Dear support, This my log: # tail -f /var/log/radius/radius.log Info: Loaded virtual server <default> Warning: Ignoring "ldap" (see raddb/mods-available/README.rst) Info: Loaded virtual server default Info: # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:330 Info: Loaded virtual server inner-tunnel Info: Ready to process requests Info: Need 4 more connections to reach 10 spares Info: rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used ERROR: (0) pam: ERROR: pam_authenticate failed: Authentication failure Auth: (0) Login incorrect (pam: pam_authenticate failed: Authentication failure): [linux/linux@123] Best regards, Debug radius -X (3) Received Access-Request Id 1 from 172.26.10.34:63261 to 172.24.0.10:1812 length 45 (3) User-Name = "linux" (3) User-Password = "linux@123" (3) # Executing section authorize from file /etc/raddb/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /@\./) { (3) if (&User-Name =~ /@\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (3) auth_log: --> /var/log/radius/radacct/172.26.10.34/auth-detail-20181221 (3) auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.26.10.34/auth-detail-20181221 (3) auth_log: EXPAND %t (3) auth_log: --> Fri Dec 21 10:56:45 2018 (3) [auth_log] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "linux", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: No EAP-Message, not doing EAP (3) [eap] = noop (3) files: Failed resolving UID: No error (3) files: users: Matched entry DEFAULT at line 221 (3) [files] = ok (3) sql: EXPAND %{User-Name} (3) sql: --> linux (3) sql: SQL-User-Name set to 'linux' rlm_sql (sql): Closing connection (1): Hit idle_timeout, was idle for 76 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (6): Hit idle_timeout, was idle for 76 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (2): Hit idle_timeout, was idle for 76 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (3): Hit idle_timeout, was idle for 67 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (7): Hit idle_timeout, was idle for 67 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (4): Hit idle_timeout, was idle for 67 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Reserved connection (0) (3) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (3) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'linux' ORDER BY id (3) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'linux' ORDER BY id (3) sql: User found in radcheck table (3) sql: Conditional check items matched, merging assignment check items (3) sql: MD5-Password := 0x6662656262336539353530303464363162623635616539376331656239616333 (3) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (3) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'linux' ORDER BY id (3) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'linux' ORDER BY id (3) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (3) sql: --> SELECT groupname FROM radusergroup WHERE username = 'linux' ORDER BY priority (3) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'linux' ORDER BY priority (3) sql: User not found in any groups rlm_sql (sql): Released connection (0) Need 7 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (9), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radiusdb' on Localhost via UNIX socket, server version 10.3.11-MariaDB, protocol version 10 (3) [sql] = ok (3) [expiration] = noop (3) [logintime] = noop (3) pap: Normalizing MD5-Password from hex encoding, 32 bytes -> 16 bytes (3) pap: WARNING: Auth-Type already set. Not setting to PAP (3) [pap] = noop (3) } # authorize = ok (3) Found Auth-Type = pam (3) # Executing group from file /etc/raddb/sites-enabled/default (3) authenticate { (3) pam: Using pamauth string "radiusd" for pam.conf lookup (3) pam: ERROR: pam_authenticate failed: Authentication failure (3) [pam] = reject (3) } # authenticate = reject (3) Failed to authenticate the user (3) Login incorrect (pam: pam_authenticate failed: Authentication failure): [linux/linux@123] (from client private-net1e port 0) (3) Using Post-Auth-Type Reject (3) # Executing group from file /etc/raddb/sites-enabled/default (3) Post-Auth-Type REJECT { (3) sql: EXPAND .query (3) sql: --> .query (3) sql: Using query template 'query' rlm_sql (sql): Reserved connection (8) (3) sql: EXPAND %{User-Name} (3) sql: --> linux (3) sql: SQL-User-Name set to 'linux' (3) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (3) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'linux', 'linux@123', 'Access-Reject', '2018-12-21 10:56:45.628824') (3) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'linux', 'linux@123', 'Access-Reject', '2018-12-21 10:56:45.628824') (3) sql: SQL query returned: success (3) sql: 1 record(s) updated rlm_sql (sql): Released connection (8) (3) [sql] = ok (3) attr_filter.access_reject: EXPAND %{User-Name} (3) attr_filter.access_reject: --> linux (3) attr_filter.access_reject: Matched entry DEFAULT at line 11 (3) [attr_filter.access_reject] = updated (3) [eap] = noop (3) policy remove_reply_message_if_eap { (3) if (&reply:EAP-Message && &reply:Reply-Message) { (3) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (3) else { (3) [noop] = noop (3) } # else = noop (3) } # policy remove_reply_message_if_eap = noop (3) } # Post-Auth-Type REJECT = updated (3) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (3) Sending delayed response (3) Sent Access-Reject Id 1 from 172.24.0.10:1812 to 172.26.10.34:63261 length 20 Waking up in 3.9 seconds. (3) Cleaning up request packet ID 1 with timestamp +91 Ready to process requests Sum Soklang Senior Network System Engineer Cambo Technology ISP Co. Ltd. +855 (0) 99 999 208 From: freeradius-users-request@lists.freeradius.org Sent: Friday, December 21, 2018 10:36 AM To: freeradius-users@lists.freeradius.org Subject: Freeradius-Users Digest, Vol 164, Issue 44 Send Freeradius-Users mailing list submissions to freeradius-users@lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request@lists.freeradius.org You can reach the person managing the list at freeradius-users-owner@lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Ms-Chap + NT-Password (Alan DeKok) 2. Re: Ms-Chap + NT-Password (Anton Kiryushkin) 3. Re: Ms-Chap + NT-Password (Alan DeKok) 4. RE: Freeradius-Users Digest, Vol 164, Issue 43 (soklang.sum) ---------------------------------------------------------------------- Message: 1 Date: Thu, 20 Dec 2018 16:06:05 -0500 From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Ms-Chap + NT-Password Message-ID: <1AD55C6B-C125-4B3B-BEB9-45FFF80D38A7@deployingradius.com> Content-Type: text/plain; charset=us-ascii On Dec 20, 2018, at 3:52 PM, Anton Kiryushkin <swood@fotofor.biz> wrote:
Hello, Alan.
I checked it.
Let me show you full log:
Thu Dec 20 01:10:08 2018 : Debug: (138) User-Name = " anonymous@espressif.com"
Please post the log from "radiusd -X" as suggested *EVERYWHERE* in the documentation. For some unknown reason people recently seem to be ignoring all of the documentation that says to post "radiusd -X". This is mentioned in the "man" page, the Wiki, and in the email you get when you join the list. Out of general principle, I'm going to ignore messages which fail to follow the documentation. Re-post this with the *correct* debug log, and I will read it. Alan DeKok. ------------------------------ Message: 2 Date: Thu, 20 Dec 2018 23:18:00 +0000 From: Anton Kiryushkin <swood@fotofor.biz> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Ms-Chap + NT-Password Message-ID: <CAM_jxg2Lf_HKfGd3kU4qdbdQmq+SkUbc=-Tvk=W0+jYdzQs1OQ@mail.gmail.com> Content-Type: text/plain; charset="UTF-8" Hello, Alan. You're right. My fault. Please see log below: (9) User-Name = "testlogin" (9) NAS-Port = 215 (9) State = 0x5d9ac8cb5bb0d1b476356bca7bc2305b (9) EAP-Message = 0x022a00681900170303005d0000000000000002301470a7306238a494e48f971e6c3870bb09639041141c00594ceaf49ffe07ac3d0ecdb68988c165ca8f370152e4cc61bf8065410eb9cf70432c800237bc3f4b089aaa37633688a6abe470d7f72aacf17e16110ef7 (9) Message-Authenticator = 0x3a5c65e42a9d0494a1805e850396ff75 (9) Acct-Session-Id = "8O2.1x811d36760006c7c6" (9) NAS-Port-Id = "ge-3/0/40.0" (9) Calling-Station-Id = "2c-4d-54-65-19-3b" (9) Called-Station-Id = "88-e0-f3-b0-d6-00" (9) NAS-IP-Address = 192.168.7.2 (9) NAS-Identifier = "sw-ex6210" (9) NAS-Port-Type = Ethernet (9) session-state: No cached attributes (9) # Executing section authorize from file /etc/raddb/sites-enabled/default (9) authorize { (9) if (!control:Cleartext-Password && &User-Password) { (9) if (!control:Cleartext-Password && &User-Password) -> FALSE (9) if (config:User-Password && config:Cleartext-Password) { (9) if (config:User-Password && config:Cleartext-Password) -> FALSE (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "testlogin", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) eap: Peer sent EAP Response (code 2) ID 42 length 104 (9) eap: Continuing tunnel setup (9) [eap] = ok (9) } # authorize = ok (9) Found Auth-Type = eap (9) # Executing group from file /etc/raddb/sites-enabled/default (9) authenticate { (9) eap: Expiring EAP session with state 0x1b445c8e1b6e4610 (9) eap: Finished EAP session with state 0x5d9ac8cb5bb0d1b4 (9) eap: Previous EAP request found for state 0x5d9ac8cb5bb0d1b4, released from the list (9) eap: Peer sent packet with method EAP PEAP (25) (9) eap: Calling submodule eap_peap to process data (9) eap_peap: Continuing EAP-TLS (9) eap_peap: [eaptls verify] = ok (9) eap_peap: Done initial handshake (9) eap_peap: [eaptls process] = ok (9) eap_peap: Session established. Decoding tunneled attributes (9) eap_peap: PEAP state phase2 (9) eap_peap: EAP method MSCHAPv2 (26) (9) eap_peap: Got tunneled request (9) eap_peap: EAP-Message = 0x022a00491a022a0044314bdbebd0c0d0e6a8932b5fcdc388361a00000000000000004318685452e8005b97b446f5c1c0d23265bc1198557b1aa900646d697472792e616e616e796576 (9) eap_peap: Setting User-Name to testlogin (9) eap_peap: Sending tunneled request to default (9) eap_peap: EAP-Message = 0x022a00491a022a0044314bdbebd0c0d0e6a8932b5fcdc388361a00000000000000004318685452e8005b97b446f5c1c0d23265bc1198557b1aa900646d697472792e616e616e796576 (9) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (9) eap_peap: User-Name = "testlogin" (9) eap_peap: State = 0x1b445c8e1b6e4610f294f492105a1239 (9) Virtual server default received request (9) EAP-Message = 0x022a00491a022a0044314bdbebd0c0d0e6a8932b5fcdc388361a00000000000000004318685452e8005b97b446f5c1c0d23265bc1198557b1aa900646d697472792e616e616e796576 (9) FreeRADIUS-Proxied-To = 127.0.0.1 (9) User-Name = "testlogin" (9) State = 0x1b445c8e1b6e4610f294f492105a1239 (9) WARNING: Outer and inner identities are the same. User privacy is compromised. (9) server default { (9) session-state: No cached attributes (9) # Executing section authorize from file /etc/raddb/sites-enabled/default (9) authorize { (9) if (!control:Cleartext-Password && &User-Password) { (9) if (!control:Cleartext-Password && &User-Password) -> FALSE (9) if (config:User-Password && config:Cleartext-Password) { (9) if (config:User-Password && config:Cleartext-Password) -> FALSE (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "testlogin", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) eap: Peer sent EAP Response (code 2) ID 42 length 73 (9) eap: No EAP Start, assuming it's an on-going EAP conversation (9) [eap] = updated (9) sql-wifi: EXPAND %{User-Name} (9) sql-wifi: --> testlogin (9) sql-wifi: SQL-User-Name set to 'testlogin' rlm_sql (sql-wifi): Reserved connection (2) (9) sql-wifi: EXPAND SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = '%{SQL-User-Name}' ORDER BY id (9) sql-wifi: --> SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = 'testlogin' ORDER BY id (9) sql-wifi: Executing select query: SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = 'testlogin' ORDER BY id (9) sql-wifi: User found in radcheck table (9) sql-wifi: Conditional check items matched, merging assignment check items (9) sql-wifi: NT-Password := 0x6336623331333036323736373866653636626166393538616561356566363138 (9) sql-wifi: EXPAND SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = '%{SQL-User-Name}' ORDER BY id (9) sql-wifi: --> SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = 'testlogin' ORDER BY id (9) sql-wifi: Executing select query: SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = 'testlogin' ORDER BY id (9) sql-wifi: User found in radreply table, merging reply items (9) sql-wifi: NT-Password := 0x6336623331333036323736373866653636626166393538616561356566363138 (9) sql-wifi: EXPAND SELECT 'OfficeWifi' as GroupName FROM userstable WHERE UserName='%{SQL-User-Name}' (9) sql-wifi: --> SELECT 'OfficeWifi' as GroupName FROM userstable WHERE UserName='testlogin' (9) sql-wifi: Executing select query: SELECT 'OfficeWifi' as GroupName FROM userstable WHERE UserName='testlogin' (9) sql-wifi: User found in the group table (9) sql-wifi: EXPAND SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = '%{SQL-User-Name}' ORDER BY id (9) sql-wifi: --> SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = 'testlogin' ORDER BY id (9) sql-wifi: Executing select query: SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = 'testlogin' ORDER BY id (9) sql-wifi: Group "OfficeWifi": Conditional check items matched (9) sql-wifi: Group "OfficeWifi": Merging assignment check items (9) sql-wifi: NT-Password := 0x61675648496e73416b666d41 (9) sql-wifi: EXPAND SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = '%{SQL-User-Name}' ORDER BY id (9) sql-wifi: --> SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = 'testlogin' ORDER BY id (9) sql-wifi: Executing select query: SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = 'testlogin' ORDER BY id (9) sql-wifi: Group "OfficeWifi": Merging reply items (9) sql-wifi: NT-Password := 0x61675648496e73416b666d41 rlm_sql (sql-wifi): Released connection (2) (9) [sql-wifi] = ok (9) pap: WARNING: Auth-Type already set. Not setting to PAP (9) [pap] = noop (9) } # authorize = updated (9) Found Auth-Type = eap (9) # Executing group from file /etc/raddb/sites-enabled/default (9) authenticate { (9) eap: Expiring EAP session with state 0x1b445c8e1b6e4610 (9) eap: Finished EAP session with state 0x1b445c8e1b6e4610 (9) eap: Previous EAP request found for state 0x1b445c8e1b6e4610, released from the list (9) eap: Peer sent packet with method EAP MSCHAPv2 (26) (9) eap: Calling submodule eap_mschapv2 to process data (9) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/default (9) eap_mschapv2: Auth-Type MS-CHAP { (9) mschap: WARNING: NT-Password found but incorrect length, expected 16 bytes got 12 bytes. Authentication may fail (9) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (9) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (9) mschap: Creating challenge hash with username: testlogin (9) mschap: Client is using MS-CHAPv2 (9) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (9) mschap: ERROR: MS-CHAP2-Response is incorrect (9) [mschap] = reject (9) } # Auth-Type MS-CHAP = reject чт, 20 дек. 2018 г. в 21:06, Alan DeKok <aland@deployingradius.com>:
On Dec 20, 2018, at 3:52 PM, Anton Kiryushkin <swood@fotofor.biz> wrote:
Hello, Alan.
I checked it.
Let me show you full log:
Thu Dec 20 01:10:08 2018 : Debug: (138) User-Name = " anonymous@espressif.com"
Please post the log from "radiusd -X" as suggested *EVERYWHERE* in the documentation.
For some unknown reason people recently seem to be ignoring all of the documentation that says to post "radiusd -X". This is mentioned in the "man" page, the Wiki, and in the email you get when you join the list.
Out of general principle, I'm going to ignore messages which fail to follow the documentation.
Re-post this with the *correct* debug log, and I will read it.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Best regards, Anton Kiryushkin ------------------------------ Message: 3 Date: Thu, 20 Dec 2018 19:13:12 -0500 From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Ms-Chap + NT-Password Message-ID: <CF585B0B-C5DC-4341-9620-1879A9BD52C0@deployingradius.com> Content-Type: text/plain; charset=us-ascii On Dec 20, 2018, at 6:18 PM, Anton Kiryushkin <swood@fotofor.biz> wrote:
You're right. My fault. Please see log below:
Thanks.
... (9) sql-wifi: Conditional check items matched, merging assignment check items (9) sql-wifi: NT-Password := 0x6336623331333036323736373866653636626166393538616561356566363138
Again... that's all ASCII data. You've taken the hex form of the string: c6b3130627678fe66baf958aea5ef618 And instead of just putting this into SQL: NT-Password := 0xc6b3130627678fe66baf958aea5ef618 You've converted the ASCII representation to hex again... and then set that as the NT password. Don't do that.
... (9) eap_mschapv2: Auth-Type MS-CHAP { (9) mschap: WARNING: NT-Password found but incorrect length, expected 16 bytes got 12 bytes. Authentication may fail
And the NT password is mangled, as noted above. Why are you converting the hex string to ASCII *twice*? Just take the output of smbencrypt, put a "0x" in front of it, and set it as NT-Password in the database: Again: $ smbencrypt hello LM Hash NT Hash -------------------------------- -------------------------------- FDA95FBECA288D44AAD3B435B51404EE 066DDFD4EF0E9CD7C256FE77191EF43C And then: NT-Password := 0x066DDFD4EF0E9CD7C256FE77191EF43C You *don't* have to hex-encode the hex output of smbencrypt. Alan DeKok. ------------------------------ Message: 4 Date: Fri, 21 Dec 2018 10:35:31 +0700 From: "soklang.sum" <soklang.sum@cambotech.com> To: "freeradius-users@lists.freeradius.org" <freeradius-users@lists.freeradius.org> Subject: RE: Freeradius-Users Digest, Vol 164, Issue 43 Message-ID: <5c1c5f83.1c69fb81.e454f.3e46@mx.google.com> Content-Type: text/plain; charset="utf-8" Dear Support, I would like to add google authenticator with freeradius. Please kindly assist to support as possible. When I enable in /etc/freeradius/users # Instruct FreeRADIUS to use PAM to authenticate users DEFAULT Auth-Type := PAM Username and password always reject PAM of user in MySQL. Best regards, Sum Soklang Senior Network System Engineer Cambo Technology ISP Co. Ltd. +855 (0) 99 999 208 From: freeradius-users-request@lists.freeradius.org Sent: Friday, December 21, 2018 3:54 AM To: freeradius-users@lists.freeradius.org Subject: Freeradius-Users Digest, Vol 164, Issue 43 Send Freeradius-Users mailing list submissions to freeradius-users@lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request@lists.freeradius.org You can reach the person managing the list at freeradius-users-owner@lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: why user dosn`t connect ? (Alan DeKok) 2. Re: why user dosn`t connect ? (Alan Buxey) 3. Re: Capacity calculation (Alan Buxey) 4. Re: why user dosn`t connect ? (تعلم البرمجة) 5. Re: why user dosn`t connect ? (Alan Buxey) 6. Re: why user dosn`t connect ? (Alan DeKok) 7. Re: why user dosn`t connect ? (Alan Buxey) 8. Re: Ms-Chap + NT-Password (Anton Kiryushkin) ---------------------------------------------------------------------- Message: 1 Date: Thu, 20 Dec 2018 10:18:33 -0500 From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: why user dosn`t connect ? Message-ID: <C061CF1B-7A61-493D-AE3F-6D1FF10E92AB@deployingradius.com> Content-Type: text/plain; charset=utf-8
On Dec 20, 2018, at 9:51 AM, تعلم البرمجة <mido2010bona@gmail.com> wrote:
but why not added to radacct !!
If you're going to reply to your own messages, then PLEASE edit them so you don't post thousands of lines of the same debug output. As for why there's no accounting packets, this is in the FAQ. The NAS is supposed to send accounting packets. Poking FreeRADIUS won't magically make the NAS send accounting packets. Go configure the NAS. Alan DeKok. ------------------------------ Message: 2 Date: Thu, 20 Dec 2018 17:12:29 +0000 From: Alan Buxey <alan.buxey@gmail.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: why user dosn`t connect ? Message-ID: <CAOVYXj9dPO6m_PxKAxd1HL0_AZVC+n6174-8ZKMxt4=O7z=vpQ@mail.gmail.com> Content-Type: text/plain; charset="UTF-8" hi, but why not added to radacct !!
because the packet received by the server was an access-request, not an accounting-start, interim update or stop. so no accounting things were done. alan ------------------------------ Message: 3 Date: Thu, 20 Dec 2018 17:18:23 +0000 From: Alan Buxey <alan.buxey@gmail.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Capacity calculation Message-ID: <CAOVYXj9Jgz3-JOgi-iM6Jejp=vTYaKgsfu-kWUKx9Ku5PKJaVw@mail.gmail.com> Content-Type: text/plain; charset="UTF-8" hi, I want to understand how much TPS freeRADIUS will support for below
configuration along with postgresql DB
as Nathan has said - this all depends on your configuration, requirements, processes/policies that need to be dealt with, etc you can easily do some local benchmarking on a local VM to work out requirements for scaling - obviously the memory requirement will be related to DB requirements (caching etc) - usually the system will be constrained by steps such as DB inserts etc (if doing live ones) rather than CPU - small institutions could probably run FR on a RaspberryPi ... alan ------------------------------ Message: 4 Date: Thu, 20 Dec 2018 19:21:27 +0200 From: تعلم البرمجة <mido2010bona@gmail.com> To: freeradius-users@lists.freeradius.org Subject: Re: why user dosn`t connect ? Message-ID: <CACe-uLw4kUSF6xP_tLH34EhvzZsmmYxs2GV9hCL09fbFa7qoOA@mail.gmail.com> Content-Type: text/plain; charset="UTF-8" thanks allan , i get this error message "User or Chap Password in non-access request"
------------------------------ Message: 5 Date: Thu, 20 Dec 2018 17:22:39 +0000 From: Alan Buxey <alan.buxey@gmail.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: why user dosn`t connect ? Message-ID: <CAOVYXj-hicmjZVHAMVNpYE_yqrkWT_9G-bBbBGf_=W+BV8TVqQ@mail.gmail.com> Content-Type: text/plain; charset="UTF-8" hi, your sending access requests to port 1813 of the server? alan On Thu, 20 Dec 2018 at 17:22, تعلم البرمجة <mido2010bona@gmail.com> wrote:
thanks allan , i get this error message "User or Chap Password in non-access request"
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------ Message: 6 Date: Thu, 20 Dec 2018 12:24:35 -0500 From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: why user dosn`t connect ? Message-ID: <7BBEF01A-206F-46DB-BF3E-2FE7326F31F7@deployingradius.com> Content-Type: text/plain; charset=utf-8
On Dec 20, 2018, at 12:21 PM, تعلم البرمجة <mido2010bona@gmail.com> wrote:
thanks allan , i get this error message "User or Chap Password in non-access request"
That message doesn't come from FreeRADIUS. Alan DeKok. ------------------------------ Message: 7 Date: Thu, 20 Dec 2018 17:27:06 +0000 From: Alan Buxey <alan.buxey@gmail.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: why user dosn`t connect ? Message-ID: <CAOVYXj8c4XNngZ3-XAbxLk69WsDaQpDVgV65b42KfhEfHJQ=wg@mail.gmail.com> Content-Type: text/plain; charset="UTF-8" indeed, looks like its from php-radius https://github.com/LawnGnome/php-radius alan ------------------------------ Message: 8 Date: Thu, 20 Dec 2018 20:52:14 +0000 From: Anton Kiryushkin <swood@fotofor.biz> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Ms-Chap + NT-Password Message-ID: <CAM_jxg1hM8OLdKf0yHP6KkoXSRL+aCkfQHqk0ezQX+r1KPXcDw@mail.gmail.com> Content-Type: text/plain; charset="UTF-8" Hello, Alan. I checked it. Let me show you full log: Thu Dec 20 01:10:08 2018 : Debug: (138) User-Name = " anonymous@espressif.com" Thu Dec 20 01:10:08 2018 : Debug: (138) Chargeable-User-Identity = 0x00 Thu Dec 20 01:10:08 2018 : Debug: (138) Location-Capable = Civic-Location Thu Dec 20 01:10:08 2018 : Debug: (138) Calling-Station-Id = "38-2b-78-03-ee-70" Thu Dec 20 01:10:08 2018 : Debug: (138) Called-Station-Id = "cc-46-d6-09-ed-50:BD" Thu Dec 20 01:10:08 2018 : Debug: (138) NAS-Port = 13 Thu Dec 20 01:10:08 2018 : Debug: (138) Cisco-AVPair = "audit-session-id=c0a807c8000000015ba9aa3b" Thu Dec 20 01:10:08 2018 : Debug: (138) Acct-Session-Id = "5ba9aa3b/38:2b:78:03:ee:70/1" Thu Dec 20 01:10:08 2018 : Debug: (138) NAS-IP-Address = 192.168.1.200 Thu Dec 20 01:10:08 2018 : Debug: (138) NAS-Identifier = "wc-5508" Thu Dec 20 01:10:08 2018 : Debug: (138) Airespace-Wlan-Id = 14 Thu Dec 20 01:10:08 2018 : Debug: (138) Service-Type = Framed-User Thu Dec 20 01:10:08 2018 : Debug: (138) Framed-MTU = 1300 Thu Dec 20 01:10:08 2018 : Debug: (138) NAS-Port-Type = Wireless-802.11 Thu Dec 20 01:10:08 2018 : Debug: (138) Tunnel-Type:0 = VLAN Thu Dec 20 01:10:08 2018 : Debug: (138) Tunnel-Medium-Type:0 = IEEE-802 Thu Dec 20 01:10:08 2018 : Debug: (138) Tunnel-Private-Group-Id:0 = "14" Thu Dec 20 01:10:08 2018 : Debug: (138) EAP-Message = 0x0207007b19001703020070493c43a0045e1a736402d6353c2ebfd02b02b3da47074e8043e42814d384055eb07d8a3fdf5fc763651fee8a9c19e2525e0450f5bee24195a432757be658ec4fec63f0d1a904eaed55de4f98bc097aca893e67f8761a530e374122b3ba2c61eab23cf1af3ecd9ab8edf2907b Thu Dec 20 01:10:08 2018 : Debug: (138) State = 0x9a0fd4fc9e08cd9b875e606333810d4e Thu Dec 20 01:10:08 2018 : Debug: (138) Message-Authenticator = 0x3b8a82762eef0a453f82a36821b263f2 Thu Dec 20 01:10:08 2018 : Debug: (138) session-state: No cached attributes Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing section authorize from file /etc/raddb/sites-enabled/default Thu Dec 20 01:10:08 2018 : Debug: (138) authorize { Thu Dec 20 01:10:08 2018 : Debug: (138) if (!control:Cleartext-Password && &User-Password) { Thu Dec 20 01:10:08 2018 : Debug: (138) if (!control:Cleartext-Password && &User-Password) -> FALSE Thu Dec 20 01:10:08 2018 : Debug: (138) if (config:User-Password && config:Cleartext-Password) { Thu Dec 20 01:10:08 2018 : Debug: (138) if (config:User-Password && config:Cleartext-Password) -> FALSE Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling preprocess (rlm_preprocess) Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from preprocess (rlm_preprocess) Thu Dec 20 01:10:08 2018 : Debug: (138) [preprocess] = ok Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling chap (rlm_chap) Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from chap (rlm_chap) Thu Dec 20 01:10:08 2018 : Debug: (138) [chap] = noop Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling mschap (rlm_mschap) Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from mschap (rlm_mschap) Thu Dec 20 01:10:08 2018 : Debug: (138) [mschap] = noop Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling suffix (rlm_realm) Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: Checking for suffix after "@" Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: Looking up realm " espressif.com" for User-Name = "anonymous@espressif.com" Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: No such realm "espressif.com " Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from suffix (rlm_realm) Thu Dec 20 01:10:08 2018 : Debug: (138) [suffix] = noop Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent EAP Response (code 2) ID 7 length 123 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Continuing tunnel setup Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) [eap] = ok Thu Dec 20 01:10:08 2018 : Debug: (138) } # authorize = ok Thu Dec 20 01:10:08 2018 : Debug: (138) Found Auth-Type = eap Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing group from file /etc/raddb/sites-enabled/default Thu Dec 20 01:10:08 2018 : Debug: (138) authenticate { Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]: calling eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Expiring EAP session with state 0x0d5314a80d540ec8 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Finished EAP session with state 0x9a0fd4fc9e08cd9b Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Previous EAP request found for state 0x9a0fd4fc9e08cd9b, released from the list Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent packet with method EAP PEAP (25) Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Calling submodule eap_peap to process data Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Continuing EAP-TLS Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Peer sent flags --- Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: [eaptls verify] = ok Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Done initial handshake Thu Dec 20 01:10:08 2018 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: [eaptls process] = ok Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Session established. Decoding tunneled attributes Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: PEAP state phase2 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP method MSCHAPv2 (26) Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Got tunneled request Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP-Message = 0x020700441a0207003f3199f6449a50fa3b50be389565dde6ae4b0000000000000000e78496d30625840ded712d0b260d96bead07a7fdd950530a00792e6c696c656b6f76 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Setting User-Name to testlogin Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Sending tunneled request to default Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP-Message = 0x020700441a0207003f3199f6449a50fa3b50be389565dde6ae4b0000000000000000e78496d30625840ded712d0b260d96bead07a7fdd950530a00792e6c696c656b6f76 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: User-Name = “testlogin" Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: State = 0x0d5314a80d540ec8eca17483a9cfe203 Thu Dec 20 01:10:08 2018 : Debug: (138) Virtual server default received request Thu Dec 20 01:10:08 2018 : Debug: (138) EAP-Message = 0x020700441a0207003f3199f6449a50fa3b50be389565dde6ae4b0000000000000000e78496d30625840ded712d0b260d96bead07a7fdd950530a00792e6c696c656b6f76 Thu Dec 20 01:10:08 2018 : Debug: (138) FreeRADIUS-Proxied-To = 127.0.0.1 Thu Dec 20 01:10:08 2018 : Debug: (138) User-Name = "testlogin " Thu Dec 20 01:10:08 2018 : Debug: (138) State = 0x0d5314a80d540ec8eca17483a9cfe203 Thu Dec 20 01:10:08 2018 : Debug: (138) server default { Thu Dec 20 01:10:08 2018 : Debug: (138) session-state: No cached attributes Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing section authorize from file /etc/raddb/sites-enabled/default Thu Dec 20 01:10:08 2018 : Debug: (138) authorize { Thu Dec 20 01:10:08 2018 : Debug: (138) if (!control:Cleartext-Password && &User-Password) { Thu Dec 20 01:10:08 2018 : Debug: (138) if (!control:Cleartext-Password && &User-Password) -> FALSE Thu Dec 20 01:10:08 2018 : Debug: (138) if (config:User-Password && config:Cleartext-Password) { Thu Dec 20 01:10:08 2018 : Debug: (138) if (config:User-Password && config:Cleartext-Password) -> FALSE Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling preprocess (rlm_preprocess) Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from preprocess (rlm_preprocess) Thu Dec 20 01:10:08 2018 : Debug: (138) [preprocess] = ok Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling chap (rlm_chap) Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from chap (rlm_chap) Thu Dec 20 01:10:08 2018 : Debug: (138) [chap] = noop Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling mschap (rlm_mschap) Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from mschap (rlm_mschap) Thu Dec 20 01:10:08 2018 : Debug: (138) [mschap] = noop Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling suffix (rlm_realm) Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: Checking for suffix after "@" Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: No '@' in User-Name = “testlogin", looking up realm NULL Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: No such realm "NULL" Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from suffix (rlm_realm) Thu Dec 20 01:10:08 2018 : Debug: (138) [suffix] = noop Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent EAP Response (code 2) ID 7 length 68 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: No EAP Start, assuming it's an on-going EAP conversation Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) [eap] = updated Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling sql-wifi (rlm_sql) Thu Dec 20 01:10:08 2018 : Debug: %{User-Name} Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree: Thu Dec 20 01:10:08 2018 : Debug: attribute --> User-Name Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND %{User-Name} Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> testlogin Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: SQL-User-Name set to ’testlogin' Thu Dec 20 01:10:08 2018 : Info: rlm_sql (sql-wifi): Closing connection (28): Hit idle_timeout, was idle for 80 seconds Thu Dec 20 01:10:08 2018 : Debug: rlm_sql (sql-wifi): You probably need to lower "min" Thu Dec 20 01:10:08 2018 : Debug: rlm_sql_mysql: Socket destructor called, closing socket Thu Dec 20 01:10:08 2018 : Debug: rlm_sql (sql-wifi): Reserved connection (19) Thu Dec 20 01:10:08 2018 : Debug: SELECT wifi_id as id, UserName, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = '%{SQL-User-Name}' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree: Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT wifi_id as id, UserName, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = ' Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name Thu Dec 20 01:10:08 2018 : Debug: literal --> ' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT wifi_id as id, UserName, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = '%{SQL-User-Name}' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT wifi_id as id, UserName, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = ’testlogin' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query: SELECT wifi_id as id, UserName, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = ’testlogin' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: User found in radcheck table Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Conditional check items matched, merging assignment check items Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password := 0x3161666532333532663366363365333136376163646230306136646366386235 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 1 MAX 2 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: APPENDING NT-Password FROM 0 TO 1 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 1 out 1 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[0] = Auth-Type Thu Dec 20 01:10:08 2018 : Debug: SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = '%{SQL-User-Name}' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree: Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = ' Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name Thu Dec 20 01:10:08 2018 : Debug: literal --> ' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = '%{SQL-User-Name}' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = ’testlogin' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query: SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = ’testlogin' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: User found in radreply table, merging reply items Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password := 0x3161666532333532663366363365333136376163646230306136646366386235 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 0 MAX 1 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: APPENDING NT-Password FROM 0 TO 0 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 0 out 0 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ... falling-through to group processing Thu Dec 20 01:10:08 2018 : Debug: SELECT 'OfficeWifi' as GroupName FROM userstable WHERE UserName='%{SQL-User-Name}' Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree: Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT 'OfficeWifi' as GroupName FROM userstable WHERE UserName=' Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name Thu Dec 20 01:10:08 2018 : Debug: literal --> ' Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT 'OfficeWifi' as GroupName FROM userstable WHERE UserName='%{SQL-User-Name}' Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT 'OfficeWifi' as GroupName FROM userstable WHERE UserName='testlogin' Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query: SELECT 'OfficeWifi' as GroupName FROM userstable WHERE UserName='testlogin' Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: User found in the group table Thu Dec 20 01:10:08 2018 : Debug: SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = '%{SQL-User-Name}' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree: Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = ' Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name Thu Dec 20 01:10:08 2018 : Debug: literal --> ' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = '%{SQL-User-Name}' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = ’testlogin' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query: SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = 'testlogin' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Group "OfficeWifi": Conditional check items matched Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Group "OfficeWifi": Merging assignment check items Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password := 0x696e616d6974414c545a694e3039393021 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 2 MAX 3 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: OVERWRITING NT-Password FROM 0 TO 1 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 2 out 2 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[0] = Auth-Type Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[1] = NT-Password Thu Dec 20 01:10:08 2018 : Debug: SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = '%{SQL-User-Name}' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree: Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = ' Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name Thu Dec 20 01:10:08 2018 : Debug: literal --> ' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = '%{SQL-User-Name}' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = 'testlogin' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query: SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = 'testlogin' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Group "OfficeWifi": Merging reply items Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password := 0x696e616d6974414c545a694e3039393021 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 1 MAX 2 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: OVERWRITING NT-Password FROM 0 TO 0 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 1 out 1 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[0] = NT-Password Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ... falling-through to profile processing Thu Dec 20 01:10:08 2018 : Debug: rlm_sql (sql-wifi): Released connection (19) Thu Dec 20 01:10:08 2018 : Info: Need 1 more connections to reach min connections (5) Thu Dec 20 01:10:08 2018 : Info: rlm_sql (sql-wifi): Opening additional connection (30), 1 of 6 pending slots used Thu Dec 20 01:10:08 2018 : Debug: rlm_sql_mysql: Starting connect to MySQL server Thu Dec 20 01:10:08 2018 : Debug: rlm_sql_mysql: Connected to database 'vpn_wifi' on 127.0.0.1 via TCP/IP, server version 5.7.19-17-log, protocol version 10 Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from sql-wifi (rlm_sql) Thu Dec 20 01:10:08 2018 : Debug: (138) [sql-wifi] = ok Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling pap (rlm_pap) Thu Dec 20 01:10:08 2018 : WARNING: (138) pap: Auth-Type already set. Not setting to PAP Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from pap (rlm_pap) Thu Dec 20 01:10:08 2018 : Debug: (138) [pap] = noop Thu Dec 20 01:10:08 2018 : Debug: (138) } # authorize = updated Thu Dec 20 01:10:08 2018 : Debug: (138) Found Auth-Type = eap Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing group from file /etc/raddb/sites-enabled/default Thu Dec 20 01:10:08 2018 : Debug: (138) authenticate { Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]: calling eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Expiring EAP session with state 0x0d5314a80d540ec8 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Finished EAP session with state 0x0d5314a80d540ec8 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Previous EAP request found for state 0x0d5314a80d540ec8, released from the list Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent packet with method EAP MSCHAPv2 (26) Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Calling submodule eap_mschapv2 to process data Thu Dec 20 01:10:08 2018 : Debug: (138) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/default Thu Dec 20 01:10:08 2018 : Debug: (138) eap_mschapv2: Auth-Type MS-CHAP { Thu Dec 20 01:10:08 2018 : Debug: (138) eap_mschapv2: modsingle[authenticate]: calling mschap (rlm_mschap) Thu Dec 20 01:10:08 2018 : WARNING: (138) mschap: NT-Password found but incorrect length, expected 16 bytes got 17 bytes. Authentication may fail Thu Dec 20 01:10:08 2018 : WARNING: (138) mschap: No Cleartext-Password configured. Cannot create NT-Password Thu Dec 20 01:10:08 2018 : WARNING: (138) mschap: No Cleartext-Password configured. Cannot create LM-Password Thu Dec 20 01:10:08 2018 : Debug: (138) mschap: Creating challenge hash with username: testlogin Thu Dec 20 01:10:08 2018 : Debug: (138) mschap: Client is using MS-CHAPv2 Thu Dec 20 01:10:08 2018 : ERROR: (138) mschap: FAILED: No NT/LM-Password. Cannot perform authentication Thu Dec 20 01:10:08 2018 : ERROR: (138) mschap: MS-CHAP2-Response is incorrect Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]: returned from mschap (rlm_mschap) Thu Dec 20 01:10:08 2018 : Debug: (138) [mschap] = reject Thu Dec 20 01:10:08 2018 : Debug: (138) } # Auth-Type MS-CHAP = reject Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Sending EAP Failure (code 4) ID 7 length 4 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Freeing handler Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]: returned from eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) [eap] = reject Thu Dec 20 01:10:08 2018 : Debug: (138) } # authenticate = reject Thu Dec 20 01:10:08 2018 : Debug: (138) Failed to authenticate the user Thu Dec 20 01:10:08 2018 : Debug: (138) Using Post-Auth-Type Reject Thu Dec 20 01:10:08 2018 : Debug: (138) Post-Auth-Type sub-section not found. Ignoring. Thu Dec 20 01:10:08 2018 : Auth: (138) Login incorrect (mschap: FAILED: No NT/LM-Password. Cannot perform authentication): [testlogin/<via Auth-Type = eap>] (from client WC-5508_ port 0 via TLS tunnel) Thu Dec 20 01:10:08 2018 : Debug: (138) } # server default Thu Dec 20 01:10:08 2018 : Debug: (138) Virtual server sending reply Thu Dec 20 01:10:08 2018 : Debug: (138) NT-Password = 0x696e616d6974414c545a694e3039393021 Thu Dec 20 01:10:08 2018 : Debug: (138) MS-CHAP-Error = "\007E=691 R=1 C=86e3f7442e804d519197bbbf0301334f V=3 M=Authentication rejected" Thu Dec 20 01:10:08 2018 : Debug: (138) EAP-Message = 0x04070004 Thu Dec 20 01:10:08 2018 : Debug: (138) Message-Authenticator = 0x00000000000000000000000000000000 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Got tunneled reply code 3 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: NT-Password = 0x696e616d6974414c545a694e3039393021 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: MS-CHAP-Error = "\007E=691 R=1 C=86e3f7442e804d519197bbbf0301334f V=3 M=Authentication rejected" Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP-Message = 0x04070004 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Got tunneled reply RADIUS code 3 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: NT-Password = 0x696e616d6974414c545a694e3039393021 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: MS-CHAP-Error = "\007E=691 R=1 C=86e3f7442e804d519197bbbf0301334f V=3 M=Authentication rejected" Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP-Message = 0x04070004 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Tunneled authentication was rejected Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: FAILURE Thu Dec 20 01:10:08 2018 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Sending EAP Request (code 1) ID 8 length 59 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: EAP session adding &reply:State = 0x9a0fd4fc9f07cd9b Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]: returned from eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) [eap] = handled Thu Dec 20 01:10:08 2018 : Debug: (138) } # authenticate = handled Thu Dec 20 01:10:08 2018 : Debug: (138) Using Post-Auth-Type Challenge Thu Dec 20 01:10:08 2018 : Debug: (138) Post-Auth-Type sub-section not found. Ignoring. Thu Dec 20 01:10:08 2018 : Debug: (138) session-state: Nothing to cache Could you please explain, what for you mean with "It looks like you've taken the input password, and then tried to use that as the NT hash."? Which way I have to use for my case? And what exactly meaning strings below: Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password := 0x696e616d6974414c545a694e3039393021 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password := 0x3161666532333532663366363365333136376163646230306136646366386235 That isn't my real hashes. Yes, I used the same hash as you provided via smbencrypt. I can provide with you my full configuration file as well is it could help. чт, 20 дек. 2018 г. в 11:40, Alan DeKok <aland@deployingradius.com>:
On Dec 20, 2018, at 2:47 AM, Anton Kiryushkin <swood@fotofor.biz> wrote:
Hello, Matthew.
Yes, I have the same fear about the hash. I made it in the two ways: - hash=$(printf '%s' "${pass}" | iconv -t utf16le | openssl md4
2>/dev/null
| awk '{print $NF}') - smbencrypt
Both ways are equal. Which method is right in my case?
smbencrypt it preferred. I use:
$ smbencrypt hello LM Hash NT Hash -------------------------------- -------------------------------- FDA95FBECA288D44AAD3B435B51404EE 066DDFD4EF0E9CD7C256FE77191EF43C
And the use the NT hash.
There is just no way that an input password ends up being *all* ASCII characters after hashing. It looks like you've taken the input password, and then tried to use that as the NT hash.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Best regards, Anton Kiryushkin ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ End of Freeradius-Users Digest, Vol 164, Issue 43 ************************************************* ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ End of Freeradius-Users Digest, Vol 164, Issue 44 *************************************************