- Freeradius-Users - lists.freeradius.org

Failure to Process radgroupreply
by Andrew Long 09 Apr '12

09 Apr '12

Platfrom: CentOS 5.8 FreeRADIUS: 2.1.8 Backend: MySQL I am unable to get FreeRadius to reply with attributes assigned in the radgroupreply table for some groups. When the same attributes are assigned in radreply, the server sends them as expected. Adding a Fall-Through entry for the user in radreply makes no difference (the server defaults to Fall-Through from the config). I can see no difference in the structure of the user/groups between working and non-working accounts. I've spent most of the night combing the web, wiki, and other resources, but I find nothing quite like this. For instance: # radcheck testuser1 Cleartext-Password := password # radreply (WORKS) testuser1 Nomadix-Bw-Down := 768 # radusergroup testuser1 test-group 1 # radgroupreply (DOES NOT WORK) testuser1 Nomadix-Bw-Down := 768 Here is debug output from an auth request for this account (when the pairs are only in radgroupreply). You'll notice there is no processing of the radgroupreply table. rad_recv: Access-Request packet from host xx.xx.xx.xx port 29817, id=170, length=49 User-Name = "testuser1" User-Password = "password" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testuser1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [sql] expand: %{User-Name} -> testuser1 [sql] sql_set_user escaped user --> 'testuser1' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser1' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testuser1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'testuser1' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'test-group' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[dailycounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[monthlycounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[daypasscounter] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "password" [pap] Using clear text password "password" [pap] User authenticated successfully ++[pap] returns ok Login OK: [testuser1] (from client wolfchase-gateway port 0) +- entering group post-auth {...} [sql] expand: %{User-Name} -> testuser1 [sql] sql_set_user escaped user --> 'testuser1' [sql] expand: %{User-Password} -> password [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser1', 'password', 'Access-Accept', '2012-04-05 06:58:06') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser1', 'password', 'Access-Accept', '2012-04-05 06:58:06') rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 170 to xx.xx.xx.xx port 29817 Finished request 166. Going to the next request Waking up in 3.0 seconds. Thank you for any help.

2 11

Re: EAP-PEAP + Windows 7 with SSO and Password change
by CD DD 08 Apr '12

08 Apr '12

Hi Alan, hmm, it seems not working by me. In the Debug Log you can see, that the radius Server send the CHAP-Error to the Supplicant. And on Windows 7 side, i got an Invalid Login but NOT a Password Change window. But this should Pop up with enabled passchange feature, right ? I enabled the passchange config in mschap module without success. What is wrong there ? DEBUG LOG: ########## (8) Found Auth-Type = EAP (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) group authenticate { (8) - entering group authenticate {...} (8) eap : Request found, released from the list (8) eap : EAP/mschapv2 (8) eap : processing type mschapv2 (8) mschapv2 : # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) mschapv2 : group MS-CHAP { (8) mschapv2 : - entering group MS-CHAP {...} (8) mschap : NT Domain delimeter found, should we have enabled with_ntdomain_hack? (8) mschap : Creating challenge hash with username: DOMAIN\test-user3 (8) mschap : Told to do MS-CHAPv2 for DOMAIN\test-user3 with NT-Password (8) mschap : expand: %{Stripped-User-Name} -> (8) mschap : ... expanding second conditional (8) mschap : expand: %{User-Name} -> DOMAIN\test-user3 (8) mschap : expand: %{%{User-Name}:-None} -> DOMAIN\test-user3 (8) mschap : expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=DOMAIN\test-user3 (8) mschap : NT Domain delimeter found, should we have enabled with_ntdomain_hack? (8) mschap : Creating challenge hash with username: DOMAIN\test-user3 (8) mschap : expand: %{mschap:Challenge} -> 4b4be3875649ba1a (8) mschap : expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=4b4be3875649ba1a (8) mschap : expand: %{mschap:NT-Response} -> a900f8c9381beb68f33a91cc2f1c87bb72970bdd62ece3a2 (8) mschap : expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=a900f8c9381beb68f33a91cc2f1c87bb72970bdd62ece3a2 Exec-Program output: Password expired (0xc0000648) Exec-Program-Wait: plaintext: Password expired (0xc0000648) Exec-Program: returned: 1 (8) mschap : ntlm_auth says password has expired (8) [mschap] = reject rlm_eap_mschapv2: No MS-CHAPv2-Success or MS-CHAP-Error was found. (8) eap : Handler failed in EAP/mschapv2 (8) eap : Failed in EAP select (8) [eap] = invalid (8) Failed to authenticate the user. (8) Login incorrect: [DOMAIN\\test-user3/<via Auth-Type = EAP>] (from client switches port 0 via TLS tunnel) } # server inner-tunnel (8) peap : Got tunneled reply code 3 MS-CHAP-Error = "\013E=648 R=0 C=62fa0aad52c662d5b02fcda34542d074 V=3 M=Password Expired" EAP-Message = 0x040b0004 Message-Authenticator = 0x00000000000000000000000000000000 (8) peap : Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\013E=648 R=0 C=62fa0aad52c662d5b02fcda34542d074 V=3 M=Password Expired" EAP-Message = 0x040b0004 Message-Authenticator = 0x00000000000000000000000000000000 (8) peap : Tunneled authentication was rejected. (8) peap : FAILURE (8) [eap] = handled Sending Access-Challenge of id 128 to 192.168.15.52 port 2686 EAP-Message = 0x010c002b190017030100202f2f3b44177589096e8dbced7004dd801b1a777dd1a966acf5dcbde958537403 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7cb2ed6374bef496dfd35c4e86820391 (8) Finished request 8. Waking up in 0.1 seconds. rad_recv: Access-Request packet from host zzz.aaa.xxx.yyy port 2686, id=129, length=262 Framed-MTU = 1480 NAS-IP-Address = zzz.aaa.xxx.yyy NAS-Identifier = "SWITCHxxx" User-Name = "DOMAIN\\test-user3" Service-Type = Framed-User Thanks a lot, C. >CD DD wrote: >> and how do i get this working ? > > read raddb/mods-available/mschap > > Alan DeKok. -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

1 0

Minor typo in master/raddb/mods-available/mschap
by James J J Hooper 08 Apr '12

08 Apr '12

--- mschap-orig 2012-04-08 00:39:44.000000000 +0100 +++ mschap-new 2012-04-08 00:41:06.000000000 +0100 @@ -78,3 +78,3 @@ # ntlm_auth_username = "username: %{mschap:User-Name}" -# ntlm_auth_domain = "username: %{mschap:NT-Domain}" +# ntlm_auth_domain = "nt-domain: %{mschap:NT-Domain}" -James

2 1

Single username/password for any platform?
by Blaster 08 Apr '12

08 Apr '12

Is it possible to give someone a single username & password that the person can use to login via WPA2-Enterprise from any type of device? (Android, iOS, Mac, Windows, Linux, etc?) I would prefer to not have to distribute certs either, and it's OK if the user has to accept a self-signed cert on first connect for each device. I've been googling this and can't seem to find any discussion that has a single cookbook cross-platform example, so I'm thinking it might not be? For example, my Android device just asks for an EAP password, and not a username/password like Windows does. Thanks...

2 1

load balancing and if statements
by Scott McLane Gardner 06 Apr '12

06 Apr '12

FR 2.1.10 on Linux I want to load balance my LDAP servers, but I also want to do some checking for group membership. Reading the documentation at http://wiki.freeradius.org/Load-balancing#Interaction+with+%22if%22+and+%22 else%22 makes me think I can use if and elsif statements in a load balancing block, as long as the rules in the table are followed. However, when I try to do this, I get the following errors in my log: >/etc/freeradius/sites-enabled/default[173]: load-balance sections cannot >contain a "if" statement Here is the configuration I am attempting: > load-balance { > ldap1 > > if (Ldap-Group == "NET Staff") { > if (NAS-IP-Address == "10.52.6.5" || NAS-IP-Address == >"10.52.6.4") { > update reply { > Passport-Access-Priority = 6 > } > } > } > # Reject everyone else to the routers > elsif (NAS-IP-Address == "10.52.6.5" || NAS-IP-Address == >"10.52.6.4" || NAS-IP-Address == "10.51.0.1" || NAS-IP-Address == >"10.51.0.2") { > reject > } > > ldap2 > > if (Ldap-Group == "NET Staff") { > if (NAS-IP-Address == "10.52.6.5" || NAS-IP-Address == >"10.52.6.4") { > update reply { > Passport-Access-Priority = 6 > } > } > } > # Reject everyone else to the routers > elsif (NAS-IP-Address == "10.52.6.5" || NAS-IP-Address == >"10.52.6.4" || NAS-IP-Address == "10.51.0.1" || NAS-IP-Address == >"10.51.0.2") { > reject > } > } If I can't use if statements in a load balance block, can anyone suggest another way to go about accomplishing what I want to do here? Thank you, Scott

6 19

How to configure COA in freeRadius
by ulislam.raihan 06 Apr '12

06 Apr '12

HI , I have put the following COA list in authorization section of default file. The default file is /etc/freeradius/sits-available to enable the COA request. update coa{ User-Name="%{User-Name}" Acct-Session-Id="%Acct-Session-Id" NAS-IP-Address="%NAS-IP-Address" Packet-Dst-Port=4200 } I am sending Access-Request from my java program and listening to port 4200. I am getting success Access-Accept . but i am not getting any COA request instead i have seen following error "Info: WARNING: Unknown destination 127.0.0.1:4200 for CoA request." Can any one tell me wht i have to configure more or what is the problem ? The output from radius server is below rad_recv: Access-Request packet from host 127.0.0.1 port 57378, id=1, length=59 User-Name = "testing" NAS-IP-Address = 127.0.0.1 NAS-Port = 4200 User-Password = "password" Thu Apr 5 13:49:52 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Thu Apr 5 13:49:52 2012 : Info: +- entering group authorize {...} Thu Apr 5 13:49:52 2012 : Info: ++[preprocess] returns ok Thu Apr 5 13:49:52 2012 : Info: ++[chap] returns noop Thu Apr 5 13:49:52 2012 : Info: ++[mschap] returns noop Thu Apr 5 13:49:52 2012 : Info: ++[digest] returns noop Thu Apr 5 13:49:52 2012 : Info: [suffix] No '@' in User-Name = "testing", looking up realm NULL Thu Apr 5 13:49:52 2012 : Info: [suffix] No such realm "NULL" Thu Apr 5 13:49:52 2012 : Info: ++[suffix] returns noop Thu Apr 5 13:49:52 2012 : Info: [eap] No EAP-Message, not doing EAP Thu Apr 5 13:49:52 2012 : Info: ++[eap] returns noop Thu Apr 5 13:49:52 2012 : Info: [files] users: Matched entry testing at line 49 Thu Apr 5 13:49:52 2012 : Info: ++[files] returns ok Thu Apr 5 13:49:52 2012 : Info: [sql] expand: %{User-Name} -> testing Thu Apr 5 13:49:52 2012 : Info: [sql] sql_set_user escaped user --> 'testing' Thu Apr 5 13:49:52 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 0 Thu Apr 5 13:49:52 2012 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testing' ORDER BY id Thu Apr 5 13:49:52 2012 : Debug: rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testing' ORDER BY id Thu Apr 5 13:49:52 2012 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'testing' ORDER BY priority Thu Apr 5 13:49:52 2012 : Debug: rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'testing' ORDER BY priority Thu Apr 5 13:49:52 2012 : Debug: rlm_sql (sql): Released sql socket id: 0 Thu Apr 5 13:49:52 2012 : Info: [sql] User testing not found Thu Apr 5 13:49:52 2012 : Info: ++[sql] returns notfound Thu Apr 5 13:49:52 2012 : Info: ++[expiration] returns noop Thu Apr 5 13:49:52 2012 : Info: ++[logintime] returns noop Thu Apr 5 13:49:52 2012 : Info: ++[pap] returns updated Thu Apr 5 13:49:52 2012 : Info: expand: %{User-Name} -> testing Thu Apr 5 13:49:52 2012 : Info: expand: %{Acct-Session-Id} -> Thu Apr 5 13:49:52 2012 : Info: expand: %{NAS-IP-Address} -> 127.0.0.1 Thu Apr 5 13:49:52 2012 : Debug: WARNING: You are modifying the value of virtual attribute Packet-Dst-Port. This is not supported. Thu Apr 5 13:49:52 2012 : Info: ++[coa] returns updated Thu Apr 5 13:49:52 2012 : Info: Found Auth-Type = PAP Thu Apr 5 13:49:52 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Thu Apr 5 13:49:52 2012 : Info: +- entering group PAP {...} Thu Apr 5 13:49:52 2012 : Info: [pap] login attempt with password "password" Thu Apr 5 13:49:52 2012 : Info: [pap] Using clear text password "password" Thu Apr 5 13:49:52 2012 : Info: [pap] User authenticated successfully Thu Apr 5 13:49:52 2012 : Info: ++[pap] returns ok Thu Apr 5 13:49:52 2012 : Auth: Login OK: [testing/password] (from client localhost port 4200) Thu Apr 5 13:49:52 2012 : Info: # Executing section post-auth from file /etc/freeradius/sites-enabled/default Thu Apr 5 13:49:52 2012 : Info: +- entering group post-auth {...} Thu Apr 5 13:49:52 2012 : Info: [sql] expand: %{User-Name} -> testing Thu Apr 5 13:49:52 2012 : Info: [sql] sql_set_user escaped user --> 'testing' Thu Apr 5 13:49:52 2012 : Info: [sql] expand: %{User-Password} -> password Thu Apr 5 13:49:52 2012 : Info: [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate,ip,webport,mediaport) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}:-%{Role2}', '%S','%{IP}','%{WEBPORT}','%{MEDIAPORT}') -> INSERT INTO radpostauth (username, pass, reply, authdate,ip,webport,mediaport) VALUES ( 'testing', 'password', 'Access-Accept:-', '2012-04-05 13:49:52','','','') Thu Apr 5 13:49:52 2012 : Info: [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql Thu Apr 5 13:49:52 2012 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate,ip,webport,mediaport) VALUES ( 'testing', 'password', 'Access-Accept:-', '2012-04-05 13:49:52','','','') Thu Apr 5 13:49:52 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Thu Apr 5 13:49:52 2012 : Debug: rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate,ip,webport,mediaport) VALUES ( 'testing', 'password', 'Access-Accept:-', '2012-04-05 13:49:52','','','') Thu Apr 5 13:49:52 2012 : Debug: rlm_sql (sql): Released sql socket id: 4 Thu Apr 5 13:49:52 2012 : Info: ++[sql] returns ok Thu Apr 5 13:49:52 2012 : Info: ++[exec] returns noop Sending Access-Accept of id 1 to 127.0.0.1 port 57378 Role = "http://www.freeradius.org/rfc/attributes.html" Role2 = "Home A" Thu Apr 5 13:49:52 2012 : Info: WARNING: Unknown destination 127.0.0.1:4200 for CoA request. Thu Apr 5 13:49:52 2012 : Info: Do CoA Fail handler here Thu Apr 5 13:49:52 2012 : Info: Finished request 2. Thu Apr 5 13:49:52 2012 : Debug: Going to the next request Thu Apr 5 13:49:52 2012 : Debug: Waking up in 4.9 seconds. Thu Apr 5 13:49:57 2012 : Info: Cleaning up request 2 ID 1 with timestamp +1160 Thu Apr 5 13:49:57 2012 : Info: Ready to process requests Thanks raihan -- View this message in context: http://freeradius.1045715.n5.nabble.com/How-to-configure-COA-in-freeRadius-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 12

Re: Re: EAP-PEAP + Windows 7 with SSO and Password change
by CD DD 06 Apr '12

06 Apr '12

Hi Alan, and how do i get this working ? I installed freeradius 3.0.0 and tested it, no chance by me ! Thanks, Alan DeKok wrote: >Aman Arneja wrote: >> Password change and retry is very much supported for Windows and Eap >> for (P)eap-mschapv2. There would be some flag that needs to be set for >> this after which it will work, will check what that flag is and write >> back in some time > The git "master" branch of FreeRADIUS supports MS-CHAP password >change. Version 2.1.x does NOT support it. >> Alan DeKok. -- NEU: FreePhone 3-fach-Flat mit kostenlosem Smartphone! Jetzt informieren: http://mobile.1und1.de/?ac=OM.PW.PW003K20328T7073a

2 1

atributing VLANs to roaming users
by Rui Ribeiro 05 Apr '12

05 Apr '12

Hi, I am having some problems with freeradius 2.1.12 and eduroam; whilst the local users are authenticated properly and given a specific VLAN, I haven´t been able to do the same to roaming (proxied) users. I have tried to place the following unlang code at the end of post-proxy, and in another separate test, at the end of post-auth, without much success. Any hints of fellow eduroamers? Best regards, Rui if ( Realm != "myreal" ) { update reply { Service-Type := "Framed-User" Reply-Message := "Eduroam Roaming" Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := "216" } }

2 1

radius proxy
by mimir 05 Apr '12

05 Apr '12

Hello, I applied proxy configuration between two radius servers. I see that packets are succesfully sent to second server and can get statistics via radmin tool. Besides this, I can log or write to sql the accounting datas. When I shutdown the remote server I can see the status of remote server like dead/alive and it is run succesfully with time settings in definition of home_server. But, I want to log accounting packets which could not be sent (which have no accounting response) to remote server (acct start/stop). Is it possible? Thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/radius-proxy-tp5620043p5620043.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 1

RE: EAP-PEAP + Windows 7 with SSO and Password change
by Aman Arneja 05 Apr '12

05 Apr '12

Password change and retry is very much supported for Windows and Eap for (P)eap-mschapv2. There would be some flag that needs to be set for this after which it will work, will check what that flag is and write back in some time Sent from my Windows Phone From: David Mitton Sent: 4/5/2012 6:19 PM To: freeradius-users(a)lists.freeradius.org Subject: Re: EAP-PEAP + Windows 7 with SSO and Password change Yes, basically, password change operations are not supported by Windows EAP support. Not to mention RADIUS as well. Dave. Quoting c_dornig(a)gmx.de: > Hi, > > > we would like to use freeradius server for setup port access per > 802.1x on wired LAN. The plan is to have a guest-vlan for > unauthenticated supplicants and a vlan assignment for authenticated > supplicants. > > We configured the freeradius Server (Version 2.1.12) to use > peap/mschapv2 for user authentication. Each user can have one > nativ/untagged VLAN. > So far, the actual configuration works. > > Now we would like to use the Single Sign On feature from windows 7 > supplicant before the user logged in. > But this seems to work only if the user account is valid. > When the User account is new (with password change on next loggon) > or the password has expired, then the freeradius send the > MS-CHAP-Error to the supplicant. But why the hell, the windows 7 > client do not popup a window for change the password ? > > Is that generally not possible (cause EAP-MSCHAPv2) or something > missed in config ? > > I tried to use freeradius 3.0.0 from git with enabling the > passchange feature in the mschap module. > I did all steps from doc/mschap.rst. > > The follow Debug is from freeradius 3.0.0: > > <snip> > : > : > (8) Found Auth-Type = EAP > (8) # Executing group from file > /usr/local/etc/raddb/sites-enabled/inner-tunnel > (8) group authenticate { > (8) - entering group authenticate {...} > (8) eap : Request found, released from the list > (8) eap : EAP/mschapv2 > (8) eap : processing type mschapv2 > (8) mschapv2 : # Executing group from file > /usr/local/etc/raddb/sites-enabled/inner-tunnel > (8) mschapv2 : group MS-CHAP { > (8) mschapv2 : - entering group MS-CHAP {...} > (8) mschap : NT Domain delimeter found, should we have enabled > with_ntdomain_hack? > (8) mschap : Creating challenge hash with username: DOMAIN\test-user3 > (8) mschap : Told to do MS-CHAPv2 for DOMAIN\test-user3 with NT-Password > (8) mschap : expand: %{Stripped-User-Name} -> > (8) mschap : ... expanding second conditional > (8) mschap : expand: %{User-Name} -> DOMAIN\test-user3 > (8) mschap : expand: %{%{User-Name}:-None} -> DOMAIN\test-user3 > (8) mschap : expand: > --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> > --username=DOMAIN\test-user3 > (8) mschap : NT Domain delimeter found, should we have enabled > with_ntdomain_hack? > (8) mschap : Creating challenge hash with username: DOMAIN\test-user3 > (8) mschap : expand: %{mschap:Challenge} -> 4b4be3875649ba1a > (8) mschap : expand: --challenge=%{%{mschap:Challenge}:-00} -> > --challenge=4b4be3875649ba1a > (8) mschap : expand: %{mschap:NT-Response} -> > a900f8c9381beb68f33a91cc2f1c87bb72970bdd62ece3a2 > (8) mschap : expand: --nt-response=%{%{mschap:NT-Response}:-00} > -> --nt-response=a900f8c9381beb68f33a91cc2f1c87bb72970bdd62ece3a2 > Exec-Program output: Password expired (0xc0000648) > Exec-Program-Wait: plaintext: Password expired (0xc0000648) > Exec-Program: returned: 1 > (8) mschap : ntlm_auth says password has expired > (8) [mschap] = reject > rlm_eap_mschapv2: No MS-CHAPv2-Success or MS-CHAP-Error was found. > (8) eap : Handler failed in EAP/mschapv2 > (8) eap : Failed in EAP select > (8) [eap] = invalid > (8) Failed to authenticate the user. > (8) Login incorrect: [DOMAIN\\test-user3/<via Auth-Type = EAP>] > (from client switches port 0 via TLS tunnel) > } # server inner-tunnel > (8) peap : Got tunneled reply code 3 > MS-CHAP-Error = "\013E=648 R=0 > C=62fa0aad52c662d5b02fcda34542d074 V=3 M=Password Expired" > EAP-Message = 0x040b0004 > Message-Authenticator = 0x00000000000000000000000000000000 > (8) peap : Got tunneled reply RADIUS code 3 > MS-CHAP-Error = "\013E=648 R=0 > C=62fa0aad52c662d5b02fcda34542d074 V=3 M=Password Expired" > EAP-Message = 0x040b0004 > Message-Authenticator = 0x00000000000000000000000000000000 > (8) peap : Tunneled authentication was rejected. > (8) peap : FAILURE > (8) [eap] = handled > Sending Access-Challenge of id 128 to 192.168.15.52 port 2686 > EAP-Message = > 0x010c002b190017030100202f2f3b44177589096e8dbced7004dd801b1a777dd1a966acf5dcbde958537403 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x7cb2ed6374bef496dfd35c4e86820391 > (8) Finished request 8. > Waking up in 0.1 seconds. > rad_recv: Access-Request packet from host zzz.aaa.xxx.yyy port 2686, > id=129, length=262 > Framed-MTU = 1480 > NAS-IP-Address = zzz.aaa.xxx.yyy > NAS-Identifier = "SWITCHxxx" > User-Name = "DOMAIN\\test-user3" > Service-Type = Framed-User > : > : > : > > </snip> > > Thanks for any help. > -- > Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir > belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1