PEAP mschapv2 E= 691 R=0 code is correct?
On Sep 25, 2020, at 9:22 AM, 엔트로링크(주) <dhpark21@naver.com> wrote:
atteched full log. Thanks <rtest.txt>-
Part of the reason it's so big is you're (again) not following instructions. DON'T use "radius -Xx" or "radiusd -Xx" or "radiusd -XXXxxxxxxxxx". Follow the documentation. Use "radiusd -X". Honestly... it really does help to read the documentation and follow the instructions. Most of the issues you're running into would have been avoided. And reading the debug output show: (6) mschap: Found Cleartext-Password, hashing to create NT-Password (6) mschap: Creating challenge hash with username: user01 (6) mschap: Client is using MS-CHAPv2 ERROR: (6) mschap: MS-CHAP2-Response is incorrect So... the password is wrong. You've told FreeRADIUS one password, and the user is entering a different one. Make sure that the user is entering the correct password. And no, don't argue that "the password is correct". It's not. Alan DeKok.
Thank reply. At test case,...(cached password was wrong) as below document, it will prompt the user for a new password. but, Windows 10 are not prompt.(FR), Cisco ISE are prompt ok my question is it(new password prompt). Check it. Thanks. -- mschapv2 { # Prior to version 2.1.11, the module never # sent the MS-CHAP-Error message to the # client. This worked, but it had issues # when the cached password was wrong. The # server *should* send "E=691 R=0" to the # client, which tells it to prompt the user # for a new password. # # The default is to behave as in 2.1.10 and # earlier, which is known to work. If you # set "send_error = yes", then the error # message will be sent back to the client. # This *may* help some clients work better, # but *may* also cause other clients to stop # working. # -- -----Original Message----- From: "Alan DeKok"<aland@deployingradius.com> To: "FreeRadius users mailing list"<freeradius-users@lists.freeradius.org>; Cc: Sent: 2020-09-25 (금) 22:29:42 (GMT+09:00) Subject: Re: PEAP mschapv2 E= 691 R=0 code is correct?
On Sep 25, 2020, at 9:22 AM,
atteched full log. Thanks <rtest.txt>-
Part of the reason it's so big is you're (again) not following instructions. DON'T use "radius -Xx" or "radiusd -Xx" or "radiusd -XXXxxxxxxxxx". Follow the documentation. Use "radiusd -X". Honestly... it really does help to read the documentation and follow the instructions. Most of the issues you're running into would have been avoided. And reading the debug output show: (6) mschap: Found Cleartext-Password, hashing to create NT-Password (6) mschap: Creating challenge hash with username: user01 (6) mschap: Client is using MS-CHAPv2 ERROR: (6) mschap: MS-CHAP2-Response is incorrect So... the password is wrong. You've told FreeRADIUS one password, and the user is entering a different one. Make sure that the user is entering the correct password. And no, don't argue that "the password is correct". It's not. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks. my test, put below then work fine. send_error = yes Thanks. -----Original Message----- To: "FreeRadius users mailing list"<freeradius-users@lists.freeradius.org>; Cc: Sent: 2020-09-25 (금) 23:05:58 (GMT+09:00) Subject: Re: PEAP mschapv2 E= 691 R=0 code is correct? Thank reply. At test case,...(cached password was wrong) as below document, it will prompt the user for a new password. but, Windows 10 are not prompt.(FR), Cisco ISE are prompt ok my question is it(new password prompt). Check it. Thanks. -- mschapv2 { # Prior to version 2.1.11, the module never # sent the MS-CHAP-Error message to the # client. This worked, but it had issues # when the cached password was wrong. The # server *should* send "E=691 R=0" to the # client, which tells it to prompt the user # for a new password. # # The default is to behave as in 2.1.10 and # earlier, which is known to work. If you # set "send_error = yes", then the error # message will be sent back to the client. # This *may* help some clients work better, # but *may* also cause other clients to stop # working. # -- -----Original Message----- From: "Alan DeKok"<aland@deployingradius.com> To: "FreeRadius users mailing list"<freeradius-users@lists.freeradius.org>; Cc: Sent: 2020-09-25 (금) 22:29:42 (GMT+09:00) Subject: Re: PEAP mschapv2 E= 691 R=0 code is correct?
On Sep 25, 2020, at 9:22 AM,
atteched full log. Thanks <rtest.txt>-
Part of the reason it's so big is you're (again) not following instructions. DON'T use "radius -Xx" or "radiusd -Xx" or "radiusd -XXXxxxxxxxxx". Follow the documentation. Use "radiusd -X". Honestly... it really does help to read the documentation and follow the instructions. Most of the issues you're running into would have been avoided. And reading the debug output show: (6) mschap: Found Cleartext-Password, hashing to create NT-Password (6) mschap: Creating challenge hash with username: user01 (6) mschap: Client is using MS-CHAPv2 ERROR: (6) mschap: MS-CHAP2-Response is incorrect So... the password is wrong. You've told FreeRADIUS one password, and the user is entering a different one. Make sure that the user is entering the correct password. And no, don't argue that "the password is correct". It's not. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
엔트로링크(주)