Freeradius 2.1.7 mschap2 depreciated condition
I am trying to build a radius server on a Licencesed RedHat ES 5.5 with the stock Freeradius 2.1.7 rpms. The problem is %{Stripped-User-Name} does not seem to be working properly. If I run radius -X I can see the following [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for OURUSER@scri.ac.uk with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: %{User-Name:-None} -> OURUSER@scri.ac.uk [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} -> --username=OURUSER@scri.ac.uk [mschap] No NT-Domain was found in the User-Name. [mschap] expand: %{mschap:NT-Domain} -> [mschap] expand: --domain=%{%{mschap:NT-Domain}:-OURDOMAIN} -> --domain=OURDOMAIN [mschap] mschap2: 04 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=13b2ecc29de42369 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=f55853d43f231f154755ce89ca3136f13929f36d728dbfd9 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Note : I've changed the username and domain name in the above. Is this fixable with a configuration file ? I have already got a working Centos 5.5 server using freereadius 2.1.8, but I want to move it to RedHat too match all the other infrastructure servers. Also I'm writing a build document for the system so that someone else has a document to follow in the future. Thanks iain Iain Grant Linux System Administrator Scottish Crop Research Institute Invergowrie Dundee DD2 5DA Tel : 01382 562731 x 2605 ______________________________________________________ SCRI, Invergowrie, Dundee, DD2 5DA. The Scottish Crop Research Institute is a charitable company limited by guarantee. Registered in Scotland No: SC 29367. Recognised by the Inland Revenue as a Scottish Charity No: SC 006662. DISCLAIMER: This email is from the Scottish Crop Research Institute, but the views expressed by the sender are not necessarily the views of SCRI and its subsidiaries. This email and any files transmitted with it are confidential to the intended recipient at the e-mail address to which it has been addressed. It may not be disclosed or used by any other than that addressee. If you are not the intended recipient you are requested to preserve this confidentiality and you must not use, disclose, copy, print or rely on this e-mail in any way. Please notify postmaster@scri.ac.uk quoting the name of the sender and delete the email from your system. Although SCRI has taken reasonable precautions to ensure no viruses are present in this email, neither the Institute nor the sender accepts any responsibility for any viruses, and it is your responsibility to scan the email and the attachments (if any). ______________________________________________________
Hi,
The problem is %{Stripped-User-Name} does not seem to be working properly.
here was a chhange to conditional expansions some time back....the output you see is just a warning....if you 'man unlang' you can see how such a condition should be written.....the default config that ships with 2.1.8 should have this fixed....but just check your modules/* files for where this is used... mschapv2 or ntlm_auth from memory alan
Hi,
The problem is %{Stripped-User-Name} does not seem to be working properly.
further to this, the stripped-user-name doesnt exist - which is why its not being used....if this is the case then you are not running required module that understands the realm part or do not have scri.ac.uk as a defined realm in the proxy.conf - check that you are running the required modules (preprocess, suffix and ntdomain are usual friends) check the debug startup output of the old server and of the new server ....ad , if similar architecture (eg both 2.1.x) you can also diff the config files. very handy. alan
participants (2)
-
Alan Buxey -
Iain Grant