I have a fresh install of Freeradius 1.1.7build4 on my Ubuntu 8.04 system. I used this link to do the bob test: http://deployingradius.com/documents/configuration/pap.html which was successful. Then I created myself (kwallace) as a user and tested with radtest, again with success. Then I went to my Windows 2000 notebook with a wifi link through a WRT54GL and OpenWRT as a bridge, using the notebook's VPN connection feature and the same username and password and got "Error 691:Access was denied because the username and/or password was invalid on the domain." Below should be the relevant files. http://www.bumpernipple.com/freeradius-X http://www.bumpernipple.com/clients.conf http://www.bumpernipple.com/users Any hints on how correct this or better present my problem would be appreciated. Kirk
Solved (so far). I found the PoPToP cookbook link: http://wiki.freeradius.org/PopTop in http://wiki.freeradius.org/Example_Setups from the main page. The dictionary file edit: INCLUDE /etc/radiusclient/dictionary.merit INCLUDE /etc/radiusclient/dictionary.microsoft seems to have made the difference. This bit is missing from my usual instructions: http://poptop.sourceforge.net/dox/radius_mysql.html Now on to the next thing. Thanks for the replies and thanks to the developers ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ On Fri, 2008-09-05 at 17:59 -0700, Kirk Wallace wrote:
I have a fresh install of Freeradius 1.1.7build4 on my Ubuntu 8.04 system. I used this link to do the bob test:
http://deployingradius.com/documents/configuration/pap.html
which was successful.
Then I created myself (kwallace) as a user and tested with radtest, again with success. Then I went to my Windows 2000 notebook with a wifi link through a WRT54GL and OpenWRT as a bridge, using the notebook's VPN connection feature and the same username and password and got "Error 691:Access was denied because the username and/or password was invalid on the domain." Below should be the relevant files.
http://www.bumpernipple.com/freeradius-X http://www.bumpernipple.com/clients.conf http://www.bumpernipple.com/users
Any hints on how correct this or better present my problem would be appreciated.
Kirk
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Kirk Wallace wrote:
Solved (so far). I found the PoPToP cookbook link: ... The dictionary file edit: INCLUDE /etc/radiusclient/dictionary.merit INCLUDE /etc/radiusclient/dictionary.microsoft seems to have made the difference. This bit is missing from my usual instructions:
It's arguably a fairly serious bug on the part of the client software. RADIUS clients do NOT need dictionaries. Their functionality is hard-coded in. e.g. If the client does MS-CHAP, then they know the name, number, and properties of the MS-CHAP attributes. Those properties shouldn't change. Ever. So having the client *require* a dictionary to define those properties is useless. RADIUS servers need dictionaries because new clients define all sorts of new attributes, that the server needs to understand without code changes. This is described in more detail in an upcoming RADIUS RFC which has my name on it. Alan DeKok.
Kirk Wallace wrote:
I have a fresh install of Freeradius 1.1.7build4 on my Ubuntu 8.04 system. I used this link to do the bob test: .. which was successful.
Then I created myself (kwallace) as a user and tested with radtest, again with success. Then I went to my Windows 2000 notebook with a wifi link through a WRT54GL and OpenWRT as a bridge, using the notebook's VPN connection feature and the same username and password and got "Error 691:Access was denied because the username and/or password was invalid on the domain." Below should be the relevant files.
Ok...
And looking at that, you're not doing WiFi. You're doing PPP. And the PPP server isn't sending *any* password in the request. No PAP, CHAP, MS-CHAP, or EAP. Fix the PPP/VPN server so that it sends a password. Only then can FreeRADIUS authenticate the user. Alan DeKok.
participants (2)
-
Alan DeKok -
Kirk Wallace