Why not setup your NAS to use PAP, instead of MS-CHAP.<br><br>If you use MS-CHAP you will need to have NT Hash'es in your LDAP directory.<br><br>It would be far easier to have PAP authentication enabled on your NAS, then it should work fine.<br>
<br><div class="gmail_quote">On Tue, Jul 6, 2010 at 3:59 AM, Daniel Gomes <span dir="ltr"><<a href="mailto:dgomes@ipfn.ist.utl.pt">dgomes@ipfn.ist.utl.pt</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Dear list,<br>
<br>
I know this is a question which has been thoroughly asked and answered,<br>
but after spending several days configuring, debugging, searching the<br>
internet, rec-configuring, etc, I still can't get my freeradius server<br>
to properly authenticate users (for a pptd server).<br>
<br>
First of all, on the pptpd server's side (which I know it's not your<br>
"jurisdiction", so I'll be fast here), I have the require-mschap-v2 and<br>
require-mppe options enabled.<br>
<br>
As for freeradius itself, a summarized sites-enabled/default reads:<br>
<br>
authorize {<br>
preprocess<br>
<br>
pap<br>
<br>
mschap<br>
<br>
ldap<br>
<br>
auth_log<br>
<br>
eap {<br>
ok = return<br>
}<br>
<br>
expiration<br>
logintime<br>
}<br>
<br>
authenticate {<br>
Auth-Type PAP {<br>
pap<br>
}<br>
<br>
Auth-Type MS-CHAP {<br>
mschap<br>
}<br>
<br>
Auth-Type LDAP {<br>
ldap<br>
}<br>
<br>
eap<br>
}<br>
<br>
My modules/ldap contains all the necessary information, and my<br>
modules/mschap has the options use_mppe, require_encryption and<br>
require_strong enabled, like most tutorials state.<br>
<br>
As for the results, radtest works fine (querying LDAP etc), but through<br>
pptd it always fails with this error:<br>
<br>
----------------<br>
<br>
rad_recv: Access-Request packet from host 127.0.0.1 port 39968, id=75,<br>
length=151<br>
Service-Type = Framed-User<br>
Framed-Protocol = PPP<br>
User-Name = "dgomes"<br>
MS-CHAP-Challenge = 0x4276ec425c25a93a22c31b2bc34cdd17<br>
MS-CHAP2-Response =<br>
0x48003ac4b88e3cc4c6b5819eb258c434e27a000000000000000002a4c78177ee841a98cf68cb9686085635bd3b3083707eb3<br>
Calling-Station-Id = "193.136.136.200"<br>
NAS-IP-Address = 193.136.136.40<br>
NAS-Port = 0<br>
+- entering group authorize {...}<br>
++[preprocess] returns ok<br>
[pap] WARNING! No "known good" password found for the user.<br>
Authentication may fail because of this.<br>
++[pap] returns noop<br>
[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'<br>
++[mschap] returns ok<br>
[ldap] performing user authorization for dgomes<br>
WARNING: Deprecated conditional expansion ":-". See "man unlang" for<br>
details<br>
expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=dgomes)<br>
expand: ou=people,dc=ipfn,dc=ist,dc=utl,dc=pt -><br>
ou=people,dc=ipfn,dc=ist,dc=utl,dc=pt<br>
rlm_ldap: ldap_get_conn: Checking Id: 0<br>
rlm_ldap: ldap_get_conn: Got Id: 0<br>
rlm_ldap: attempting LDAP reconnection<br>
rlm_ldap: (re)connect to <a href="http://gold.ipfn.ist.utl.pt:389" target="_blank">gold.ipfn.ist.utl.pt:389</a>, authentication 0<br>
rlm_ldap: bind as<br>
cn=radius,ou=people,dc=ipfn,dc=ist,dc=utl,dc=pt/passVPN to<br>
<a href="http://gold.ipfn.ist.utl.pt:389" target="_blank">gold.ipfn.ist.utl.pt:389</a><br>
rlm_ldap: waiting for bind result ...<br>
rlm_ldap: Bind was successful<br>
rlm_ldap: performing search in ou=people,dc=ipfn,dc=ist,dc=utl,dc=pt,<br>
with filter (cn=dgomes)<br>
[ldap] No default NMAS login sequence<br>
[ldap] looking for check items in directory...<br>
[ldap] looking for reply items in directory...<br>
WARNING: No "known good" password was found in LDAP. Are you sure that<br>
the user is configured correctly?<br>
[ldap] user dgomes authorized to use remote access<br>
rlm_ldap: ldap_release_conn: Release Id: 0<br>
++[ldap] returns ok<br>
expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y<br>
%m%d -> /var/log/freeradius/radacct/<a href="http://127.0.0.1/auth-detail-20100708" target="_blank">127.0.0.1/auth-detail-20100708</a><br>
[auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/<a href="http://127.0.0.1/auth-detail-20100708" target="_blank">127.0.0.1/auth-detail-20100708</a><br>
expand: %t -> Thu Jul 8 14:08:34 2010<br>
++[auth_log] returns ok<br>
[eap] No EAP-Message, not doing EAP<br>
++[eap] returns noop<br>
++[expiration] returns noop<br>
++[logintime] returns noop<br>
Found Auth-Type = MSCHAP<br>
+- entering group MS-CHAP {...}<br>
[mschap] No Cleartext-Password configured. Cannot create LM-Password.<br>
[mschap] No Cleartext-Password configured. Cannot create NT-Password.<br>
[mschap] Told to do MS-CHAPv2 for dgomes with NT-Password<br>
[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.<br>
[mschap] FAILED: MS-CHAP2-Response is incorrect<br>
++[mschap] returns reject<br>
Failed to authenticate the user.<br>
Using Post-Auth-Type Reject<br>
+- entering group REJECT {...}<br>
expand: %{User-Name} -> dgomes<br>
attr_filter: Matched entry DEFAULT at line 11<br>
++[attr_filter.access_reject] returns updated<br>
Delaying reject of request 0 for 1 seconds<br>
Going to the next request<br>
<br>
------------------<br>
<br>
I know that the error should be enough for me to fix it (since it's<br>
quite explanatory), but after trying many different configurations and<br>
searching through dozens of old mailing lists posts, I still haven't<br>
managed it...<br>
<br>
So yeah, of you could help me out, I'd appreciate it! All I want is<br>
pptpd to authenticate the users with a LDAP backend, via RADIUS. MS-CHAP<br>
is not even a requirement for me here, since both services are on the<br>
same machine, so there's not even the need for safe connections. So long<br>
as it works, I really don't care about any particular configuration!<br>
<br>
Thanks in advance,<br>
Daniel Gomes<br>
<br>
-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
</blockquote></div><br>