<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
i have pptpd on a centos 6 box configured to use radius for auth.<br>
radius in turn checks credentials in ldap. <br>
the user in ldap has a samba extension and a configured password (i
used ldap account manager to set it up) it also has a
sambaNTPassword field and it's populated. <br>
rpm -q freeradius gives freeradius-2.1.12-4.el6_3.x86_64<br>
<br>
the auth fails however when i try conencting from my windows8
client.<br>
i need to mention that i am sure i'm inputting correct passwords.<br>
this is the log from radiusd -X <br>
<br>
<blockquote><small>rad_recv: Access-Request packet from host
127.0.0.1 port 49338, id=12, length=152<br>
Service-Type = Framed-User<br>
Framed-Protocol = PPP<br>
User-Name = "testuser1"<br>
MS-CHAP-Challenge = 0x09235ac983790fedc6ccf93af69b67bf<br>
MS-CHAP2-Response =
0x5e004a81f91bcf75cd6452c64bd587a74f210000000000000000ff5eaa8a5df6639683423ed294074ceb705105d5d762932d<br>
Calling-Station-Id = "***.***.***.***" <font
color="#ff0000">- edited out</font><br>
NAS-IP-Address = 127.0.0.1<br>
NAS-Port = 0<br>
# Executing section authorize from file
/etc/raddb/sites-enabled/default<br>
+- entering group authorize {...}<br>
++[preprocess] returns ok<br>
++[chap] returns noop<br>
[mschap] Found MS-CHAP attributes. Setting 'Auth-Type =
mschap'<br>
++[mschap] returns ok<br>
++[digest] returns noop<br>
[suffix] No '@' in User-Name = "testuser1", looking up realm
NULL<br>
[suffix] No such realm "NULL"<br>
++[suffix] returns noop<br>
[eap] No EAP-Message, not doing EAP<br>
++[eap] returns noop<br>
[files] users: Matched entry DEFAULT at line 172<br>
++[files] returns ok<br>
[ldap] performing user authorization for testuser1<br>
[ldap] expand: %{Stripped-User-Name} -> <br>
[ldap] ... expanding second conditional<br>
[ldap] expand: %{User-Name} -> testuser1<br>
[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}})
-> (uid=testuser1)<br>
[ldap] expand: dc=my-domain,dc=com -> dc=my-domain,dc=com <font
color="#ff0000">- edited out</font><br>
[ldap] ldap_get_conn: Checking Id: 0<br>
[ldap] ldap_get_conn: Got Id: 0<br>
[ldap] performing search in dc=my-domain,dc=com, with filter
(uid=testuser1)<br>
[ldap] looking for check items in directory...<br>
[ldap] userPassword -> Password-With-Header ==
"{SSHA}YQwkujoqTZAKF1Jl1e1JRxKKvDVVRGYv"<br>
[ldap] sambaNtPassword -> NT-Password ==
0x3331443643464530443136414539333142373343353944374530433038394330<br>
[ldap] looking for reply items in directory...<br>
[ldap] user testuser1 authorized to use remote access<br>
[ldap] ldap_release_conn: Release Id: 0<br>
++[ldap] returns ok<br>
++[expiration] returns noop<br>
++[logintime] returns noop<br>
[pap] Normalizing NT-Password from hex encoding<br>
[pap] Normalizing SSHA1-Password from base64 encoding<br>
[pap] WARNING: Auth-Type already set. Not setting to PAP<br>
++[pap] returns noop<br>
Found Auth-Type = MSCHAP<br>
# Executing group from file /etc/raddb/sites-enabled/default<br>
+- entering group MS-CHAP {...}<br>
[mschap] No Cleartext-Password configured. Cannot create
LM-Password.<br>
[mschap] Found NT-Password<br>
[mschap] Creating challenge hash with username: testuser1<br>
[mschap] Told to do MS-CHAPv2 for testuser1 with NT-Password<br>
[mschap] FAILED: MS-CHAP2-Response is incorrect<br>
++[mschap] returns reject<br>
Failed to authenticate the user.<br>
Using Post-Auth-Type Reject<br>
# Executing group from file /etc/raddb/sites-enabled/default<br>
+- entering group REJECT {...}<br>
[attr_filter.access_reject] expand: %{User-Name} ->
testuser1<br>
attr_filter: Matched entry DEFAULT at line 11<br>
++[attr_filter.access_reject] returns updated<br>
Delaying reject of request 4 for 1 seconds<br>
Going to the next request<br>
Waking up in 0.9 seconds.<br>
Sending delayed reject for request 4<br>
Sending Access-Reject of id 12 to 127.0.0.1 port 49338<br>
MS-CHAP-Error = "^E=691 R=1
C=50685502b0ea6334450d0cd8077ac242 V=3 M=Re-enter (or reset) the
password"<br>
Waking up in 4.9 seconds.<br>
Cleaning up request 4 ID 12 with timestamp +801<br>
Ready to process requests.</small><br>
</blockquote>
</body>
</html>