Re: No User-Password or CHAP-Password attribute in the request
hello all,
My version of freeradius is Version 2.1.0
here is my result in debug mode:
rad_recv: Access-Request packet from host 192.168.20.253 port 1645, id=112, length=131 User-Name = "linatest" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-1A-A1-64-BB-1A" Calling-Station-Id = "00-18-8B-B5-26-B7" EAP-Message = 0x0202000d016c696e6174657374 Message-Authenticator = 0x3fe6e297218c3aa1e98286a5a3db3303 NAS-Port = 50024 NAS-Port-Type = Ethernet NAS-IP-Address = 192.168.20.253 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [files] users: Matched entry linatest at line 11 ++[files] returns ok WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No User-Password or CHAP-Password attribute in the request. Cannot perform authentication. Failed to authenticate the user. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 112 to 192.168.20.253 port 1645 Service-Type = Framed-User Waking up in 4.9 seconds. Cleaning up request 0 ID 112 with timestamp +20
i don't have 'Auth-Type = Local' but it still remaining me this And : No User-Password or CHAP-Password attribute in the request. Cannot perform authentication. Failed to authenticate the user.
where to put this CHAP-Password attribute in the request??
here is my users file
linatest Cleartext-Password := "mypass" Service-Type = Framed-User
thanks for your help
Hi,
My version of freeradius is Version 2.1.0
upgrade to 2.1.8
[files] users: Matched entry linatest at line 11 ++[files] returns ok WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead.
FreeRADIUS doesnt lie
i don't have 'Auth-Type = Local' but it still remaining me this And : No User-Password or CHAP-Password attribute in the request. Cannot perform authentication. Failed to authenticate the user.
oh but you do - or did you just not restart the server? are you sure you are editing the right 'users' file - so many many times people have installed multiple copies and then found that whilst they are editing eg /etc/raddb/users, the daemon is reading /usr/local/etc/raddb/users etc if you check the full output of 'radiusd -X' you will see which files it is reading alan
hi alan, thanks for your help. i use ubuntu as radius server all configuration file is under /etc/freeradius/* as client i use winxp wired without certificate. just EAP-MSCHAP v2 as authentication method. in my users file i put one user like this: ############################## linatest Auth-Type = CHAP , Cleartext-Password := "linagora" Service-Type = Framed-User ############################ in my radiusd.conf: ############## modules { files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } chap { authtype = CHAP } ... } authorize { preprocess chap files } authenticate { Auth-Type CHAP{ chap } } ############## in result of freeradius -X , I got: rad_recv: Access-Request packet from host 192.168.20.253 port 1645, id=118, length=131 User-Name = "linatest" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-1A-A1-64-BB-1A" Calling-Station-Id = "00-18-8B-B5-26-B7" EAP-Message = 0x0202000d016c696e6174657374 Message-Authenticator = 0x4e31158d9f8be4943a213e992598bdf6 NAS-Port = 50024 NAS-Port-Type = Ethernet NAS-IP-Address = 192.168.20.253 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [files] users: Matched entry linatest at line 89 ++[files] returns ok Found Auth-Type = CHAP +- entering group CHAP {...} [chap] rlm_chap: Attribute "CHAP-Password" is required for authentication. ++[chap] returns invalid Failed to authenticate the user. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 118 to 192.168.20.253 port 1645 Service-Type = Framed-User Waking up in 4.9 seconds. Cleaning up request 0 ID 118 with timestamp +20 Ready to process requests. So my asking help is: how can i authenticate my client? which "CHAP-Password" ? thanks for your help
omega bk wrote:
hi alan, thanks for your help.
i use ubuntu as radius server all configuration file is under /etc/freeradius/*
as client i use winxp wired without certificate. just EAP-MSCHAP v2 as authentication method.
in my users file i put one user like this: ############################## linatest Auth-Type = CHAP , Cleartext-Password := "linagora"
Delete the "Auth-Type = CHAP" line. It's not necessary.
in my radiusd.conf:
You've butchered the configuration files. It's not necessary. USE THE DEFAULT CONFIGURATION. IT WORKS. Really. Your edits have *BROKEN THE SERVER*. Alan DeKok.
Hi,
i use ubuntu as radius server all configuration file is under /etc/freeradius/*
as client i use winxp wired without certificate. just EAP-MSCHAP v2 as authentication method.
in my users file i put one user like this: ############################## linatest Auth-Type = CHAP , Cleartext-Password := "linagora" Service-Type = Framed-User ############################
okay - now you messing things up. for a start this is not what you said int he last email secondly, wired authentication on a WinXP will either be EAP-TLS, PEAP (w MSCHAPv2) or EAP-MD5 either way, setting "Auth-Type = CHAP" is just totally wrong (wrong wrong wrong). dont do it. just have linatest Cleartext-Password := "linagora" in your dumb/basic testing users file and then do the WinXP connection....you should see all sorts of things about EAP then flying past the screen...that'll be okay - and it'll work if you have configured the client to ignore certificate and dont check certificate etc...you'll have also configured the client to NOT use the windows login for authentication or login is guest because those settings will also mess things up. what you are currently trying to do will work 100% with latest version of FreeRADIUS with ONLY the users file being played with. of course...the other thing is you're using Ubuntu - did you build this yourself WITH SSL support enabled or did you just get it via apt-get/synaptic? 'cos its very likely you wont have SSL support (and hence no EAP!) if you havent sorted that bit out too. alan
yeah i really messed things up. i got my radius from apt-get i downloaded from source the latest version. i removed the odl one with apt-get remove freeradius i did a dpkg-bildpackage -b -uc but messd in: /home/omega/freeradius-server-2.1.8/src/main/modules.c:1358: undefined reference to `lt_preloaded_symbols' so i din't know how to put that new version. thanks for your help 2010/3/3 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>
Hi,
i use ubuntu as radius server all configuration file is under /etc/freeradius/*
as client i use winxp wired without certificate. just EAP-MSCHAP v2 as authentication method.
in my users file i put one user like this: ############################## linatest Auth-Type = CHAP , Cleartext-Password := "linagora" Service-Type = Framed-User ############################
okay - now you messing things up. for a start this is not what you said int he last email
secondly, wired authentication on a WinXP will either be EAP-TLS, PEAP (w MSCHAPv2) or EAP-MD5
either way, setting "Auth-Type = CHAP" is just totally wrong (wrong wrong wrong). dont do it.
just have
linatest Cleartext-Password := "linagora"
in your dumb/basic testing users file and then do the WinXP connection....you should see all sorts of things about EAP then flying past the screen...that'll be okay - and it'll work if you have configured the client to ignore certificate and dont check certificate etc...you'll have also configured the client to NOT use the windows login for authentication or login is guest because those settings will also mess things up.
what you are currently trying to do will work 100% with latest version of FreeRADIUS with ONLY the users file being played with.
of course...the other thing is you're using Ubuntu - did you build this yourself WITH SSL support enabled or did you just get it via apt-get/synaptic? 'cos its very likely you wont have SSL support (and hence no EAP!) if you havent sorted that bit out too.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
oh great i compiled the latest => and tryed new configuration great , it works with my client wired!!!! Thank u so much 2010/3/3 omega bk <omegabk@gmail.com>
yeah i really messed things up.
i got my radius from apt-get
i downloaded from source the latest version. i removed the odl one with apt-get remove freeradius i did a dpkg-bildpackage -b -uc but messd in: /home/omega/freeradius-server-2.1.8/src/main/modules.c:1358: undefined reference to `lt_preloaded_symbols'
so i din't know how to put that new version.
thanks for your help
2010/3/3 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>
Hi,
i use ubuntu as radius server all configuration file is under /etc/freeradius/*
as client i use winxp wired without certificate. just EAP-MSCHAP v2 as authentication method.
in my users file i put one user like this: ############################## linatest Auth-Type = CHAP , Cleartext-Password := "linagora" Service-Type = Framed-User ############################
okay - now you messing things up. for a start this is not what you said int he last email
secondly, wired authentication on a WinXP will either be EAP-TLS, PEAP (w MSCHAPv2) or EAP-MD5
either way, setting "Auth-Type = CHAP" is just totally wrong (wrong wrong wrong). dont do it.
just have
linatest Cleartext-Password := "linagora"
in your dumb/basic testing users file and then do the WinXP connection....you should see all sorts of things about EAP then flying past the screen...that'll be okay - and it'll work if you have configured the client to ignore certificate and dont check certificate etc...you'll have also configured the client to NOT use the windows login for authentication or login is guest because those settings will also mess things up.
what you are currently trying to do will work 100% with latest version of FreeRADIUS with ONLY the users file being played with.
of course...the other thing is you're using Ubuntu - did you build this yourself WITH SSL support enabled or did you just get it via apt-get/synaptic? 'cos its very likely you wont have SSL support (and hence no EAP!) if you havent sorted that bit out too.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan Buxey -
Alan DeKok -
omega bk