1. Networking
  2. Freeradius CHAP

Freeradius Authentication against OpenLDAP via CHAP

If you happen to run a freeradius-NAS, and you do not only want to support PAP but also CHAP, here's how I did it:

ldap-module-config:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

ldap {
 server = "localhost"
 identity = "cn=radius,ou=systemUsers,dc=yourdomain,dc=com"
 password = xxx
 basedn = "ou=users,dc=yourdomain,dc=com"
 filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(userRight=VPDN))"
 ldap_connections_number = 5
 timeout = 4
 timelimit = 3
 net_timeout = 1
 tls {
 start_tls = no
 }
 access_attr = "uid"
 dictionary_mapping = ${confdir}/ldap.attrmap
 set_auth_type = yes
}

The set_auth_type = yes is important, without this directive freeradius won't do the auth_type auto-find-out (PAP, CHAP, whatever). Now for chap to work, it is important to know that is only works if you have your password in clear-text in the ldap-database. This configuration supports either PAP or CHAP, whatever the client reqests. This is achieved by NOT setting the AUTH_TYPE in the users-File, but letting the modules decide on their own. This is my sites-enabled/default file:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

authorize {
 preprocess
 chap
 suffix
 files
 ldap
 expiration
 logintime
}
authenticate {
 Auth-Type CHAP {
 chap
 }
 Auth-Type LDAP {
 ldap
 }
}
preacct {
 preprocess
 acct_unique
 suffix
 files
}
accounting {
 detail
 unix
 radutmp
 exec
 attr_filter.accounting_response
}
session {
 radutmp
}
post-auth {
 exec
 Post-Auth-Type REJECT {
 attr_filter.access_reject
 }
}
pre-proxy {
}
post-proxy {
 eap
}

Here comes the important, rather undocumented part: Your ldap.attrmap must have an additional attribute mapping, called Cleartext-Password:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

checkItem $GENERIC$ radiusCheckItem
replyItem $GENERIC$ radiusReplyItem

checkItem Auth-Type radiusAuthType
checkItem Simultaneous-Use radiusSimultaneousUse
checkItem Called-Station-Id radiusCalledStationId
checkItem Calling-Station-Id radiusCallingStationId
checkItem LM-Password lmPassword
checkItem NT-Password ntPassword
checkItem LM-Password sambaLmPassword
checkItem NT-Password sambaNtPassword
checkItem LM-Password dBCSPwd
checkitem Password-With-Header userPassword
checkitem Cleartext-Password userPassword
checkItem SMB-Account-CTRL-TEXT acctFlags
checkItem Expiration radiusExpiration
checkItem NAS-IP-Address radiusNASIpAddress

replyItem Service-Type radiusServiceType
replyItem Framed-Protocol radiusFramedProtocol
replyItem Framed-IP-Address radiusFramedIPAddress
replyItem Framed-IP-Netmask radiusFramedIPNetmask
replyItem Framed-Route radiusFramedRoute
replyItem Framed-Routing radiusFramedRouting
replyItem Filter-Id radiusFilterId
replyItem Framed-MTU radiusFramedMTU
replyItem Framed-Compression radiusFramedCompression
replyItem Login-IP-Host radiusLoginIPHost
replyItem Login-Service radiusLoginService
replyItem Login-TCP-Port radiusLoginTCPPort
replyItem Callback-Number radiusCallbackNumber
replyItem Callback-Id radiusCallbackId
replyItem Framed-IPX-Network radiusFramedIPXNetwork
replyItem Class radiusClass
replyItem Session-Timeout radiusSessionTimeout
replyItem Idle-Timeout radiusIdleTimeout
replyItem Termination-Action radiusTerminationAction
replyItem Login-LAT-Service radiusLoginLATService
replyItem Login-LAT-Node radiusLoginLATNode
replyItem Login-LAT-Group radiusLoginLATGroup
replyItem Framed-AppleTalk-Link radiusFramedAppleTalkLink
replyItem Framed-AppleTalk-Network radiusFramedAppleTalkNetwork
replyItem Framed-AppleTalk-Zone radiusFramedAppleTalkZone
replyItem Port-Limit radiusPortLimit
replyItem Login-LAT-Port radiusLoginLATPort
replyItem Reply-Message radiusReplyMessage
replyItem Tunnel-Type radiusTunnelType
replyItem Tunnel-Medium-Type radiusTunnelMediumType
replyItem Tunnel-Private-Group-Id radiusTunnelPrivateGroupId

And for the pap-module I recommend setting the auto_header to yes, so it knows how to deal with the ldap-entries if they are hashed passwords and so on:

1
2
3

pap {
 auto_header = yes
}

Now this is basically it. Of course you also have to do the standard-setup like clients.conf, but this is already documented very whell somewhere else.

Last Update: 2013