<HTML>
<HEAD>
<TITLE>Re: 802.1x ->Radius ->Ldap</TITLE>
</HEAD>
<BODY>
<FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>Doing an ldapsearch put me on the right track, I had created a user ‘radiusd’, but that user did not have the rights to request the userPassword. <BR>
<BR>
The error I am getting now is: <BR>
<BR>
Found Auth-Type = EAP<BR>
+- entering group authenticate {...}<BR>
[eap] Request found, released from the list<BR>
[eap] EAP/mschapv2<BR>
[eap] processing type mschapv2<BR>
[mschapv2] +- entering group MS-CHAP {...}<BR>
[mschap] Told to do MS-CHAPv2 for kplimack with NT-Password<BR>
[mschap] FAILED: MS-CHAP2-Response is incorrect<BR>
++[mschap] returns reject<BR>
<BR>
I added an entry to ldap.attrmap, “checkItem Cleartext-Password userPassword”<BR>
The Password is not cleartext, but I read somewhere that radius is supposed to figure that out automatically from a header. This is what is returned:<BR>
<BR>
rlm_ldap: userPassword -> Cleartext-Password == "{SSHA}xQjX16XbCUSXpiR2y****************"<BR>
<BR>
<BR>
Full Log:<BR>
<a href="http://pastebin.com/ZJuPsyrb">http://pastebin.com/ZJuPsyrb</a><BR>
<BR>
<BR>
<BR>
<BR>
On 6/18/10 7:14 AM, "John Dennis" <<a href="jdennis@redhat.com">jdennis@redhat.com</a>> wrote:<BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>On 06/18/2010 02:01 AM, Alan DeKok wrote:<BR>
> Kyle Plimack wrote:<BR>
>> I have pap working (i.e. I ran radtest and got an access-accept).<BR>
>> I don’t want to configure certs on each of my hosts for each of my<BR>
>> clients, so I’d like to use PEAP/msChapV2 so that dot1x clients are<BR>
>> prompted for and username/password.<BR>
>><BR>
>> According the the deployingradius.com guide, once pap is working,<BR>
>> mschapv2 should “just work”. It doesn’t.<BR>
><BR>
> Your debug output shows you are using PEAP. That is *not* MSCHAPv2.<BR>
><BR>
>> I’ve put the log on pastebin where it is formatted in a more friendly way<BR>
>> <a href="http://pastebin.com/9tSjQW1f">http://pastebin.com/9tSjQW1f</a><BR>
><BR>
> You have added "ldap" to the "inner-tunnel" section. That's good.<BR>
> You haven't read the WARNING in the debug output, as pointed out by<BR>
> John. That's bad.<BR>
><BR>
> The server NEEDS a "known good" password in order to authenticate the<BR>
> user. The LDAP server didn't supply one. Ensure that that LDAP server<BR>
> returns a password. It *will* work.<BR>
<BR>
Do an ldapsearch on the command line for the user to see what is getting<BR>
returned to radius. Look for the password attributes, are they there? Is<BR>
there a cleartext password rather than just hashes? Does the cleartext<BR>
password attribute in ldap match the password attribute in your radius<BR>
ldap config (by default it's userPassword). Does your<BR>
/etc/raddb/ldap.attrmap file have this line?<BR>
<BR>
checkItem Cleartext-Password userPassword<BR>
<BR>
Don't forget to put an ACL on the password attributes in ldap, you don't<BR>
want others to be able to read them! If you don't want to store<BR>
cleartext passwords you'll need to restrict the protocols you support.<BR>
<BR>
--<BR>
John Dennis <<a href="jdennis@redhat.com">jdennis@redhat.com</a>><BR>
<BR>
Looking to carve out IT costs?<BR>
www.redhat.com/carveoutcosts/<BR>
-<BR>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a> <BR>
<BR>
</SPAN></FONT></BLOCKQUOTE>
</BODY>
</HTML>