MySQL and PEAP not talking

30 Mar 2009

      Hi.
I'm quite a newbie, so please keep it simple.
I have been fighting with this for the past 10 hours!

I am trying to do PEAP authentication (without certificates) where a
client (Windows XP/Vista) gains WPA wi-fi access with a username and
password using FreeRADIUS (v2.1.4) as the RADIUS server on Ubuntu
Linux 8.10.

I have gotten as far as compiling FreeRADIUS with SSL/TLS support and
getting a Windows client to gain WPA access where his username/pass is
in the "/etc/freeradius/users" file. I'm not interested in doing any
LDAP or Active Directory stuff (don't want to use ntlm_auth), so
obviously "MS-CHAP-Use-NTLM-Auth := No" was included with the
user/pass in the "/etc/freeradius/users" file. And as I said, the
client could gain Wi-fi WPA access using PEAP authentication.

However, I would like to manage usernames and passwords in a MySQL database.
The relevant part of the MySQL schema that I have been trying is as follows:
radcheck (id,username,attribute,op,value)
radreply (id,username,attribute,op,value)

I have configured FreeRADIUS to talk to MySQL using various tutorials
on the internet and have confirmed this works with the "radtest" shell
command (I get an accept-accept back for any users in the "radcheck"
table.

So to try do it with PEAP authentication I inserted the following in the tables.
INSERT INTO radcheck (username,attribute,op,value) VALUES
('user1','Cleartext-Password',':=','pass1')
INSERT INTO radreply (username,attribute,op,value) VALUES
('user1','MS-CHAP-Use-NTLM-Auth',':=','No')

Note how I have included  "MS-CHAP-Use-NTLM-Auth := No" as a reply
attribute. But, no matter what I do, this does not allow a client to
authenticate.

freeradius debug (with -X switch) gives me the following (I've only
included the parts which I think are relevant:

..................
[sql] 	expand: SELECT id, username, attribute, value, op
FROM radcheck           WHERE username = '%{SQL-User-Name}'
ORDER BY id -> SELECT id, username, attribute, value, op
FROM radcheck           WHERE username = 'user1'           ORDER BY id
[sql] User found in radcheck table
[sql] 	expand: SELECT id, username, attribute, value, op
FROM radreply           WHERE username = '%{SQL-User-Name}'
ORDER BY id -> SELECT id, username, attribute, value, op
FROM radreply           WHERE username = 'user1'           ORDER BY id
[sql] 	expand: SELECT groupname           FROM radusergroup
WHERE username = '%{SQL-User-Name}'           ORDER BY priority ->
SELECT groupname           FROM radusergroup           WHERE username
= 'user8'           ORDER BY priority
rlm_sql (sql): Released sql socket id: 3
++[sql] returns ok
..................
	EAP-Message = 0x0108001f1a0108001a1025124f5e6a8bc7778687e657b729c16b7573657238
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x31f7332531ff293ae0350b28678bf4db
[peap] Got tunneled reply RADIUS code 11
	EAP-Message = 0x0108001f1a0108001a1025124f5e6a8bc7778687e657b729c16b7573657238
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x31f7332531ff293ae0350b28678bf4db
[peap] Got tunneled Access-Challenge
++[eap] returns handled
...................
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] +- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured.  Cannot create LM-Password.
[mschap] No Cleartext-Password configured.  Cannot create NT-Password.
[mschap] Told to do MS-CHAPv2 for user1 with NT-Password
[mschap] FAILED: No NT/LM-Password.  Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
[eap] Freeing handler
++[eap] returns reject
Failed to authenticate the user.
..................

The parts that gives away the fact that the "MS-CHAP-Use-NTLM-Auth :=
No" is not being read from the database:
1) no users are found in the "SELECT FROM radreply" query
2) underneath "[peap] Got tunneled reply code 11" there is no
"MS-CHAP-Use-NTLM-Auth := No" as there is when a user is authenticated
from the "users" file.
3) The fact that I cannot get the client to gain access!

I really don't know what to do from this point. I haven't included any
of my freeradius configuration files because I really don't know which
ones to include. So if you want to see them just let me know which
ones you want.

Thanks in advance
Doron

Doe Hoe

tnt＠kalik.net

Doe Hoe

Alan DeKok

Doe Hoe

Alan DeKok

Doe Hoe

tags

participants (3)