Hi
I have been trying to implement radius authetication server
at my workplace. The idea is to have all wifi access points authenticate
against a radius server.
The radius server needs to pass
authentication to a backend Active Directory server. I have been
sucessful in authenticating wifi users against file based and SQL based
authentication in radius. NTLM_AUTH using PAP also works fine, wherein
plaintext password is sucessfully authenticated against the AD and I get
an "Access-Accept". However when I pass the same credentials over CHAP,
MSCHAP or EAP_MSCHAP the same is not working and I end up in a
"Access-Reject". Seems like that the ntlm_auth program is not parsing
the received encrypted password hence the authetication fails. MSCHAP is
a requirement as wifi clients at my place mostly have eap supplicant.
(Read in freeradius documentation that eap and ldap doesnt go hand in
hand, I may be wrong at interpreting the same)
The freeradius logs for all the cases is listed below. Radius gurus
please point me to the right direction as to make MS_CHAP authentication
owrk over ntlm_auth or ldap(if possible).
PS: I did all the testing using JRadius simulator.
Regards
Dhiraj Gaur
-------------------------- LOGS ------------------------------
rad_recv: Access-Request packet from host 192.168.3.210 port 32854, id=22, length=69
User-Name = "01546"
User-Password = "xxxxxxxxxxx" --> (Plian Text password)
NAS-IP-Address = 192.168.0.199
Message-Authenticator = 0x008294e58343b74ea977c228f5b5ec5d
Fri Jan 20 18:28:42 2012 : Info: +- entering group authorize {...}
Fri Jan 20 18:28:42 2012 : Info: ++[preprocess] returns ok
Fri Jan 20 18:28:42 2012 : Info: ++[chap] returns noop
Fri Jan 20 18:28:42 2012 : Info: ++[mschap] returns noop
Fri Jan 20 18:28:42 2012 : Info: [suffix] No '@' in User-Name = "01546", looking up realm NULL
Fri Jan 20 18:28:42 2012 : Info: [suffix] No such realm "NULL"
Fri Jan 20 18:28:42 2012 : Info: ++[suffix] returns noop
Fri Jan 20 18:28:42 2012 : Info: [eap] No EAP-Message, not doing EAP
Fri Jan 20 18:28:42 2012 : Info: ++[eap] returns noop
Fri Jan 20 18:28:42 2012 : Info: [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=01546
Fri
Jan 20 18:28:42 2012 : Info: [ntlm_auth] expand:
--password=%{User-Password} -> --password=xxxxxxxxx --> (We can
see the password in plaintext)
Fri Jan 20 18:28:42 2012 : Debug: Exec-Program output: NT_STATUS_OK: Success (0x0)
Fri Jan 20 18:28:42 2012 : Debug: Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0)
Fri Jan 20 18:28:42 2012 : Debug: Exec-Program: returned: 0
Fri Jan 20 18:28:42 2012 : Info: ++[ntlm_auth] returns ok
Fri Jan 20 18:28:42 2012 : Info: ++[expiration] returns noop
Fri Jan 20 18:28:42 2012 : Info: ++[logintime] returns noop
Fri
Jan 20 18:28:42 2012 : Info: [pap] WARNING! No "known good" password
found for the user. Authentication may fail because of this.
Fri Jan 20 18:28:42 2012 : Info: ++[pap] returns noop
Fri Jan 20 18:28:42 2012 : Info: ++? if (!control:Auth-Type)
Fri Jan 20 18:28:42 2012 : Info: ? Evaluating !(control:Auth-Type) -> TRUE
Fri Jan 20 18:28:42 2012 : Info: ++? if (!control:Auth-Type) -> TRUE
Fri Jan 20 18:28:42 2012 : Info: ++- entering if (!control:Auth-Type) {...}
Fri Jan 20 18:28:42 2012 : Info: +++[control] returns noop
Fri Jan 20 18:28:42 2012 : Info: ++- if (!control:Auth-Type) returns noop
Fri Jan 20 18:28:42 2012 : Info: Found Auth-Type = ntlm_auth
Fri Jan 20 18:28:42 2012 : Info: +- entering group NTLM_AUTH {...}
Fri Jan 20 18:28:42 2012 : Info: [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=01546
Fri Jan 20 18:28:42 2012 : Info: [ntlm_auth] expand: --password=%{User-Password} -> --password=xxxxxxxx
Fri Jan 20 18:28:42 2012 : Debug: Exec-Program output: NT_STATUS_OK: Success (0x0)
Fri Jan 20 18:28:42 2012 : Debug: Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0)
Fri Jan 20 18:28:42 2012 : Debug: Exec-Program: returned: 0
Fri Jan 20 18:28:42 2012 : Info: ++[ntlm_auth] returns ok
Fri Jan 20 18:28:42 2012 : Info: +- entering group post-auth {...}
Fri Jan 20 18:28:42 2012 : Info: [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=01546
Fri Jan 20 18:28:42 2012 : Info: [ntlm_auth] expand: --password=%{User-Password} -> --password=xxxxxxxx
Fri Jan 20 18:28:42 2012 : Debug: Exec-Program output: NT_STATUS_OK: Success (0x0)
Fri Jan 20 18:28:42 2012 : Debug: Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0)
Fri Jan 20 18:28:42 2012 : Debug: Exec-Program: returned: 0
Fri Jan 20 18:28:42 2012 : Info: ++[ntlm_auth] returns ok
Fri Jan 20 18:28:42 2012 : Info: ++[exec] returns noop
Sending Access-Accept of id 22 to 192.168.3.210 port 32854
JRADIUS CLINET LOG
Sending RADIUS Packet:
----------------------------------------------------------
Class: class net.jradius.packet.AccessRequest
Attributes:
User-Name := 01546
User-Password := [Encrypted String]
NAS-IP-Address := 192.168.0.199
Message-Authenticator := [Binary Data (length=16)]
Received RADIUS Packet:
----------------------------------------------------------
Class: class net.jradius.packet.AccessAccept
Attributes:
-----------------------------------------------------------------------
rad_recv: Access-Request packet from host 192.168.3.210 port 32854, id=22, length=88
User-Name = "01546"
NAS-IP-Address = 192.168.0.199
CHAP-Challenge = 0xf454eecc38bb821eb32aa451728f6c57
CHAP-Password = 0x16aec775613540e9d4945ec5f116faf84e
Message-Authenticator = 0xf231228e943e3b7de3d2de0f48b1c9c2
Fri Jan 20 18:29:27 2012 : Info: +- entering group authorize {...}
Fri Jan 20 18:29:27 2012 : Info: ++[preprocess] returns ok
Fri Jan 20 18:29:27 2012 : Info: [chap] Setting 'Auth-Type := CHAP'
Fri Jan 20 18:29:27 2012 : Info: ++[chap] returns ok
Fri Jan 20 18:29:27 2012 : Info: ++[mschap] returns noop
Fri Jan 20 18:29:27 2012 : Info: [suffix] No '@' in User-Name = "01546", looking up realm NULL
Fri Jan 20 18:29:27 2012 : Info: [suffix] No such realm "NULL"
Fri Jan 20 18:29:27 2012 : Info: ++[suffix] returns noop
Fri Jan 20 18:29:27 2012 : Info: [eap] No EAP-Message, not doing EAP
Fri Jan 20 18:29:27 2012 : Info: ++[eap] returns noop
Fri Jan 20 18:29:27 2012 : Info: [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=01546
Fri Jan 20 18:29:27 2012 : Info: [ntlm_auth] expand: --password=%{User-Password} -> --password=
Fri Jan 20 18:29:27 2012 : Debug: Exec-Program output: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)
Fri Jan 20 18:29:27 2012 : Debug: Exec-Program-Wait: plaintext: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)
Fri Jan 20 18:29:27 2012 : Debug: Exec-Program: returned: 1
Fri Jan 20 18:29:27 2012 : Info: ++[ntlm_auth] returns reject
Fri Jan 20 18:29:27 2012 : Info: Using Post-Auth-Type Reject
Fri Jan 20 18:29:27 2012 : Info: +- entering group REJECT {...}
Fri Jan 20 18:29:27 2012 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 01546
Fri Jan 20 18:29:27 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11
Fri Jan 20 18:29:27 2012 : Info: ++[attr_filter.access_reject] returns updated
Fri Jan 20 18:29:27 2012 : Info: Delaying reject of request 5 for 1 seconds
Fri Jan 20 18:29:27 2012 : Debug: Going to the next request
Fri Jan 20 18:29:27 2012 : Debug: Waking up in 0.9 seconds.
Fri Jan 20 18:29:28 2012 : Info: Sending delayed reject for request 5
Sending Access-Reject of id 22 to 192.168.3.210 port 32854
JRADIUS CLINET LOG
Sending RADIUS Packet:
----------------------------------------------------------
Class: class net.jradius.packet.AccessRequest
Attributes:
User-Name := 01546
NAS-IP-Address := 192.168.0.199
CHAP-Challenge := [Binary Data (length=16)]
CHAP-Password := [Binary Data (length=17)]
Message-Authenticator := [Binary Data (length=16)]
Received RADIUS Packet:
----------------------------------------------------------
Class: class net.jradius.packet.AccessReject
Attributes:
--------------------------------------------------------------------------------------
rad_recv: Access-Request packet from host 192.168.3.210 port 32854, id=23, length=133
User-Name = "01546"
NAS-IP-Address = 192.168.0.199
MS-CHAP-Challenge = 0x4262788d507fdf3cc3a78a50f98c7a8e
MS-CHAP2-Response = 0x00007062fd34e8a05d2996f236e49ea738580000000000000000f7b20a408df67dbcda3faf9290592064f165a9bcf6f37e8f
Message-Authenticator = 0x92716bba8963b228666c070135f8245a
Fri Jan 20 18:29:56 2012 : Info: +- entering group authorize {...}
Fri Jan 20 18:29:56 2012 : Info: ++[preprocess] returns ok
Fri Jan 20 18:29:56 2012 : Info: ++[chap] returns noop
Fri Jan 20 18:29:56 2012 : Info: [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'
Fri Jan 20 18:29:56 2012 : Info: ++[mschap] returns ok
Fri Jan 20 18:29:56 2012 : Info: [suffix] No '@' in User-Name = "01546", looking up realm NULL
Fri Jan 20 18:29:56 2012 : Info: [suffix] No such realm "NULL"
Fri Jan 20 18:29:56 2012 : Info: ++[suffix] returns noop
Fri Jan 20 18:29:56 2012 : Info: [eap] No EAP-Message, not doing EAP
Fri Jan 20 18:29:56 2012 : Info: ++[eap] returns noop
Fri Jan 20 18:29:56 2012 : Info: [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=01546
Fri Jan 20 18:29:56 2012 : Info: [ntlm_auth] expand: --password=%{User-Password} -> --password=
Fri Jan 20 18:29:57 2012 : Debug: Exec-Program output: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)
Fri Jan 20 18:29:57 2012 : Debug: Exec-Program-Wait: plaintext: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)
Fri Jan 20 18:29:57 2012 : Debug: Exec-Program: returned: 1
Fri Jan 20 18:29:57 2012 : Info: ++[ntlm_auth] returns reject
Fri Jan 20 18:29:57 2012 : Info: Using Post-Auth-Type Reject
Fri Jan 20 18:29:57 2012 : Info: +- entering group REJECT {...}
Fri Jan 20 18:29:57 2012 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 01546
Fri Jan 20 18:29:57 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11
Fri Jan 20 18:29:57 2012 : Info: ++[attr_filter.access_reject] returns updated
Fri Jan 20 18:29:57 2012 : Info: Delaying reject of request 6 for 1 seconds
Fri Jan 20 18:29:57 2012 : Debug: Going to the next request
Fri Jan 20 18:29:57 2012 : Debug: Waking up in 0.8 seconds.
Fri Jan 20 18:29:57 2012 : Info: Sending delayed reject for request 6
Sending Access-Reject of id 23 to 192.168.3.210 port 32854
JRADIUS CLINET LOG
Sending RADIUS Packet:
----------------------------------------------------------
Class: class net.jradius.packet.AccessRequest
Attributes:
User-Name := 01546
NAS-IP-Address := 192.168.0.199
MS-CHAP-Challenge := [Binary Data (length=16)]
MS-CHAP2-Response := [Binary Data (length=50)]
Message-Authenticator := [Binary Data (length=16)]
Received RADIUS Packet:
----------------------------------------------------------
Class: class net.jradius.packet.AccessReject
Attributes:
-----------------------------------------------------------------------------------------
rad_recv: Access-Request packet from host 192.168.3.210 port 32854, id=24, length=63
User-Name = "01546"
NAS-IP-Address = 192.168.0.199
EAP-Message = 0x0200000a013031353436
Message-Authenticator = 0x2a95a91be9cb3f0d79d167ea048043f9
Fri Jan 20 18:30:30 2012 : Info: +- entering group authorize {...}
Fri Jan 20 18:30:30 2012 : Info: ++[preprocess] returns ok
Fri Jan 20 18:30:30 2012 : Info: ++[chap] returns noop
Fri Jan 20 18:30:30 2012 : Info: ++[mschap] returns noop
Fri Jan 20 18:30:30 2012 : Info: [suffix] No '@' in User-Name = "01546", looking up realm NULL
Fri Jan 20 18:30:30 2012 : Info: [suffix] No such realm "NULL"
Fri Jan 20 18:30:30 2012 : Info: ++[suffix] returns noop
Fri Jan 20 18:30:30 2012 : Info: [eap] EAP packet type response id 0 length 10
Fri Jan 20 18:30:30 2012 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation
Fri Jan 20 18:30:30 2012 : Info: ++[eap] returns updated
Fri Jan 20 18:30:30 2012 : Info: [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=01546
Fri Jan 20 18:30:30 2012 : Info: [ntlm_auth] expand: --password=%{User-Password} -> --password=
Fri Jan 20 18:30:30 2012 : Debug: Exec-Program output: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)
Fri Jan 20 18:30:30 2012 : Debug: Exec-Program-Wait: plaintext: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a)
Fri Jan 20 18:30:30 2012 : Debug: Exec-Program: returned: 1
Fri Jan 20 18:30:30 2012 : Info: ++[ntlm_auth] returns reject
Fri Jan 20 18:30:30 2012 : Info: Using Post-Auth-Type Reject
Fri Jan 20 18:30:30 2012 : Info: +- entering group REJECT {...}
Fri Jan 20 18:30:30 2012 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 01546
Fri Jan 20 18:30:30 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11
Fri Jan 20 18:30:30 2012 : Info: ++[attr_filter.access_reject] returns updated
Fri Jan 20 18:30:30 2012 : Info: Delaying reject of request 7 for 1 seconds
Fri Jan 20 18:30:30 2012 : Debug: Going to the next request
Fri Jan 20 18:30:30 2012 : Debug: Waking up in 0.9 seconds.
Fri Jan 20 18:30:31 2012 : Info: Sending delayed reject for request 7
Sending Access-Reject of id 24 to 192.168.3.210 port 32854
JRADIUS CLINET LOG
Sending RADIUS Packet:
----------------------------------------------------------
Class: class net.jradius.packet.AccessRequest
Attributes:
User-Name := 01546
NAS-IP-Address := 192.168.0.199
EAP-Message := [Binary Data (length=10)]
Message-Authenticator := [Binary Data (length=16)]
Received RADIUS Packet:
----------------------------------------------------------
Class: class net.jradius.packet.AccessReject
Attributes: