Authentication Problem with EAP-PEAP
Hi, I've got a new problem when I try to authenticate a Windows Vista client with Freeradius. Vista sends to the radius a User-Name like DOMAIN\USER. When I use nt_domain_hack or the realm ntdomain, the domain disappear from the User-Name attribute. The authentication goes on, the login/password match in LDAP database but EAP fails. Here's a trace : rlm_ldap: user nsouleman authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 3 modcall: leaving group authenticate (returns invalid) for request 3 auth: Failed to validate the user. As you can see, ldap module returns OK but I have this message just after : rlm_eap: Identity does not match User-Name, setting from EAP Identity. Does anybody help me ? Thanks. Nicolas SOULEMAN.
debug afone wrote:
Hi,
I've got a new problem when I try to authenticate a Windows Vista client with Freeradius. Vista sends to the radius a User-Name like DOMAIN\USER. When I use nt_domain_hack or the realm ntdomain, the domain disappear from the User-Name attribute.
The authentication goes on, the login/password match in LDAP database but EAP fails. Here's a trace :
rlm_ldap: user nsouleman authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 3 modcall: leaving group authenticate (returns invalid) for request 3 auth: Failed to validate the user.
As you can see, ldap module returns OK but I have this message just after : rlm_eap: Identity does not match User-Name, setting from EAP Identity.
Does anybody help me ?
Thanks.
Nicolas SOULEMAN.
rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler User-Name attribute in Access-Accept packet must match EAP-Identity encoded in EAP Packets, but can be different from identity used in the EAP method. -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
Hi all, After searching around the docs, I cannot find a way to control the debug log level (to radius.log), and since I am having problems where the server seems to "freeze" every now and then, I really need to find a cause. All I could see in the last batch of logs is: Wed Jan 23 09:15:51 2008 : Info: rlm_sql (sql): No matching entry in the database for request from user [mother] Wed Jan 23 11:34:00 2008 : Error: Discarding duplicate request from client Whisher-Test:2207 - ID: 0 due to unfinished request 391 <About a dozen more of these> Wed Jan 23 11:34:30 2008 : Error: WARNING: Unresponsive child (id 136186368) for request 391 (in component authorize module rlm_sql) Wed Jan 23 11:34:32 2008 : Error: Discarding duplicate request from client Whisher-Test:2207 - ID: 0 due to unfinished request 391 <About another dozen of these> It seems the server stopped responding at 09:15 or just after, and I restarted it at 11:34 after a user complained he could not login on the hotspot's landing page. Any insight will be greatly appreciated, regards, Mike PS Before you start screaming "Upgrade to 2.0.0!!", I cannot (yet) as this is on a FreeBSD box using ports and Oracle.
http://www.digipedia.pl/man/radiusd.8.html Ivan Kalik Kalik Informatika ISP Dana 23/1/2008, "Mother" <mother@netstumbler.com> piše:
Hi all,
After searching around the docs, I cannot find a way to control the debug log level (to radius.log), and since I am having problems where the server seems to "freeze" every now and then, I really need to find a cause. All I could see in the last batch of logs is:
Wed Jan 23 09:15:51 2008 : Info: rlm_sql (sql): No matching entry in the database for request from user [mother] Wed Jan 23 11:34:00 2008 : Error: Discarding duplicate request from client Whisher-Test:2207 - ID: 0 due to unfinished request 391 <About a dozen more of these> Wed Jan 23 11:34:30 2008 : Error: WARNING: Unresponsive child (id 136186368) for request 391 (in component authorize module rlm_sql) Wed Jan 23 11:34:32 2008 : Error: Discarding duplicate request from client Whisher-Test:2207 - ID: 0 due to unfinished request 391 <About another dozen of these>
It seems the server stopped responding at 09:15 or just after, and I restarted it at 11:34 after a user complained he could not login on the hotspot's landing page.
Any insight will be greatly appreciated, regards,
Mike
PS Before you start screaming "Upgrade to 2.0.0!!", I cannot (yet) as this is on a FreeBSD box using ports and Oracle. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ivan, tnt@kalik.co.yu wrote:
Yes, deja-vu :) One question, -x (not -X), provides debug output to radius.log??? I tried this before, but did not seem to get anything other than what is already normally ouput. Best regards, Mike
Mother wrote:
Ivan,
tnt@kalik.co.yu wrote:
Yes, deja-vu :) One question, -x (not -X), provides debug output to radius.log??? I tried this before, but did not seem to get anything other than what is already normally ouput.
Best regards,
Mike - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html radiusd -xxxxx
The more x's the more verbose And no -X stops the server from forking, and writes output to /dev/stdout -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
Hi all, Since I hate when people write "No problem, I fixed it" and then disappear into the ether without giving details that could be useful to others, here is what I did: 1. Install screen (not by default installed in FreeBSD). 2. Run a new screen, name it something convenient (# screen -S radiusd) 3. Hit Ctrl+A-H, this will log all console output to file. 4. Start radiusd with -X or -xxxxx 5. Detach from the screen with Ctrl+A-d FreeRADIUS is now running in this screen, and everything is being stored to log file. At any time, you can reattach to the screen (both from local and over SSH) to see what is going on in real time. Cheers, Mike
On Mon 28 Jan 2008, Mother wrote:
1. Install screen (not by default installed in FreeBSD). 2. Run a new screen, name it something convenient (# screen -S radiusd) 3. Hit Ctrl+A-H, this will log all console output to file. 4. Start radiusd with -X or -xxxxx 5. Detach from the screen with Ctrl+A-d
FreeRADIUS is now running in this screen, and everything is being stored to log file. At any time, you can reattach to the screen (both from local and over SSH) to see what is going on in real time.
Thanks. Nice instructions. I have added them to the wiki (slightly modified) Cheers -- Peter Nixon http://peternixon.net/
Peter Nixon wrote:
On Mon 28 Jan 2008, Mother wrote:
1. Install screen (not by default installed in FreeBSD). 2. Run a new screen, name it something convenient (# screen -S radiusd) 3. Hit Ctrl+A-H, this will log all console output to file. 4. Start radiusd with -X or -xxxxx 5. Detach from the screen with Ctrl+A-d
FreeRADIUS is now running in this screen, and everything is being stored to log file. At any time, you can reattach to the screen (both from local and over SSH) to see what is going on in real time.
Thanks. Nice instructions. I have added them to the wiki (slightly modified)
Cheers
Thanks Peter, it's nice to see the contribution was meaningful :) Cheers, Mike
participants (6)
-
Arran Cudbard-Bell -
debug afone -
Mike Puchol -
Mother -
Peter Nixon -
tnt＠kalik.co.yu