Hey,<br><br>i copy the dictionary to /etc/radiusclient. But now the connections don't target the Radius Server. <br><br>--<br>epiderme:/etc/radiusclient# ls -l<br>total 68<br>-rw-r--r-- 1 root root 6593 2008-11-27 15:02 dictionary<br>
-rw-r--r-- 1 root root 12388 2006-10-29 08:54 dictionary.ascend<br>-rw-r--r-- 1 root root 1517 2006-10-29 08:54 dictionary.compat<br>-rw-r--r-- 1 root root 646 2008-11-27 14:20 dictionary.merit<br>-rw-r--r-- 1 root root 599 2008-11-27 14:20 dictionary.merit.BKP<br>
-rwxr-xr-x 1 root root 3639 2008-11-27 14:42 dictionary.microsoft<br>-rwxr-xr-x 1 root root 2697 2008-11-27 14:20 dictionary.microsoft.BKP<br>-rw-r--r-- 1 root root 135 2006-10-29 08:54 issue<br>-rw-r--r-- 1 root root 410 2006-10-29 08:54 port-id-map<br>
-rw-r--r-- 1 root root 508 2008-11-27 13:29 radiusclient.conf<br>-rwxr-xr-x 1 root root 2621 2008-11-24 13:33 radiusclient.conf.EPI<br>-rw-r--r-- 1 root root 435 2008-11-27 12:17 radiusclient.conf.LIMPO<br>-rw------- 1 root root 272 2008-11-24 13:12 servers<br>
--<br><br>And include on dictionary:<br><br>--<br>epiderme:/etc/radiusclient# cat dictionary | grep INCLUDE<br>INCLUDE /etc/radiusclient/dictionary.merit<br>INCLUDE /etc/radiusclient/dictionary.microsoft<br>--<br><br>Now, the pptp log:<br>
<br>--<br>Nov 27 15:14:32 epiderme pptpd[13058]: MGR: Launching /usr/sbin/pptpctrl to handle client<br>Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: local address = <a href="http://150.162.67.200">150.162.67.200</a><br>Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: remote address = <a href="http://150.162.67.201">150.162.67.201</a><br>
Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: pppd options file = /etc/ppp/pptpd-options<br>Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Client <a href="http://150.162.67.54">150.162.67.54</a> control connection started<br>
Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Received PPTP Control Message (type: 1)<br>Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Made a START CTRL CONN RPLY packet<br>Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: I wrote 156 bytes to the client.<br>
Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Sent packet to client<br>Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Received PPTP Control Message (type: 7)<br>Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Set parameters to 100000000 maxbps, 64 window size<br>
Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Made a OUT CALL RPLY packet<br>Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Starting call (launching pppd, opening GRE)<br>Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: pty_fd = 6<br>
Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: tty_fd = 7<br>Nov 27 15:14:32 epiderme pptpd[13059]: CTRL (PPPD Launcher): program binary = /usr/sbin/pppd<br>Nov 27 15:14:32 epiderme pptpd[13059]: CTRL (PPPD Launcher): local address = <a href="http://150.162.67.200">150.162.67.200</a><br>
Nov 27 15:14:32 epiderme pptpd[13059]: CTRL (PPPD Launcher): remote address = <a href="http://150.162.67.201">150.162.67.201</a><br>Nov 27 15:14:32 epiderme pppd[13059]: Plugin radius.so loaded.<br>Nov 27 15:14:32 epiderme pppd[13059]: RADIUS plugin initialized.<br>
Nov 27 15:14:32 epiderme pppd[13059]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded.<br>Nov 27 15:14:32 epiderme pppd[13059]: pptpd-logwtmp: $Version$<br>Nov 27 15:14:32 epiderme pppd[13059]: pppd 2.4.4 started by root, uid 0<br>
Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: I wrote 32 bytes to the client.<br>Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Sent packet to client<br>Nov 27 15:14:32 epiderme pppd[13059]: using channel 322<br>Nov 27 15:14:32 epiderme pppd[13059]: Using interface ppp0<br>
Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Received PPTP Control Message (type: 15)<br>Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Got a SET LINK INFO packet with standard ACCMs<br>Nov 27 15:14:32 epiderme pppd[13059]: Connect: ppp0 <--> /dev/pts/2<br>
Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x35f8d0db> <pcomp> <accomp>]<br>Nov 27 15:14:32 epiderme pptpd[13058]: GRE: Bad checksum from pppd.<br>
Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #0<br>Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP ConfReq id=0x0 <mru 1400> <magic 0x31fa2cf6> <pcomp> <accomp> <callback CBCP>]<br>
Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP ConfRej id=0x0 <callback CBCP>]<br>Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #1<br>Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x35f8d0db> <pcomp> <accomp>]<br>
Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #2<br>Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP ConfReq id=0x1 <mru 1400> <magic 0x31fa2cf6> <pcomp> <accomp>]<br>Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP ConfAck id=0x1 <mru 1400> <magic 0x31fa2cf6> <pcomp> <accomp>]<br>
Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP EchoReq id=0x0 magic=0x35f8d0db]<br>Nov 27 15:14:32 epiderme pppd[13059]: sent [CHAP Challenge id=0x43 <8643b88179a03fce2ca15689bf84147b>, name = "pptpd"]<br>
Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #3<br>Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #4<br>Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #5<br>Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP Ident id=0x2 magic=0x31fa2cf6 "MSRASV5.10"]<br>
Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP Ident id=0x3 magic=0x31fa2cf6 "MSRAS-0-MOLAR"]<br>Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP EchoRep id=0x0 magic=0x31fa2cf6]<br>Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #6<br>
Nov 27 15:14:32 epiderme pppd[13059]: rcvd [CHAP Response id=0x43 <318ca3c0e7f2e099a1f93ed8ca10717e00000000000000006b76deecbf9b1bd51ccc27f8183335f703835d5f6589e20400>, name = "douglas"]<br>Nov 27 15:14:32 epiderme pppd[13059]: rc_avpair_new: unknown attribute 6<br>
Nov 27 15:14:32 epiderme pppd[13059]: rc_avpair_new: unknown attribute 7<br>Nov 27 15:14:32 epiderme pppd[13059]: rc_avpair_new: unknown attribute 1<br>Nov 27 15:14:32 epiderme pppd[13059]: rc_avpair_new: unknown attribute 4<br>
Nov 27 15:14:32 epiderme pppd[13059]: Peer douglas failed CHAP authentication<br>Nov 27 15:14:32 epiderme pppd[13059]: sent [CHAP Failure id=0x43 ""]<br>Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP TermReq id=0x2 "Authentication failed"]<br>
Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #7<br>Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP TermAck id=0x2 "Authentication failed"]<br>Nov 27 15:14:32 epiderme pppd[13059]: Connection terminated.<br>
Nov 27 15:14:32 epiderme pppd[13059]: Exit.<br>Nov 27 15:14:32 epiderme pptpd[13058]: GRE: read(fd=6,buffer=8058640,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs<br>
Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7)<br>Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Reaping child PPP[13059]<br>Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Client <a href="http://150.162.67.54">150.162.67.54</a> control connection finished<br>
Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Exiting now<br>Nov 27 15:14:32 epiderme pptpd[13024]: MGR: Reaped child 13058<br>--<br><br>So, the problem persist:<br><br>Nov 27 15:10:43 epiderme pppd[13043]: rc_avpair_new: unknown attribute 6<br>
Nov 27 15:10:43 epiderme pppd[13043]: rc_avpair_new: unknown attribute 7<br>
Nov 27 15:10:43 epiderme pppd[13043]: rc_avpair_new: unknown attribute 1<br>
Nov 27 15:10:43 epiderme pppd[13043]: rc_avpair_new: unknown attribute 4<br><br>And:<br><br>Nov 27 15:14:32 epiderme pptpd[13058]: GRE:
read(fd=6,buffer=8058640,len=8196) from PTY failed: status = -1 error =
Input/output error, usually caused by unexpected termination of pppd,
check option syntax and pppd logs<br>
Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7)<br><br>What you think? I put de dictionaries here to you look it:<br><br>(dictionary.microsoft)<br>--<br><br>#<br># Microsoft's VSA's, from RFC 2548<br>
#<br># $Id: dictionary.microsoft,v 1.1 2002/03/06 13:23:09 dfs Exp $<br>#<br><br>VENDOR Microsoft 311 Microsoft<br><br>ATTRIBUTE MS-CHAP-Response 1 string Microsoft<br>ATTRIBUTE MS-CHAP-Error 2 string Microsoft<br>
ATTRIBUTE MS-CHAP-CPW-1 3 string Microsoft<br>ATTRIBUTE MS-CHAP-CPW-2 4 string Microsoft<br>ATTRIBUTE MS-CHAP-LM-Enc-PW 5 string Microsoft<br>ATTRIBUTE MS-CHAP-NT-Enc-PW 6 string Microsoft<br>
ATTRIBUTE MS-MPPE-Encryption-Policy 7 string Microsoft<br># This is referred to as both singular and plural in the RFC.<br># Plural seems to make more sense.<br>ATTRIBUTE MS-MPPE-Encryption-Type 8 string Microsoft<br>
ATTRIBUTE MS-MPPE-Encryption-Types 8 string Microsoft<br>ATTRIBUTE MS-RAS-Vendor 9 integer Microsoft<br>ATTRIBUTE MS-CHAP-Domain 10 string Microsoft<br>ATTRIBUTE MS-CHAP-Challenge 11 string Microsoft<br>
ATTRIBUTE MS-CHAP-MPPE-Keys 12 string Microsoft<br>ATTRIBUTE MS-BAP-Usage 13 integer Microsoft<br>ATTRIBUTE MS-Link-Utilization-Threshold 14 integer Microsoft<br>ATTRIBUTE MS-Link-Drop-Time-Limit 15 integer Microsoft<br>
ATTRIBUTE MS-MPPE-Send-Key 16 string Microsoft<br>ATTRIBUTE MS-MPPE-Recv-Key 17 string Microsoft<br>ATTRIBUTE MS-RAS-Version 18 string Microsoft<br>ATTRIBUTE MS-Old-ARAP-Password 19 string Microsoft<br>
ATTRIBUTE MS-New-ARAP-Password 20 string Microsoft<br>ATTRIBUTE MS-ARAP-PW-Change-Reason 21 integer Microsoft<br><br>ATTRIBUTE MS-Filter 22 string Microsoft<br>ATTRIBUTE MS-Acct-Auth-Type 23 integer Microsoft<br>
ATTRIBUTE MS-Acct-EAP-Type 24 integer Microsoft<br><br>ATTRIBUTE MS-CHAP2-Response 25 string Microsoft<br>ATTRIBUTE MS-CHAP2-Success 26 string Microsoft<br>ATTRIBUTE MS-CHAP2-CPW 27 string Microsoft<br>
<br>ATTRIBUTE MS-Primary-DNS-Server 28 ipaddr Microsoft<br>ATTRIBUTE MS-Secondary-DNS-Server 29 ipaddr Microsoft<br>ATTRIBUTE MS-Primary-NBNS-Server 30 ipaddr Microsoft<br>ATTRIBUTE MS-Secondary-NBNS-Server 31 ipaddr Microsoft<br>
<br>#ATTRIBUTE MS-ARAP-Challenge 33 string Microsoft<br><br><br>#<br># Integer Translations<br>#<br><br># MS-BAP-Usage Values<br><br>VALUE MS-BAP-Usage Not-Allowed 0<br>
VALUE MS-BAP-Usage Allowed 1<br>VALUE MS-BAP-Usage Required 2<br><br># MS-ARAP-Password-Change-Reason Values<br><br>VALUE MS-ARAP-PW-Change-Reason Just-Change-Password 1<br>
VALUE MS-ARAP-PW-Change-Reason Expired-Password 2<br>VALUE MS-ARAP-PW-Change-Reason Admin-Requires-Password-Change 3<br>VALUE MS-ARAP-PW-Change-Reason Password-Too-Short 4<br>
<br># MS-Acct-Auth-Type Values<br><br>VALUE MS-Acct-Auth-Type PAP 1<br>VALUE MS-Acct-Auth-Type CHAP 2<br>VALUE MS-Acct-Auth-Type MS-CHAP-1 3<br>
VALUE MS-Acct-Auth-Type MS-CHAP-2 4<br>VALUE MS-Acct-Auth-Type EAP 5<br><br># MS-Acct-EAP-Type Values<br><br>VALUE MS-Acct-EAP-Type MD5 4<br>
VALUE MS-Acct-EAP-Type OTP 5<br>VALUE MS-Acct-EAP-Type Generic-Token-Card 6<br>VALUE MS-Acct-EAP-Type TLS 13<br>----<br><br>Thanks in advanced!<br>
<br>Douglas<br><br><div class="gmail_quote">On Thu, Nov 27, 2008 at 4:06 PM, Alexandre Chapellon <span dir="ltr"><<a href="mailto:alexandre.chapellon@mana.pf">alexandre.chapellon@mana.pf</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#000000">
<br>
<br>
Le 27.11.2008 07:17, Douglas Macedo a écrit :
<div><div></div><div class="Wj3C7c"><blockquote type="cite">Hey TNT,<br>
<br>
<div class="gmail_quote">On Thu, Nov 27, 2008 at 2:54 PM, <span dir="ltr"><<a href="mailto:tnt@kalik.net" target="_blank">tnt@kalik.net</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>>i force in WIndows Client to use only
mschap2, but the problem continue:<br>
><br>
>-<br>
>Module: Instantiated radutmp (radutmp)<br>
>Listening on authentication *:1812<br>
>Listening on accounting *:1813<br>
>Ready to process requests.<br>
>rad_recv: Access-Request packet from host <a href="http://150.162.67.254:32858" target="_blank">150.162.67.254:32858</a>,
id=109,<br>
>length=53<br>
> Service-Type = Framed-User<br>
> Framed-Protocol = PPP<br>
> User-Name = "douglas"<br>
> NAS-IP-Address = <a href="http://1.1.1.1" target="_blank">1.1.1.1</a><br>
> NAS-Port = 0<br>
<br>
</div>
This is nothing to do with freeradius. I don't see your NAS sending<br>
mschap attributes.<br>
</blockquote>
<div><br>
How I can fix that? Where i configure that? <br>
</div>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><br>
>In PPTP debug show:<br>
><br>
..<br>
<div>>Nov 27 11:35:39 epiderme pppd[12254]:
rc_avpair_new: unknown attribute 11<br>
>Nov 27 11:35:39 epiderme pppd[12254]: rc_avpair_new: unknown
attribute 25<br>
<br>
</div>
Has your radius client got mschap dictionary?<br>
</blockquote>
<div><br>
I'm using the RadiusClient1 of Debian. <br>
<br>
--<br>
epiderme:/etc/radiusclient# ls -l<br>
total 52<br>
-rw-r--r-- 1 root root 6502 2008-11-26 13:10 dictionary<br>
-rw-r--r-- 1 root root 12388 2006-10-29 08:54 dictionary.ascend<br>
-rw-r--r-- 1 root root 1517 2006-10-29 08:54 dictionary.compat<br>
-rw-r--r-- 1 root root 599 2006-10-29 08:54 dictionary.merit<br>
-rw-r--r-- 1 root root 135 2006-10-29 08:54 issue<br>
-rw-r--r-- 1 root root 410 2006-10-29 08:54 port-id-map<br>
-rw-r--r-- 1 root root 2630 2008-11-24 15:24 radiusclient.conf<br>
-rwxr-xr-x 1 root root 2621 2008-11-24 13:33 radiusclient.conf.EPI<br>
-rw------- 1 root root 272 2008-11-24 13:12 servers<br>
--<br>
</div>
</div>
</blockquote>
<br></div></div>
Copy microsoft dictionnary from your freeradius install to your pptp
server, and add it to the dictionnary list.<br>
Additionnaly (this may not be related to your problem) having multiple
require-<protocols> in pptpd config is a non-sense, if you want
to enable multiples protocols for authentications, use +pap, +chap,
+mschap.... instead of require-...<div><div></div><div class="Wj3C7c"><br>
<br>
<blockquote type="cite">
<div class="gmail_quote">
<div><br>
--<br>
epiderme:/etc/radiusclient# cat radiusclient.conf<br>
auth_order radius,local<br>
login_tries 4<br>
login_timeout 60<br>
nologin /etc/nologin<br>
issue /etc/radiusclient/issue<br>
authserver <a href="http://ldap.telemedicina.ufsc.br" target="_blank">ldap.telemedicina.ufsc.br</a><br>
acctserver <a href="http://ldap.telemedicina.ufsc.br" target="_blank">ldap.telemedicina.ufsc.br</a><br>
servers /etc/radiusclient/servers<br>
dictionary /etc/radiusclient/dictionary<br>
login_radius /usr/sbin/login.radius<br>
seqfile /var/run/radius.seq<br>
mapfile /etc/radiusclient/port-id-map<br>
default_realm<br>
radius_timeout 10<br>
radius_retries 3<br>
login_local /bin/login<br>
--<br>
<br>
<br>
But I don't found the attributes to MS-CHAP:<br>
<br>
--<br>
epiderme:/etc/radiusclient# cat dictionary | grep MS-CHAP<br>
epiderme:/etc/radiusclient# cat dictionary | grep MSCHAP<br>
epiderme:/etc/radiusclient# cat dictionary | grep mschap<br>
--<br>
<br>
Just to CHAP:<br>
<br>
--<br>
epiderme:/etc/radiusclient# cat dictionary | grep -i chap<br>
ATTRIBUTE CHAP-Password 3 string<br>
ATTRIBUTE Chap-Challenge 60 string<br>
--<br>
<br>
That's correct? <br>
</div>
</div>
</blockquote></div></div>
No you need MS-CHAP Attributes<br>
<blockquote type="cite"><div class="Ih2E3d">
<div class="gmail_quote">
<div><br>
Thanks a lot in advanced,<br>
Douglas<br>
</div>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<div><br>
Ivan Kalik<br>
Kalik Informatika ISP<br>
<br>
-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
</div>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
Douglas Macedo<br>
<a href="mailto:dmacedo@gmail.com" target="_blank">dmacedo@gmail.com</a><br>
--<br>
Avalia-se a inteligência de um indivíduo pela quantidade de incertezas
que ele é capaz de suportar.<br>
(Immanuel Kant)<br>
</div><pre><hr size="4" width="90%"><div class="Ih2E3d">
-
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a></div></pre>
</blockquote>
</div>
<br>-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br><br clear="all"><br>-- <br>Douglas Macedo<br>
<a href="mailto:dmacedo@gmail.com">dmacedo@gmail.com</a><br>--<br>Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar.<br>(Immanuel Kant)<br>