9:40 AM -0600 Ron Wahler
> <***@rovingplanet.com> wrote:
>
>>
>> Is there a description someplace that would show how
>> to setup an SSL connection from Freeradius to an external LDAP
> database.
>>
>> Thanks,
>> Ron.
>>
>> -----Original Message-----
>> From: Owen DeLong [mailto:***@delong.com]
>> Sent: Wednesday, June 18, 2003 9:05 AM
>> To: freeradius-***@lists.cistron.nl
>> Subject: Re: RADIUS + LDAP + TLS
>>
>> I don't know how to get TLS to work, but you should be able to do
>> SSL by specifying that the LDAP port to use is 669 (LDAPs) in
>> your radius.conf. I'm, however, having a similar problem in that
>> I am unable to get it to work because of a complaint about a
> self-signed
>> certificate. If you have any ideas on how to rectify that one, I'd
>> appreciate it. I've posted my question to the list twice and have
>> received zero response.
>>
>> Owen
>>
>>
>> --On Wednesday, June 18, 2003 12:32 PM +0200 "Francisco Orozco/Upcnet"
>> <***@upcnet.es> wrote:
>>
>>> Hello to all,
>>>
>>> I've been using FreeRadius for a year, but now I'd like to implement
>>> RADIUS with LDAP authentication, I've test it and It works great.
>>>
>>> Now I'd like to protect radius - ldap server comunication using TLS.
>> But
>>> I'm not able to do it.
>>>
>>> My LDAP server is Notes Domino and I've been able to configure it
>>> correctly. I can connect to it using LDAP SSL/TLS, but I don't know
>> how
>>> to implement this in FreeRadius.
>>>
>>> I'm using freeradius-0.8.1 and this is my radiusd.conf
>>>
>>>
>>>
>>> Can you help me?
>>>
>>> When I try i view this log:
>>>
>>> rad_recv: Access-Request packet from host 127.0.0.1:32792, id=101,
>>> length=60
>>> User-Name = "test"
>>> User-Password = "1234567890"
>>> NAS-IP-Address = 255.255.255.255
>>> NAS-Port = 1
>>> rad_lowerpair: User-Name now 'test'
>>> rad_lowerpair: User-Password now '1234567890'
>>> modcall: entering group authorize
>>> rlm_ldap: - authorize
>>> rlm_ldap: performing user authorization for test
>>> radius_xlat: '(uid=test)'
>>> radius_xlat: 'o=Prova'
>>> ldap_get_conn: Got Id: 0
>>> rlm_ldap: attempting LDAP reconnection
>>> rlm_ldap: (re)connect to ldap.server.mycompany.es:636, authentication
>> 0
>>> rlm_ldap: setting TLS mode to 1
>>> rlm_ldap: starting TLS
>>> rlm_ldap: ldap_start_tls_s()
>>> rlm_ldap: could not start TLS Protocol error
>>> rlm_ldap: (re)connection attempt failed
>>> rlm_ldap: search failed
>>> ldap_release_conn: Release Id: 0
>>> modcall[authorize]: module "ldap" returns fail
>>> modcall: group authorize returns fail
>>> There was no response configured: rejecting request 0
>>> Server rejecting request 0.
>>> Finished request 0
>>> Going to the next request
>>> --- Walking the entire request list ---
>>> Waking up in 1 seconds...
>>> --- Walking the entire request list ---
>>> Waking up in 1 seconds...
>>> --- Walking the entire request list ---
>>> Sending Access-Reject of id 101 to 127.0.0.1:32792
>>> Waking up in 4 seconds...
>>> --- Walking the entire request list ---
>>> Cleaning up request 0 ID 101 with timestamp 3ef0694c
>>> Nothing to do. Sleeping until we see a request.
>>>
>>> ______________________________________
>>> Paco Orozco (***@upcnet.es)
>>> Divisió de Telecomunicacions
>>> UPCNet
>>> Edifici Vèrtex - Pl. Eusebi Güell, 6
>>> Telèfon centraleta: 93.40.11600
>>
>>
>>
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
>>
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
>>
>
>
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>



-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Ron Wahler]

The OpenLDAP build was part of the freeradius build or did you do them
separate? Our LDAP is not on the server it is on another box.

How did you get the certificates installed?
How did you get them to validate?



-----Original Message-----
From: Owen DeLong [mailto:***@delong.com]
Sent: Wednesday, June 18, 2003 10:28 AM
To: freeradius-***@lists.cistron.nl
Subject: RE: RADIUS + LDAP + TLS

No... The OpenLDAP libraries used to build Freeradius already handle
all of that for you. At least in my case, it just worked, except for
that niggling issue of the self-signed certificate. If your LDAP
server is already set up to handle SSL connections, that should be
all you need.

Owen


--On Wednesday, June 18, 2003 9:58 AM -0600 Ron Wahler
<***@rovingplanet.com> wrote:

>
> Yes, but how do you set up the SSL tunnel and get the certificates to
> validate to the LDAP server? are you using stunnel ?
>
> Ron.
>
> -----Original Message-----
> From: Owen DeLong [mailto:***@delong.com]
> Sent: Wednesday, June 18, 2003 9:55 AM
> To: freeradius-***@lists.cistron.nl
> Subject: RE: RADIUS + LDAP + TLS
>
> Yes... Don't remember exactly where I found it, but, if you have LDAP
> working, then it's just a matter of adding a port=669 phrase to the
> configuration file (radiusd.conf) where you specify the ldap server.
>
> Owen
>
> --On Wednesday, June 18, 2003 9:40 AM -0600 Ron Wahler
> <***@rovingplanet.com> wrote:
>
>>
>> Is there a description someplace that would show how
>> to setup an SSL connection from Freeradius to an external LDAP
> database.
>>
>> Thanks,
>> Ron.
>>
>> -----Original Message-----
>> From: Owen DeLong [mailto:***@delong.com]
>> Sent: Wednesday, June 18, 2003 9:05 AM
>> To: freeradius-***@lists.cistron.nl
>> Subject: Re: RADIUS + LDAP + TLS
>>
>> I don't know how to get TLS to work, but you should be able to do
>> SSL by specifying that the LDAP port to use is 669 (LDAPs) in
>> your radius.conf. I'm, however, having a similar problem in that
>> I am unable to get it to work because of a complaint about a
> self-signed
>> certificate. If you have any ideas on how to rectify that one, I'd
>> appreciate it. I've posted my question to the list twice and have
>> received zero response.
>>
>> Owen
>>
>>
>> --On Wednesday, June 18, 2003 12:32 PM +0200 "Francisco
Orozco/Upcnet"
>> <***@upcnet.es> wrote:
>>
>>> Hello to all,
>>>
>>> I've been using FreeRadius for a year, but now I'd like to implement
>>> RADIUS with LDAP authentication, I've test it and It works great.
>>>
>>> Now I'd like to protect radius - ldap server comunication using TLS.
>> But
>>> I'm not able to do it.
>>>
>>> My LDAP server is Notes Domino and I've been able to configure it
>>> correctly. I can connect to it using LDAP SSL/TLS, but I don't know
>> how
>>> to implement this in FreeRadius.
>>>
>>> I'm using freeradius-0.8.1 and this is my radiusd.conf
>>>
>>>
>>>
>>> Can you help me?
>>>
>>> When I try i view this log:
>>>
>>> rad_recv: Access-Request packet from host 127.0.0.1:32792, id=101,
>>> length=60
>>> User-Name = "test"
>>> User-Password = "1234567890"
>>> NAS-IP-Address = 255.255.255.255
>>> NAS-Port = 1
>>> rad_lowerpair: User-Name now 'test'
>>> rad_lowerpair: User-Password now '1234567890'
>>> modcall: entering group authorize
>>> rlm_ldap: - authorize
>>> rlm_ldap: performing user authorization for test
>>> radius_xlat: '(uid=test)'
>>> radius_xlat: 'o=Prova'
>>> ldap_get_conn: Got Id: 0
>>> rlm_ldap: attempting LDAP reconnection
>>> rlm_ldap: (re)connect to ldap.server.mycompany.es:636,
authentication
>> 0
>>> rlm_ldap: setting TLS mode to 1
>>> rlm_ldap: starting TLS
>>> rlm_ldap: ldap_start_tls_s()
>>> rlm_ldap: could not start TLS Protocol error
>>> rlm_ldap: (re)connection attempt failed
>>> rlm_ldap: search failed
>>> ldap_release_conn: Release Id: 0
>>> modcall[authorize]: module "ldap" returns fail
>>> modcall: group authorize returns fail
>>> There was no response configured: rejecting request 0
>>> Server rejecting request 0.
>>> Finished request 0
>>> Going to the next request
>>> --- Walking the entire request list ---
>>> Waking up in 1 seconds...
>>> --- Walking the entire request list ---
>>> Waking up in 1 seconds...
>>> --- Walking the entire request list ---
>>> Sending Access-Reject of id 101 to 127.0.0.1:32792
>>> Waking up in 4 seconds...
>>> --- Walking the entire request list ---
>>> Cleaning up request 0 ID 101 with timestamp 3ef0694c
>>> Nothing to do. Sleeping until we see a request.
>>>
>>> ______________________________________
>>> Paco Orozco (***@upcnet.es)
>>> Divisió de Telecomunicacions
>>> UPCNet
>>> Edifici Vèrtex - Pl. Eusebi Güell, 6
>>> Telèfon centraleta: 93.40.11600
>>
>>
>>
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
>>
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
>>
>
>
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>



-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Owen DeLong]

When you built rlm_ldap, you needed some sort of LDAP library for
it. Usually, this is OpenLDAP. If you used something else, I'm not
sure what to tell you. In my case, I built FreeRadius and the rlm_ldap
module at the same time. I don't know what you did. I didn't install
a certificate on the RADIUS server. I used an existing LDAP server run
by IT which has a self-signed certificate on it. I don't know how they
installed the certificate, and that would depend on the LDAP server in use
anyway. As to validation, I haven't been able to get them to validate
because FreeRadius is rejecting the self-signed certificate from the LDAP
server.

I got the impression from your original email that you had the LDAP
server already working with LDAPs. If that's not the case, you first
need to get a working LDAPs server (LDAP over SSL). This is not something
I can help you with.

Once that is done, getting RADIUS to be another client of that LDAPs
server should simply be a matter of changing the port number in the
radiusd.conf from what was working with the LDAP server.

Owen


--On Wednesday, June 18, 2003 10:51 -0600 Ron Wahler <***@rovingplanet.com>
wrote:

>
> The OpenLDAP build was part of the freeradius build or did you do them
> separate? Our LDAP is not on the server it is on another box.
>
> How did you get the certificates installed?
> How did you get them to validate?
>
>
>
> -----Original Message-----
> From: Owen DeLong [mailto:***@delong.com]
> Sent: Wednesday, June 18, 2003 10:28 AM
> To: freeradius-***@lists.cistron.nl
> Subject: RE: RADIUS + LDAP + TLS
>
> No... The OpenLDAP libraries used to build Freeradius already handle
> all of that for you. At least in my case, it just worked, except for
> that niggling issue of the self-signed certificate. If your LDAP
> server is already set up to handle SSL connections, that should be
> all you need.
>
> Owen
>
>
> --On Wednesday, June 18, 2003 9:58 AM -0600 Ron Wahler
> <***@rovingplanet.com> wrote:
>
>>
>> Yes, but how do you set up the SSL tunnel and get the certificates to
>> validate to the LDAP server? are you using stunnel ?
>>
>> Ron.
>>
>> -----Original Message-----
>> From: Owen DeLong [mailto:***@delong.com]
>> Sent: Wednesday, June 18, 2003 9:55 AM
>> To: freeradius-***@lists.cistron.nl
>> Subject: RE: RADIUS + LDAP + TLS
>>
>> Yes... Don't remember exactly where I found it, but, if you have LDAP
>> working, then it's just a matter of adding a port=669 phrase to the
>> configuration file (radiusd.conf) where you specify the ldap server.
>>
>> Owen
>>
>> --On Wednesday, June 18, 2003 9:40 AM -0600 Ron Wahler
>> <***@rovingplanet.com> wrote:
>>
>>>
>>> Is there a description someplace that would show how
>>> to setup an SSL connection from Freeradius to an external LDAP
>> database.
>>>
>>> Thanks,
>>> Ron.
>>>
>>> -----Original Message-----
>>> From: Owen DeLong [mailto:***@delong.com]
>>> Sent: Wednesday, June 18, 2003 9:05 AM
>>> To: freeradius-***@lists.cistron.nl
>>> Subject: Re: RADIUS + LDAP + TLS
>>>
>>> I don't know how to get TLS to work, but you should be able to do
>>> SSL by specifying that the LDAP port to use is 669 (LDAPs) in
>>> your radius.conf. I'm, however, having a similar problem in that
>>> I am unable to get it to work because of a complaint about a
>> self-signed
>>> certificate. If you have any ideas on how to rectify that one, I'd
>>> appreciate it. I've posted my question to the list twice and have
>>> received zero response.
>>>
>>> Owen
>>>
>>>
>>> --On Wednesday, June 18, 2003 12:32 PM +0200 "Francisco
> Orozco/Upcnet"
>>> <***@upcnet.es> wrote:
>>>
>>>> Hello to all,
>>>>
>>>> I've been using FreeRadius for a year, but now I'd like to implement
>>>> RADIUS with LDAP authentication, I've test it and It works great.
>>>>
>>>> Now I'd like to protect radius - ldap server comunication using TLS.
>>> But
>>>> I'm not able to do it.
>>>>
>>>> My LDAP server is Notes Domino and I've been able to configure it
>>>> correctly. I can connect to it using LDAP SSL/TLS, but I don't know
>>> how
>>>> to implement this in FreeRadius.
>>>>
>>>> I'm using freeradius-0.8.1 and this is my radiusd.conf
>>>>
>>>>
>>>>
>>>> Can you help me?
>>>>
>>>> When I try i view this log:
>>>>
>>>> rad_recv: Access-Request packet from host 127.0.0.1:32792, id=101,
>>>> length=60
>>>> User-Name = "test"
>>>> User-Password = "1234567890"
>>>> NAS-IP-Address = 255.255.255.255
>>>> NAS-Port = 1
>>>> rad_lowerpair: User-Name now 'test'
>>>> rad_lowerpair: User-Password now '1234567890'
>>>> modcall: entering group authorize
>>>> rlm_ldap: - authorize
>>>> rlm_ldap: performing user authorization for test
>>>> radius_xlat: '(uid=test)'
>>>> radius_xlat: 'o=Prova'
>>>> ldap_get_conn: Got Id: 0
>>>> rlm_ldap: attempting LDAP reconnection
>>>> rlm_ldap: (re)connect to ldap.server.mycompany.es:636,
> authentication
>>> 0
>>>> rlm_ldap: setting TLS mode to 1
>>>> rlm_ldap: starting TLS
>>>> rlm_ldap: ldap_start_tls_s()
>>>> rlm_ldap: could not start TLS Protocol error
>>>> rlm_ldap: (re)connection attempt failed
>>>> rlm_ldap: search failed
>>>> ldap_release_conn: Release Id: 0
>>>> modcall[authorize]: module "ldap" returns fail
>>>> modcall: group authorize returns fail
>>>> There was no response configured: rejecting request 0
>>>> Server rejecting request 0.
>>>> Finished request 0
>>>> Going to the next request
>>>> --- Walking the entire request list ---
>>>> Waking up in 1 seconds...
>>>> --- Walking the entire request list ---
>>>> Waking up in 1 seconds...
>>>> --- Walking the entire request list ---
>>>> Sending Access-Reject of id 101 to 127.0.0.1:32792
>>>> Waking up in 4 seconds...
>>>> --- Walking the entire request list ---
>>>> Cleaning up request 0 ID 101 with timestamp 3ef0694c
>>>> Nothing to do. Sleeping until we see a request.
>>>>
>>>> ______________________________________
>>>> Paco Orozco (***@upcnet.es)
>>>> Divisió de Telecomunicacions
>>>> UPCNet
>>>> Edifici Vèrtex - Pl. Eusebi Güell, 6
>>>> Telèfon centraleta: 93.40.11600
>>>
>>>
>>>
>>> -
>>> List info/subscribe/unsubscribe? See
>>> http://www.freeradius.org/list/users.html
>>>
>>> -
>>> List info/subscribe/unsubscribe? See
>>> http://www.freeradius.org/list/users.html
>>>
>>
>>
>>
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
>>
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
>>
>
>
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>





-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Francisco Orozco/Upcnet]

Hiya,

> When you built rlm_ldap, you needed some sort of LDAP library for
> it. Usually, this is OpenLDAP. If you used something else, I'm not
> sure what to tell you. In my case, I built FreeRadius and the rlm_ldap
> module at the same time. I don't know what you did. I didn't install
> a certificate on the RADIUS server. I used an existing LDAP server run
> by IT which has a self-signed certificate on it. I don't know how they
> installed the certificate, and that would depend on the LDAP server in
use
> anyway. As to validation, I haven't been able to get them to validate
> because FreeRadius is rejecting the self-signed certificate from the
LDAP
> server.

I've compiled FreeRadius and rlm_ldap, without installing any LDAP package
(like OpenLDAP), I've only untar FreeRadius, then ./configure, and make.
But I suppose that it has LDAP support, because I've been able to
authenticate users using LDAP.

On RADIUS server I haven't install any certificate, I don't know how. I've
configured my RADIUS server in order to use LDAP as authentication
database and I det to yes "start_tls" and "tls_mode".

> I got the impression from your original email that you had the LDAP
> server already working with LDAPs. If that's not the case, you first
> need to get a working LDAPs server (LDAP over SSL). This is not
something
> I can help you with.

Yes, I've got an LDAPs (LDAP over SSL) server working. But I'm not able to
contact it from RADIUS. If I try to contact to LDAPs server from Outlook
(for example) I need to install my CA certificate, to validate
authentication of LDAPs. Dous RADIUS need some similar?

> Once that is done, getting RADIUS to be another client of that LDAPs
> server should simply be a matter of changing the port number in the
> radiusd.conf from what was working with the LDAP server.

I've do it, but i get an error "could not start TLS protocol". See my log.

Maybe I'm forgetting something. I've saw some TLS parameters in EAP
section of radiusd.conf, but I haven't used it... Is it ok?

> >>>>
> >>>> rad_recv: Access-Request packet from host 127.0.0.1:32792, id=101,
> >>>> length=60
> >>>> User-Name = "test"
> >>>> User-Password = "1234567890"
> >>>> NAS-IP-Address = 255.255.255.255
> >>>> NAS-Port = 1
> >>>> rad_lowerpair: User-Name now 'test'
> >>>> rad_lowerpair: User-Password now '1234567890'
> >>>> modcall: entering group authorize
> >>>> rlm_ldap: - authorize
> >>>> rlm_ldap: performing user authorization for test
> >>>> radius_xlat: '(uid=test)'
> >>>> radius_xlat: 'o=Prova'
> >>>> ldap_get_conn: Got Id: 0
> >>>> rlm_ldap: attempting LDAP reconnection
> >>>> rlm_ldap: (re)connect to ldap.server.mycompany.es:636,
> > authentication
> >>> 0
> >>>> rlm_ldap: setting TLS mode to 1
> >>>> rlm_ldap: starting TLS
> >>>> rlm_ldap: ldap_start_tls_s()
> >>>> rlm_ldap: could not start TLS Protocol error
> >>>> rlm_ldap: (re)connection attempt failed
> >>>> rlm_ldap: search failed
> >>>> ldap_release_conn: Release Id: 0
> >>>> modcall[authorize]: module "ldap" returns fail
> >>>> modcall: group authorize returns fail
> >>>> There was no response configured: rejecting request 0
> >>>> Server rejecting request 0.
> >>>> Finished request 0
> >>>> Going to the next request
> >>>> --- Walking the entire request list ---
> >>>> Waking up in 1 seconds...
> >>>> --- Walking the entire request list ---
> >>>> Waking up in 1 seconds...
> >>>> --- Walking the entire request list ---
> >>>> Sending Access-Reject of id 101 to 127.0.0.1:32792
> >>>> Waking up in 4 seconds...
> >>>> --- Walking the entire request list ---
> >>>> Cleaning up request 0 ID 101 with timestamp 3ef0694c
> >>>> Nothing to do. Sleeping until we see a request.

______________________________________
Paco Orozco (***@upcnet.es)
Divisió de Telecomunicacions
UPCNet
Edifici Vèrtex - Pl. Eusebi Güell, 6
Telèfon centraleta: 93.40.11600


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Owen DeLong]

I think there must have been some sort of LDAP library on the system
where you built FreeRadius.

I don't know about TLS. As I said, I was using SSL. I get a different
error, telling me that it doesn't like the self-signed certificate.

As to installing the CA certificate, that depends on the TLS/SSL library
you are using and how it was built.

Owen


--On Thursday, June 19, 2003 9:18 AM +0200 "Francisco Orozco/Upcnet"
<***@upcnet.es> wrote:

> Hiya,
>
>> When you built rlm_ldap, you needed some sort of LDAP library for
>> it. Usually, this is OpenLDAP. If you used something else, I'm not
>> sure what to tell you. In my case, I built FreeRadius and the rlm_ldap
>> module at the same time. I don't know what you did. I didn't install
>> a certificate on the RADIUS server. I used an existing LDAP server run
>> by IT which has a self-signed certificate on it. I don't know how they
>> installed the certificate, and that would depend on the LDAP server in
> use
>> anyway. As to validation, I haven't been able to get them to validate
>> because FreeRadius is rejecting the self-signed certificate from the
> LDAP
>> server.
>
> I've compiled FreeRadius and rlm_ldap, without installing any LDAP
> package (like OpenLDAP), I've only untar FreeRadius, then ./configure,
> and make. But I suppose that it has LDAP support, because I've been able
> to authenticate users using LDAP.
>
> On RADIUS server I haven't install any certificate, I don't know how.
> I've configured my RADIUS server in order to use LDAP as authentication
> database and I det to yes "start_tls" and "tls_mode".
>
>> I got the impression from your original email that you had the LDAP
>> server already working with LDAPs. If that's not the case, you first
>> need to get a working LDAPs server (LDAP over SSL). This is not
> something
>> I can help you with.
>
> Yes, I've got an LDAPs (LDAP over SSL) server working. But I'm not able
> to contact it from RADIUS. If I try to contact to LDAPs server from
> Outlook (for example) I need to install my CA certificate, to validate
> authentication of LDAPs. Dous RADIUS need some similar?
>
>> Once that is done, getting RADIUS to be another client of that LDAPs
>> server should simply be a matter of changing the port number in the
>> radiusd.conf from what was working with the LDAP server.
>
> I've do it, but i get an error "could not start TLS protocol". See my log.
>
> Maybe I'm forgetting something. I've saw some TLS parameters in EAP
> section of radiusd.conf, but I haven't used it... Is it ok?
>
>> >>>>
>> >>>> rad_recv: Access-Request packet from host 127.0.0.1:32792, id=101,
>> >>>> length=60
>> >>>> User-Name = "test"
>> >>>> User-Password = "1234567890"
>> >>>> NAS-IP-Address = 255.255.255.255
>> >>>> NAS-Port = 1
>> >>>> rad_lowerpair: User-Name now 'test'
>> >>>> rad_lowerpair: User-Password now '1234567890'
>> >>>> modcall: entering group authorize
>> >>>> rlm_ldap: - authorize
>> >>>> rlm_ldap: performing user authorization for test
>> >>>> radius_xlat: '(uid=test)'
>> >>>> radius_xlat: 'o=Prova'
>> >>>> ldap_get_conn: Got Id: 0
>> >>>> rlm_ldap: attempting LDAP reconnection
>> >>>> rlm_ldap: (re)connect to ldap.server.mycompany.es:636,
>> > authentication
>> >>> 0
>> >>>> rlm_ldap: setting TLS mode to 1
>> >>>> rlm_ldap: starting TLS
>> >>>> rlm_ldap: ldap_start_tls_s()
>> >>>> rlm_ldap: could not start TLS Protocol error
>> >>>> rlm_ldap: (re)connection attempt failed
>> >>>> rlm_ldap: search failed
>> >>>> ldap_release_conn: Release Id: 0
>> >>>> modcall[authorize]: module "ldap" returns fail
>> >>>> modcall: group authorize returns fail
>> >>>> There was no response configured: rejecting request 0
>> >>>> Server rejecting request 0.
>> >>>> Finished request 0
>> >>>> Going to the next request
>> >>>> --- Walking the entire request list ---
>> >>>> Waking up in 1 seconds...
>> >>>> --- Walking the entire request list ---
>> >>>> Waking up in 1 seconds...
>> >>>> --- Walking the entire request list ---
>> >>>> Sending Access-Reject of id 101 to 127.0.0.1:32792
>> >>>> Waking up in 4 seconds...
>> >>>> --- Walking the entire request list ---
>> >>>> Cleaning up request 0 ID 101 with timestamp 3ef0694c
>> >>>> Nothing to do. Sleeping until we see a request.
>
> ______________________________________
> Paco Orozco (***@upcnet.es)
> Divisió de Telecomunicacions
> UPCNet
> Edifici Vèrtex - Pl. Eusebi Güell, 6
> Telèfon centraleta: 93.40.11600
>
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>



-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Francisco Orozco/Upcnet]

Hiya,

I'm bit confused. I'd like to use, as I mentioned, RADIUS + LDAP over
encripted comunications (TLS).

I order to user RADIUS + LDAP I've compiled FreeRadius, but I haven't
installed any OpenLDAP SDK. Then I've configured radiusd.conf as mentioned
in past messages.

I try it and It works great. I can authenticate users via LDAP.

When I try to use TLS I've configured radiusd.conf parameters:
"stat_tls=yes" "tls_mode=yes" "port=636"

It's not working, see log. "Protocol Error", It means that I need to
compile something.

I don't want to authenticate LDAP server from RADIUS, so I doesn't need to
install OpenSSL and CA certificates. I only want to encrypt RADIUS - LDAP
comunication, without ensuring identity of any.

Please... can you put some light on my work????

> >> >>>>
> >> >>>> rad_recv: Access-Request packet from host 127.0.0.1:32792,
id=101,
> >> >>>> length=60
> >> >>>> User-Name = "test"
> >> >>>> User-Password = "1234567890"
> >> >>>> NAS-IP-Address = 255.255.255.255
> >> >>>> NAS-Port = 1
> >> >>>> rad_lowerpair: User-Name now 'test'
> >> >>>> rad_lowerpair: User-Password now '1234567890'
> >> >>>> modcall: entering group authorize
> >> >>>> rlm_ldap: - authorize
> >> >>>> rlm_ldap: performing user authorization for test
> >> >>>> radius_xlat: '(uid=test)'
> >> >>>> radius_xlat: 'o=Prova'
> >> >>>> ldap_get_conn: Got Id: 0
> >> >>>> rlm_ldap: attempting LDAP reconnection
> >> >>>> rlm_ldap: (re)connect to ldap.server.mycompany.es:636,
> >> > authentication
> >> >>> 0
> >> >>>> rlm_ldap: setting TLS mode to 1
> >> >>>> rlm_ldap: starting TLS
> >> >>>> rlm_ldap: ldap_start_tls_s()
> >> >>>> rlm_ldap: could not start TLS Protocol error
> >> >>>> rlm_ldap: (re)connection attempt failed
> >> >>>> rlm_ldap: search failed
> >> >>>> ldap_release_conn: Release Id: 0
> >> >>>> modcall[authorize]: module "ldap" returns fail
> >> >>>> modcall: group authorize returns fail
> >> >>>> There was no response configured: rejecting request 0
> >> >>>> Server rejecting request 0.
> >> >>>> Finished request 0
> >> >>>> Going to the next request
> >> >>>> --- Walking the entire request list ---
> >> >>>> Waking up in 1 seconds...
> >> >>>> --- Walking the entire request list ---
> >> >>>> Waking up in 1 seconds...
> >> >>>> --- Walking the entire request list ---
> >> >>>> Sending Access-Reject of id 101 to 127.0.0.1:32792
> >> >>>> Waking up in 4 seconds...
> >> >>>> --- Walking the entire request list ---
> >> >>>> Cleaning up request 0 ID 101 with timestamp 3ef0694c
> >> >>>> Nothing to do. Sleeping until we see a request.

______________________________________
Paco Orozco (***@upcnet.es)
Divisió de Telecomunicacions
UPCNet
Edifici Vèrtex - Pl. Eusebi Güell, 6
Telèfon centraleta: 93.40.11600


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Kostas Kalevras]

On Fri, 20 Jun 2003, Francisco Orozco/Upcnet wrote:

> Hiya,
>
> I'm bit confused. I'd like to use, as I mentioned, RADIUS + LDAP over
> encripted comunications (TLS).
>
> I order to user RADIUS + LDAP I've compiled FreeRadius, but I haven't
> installed any OpenLDAP SDK. Then I've configured radiusd.conf as mentioned
> in past messages.
>
> I try it and It works great. I can authenticate users via LDAP.
>
> When I try to use TLS I've configured radiusd.conf parameters:
> "stat_tls=yes" "tls_mode=yes" "port=636"

StartTLS is an extended operation for starting TLS while connecting to the
normal ldap port (389). I would suggest
start_tls=yes,tls_mode=no and port=389

I think that the tls_mode directive should go away completely and start_tls only
be allowed if we don't use the ldaps port. But I am not sure that the above is
correct.

>
> It's not working, see log. "Protocol Error", It means that I need to
> compile something.
>
> I don't want to authenticate LDAP server from RADIUS, so I doesn't need to
> install OpenSSL and CA certificates. I only want to encrypt RADIUS - LDAP
> comunication, without ensuring identity of any.
>
> Please... can you put some light on my work????
>
> > >> >>>>
> > >> >>>> rad_recv: Access-Request packet from host 127.0.0.1:32792,
> id=101,
> > >> >>>> length=60
> > >> >>>> User-Name = "test"
> > >> >>>> User-Password = "1234567890"
> > >> >>>> NAS-IP-Address = 255.255.255.255
> > >> >>>> NAS-Port = 1
> > >> >>>> rad_lowerpair: User-Name now 'test'
> > >> >>>> rad_lowerpair: User-Password now '1234567890'
> > >> >>>> modcall: entering group authorize
> > >> >>>> rlm_ldap: - authorize
> > >> >>>> rlm_ldap: performing user authorization for test
> > >> >>>> radius_xlat: '(uid=test)'
> > >> >>>> radius_xlat: 'o=Prova'
> > >> >>>> ldap_get_conn: Got Id: 0
> > >> >>>> rlm_ldap: attempting LDAP reconnection
> > >> >>>> rlm_ldap: (re)connect to ldap.server.mycompany.es:636,
> > >> > authentication
> > >> >>> 0
> > >> >>>> rlm_ldap: setting TLS mode to 1
> > >> >>>> rlm_ldap: starting TLS
> > >> >>>> rlm_ldap: ldap_start_tls_s()
> > >> >>>> rlm_ldap: could not start TLS Protocol error
> > >> >>>> rlm_ldap: (re)connection attempt failed
> > >> >>>> rlm_ldap: search failed
> > >> >>>> ldap_release_conn: Release Id: 0
> > >> >>>> modcall[authorize]: module "ldap" returns fail
> > >> >>>> modcall: group authorize returns fail
> > >> >>>> There was no response configured: rejecting request 0
> > >> >>>> Server rejecting request 0.
> > >> >>>> Finished request 0
> > >> >>>> Going to the next request
> > >> >>>> --- Walking the entire request list ---
> > >> >>>> Waking up in 1 seconds...
> > >> >>>> --- Walking the entire request list ---
> > >> >>>> Waking up in 1 seconds...
> > >> >>>> --- Walking the entire request list ---
> > >> >>>> Sending Access-Reject of id 101 to 127.0.0.1:32792
> > >> >>>> Waking up in 4 seconds...
> > >> >>>> --- Walking the entire request list ---
> > >> >>>> Cleaning up request 0 ID 101 with timestamp 3ef0694c
> > >> >>>> Nothing to do. Sleeping until we see a request.
>
> ______________________________________
> Paco Orozco (***@upcnet.es)
> Divisi? de Telecomunicacions
> UPCNet
> Edifici V?rtex - Pl. Eusebi G?ell, 6
> Tel?fon centraleta: 93.40.11600
>
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>

--
Kostas Kalevras Network Operations Center
***@noc.ntua.gr National Technical University of Athens, Greece
Work Phone: [phone]
'Go back to the shadow' Gandalf

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Francisco Orozco/Upcnet]

Hiya,

> StartTLS is an extended operation for starting TLS while connecting to
the
> normal ldap port (389). I would suggest
> start_tls=yes,tls_mode=no and port=389
>
> I think that the tls_mode directive should go away completely and
> start_tls only
> be allowed if we don't use the ldaps port. But I am not sure that the
above is
> correct.

Is necessary install OpenSSL or other software in order to use TLS with
RADIUS?

This is my big dude!!!!

______________________________________
Paco Orozco (***@upcnet.es)
Divisió de Telecomunicacions
UPCNet
Edifici Vèrtex - Pl. Eusebi Güell, 6
Telèfon centraleta: 93.40.11600

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Kostas Kalevras]

On Fri, 20 Jun 2003, Francisco Orozco/Upcnet wrote:

> Hiya,
>
> > StartTLS is an extended operation for starting TLS while connecting to
> the
> > normal ldap port (389). I would suggest
> > start_tls=yes,tls_mode=no and port=389
> >
> > I think that the tls_mode directive should go away completely and
> > start_tls only
> > be allowed if we don't use the ldaps port. But I am not sure that the
> above is
> > correct.
>
> Is necessary install OpenSSL or other software in order to use TLS with
> RADIUS?

Yes you must install OpenSSL for TLS to even be available in compile time.

>
> This is my big dude!!!!
>
> ______________________________________
> Paco Orozco (***@upcnet.es)
> Divisi? de Telecomunicacions
> UPCNet
> Edifici V?rtex - Pl. Eusebi G?ell, 6
> Tel?fon centraleta: 93.40.11600
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>

--
Kostas Kalevras Network Operations Center
***@noc.ntua.gr National Technical University of Athens, Greece
Work Phone: [phone]
'Go back to the shadow' Gandalf

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[Owen DeLong]

> Hiya,
>
> I'm bit confused. I'd like to use, as I mentioned, RADIUS + LDAP over
> encripted comunications (TLS).
>
> I order to user RADIUS + LDAP I've compiled FreeRadius, but I haven't
> installed any OpenLDAP SDK. Then I've configured radiusd.conf as mentioned
> in past messages.
>
> I try it and It works great. I can authenticate users via LDAP.
>
This is a surprise. Where did rlm_ldap get it's LDAP libraries
if you don't have Open LDAP installed?

> When I try to use TLS I've configured radiusd.conf parameters:
> "stat_tls=yes" "tls_mode=yes" "port=636"
>
This is because you are confusing TLS and SSL. Port 636 is for SSL.
TLS is different. It works over the regular 389 port. Not all LDAP
servers support either one. If your LDAP server supports one or the
other (few support both), you need to figure out which one. If
it's TLS, you want:

"start_tls=yes" "tls_mode=yes" "port=389"

If it's SSL, you want:
"start_tls=no" "tls_mode=no" "port=636"


> It's not working, see log. "Protocol Error", It means that I need to
> compile something.
>
That may also be necessary, but, Protocol Error alone doesn't necessarily
mean that.

> I don't want to authenticate LDAP server from RADIUS, so I doesn't need to
> install OpenSSL and CA certificates. I only want to encrypt RADIUS - LDAP
> comunication, without ensuring identity of any.
>
Right... You need to decide whether you want SSL or TLS, the configure
accordingly.

> Please... can you put some light on my work????
>
Hope this helps.

Owen


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html