<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
I cleaned the auth-type in users file.<br>
Everything is OK now on freeradius side. My second problem is the NAS
sending a null port. That's not a freeradius problem.<br>
<br>
Thanks<br>
<br>
Dom<br>
<br>
LALOT Dominique a écrit :
<blockquote cite="mid45B4726F.7060703@univ-aix.fr" type="cite">
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
Sorry,<br>
<br>
I didn't see your answer. I just got it via the archives.<br>
I explain a little bit more. We are using freeradius for VPN access,
which can be done using PPTP or IPSEC<br>
PPTP is done using mschap<br>
IPSEC is done using a shared group secret, then a classic ldap user
bind to check the identity.<br>
<br>
The ippool we use shall be common, so we can't split between to radius
configs.<br>
<br>
Our radiusd.conf was working for that without any problem for years,
just until we get a new release.<br>
freeradius 1.0.2-4sarge3 stable was OK<br>
<br>
Just moving, the behaviour changed<br>
I believe that there's somewhere a little difference that prevent a
working config:<br>
<br>
NOK rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type =
mschap'<br>
then rad_check_password: Found Auth-Type ldap<br>
<br>
OK rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP'<br>
Then rad_check_password: Found Auth-Type MS-CHAP<br>
<br>
I believe that mschap or MS-CHAP makes the difference.<br>
<br>
Dominique<br>
<br>
Alan DeKok a écrit :
<blockquote cite="mid45B094CD.9030606@deployingradius.com" type="cite">
<pre wrap="">LALOT Dominique wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Before, I was able to do LDAP or MSCHAP automatically.
I had and entry in users
lalot Auth-Type := ldap
</pre>
</blockquote>
<pre wrap=""><!---->
That will prevent MS-CHAP from working. See:
<a class="moz-txt-link-freetext"
href="http://deployingradius.com/documents/protocols/oracles.html">http://deployingradius.com/documents/protocols/oracles.html</a>
The short answer is DON'T SET Auth-Type.
And don't do LDAP "bind as user" if you can help it.
Alan DeKok.
--
<a class="moz-txt-link-freetext" href="http://deployingradius.com">http://deployingradius.com</a> - The web site of the book
<a class="moz-txt-link-freetext"
href="http://deployingradius.com/blog/">http://deployingradius.com/blog/</a> - The blog
-
List info/subscribe/unsubscribe? See <a class="moz-txt-link-freetext"
href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Dominique LALOT
Ingenieur Systeme et Reseaux
<a class="moz-txt-link-freetext"
href="http://annuaire.univmed.fr/showuser.php?uid=lalot">http://annuaire.univmed.fr/showuser.php?uid=lalot</a></pre>
<pre wrap="">
<hr size="4" width="90%">
-
List info/subscribe/unsubscribe? See <a class="moz-txt-link-freetext" href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a></pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Dominique LALOT
Ingenieur Systeme et Reseaux
<a class="moz-txt-link-freetext" href="http://annuaire.univmed.fr/showuser.php?uid=lalot">http://annuaire.univmed.fr/showuser.php?uid=lalot</a></pre>
</body>
</html>