<div dir="ltr"><div>replaced with v3.0.x branch, getting a slightly different error. Im 100% the passwords line up. </div><div><br></div><div>rad_recv: Access-Request packet from host 10.x.x.100 port 61392, id=49, length=50</div>
<div> User-Name = 'adamjseed'</div><div> CHAP-Password = 0x79c646622409adfd85b69f1f58428f0658</div><div>(2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default</div><div>
(2) authorize {</div><div>(2) filter_username filter_username {</div><div>(2) ? if (!User-Name)</div><div>(2) ? if (!User-Name) -> FALSE</div><div>(2) ? if (User-Name != "%{tolower:%{User-Name}}")</div>
<div>(2) expand: "%{tolower:%{User-Name}}" -> 'adamjseed'</div><div>(2) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE</div><div>(2) ? if (User-Name =~ / /)</div><div>(2) ? if (User-Name =~ / /) -> FALSE</div>
<div>(2) ? if (User-Name =~ /@.*@/ )</div><div>(2) ? if (User-Name =~ /@.*@/ ) -> FALSE</div><div>(2) ? if (User-Name =~ /\\.\\./ )</div><div>(2) ? if (User-Name =~ /\\.\\./ ) -> FALSE</div><div>(2) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/))</div>
<div>(2) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE</div><div>(2) ? if (User-Name =~ /\\.$/)</div><div>(2) ? if (User-Name =~ /\\.$/) -> FALSE</div><div>(2) ? if (User-Name =~ /@\\./)</div>
<div>(2) ? if (User-Name =~ /@\\./) -> FALSE</div><div>(2) } # filter_username filter_username = notfound</div><div>(2) [preprocess] = ok</div><div>(2) chap : Setting 'Auth-Type := CHAP'</div><div>(2) [chap] = ok</div>
<div>(2) [mschap] = noop</div><div>(2) [digest] = noop</div><div>(2) suffix : No '@' in User-Name = "adamjseed", looking up realm NULL</div><div>(2) suffix : No such realm "NULL"</div><div>
(2) [suffix] = noop</div><div>(2) eap : No EAP-Message, not doing EAP</div><div>(2) [eap] = noop</div><div>(2) [files] = noop</div><div>rlm_ldap (ldap): Reserved connection (4)</div><div>(2) ldap : expand: "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" -> '(uid=adamjseed)'</div>
<div>(2) ldap : expand: "dc=example,dc=com" -> 'dc=example,dc=com'</div><div>(2) ldap : Performing search in 'dc=example,dc=com' with filter '(uid=adamjseed)', scope 'sub'</div>
<div>(2) ldap : Waiting for search result...</div><div>(2) ldap : User object found at DN "cn=adamjseed,ou=users,dc=example,dc=com"</div><div>(2) ldap : Processing user attributes</div><div>(2) ldap : control:Password-With-Header += 'Password01'</div>
<div>rlm_ldap (ldap): Released connection (4)</div><div>rlm_ldap (ldap): Closing connection (0): Too many free connections (5 > 3)</div><div>rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 118 seconds</div>
<div>rlm_ldap (ldap): You probably need to lower "min"</div><div>rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 118 seconds</div><div>rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 118 seconds</div>
<div>(2) [-ldap] = ok</div><div>(2) [expiration] = noop</div><div>(2) [logintime] = noop</div><div>(2) pap : No {...} in Password-With-Header, re-writing to Cleartext-Password</div><div>(2) WARNING: pap : Auth-Type already set. Not setting to PAP</div>
<div>(2) [pap] = noop</div><div>(2) } # authorize = ok</div><div>(2) Found Auth-Type = CHAP</div><div>(2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default</div><div>(2) Auth-Type CHAP {</div><div>
(2) chap : Login attempt by "adamjseed" with CHAP password</div><div>(2) chap : Comparing with "known good" Cleartext-Password</div><div>(2) ERROR: chap : Password is comparison failed: password is incorrect</div>
<div>(2) [chap] = reject</div><div>(2) } # Auth-Type CHAP = reject</div><div>(2) Failed to authenticate the user.</div><div>(2) Using Post-Auth-Type Reject</div><div>(2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default</div>
<div>(2) Post-Auth-Type REJECT {</div><div>(2) attr_filter.access_reject : expand: "%{User-Name}" -> 'adamjseed'</div><div>(2) attr_filter.access_reject : Matched entry DEFAULT at line 11</div>
<div>(2) [attr_filter.access_reject] = updated</div><div>(2) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure</div><div>(2) [eap] = noop</div><div>(2) remove_reply_message_if_eap remove_reply_message_if_eap {</div>
<div>(2) ? if (reply:EAP-Message && reply:Reply-Message)</div><div>(2) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE</div><div>(2) else else {</div><div>(2) [noop] = noop</div><div>
(2) } # else else = noop</div><div>(2) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop</div><div>(2) } # Post-Auth-Type REJECT = updated</div><div>(2) Delaying reject of request 2 for 1 seconds</div>
<div>Waking up in 0.3 seconds.</div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Mar 4, 2014 at 6:03 PM, Alan DeKok <span dir="ltr"><<a href="mailto:aland@deployingradius.com" target="_blank">aland@deployingradius.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="">Adam Seed wrote:<br>
> I just tried this on radiusd: FreeRADIUS Version 3.1.0 (git #b2d5a45),<br>
<br>
</div> Please use the v3.0.x branch from git. I've pushed a fix.<br>
<br>
The "master" branch is under heavy development, and may not always<br>
work correctly.<br>
<span class="HOEnZb"><font color="#888888"><br>
Alan DeKok.<br>
</font></span><div class="HOEnZb"><div class="h5">-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
</div></div></blockquote></div><br></div>