<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Arial; font-size: 10pt; color: #000000'><P>as I have read, <A href="http://deployingradius.com/documents/protocols/compatibility.html">http://deployingradius.com/documents/protocols/compatibility.html</A>, isn´t possible authenticate users with peap (mschapv2) in ldap.</P>
<P> </P>
<P>when we use EAP to authenticate in ldap, only EAP-TTLS (PAP) works.</P>
<P> </P>
<P> </P>
<P> </P>
<P><BR>----- Mensaje original -----<BR>De: "Daniel Soto" <daxocam@uax.es><BR>Para: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org><BR>Enviados: Lunes, 3 de Mayo 2010 8:56:34<BR>Asunto: Re: supplicant winxp+freeradius+ldap<BR><BR></P>
<STYLE>p { margin: 0; }</STYLE>
<DIV style="FONT-FAMILY: Arial; COLOR: #000000; FONT-SIZE: 10pt">
<P>sorry, didn´t include the log, </P>
<P> </P>
<P>Starting - reading configuration files ...<BR>reread_config: reading radiusd.conf<BR>Config: including file: /etc/raddb/proxy.conf<BR>Config: including file: /etc/raddb/clients.conf<BR>Config: including file: /etc/raddb/snmp.conf<BR>Config: including file: /etc/raddb/eap.conf<BR> main: prefix = "/usr"<BR> main: localstatedir = "/var"<BR> main: logdir = "/var/log/radius"<BR> main: libdir = "/usr/lib64"<BR> main: radacctdir = "/var/log/radius/radacct"<BR> main: hostname_lookups = no<BR> main: snmp = no<BR> main: max_request_time = 30<BR> main: cleanup_delay = 5<BR> main: max_requests = 1024<BR> main: delete_blocked_requests = 0<BR> main: port = 1645<BR> main: allow_core_dumps = no<BR> main: log_stripped_names = no<BR> main: log_file = "/var/log/radius/radius.log"<BR> main: log_auth = yes<BR> main: log_auth_badpass = no<BR> main: log_auth_goodpass = no<BR> main: pidfile = "/var/run/radiusd/radiusd.pid"<BR> main: user = "(null)"<BR> main: group = "(null)"<BR> main: usercollide = no<BR> main: lower_user = "no"<BR> main: lower_pass = "no"<BR> main: nospace_user = "no"<BR> main: nospace_pass = "no"<BR> main: checkrad = "/usr/sbin/checkrad"<BR> main: proxy_requests = yes<BR> proxy: retry_delay = 5<BR> proxy: retry_count = 3<BR> proxy: synchronous = no<BR> proxy: default_fallback = yes<BR> proxy: dead_time = 120<BR> proxy: post_proxy_authorize = no<BR> proxy: wake_all_if_all_dead = no<BR> security: max_attributes = 200<BR> security: reject_delay = 1<BR> security: status_server = no<BR> main: debug_level = 0<BR>read_config_files: reading dictionary<BR>read_config_files: reading naslist<BR>Using deprecated naslist file. Support for this will go away soon.<BR>read_config_files: reading clients<BR>read_config_files: reading realms<BR>radiusd: entering modules setup<BR>Module: Library search path is /usr/lib64<BR>Module: Loaded exec <BR> exec: wait = yes<BR> exec: program = "(null)"<BR> exec: input_pairs = "request"<BR> exec: output_pairs = "(null)"<BR> exec: packet_type = "(null)"<BR>rlm_exec: Wait=yes but no output defined. Did you mean output=none?<BR>Module: Instantiated exec (exec) <BR>Module: Loaded expr <BR>Module: Instantiated expr (expr) <BR>Module: Loaded PAP <BR> pap: encryption_scheme = "md5"<BR>Module: Instantiated pap (pap) <BR>Module: Loaded CHAP <BR>Module: Instantiated chap (chap) <BR>Module: Loaded MS-CHAP <BR> mschap: use_mppe = yes<BR> mschap: require_encryption = yes<BR> mschap: require_strong = yes<BR> mschap: with_ntdomain_hack = no<BR> mschap: passwd = "(null)"<BR> mschap: ntlm_auth = "(null)"<BR>Module: Instantiated mschap (mschap) <BR>Module: Loaded Pam <BR> pam: pam_auth = "radiusd"<BR>Module: Instantiated pam (pam) <BR>Module: Loaded System <BR> unix: cache = no<BR> unix: passwd = "(null)"<BR> unix: shadow = "/etc/shadow"<BR> unix: group = "(null)"<BR> unix: radwtmp = "/var/log/radius/radwtmp"<BR> unix: usegroup = no<BR> unix: cache_reload = 600<BR>Module: Instantiated unix (unix) <BR>Module: Loaded LDAP <BR> ldap: server = "10.40.30.80"<BR> ldap: port = 389<BR> ldap: net_timeout = 1<BR> ldap: timeout = 15<BR> ldap: timelimit = 15<BR> ldap: identity = ""<BR> ldap: tls_mode = no<BR> ldap: start_tls = no<BR> ldap: tls_cacertfile = "(null)"<BR> ldap: tls_cacertdir = "(null)"<BR> ldap: tls_certfile = "(null)"<BR> ldap: tls_keyfile = "(null)"<BR> ldap: tls_randfile = "(null)"<BR> ldap: tls_require_cert = "allow"<BR> ldap: password = ""<BR> ldap: basedn = "ou=prf,dc=uax,dc=es"<BR> ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"<BR> ldap: base_filter = "(objectclass=radiusprofile)"<BR> ldap: default_profile = "(null)"<BR> ldap: profile_attribute = "(null)"<BR> ldap: password_header = "{md5}"<BR> ldap: password_attribute = "(null)"<BR> ldap: access_attr = "(null)"<BR> ldap: groupname_attribute = "cn"<BR> ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"<BR> ldap: groupmembership_attribute = "(null)"<BR> ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap"<BR> ldap: ldap_debug = 0<BR> ldap: ldap_connections_number = 5<BR> ldap: compare_check_items = no<BR> ldap: access_attr_used_for_allow = yes<BR> ldap: do_xlat = yes<BR> ldap: set_auth_type = yes<BR>rlm_ldap: Registering ldap_groupcmp for Ldap-Group<BR>rlm_ldap: Registering ldap_xlat with xlat_name ldap<BR>rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap<BR>rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$<BR>rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$<BR>rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password<BR>rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type<BR>rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use<BR>rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id<BR>rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id<BR>rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password<BR>rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password<BR>rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT<BR>rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration<BR>rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address<BR>rlm_ldap: LDAP userPassword mapped to RADIUS User-Password<BR>rlm_ldap: LDAP chapPassword mapped to RADIUS CHAP-Password<BR>rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type<BR>rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol<BR>rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address<BR>rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask<BR>rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route<BR>rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing<BR>rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id<BR>rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU<BR>rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression<BR>rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host<BR>rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service<BR>rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port<BR>rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number<BR>rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id<BR>rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network<BR>rlm_ldap: LDAP radiusClass mapped to RADIUS Class<BR>rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout<BR>rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout<BR>rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action<BR>rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service<BR>rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node<BR>rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group<BR>rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link<BR>rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network<BR>rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone<BR>rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit<BR>rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port<BR>rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message<BR>conns: 0x2ac416410640<BR>Module: Instantiated ldap (ldap) <BR>Module: Loaded eap <BR> eap: default_eap_type = "tls"<BR> eap: timer_expire = 60<BR> eap: ignore_unknown_eap_types = no<BR> eap: cisco_accounting_username_bug = no<BR>rlm_eap: Loaded and initialized type md5<BR>rlm_eap: Loaded and initialized type leap<BR> gtc: challenge = "Password: "<BR> gtc: auth_type = "PAP"<BR>rlm_eap: Loaded and initialized type gtc<BR> tls: rsa_key_exchange = no<BR> tls: dh_key_exchange = yes<BR> tls: rsa_key_length = 512<BR> tls: dh_key_length = 512<BR> tls: verify_depth = 0<BR> tls: CA_path = "(null)"<BR> tls: pem_file_type = yes<BR> tls: private_key_file = "/etc/raddb/certs/cert-srv.pem"<BR> tls: certificate_file = "/etc/raddb/certs/cert-srv.pem"<BR> tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem"<BR> tls: private_key_password = "whatever"<BR> tls: dh_file = "/etc/raddb/certs/dh"<BR> tls: random_file = "/etc/raddb/certs/random"<BR> tls: fragment_size = 1024<BR> tls: include_length = yes<BR> tls: check_crl = no<BR> tls: check_cert_cn = "(null)"<BR> tls: cipher_list = "DEFAULT"<BR> tls: check_cert_issuer = "(null)"<BR>rlm_eap_tls: Loading the certificate file as a chain<BR>rlm_eap: Loaded and initialized type tls<BR> ttls: default_eap_type = "gtc"<BR> ttls: copy_request_to_tunnel = no<BR> ttls: use_tunneled_reply = no<BR>rlm_eap: Loaded and initialized type ttls<BR> peap: default_eap_type = "mschapv2"<BR> peap: copy_request_to_tunnel = no<BR> peap: use_tunneled_reply = no<BR> peap: proxy_tunneled_request_as_eap = yes<BR>rlm_eap: Loaded and initialized type peap<BR> mschapv2: with_ntdomain_hack = no<BR>rlm_eap: Loaded and initialized type mschapv2<BR>Module: Instantiated eap (eap) <BR>Module: Loaded preprocess <BR> preprocess: huntgroups = "/etc/raddb/huntgroups"<BR> preprocess: hints = "/etc/raddb/hints"<BR> preprocess: with_ascend_hack = no<BR> preprocess: ascend_channels_per_line = 23<BR> preprocess: with_ntdomain_hack = no<BR> preprocess: with_specialix_jetstream_hack = no<BR> preprocess: with_cisco_vsa_hack = no<BR> preprocess: with_alvarion_vsa_hack = no<BR>Module: Instantiated preprocess (preprocess) <BR>Module: Loaded attr_filter <BR> attr_filter: attrsfile = "/etc/raddb/attrs"<BR> rlm_attr_filter: Authorize method will be deprecated.<BR>Module: Instantiated attr_filter (attr_filter) <BR>Module: Loaded realm <BR> realm: format = "suffix"<BR> realm: delimiter = "@"<BR> realm: ignore_default = no<BR> realm: ignore_null = no<BR>Module: Instantiated realm (suffix) <BR>Module: Loaded files <BR> files: usersfile = "/etc/raddb/users"<BR> files: acctusersfile = "/etc/raddb/acct_users"<BR> files: preproxy_usersfile = "/etc/raddb/preproxy_users"<BR> files: compat = "no"<BR>Module: Instantiated files (files) <BR>Module: Loaded Acct-Unique-Session-Id <BR> acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"<BR>Module: Instantiated acct_unique (acct_unique) <BR>Module: Loaded detail <BR> detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"<BR> detail: detailperm = 384<BR> detail: dirperm = 493<BR> detail: locking = no<BR>Module: Instantiated detail (detail) <BR>Module: Loaded radutmp <BR> radutmp: filename = "/var/log/radius/radutmp"<BR> radutmp: username = "%{User-Name}"<BR> radutmp: case_sensitive = yes<BR> radutmp: check_with_nas = yes<BR> radutmp: perm = 384<BR> radutmp: callerid = yes<BR>Module: Instantiated radutmp (radutmp) <BR>Listening on authentication *:1645<BR>Listening on accounting *:1646<BR>Ready to process requests.<BR>rad_recv: Access-Request packet from host x.x.x.x:32840, id=183, length=148<BR> User-Name = "peter"<BR> NAS-IP-Address = x.x.x.x<BR> NAS-Port = 6145<BR> Called-Station-Id = "00-02-B6-33-58-B2:rad_pru"<BR> Calling-Station-Id = "00-22-74-A6-91-BD"<BR> Framed-MTU = 1250<BR> NAS-Port-Type = Wireless-802.11<BR> Connect-Info = "CONNECT 802.11a"<BR> EAP-Message = 0x0201000c016461786f63616d<BR> Message-Authenticator = 0xe74d9538d9499f002e149f972005f7af<BR> Processing the authorize section of radiusd.conf<BR>modcall: entering group authorize for request 0<BR> modcall[authorize]: module "preprocess" returns ok for request 0<BR> modcall[authorize]: module "attr_filter" returns noop for request 0<BR> modcall[authorize]: module "chap" returns noop for request 0<BR> modcall[authorize]: module "mschap" returns noop for request 0<BR> rlm_realm: No <A href="mailto:'@'" target=_blank>'@'</A> in User-Name = "peter", looking up realm NULL<BR> rlm_realm: No such realm "NULL"<BR> modcall[authorize]: module "suffix" returns noop for request 0<BR> rlm_eap: EAP packet type response id 1 length 12<BR> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation<BR> modcall[authorize]: module "eap" returns updated for request 0<BR> modcall[authorize]: module "files" returns notfound for request 0<BR>rlm_ldap: - authorize<BR>rlm_ldap: performing user authorization for peter<BR>radius_xlat: '(uid=peter)'<BR>radius_xlat: 'ou=x,dc=x,dc=x'<BR>rlm_ldap: ldap_get_conn: Checking Id: 0<BR>rlm_ldap: ldap_get_conn: Got Id: 0<BR>rlm_ldap: attempting LDAP reconnection<BR>rlm_ldap: (re)connect to x.x.x:389, authentication 0<BR>rlm_ldap: bind as / to x.x.x.x:389<BR>rlm_ldap: waiting for bind result ...<BR>rlm_ldap: Bind was successful<BR>rlm_ldap: performing search in ou=prf,dc=uax,dc=es, with filter (uid=peter)<BR>rlm_ldap: looking for check items in directory...<BR>rlm_ldap: looking for reply items in directory...<BR>rlm_ldap: user peter authorized to use remote access<BR>rlm_ldap: ldap_release_conn: Release Id: 0<BR> modcall[authorize]: module "ldap" returns ok for request 0<BR>modcall: leaving group authorize (returns updated) for request 0<BR> rad_check_password: Found Auth-Type EAP<BR>auth: type "EAP"<BR> Processing the authenticate section of radiusd.conf<BR>modcall: entering group authenticate for request 0<BR> rlm_eap: EAP Identity<BR> rlm_eap: processing type tls<BR> rlm_eap_tls: Requiring client certificate<BR> rlm_eap_tls: Initiate<BR> rlm_eap_tls: Start returned 1<BR> modcall[authenticate]: module "eap" returns handled for request 0<BR>modcall: leaving group authenticate (returns handled) for request 0<BR>Sending Access-Challenge of id 183 to x.x.x.x port 32840<BR> EAP-Message = 0x010200060d20<BR> Message-Authenticator = 0x00000000000000000000000000000000<BR> State = 0x2ee2998b9fe8c4f9698291efe30cde7c<BR>Finished request 0<BR>Going to the next request<BR>--- Walking the entire request list ---<BR>Waking up in 6 seconds...<BR>--- Walking the entire request list ---<BR>Cleaning up request 0 ID 183 with timestamp 4bde771b<BR>Nothing to do. Sleeping until we see a request.</P>
<P> </P>
<P> </P>
<P> </P>
<P> </P>
<P> </P>
<P> </P>
<P> </P>
<P> </P>
<P> </P>
<P> </P>
<P> </P><SPAN><BR></SPAN></DIV><BR>-<BR>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<SPAN><BR><BR>-- <BR>
<DIV>
<P align=center><FONT color=#990000></FONT> </P>
<P align=center><FONT color=#990000></FONT> </P>
<P align=center><FONT color=#990000></FONT> </P>
<P align=center><FONT color=#990000></FONT> </P>
<P align=center><FONT color=#990000>Daniel Soto</FONT></P>
<P align=center> </P>
<P align=center><FONT color=#990000>Dep. Comunicaciones U.A.X</FONT></P>
<P> </P></DIV><BR></SPAN></div></body></html>