RE: MSCHAPv2, MySQL, Freeradius
-----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius- users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, 4 October 2005 3:17 PM To: FreeRadius users mailing list Subject: Re: MSCHAPv2, MySQL, Freeradius
"Dan Russell" <dan@in-house.com.au> wrote:
Because you put it into the NT-Password attribute, instead of the User-Password attribute.
Okay, I've tried that and not found it to work for me.
Sorry, it *does* work. Since you didn't provide any debug logs or config examples, I can only suggest that you probably did it wrong.
Hey, I'm not having a go at you, I believe it does work, I'm just having issue getting it working.. Here is the log of someone attempting to log in : rad_recv: Access-Request packet from host x.x.x.x:32775, id=33, length=177 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 422 NAS-Port-Type = Ethernet User-Name = "wolfer" Calling-Station-Id = "00:50:FC:68:E6:32" NAS-Port-Id = "ether2" MS-CHAP-Challenge = 0x700b1e514cb6628c25441cb76ce17109 MS-CHAP2-Response = 0x010051c12db8db344c7c72d03bda36fd556d000000000000000076fb28d715a538d4ae 05b012cd5edb6e86ee71d8f6d6bbc0 NAS-Identifier = "NAS" NAS-IP-Address = x.x.x.x Tue Oct 4 15:10:39 2005 : Debug: Processing the authorize section of radiusd.conf Tue Oct 4 15:10:39 2005 : Debug: modcall: entering group authorize for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall[authorize]: module "preprocess" returns ok for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall[authorize]: module "chap" returns noop for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 5 Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'wolfer' Tue Oct 4 15:10:39 2005 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'wolfer' Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'wolfer' ORDER BY id' Tue Oct 4 15:10:39 2005 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgrou pcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'wolfer' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'wolfer' ORDER BY id' Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrou preply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'wolfer' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' Tue Oct 4 15:10:39 2005 : Info: rlm_sql (sql): No matching entry in the database for request from user [wolfer] Tue Oct 4 15:10:39 2005 : Debug: rlm_sql (sql): Released sql socket id: 4 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall[authorize]: module "sql" returns notfound for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall[authorize]: module "mschap" returns ok for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall: group authorize returns ok for request 5 Tue Oct 4 15:10:39 2005 : Debug: rad_check_password: Found Auth-Type MS-CHAP Tue Oct 4 15:10:39 2005 : Debug: auth: type "MS-CHAP" Tue Oct 4 15:10:39 2005 : Debug: Processing the authenticate section of radiusd.conf Tue Oct 4 15:10:39 2005 : Debug: modcall: entering group Auth-Type for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authenticate]: calling mschap (rlm_mschap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: No User-Password configured. Cannot create LM-Password. Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: No User-Password configured. Cannot create NT-Password. Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: Told to do MS-CHAPv2 for wolfer with NT-Password Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Tue Oct 4 15:10:39 2005 : Debug: modsingle[authenticate]: returned from mschap (rlm_mschap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall[authenticate]: module "mschap" returns reject for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall: group Auth-Type returns reject for request 5 Tue Oct 4 15:10:39 2005 : Debug: auth: Failed to validate the user. Tue Oct 4 15:10:39 2005 : Auth: Login incorrect: [wolfer/<no User-Password attribute>] (from client build port 422 cli 00:50:FC:68:E6:32) Tue Oct 4 15:10:39 2005 : Debug: Delaying request 5 for 1 seconds Tue Oct 4 15:10:39 2005 : Debug: Finished request 5 Tue Oct 4 15:10:39 2005 : Debug: Going to the next request Tue Oct 4 15:10:39 2005 : Debug: --- Walking the entire request list --- Tue Oct 4 15:10:39 2005 : Debug: Waking up in 1 seconds... Tue Oct 4 15:10:40 2005 : Debug: --- Walking the entire request list --- Tue Oct 4 15:10:40 2005 : Debug: Waking up in 1 seconds... rad_recv: Access-Request packet from host x.x.x.x:32775, id=33, length=177 Sending Access-Reject of id 33 to x.x.x.x:32775 Here is a snippet of the radcheck table : ID UserName Attribute op Value 25 wolfer SMB-Account-CTRL == 16 27 wolfer NT-Password == 0x47C8F8E50C470E37AAD3B435B51404EE Any help? Thanks for any help in advance, Daniel Russell
It tries to get the 'User-Password' attribute first (which it fails on, I don't have one), then it tried to get the 'LM-Password' attribute which it also fails on. After dealing with that it tries the same thing with 'NT-Password'. For some reason it isn't pulling these attributes out of mysql..
Read the debug log. It will tell you what it *is* getting from MySQL.
After looking at the debug output from freeradius, the sql statement that it executes when it receives an authentication request should return the LM-Password and NT-Password.
Does it return those attributes when you run the query by hand?
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
"Dan Russell" <dan@in-house.com.au> wrote:
Hey, I'm not having a go at you, I believe it does work, I'm just having issue getting it working..
Yes, but too many people post messages saying "Stuff went wrong... how do I fix it?". Without any context, the only possible answer is "No idea..."
Tue Oct 4 15:10:39 2005 : Info: rlm_sql (sql): No matching entry in the database for request from user [wolfer]
Well, that would appear to be useful.
Here is a snippet of the radcheck table :
ID UserName Attribute op Value 25 wolfer SMB-Account-CTRL == 16 27 wolfer NT-Password == 0x47C8F8E50C470E37AAD3B435B51404EE
See the docs for rlm_sql. '==' is a *comparison* operator. There is no NT-Password in the packet, so of course it never matches. Change both '==' to ':='. Alan DeKok.
participants (2)
-
Alan DeKok -
Dan Russell