September 2006 - Freeradius-Users - lists.freeradius.org

How to use rlm_dbm module ???
by 나종현 26 Sep '06

26 Sep '06

1 0

rlm_perl and accounting
by Justin Church 25 Sep '06

25 Sep '06

I'm running freeradius v. 1.1.0 and am trying to use rlm_perl to rewrite accounting attributes before they are written to log with detail and then replicated with radrelay. Here is the version of example.pl that I'm using (I've only added a single statement to the preacct function): use strict; # use ... # This is very important ! Without this script will not get the filled hashesh from main. use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); #use Data::Dumper; # This is hash wich hold original request from radius #my %RAD_REQUEST; # In this hash you add values that will be returned to NAS. #my %RAD_REPLY; #This is for check items #my %RAD_CHECK; # # This the remapping of return values # use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ # Function to handle authorize sub authorize { # For debugging purposes only # &log_request_attributes; # Here's where your authorization code comes # You can call another function from here: &test_call; return RLM_MODULE_OK; } # Function to handle authenticate sub authenticate { # For debugging purposes only # &log_request_attributes; if ($RAD_REQUEST{'User-Name'} =~ /^baduser/i) { # Reject user and tell him why $RAD_REPLY{'Reply-Message'} = "Denied access by rlm_perl function"; return RLM_MODULE_REJECT; } else { # Accept user and set some attribute $RAD_REPLY{'h323-credit-amount'} = "100"; return RLM_MODULE_OK; } } # Function to handle preacct sub preacct { # For debugging purposes only #&log_request_attributes; $RAD_REPLY{'Acct-Session-Id'} = "new-session-value"; return RLM_MODULE_OK; } # Function to handle accounting sub accounting { # For debugging purposes only # &log_request_attributes; # You can call another subroutine from here #&test_call; return RLM_MODULE_OK; } # Function to handle checksimul sub checksimul { # For debugging purposes only # &log_request_attributes; return RLM_MODULE_OK; } # Function to handle pre_proxy sub pre_proxy { # For debugging purposes only # &log_request_attributes; return RLM_MODULE_OK; } # Function to handle post_proxy sub post_proxy { # For debugging purposes only # &log_request_attributes; return RLM_MODULE_OK; } # Function to handle post_auth sub post_auth { # For debugging purposes only # &log_request_attributes; return RLM_MODULE_OK; } # Function to handle xlat sub xlat { # For debugging purposes only # &log_request_attributes; # Loads some external perl and evaluate it my ($filename,$a,$b,$c,$d) = @_; &radiusd::radlog(1, "From xlat $filename "); &radiusd::radlog(1,"From xlat $a $b $c $d "); local *FH; open FH, $filename or die "open '$filename' $!"; local($/) = undef; my $sub = <FH>; close FH; my $eval = qq{ sub handler{ $sub;} }; eval $eval; eval {main->handler;}; } # Function to handle detach sub detach { # For debugging purposes only # &log_request_attributes; # Do some logging. &radiusd::radlog(0,"rlm_perl::Detaching. Reloading. Done."); } # # Some functions that can be called from other functions # sub test_call { # Some code goes here } sub log_request_attributes { # This shouldn't be done in production environments! # This is only meant for debugging! for (keys %RAD_REQUEST) { &radiusd::radlog(1, "RAD_REQUEST: $_ = $RAD_REQUEST{$_}"); } } Here's the output of freeradius -X: root@black-pearl:/etc/freeradius# freeradius -X ... Module: Loaded perl perl: module = "/home/jcc/scripts/example.pl" perl: func_authorize = "authorize" perl: func_authenticate = "authenticate" perl: func_accounting = "accounting" perl: func_preacct = "preacct" perl: func_checksimul = "checksimul" perl: func_detach = "detach" perl: func_xlat = "xlat" perl: func_pre_proxy = "pre_proxy" perl: func_post_proxy = "post_proxy" perl: func_post_auth = "post_auth" perl: perl_flags = "(null)" perl: func_start_accounting = "(null)" perl: func_stop_accounting = "(null)" perl: max_clones = 32 perl: start_clones = 5 perl: min_spare_clones = 3 perl: max_spare_clones = 3 perl: cleanup_delay = 5 perl: max_request_per_clone = 0 Module: Instantiated perl (perl) ... Here's my radiusd.conf: ... modules { perl { module = /home/jcc/scripts/example.pl max_clones = 32 start_clones = 5 min_spare_clones = 3 max_spare_clones = 3 cleanup_delay = 5 max_request_per_clone = 0 } } ... preacct { preprocess acct_unique perl suffix files } accounting { local-detail radrelay-detail unix radutmp } ... Notice from my example.pl that I'm trying to rewrite the value for Acct-Session-Id. The freeradius -X output shows that I've added a new pair, Acct-Session-Id = new-session-value, but only the original value shows up in the radacct log, not the new value: rad_recv: Accounting-Request packet from host 127.0.0.1:32819, id=89, length=65 User-Name = "jcc" NAS-Port = 1 Acct-Session-Id = "accounting-session-1" Sip-Transport-Protocol = TCP Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_acct_unique: Hashing 'NAS-Port = 1,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "accounting-session-1",User-Name = "jcc"' rlm_acct_unique: Acct-Unique-Session-ID = "4f08f8eb92e050ff". modcall[preacct]: module "acct_unique" returns ok for request 0 perl_pool: item 0x8168260 asigned new request. Handled so far: 1 found interpetator at address 0x8168260 rlm_perl: Added pair Acct-Session-Id = new-session-value perl_pool total/active/spare [5/0/5] Could not get @DynaLoader::dl_librefs for unloading. Unreserve perl at address 0x8168260 modcall[preacct]: module "perl" returns ok for request 0 rlm_realm: No '@' in User-Name = "jcc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 0 modcall[preacct]: module "files" returns noop for request 0 modcall: leaving group preacct (returns ok) for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: '/var/log/freeradius/radacct/127.0.0.1/detail-20060822' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/detail-20060822 modcall[accounting]: module "local-detail" returns ok for request 0 radius_xlat: '/var/log/freeradius/radacct/radrelay-detail' rlm_detail: /var/log/freeradius/radacct/radrelay-detail expands to /var/log/freeradius/radacct/radrelay-detail rlm_detail: Acquired filelock, tried 1 time(s) rlm_detail: Released filelock modcall[accounting]: module "radrelay-detail" returns ok for request 0 rlm_unix: no Accounting-Status-Type attribute in request. modcall[accounting]: module "unix" returns noop for request 0 rlm_radutmp: No Accounting-Status-Type record. modcall[accounting]: module "radutmp" returns noop for request 0 modcall: leaving group accounting (returns ok) for request 0 Sending Accounting-Response of id 89 to 127.0.0.1 port 32819 Finished request 0 Going to the next request --- Walking the entire request list --- Cleaning up request 0 ID 89 with timestamp 44eb308c Nothing to do. Sleeping until we see a request. radrelay-detail log: Tue Aug 22 12:27:56 2006 User-Name = "jcc" NAS-Port = 1 Acct-Session-Id = "accounting-session-1" Sip-Transport-Protocol = TCP NAS-IP-Address = 127.0.0.1 Client-IP-Address = 127.0.0.1 Acct-Unique-Session-Id = "4f08f8eb92e050ff" Timestamp = 1156264076 What am I missing? Thanks. -jc

9 37

Re: Segfault with EAP-PEAP/MSCHAPv2
by Paul A Roberts 25 Sep '06

25 Sep '06

This is the core dump. FreeBSD 6.1 host, 1.1.2 FreeRadius. Authenticates fine using NTRadPing with MS-CHAP but crashes each time trying to authenticate from an XP box using EAP-PEAP/MS-CHAPv2. cat gdb-radiusd.log * 8 LWP 100065 0x280ac4ab in pthread_testcancel () from /usr/lib/libpthread.so.2 7 Thread 0x8077000 (runnable) 0x282e775f in select () from /lib/libc.so.6 6 Thread 0x8143000 (LWP 100061) 0x280ac46b in pthread_testcancel () from /usr/lib/libpthread.so.2 5 Thread 0x8143200 (sleeping) 0x280a4f0f in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 4 Thread 0x8143400 (sleeping) 0x280a4f0f in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 3 Thread 0x8143600 (runnable) 0x281db323 in sk_value () from /lib/libcrypto.so.4 2 Thread 0x8143800 (sleeping) 0x280a4f0f in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 1 Thread 0x8143a00 (sleeping) 0x280a4f0f in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 Thread 8 (LWP 100065): #0 0x280ac46b in pthread_testcancel () from /usr/lib/libpthread.so.2 No symbol table info available. #1 0x280a4e3c in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #2 0x2808e450 in ?? () No symbol table info available. Thread 7 (Thread 0x8077000 (runnable)): #0 0x282e775f in select () from /lib/libc.so.6 No symbol table info available. #1 0x2809503d in select () from /usr/lib/libpthread.so.2 No symbol table info available. #2 0x08056231 in main () No symbol table info available. Thread 6 (Thread 0x8143000 (LWP 100061)): #0 0x280ac46b in pthread_testcancel () from /usr/lib/libpthread.so.2 No symbol table info available. #1 0x280a4e3c in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #2 0x2808e450 in ?? () No symbol table info available. Thread 5 (Thread 0x8143200 (sleeping)): #0 0x280a4f0f in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #1 0x280a50a3 in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #2 0x280a96b1 in _pthread_cond_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #3 0x280a9bfa in pthread_cond_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #4 0x28094d6f in sem_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #5 0x0805a95f in smux_start () No symbol table info available. #6 0x2809d319 in pthread_create () from /usr/lib/libpthread.so.2 No symbol table info available. #7 0x282cf637 in _ctx_start () from /lib/libc.so.6 No symbol table info available. Thread 4 (Thread 0x8143400 (sleeping)): #0 0x280a4f0f in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #1 0x280a50a3 in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #2 0x280a96b1 in _pthread_cond_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #3 0x280a9bfa in pthread_cond_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #4 0x28094d6f in sem_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #5 0x0805a95f in smux_start () No symbol table info available. #6 0x2809d319 in pthread_create () from /usr/lib/libpthread.so.2 No symbol table info available. #7 0x282cf637 in _ctx_start () from /lib/libc.so.6 No symbol table info available. Thread 3 (Thread 0x8143600 (runnable)): #0 0x281db323 in sk_value () from /lib/libcrypto.so.4 No symbol table info available. #1 0x28464f8c in ssl3_output_cert_chain () from /usr/local/lib/libssl.so No symbol table info available. Thread 2 (Thread 0x8143800 (sleeping)): #0 0x280a4f0f in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #1 0x280a50a3 in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #2 0x280a96b1 in _pthread_cond_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #3 0x280a9bfa in pthread_cond_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #4 0x28094d6f in sem_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #5 0x0805a95f in smux_start () No symbol table info available. #6 0x2809d319 in pthread_create () from /usr/lib/libpthread.so.2 No symbol table info available. #7 0x282cf637 in _ctx_start () from /lib/libc.so.6 No symbol table info available. Thread 1 (Thread 0x8143a00 (sleeping)): #0 0x280a4f0f in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #1 0x280a50a3 in pthread_mutexattr_init () from /usr/lib/libpthread.so.2 No symbol table info available. #2 0x280a96b1 in _pthread_cond_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #3 0x280a9bfa in pthread_cond_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #4 0x28094d6f in sem_wait () from /usr/lib/libpthread.so.2 No symbol table info available. #5 0x0805a95f in smux_start () No symbol table info available. #6 0x2809d319 in pthread_create () from /usr/lib/libpthread.so.2 No symbol table info available. #7 0x282cf637 in _ctx_start () from /lib/libc.so.6 No symbol table info available. #0 0x280ac46b in pthread_testcancel () from /usr/lib/libpthread.so.2 -----Original Message----- >From: Alan DeKok <aland(a)deployingradius.com> >Sent: Sep 25, 2006 7:36 AM >To: Paul A Roberts <proberts(a)teleport.com>, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> >Subject: Re: Segfault with EAP-PEAP/MSCHAPv2 > >Paul A Roberts <proberts(a)teleport.com> wrote: >> Segmentation fault (core dumped) > > doc/bugs describes what to do. > > Alan DeKok. >-- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog

3 2

RE: Hiding Passwords in Debug Output
by Garber, Neal 25 Sep '06

25 Sep '06

Let me start by saying that I appreciate the amount of time and effort you and others expend toward maintaining FreeRadius, answering countless/repetitive "my thing don't work, what's wrong" and "how do I..." questions, and responding to seemingly ridiculous enhancement requests *g* from people like me. You have certainly provided me information that was helpful to me in getting FreeRadius working. Thank you for sharing your time and knowledge Alan. > The whole purpose of debugging mode is to print out what the server > is doing. Hiding information is a guaranteed way to create problems. I agree with you 100% that having the server show what it is doing is very helpful when troubleshooting problems. Can you help me understand how displaying the plaintext password tells me what the server is doing? Even though the password is hidden by encryption in many other protocols, it is possible to properly configure and troubleshoot FreeRadius for these protocols. Are you saying you don't see any value in having the option to hide secret information? I freely admit that I'm fairly new to FreeRadius and this list, but I bet it's atypical that the actual value of the password (not whether the attribute is present) is necessary for non-FreeRadius developers to troubleshoot server problems. If you disagree, can you help enlighten me? > a) Why is it a security exposure? You haven't explained. Security exposure is perhaps the wrong term. I believe it increases the risk of user account compromise with little or no benefit to the administrator. Displaying the password while troubleshooting our FreeRadius deployment did not help me solve any problems. I'm open to the idea that it might help some people solve problems. But, if it's not normally needed and it's secret information, why not give administrators the option to suppress it (as the detail module does)? > You're really saying that it's a security exposure to show passwords > to the administrator who has permission to stop and start the server? What I'm saying is that displaying plaintext passwords and/or potentially storing them unencrypted on electronic media (e.g., redirected output from FreeRadius that is stored on disk and in backups), increases the risk of user account compromise. Also, being a FreeRadius administrator does not imply that you are an administrator of the backend user database. I'm not sure I understand the relevance of having permission to stop and start the server.. > b) If the default is changed to not show the passwords, are *you* > going to answer umpteen questions on this list about "why does the > password show up as ***"? That's an excellent point - I could easily see that outcome. Would you feel differently if the mask was different (e.g., "<password hidden by config. option>")? What if the default was to show the passwords so the server acts the same as it does now unless the administrator goes out of their way to change it?

2 1

Rewriting reply attributes
by Graham Beneke 25 Sep '06

25 Sep '06

Hi guys Is there any way (in some post processing module perhaps) to rewrite the name of a reply attribute without changing the value. One of the modules that I am using has the reply attribute 'hardwired' but it is returning the exact attribute value that I require. The more elegant solution would be to make the module more customisable - which is something I plan to pursue on the devel list shortly. But it would be really good if I can find a stop gap solution in the mean time. -- Graham Beneke Apolix Internet Services E-Mail: graham(a)apolix.co.za <mailto:graham@apolix.co.za> Cell: 082-432-1873 <callto://+27824321873> Skype: grbeneke <callto://grbeneke> WEB: www.apolix.co.za <http://www.apolix.co.za/>

2 2

testing freeRadius
by Mike May 25 Sep '06

25 Sep '06

Hello Everyone, I am looking for some help with testing my installation of freeRadius. Here is my environment, I have 2 radius servers behind a very tight firewall that I do not admin, I need a way that I can test various forms of auth from the radius servers themselves, is that possible, does freeRadius come with it's own set of testing tools that can be run from the command line. Thanks in advaced Mike

3 2

FreeRADIUS + MySQL + md5 passwords?
by Jan Mulders 25 Sep '06

25 Sep '06

Hello all. I'm trying to get FreeRADIUS to authenticate against MD5 passwords. Here's the relevant part of my config... ............ modules { pap { encryption_scheme = md5 } ...... instantiate { #mysqlcounter } authorize { preprocess sql } authenticate { pap } preacct { preprocess } accounting { #acct_unique #detail sql radutmp # ? } session { radutmp # ? sql } [end of file] I have the passwords in my database as MD5 (I have included a testuser2 with a plaintext password for troubleshooting): id UserName Attribute op Value 1 testuser1 Password == ae2b1fca515949e5d54fb22b8ed95575 2 testuser2 Password == testing What do I need to do to make FreeRADIUS authenticate passwords sent as plaintext to it from a client NAS, to MD5 stored in the database? Is this possible? (please see attempt logs below) Regards, Jan Mulders ### client request ### www~# radtest testuser1 testing localhost:1812 3 testing123 Sending Access-Request of id 111 to 127.0.0.1 port 1812 User-Name = "testuser1" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 3 Re-sending Access-Request of id 111 to 127.0.0.1 port 1812 User-Name = "testuser1" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 3 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=111, length=20 0www~# ### radiusd log ### Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:49086, id=111, length=61 User-Name = "testuser1" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 3 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): No matching entry in the database for request from user [testuser1] Login incorrect: [testuser1/testing] (from client localhost port 3) rad_recv: Access-Request packet from host 127.0.0.1:49086, id=111, length=61 Sending Access-Reject of id 111 to 127.0.0.1 port 49086

3 2

RE: PEAP-MSCHAPv2 against AD
by Jonathan De Graeve 25 Sep '06

25 Sep '06

> > > Login incorrect: [IMZ\\jonathan/<no User-Password attribute>] (from > > Do you have: > > realm IMZ { > type = radius > authhost = LOCAL > accthost = LOCAL > } > > In your proxy.conf file? You don't need the realm (I already tried that one and that didn't work)

1 0

PEAP-MSCHAPv2 against AD
by Jonathan De Graeve 25 Sep '06

25 Sep '06

I'm trying todo PEAP-MSCHAPv2 with authentication against an AD Currently I have the following problem: When the domain is in the username the authentication fails, if the domainname isn't in the authentication the authentication succeeds. I'm using the following ntlm_auth line in radiusd.conf: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134 --domain=%{mschap:NT-Domain:-IMZ}" The with_ntdomain_hack = yes is enabled in the mschap {} Output from shell: radius1:/etc/freeradius# /usr/bin/ntlm_auth --request-nt-key --username=IMZ\\beheerder --challenge=e456e008c25a9ac7 --nt-response=28e9d997b30267a36af64a4fcb530cd6b08f1141c09bc580 --require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134 --domain=IMZ Logon failure (0xc000006d) radius1:/etc/freeradius# /usr/bin/ntlm_auth --request-nt-key --username=beheerder --challenge=e456e008c25a9ac7 --nt-response=28e9d997b30267a36af64a4fcb530cd6b08f1141c09bc580 --require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134 --domain=IMZ NT_KEY: EB23807FB13B1CAB06F4F0BBE5C199D0 Debugging information (with a different user) Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 252 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020800471a0208004231f622919de18b1fdab0ca9902b9729d49000000000000000013 37f654a247b82ba252becd3320cdd94974567666fa081800494d5a5c6a6f6e617468616e PEAP: Setting User-Name to IMZ\jonathan PEAP: Adding old state with 8f f9 PEAP: Sending tunneled request EAP-Message = 0x020800471a0208004231f622919de18b1fdab0ca9902b9729d49000000000000000013 37f654a247b82ba252becd3320cdd94974567666fa081800494d5a5c6a6f6e617468616e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "IMZ\\jonathan" State = 0x8ff913e6997d7ca8d6a9b4832ff5c931 NAS-IP-Address = 194.8.52.161 Connect-Info = "CONNECT 802.11" Called-Station-Id = "000fb5df0524" Calling-Station-Id = "004096ab4eed" NAS-Identifier = "ap" NAS-Port-Type = Wireless-802.11 NAS-Port = 4 NAS-Port-Id = "4" Framed-MTU = 1400 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 252 modcall[authorize]: module "preprocess" returns ok for request 252 modcall[authorize]: module "attr_filter" returns noop for request 252 modcall[authorize]: module "chap" returns noop for request 252 modcall[authorize]: module "mschap" returns noop for request 252 modcall[authorize]: module "digest" returns noop for request 252 rlm_realm: No '@' in User-Name = "IMZ\jonathan", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 252 rlm_eap: EAP packet type response id 8 length 71 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 252 modcall[authorize]: module "files" returns notfound for request 252 radius_xlat: 'IMZ\\jonathan' rlm_sql (sql): sql_set_user escaped user --> 'IMZ\\jonathan' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'IMZ=5C=5C=5C=5Cjonathan' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User IMZ\\jonathan not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgrou pcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'IMZ=5C=5C=5C=5Cjonathan' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrou preply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'IMZ=5C=5C=5C=5Cjonathan' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User IMZ\\jonathan not found in radgroupcheck rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 252 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "validfromlogin" returns noop for request 252 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "validfromcreation" returns noop for request 252 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "uploadlimit" returns noop for request 252 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "volumelimit" returns noop for request 252 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "prepaidcounter" returns noop for request 252 modcall: leaving group authorize (returns updated) for request 252 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 252 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 252 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for jonathan with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 05 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=IMZ\\jonathan --challenge=d13cab581e1c3097 --nt-response=1337f654a247b82ba252becd3320cdd94974567666fa0818 --require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134 --domain=IMZ' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=IMZ\\jonathan --challenge=d13cab581e1c3097 --nt-response=1337f654a247b82ba252becd3320cdd94974567666fa0818 --require-membership-of=S-1-5-21-3816208617-2573269785-2633524980-1134 --domain=IMZ Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 252 modcall: leaving group MS-CHAP (returns reject) for request 252 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 252 modcall: leaving group authenticate (returns reject) for request 252 auth: Failed to validate the user. Login incorrect: [IMZ\\jonathan/<no User-Password attribute>] (from client localhost port 4 cli 004096ab4eed) PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x8978750 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE Anyone out there who nows how to solve this problem? PS I'm running freeradius 1.1.3 Thx in advance, J. -- Jonathan De Graeve Network/System Engineer Imelda vzw Informatica Dienst +32 15/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite ---------

2 1

RE: PEAP-MSCHAPv2 against AD
by Garber, Neal 25 Sep '06

25 Sep '06

> Login incorrect: [IMZ\\jonathan/<no User-Password attribute>] (from Do you have: realm IMZ { type = radius authhost = LOCAL accthost = LOCAL } In your proxy.conf file?

1 0