Hello, I have problems with my FreeRADIUS (Installed )Version 1.1.3. The problem is when I use EAP-PEAP, msCHAPv2 for clients Windows and a Server LDAP in Debian.<br>I have Installed freeradius using EAP-PEAP and in the radius.conf is of the next form:<br>
<br>ldap {<br> server = "direcc_IP_LDAP"<br> #identity = "cn=admin,dc=inictel,dc=raap,dc=pe"<br> identity = "uid=user6,cn=admin,dc=inictel,dc=raap,dc=pe"<br>
password = inictel<br> basedn = "dc=inictel,dc=raap,dc=pe"<br> #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"<br> # filter = "(uid=%u)"<br>
groupname_attribute = radiusGriupName<br> groupmembership_attribute = radiusGroupName<br> base_filter = "(objectclass=radiusprofile)"<br> access_attr = "radiusFilterId"<br>
# Mapping of RADIUS dictionary attributes to LDAP<br> # directory attributes.<br> dictionary_mapping = ${raddbdir}/ldap.attrmap<br> authtype=ldap<br> ldap_connections_number = 5<br>
<br>... }<br>And in the file slapd.conf is of the next form:<br><br>database hdb<br><br># The base of your directory in database #1<br>suffix "dc=inictel,dc=raap,dc=pe"<br><br># rootdn directive for specifying a superuser on the database. This is needed<br>
# for syncrepl.<br>rootdn "cn=admin,dc=inictel,dc=raap,dc=pe"<br>rootpw inictel<br># Where the database file are physically stored for database #1<br>directory "/var/lib/ldap"<br>
<br>---------------------<br>In vim /etc/raddb/users is the next form:<br><br>#DEFAULT Auth-Type = System<br># Fall-Through = 1<br>DEFAULT Auth-Type = LDAP<br> Fall-Through = 1<br>#userX User-Password == passX<br>
# Auth-Type := LOCAL<br><br>The clients.conf is Ok, and when I do radiusd -X is OK, and I tested of the next form:<br><br>[root@localhost raddb]# radtest user6 inictel 127.0.0.1 10 testing123<br>Sending Access-Request of id 247 to 127.0.0.1 port 1812<br>
User-Name = "user6"<br> User-Password = "inictel"<br> NAS-IP-Address = 255.255.255.255<br> NAS-Port = 10<br>rad_recv: Access-Accept packet from host <a href="http://127.0.0.1:1812">127.0.0.1:1812</a>, id=247, length=64<br>
Filter-Id = "Enterasys:version=1:policy=Enterprise User"<br><br><span id="result_box" class="short_text"><span style="" title="">So everything is ok there but when I want authenticate a supplicant since my laptop, I have problems:<br>
<br><br></span></span>rlm_ldap: - authorize<br>rlm_ldap: performing user authorization for user6<br>radius_xlat: '(uid=user6)'<br>radius_xlat: 'dc=inictel,dc=raap,dc=pe'<br>rlm_ldap: ldap_get_conn: Checking Id: 0<br>
rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: performing search in dc=inictel,dc=raap,dc=pe, with filter (uid=user6)<br>rlm_ldap: checking if remote access for user6 is allowed by radiusFilterId<br>rlm_ldap: looking for check items in directory...<br>
rlm_ldap: looking for reply items in directory...<br>rlm_ldap: Adding radiusFilterId as Filter-Id, value Enterasys:version=1:policy=Enterprise User & op=11<br>rlm_ldap: user user6 authorized to use remote access<br>rlm_ldap: ldap_release_conn: Release Id: 0<br>
modcall[authorize]: module "ldap" returns ok for request 274<br>modcall: leaving group authorize (returns updated) for request 274<br> rad_check_password: Found Auth-Type EAP<br>auth: type "EAP"<br>
Processing the authenticate section of radiusd.conf<br>modcall: entering group authenticate for request 274<br> rlm_eap: Request found, released from the list<br> rlm_eap: EAP/peap<br> rlm_eap: processing type peap<br>
rlm_eap_peap: Authenticate<br> rlm_eap_tls: processing TLS<br> eaptls_verify returned 7 <br> rlm_eap_tls: Done initial handshake<br> eaptls_process returned 7 <br> rlm_eap_peap: EAPTLS_OK<br><b style="background-color: rgb(255, 204, 0);"> rlm_eap_peap: Session established. Decoding tunneled attributes.<br>
rlm_eap_peap: Received EAP-TLV response.<br> rlm_eap_peap: Tunneled data is valid.<br> rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session.<br> rlm_eap: Handler failed in EAP/peap<br>
rlm_eap: Failed in EAP select<br> modcall[authenticate]: module "eap" returns invalid for request 274<br>modcall: leaving group authenticate (returns invalid) for request 274<br>auth: Failed to validate the user.<br>
Delaying request 274 for 1 seconds<br>Finished request 274</b><br>Going to the next request<br>Waking up in 5 seconds...<br>rad_recv: Access-Request packet from host <a href="http://200.37.45.97:1645">200.37.45.97:1645</a>, id=65, length=216<br>
Sending Access-Reject of id 65 to 200.37.45.97 port 1645<br> EAP-Message = 0x04080004<br> Message-Authenticator = 0x00000000000000000000000000000000<br>--- Walking the entire request list ---<br>Waking up in 1 seconds...<br>
--- Walking the entire request list ---<br>Cleaning up request 267 ID 58 with timestamp 4c696b6c<br>Cleaning up request 268 ID 59 with timestamp 4c696b6c<br>Cleaning up request 269 ID 60 with timestamp 4c696b6c<br>Cleaning up request 270 ID 61 with timestamp 4c696b6c<br>
<br>I can't authenticate my supplicant, Could you help me please<br><br>Thank You!.<br clear="all"><br>-- <br>Quinto Ancieta Javier Richard<br><a href="mailto:jquinto@inictel-uni.edu.pe" target="_blank">jquinto@inictel-uni.edu.pe</a>, <a href="mailto:richardqa@gmail.com" target="_blank">richardqa@gmail.com</a><br>
telf: 9931-78569-5213902-3461808-533<br><br>Remember:<br>Nothing is impossible, because the dreams of yesterday are the hopes of today and tomorrow can become a reality.<br><br>