MySQL works for radtest, not IRL - Users file always works
I'm in a bit of an odd situation here, I have a freeradius 2.1.8 server (installed from the ubuntu 10.04 repo) that I'm using in conjunction with a DD-WRT v24-SP2 (on wrt54g v5) NAS. I've generated certs for two users RadiusUser and RadiusSQL and installed both on a windows 7 ultimate box along with the CA. RadiusUser is in the Users file with a bare-bones configuration: RadiusUser Cleartext-Password: "RadiusUser" RadiusSQL is in a MySQL database with a similiar configuration: SELECT * FROM radcheck; +----+-----------+--------------------+----+-----------+ | id | username | attribute | op | value | +----+-----------+--------------------+----+-----------+ | 1 | RadiusSQL | Cleartext-Password | := | RadiusSQL | +----+-----------+--------------------+----+-----------+ radtest for both users works on server, but from the windows 7 client only RadiusUser can log in. After looking at RadiusSQL's debug, it seems the sql module isn't ever consulted... Debugs for both users can be posted on request.
Huckle Berry wrote:
radtest for both users works on server, but from the windows 7 client only RadiusUser can log in. After looking at RadiusSQL's debug, it seems the sql module isn't ever consulted... Debugs for both users can be posted on request.
What you didn't say is that the Windows system is using PEAP. This means that you need to configure "sql" in the file raddb/sites-available/inner-tunnel. You've configured SQL in raddb/sites-available/default, which allows it to work for simple PAP / MS-CHAP requests. But PEAP puts the password inside of the "inner-tunnel", which hasn't been configured. Alan DeKok.
On Sun, Aug 15, 2010 at 3:43 AM, Alan DeKok <aland@deployingradius.com>wrote:
Huckle Berry wrote:
radtest for both users works on server, but from the windows 7 client only RadiusUser can log in. After looking at RadiusSQL's debug, it seems the sql module isn't ever consulted... Debugs for both users can be posted on request.
What you didn't say is that the Windows system is using PEAP. This means that you need to configure "sql" in the file raddb/sites-available/inner-tunnel.
You've configured SQL in raddb/sites-available/default, which allows it to work for simple PAP / MS-CHAP requests. But PEAP puts the password inside of the "inner-tunnel", which hasn't been configured.
Is there a good reference for the various protocols, i.e. a diagram, or flowchart, that could help me understand the process and therefore better troubleshoot my situation? I'm more of a visual learner so illustrations would be awesome.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Huckle Berry wrote:
Is there a good reference for the various protocols, i.e. a diagram, or flowchart, that could help me understand the process and therefore better troubleshoot my situation? I'm more of a visual learner so illustrations would be awesome.
There are no pictures. The processing is documented in... various places on the Wiki && in the "doc/" directory. Alan DeKok.
participants (2)
-
Alan DeKok -
Huckle Berry