<div dir="ltr">That setting was at the default of 1, I tried setting to zero, no affect.<br><br>Here is the debug output with first a successful user followed by the same user with a bad pwd.<br><br><br>--------------------------------------------------------------------------------------------------------------------------<br>
<br>rad_recv: Access-Request packet from host <a href="http://10.15.251.232:1387">10.15.251.232:1387</a>, id=6, length=62<br> User-Name = "test"<br> User-Password = "test"<br> Message-Authenticator = 0x0adeae0c4cb8659e2aaede3adb6009a3<br>
Processing the authorize section of radiusd.conf<br>modcall: entering group authorize for request 0<br> modcall[authorize]: module "preprocess" returns ok for request 0<br>radius_xlat: '/var/log/radius-switch/radacct-switch/<a href="http://10.15.251.232/auth-detail-20080829">10.15.251.232/auth-detail-20080829</a>'<br>
rlm_detail: /var/log/radius-switch/radacct-switch/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius-switch/radacct-switch/<a href="http://10.15.251.232/auth-detail-20080829">10.15.251.232/auth-detail-20080829</a><br>
modcall[authorize]: module "auth_log" returns ok for request 0<br> modcall[authorize]: module "chap" returns noop for request 0<br> modcall[authorize]: module "mschap" returns noop for request 0<br>
rlm_realm: No '@' in User-Name = "test", looking up realm NULL<br> rlm_realm: No such realm "NULL"<br> modcall[authorize]: module "suffix" returns noop for request 0<br> rlm_realm: No '\' in User-Name = "test", looking up realm NULL<br>
rlm_realm: No such realm "NULL"<br> modcall[authorize]: module "ntdomain" returns noop for request 0<br> users: Matched entry DEFAULT at line 1<br> users: Matched entry test at line 33<br>rlm_ldap: Entering ldap_groupcmp()<br>
radius_xlat: 'ou=***,dc=**,dc=**'<br>radius_xlat: '(uid=test)'<br>rlm_ldap: ldap_get_conn: Checking Id: 0<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: attempting LDAP reconnection<br>rlm_ldap: (re)connect to <a href="http://10.2.16.156:389">10.2.16.156:389</a>, authentication 0<br>
rlm_ldap: bind as cn=ITDRADIUSC,ou=USERS,ou=ITD,dc=nd,dc=gov/X27wireless45 to <a href="http://10.2.16.156:389">10.2.16.156:389</a><br>rlm_ldap: waiting for bind result ...<br>rlm_ldap: Bind was successful<br>rlm_ldap: performing search in ou=***,dc=nd,**=***, with filter (uid=test)<br>
rlm_ldap: object not found or got ambiguous search result<br>rlm_ldap::ldap_groupcmp: search failed<br>rlm_ldap: ldap_release_conn: Release Id: 0<br> modcall[authorize]: module "files" returns ok for request 0<br>
rlm_ldap: - authorize<br>rlm_ldap: performing user authorization for test<br>radius_xlat: '(uid=test)'<br>radius_xlat: 'ou=***,dc=**,dc=***'<br>rlm_ldap: ldap_get_conn: Checking Id: 0<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>
rlm_ldap: performing search in ou=***,**=nd,**=***, with filter (uid=test)<br>rlm_ldap: object not found or got ambiguous search result<br>rlm_ldap: search failed<br>rlm_ldap: ldap_release_conn: Release Id: 0<br> modcall[authorize]: module "********" returns notfound for request 0<br>
modcall: leaving group authorize (returns ok) for request 0<br> rad_check_password: Found Auth-Type Local<br>auth: type Local<br>auth: user supplied User-Password matches local User-Password<br>Login OK: [test] (from client NetworkEquipment port 0)<br>
Processing the post-auth section of radiusd.conf<br>modcall: entering group post-auth for request 0<br>radius_xlat: '/var/log/radius-switch/radacct-switch/<a href="http://10.15.251.232/reply-detail-20080829">10.15.251.232/reply-detail-20080829</a>'<br>
rlm_detail: /var/log/radius-switch/radacct-switch/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius-switch/radacct-switch/<a href="http://10.15.251.232/reply-detail-20080829">10.15.251.232/reply-detail-20080829</a><br>
modcall[post-auth]: module "reply_log" returns ok for request 0<br>modcall: leaving group post-auth (returns ok) for request 0<br>Sending Access-Accept of id 6 to <a href="http://10.15.251.232">10.15.251.232</a> port 1387<br>
NS-Admin-Privilege = Root-Admin<br> APC-Service-Type = 1<br> Service-Type = Administrative-User<br> Cisco-AVPair = "shell:priv-lvl=15"<br> Filter-Id = "unlim"<br> Extreme-Shell-Command = "Enable"<br>
Finished request 0<br>Going to the next request<br>--- Walking the entire request list ---<br>Waking up in 6 seconds...<br><br><br><br>--------------------------------------------------------------------------------------------------------------------------<br>
<br><br><br><br><br>rad_recv: Access-Request packet from host <a href="http://10.15.251.232:1337">10.15.251.232:1337</a>, id=5, length=62<br> User-Name = "test"<br> User-Password = "test2"<br>
Message-Authenticator = 0x9bb6290c9d5e7dcffeeafe87e2c65b40<br> Processing the authorize section of radiusd.conf<br>modcall: entering group authorize for request 0<br> modcall[authorize]: module "preprocess" returns ok for request 0<br>
radius_xlat: '/var/log/radius-switch/radacct-switch/<a href="http://10.15.251.232/auth-detail-20080829">10.15.251.232/auth-detail-20080829</a>'<br>rlm_detail: /var/log/radius-switch/radacct-switch/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius-switch/radacct-switch/<a href="http://10.15.251.232/auth-detail-20080829">10.15.251.232/auth-detail-20080829</a><br>
modcall[authorize]: module "auth_log" returns ok for request 0<br> modcall[authorize]: module "chap" returns noop for request 0<br> modcall[authorize]: module "mschap" returns noop for request 0<br>
rlm_realm: No '@' in User-Name = "test", looking up realm NULL<br> rlm_realm: No such realm "NULL"<br> modcall[authorize]: module "suffix" returns noop for request 0<br> rlm_realm: No '\' in User-Name = "test", looking up realm NULL<br>
rlm_realm: No such realm "NULL"<br> modcall[authorize]: module "ntdomain" returns noop for request 0<br> users: Matched entry DEFAULT at line 1<br>rlm_ldap: Entering ldap_groupcmp()<br>radius_xlat: 'ou=ITD,dc=nd,dc=gov'<br>
radius_xlat: '(uid=test)'<br>rlm_ldap: ldap_get_conn: Checking Id: 0<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: attempting LDAP reconnection<br>rlm_ldap: (re)connect to <a href="http://10.2.16.156:389">10.2.16.156:389</a>, authentication 0<br>
rlm_ldap: bind as cn=ITDRADIUSC,ou=USERS,ou=ITD,dc=nd,dc=gov/X27wireless45 to <a href="http://10.2.16.156:389">10.2.16.156:389</a><br>rlm_ldap: waiting for bind result ...<br>rlm_ldap: Bind was successful<br>rlm_ldap: performing search in ou=ITD,dc=nd,dc=gov, with filter (uid=test)<br>
rlm_ldap: object not found or got ambiguous search result<br>rlm_ldap::ldap_groupcmp: search failed<br>rlm_ldap: ldap_release_conn: Release Id: 0<br> modcall[authorize]: module "files" returns ok for request 0<br>
rlm_ldap: - authorize<br>rlm_ldap: performing user authorization for test<br>radius_xlat: '(uid=test)'<br>radius_xlat: 'ou=ITD,dc=nd,dc=gov'<br>rlm_ldap: ldap_get_conn: Checking Id: 0<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>
rlm_ldap: performing search in ou=ITD,dc=nd,dc=gov, with filter (uid=test)<br>rlm_ldap: object not found or got ambiguous search result<br>rlm_ldap: search failed<br>rlm_ldap: ldap_release_conn: Release Id: 0<br> modcall[authorize]: module "STATE" returns notfound for request 0<br>
modcall: leaving group authorize (returns ok) for request 0<br> rad_check_password: Found Auth-Type LDAP<br>auth: type "LDAP"<br> Processing the authenticate section of radiusd.conf<br>modcall: entering group LDAP for request 0<br>
rlm_ldap: - authenticate<br>rlm_ldap: login attempt by "test" with password "test"<br>radius_xlat: '(uid=test)'<br>radius_xlat: 'ou=ITD,dc=nd,dc=gov'<br>rlm_ldap: ldap_get_conn: Checking Id: 0<br>
rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: performing search in ou=ITD,dc=nd,dc=gov, with filter (uid=test)<br>rlm_ldap: object not found or got ambiguous search result<br>rlm_ldap: ldap_release_conn: Release Id: 0<br>
modcall[authenticate]: module "STATE" returns notfound for request 0<br>modcall: leaving group LDAP (returns notfound) for request 0<br>auth: Failed to validate the user.<br>Login incorrect (rlm_ldap: User not found): [test] (from client NetworkEquipment port 0)<br>
Delaying request 0 for 1 seconds<br>Finished request 0<br>Going to the next request<br>--- Walking the entire request list ---<br>Waking up in 1 seconds...<br>--- Walking the entire request list ---<br>Waking up in 1 seconds...<br>
--- Walking the entire request list ---<br>Sending Access-Reject of id 5 to <a href="http://10.15.251.232">10.15.251.232</a> port 1337<br>Waking up in 4 seconds...<br>--- Walking the entire request list ---<br>Cleaning up request 0 ID 5 with timestamp 48b80e1f<br>
Nothing to do. Sleeping until we see a request.<br><br><div class="gmail_quote"><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Set "reject_delay = 0"<br>
<font color="#888888"><br>
Alan DeKok.<br>
</font><div><div></div><div class="Wj3C7c">-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
</div></div></blockquote></div><br></div>