help on rlm_mschap: FAILED: MS-CHAP2-Response is incorrect
Hi, All, When I tried to develop PEAP at client side, i found I am always rejected by the server. The following is the log. what might be wrong? my server config? thanks, Jie Tue Dec 13 19:17:04 2005 : Debug: users: Matched supplicant_cts2@spirentcom. com at 53 Tue Dec 13 19:17:04 2005 : Debug: modsingle[authorize]: returned from files (r lm_files) for request 14 Tue Dec 13 19:17:04 2005 : Debug: modcall[authorize]: module "files" returns o k for request 14 Tue Dec 13 19:17:04 2005 : Debug: modcall: group authorize returns updated for r equest 14 Tue Dec 13 19:17:04 2005 : Debug: rad_check_password: Found Auth-Type EAP Tue Dec 13 19:17:04 2005 : Debug: auth: type "EAP" Tue Dec 13 19:17:04 2005 : Debug: Processing the authenticate section of radiu sd.conf Tue Dec 13 19:17:04 2005 : Debug: modcall: entering group authenticate for reque st 14 Tue Dec 13 19:17:04 2005 : Debug: modsingle[authenticate]: calling eap (rlm_ea p) for request 14 Tue Dec 13 19:17:04 2005 : Debug: rlm_eap: Request found, released from the li st Tue Dec 13 19:17:04 2005 : Debug: rlm_eap: EAP/mschapv2 Tue Dec 13 19:17:04 2005 : Debug: rlm_eap: processing type mschapv2 Tue Dec 13 19:17:04 2005 : Debug: Processing the authenticate section of radiu sd.conf Tue Dec 13 19:17:04 2005 : Debug: modcall: entering group Auth-Type for request 14 Tue Dec 13 19:17:04 2005 : Debug: modsingle[authenticate]: calling mschap (rlm _mschap) for request 14 Tue Dec 13 19:17:04 2005 : Debug: rlm_mschap: Told to do MS-CHAPv2 for supplic ant_cts2@spirentcom.com with NT-Password Tue Dec 13 19:17:04 2005 : Debug: rlm_mschap: FAILED: MS-CHAP2-Response is inc orrect Tue Dec 13 19:17:04 2005 : Debug: modsingle[authenticate]: returned from mscha p (rlm_mschap) for request 14 Tue Dec 13 19:17:04 2005 : Debug: modcall[authenticate]: module "mschap" retur ns reject for request 14 Tue Dec 13 19:17:04 2005 : Debug: modcall: group Auth-Type returns reject for re quest 14 Tue Dec 13 19:17:04 2005 : Debug: rlm_eap: Freeing handler
Hi, All, When I tried to develop PEAP at client side, i found I am always rejected by the server. The following is the log. what might be wrong? my server config? thanks, Jie Tue Dec 13 19:17:04 2005 : Debug: users: Matched supplicant_cts2@spirentcom. com at 53 Tue Dec 13 19:17:04 2005 : Debug: modsingle[authorize]: returned from files (r lm_files) for request 14 Tue Dec 13 19:17:04 2005 : Debug: modcall[authorize]: module "files" returns o k for request 14 Tue Dec 13 19:17:04 2005 : Debug: modcall: group authorize returns updated for r equest 14 Tue Dec 13 19:17:04 2005 : Debug: rad_check_password: Found Auth-Type EAP Tue Dec 13 19:17:04 2005 : Debug: auth: type "EAP" Tue Dec 13 19:17:04 2005 : Debug: Processing the authenticate section of radiu sd.conf Tue Dec 13 19:17:04 2005 : Debug: modcall: entering group authenticate for reque st 14 Tue Dec 13 19:17:04 2005 : Debug: modsingle[authenticate]: calling eap (rlm_ea p) for request 14 Tue Dec 13 19:17:04 2005 : Debug: rlm_eap: Request found, released from the li st Tue Dec 13 19:17:04 2005 : Debug: rlm_eap: EAP/mschapv2 Tue Dec 13 19:17:04 2005 : Debug: rlm_eap: processing type mschapv2 Tue Dec 13 19:17:04 2005 : Debug: Processing the authenticate section of radiu sd.conf Tue Dec 13 19:17:04 2005 : Debug: modcall: entering group Auth-Type for request 14 Tue Dec 13 19:17:04 2005 : Debug: modsingle[authenticate]: calling mschap (rlm _mschap) for request 14 Tue Dec 13 19:17:04 2005 : Debug: rlm_mschap: Told to do MS-CHAPv2 for supplic ant_cts2@spirentcom.com with NT-Password Tue Dec 13 19:17:04 2005 : Debug: rlm_mschap: FAILED: MS-CHAP2-Response is inc orrect Tue Dec 13 19:17:04 2005 : Debug: modsingle[authenticate]: returned from mscha p (rlm_mschap) for request 14 Tue Dec 13 19:17:04 2005 : Debug: modcall[authenticate]: module "mschap" retur ns reject for request 14 Tue Dec 13 19:17:04 2005 : Debug: modcall: group Auth-Type returns reject for re quest 14 Tue Dec 13 19:17:04 2005 : Debug: rlm_eap: Freeing handler
Jie Yang wrote:
Hi, All, When I tried to develop PEAP at client side, i found I am always rejected by the server. The following is the log. what might be wrong?
You almost certainly need to strip the "@domain" off the username before mschap sees it - the username is used in calculating the challenge response. See the "realms" module, specifically you'll want the "suffix" instance in authorize, "spirentcom.com" as a LOCAL realm in proxy.conf and proxying turned on.
Hi, I removed "@domain", but still the same error. I also run an AEGIS v.2.0.5 (a very old version though) with same supplicant configuration, which also gave me the same error. It seems to me there might be something wrong at the server side. But I don't know where. my freeradius version is 1.0.1. thanks for your suggestion though. Jie On 12/14/05, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
Jie Yang wrote:
Hi, All, When I tried to develop PEAP at client side, i found I am always rejected by the server. The following is the log. what might be wrong?
You almost certainly need to strip the "@domain" off the username before mschap sees it - the username is used in calculating the challenge response.
See the "realms" module, specifically you'll want the "suffix" instance in authorize, "spirentcom.com" as a LOCAL realm in proxy.conf and proxying turned on. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ok, I solved the problem. The PEAP of freeRadius 1.0.1 on solaris cannot work correctly. after I upgraded the server to 1.0.5, it is working. Jie On 12/14/05, Jie Yang <jyang09@gmail.com> wrote:
Hi, I removed "@domain", but still the same error. I also run an AEGIS v.2.0.5 (a very old version though) with same supplicant configuration, which also gave me the same error. It seems to me there might be something wrong at the server side. But I don't know where. my freeradius version is 1.0.1. thanks for your suggestion though. Jie
On 12/14/05, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
Jie Yang wrote:
Hi, All, When I tried to develop PEAP at client side, i found I am always rejected by the server. The following is the log. what might be wrong?
You almost certainly need to strip the "@domain" off the username before mschap sees it - the username is used in calculating the challenge response.
See the "realms" module, specifically you'll want the "suffix" instance in authorize, "spirentcom.com" as a LOCAL realm in proxy.conf and proxying turned on. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Jie Yang -
Phil Mayers