I’ve got, well think I have, radius to accept all logins no matter what password they send.

However some users still cannot login, its around 10 users out of 200.

I’ll show details for one user that can login ok and one user that can’t.

I’m guessing it’s something the end user is doing because they all come in via the same NAS and have exactly the same radius entry.

If I can get around this by just accepting anything that would be ideal, since our realm is the only radius logins that are sent to us.

Here is a user that can’t login:

##

Thu Mar  2 09:59:03 2006 : Auth: Login incorrect (rlm_chap: Clear text password not available): [user22@dsl.realm.com/<CHAP-Password>] (from client l2tp port 510)

##

Here is someone that did authenticate ok:

##

Thu Mar  2 09:55:26 2006 : Auth: Login OK: [user3@dsl.realm.com/<CHAP-Password>] (from client l2tp port 492)

##

My users file has:

##

DEFAULT Auth-Type = Accept

##

And the entries for both users above are identical apart from the username and IP assignment:

##

user3@dsl.realm.com      Auth-Type := Accept

        Service-Type = Framed-User,

        Framed-Protocol = PPP,

        Framed-Address = 192.168.0.1,

        Framed-Netmask = 255.255.255.255,

        Framed-Compression = Van-Jacobsen-TCP-IP,

user22@dsl.realm.com      Auth-Type := Accept

        Service-Type = Framed-User,

        Framed-Protocol = PPP,

        Framed-Address = 192.168.0.2,

        Framed-Netmask = 255.255.255.255,

        Framed-Compression = Van-Jacobsen-TCP-IP,

##

Here is some radius debug first for the user that can’t login:

##

rad_recv: Access-Request packet from host 10.0.0.2:1645, id=46, length=98

        Framed-Protocol = PPP

        User-Name = " user22@dsl.realm.com"

        CHAP-Password = 0x01295999be562b2eab944deb9647c5a664

        NAS-Port-Type = Virtual

        NAS-Port = 563

        Service-Type = Framed-User

        NAS-IP-Address = 10.0.0.2

  Processing the authorize section of radiusd.conf

modcall: entering group authorize for request 1

  modcall[authorize]: module "preprocess" returns ok for request 1

  rlm_chap: Setting 'Auth-Type := CHAP'

  modcall[authorize]: module "chap" returns ok for request 1

  modcall[authorize]: module "mschap" returns noop for request 1

    rlm_realm: Looking up realm "dsl.realm.com" for User-Name = " user22@dsl.realm.com"

    rlm_realm: No such realm "dsl.realm.com"

  modcall[authorize]: module "suffix" returns noop for request 1

  rlm_eap: No EAP-Message, not doing EAP

  modcall[authorize]: module "eap" returns noop for request 1

    users: Matched DEFAULT at 152

  modcall[authorize]: module "files" returns ok for request 1

modcall: group authorize returns ok for request 1

  rad_check_password:  Found Auth-Type CHAP

auth: type "CHAP"

  Processing the authenticate section of radiusd.conf

modcall: entering group Auth-Type for request 1

  rlm_chap: login attempt by " user22@dsl.realm.com" with CHAP password

  rlm_chap: Could not find clear text password for user  user22@dsl.realm.com

  modcall[authenticate]: module "chap" returns invalid for request 1

modcall: group Auth-Type returns invalid for request 1

auth: Failed to validate the user.

Login incorrect (rlm_chap: Clear text password not available): [ user22@dsl.realm.com/<CHAP-Password>] (from client l2tp port 563)

##

And a user that can login:

##

rad_recv: Access-Request packet from host 10.0.0.2:1645, id=200, length=97

        Framed-Protocol = PPP

        User-Name = "user3@dsl.realm.com"

        CHAP-Password = 0x012d51dff5b1bda7f6a370e79ff84e0dcf

        NAS-Port-Type = Virtual

        NAS-Port = 717

        Service-Type = Framed-User

        NAS-IP-Address = 10.0.0.2

  Processing the authorize section of radiusd.conf

modcall: entering group authorize for request 2

  modcall[authorize]: module "preprocess" returns ok for request 2

  rlm_chap: Setting 'Auth-Type := CHAP'

  modcall[authorize]: module "chap" returns ok for request 2

  modcall[authorize]: module "mschap" returns noop for request 2

    rlm_realm: Looking up realm "dsl.realm.com" for User-Name = "user3@dsl.realm.com"

    rlm_realm: No such realm "dsl.realm.com"

  modcall[authorize]: module "suffix" returns noop for request 2

  rlm_eap: No EAP-Message, not doing EAP

  modcall[authorize]: module "eap" returns noop for request 2

    users: Matched DEFAULT at 152

    users: Matched user3@dsl.realm.com at 243

  modcall[authorize]: module "files" returns ok for request 2

modcall: group authorize returns ok for request 2

  rad_check_password:  Found Auth-Type Accept

  rad_check_password: Auth-Type = Accept, accepting the user

Login OK: [user3@dsl.realm.com/<CHAP-Password>] (from client l2tp port 717)

Sending Access-Accept of id 200 to 10.0.0.2:1645

        Service-Type = Framed-User

        Framed-Protocol = PPP

        Framed-IP-Address = 192.168.0.2

        Framed-IP-Netmask = 255.255.255.255

        Framed-Compression = Van-Jacobson-TCP-IP

Finished request 2

##

I can see that it seems user33 is sending a blank white space before his username, but I don’t see that this would make a difference since I’m accepting everything anyway. And from the command line I can use “radtest” and send blank spaces and it works fine. Although I do see that the user would not get assigned his IP address. But first I’d like to ensure everyone can authenticate.

Any idea?

Thanks in advance

Tony