November 2008 - Freeradius-Users - lists.freeradius.org

Weird logic issue...
by Arran Cudbard-Bell 12 Nov '08

12 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Got a weird condition evaluation issue elsif(\ ("%{Supplicant-Flags}" =~ /^10........$/) || \ (("%{Supplicant-Flags}" == 'notfound') && ("%{Realm}" == 'local') && ("%{Huntgroup-Name}" != 'auth-proxy') && \ (("%{Service-Type}" == 'Framed-User') || ("%{Service-Type}" == 'Call-Check'))) \ ){ Gets processed as: ++? if ("%{Supplicant-Flags}" == 'notfound') expand: %{Supplicant-Flags} -> ? Evaluating ("%{Supplicant-Flags}" == 'notfound') -> FALSE ++? if ("%{Supplicant-Flags}" == 'notfound') -> FALSE ++? if ("%{Supplicant-Flags}" =~ /^.1........$/) expand: %{Supplicant-Flags} -> ? Evaluating ("%{Supplicant-Flags}" =~ /^.1........$/) -> FALSE ++? if ("%{Supplicant-Flags}" =~ /^.1........$/) -> FALSE ++? elsif (("%{Supplicant-Flags}" =~ /^10........$/) || (("%{Supplicant-Flags}" == 'notfound') && ("%{Realm}" == 'local') && ("%{Huntgroup-Name}" != 'auth-proxy') && (("%{Service-Type}" == 'Framed-User') || ("%{Service-Type}" == 'Call-Check')) )) expand: %{Supplicant-Flags} -> ?? Evaluating ("%{Supplicant-Flags}" =~ /^10........$/) -> FALSE expand: %{Supplicant-Flags} -> ??? Evaluating ("%{Supplicant-Flags}" == 'notfound') -> FALSE ??? Skipping ("%{Realm}" == 'local') ??? Skipping ("%{Huntgroup-Name}" != 'auth-proxy') ???? Skipping ("%{Service-Type}" == 'Framed-User') ???? Skipping ("%{Service-Type}" == 'Call-Check') ++? elsif (("%{Supplicant-Flags}" =~ /^10........$/) || (("%{Supplicant-Flags}" == 'notfound') && ("%{Realm}" == 'local') && ("%{Huntgroup-Name}" != 'auth-proxy') && (("%{Service-Type}" == 'Framed-User') || ("%{Service-Type}" == 'Call-Check')) )) -> TRUE So the first condition: ("%{Supplicant-Flags}" =~ /^10........$/) returns false Instead of processing the rest of the conditions FR skips the rest of the conditions and returns true for the entire condition... Interestingly if you take out the nested: (("%{Service-Type}" == 'Framed-User') || ("%{Service-Type}" == 'Call-Check')) Condition and replace it with: ("%{Service-Type}" == 'Framed-User') All is well. So only happens with multiple levels of nesting. This has been a bug since at least version 2.0.4. Thanks, Arran - -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer, Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkka/MsACgkQcaklux5oVKI5DQCfVWJqHf8uOWsVqEKHWPZpFHvc FlcAn14qXPIwsHOOme+q7jT7cNqy9TkK =JXk/ -----END PGP SIGNATURE-----

1 0

snmp problem
by Oguzhan Kayhan 12 Nov '08

12 Nov '08

Hi, I am trying snmp on debian 32 bit. With freeradius 2.0.5. and net-snmp 5.4.1 I did all just like on http://wiki.freeradius.org/SNMP_HOWTO. Changed radiusd.conf as snmp = yes $INCLUDE snmp.con and remove comment on line smux_password = verysecret and added the line on snmpd.conf of snmpdaemon "smuxpeer .1.3.6.1.4.1.11344.1.1.1 verysecret" Enabled smux on snmpd too by removing -smux parameter. But i got the following error on freeradius debug.. SMUX connect try 1 SMUX SMUX open oid: 1.3.6.1.4.1.11344.1.1.1 SMUX open progname: radiusd SMUX open password: verysecret SMUX SMUX register oid: 1.3.6.1.2.1.67.1.1.1.1 SMUX register priority: -1 SMUX register operation: 1 SMUX SMUX register oid: 1.3.6.1.2.1.67.2.1.1.1 SMUX register priority: -1 SMUX register operation: 1 SMUX register message send failed: Broken pipe And also snmpd gives the following error: refused smux peer: oid SNMPv2-SMI::enterprises.11344.1.1.1, descr radiusd Is it a bug regarding to snmp or freeradius? Or did i miss something?

2 2

Re: LDAP & MSCHAP errors
by Simon Palmer 12 Nov '08

12 Nov '08

>>pap against LDAP works fine >>chap against LDAP works fine (With ntradping) > >They used different password. Do you mean chap and MSCHAPv2 require passwords in different formats or something? I can auth CHAP, but with the same username and password can't auth CHAPv2 (with no config change on freeradius) My two debugs show that Debug: rlm_ldap: sambaNtPassword -> NT-Password == 0x4145394341303636374123413937333342303139423034323445363933373332 So the NT-Password is being retrieved from LDAP in both cases. > >>BUT - MSCHAPv2 gives "FAILED: MS-CHAP2-Response is incorrect" >>Am I missing something required for MSCHAP to work? The NT-Password >>seems to be retrieved... >> > >A coorect password. Do you think the has being retrieved from LDAP is wrong then? If I do put in an incorrect password I do get the same error message. Does anyone have Freeradius working with MSCHAP against eDir? > >>Working CHAP debug from ntradping: >> >>Tue Nov 11 10:10:26 2008 : Info: [ldap] looking for check items in >>directory... >>Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: acctFlags -> >>SMB-Account-CTRL-TEXT == "[UX ]" >>Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: sambaNtPassword -> >>NT-Password == >>0x4145394341303636374133413937333342303139423034323645363933373332 >>Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: sambaLmPassword -> >>LM-Password == >>0x3635423939303044343142344533363831394631304139333344343836384443 >>Tue Nov 11 10:10:26 2008 : Info: [ldap] looking for reply items in >>directory... >>Tue Nov 11 10:10:26 2008 : Info: [ldap] user testuser authorized to use >>remote access >>Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: ldap_release_conn: Release >>Id: 0 >>Tue Nov 11 10:10:26 2008 : Info: ++[ldap] returns ok >>Tue Nov 11 10:10:26 2008 : Info: ++[expiration] returns noop >>Tue Nov 11 10:10:26 2008 : Info: ++[logintime] returns noop >>Tue Nov 11 10:10:26 2008 : Info: [pap] Normalizing NT-Password from hex >>encoding >>Tue Nov 11 10:10:26 2008 : Info: [pap] Normalizing LM-Password from hex >>encoding >>Tue Nov 11 10:10:26 2008 : Info: [pap] Found existing Auth-Type, not >>changing it. >>Tue Nov 11 10:10:26 2008 : Info: ++[pap] returns noop >>Tue Nov 11 10:10:26 2008 : Info: Found Auth-Type = CHAP >>Tue Nov 11 10:10:26 2008 : Info: +- entering group CHAP {...} >>Tue Nov 11 10:10:26 2008 : Info: [chap] login attempt by "testuser" >>with CHAP password > >***** >>Tue Nov 11 10:10:26 2008 : Info: [chap] Using clear text password >>"ommitted" for user testuser authentication. >***** > >>Where did that come from? I don't know - inside tha chap module? It's retrieved from LDAP. I'm using the default modules/chap - it just says: chap { # no configuration } > >>Tue Nov 11 10:10:26 2008 : Info: [chap] chap user testuser >>authenticated succesfully > >>Default configuration in modules/mschap and modules/chap >>In sites-enabled/default >>authorize { >>ldap >>} > >That is obviously untrue from your debug. Just checked again, modules/mschap has nothing unhashed. modules/chap has as above with # no configuration > >Try doing pap with that NT-Password from ldap (remove clear text password >entry wherever it is). Yeah - PAP works perfectly, chap works perfectly, MSCHAP doesn't. Thanks > >Ivan Kalik >Kalik Informatika ISP Mae'r e-bost hwn ac unrhyw ffeiliau atodedig yn gyfrinachol ac at sylw'r unigolyn neu'r sefydliad a enwir uchod. Bydd unrhyw farn neu sylwadau a fynegir yn perthyn i'r awdur yn unig ac ni chynrychiolant o anghenraid farn Coleg Sir Gâr. Os ydych chi wedi derbyn yr e-bost hwn ar gam, rhowch sylw i'r gweinyddwr ar y cyfeiriad canlynol: postmaster(a)colegsirgar.ac.uk Cysidrwch yr amgylchedd - a oes wir angen argraffu'r ebost hwn? This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Any views or opinions expressed are solely those of the author an d do not necessarily represent those of Coleg Sir Gâr. If you have received this email in error please notify the administrator on the following address: postmaster(a)colegsirgar.ac.uk Please consider the environment - do you really need to print this email?

2 4

VMPS - Initial project ideas
by Hairy51 12 Nov '08

12 Nov '08

Hi all, I am just about to start a project to remove the VMPS system from an aging catalyst switch and i would like to investigate the possibilty of using FreeRadius for this. We currently have about 1500 hosts that rely on VMPS for dynamic assignment and an ideal solution would be to move the VMPS service onto a server (Or multiple servers) with as little interuptions to users as possible. Also, for simplicities sake it would be great if we could re-use the current Static VMPS file that the catalyst switch uses. I have looked into FreeNAC as a solution, but want to investigate other ways of acheiving this. We do not really need to do anything other than assign (or block) VLANs, so the extra functionality of FreeNAC is not needed at this point. Considering i am coming from a limited Linux background, how hard would it be for me to acheive this using FreeRADIUS? Does it sound feasible? I am really looking for a bit of advice from those with experience of the FreeRADIUS application and who know of the potential pit-falls and complications that we may face! Many thanks - any comments or idea's much appreciated... Cheers Jonathan -- View this message in context: http://www.nabble.com/VMPS---Initial-project-ideas-tp20264221p20264221.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

Freeradius/MySQL - Dynamic IP address, help pls?
by Lucio Godoy 12 Nov '08

12 Nov '08

Hi All; I have been for sometime now trying to get Freeradius to assign Dynamic IP Addresses to my users, with no luck! I can authenticate users and give static ip address without a hint of problem. I am using Freeradius Version 2.1.1 with MySQL backend with a Cisco VPN3000; I have read all about: Pool-Name := main_pool, Fall-Through = Yes, the Freeradius WIKI, etc, etc; but can't get anything to work. Could any body help me to add the right entries on the sql tables for user: TEST Group called: DYNAMIC ip pool called: MAIN_POOL IP range of 192.168.2.1 till 192.168.2.10 I am seriously burn-out! Thanks Lucio _________________________________________________________________ Win £1000 John Lewis shopping sprees with BigSnapSearch.com http://clk.atdmt.com/UKM/go/117442309/direct/01/

2 4

RE: Zithromax is your choice to fight any bacteria.
by freeradius-users＠list.xs4all.nl 12 Nov '08

12 Nov '08

1 0

sqltrace log
by Søren Schrøder 12 Nov '08

12 Nov '08

Greetings I'm running FreeRadius with mysql backend, and for some reason I cannot get the sqltrace logfile enabled. Im running Freeradius on Freebsd 7.0, and I have tried installing from FreeBSD ports (2.0.5) and a build from source (2.1.1), but with the same result: Running freeradius in debug mode (-X -xx), it outputs: Tue Nov 11 15:24:10 2008 : Debug: Module: Linked to module rlm_sql Tue Nov 11 15:24:10 2008 : Debug: Module: Instantiating sql Tue Nov 11 15:24:10 2008 : Debug: sql { Tue Nov 11 15:24:10 2008 : Debug: driver = "rlm_sql_mysql" Tue Nov 11 15:24:10 2008 : Debug: server = "localhost" Tue Nov 11 15:24:10 2008 : Debug: port = "" Tue Nov 11 15:24:10 2008 : Debug: login = "radius" Tue Nov 11 15:24:10 2008 : Debug: password = "<blanked>" Tue Nov 11 15:24:10 2008 : Debug: radius_db = "radius" Tue Nov 11 15:24:10 2008 : Debug: read_groups = yes Tue Nov 11 15:24:10 2008 : Debug: sqltrace = yes Tue Nov 11 15:24:10 2008 : Debug: sqltracefile = "/var/log/radius/sqltrace.sql" ... ... I touched and 666'ed the logfile to eliminate right-issues [root@server /var/log/radius]# ls -al total 6 drwxr-xr-x 3 freeradius wheel 512 Nov 11 15:26 . drwxr-xr-x 4 root wheel 1536 Nov 11 15:21 .. drwxr-xr-x 3 root wheel 512 Nov 11 15:21 radacct -rw-rw-rw- 1 freeradius wheel 0 Nov 11 15:26 sqltrace.sql but I simply doesnt get anything in the sqltrace logfile I can do auth and acct with the DB, so it actually works, but I would have liked the sqltrace in the debugging phase. Any explanation on why sqltrace doesn't log ??? -- Søren Schrøder, Tecnical Innovation, Cybercity (a Telenor Company). sch(a)cybercity.dk, (+45) 60503045. "Obey Gravity.... It's the LAW!"

2 4

Freeradius proxy
by Siumafua Moala 12 Nov '08

12 Nov '08

Hi, I'm running freeradius 2.0.5+mysql backend. Everything is fine but I want to use the current server to 1. allocate ip address 2. use cisco-avpairs to allocate vrf Then send to another server to check only the username and password. I have gone through the proxy configuration and it seems you can proxy either the auth or acct but I cannot seems to find how to split the authentication. Its seems on the users file you can use pass-through but I am not using the users file! Appreciate any help on this. Thanks

2 1

wierd problem with freeradius 2.1.1
by Anatoli Logvinski 12 Nov '08

12 Nov '08

Hi, I have freeradius 2.1.1 configured to handle peap and ttls/mschap2 against AD. It accepts usernames in 3 formats "DOMAIN\username", "username@domain" and "username". The problem is that one of the formats doesn't work. It can be any one of the three and can change when I reboot the machine where the server is running and doesn't change if I only restart the server itself and it can be different for different wireless clients. I have a similarly configured 1.1.7 and it's been working perfectly. 2.1.1 runs on RHEL5 (REd Hat Enterprise Linux) 64-bit and I also tried it on RHEL4 32-bit with the same results. There is no reject from the server but looking at the packet trace I can see that instead of a TLS encrypted handshake message the client gets a PEAP request and replies with Deauthentication This is a packet trace of a successful session: 228 11:45:27.797692 IntelCor_d6:da:d5 Cisco_89:9d:49 EAP Response, Identity [RFC3748] 230 11:45:27.802659 Cisco_89:9d:49 IntelCor_d6:da:d5 EAP Request, PEAP [Palekar] 232 11:45:27.804773 IntelCor_d6:da:d5 Cisco_89:9d:49 TLSv1 Client Hello 234 11:45:27.808900 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Server Hello, Certificate, Server Hello Done 236 11:45:27.811647 IntelCor_d6:da:d5 Cisco_89:9d:49 EAP Response, PEAP [Palekar] 238 11:45:27.814901 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Server Hello, Certificate, Server Hello Done 240 11:45:27.815646 IntelCor_d6:da:d5 Cisco_89:9d:49 EAP Response, PEAP [Palekar] 242 11:45:27.818397 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Server Hello, Certificate, Server Hello Done 244 11:45:27.820270 IntelCor_d6:da:d5 Cisco_89:9d:49 TLSv1 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message 246 11:45:27.837270 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Change Cipher Spec, Encrypted Handshake Message 248 11:45:27.845145 IntelCor_d6:da:d5 Cisco_89:9d:49 EAP Response, PEAP [Palekar] 250 11:45:27.848520 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Application Data 252 11:45:27.849269 IntelCor_d6:da:d5 Cisco_89:9d:49 TLSv1 Application Data 254 11:45:27.852894 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Application Data 256 11:45:27.862774 IntelCor_d6:da:d5 Cisco_89:9d:49 TLSv1 Application Data And this is unsuccessful session: 162 16:12:11.521443 Cisco_89:9d:49 IntelCor_d6:da:d5 EAP Request, Identity [RFC3748] 165 16:12:11.572735 IntelCor_d6:da:d5 Cisco_89:9d:49 EAPOL Start 167 16:12:11.573466 Cisco_89:9d:49 IntelCor_d6:da:d5 EAP Request, Identity [RFC3748] 283 16:12:22.521827 IntelCor_d6:da:d5 Cisco_89:9d:49 IEEE 802.11 QoS Null function (No data), SN=0, FN=0, Flags=.......TC 319 16:12:25.126804 IntelCor_d6:da:d5 Cisco_89:9d:49 EAP Response, Identity [RFC3748] 321 16:12:25.131179 Cisco_89:9d:49 IntelCor_d6:da:d5 EAP Request, PEAP [Palekar] 323 16:12:25.132286 IntelCor_d6:da:d5 Cisco_89:9d:49 SSL Client Hello 325 16:12:25.136419 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Server Hello, Certificate, Server Hello Done 327 16:12:25.140310 IntelCor_d6:da:d5 Cisco_89:9d:49 EAP Response, PEAP [Palekar] 329 16:12:25.143789 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Server Hello, Certificate, Server Hello Done 331 16:12:25.144547 IntelCor_d6:da:d5 Cisco_89:9d:49 EAP Response, PEAP [Palekar] 333 16:12:25.147047 Cisco_89:9d:49 IntelCor_d6:da:d5 TLSv1 Server Hello, Certificate, Server Hello Done 335 16:12:25.148670 IntelCor_d6:da:d5 Cisco_89:9d:49 EAP Response, PEAP [Palekar] 337 16:12:25.151045 Cisco_89:9d:49 IntelCor_d6:da:d5 EAP Request, PEAP [Palekar] 339 16:12:25.164296 IntelCor_d6:da:d5 Cisco_89:9d:49 IEEE 802.11 Deauthentication, SN=2842, FN=0, Flags=........C Here is an example of a failed session from the server debug: rad_recv: Access-Request packet from host 10.16.17.33 port 32770, id=254, length=378 User-Name = "username(a)adelaide.edu.au" Calling-Station-Id = "00-1F-3B-D6-DA-D5" Called-Station-Id = "00-23-04-89-9D-40:dev-UofA" NAS-Port = 29 NAS-IP-Address = 10.16.17.33 NAS-Identifier = "c4404-01-lg45-d3-nt" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "977" EAP-Message = 0x020300a719800000009d1603010098010000940301491a294895f3db20fdb54221a9e3f3d6201c394835761953775233784549a7c320d5e5e5c9f84361b56c294e147e0ff1c8402384b74f32f27b9b9e93c46b1da6440018002f00350005000ac009c00ac013c0140032003800130004010000330000001d001b0100186131303032373538406164656c616964652e6564752e6175000a00080006001700180019000b00020100 State = 0x29bd479429be5e064d1acd012c09ab36 Message-Authenticator = 0xf3843f7b19a689f2590496657c26c1c0 Wed Nov 12 11:24:38 2008 : Info: +- entering group authorize {...} Wed Nov 12 11:24:38 2008 : Info: ++[preprocess] returns ok Wed Nov 12 11:24:38 2008 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.16.17.33/auth-detail-20081112 Wed Nov 12 11:24:38 2008 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.16.17.33/auth-detail-20081112 Wed Nov 12 11:24:38 2008 : Info: [auth_log] expand: %t -> Wed Nov 12 11:24:38 2008 Wed Nov 12 11:24:38 2008 : Info: ++[auth_log] returns ok Wed Nov 12 11:24:38 2008 : Info: ++[mschap] returns noop Wed Nov 12 11:24:38 2008 : Info: [suffix] Looking up realm "adelaide.edu.au" for User-Name = "username(a)adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Found realm "adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Adding Stripped-User-Name = "username" Wed Nov 12 11:24:38 2008 : Info: [suffix] Adding Realm = "adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Authentication realm is LOCAL. Wed Nov 12 11:24:38 2008 : Info: ++[suffix] returns ok Wed Nov 12 11:24:38 2008 : Info: [ntdomain] Request already proxied. Ignoring. Wed Nov 12 11:24:38 2008 : Info: ++[ntdomain] returns ok Wed Nov 12 11:24:38 2008 : Info: [eap] EAP packet type response id 3 length 167 Wed Nov 12 11:24:38 2008 : Info: [eap] Continuing tunnel setup. Wed Nov 12 11:24:38 2008 : Info: ++[eap] returns ok Wed Nov 12 11:24:38 2008 : Info: Found Auth-Type = EAP Wed Nov 12 11:24:38 2008 : Info: +- entering group authenticate {...} Wed Nov 12 11:24:38 2008 : Info: [eap] Request found, released from the list Wed Nov 12 11:24:38 2008 : Info: [eap] EAP/peap Wed Nov 12 11:24:38 2008 : Info: [eap] processing type peap Wed Nov 12 11:24:38 2008 : Info: [peap] processing EAP-TLS Wed Nov 12 11:24:38 2008 : Debug: TLS Length 157 Wed Nov 12 11:24:38 2008 : Info: [peap] Length Included Wed Nov 12 11:24:38 2008 : Info: [peap] eaptls_verify returned 11 Wed Nov 12 11:24:38 2008 : Info: [peap] (other): before/accept initialization Wed Nov 12 11:24:38 2008 : Info: [peap] TLS_accept: before/accept initialization Wed Nov 12 11:24:38 2008 : Info: [peap] <<< TLS 1.0 Handshake [length 0098], ClientHello Wed Nov 12 11:24:38 2008 : Info: [peap] TLS_accept: SSLv3 read client hello A Wed Nov 12 11:24:38 2008 : Info: [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello Wed Nov 12 11:24:38 2008 : Info: [peap] TLS_accept: SSLv3 write server hello A Wed Nov 12 11:24:38 2008 : Info: [peap] >>> TLS 1.0 Handshake [length 090b], Certificate Wed Nov 12 11:24:38 2008 : Info: [peap] TLS_accept: SSLv3 write certificate A Wed Nov 12 11:24:38 2008 : Info: [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Wed Nov 12 11:24:38 2008 : Info: [peap] TLS_accept: SSLv3 write server done A Wed Nov 12 11:24:38 2008 : Info: [peap] TLS_accept: SSLv3 flush data Wed Nov 12 11:24:38 2008 : Info: [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A Wed Nov 12 11:24:38 2008 : Debug: In SSL Handshake Phase Wed Nov 12 11:24:38 2008 : Debug: In SSL Accept mode Wed Nov 12 11:24:38 2008 : Info: [peap] eaptls_process returned 13 Wed Nov 12 11:24:38 2008 : Info: [peap] EAPTLS_HANDLED Wed Nov 12 11:24:38 2008 : Info: ++[eap] returns handled Sending Access-Challenge of id 254 to 10.16.17.33 port 32770 EAP-Message = 0x0104040019c000000948160301002a020000260301491a294e3f610fb297f401436df8548042ce957ae530c81f6d2915e3379992bb00002f00160301090b0b0009070009040004b9308204b53082041ea00302010202033f048e300d06092a864886f70d01010505003081ec310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3130302e060355040b1327687474703a2f2f7777772e737461726669656c64746563682e636f6d2f7265706f7369746f72793131302f EAP-Message = 0x06035504031328537461726669656c64205365637572652043657274696669636174696f6e20417574686f72697479312a302806092a864886f70d010901161b70726163746963657340737461726669656c64746563682e636f6d301e170d3036313231333231333931365a170d3038313231333231333931365a3065311f301d060355040a13167261646975732e6164656c616964652e6564752e61753121301f060355040b1318446f6d61696e20436f6e74726f6c2056616c696461746564311f301d060355040313167261646975732e6164656c616964652e6564752e617530819f300d06092a864886f70d010101050003818d003081890281 EAP-Message = 0x8100d7fbf50a4906fe53cda9cb3597730e36b640eaad16028c68cc317ec62b4c9d2351ba870cb637a42f51f30c29ba6ee783df929b0a430589c9e719ad6f35be2fa2ef652e78f202201aef69a218ff9c7a88abb3caf692912d3e3be9e97f2d027906627102787b3f4229a5fc0ce71daa1a5688b489b0590cf631297649b57e1021af0203010001a38201e9308201e530090603551d1304023000300b0603551d0f0404030205a0301d0603551d250416301406082b0601050507030106082b0601050507030230560603551d1f044f304d304ba049a0478645687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f EAP-Message = 0x6d2f7265706f7369746f72792f737461726669656c6469737375696e672e63726c30520603551d20044b30493047060b6086480186fd6d010717013038303606082b06010505070201162a687474703a2f2f6365727469666963617465732e676f64616464792e636f6d2f7265706f7369746f727930818006082b0601050507010104743072302906082b06010505073001861d687474703a2f2f6f6373702e737461726669656c64746563682e636f6d304506082b060105050730028639687474703a2f2f6365727469666963617465732e676f64616464792e636f6d2f7265706f7369746f72792f73665f69737375696e672e637274301d060355 EAP-Message = 0x1d0e04160414fe709c5e71bf Message-Authenticator = 0x00000000000000000000000000000000 State = 0x29bd479428b95e064d1acd012c09ab36 Wed Nov 12 11:24:38 2008 : Info: Finished request 45. Wed Nov 12 11:24:38 2008 : Debug: Going to the next request Wed Nov 12 11:24:38 2008 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.16.17.33 port 32770, id=255, length=217 User-Name = "username(a)adelaide.edu.au" Calling-Station-Id = "00-1F-3B-D6-DA-D5" Called-Station-Id = "00-23-04-89-9D-40:dev-UofA" NAS-Port = 29 NAS-IP-Address = 10.16.17.33 NAS-Identifier = "c4404-01-lg45-d3-nt" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "977" EAP-Message = 0x020400061900 State = 0x29bd479428b95e064d1acd012c09ab36 Message-Authenticator = 0xf2794b5e43df427c07ab233e76e5ae0f Wed Nov 12 11:24:38 2008 : Info: +- entering group authorize {...} Wed Nov 12 11:24:38 2008 : Info: ++[preprocess] returns ok Wed Nov 12 11:24:38 2008 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.16.17.33/auth-detail-20081112 Wed Nov 12 11:24:38 2008 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.16.17.33/auth-detail-20081112 Wed Nov 12 11:24:38 2008 : Info: [auth_log] expand: %t -> Wed Nov 12 11:24:38 2008 Wed Nov 12 11:24:38 2008 : Info: ++[auth_log] returns ok Wed Nov 12 11:24:38 2008 : Info: ++[mschap] returns noop Wed Nov 12 11:24:38 2008 : Info: [suffix] Looking up realm "adelaide.edu.au" for User-Name = "username(a)adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Found realm "adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Adding Stripped-User-Name = "username" Wed Nov 12 11:24:38 2008 : Info: [suffix] Adding Realm = "adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Authentication realm is LOCAL. Wed Nov 12 11:24:38 2008 : Info: ++[suffix] returns ok Wed Nov 12 11:24:38 2008 : Info: [ntdomain] Request already proxied. Ignoring. Wed Nov 12 11:24:38 2008 : Info: ++[ntdomain] returns ok Wed Nov 12 11:24:38 2008 : Info: [eap] EAP packet type response id 4 length 6 Wed Nov 12 11:24:38 2008 : Info: [eap] Continuing tunnel setup. Wed Nov 12 11:24:38 2008 : Info: ++[eap] returns ok Wed Nov 12 11:24:38 2008 : Info: Found Auth-Type = EAP Wed Nov 12 11:24:38 2008 : Info: +- entering group authenticate {...} Wed Nov 12 11:24:38 2008 : Info: [eap] Request found, released from the list Wed Nov 12 11:24:38 2008 : Info: [eap] EAP/peap Wed Nov 12 11:24:38 2008 : Info: [eap] processing type peap Wed Nov 12 11:24:38 2008 : Info: [peap] processing EAP-TLS Wed Nov 12 11:24:38 2008 : Info: [peap] Received TLS ACK Wed Nov 12 11:24:38 2008 : Info: [peap] ACK handshake fragment handler Wed Nov 12 11:24:38 2008 : Info: [peap] eaptls_verify returned 1 Wed Nov 12 11:24:38 2008 : Info: [peap] eaptls_process returned 13 Wed Nov 12 11:24:38 2008 : Info: [peap] EAPTLS_HANDLED Wed Nov 12 11:24:38 2008 : Info: ++[eap] returns handled Sending Access-Challenge of id 255 to 10.16.17.33 port 32770 EAP-Message = 0x010503fc1940137b8a796c791f63339cc98f1d7e301f0603551d23041830168014ac55deb7ea13ebfc9868e253601ef1253e8ceee7303d0603551d110436303482167261646975732e6164656c616964652e6564752e6175821a7777772e7261646975732e6164656c616964652e6564752e6175300d06092a864886f70d010105050003818100029139d07b6cae175ece69c94e0e5c8d4505577787beb56df5b14c2086a078c1e8565a656b3165ad14078cde6ad2dfe34172b2b9d94296e8880e1639729ae30997b70330a191278675379c25005a767105d3bbf27c1d134dcff7a23ef8f5b8b39f724cf468b03a35964f97e3a97b40e1cbc6b8e177f9 EAP-Message = 0x992b30457d2fbaf4407e00044530820441308203aaa00302010202020104300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3034303131343231303532315a17 EAP-Message = 0x0d3234303130393231303532315a3081ec310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3130302e060355040b1327687474703a2f2f7777772e737461726669656c64746563682e636f6d2f7265706f7369746f72793131302f06035504031328537461726669656c64205365637572652043657274696669636174696f6e20417574686f72697479312a302806092a864886f70d010901161b70726163746963657340737461726669656c64746563682e636f6d EAP-Message = 0x30819d300d06092a864886f70d010101050003818b0030818702818100db11436bdcd169785949e86e74140874116c7eb72aa822d8423c7acf9f50b246aea6671a2322be0fb334fbacac90aa5b28c270f6b68a802ae09b9c52e091a872a016e1c44e7d1109b39eb9d4f3b250c46d4808bdbc2a970c6da38a6a3c9acf4a34dc1edeea5a26c0a1a282a94afb862212903ab282d492919fa9459fc3a4dbfb020103a38201213082011d300c0603551d13040530030101ff300b0603551d0f040403020106304a0603551d1f04433041303fa03da03b8639687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f72 EAP-Message = 0x65706f7369746f72 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x29bd47942bb85e064d1acd012c09ab36 Wed Nov 12 11:24:38 2008 : Info: Finished request 46. Wed Nov 12 11:24:38 2008 : Debug: Going to the next request Wed Nov 12 11:24:38 2008 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.16.17.33 port 32770, id=0, length=217 User-Name = "username(a)adelaide.edu.au" Calling-Station-Id = "00-1F-3B-D6-DA-D5" Called-Station-Id = "00-23-04-89-9D-40:dev-UofA" NAS-Port = 29 NAS-IP-Address = 10.16.17.33 NAS-Identifier = "c4404-01-lg45-d3-nt" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "977" EAP-Message = 0x020500061900 State = 0x29bd47942bb85e064d1acd012c09ab36 Message-Authenticator = 0x0d141b37c603c7d45fa85a8a89de8c6c Wed Nov 12 11:24:38 2008 : Info: +- entering group authorize {...} Wed Nov 12 11:24:38 2008 : Info: ++[preprocess] returns ok Wed Nov 12 11:24:38 2008 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.16.17.33/auth-detail-20081112 Wed Nov 12 11:24:38 2008 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.16.17.33/auth-detail-20081112 Wed Nov 12 11:24:38 2008 : Info: [auth_log] expand: %t -> Wed Nov 12 11:24:38 2008 Wed Nov 12 11:24:38 2008 : Info: ++[auth_log] returns ok Wed Nov 12 11:24:38 2008 : Info: ++[mschap] returns noop Wed Nov 12 11:24:38 2008 : Info: [suffix] Looking up realm "adelaide.edu.au" for User-Name = "username(a)adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Found realm "adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Adding Stripped-User-Name = "username" Wed Nov 12 11:24:38 2008 : Info: [suffix] Adding Realm = "adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Authentication realm is LOCAL. Wed Nov 12 11:24:38 2008 : Info: ++[suffix] returns ok Wed Nov 12 11:24:38 2008 : Info: [ntdomain] Request already proxied. Ignoring. Wed Nov 12 11:24:38 2008 : Info: ++[ntdomain] returns ok Wed Nov 12 11:24:38 2008 : Info: [eap] EAP packet type response id 5 length 6 Wed Nov 12 11:24:38 2008 : Info: [eap] Continuing tunnel setup. Wed Nov 12 11:24:38 2008 : Info: ++[eap] returns ok Wed Nov 12 11:24:38 2008 : Info: Found Auth-Type = EAP Wed Nov 12 11:24:38 2008 : Info: +- entering group authenticate {...} Wed Nov 12 11:24:38 2008 : Info: [eap] Request found, released from the list Wed Nov 12 11:24:38 2008 : Info: [eap] EAP/peap Wed Nov 12 11:24:38 2008 : Info: [eap] processing type peap Wed Nov 12 11:24:38 2008 : Info: [peap] processing EAP-TLS Wed Nov 12 11:24:38 2008 : Info: [peap] Received TLS ACK Wed Nov 12 11:24:38 2008 : Info: [peap] ACK handshake fragment handler Wed Nov 12 11:24:38 2008 : Info: [peap] eaptls_verify returned 1 Wed Nov 12 11:24:38 2008 : Info: [peap] eaptls_process returned 13 Wed Nov 12 11:24:38 2008 : Info: [peap] EAPTLS_HANDLED Wed Nov 12 11:24:38 2008 : Info: ++[eap] returns handled Sending Access-Challenge of id 0 to 10.16.17.33 port 32770 EAP-Message = 0x010601621900792f726f6f742e63726c304f0603551d20044830463044060b6086480186f845010717033035303306082b060105050702011627687474703a2f2f7777772e737461726669656c64746563682e636f6d2f7265706f7369746f7279303906082b06010505070101042d302b302906082b06010505073001861d687474703a2f2f6f6373702e737461726669656c64746563682e636f6d301d0603551d0e04160414ac55deb7ea13ebfc9868e253601ef1253e8ceee730090603551d2304023000300d06092a864886f70d0101050500038181007e1c98bead038d2585ee7c9088222bfe27f442b2ec7fb5fc726805a47d91ef28d17d2039 EAP-Message = 0x3b790837681852d58f03d2894f1e11d1e9a5744bfc5f67658471847859b7d6c9d7d79335e613ab943c8e9340898cc0d7f2e70752d1708f988ceba06dd1365390a08f16301edec3bf7f46a5952af9c8de3bdb77f4f232b13361a2303516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x29bd47942abb5e064d1acd012c09ab36 Wed Nov 12 11:24:38 2008 : Info: Finished request 47. Wed Nov 12 11:24:38 2008 : Debug: Going to the next request Wed Nov 12 11:24:38 2008 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.16.17.33 port 32770, id=1, length=217 User-Name = "username(a)adelaide.edu.au" Calling-Station-Id = "00-1F-3B-D6-DA-D5" Called-Station-Id = "00-23-04-89-9D-40:dev-UofA" NAS-Port = 29 NAS-IP-Address = 10.16.17.33 NAS-Identifier = "c4404-01-lg45-d3-nt" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "977" EAP-Message = 0x020600061900 State = 0x29bd47942abb5e064d1acd012c09ab36 Message-Authenticator = 0x17ceb443a291e862980fc4971fdc4a91 Wed Nov 12 11:24:38 2008 : Info: +- entering group authorize {...} Wed Nov 12 11:24:38 2008 : Info: ++[preprocess] returns ok Wed Nov 12 11:24:38 2008 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.16.17.33/auth-detail-20081112 Wed Nov 12 11:24:38 2008 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.16.17.33/auth-detail-20081112 Wed Nov 12 11:24:38 2008 : Info: [auth_log] expand: %t -> Wed Nov 12 11:24:38 2008 Wed Nov 12 11:24:38 2008 : Info: ++[auth_log] returns ok Wed Nov 12 11:24:38 2008 : Info: ++[mschap] returns noop Wed Nov 12 11:24:38 2008 : Info: [suffix] Looking up realm "adelaide.edu.au" for User-Name = "username(a)adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Found realm "adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Adding Stripped-User-Name = "username" Wed Nov 12 11:24:38 2008 : Info: [suffix] Adding Realm = "adelaide.edu.au" Wed Nov 12 11:24:38 2008 : Info: [suffix] Authentication realm is LOCAL. Wed Nov 12 11:24:38 2008 : Info: ++[suffix] returns ok Wed Nov 12 11:24:38 2008 : Info: [ntdomain] Request already proxied. Ignoring. Wed Nov 12 11:24:38 2008 : Info: ++[ntdomain] returns ok Wed Nov 12 11:24:38 2008 : Info: [eap] EAP packet type response id 6 length 6 Wed Nov 12 11:24:38 2008 : Info: [eap] Continuing tunnel setup. Wed Nov 12 11:24:38 2008 : Info: ++[eap] returns ok Wed Nov 12 11:24:38 2008 : Info: Found Auth-Type = EAP Wed Nov 12 11:24:38 2008 : Info: +- entering group authenticate {...} Wed Nov 12 11:24:38 2008 : Info: [eap] Request found, released from the list Wed Nov 12 11:24:38 2008 : Info: [eap] EAP/peap Wed Nov 12 11:24:38 2008 : Info: [eap] processing type peap Wed Nov 12 11:24:38 2008 : Info: [peap] processing EAP-TLS Wed Nov 12 11:24:38 2008 : Info: [peap] Received TLS ACK Wed Nov 12 11:24:38 2008 : Info: [peap] ACK handshake fragment handler Wed Nov 12 11:24:38 2008 : Info: [peap] eaptls_verify returned 1 Wed Nov 12 11:24:38 2008 : Info: [peap] eaptls_process returned 13 Wed Nov 12 11:24:38 2008 : Info: [peap] EAPTLS_HANDLED Wed Nov 12 11:24:38 2008 : Info: ++[eap] returns handled Sending Access-Challenge of id 1 to 10.16.17.33 port 32770 EAP-Message = 0x010700061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x29bd47942dba5e064d1acd012c09ab36 Wed Nov 12 11:24:38 2008 : Info: Finished request 48. Wed Nov 12 11:24:38 2008 : Debug: Going to the next request Wed Nov 12 11:24:38 2008 : Debug: Waking up in 4.9 seconds. Wed Nov 12 11:24:43 2008 : Info: Cleaning up request 44 ID 253 with timestamp +1137 Wed Nov 12 11:24:43 2008 : Info: Cleaning up request 45 ID 254 with timestamp +1137 Wed Nov 12 11:24:43 2008 : Info: Cleaning up request 46 ID 255 with timestamp +1137 Wed Nov 12 11:24:43 2008 : Info: Cleaning up request 47 ID 0 with timestamp +1137 Wed Nov 12 11:24:43 2008 : Info: Cleaning up request 48 ID 1 with timestamp +1137 Wed Nov 12 11:24:43 2008 : Debug: Ready to process requests. Any help would be appreciated -- Anatoli

1 0

LDAP & MSCHAP errors
by Simon Palmer 11 Nov '08

11 Nov '08

Hi, We are trying to set up freeRADIUS 2.1.1 against eDirectory LDAP and getting problems. (Trying SLES 10 SP2 32bit and 64 bit) pap against LDAP works fine chap against LDAP works fine (With ntradping) BUT - MSCHAPv2 gives "FAILED: MS-CHAP2-Response is incorrect" Am I missing something required for MSCHAP to work? The NT-Password seems to be retrieved... Working CHAP debug from ntradping: Tue Nov 11 10:10:26 2008 : Info: [ldap] looking for check items in directory... Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: acctFlags -> SMB-Account-CTRL-TEXT == "[UX ]" Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: sambaNtPassword -> NT-Password == 0x4145394341303636374133413937333342303139423034323645363933373332 Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: sambaLmPassword -> LM-Password == 0x3635423939303044343142344533363831394631304139333344343836384443 Tue Nov 11 10:10:26 2008 : Info: [ldap] looking for reply items in directory... Tue Nov 11 10:10:26 2008 : Info: [ldap] user testuser authorized to use remote access Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Nov 11 10:10:26 2008 : Info: ++[ldap] returns ok Tue Nov 11 10:10:26 2008 : Info: ++[expiration] returns noop Tue Nov 11 10:10:26 2008 : Info: ++[logintime] returns noop Tue Nov 11 10:10:26 2008 : Info: [pap] Normalizing NT-Password from hex encoding Tue Nov 11 10:10:26 2008 : Info: [pap] Normalizing LM-Password from hex encoding Tue Nov 11 10:10:26 2008 : Info: [pap] Found existing Auth-Type, not changing it. Tue Nov 11 10:10:26 2008 : Info: ++[pap] returns noop Tue Nov 11 10:10:26 2008 : Info: Found Auth-Type = CHAP Tue Nov 11 10:10:26 2008 : Info: +- entering group CHAP {...} Tue Nov 11 10:10:26 2008 : Info: [chap] login attempt by "testuser" with CHAP password Tue Nov 11 10:10:26 2008 : Info: [chap] Using clear text password "ommitted" for user testuser authentication. Tue Nov 11 10:10:26 2008 : Info: [chap] chap user testuser authenticated succesfully Tue Nov 11 10:10:26 2008 : Info: ++[chap] returns ok Tue Nov 11 10:10:26 2008 : Info: +- entering group post-auth {...} Tue Nov 11 10:10:26 2008 : Info: ++[exec] returns noop Sending Access-Accept of id 13 to 194.82.224.117 port 1958 Debug from it not working using MSCHAP2: Tue Nov 11 10:06:10 2008 : Info: [ldap] looking for check items in directory... Tue Nov 11 10:06:10 2008 : Debug: rlm_ldap: acctFlags -> SMB-Account-CTRL-TEXT == "[UX ]" Tue Nov 11 10:06:10 2008 : Debug: rlm_ldap: sambaNtPassword -> NT-Password == 0x4145394341303636374123413937333342303139423034323445363933373332 Tue Nov 11 10:06:10 2008 : Debug: rlm_ldap: sambaLmPassword -> LM-Password == 0x3635423939303044342142344533363831394631304139353344343836384443 Tue Nov 11 10:06:10 2008 : Info: [ldap] looking for reply items in directory... Tue Nov 11 10:06:10 2008 : Info: [ldap] user testuser authorized to use remote access Tue Nov 11 10:06:10 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Nov 11 10:06:10 2008 : Info: ++[ldap] returns ok Tue Nov 11 10:06:10 2008 : Info: ++[expiration] returns noop Tue Nov 11 10:06:10 2008 : Info: ++[logintime] returns noop Tue Nov 11 10:06:10 2008 : Info: [pap] Normalizing NT-Password from hex encoding Tue Nov 11 10:06:10 2008 : Info: [pap] Normalizing LM-Password from hex encoding Tue Nov 11 10:06:10 2008 : Info: [pap] Found existing Auth-Type, not changing it. Tue Nov 11 10:06:10 2008 : Info: ++[pap] returns noop Tue Nov 11 10:06:10 2008 : Info: Found Auth-Type = MSCHAP Tue Nov 11 10:06:10 2008 : Info: +- entering group MS-CHAP {...} Tue Nov 11 10:06:10 2008 : Info: [mschap] Found LM-Password Tue Nov 11 10:06:10 2008 : Info: [mschap] Found NT-Password Tue Nov 11 10:06:10 2008 : Info: [mschap] Told to do MS-CHAPv2 for testuser with NT-Password Tue Nov 11 10:06:10 2008 : Info: [mschap] FAILED: MS-CHAP2-Response is incorrect Tue Nov 11 10:06:10 2008 : Info: ++[mschap] returns reject Tue Nov 11 10:06:10 2008 : Info: Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} ++[ldap] returns noop Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.6 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 32 to 192.168.100.25 port 32834 MS-CHAP-Error = "\000E=691 R=1" modules/ldap extract: ldap { server = "192.168.1.1" port = 636 identity = "cn=admin,o=csg" password = "password" basedn = "O=csg" filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" ... # start_tls = yes tls_mode = yes # cacertfile = /path/to/cacert.pem # I don't think we need to check the certs so put require_cert below to never # cacertdir = /usr/local/etc/raddb/certs # certfile = /usr/local/etc/raddb/certs/certs.b64 # keyfile = /path/to/radius.key #randfile = /usr/local/etc/raddb/random require_cert = "never" dictionary_mapping = ${confdir}/ldap.attrmap password_attribute = nspmPassword edir_account_policy_check = no #I've tried this with yes - and enabling the option in sites-enabled/default and it's no different Default configuration in modules/mschap and modules/chap In sites-enabled/default authorize { ldap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } } post-auth { # ldap Post-Auth-Type REJECT { # attr_filter.access_reject ldap } Some help would be most appreciated. Cheers Simon Simon Palmer Systems Development Officer Colegsirgâr e-mail: simon.palmer(a)colegsirgar.ac.uk tel: 01554 748088 Mae'r e-bost hwn ac unrhyw ffeiliau atodedig yn gyfrinachol ac at sylw'r unigolyn neu'r sefydliad a enwir uchod. Bydd unrhyw farn neu sylwadau a fynegir yn perthyn i'r awdur yn unig ac ni chynrychiolant o anghenraid farn Coleg Sir Gâr. Os ydych chi wedi derbyn yr e-bost hwn ar gam, rhowch sylw i'r gweinyddwr ar y cyfeiriad canlynol: postmaster(a)colegsirgar.ac.uk Cysidrwch yr amgylchedd - a oes wir angen argraffu'r ebost hwn? This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Coleg Sir Gâr. If you have received this email in error please notify the administrator on the following address: postmaster(a)colegsirgar.ac.uk Please consider the environment - do you really need to print this email?

2 1