- Freeradius-Users - lists.freeradius.org

post_proxy_authorize = no
by Beat Schnyder 06 Jul '10

06 Jul '10

Dear freeradius users I'm trying to migrate our current radius infrastructure, and encountered the following question: I'm using: - FreeRADIUS Version 2.0.4 (Debian Lenny, 2.0.4+dfsg-6) - A Virtual Server "preauth", that parses the Username for some strings with the users file - Some requests get proxied to another server - On return of the proxied request, the authentication is done again, but because the users file is rather large, and the parsing slow, I would like to skip it - In previous versions we put "post_proxy_authorize = no" into proxy.conf, but this seems to have stopped working Now: How can I achieve this "skipping re-authentication after proxying"? Thanks for all replies Beat Schnyder ---------

2 1

Re: "Exiting normally" on FreeBSD -- Synopsis?
by Brian A. Seklecki 06 Jul '10

06 Jul '10

> Next step must be ktrace(8)/kdump(8) or GDB [1]. > > ~BAS > So it turns out, since April, there have been two distinctive types of crashes. The unexplained SIGHUP, which we eventually tracked down to faulty logging configurations (now using SYSLOG instead of file logging), and an ongoing Sig11. We finally got around to setting up core dump archival and here's what we found: % sudo gdb ../local/sbin/radiusd /var/core/133.radiusd.core GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "amd64-marcel-freebsd"... Core was generated by `radiusd'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/local/lib/freeradius-2.1.9/libfreeradius-radius-2.1.9.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/libfreeradius-radius-2.1.9.so Reading symbols from /lib/libcrypt.so.5...done. Loaded symbols for /lib/libcrypt.so.5 Reading symbols from /usr/local/lib/libltdl.so.7...done. Loaded symbols for /usr/local/lib/libltdl.so.7 Reading symbols from /usr/lib/libssl.so.6...done. Loaded symbols for /usr/lib/libssl.so.6 Reading symbols from /lib/libcrypto.so.6...done. Loaded symbols for /lib/libcrypto.so.6 Reading symbols from /lib/libthr.so.3...done. Loaded symbols for /lib/libthr.so.3 Reading symbols from /lib/libc.so.7...done. Loaded symbols for /lib/libc.so.7 Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_exec.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_exec.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_expr.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_expr.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_chap.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_chap.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_mschap.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_mschap.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_pap.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_pap.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_realm.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_realm.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_ldap.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_ldap.so Reading symbols from /usr/local/lib/libldap_r-2.4.so.7...done. Loaded symbols for /usr/local/lib/libldap_r-2.4.so.7 Reading symbols from /usr/local/lib/liblber-2.4.so.7...done. Loaded symbols for /usr/local/lib/liblber-2.4.so.7 Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_preprocess.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_preprocess.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_acct_unique.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_acct_unique.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_files.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_files.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_detail.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_detail.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_radutmp.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_radutmp.so Reading symbols from /libexec/ld-elf.so.1...done. Loaded symbols for /libexec/ld-elf.so.1 #0 0x0000000000409c49 in rad_authenticate (request=0x80138ba40) at auth.c:667 667 request->reply->code = PW_AUTHENTICATION_REJECT; [New Thread 801208740 (LWP 100229)] [New Thread 801208900 (LWP 100220)] [New Thread 801208ac0 (LWP 100135)] [New Thread 801208c80 (LWP 100132)] [New Thread 801208e40 (LWP 100108)] [New Thread 8012021c0 (LWP 100395)] And: (gdb) bt #0 0x0000000000409c49 in rad_authenticate (request=0x80138ba40) at auth.c:667 #1 0x000000000043241c in radius_handle_request (request=0x80138ba40, fun=0x409700 <rad_authenticate>) at event.c:3735 #2 0x0000000000425311 in request_handler_thread (arg=0x8013799c0) at threads.c:493 #3 0x0000000800e509ed in pthread_create () from /lib/libthr.so.3 #4 0x0000000000000000 in ?? () Cannot access memory at address 0x7fffff5fc000 This is where I normally defer to Steve/Alan for a bit of GDB/C skills I'd be happy to provide a redacted radiusd.conf(5) and and run any GDB commands, we just have to keep the contents of memory under wraps to protect passwords (We use LDAP, so.) This is: [bseklecki@blackout ~]$ radiusd -v radiusd: FreeRADIUS Version 2.1.9, for host amd64-portbld-freebsd8.0, built on Jun 30 2010 at 11:46:51 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Happy holidays, all, ~BAS

2 1

Re: FreeRadius + AD + Realms
by Matthew P 05 Jul '10

05 Jul '10

> $ man unlang > > This says "put the string %{1} as the value of Stripped-User-Name". > > See the "data types' section of the manual page, and the "strings" section. Got it ;) Thanks for your help, fixed now. btw. the "unlang-way" is quite more flexible than the "legacy-module-way" Was this problem even possible to solve without using unlang? (using freeradius 1.x for an example) _________________________________________________________________ Hotmail: Powerful Free email with security by Microsoft. https://signup.live.com/signup.aspx?id=60969

2 1

Who Talks to Who?
by Thomas Reeves 05 Jul '10

05 Jul '10

Greetings All, I'm new to FreeRADIUS and I still don't have a good sense of who talks to who. I've attached a small PDF-format diagram of what I'm trying to accomplish and my IDEA of who talks to who. Any links or feedback would be appreciated. Cheers! Thomas

2 2

NULL realm reject
by Velpi 05 Jul '10

05 Jul '10

Hi, is it possible to configure an instant reject for a certain realm (in proxy.conf)? I'd like to set this for the NULL realm to disable usernames without a suffix. (any other suggestion to accomplish this is welcomed too!) Thanks! -- /--------------------------------------------- | Jan "Velpi" Van der Velpen | Velpi(a)industria.be || +32 (0) 498 61 24 89 \---------------------------------------------

2 4

how to return attribute with more than one value in an access-accept packet?
by WWF 05 Jul '10

05 Jul '10

Hello, all! Now I use fr 2.19 for our WiMAX network. It works well now! Thanks for all who have helped us on this maillist. however, I still have an important question. Our vendor asked us to return some attributes which are listed in WiMAX Forum Standard as return 0-n or 1-n. That is, in a single access-accept packet, there may 2 or 3 value for attribute like "Packet-Flow-Descriptor", "Time-Of-Day-Time". I don't know how to achieve this? Thanks in advance for your kindly help!

2 1

mschap/peap question
by Wegener, Norbert 05 Jul '10

05 Jul '10

With 2.1.8 and the configuration from http://deployingradius.com/scripts/eapol_test/peap-mschapv2.conf I want to test a radius configuration. The linux server running radius is member of the AD domain, mschap succeeds but finally the authentication fails. freeradius sends Challenges to which eapol_test will not respond. This should not be the behaviour mentioned in eap.conf regarding windows compatibility as eapol_test says: ... EAP-MSCHAPV2: RX identifier 11 mschapv2_id 10 EAP-MSCHAPV2: Received success EAP-MSCHAPV2: Invalid authenticator response in success request EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL and finally fails. What is going wrong when freeradius says: ++[mschap] returns ok^M MSCHAP Success while eapol_test declares: EAP-MSCHAPV2: Invalid authenticator response in success request ? Thie result is the same whether eapol_test and radius run on the same host or on different machines. Below an extract from radius debug and eapol_test output. The complete logs are at http://tinyurl.com/36wn5lz ... Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for ZZZZZ1EC-TST with NT-Password [mschap] expand: --username=%{mschap:User-Name} -> --username=ZZZZZ1EC-TST [mschap] mschap2: c9 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=8dcf3f854091b5b0 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=32025f3e02109f45a23b3468721d538944af5d633f31afe2 Exec-Program output: NT_KEY: F2203599C0AD93B00507898A198A3698 Exec-Program-Wait: plaintext: NT_KEY: F2203599C0AD93B00507898A198A3698 Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010b00331a030a002e533d35423746314132333037313436343646314439373138453036333834454238383541454432384246 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6aef51466be44b4f70ee0c4182d406d0 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010b00331a030a002e533d35423746314132333037313436343646314439373138453036333834454238383541454432384246 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6aef51466be44b4f70ee0c4182d406d0 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 10 to 127.0.0.1 port 58631 EAP-Message = 0x010b005b19001703010050de110c863ab2d5e21f07b010fc9adbfcda106b35f8cee8549fde8851ad1ba75da7bd114c1481cf7d9edb8adc3b2e4d8d2b5f7e62ba0fcea0b7e8e7e6e3edf45c2a1847d9195e7a0421a854d5ce12a3cf Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cecf09536e7e9bedf3400a6b087488e Finished request 10. Going to the next request Waking up in 4.5 seconds. eapol_test : ... Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=10 length=149 Attribute 79 (EAP-Message) length=93 Value: 01 0b 00 5b 19 00 17 03 01 00 50 31 9a b2 e5 49 18 04 ab eb 62 5c cc 03 11 93 ba e9 60 5d 66 bc 6b fb 67 97 92 75 f3 cd d7 d7 1b 5b ae bc aa 12 1f c1 a2 a5 41 2a e7 10 11 c1 b9 6f 3d 39 87 04 6e f8 b8 a5 0a a7 9d f8 79 91 cd 6d 3f 32 e1 2e fc df 43 4b 4c 96 99 fc 14 07 2c Attribute 80 (Message-Authenticator) length=18 Value: b0 cf e3 2a 75 f5 18 48 50 99 4b b4 e3 c8 50 70 Attribute 24 (State) length=18 Value: 65 71 c9 7b 6f 7a d0 fc 26 6f 03 8b 5c fc f1 85 STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.09 sec RADIUS packet matching with station decapsulated EAP packet (code=1 id=11 len=91) from RADIUS server: EAP-Request-PEAP (25) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=11 method=25 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=91) - Flags 0x00 EAP-PEAP: received 85 bytes encrypted data for Phase 2 EAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=47): 1a 03 0a 00 2e 53 3d 35 33 36 46 30 44 42 30 36 42 43 45 36 42 43 37 32 31 34 33 33 37 39 46 39 38 33 35 46 33 41 31 37 38 41 43 46 44 43 39 EAP-PEAP: received Phase 2: code=1 identifier=11 length=51 EAP-PEAP: Phase 2 Request: type=26 EAP-MSCHAPV2: RX identifier 11 mschapv2_id 10 EAP-MSCHAPV2: Received success EAP-MSCHAPV2: Invalid authenticator response in success request EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: startWhen --> 0 EAPOL test timed out EAP: deinitialize previously used EAP method (25, PEAP) at EAP deinit ENGINE: engine deinit MPPE keys OK: 0 mismatch: 1 FAILURE Thanks Norbert Wegener With best regards, Norbert Wegener Siemens AG Siemens IT Solutions and Services SIS GO NW PSU SDC AS&INS Bruchstraße 5 45883 Gelsenkirchen, Germany Tel.: +49 (209) 94565716 Fax: +49 (201) 8165581284 mailto:norbert.wegener@siemens.com Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Gerhard Cromme; Managing Board: Peter Loescher, Chairman, President and Chief Executive Officer; Wolfgang Dehen, Heinrich Hiesinger, Joe Kaeser, Barbara Kux, Hermann Requardt, Siegfried Russwurm, Peter Y. Solmssen; Registered offices: Berlin and Munich, Germany; Commercial registries: Berlin Charlottenburg, HRB 12300, Munich, HRB 6684; WEEE-Reg.-No. DE 23691322

3 7

ntlm_auth fails for none domain
by John 05 Jul '10

05 Jul '10

Hi, We are using freeRADIUS talk to multiple ADs integration. I updated my freeRADIUS from 1.1.6 to 2.1.9 recently. "xjtu" is our default domain, for users under this domain will only use username to authenticate to RADIUS. With 1.1.6, it will get "xjtu" as domain; But with 2.1.9, it will not, please see the debug info below. It is the related part in configuration file: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain:-xjtu} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" It is debug info: [mschap] Told to do MS-CHAPv2 for hhe with NT-Password [mschap] No NT-Domain was found in the User-Name. [mschap] expand: --domain=%{mschap:NT-Domain} -> --domain= [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=hhe [mschap] mschap2: a6 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=ddca17e9bfdaf05a [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=741e305efc7bce1071682eee0b3c37142b184b9544242304 John

3 2

Re: ntlm_auth fails for none domain
by John 05 Jul '10

05 Jul '10

Hi, It is the whole debug info. I think the problem is we could not get the default domain name "xjtu". Listening on authentication address * port 1812 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.155.20.85 port 32807, id=118, length=125 Service-Type = Authorize-Only NAS-Port-Type = Wireless-802.11 User-Name = "hhe" MS-CHAP-Challenge = 0xd764c8cce93255c4478d7aa05d83f3ea MS-CHAP2-Response = 0x9c00a2b7249b043e23cd2866211bff3783d60000000000000000924fed02a24dee7533a7b9af370e858e1b798d9151617838 NAS-IP-Address = 10.155.20.85 +- entering group authorize {...} ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] performing user authorization for hhe [ldap] expand: (sAMAccountName=%{mschap:User-Name}) -> (sAMAccountName=hhe) [ldap] expand: OU=Domain Controllers,dc=xjtu,dc=cn -> OU=Domain Controllers,dc=xjtu,dc=cn [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 10.155.3.250:389, authentication 0 [ldap] bind as hhe(a)xjtu.cn/w2006njh to 10.155.3.250:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in OU=Domain Controllers,dc=xjtu,dc=cn, with filter (sAMAccountName=hhe) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user hhe authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for hhe with NT-Password [mschap] No NT-Domain was found in the User-Name. [mschap] expand: --domain=%{mschap:NT-Domain:-xjtu} -> --domain= [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=hhe [mschap] mschap2: d7 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=cf5ba32b520debdd [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=924fed02a24dee7533a7b9af370e858e1b798d9151617838 Exec-Program output: No such user (0xc0000064) Exec-Program-Wait: plaintext: No such user (0xc0000064) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.6 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 118 to 10.155.20.85 port 32807 MS-CHAP-Error = "\234E=691 R=1" Waking up in 4.9 seconds. Cleaning up request 0 ID 118 with timestamp +33 Ready to process requests. --- 10年7月1日，周四, Alan DeKok <aland(a)deployingradius.com> 写道：发件人: Alan DeKok <aland(a)deployingradius.com> 主题: Re: ntlm_auth fails for none domain 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年7月1日,周四,下午2:02 John wrote: > "xjtu" is our default domain, for users under this domain will only use > username to authenticate to RADIUS. With 1.1.6, it will get "xjtu" as > domain; But with 2.1.9, it will not, please see the debug info below. You have deleted nearly all of the debug information, including the information we need to help you. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 5

Re: ntlm_auth fails for none domain
by John 05 Jul '10

05 Jul '10

It is debug info when I use freeRADIUS-1.1.6. rad_recv: Access-Request packet from host 10.155.20.85:32790, id=171, length=125 --> Service-Type = Authorize-Only --> NAS-Port-Type = Wireless-802.11 --> User-Name = "hhe" --> MS-CHAP-Challenge = 0x837a4fb32a47a5bda0c24d5e4329fcdc --> MS-CHAP2-Response = 0xe40069bdb5799e2fa75ccc2d53415669f4d900000000000000008cad47a91a94b2a475bda048fda283bf23e702b5129a3164 --> NAS-IP-Address = 10.155.20.85 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modsingle[authorize]: calling chap (rlm_chap) for request 2 modsingle[authorize]: returned from chap (rlm_chap) for request 2 modcall[authorize]: module "chap" returns noop for request 2 modsingle[authorize]: calling mschap (rlm_mschap) for request 2 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modsingle[authorize]: returned from mschap (rlm_mschap) for request 2 modcall[authorize]: module "mschap" returns ok for request 2 modsingle[authorize]: calling eap (rlm_eap) for request 2 rlm_eap: No EAP-Message, not doing EAP modsingle[authorize]: returned from eap (rlm_eap) for request 2 modcall[authorize]: module "eap" returns noop for request 2 modsingle[authorize]: calling ldap (rlm_ldap) for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for hhe radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '(sAMAccountName=hhe)' radius_xlat: 'dc=xjtu,dc=cn' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: ldap_release_conn: Release Id: 0 modsingle[authorize]: returned from ldap (rlm_ldap) for request 2 modcall[authorize]: module "ldap" returns ok for request 2 modsingle[authorize]: calling ldap (rlm_ldap) for request 2 modsingle[authorize]: calling pap (rlm_pap) for request 2 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modsingle[authorize]: returned from pap (rlm_pap) for request 2 modcall[authorize]: module "pap" returns noop for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 2 modsingle[authenticate]: calling mschap (rlm_mschap) for request 2 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for hhe with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' rlm_mschap: No NT-Domain was found in the User-Name. radius_xlat: '--domain=xjtu' radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=hhe' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 83 radius_xlat: '--challenge=cfdb7016e508348d' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=8cad47a91a94b2a475bda048fda283bf23e702b5129a3164' rlm_mschap: adding MS-CHAPv2 MPPE keys modsingle[authenticate]: returned from mschap (rlm_mschap) for request 2 modcall[authenticate]: module "mschap" returns ok for request 2 modcall: leaving group MS-CHAP (returns ok) for request 2 Sending Access-Accept of id 171 to 10.155.20.85 port 32790 --> MS-CHAP2-Success = 0xe4533d41313535304434313643373437413542363236393941394135393532374335424630423438384537 --> MS-MPPE-Recv-Key = 0x6ac9* --> MS-MPPE-Send-Key = 0xcfe2* --> MS-MPPE-Encryption-Policy = 0x00000001 --> MS-MPPE-Encryption-Types = 0x00000006 Finished request 2 --- 10年7月5日，周一, John <elmer_radius(a)yahoo.com.cn> 写道：发件人: John <elmer_radius(a)yahoo.com.cn> 主题: Re: ntlm_auth fails for none domain 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年7月5日,周一,下午3:06 Yes. You are right. If I use hhe(a)xjtu.cn, it will work. If I use old freeRADIUS-1.1.6, username "hhe" can work well. I think it is because I set default domain name "xjtu" in mschap module (ntlm_auth) . But freeRADIUS-2.1.9 could not work without domain. ---- ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain:-xjtu} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" --- 10年7月2日，周五, Alan DeKok <aland(a)deployingradius.com> 写道：发件人: Alan DeKok <aland(a)deployingradius.com> 主题: Re: ntlm_auth fails for none domain 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年7月2日,周五,下午3:45 John wrote: > Hi, > It is the whole debug info. I think the problem is we could not get the > default domain name "xjtu". Because the username does not include the domain. Log in with "hhe(a)xjtu.cn", and it will work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -----下面为附件内容----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0