<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-text-flowed" style="font-family: -moz-fixed;
font-size: 12px;" lang="x-western">Server: Debian 6 (Squeeze)
2.6.32-5-amd64
<br>
FreeRadius: 2.1.10 (Debian package)
<br>
Client: HP E-MSM460 AP (MSCHAPv2, Use message authenticator)
<br>
Authentication methods for the MSM460 are: MSCHAPv2, MSCHAP, CHAP,
EAP MD5 and PAP.<br>
<br>
I'm trying to set up a simple MAC-Auth based network using HP 2610
switches and MSM640 wireless APs as radius clients. I've added the
AP to the clients.conf and configured the AP to use MAC-based
authentication and it appears to be talking to FreeRadius using
MSCHAPv2 correctly.
<br>
<br>
We only have a few dozen clients, so I'm using the perl module to
read and cache a text file of MAC addresses. My script watches the
file's mtime and re-loads it as necessary. I've followed the
instructions on <a class="moz-txt-link-freetext"
href="http://wiki.freeradius.org/Rlm_perl">http://wiki.freeradius.org/Rlm_perl</a>,
but I get the following error:
<br>
<br>
/etc/freeradius/users[204]: Parse error (check) for entry DEFAULT:
Unknown value Perl for attribute Auth-Type
<br>
<br>
After some trial and error, I found that adding perl to the
authorize and authenticate sections of
sites-available/inner-tunnel would get rid of the error, but I
have no idea if that solved the problem or merely masked it and
caused he next one.<br>
<br>
There appears to be something seriously wrong with the way this
config is working, because rlm_perl is calling the AUTHORIZE
function but not AUTHENTICATE. I've pasted the debug of an
authentication attempt below. It appears to be taking the CLIENT
mschap authentication and somehow applying those attributes to
mangle USER authentication.<br>
<br>
rad_recv: Access-Request packet from host 192.168.0.29 port 35063,
id=48, length
<br>
=275
<br>
Acct-Session-Id = "1ca83cd8-00013b2c"
<br>
NAS-Port = 0
<br>
NAS-Port-Type = Wireless-802.11
<br>
NAS-Identifier = "CN18D332BD"
<br>
NAS-IP-Address = 192.168.0.29
<br>
User-Name = "984b4af5bf40"
<br>
Calling-Station-Id = "98:4b:4a:f5:bf:40"
<br>
Called-Station-Id = "2c:41:38:f4:f5:c0"
<br>
Service-Type = Login-User
<br>
MS-CHAP-Challenge = 0x5ec43b8666ef945c1db7a14cc42da516
<br>
MS-CHAP2-Response =
0x3000f12947d93103bfe476001a4f8d6fcc6800000000000000
<br>
00fe6dae7fbe3907cbb43186ffcc0ed0f6f16a31b47731bdba
<br>
Colubris-AVPair = "ssid=TSV-UC"
<br>
Colubris-AVPair = "phytype=IEEE802dot11n"
<br>
Message-Authenticator = 0xf6affdfe1901c35141d3128eed2c515e
<br>
# Executing section authorize from file
/etc/freeradius/sites-enabled/default
<br>
+- entering group authorize {...}
<br>
++[preprocess] returns ok
<br>
++[chap] returns noop
<br>
[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'
<br>
++[mschap] returns ok
<br>
++[digest] returns noop
<br>
[suffix] No '@' in User-Name = "984b4af5bf40", looking up realm
NULL
<br>
[suffix] No such realm "NULL"
<br>
++[suffix] returns noop
<br>
[eap] No EAP-Message, not doing EAP
<br>
++[eap] returns noop
<br>
[files] users: Matched entry DEFAULT at line 204
<br>
++[files] returns ok
<br>
rlm_perl: AUTHORIZE
<br>
rlm_perl: RAD_REQUEST: NAS-Port-Type = Wireless-802.11
<br>
rlm_perl: RAD_REQUEST: Acct-Session-Id = 1ca83cd8-00013b2c
<br>
rlm_perl: RAD_REQUEST: Service-Type = Login-User
<br>
rlm_perl: RAD_REQUEST: Called-Station-Id = 2c:41:38:f4:f5:c0
<br>
rlm_perl: RAD_REQUEST: Calling-Station-Id = 98:4b:4a:f5:bf:40
<br>
rlm_perl: RAD_REQUEST: Message-Authenticator =
0xf6affdfe1901c35141d3128eed2c515e
<br>
rlm_perl: RAD_REQUEST: MS-CHAP-Challenge =
0x5ec43b8666ef945c1db7a14cc42da516
<br>
rlm_perl: RAD_REQUEST: User-Name = 984b4af5bf40
<br>
rlm_perl: RAD_REQUEST: NAS-Identifier = CN18D332BD
<br>
rlm_perl: RAD_REQUEST: MS-CHAP2-Response =
0x3000f12947d93103bfe476001a4f8d6fcc680000000000000000fe6dae7fbe3907cbb43186ffcc0ed0f6f16a31b47731bdba<br>
rlm_perl: RAD_REQUEST: Colubris-AVPair = ARRAY(0x127d4d8)
<br>
rlm_perl: RAD_REQUEST: NAS-Port = 0
<br>
rlm_perl: RAD_REQUEST: NAS-IP-Address = 192.168.0.29
<br>
rlm_perl: Added pair NAS-Port-Type = Wireless-802.11
<br>
rlm_perl: Added pair Acct-Session-Id = 1ca83cd8-00013b2c
<br>
rlm_perl: Added pair Service-Type = Login-User
<br>
rlm_perl: Added pair Called-Station-Id = 2c:41:38:f4:f5:c0
<br>
rlm_perl: Added pair Calling-Station-Id = 98:4b:4a:f5:bf:40
<br>
rlm_perl: Added pair Message-Authenticator =
0xf6affdfe1901c35141d3128eed2c515e
<br>
rlm_perl: Added pair MS-CHAP-Challenge =
0x5ec43b8666ef945c1db7a14cc42da516
<br>
rlm_perl: Added pair User-Name = 984b4af5bf40
<br>
rlm_perl: Added pair NAS-Identifier = CN18D332BD
<br>
rlm_perl: Added pair MS-CHAP2-Response =
0x3000f12947d93103bfe476001a4f8d6fcc680000000000000000fe6dae7fbe3907cbb43186ffcc0ed0f6f16a31b47731bdba<br>
rlm_perl: Added pair Colubris-AVPair = ssid=TSV-UC
<br>
rlm_perl: Added pair Colubris-AVPair = phytype=IEEE802dot11n
<br>
rlm_perl: Added pair NAS-Port = 0
<br>
rlm_perl: Added pair NAS-IP-Address = 192.168.0.29
<br>
rlm_perl: Added pair Auth-Type = MSCHAP
<br>
++[perl] returns ok
<br>
++[expiration] returns noop
<br>
++[logintime] returns noop
<br>
[pap] WARNING! No "known good" password found for the user.
Authentication may fail because of this.
<br>
++[pap] returns noop
<br>
Found Auth-Type = MSCHAP
<br>
# Executing group from file /etc/freeradius/sites-enabled/default
<br>
+- entering group MS-CHAP {...}
<br>
[mschap] No Cleartext-Password configured. Cannot create
LM-Password.
<br>
[mschap] No Cleartext-Password configured. Cannot create
NT-Password.
<br>
[mschap] Creating challenge hash with username: 984b4af5bf40
<br>
[mschap] Told to do MS-CHAPv2 for 984b4af5bf40 with NT-Password
<br>
[mschap] FAILED: No NT/LM-Password. Cannot perform
authentication.
<br>
[mschap] FAILED: MS-CHAP2-Response is incorrect
<br>
++[mschap] returns reject
<br>
Failed to authenticate the user.
<br>
Using Post-Auth-Type Reject
<br>
# Executing group from file /etc/freeradius/sites-enabled/default
<br>
+- entering group REJECT {...}
<br>
[attr_filter.access_reject] expand: %{User-Name} ->
984b4af5bf40
<br>
attr_filter: Matched entry DEFAULT at line 11
<br>
++[attr_filter.access_reject] returns updated
<br>
Delaying reject of request 0 for 1 seconds
<br>
Going to the next request
<br>
Waking up in 0.9 seconds.
<br>
Sending delayed reject for request 0
<br>
Sending Access-Reject of id 48 to 192.168.0.29 port 35063
<br>
<br>
Regards, Glen.
<br>
<br>
<br>
<br>
</div>
</body>
</html>