- Freeradius-Users - lists.freeradius.org

Odd problem (FreeRadius 1.0.5 / MSSQL 2000 / Fedora Core 3)
by Matt 16 Nov '05

16 Nov '05

We have the exact same configuration working on another system, but have been unable to get it to work correctly on this Fedora Core 3 system. We are using rlm_sql to have FreeRadius talk to our MSSQL 2000 database. That works. The odd part is on the Fedora Core 3 system it seems to be having issues reading the shared secret. When I start the server in debug mode I get: rlm_sql (sql: Read entry nasname=216.240.101.102,shortname=auth1.virtdom.com,secret=8Y Well this is all good, but the secret is not "8Y". In fact it's more something like cP83ufJu32 The fields are all nvarchar in the database (ip, shortname, secret)... yet ip and shortname display correctly. If I go into the C code for the rlm_sql module and put row[8] in place of row[5] in the debug I get the same thing, even though row[8] has the description of the NAS. If I use tsql to connect to the database and do a select * from my NAS table, all the data comes out right. It seems like something in freeradius is mangeling the sharedsecret. Can anyone shed light on this?

1 1

client configuration with max6000
by Danny Zenzano 16 Nov '05

16 Nov '05

i m working with the max6000-lucent and the freeradius 1.0.0-5 but in the client file i can see a list of NAS: # The nastype tells 'checkrad.pl' which NAS-specific method to # use to query the NAS for simultaneous use. # # Permitted NAS types are: # # cisco # computone # livingston # max40xx # multitech # netserver # pathras # patton # portslave # tc # usrhiper # other # for all other types which of the options I must choose? i configure something like this: client 192.1.1.1 { # secret and password are mapped through the "secrets" file. secret = secret shortname = Ras # the following three fields are optional, but may be used by # checkrad.pl for simultaneous usage checks nastype = other #login = RasViva #password = vivaMMS }

2 1

Login incorrect- RAS autentication
by Danny Zenzano 16 Nov '05

16 Nov '05

hi, I am trying to make work an RAS(lucent-max6000) with the freeRADIUS,I configure the MAX6000, and the radius obtains an authentication order from the RAS, but as result I obtain a login error message. somebody could help me? this is the result: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.3:1812, id=51, length=72 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=52, length=78 User-Name = "bridge-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "initial-banner-RAS" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=53, length=64 User-Name = "banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x Login incorrect: [initial-banner-RAS/ascend] (from client RAS port 0) Login incorrect: [banner/ascend] (from client RAS port 0) Login incorrect: [bridge-RAS-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=54, length=66 User-Name = "ipxroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [ipxroute-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=55, length=63 Sending Access-Reject of id 51 to 192.168.1.3:1812 Sending Access-Reject of id 52 to 192.168.1.3:1812 Sending Access-Reject of id 53 to 192.168.1.3:1812 User-Name = "dovbs-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=56, length=68 Login incorrect: [dovbs-1/ascend] (from client RAS port 0) User-Name = "appleroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [appleroute-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=57, length=70 User-Name = "initial-banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [initial-banner/ascend] (from client RAS port 0) Sending Access-Reject of id 54 to 192.168.1.3:1812 Sending Access-Reject of id 55 to 192.168.1.3:1812 Sending Access-Reject of id 56 to 192.168.1.3:1812 Sending Access-Reject of id 57 to 192.168.1.3:1812 rad_recv: Access-Request packet from host 10.40.4.35:2328, id=12, length=44 User-Name = "root" User-Password = "viva123" Login OK: [root/viva123] (from client ZenzanoPC port 0) Sending Access-Accept of id 12 to 10.40.4.35:2328 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=60, length=71 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=61, length=74 User-Name = "route-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "ipxroute-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=62, length=76 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=63, length=69 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=64, length=76 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=65, length=75 User-Name = "appleroute-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=66, length=72 User-Name = "pools-RAS" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "permconn-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x rad_recv: Access-Request packet from host 192.168.1.3:1812, id=67, length=78 User-Name = "frdlink-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x rad_recv: Access-Request packet from host 192.168.1.3:1812, id=68, length=64 User-Name = "bridge-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "initial-banner-RAS" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x Login incorrect: [permconn-RAS-1/ascend] (from client RAS port 0) Login incorrect: [pools-RAS/ascend] (from client RAS port 0) Login incorrect: [ipxroute-RAS-1/ascend] (from client RAS port 0) Login incorrect: [frdlink-RAS-1/ascend] (from client RAS port 0) Login incorrect: [bridge-RAS-1/ascend] (from client RAS port 0) Login incorrect: [initial-banner-RAS/ascend] (from client RAS port 0) Login incorrect: [appleroute-RAS-1/ascend] (from client RAS port 0) Login incorrect: [banner/ascend] (from client RAS port 0) Login incorrect: [route-RAS-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=69, length=63 User-Name = "dovbs-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [dovbs-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=70, length=66 Sending Access-Reject of id 60 to 192.168.1.3:1812 Sending Access-Reject of id 61 to 192.168.1.3:1812 Sending Access-Reject of id 62 to 192.168.1.3:1812 Sending Access-Reject of id 63 to 192.168.1.3:1812 Sending Access-Reject of id 64 to 192.168.1.3:1812 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=71, length=68 Sending Access-Reject of id 65 to 192.168.1.3:1812 Sending Access-Reject of id 66 to 192.168.1.3:1812 Sending Access-Reject of id 67 to 192.168.1.3:1812 Sending Access-Reject of id 68 to 192.168.1.3:1812 User-Name = "ipxroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "appleroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=72, length=70 Login incorrect: [appleroute-1/ascend] (from client RAS port 0) User-Name = "initial-banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [ipxroute-1/ascend] (from client RAS port 0) Login incorrect: [initial-banner/ascend] (from client RAS port 0) Sending Access-Reject of id 69 to 192.168.1.3:1812 Sending Access-Reject of id 70 to 192.168.1.3:1812 Sending Access-Reject of id 71 to 192.168.1.3:1812 Sending Access-Reject of id 72 to 192.168.1.3:1812

3 3

Ading NAS to MySQL DB
by Alex M 16 Nov '05

16 Nov '05

Hi, I'm keeping playing around with mysql manipulation, and im having trouble to force radius to obtain list of authorized clients (NASes) from SQL DB, I assume I have to enter NAS info in NAS table (im using suggested schema that was created automatically by script that came with distribution) but I not really sure what data should go where and if it is right table for clients info? Please help!

2 1

rlm_eap runtime link failure on FreeRADIUS 1.0.5 under Cygwin
by Nicola Iotti 16 Nov '05

16 Nov '05

I have a problem using Freeradius 1.0.5 under Cygwin I have a problem with rlm_eap module, I've configured with: ./configure --disabled-shared but it don't work... I found this message in the mailing list and I'm in the same situation (except for the freeradius version)... but I can't find slution.. >I've been able to configure, make and install the product with little to >no problem. However, execution aborts when rlm_eap is loaded: >... >Module: Instantiated mschap (mschap) >Module: Loaded System > unix: cache =3D no > unix: passwd =3D "(null)" > unix: shadow =3D "(null)" > unix: group =3D "(null)" > unix: radwtmp =3D "/usr/local/var/log/radius/radwtmp" > unix: usegroup =3D no > unix: cache_reload =3D 600 >Module: Instantiated unix (unix) >radiusd.conf[9] Failed to link to module 'rlm_eap': unknown error > >Line 9 (of eap.conf) is where the eap module is loaded: > >... > eap { >... I hope someone have solution Ing. Nicola Iotti Network Manager mailto: nicola.iotti(a)guglielmo.biz Guglielmo S.r.l. Sede legale: Via Martiri di Minozzo, 12 Sede operativa: Via Sante Vincenzi , 2 / D 42100 Reggio Emilia ITALIA Tel.: +39-0522 - 40 63 67 Fax: +39-0522 - 54 08 16 Cell: +39-320 61 90 072 internet website: http://www.guglielmo.biz mailto:info@guglielmo.biz

1 0

Setup freeradius for intranet desktop client
by mahesh luhar 16 Nov '05

16 Nov '05

Dear All, I have installed radius server Version 1.0.5 on linux 9. I would like to use feeradius server following usage. (1) Intranet desktop client authentication for internet access with limited no of ports as outgoing destination ports. (2) Few users on cable modem. Can i setup radius functionality for such users. Please guide Regards, Mahesh Luhar -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

2 1

Regx Question
by Mike O'Connor 16 Nov '05

16 Nov '05

Hi All I have the following in the users and acct_users files DEFAULT Called-Station-Id == "0198334115", Proxy-To-Realm := "xxxx.com" I would like to match on "198334115" with a possibility of about 4 to 6 more number on the front of this number. I have tried a number of difference regx's but non of them have worked so I must have something wrong :) Any ideas would be great. Thanks Mike

3 4

Login incorrect- RAS autentication
by Danny Zenzano 15 Nov '05

15 Nov '05

hi, I am trying to make work an RAS(lucent-max6000) with the freeRADIUS,I configure the MAX6000, and the radius obtains an authentication order from the RAS, but as result I obtain a login error message. somebody could help me? this is the result: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.3:1812, id=51, length=72 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=52, length=78 User-Name = "bridge-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "initial-banner-RAS" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=53, length=64 User-Name = "banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x Login incorrect: [initial-banner-RAS/ascend] (from client RAS port 0) Login incorrect: [banner/ascend] (from client RAS port 0) Login incorrect: [bridge-RAS-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=54, length=66 User-Name = "ipxroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [ipxroute-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=55, length=63 Sending Access-Reject of id 51 to 192.168.1.3:1812 Sending Access-Reject of id 52 to 192.168.1.3:1812 Sending Access-Reject of id 53 to 192.168.1.3:1812 User-Name = "dovbs-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=56, length=68 Login incorrect: [dovbs-1/ascend] (from client RAS port 0) User-Name = "appleroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [appleroute-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=57, length=70 User-Name = "initial-banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [initial-banner/ascend] (from client RAS port 0) Sending Access-Reject of id 54 to 192.168.1.3:1812 Sending Access-Reject of id 55 to 192.168.1.3:1812 Sending Access-Reject of id 56 to 192.168.1.3:1812 Sending Access-Reject of id 57 to 192.168.1.3:1812 rad_recv: Access-Request packet from host 10.40.4.35:2328, id=12, length=44 User-Name = "root" User-Password = "viva123" Login OK: [root/viva123] (from client ZenzanoPC port 0) Sending Access-Accept of id 12 to 10.40.4.35:2328 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=60, length=71 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=61, length=74 User-Name = "route-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "ipxroute-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=62, length=76 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=63, length=69 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=64, length=76 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=65, length=75 User-Name = "appleroute-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=66, length=72 User-Name = "pools-RAS" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "permconn-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x rad_recv: Access-Request packet from host 192.168.1.3:1812, id=67, length=78 User-Name = "frdlink-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x rad_recv: Access-Request packet from host 192.168.1.3:1812, id=68, length=64 User-Name = "bridge-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "initial-banner-RAS" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x Login incorrect: [permconn-RAS-1/ascend] (from client RAS port 0) Login incorrect: [pools-RAS/ascend] (from client RAS port 0) Login incorrect: [ipxroute-RAS-1/ascend] (from client RAS port 0) Login incorrect: [frdlink-RAS-1/ascend] (from client RAS port 0) Login incorrect: [bridge-RAS-1/ascend] (from client RAS port 0) Login incorrect: [initial-banner-RAS/ascend] (from client RAS port 0) Login incorrect: [appleroute-RAS-1/ascend] (from client RAS port 0) Login incorrect: [banner/ascend] (from client RAS port 0) Login incorrect: [route-RAS-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=69, length=63 User-Name = "dovbs-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [dovbs-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=70, length=66 Sending Access-Reject of id 60 to 192.168.1.3:1812 Sending Access-Reject of id 61 to 192.168.1.3:1812 Sending Access-Reject of id 62 to 192.168.1.3:1812 Sending Access-Reject of id 63 to 192.168.1.3:1812 Sending Access-Reject of id 64 to 192.168.1.3:1812 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=71, length=68 Sending Access-Reject of id 65 to 192.168.1.3:1812 Sending Access-Reject of id 66 to 192.168.1.3:1812 Sending Access-Reject of id 67 to 192.168.1.3:1812 Sending Access-Reject of id 68 to 192.168.1.3:1812 User-Name = "ipxroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "appleroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=72, length=70 Login incorrect: [appleroute-1/ascend] (from client RAS port 0) User-Name = "initial-banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [ipxroute-1/ascend] (from client RAS port 0) Login incorrect: [initial-banner/ascend] (from client RAS port 0) Sending Access-Reject of id 69 to 192.168.1.3:1812 Sending Access-Reject of id 70 to 192.168.1.3:1812 Sending Access-Reject of id 71 to 192.168.1.3:1812 Sending Access-Reject of id 72 to 192.168.1.3:1812

1 0

RE: Login incorrect- RAS autentication
by Danny Zenzano 15 Nov '05

15 Nov '05

-----Mensaje original----- De: Danny Zenzano [mailto:danny.zenzano@nuevatel.com] Enviado el: martes, 15 de noviembre de 2005 19:57 Para: 'freeradius-users(a)lists.freeradius.org' Asunto: Login incorrect- RAS autentication hi, I am trying to make work an RAS(lucent-max6000) with the freeRADIUS,I configure the MAX6000, and the radius obtains an authentication order from the RAS, but as result I obtain a login error message. somebody could help me? this is the result: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.3:1812, id=51, length=72 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=52, length=78 User-Name = "bridge-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "initial-banner-RAS" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=53, length=64 User-Name = "banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x Login incorrect: [initial-banner-RAS/ascend] (from client RAS port 0) Login incorrect: [banner/ascend] (from client RAS port 0) Login incorrect: [bridge-RAS-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=54, length=66 User-Name = "ipxroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [ipxroute-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=55, length=63 Sending Access-Reject of id 51 to 192.168.1.3:1812 Sending Access-Reject of id 52 to 192.168.1.3:1812 Sending Access-Reject of id 53 to 192.168.1.3:1812 User-Name = "dovbs-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=56, length=68 Login incorrect: [dovbs-1/ascend] (from client RAS port 0) User-Name = "appleroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [appleroute-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=57, length=70 User-Name = "initial-banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [initial-banner/ascend] (from client RAS port 0) Sending Access-Reject of id 54 to 192.168.1.3:1812 Sending Access-Reject of id 55 to 192.168.1.3:1812 Sending Access-Reject of id 56 to 192.168.1.3:1812 Sending Access-Reject of id 57 to 192.168.1.3:1812 rad_recv: Access-Request packet from host 10.40.4.35:2328, id=12, length=44 User-Name = "root" User-Password = "viva123" Login OK: [root/viva123] (from client ZenzanoPC port 0) Sending Access-Accept of id 12 to 10.40.4.35:2328 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=60, length=71 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=61, length=74 User-Name = "route-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "ipxroute-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=62, length=76 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=63, length=69 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=64, length=76 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=65, length=75 User-Name = "appleroute-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=66, length=72 User-Name = "pools-RAS" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "permconn-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x rad_recv: Access-Request packet from host 192.168.1.3:1812, id=67, length=78 User-Name = "frdlink-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x rad_recv: Access-Request packet from host 192.168.1.3:1812, id=68, length=64 User-Name = "bridge-RAS-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "initial-banner-RAS" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User State = 0x Login incorrect: [permconn-RAS-1/ascend] (from client RAS port 0) Login incorrect: [pools-RAS/ascend] (from client RAS port 0) Login incorrect: [ipxroute-RAS-1/ascend] (from client RAS port 0) Login incorrect: [frdlink-RAS-1/ascend] (from client RAS port 0) Login incorrect: [bridge-RAS-1/ascend] (from client RAS port 0) Login incorrect: [initial-banner-RAS/ascend] (from client RAS port 0) Login incorrect: [appleroute-RAS-1/ascend] (from client RAS port 0) Login incorrect: [banner/ascend] (from client RAS port 0) Login incorrect: [route-RAS-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=69, length=63 User-Name = "dovbs-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [dovbs-1/ascend] (from client RAS port 0) rad_recv: Access-Request packet from host 192.168.1.3:1812, id=70, length=66 Sending Access-Reject of id 60 to 192.168.1.3:1812 Sending Access-Reject of id 61 to 192.168.1.3:1812 Sending Access-Reject of id 62 to 192.168.1.3:1812 Sending Access-Reject of id 63 to 192.168.1.3:1812 Sending Access-Reject of id 64 to 192.168.1.3:1812 rad_recv: Access-Request packet from host 192.168.1.3:1812, id=71, length=68 Sending Access-Reject of id 65 to 192.168.1.3:1812 Sending Access-Reject of id 66 to 192.168.1.3:1812 Sending Access-Reject of id 67 to 192.168.1.3:1812 Sending Access-Reject of id 68 to 192.168.1.3:1812 User-Name = "ipxroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User User-Name = "appleroute-1" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User rad_recv: Access-Request packet from host 192.168.1.3:1812, id=72, length=70 Login incorrect: [appleroute-1/ascend] (from client RAS port 0) User-Name = "initial-banner" User-Password = "ascend" NAS-IP-Address = 192.168.1.3 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Outbound-User Login incorrect: [ipxroute-1/ascend] (from client RAS port 0) Login incorrect: [initial-banner/ascend] (from client RAS port 0) Sending Access-Reject of id 69 to 192.168.1.3:1812 Sending Access-Reject of id 70 to 192.168.1.3:1812 Sending Access-Reject of id 71 to 192.168.1.3:1812 Sending Access-Reject of id 72 to 192.168.1.3:1812

1 0

changing password_attribute
by Brian A. Seklecki 15 Nov '05

15 Nov '05

Cisco AP1200 + OpenLDAP + MS-CHAPv2 + EAP configuration (WPA2, basically, right?) So obviously, everyone's userPassword attribute cannot be maintained in cleartext in the LDAP database. If I modify my schema and create a "weakPassword" attribute using the following template: #attributetype ( 2.5.4.35 NAME 'userPassword' # DESC 'RFC2256/2307: password of user' # EQUALITY octetStringMatch # SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} ) Populate it with a {clear} prefix ...and then change the password_attribute in radiusd.conf(5). When the user associates to the AP, authorize works but authenticate fails because the LDAP module is then attempting to bind to the LDAP server as the user. Why does it do this? It can pull all of the LDIF info for the user when it first connects. rlm_ldap: - authorize rlm_ldap: performing user authorization for bkaplan rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to blah:389, authentication 0 rlm_ldap: setting TLS CACert File to /blah rlm_ldap: starting TLS rlm_ldap: bind as cn=RADIUS,foo... to foo.com:11 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=blah rlm_ldap: Added password {CLEAR}secret in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusAuthType as Auth-Type, value wifi & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user bkaplan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" *********** But then: ***** Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "bkaplan" with password "WRONG" rlm_ldap: user DN: blah... rlm_ldap: (re)connect to foo:389, authentication 1 rlm_ldap: setting TLS CACert File to /blah rlm_ldap: starting TLS rlm_ldap: bind as cn=blah=foo,blahfoo,blah blah rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap" returns reject for request 0 modcall: group authenticate returns reject for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: Bind as user failed): [bkaplan/WRONG] (from client blah port 1812) Delaying request 0 for 1 seconds Finished request 0 Going to the next request Why in the world is it using different logic to authorize v.s. authenticate? Head -> Wall Head -> Wall ~BAS

1 1