Help, MS RAS as client radius

[Alessandro Agostini]

Hello,
I have this problem.

I have configured my windows server 2008 with RAS to send authenticate request
to my freeradius. The Authenticate method is PAP (insicure I know!).
With "radiusd -X" I see the following request and response:

rad_recv: Access-Request packet from host 149.xxx.xxx.xxx:51678, id=2, length=287
         Acct-Session-Id = "41"
         NAS-Identifier = "WINPDC2"
         NAS-IP-Address = 149.xxx.xxx.xxx
         Service-Type = Framed-User
         Framed-Protocol = PPP
         NAS-Port = 13
         NAS-Port-Type = Virtual
         Tunnel-Type:0 = PPTP
         Tunnel-Medium-Type:0 = IP
         Calling-Station-Id = "149.xxx.xxx.xxx"
         Tunnel-Client-Endpoint:0 = "149.xxx.xxx.xxx"
         User-Name = "agostini"
         User-Password = "zzzzzz"
         Microsoft-Attr-47 = 0x00000002
         MS-RAS-Vendor = 311
         MS-RAS-Version = "MSRASV5.20"
         Microsoft-Attr-35 = 0x4d5352415356352e323000
         Microsoft-Attr-34 = 0x4d535241532d302d4e422d43454400
         Microsoft-Attr-56 =
0x7b42454332384243412d343642442d343743342d393341462d3830464145383645413235447d
         Proxy-State = 0x1700000000000000fe8000000000000000000029
   Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 21
   modcall[authorize]: module "preprocess" returns ok for request 21
   modcall[authorize]: module "chap" returns noop for request 21
   modcall[authorize]: module "mschap" returns noop for request 21
     rlm_realm: No '@' in User-Name = "agostini", looking up realm NULL
     rlm_realm: No such realm "NULL"
   modcall[authorize]: module "suffix" returns noop for request 21
   rlm_eap: No EAP-Message, not doing EAP
   modcall[authorize]: module "eap" returns noop for request 21
radius_xlat:  'agostini'
rlm_sql (sql): sql_set_user escaped user --> 'agostini'
radius_xlat:  'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE
Username = 'agostini' AND scadenza-CURDATE()>=0 ORDER BY id'
rlm_sql (sql): Reserving sql socket id: 2
rlm_sql_mysql: query:  SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE
Username = 'agostini' AND scadenza-CURDATE()>=0 ORDER BY id
radius_xlat:  'SELECT
radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op 

  FROM radgroupcheck,radusergroup WHERE radusergroup.Username = 'agostini' AND
radusergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id'
rlm_sql_mysql: query:  SELECT
radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op 

  FROM radgroupcheck,radusergroup WHERE radusergroup.Username = 'agostini' AND
radusergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id
radius_xlat:  'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE
Username = 'agostini' ORDER BY id'
rlm_sql_mysql: query:  SELECT id,UserName,Attribute,Value,op FROM radreply WHERE
Username = 'agostini' ORDER BY id
radius_xlat:  'SELECT
radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op 

  FROM radgroupreply,radusergroup WHERE radusergroup.Username = 'agostini' AND
radusergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id'
rlm_sql_mysql: query:  SELECT
radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op 

  FROM radgroupreply,radusergroup WHERE radusergroup.Username = 'agostini' AND
radusergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id
rlm_sql (sql): Released sql socket id: 2
   modcall[authorize]: module "sql" returns ok for request 21
   modcall[authorize]: module "files" returns notfound for request 21
modcall: group authorize returns ok for request 21
auth: type Crypt
Login OK: [agostini/zzzzzz] (from client WinPDC port 13 cli 149.xxx.xxx.xxx)
Sending Access-Accept of id 2 to 149.xxx.xxx.xxx:51678
         Service-Type := Framed-User
         Tunnel-Private-Group-Id:0 := "ifac"
         Framed-Protocol := PPP
         Tunnel-Type:0 := PPTP
         Proxy-State = 0x1700000000000000fe8000000000000000000029
Finished request 21
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...


As you can see I have a mysql backend working with other clients(Wifi) and
apparently also with this client is  ok but on PC Windows I see an error and
authentication is not succesfull.
On "Event viewer" on Windows server I see this error message:
"The tunnel type RADIUS attribute for this user is not correct"

What is wrong?
I have tried to change it but without result.

Can you help me? I have to resolve this problem urgently. sigh!
Thanks in advance

Alessandro Agostini

-- 
Servizio informatica e comunicazioni
CNR - Istituto Fisica Applicata "N.Carrara"
Via Madonna del Piano,10 Sesto Fiorentino (FI)
---------------------------------------------
http://www.ifac.cnr.it - tel. 055 5226406