[rad] Cannot Authenticate - Help!

[Charles Gregory]

I notice it matching multiple 'DEFAULT' entries in your 'users' file.
Make sure that one of them doesn't enforce an 'auth-type' other than 
the one you want to use here.....

- Charles

On Wed, 17 Jun 2009, Filipe Scalioni wrote:
> I'm new to FreeRadius, and I'm having some hard time to put it to
> work. Simply talking: I can authenticate from my linux (Suse 11.1)
> using radtest, directly linked to the server (LAN). Here is the
> answer:
>
> protagoras:~ # radtest teste teste 192.168.10.113:1812 1812 testing123
> Sending Access-Request of id 240 to 192.168.10.113 port 1812
>         User-Name = "teste"
>         User-Password = "teste"
>         NAS-IP-Address = 127.0.0.2
>         NAS-Port = 1812
> rad_recv: Access-Accept packet from host 192.168.10.113 port 1812,
> id=240, length=20
>
> So, it works... But then I put the AP to work (Linksys wrt54g),
> configured like this:
>
> Security mode: WPA Enterprise
> WPA Algorithms: TKIP
> RADIUS Server Address: 192.168.10.113 - this is my RADIUS server IP
> RADIUS Port: 1812
> Shared Key: testing123
> Key Renewal Timeout: 3600 seconds
>
> All good, but when I try to connect from Windows XP, Vista or 7,
> configured like this
>
> Network Authentication: WPA
> Data Encryption: TKIP
> EAP Type: PEAP
> Authentication Method: MsCHAPv2
> Not sending my windows login parameters
>
> It nevers authenticates... No matter what I do. I tried everything I
> could find on the list or FAQ before registering. Here goes the log
>
> [root at testecent raddb]# radiusd -X
> Starting - reading configuration files ...
> reread_config:  reading radiusd.conf
> Config:   including file: /etc/raddb/proxy.conf
> Config:   including file: /etc/raddb/clients.conf
> Config:   including file: /etc/raddb/snmp.conf
> Config:   including file: /etc/raddb/eap.conf
>  main: prefix = "/usr"
>  main: localstatedir = "/var"
>  main: logdir = "/var/log/radius"
>  main: libdir = "/usr/lib"
>  main: radacctdir = "/var/log/radius/radacct"
>  main: hostname_lookups = no
>  main: snmp = no
>  main: max_request_time = 30
>  main: cleanup_delay = 5
>  main: max_requests = 1024
>  main: delete_blocked_requests = 0
>  main: port = 1812
>  main: allow_core_dumps = no
>  main: log_stripped_names = no
>  main: log_file = "/var/log/radius/radius.log"
>  main: log_auth = yes
>  main: log_auth_badpass = yes
>  main: log_auth_goodpass = yes
>  main: pidfile = "/var/run/radiusd.pid"
>  main: bind_address = 192.168.10.113 IP address [192.168.10.113]
>  main: user = "radiusd"
>  main: group = "radiusd"
>  main: usercollide = no
>  main: lower_user = "no"
>  main: lower_pass = "no"
>  main: nospace_user = "no"
>  main: nospace_pass = "no"
>  main: checkrad = "/usr/sbin/checkrad"
>  main: proxy_requests = yes
>  proxy: retry_delay = 5
>  proxy: retry_count = 3
>  proxy: synchronous = no
>  proxy: default_fallback = yes
>  proxy: dead_time = 120
>  proxy: post_proxy_authorize = no
>  proxy: wake_all_if_all_dead = no
>  security: max_attributes = 200
>  security: reject_delay = 1
>  security: status_server = no
>  main: debug_level = 0
> read_config_files:  reading dictionary
> read_config_files:  reading naslist
> Using deprecated naslist file.  Support for this will go away soon.
> read_config_files:  reading clients
> read_config_files:  reading realms
> radiusd:  entering modules setup
> Module: Library search path is /usr/lib
> Module: Loaded exec
>  exec: wait = yes
>  exec: program = "(null)"
>  exec: input_pairs = "request"
>  exec: output_pairs = "(null)"
>  exec: packet_type = "(null)"
> rlm_exec: Wait=yes but no output defined. Did you mean output=none?
> Module: Instantiated exec (exec)
> Module: Loaded expr
> Module: Instantiated expr (expr)
> Module: Loaded PAP
>  pap: encryption_scheme = "clear"
> Module: Instantiated pap (pap)
> Module: Loaded CHAP
> Module: Instantiated chap (chap)
> Module: Loaded MS-CHAP
>  mschap: use_mppe = yes
>  mschap: require_encryption = no
>  mschap: require_strong = no
>  mschap: with_ntdomain_hack = yes
>  mschap: passwd = "(null)"
>  mschap: ntlm_auth = "/path/to/ntlm_auth --request-nt-key
> --username=%{Stripped-User-Name:-%{User-Name:-None}}
> --challenge=%{mschap:Challenge:-00}
> --nt-response=%{mschap:NT-Response:-00} --domain=%{mschap:NT-Domain}"
> Module: Instantiated mschap (mschap)
> Module: Loaded System
>  unix: cache = no
>  unix: passwd = "(null)"
>  unix: shadow = "(null)"
>  unix: group = "(null)"
>  unix: radwtmp = "/var/log/radius/radwtmp"
>  unix: usegroup = no
>  unix: cache_reload = 600
> Module: Instantiated unix (unix)
> Module: Loaded LDAP
>  ldap: server = "ldap.your.domain"
>  ldap: port = 389
>  ldap: net_timeout = 1
>  ldap: timeout = 4
>  ldap: timelimit = 3
>  ldap: identity = ""
>  ldap: tls_mode = no
>  ldap: start_tls = no
>  ldap: tls_cacertfile = "(null)"
>  ldap: tls_cacertdir = "(null)"
>  ldap: tls_certfile = "(null)"
>  ldap: tls_keyfile = "(null)"
>  ldap: tls_randfile = "(null)"
>  ldap: tls_require_cert = "allow"
>  ldap: password = ""
>  ldap: basedn = "o=My Org,c=UA"
>  ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
>  ldap: base_filter = "(objectclass=radiusprofile)"
>  ldap: default_profile = "(null)"
>  ldap: profile_attribute = "(null)"
>  ldap: password_header = "(null)"
>  ldap: password_attribute = "(null)"
>  ldap: access_attr = "dialupAccess"
>  ldap: groupname_attribute = "cn"
>  ldap: groupmembership_filter =
> "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
>  ldap: groupmembership_attribute = "(null)"
>  ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap"
>  ldap: ldap_debug = 0
>  ldap: ldap_connections_number = 5
>  ldap: compare_check_items = no
>  ldap: access_attr_used_for_allow = yes
>  ldap: do_xlat = yes
>  ldap: set_auth_type = yes
> rlm_ldap: Registering ldap_groupcmp for Ldap-Group
> rlm_ldap: Registering ldap_xlat with xlat_name ldap
> rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap
> rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$
> rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$
> rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type
> rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use
> rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id
> rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id
> rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password
> rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password
> rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT
> rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration
> rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address
> rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type
> rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol
> rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address
> rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask
> rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route
> rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing
> rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id
> rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU
> rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression
> rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host
> rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service
> rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port
> rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number
> rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id
> rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network
> rlm_ldap: LDAP radiusClass mapped to RADIUS Class
> rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout
> rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout
> rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action
> rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service
> rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node
> rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group
> rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link
> rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS
> Framed-AppleTalk-Network
> rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone
> rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit
> rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port
> rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message
> conns: 0x96835d0
> Module: Instantiated ldap (ldap)
> Module: Loaded eap
>  eap: default_eap_type = "md5"
>  eap: timer_expire = 60
>  eap: ignore_unknown_eap_types = no
>  eap: cisco_accounting_username_bug = no
> rlm_eap: Loaded and initialized type md5
> rlm_eap: Loaded and initialized type leap
>  gtc: challenge = "Password: "
>  gtc: auth_type = "PAP"
> rlm_eap: Loaded and initialized type gtc
>  mschapv2: with_ntdomain_hack = no
> rlm_eap: Loaded and initialized type mschapv2
> Module: Instantiated eap (eap)
> Module: Loaded files
>  files: usersfile = "/etc/raddb/users"
>  files: acctusersfile = "/etc/raddb/acct_users"
>  files: preproxy_usersfile = "/etc/raddb/preproxy_users"
>  files: compat = "no"
> Module: Instantiated files (files)
> Listening on authentication 192.168.10.113:1812
> Listening on accounting 192.168.10.113:1813
> Ready to process requests.
> rad_recv: Access-Request packet from host 192.168.10.40:2373, id=0, length=182
>         Message-Authenticator = 0xfa745a613580068b4534b34cf22f8724
>         Service-Type = Framed-User
>         User-Name = "backup"
>         Framed-MTU = 1488
>         Called-Station-Id = "00-1D-7E-5F-DF-AB:Metasys-Desktop"
>         Calling-Station-Id = "00-15-AF-CF-FE-DB"
>         NAS-Port-Type = Wireless-802.11
>         Connect-Info = "CONNECT 54Mbps 802.11g"
>         EAP-Message = 0x0200000b016261636b7570
>         NAS-IP-Address = 192.168.10.40
>         NAS-Port = 1
>         NAS-Port-Id = "STA port # 1"
>   Processing the authorize section of radiusd.conf
> modcall: entering group authorize for request 0
>   modcall[authorize]: module "chap" returns noop for request 0
>   modcall[authorize]: module "mschap" returns noop for request 0
>     users: Matched entry DEFAULT at line 152
>     users: Matched entry DEFAULT at line 171
>   modcall[authorize]: module "files" returns ok for request 0
> modcall: leaving group authorize (returns ok) for request 0
>   rad_check_password:  Found Auth-Type System
> auth: type "System"
>   Processing the authenticate section of radiusd.conf
> modcall: entering group authenticate for request 0
> rlm_unix: Attribute "User-Password" is required for authentication.
>   modcall[authenticate]: module "unix" returns invalid for request 0
> modcall: leaving group authenticate (returns invalid) for request 0
> auth: Failed to validate the user.
> Login incorrect: [backup/<no User-Password attribute>] (from client
> Linksys port 1 cli 00-15-AF-CF-FE-DB)
> Delaying request 0 for 1 seconds
> Finished request 0
> Going to the next request
> --- Walking the entire request list ---
> Waking up in 1 seconds...
> --- Walking the entire request list ---
> Waking up in 1 seconds...
> --- Walking the entire request list ---
> Sending Access-Reject of id 0 to 192.168.10.40 port 2373
> Waking up in 4 seconds...
> --- Walking the entire request list ---
> Cleaning up request 0 ID 0 with timestamp 4a490f7e
> Nothing to do.  Sleeping until we see a request.
>
>
> I have no idea how to fix it to make it read the password. I know it's
> authenticating as last method in my NIS, and it works flawlessly over
> the LAN with other linux client, like I said in the begining. Any help
> would be really appreciated, I need this to finish my Graduation!
>
> Thanks!
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>