<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EstiloDeEmail17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:1914929136;
mso-list-type:hybrid;
mso-list-template-ids:-1289033456 650658520 68550659 68550661 68550657 68550659 68550661 68550657 68550659 68550661;}
@list l0:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:\F0E8;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;
mso-fareast-font-family:Calibri;
mso-bidi-font-family:"Courier New";}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=PT-BR link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>Hello everyone,<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span lang=EN-US>I would like to receive some help on authentication
with AD using CHAP Passwords. I´ve already configured the radius (v 2.1.6) to
authenticate in the AD (Microsoft) using LDAP and clear-text passwords, until
now it works perfectly, but in the radius debug appear the following message:<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'><o:p> </o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>“rad_recv:
Access-Request packet from host 192.168.0.100 port 64871, id=7, length=50<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> User-Name =
"1000700025"<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'> User-Password =
"123456"<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>+- entering group authorize
{...}<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>++[preprocess] returns ok<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>[suffix] No '@' in User-Name
= "1000700025", looking up realm NULL<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>[suffix] No such realm
"NULL"<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>++[suffix] returns noop<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>[ldap] performing user
authorization for 1000700025<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>[ldap] WARNING: Deprecated
conditional expansion ":-". See "man unlang" for details<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>[ldap] expand:
(sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) ->
(sAMAccountName=1000700025)<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:9.0pt;
font-family:"Courier New"'>[ldap] expand: dc=pedagogico,dc=net -> dc=pedagogico,dc=net<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>rlm_ldap: ldap_get_conn:
Checking Id: 0<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>rlm_ldap: ldap_get_conn: Got
Id: 0<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:9.0pt;
font-family:"Courier New"'>rlm_ldap: attempting LDAP reconnection<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>rlm_ldap: (re)connect to
172.17.16.4:389, authentication 0<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>rlm_ldap: bind as
wni@pedagogico.net/wni@2009 to 172.17.16.4:389<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>rlm_ldap: waiting for bind
result ...<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>rlm_ldap: Bind was successful<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>rlm_ldap: performing search
in dc=pedagogico,dc=net, with filter (sAMAccountName=1000700025)<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>[ldap] looking for check
items in directory...<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>[ldap] looking for reply
items in directory...<o:p></o:p></span></p>
<p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l0 level1 lfo1;
text-autospace:none'><![if !supportLists]><span lang=EN-US style='font-size:
10.0pt;font-family:Wingdings'><span style='mso-list:Ignore'>č<span
style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><b><u><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>WARNING: No
"known good" password was found in LDAP. Are you sure that the user
is configured correctly?</span></u></b><b><span lang=EN-US style='font-size:
10.0pt;font-family:"Courier New"'> </span></b><b><span lang=EN-US
style='font-size:10.0pt;font-family:Wingdings'>į</span></b><b><u><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'><o:p></o:p></span></u></b></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>[ldap] Setting Auth-Type =
LDAP<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>[ldap] user 1000700025
authorized to use remote access<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>rlm_ldap: ldap_release_conn:
Release Id: 0<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>++[ldap] returns ok<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>++[expiration] returns noop<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>++[logintime] returns noop<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>Found Auth-Type = LDAP<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>+- entering group LDAP {...}<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>[ldap] login attempt by
"1000700025" with password "123456"<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:9.0pt;
font-family:"Courier New"'>[ldap] user DN: CN=LUIZ RICARDO DE VILLA SCANDELARI,OU=Users,OU=UNIFAE,OU=Users
and Computers,DC=PEDAGOGICO,DC=NET<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>rlm_ldap: (re)connect to
172.17.16.4:389, authentication 1<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:9.0pt;
font-family:"Courier New"'>rlm_ldap: bind as CN=LUIZ RICARDO DE VILLA
SCANDELARI,OU=Users,OU=UNIFAE,OU=Users and
Computers,DC=PEDAGOGICO,DC=NET/123456 to 172.17.16.4:389<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>rlm_ldap: waiting for bind
result ...<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>rlm_ldap: Bind was successful<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>[ldap] user 1000700025
authenticated succesfully<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>++[ldap] returns ok<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>+- entering group post-auth
{...}<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>++[exec] returns noop<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>Sending Access-Accept of id 7
to 192.168.0.100 port 64871<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'>Finished request 0.”<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-US
style='font-size:9.0pt;font-family:"Courier New"'><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>I suppose that happens because I cannot
read the AD user password, right? The important is that works with LDAP authentication.
The problem is that I have a system that sends Access-Requests with Username
and CHAP-Passwords (CoovaChilli), so radius authorize the user but cannot
authenticate it. <o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>I´ve already read the Allan´s webpage (<a
href="http://deployingradius.com/documents/configuration/active_directory.html">http://deployingradius.com/documents/configuration/active_directory.html</a>)
about integration of AD and RADIUS but I still have some questions. Can I use
CHAP with SAMBA ntlm_auth method or should i need to change the password
encryption to another protocol such as PAP or MS-CHAP? If I modify the
coovachilli to send PAP passwords, am I going to be able to use ldap for authorization
and authentication or do I need just plain?<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>I hope somebody can help me.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal>Thanks,<o:p></o:p></p>
<p class=MsoNormal><b><i>LUIZ GUSTAVO SCANDELARI<o:p></o:p></i></b></p>
<p class=MsoNormal><i>Skype: </i>luiz.gustavo.wni<i><o:p></o:p></i></p>
</div>
</body>
</html>