<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt">thank you Alan<br>(i am on the FAQ)<br><br>user=maman<br>passwd= maman<br>is a sql based user.<br><br>trying peap with sql based user give error message, but trying it with Ad_based user give no error message, just don't connect...<br><br>with radtest:<br><br>radtest maman maman localhost 1812 testing123<br>Sending Access-Request of id 48 to 127.0.0.1 port 1812<br> User-Name = "maman"<br> User-Password = "maman"<br> NAS-IP-Address = 127.0.0.2<br> NAS-Port = 1812<br>rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=48, length=20<br><br><br><br>same credential with my Access-Point (part of
output).<br>---------------------------------------------------------------------------------------------<br><br> rlm_eap: Request found, released from the list<br> rlm_eap: EAP/mschapv2<br> rlm_eap: processing type mschapv2<br>+- entering group MS-CHAP<br> rlm_mschap: Told to do MS-CHAPv2 for maman with NT-Password<br> expand: --username=%{mschap:User-Name} -> --username=maman<br> mschap2: 64<br> expand: --challenge=%{mschap:Challenge:-00} -> --challenge=2ebb047f9367e21a<br> expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=9a350da9a792cd203c8bbc949a8522dc0540f2f6561bc24b<br>Exec-Program output: Logon failure (0xc000006d)<br>Exec-Program-Wait: plaintext: Logon failure (0xc000006d)<br>Exec-Program: returned: 1<br> rlm_mschap: External script failed.<br> rlm_mschap:
FAILED: MS-CHAP2-Response is incorrect<br>++[mschap] returns reject<br> rlm_eap: Freeing handler<br>++[eap] returns reject<br>auth: Failed to validate the user.<br>Login incorrect: [maman/<via Auth-Type = EAP>] (from client Ap8500 port 2 cli 00-12-F0-0C-97-61 via TLS tunnel)<br>} # server (null)<br> PEAP: Got tunneled reply RADIUS code 3<br> MS-CHAP-Error = "\021E=691 R=1"<br> EAP-Message = 0x04110004<br> Message-Authenticator = 0x00000000000000000000000000000000<br> PEAP: Processing from tunneled session code 0x81d8f90 3<br> MS-CHAP-Error = "\021E=691 R=1"<br> EAP-Message = 0x04110004<br> Message-Authenticator = 0x00000000000000000000000000000000<br> PEAP: Tunneled
authentication was rejected.<br> rlm_eap_peap: FAILURE<br>++[eap] returns handled<br>Sending Access-Challenge of id 93 to 10.10.44.246 port 1036<br> EAP-Message = 0x011200261900170301001b073fa5a0bd298ecb1079cb86c898132309fee25458125b2dd2fa73<br> Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0xf57621b1f264389c4e317c094fd9f295<br>Finished request 477.<br>Going to the next request<br>Waking up in 4.8 seconds.<br>rad_recv: Access-Request packet from host 10.10.44.246 port 1036, id=94, length=194<br> User-Name = "maman"<br> NAS-IP-Address = 10.10.44.246<br> NAS-Port = 2<br> Called-Station-Id =
"00-1C-F0-08-FB-FA:PEAP"<br> Calling-Station-Id = "00-12-F0-0C-97-61"<br> Framed-MTU = 1400<br> NAS-Port-Type = Wireless-802.11<br> Connect-Info = "CONNECT 54Mbps 802.11g"<br> EAP-Message = 0x021200261900170301001b45d08a0aa2a8e62c56613f082cafa76f4b6f51d358557fefd07b7f<br> State = 0xf57621b1f264389c4e317c094fd9f295<br> Message-Authenticator = 0xc80003ff430d4f991ea016e1e620ecaf<br>+- entering group authorize<br>++[preprocess] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br> rlm_realm: No '@' in User-Name = "maman", looking up realm NULL<br> rlm_realm: No such realm "NULL"<br>++[suffix] returns noop<br>
rlm_eap: EAP packet type response id 18 length 38<br> rlm_eap: Continuing tunnel setup.<br>++[eap] returns ok<br> rad_check_password: Found Auth-Type EAP<br>auth: type "EAP"<br>+- entering group authenticate<br> rlm_eap: Request found, released from the list<br> rlm_eap: EAP/peap<br> rlm_eap: processing type peap<br> rlm_eap_peap: Authenticate<br> rlm_eap_tls: processing TLS<br> eaptls_verify returned 7<br> rlm_eap_tls: Done initial handshake<br> eaptls_process returned 7<br> rlm_eap_peap: EAPTLS_OK<br> rlm_eap_peap: Session established. Decoding tunneled attributes.<br> rlm_eap_peap: Received EAP-TLV response.<br> rlm_eap_peap: Had sent TLV failure. User was rejected earlier in this session.<br> rlm_eap: Handler failed in EAP/peap<br> rlm_eap: Failed in EAP select<br>++[eap] returns invalid<br>auth: Failed to validate the
user.<br>Login incorrect: [maman/<via Auth-Type = EAP>] (from client Ap8500 port 2 cli 00-12-F0-0C-97-61)<br> Found Post-Auth-Type Reject<br>+- entering group REJECT<br> expand: %{User-Name} -> maman<br> attr_filter: Matched entry DEFAULT at line 11<br>++[attr_filter.access_reject] returns updated<br>Sending Access-Reject of id 94 to 10.10.44.246 port 1036<br> EAP-Message = 0x04120004<br> Message-Authenticator = 0x00000000000000000000000000000000<br>Finished request 478.<br>Going to the next request<br>Waking up in 4.8 seconds.<div style="font-family: times new roman,new york,times,serif; font-size: 12pt;">---------------------------------------------------------------------------------------------<br><br><br><div style="font-family: arial,helvetica,sans-serif; font-size: 13px;">----- Message d'origine
----<br>De : Alan DeKok <aland@deployingradius.com><br>À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org><br>Envoyé le : Samedi, 19 Juillet 2008, 17h19mn 58s<br>Objet : Re: Re : Re : EAP-TLS OK - EAP-PEAP KO!! why that?<br><br>Reveal MAP wrote:<br>> Now i am trying to authenticate via PEAP a user existing onmy sql database:<br><br> The debug log doesn't show that.<br><br>> the output is too long, mailing list parameters won't accept it. i post<br>> part of the output that seem to give the point of misconfiguration. if<br>> it is not sufficient, please let me know, and i will find a way to put<br>> somewher the whole output of RADIUD -X. thank you.<br>...<br>> Exec-Program output: Logon failure (0xc000006d)<br>> Exec-Program-Wait: plaintext: Logon failure (0xc000006d)<br>> Exec-Program: returned: 1<br>> rlm_mschap: External script failed.<br>> rlm_mschap: FAILED:
MS-CHAP2-Response is incorrect<br><br> What's the problem? You're using Samba to authenticate to Active<br>Directory, and the password is wrong.<br><br> Check that the passwords are correct.<br><br> Alan DeKok.<br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></div></div></div><br>
<hr size="1">
Envoyé avec <a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html">Yahoo! Mail</a>.<br>Une boite mail plus intelligente. </a></body></html>