I am just a new with freeradius. so please consider. This is what I am trying to do today. 1. installed pptpd server on centos 6 box, tested with chap-secert password and worked. 2. installed freeradius server to handle stuff like ip pool and authenticaton, and integrate with my existing openldap server for authentication. 3. I looked at the /etc/raddb/radiusd.conf but I do not see the the LDAP section 4. how can I integrate the my freeradius server to hook up with ldap server ? I followed this doc but got stucked. I am nearly there I think wiki.freeradius.org/PopTop any help, guide or tips would be great help. here are my versino of freeradius Installed Packages Name : freeradius Arch : x86_64 Version : 2.1.10 Release : 5.el6 Size : 5.5 M and client Installed Packages Name : radiusclient-ng Arch : x86_64 Version : 0.5.6 Release : 5.el6 Size : 102 k Repo : installed
From repo : epel
Tell me what I am missing! Khapare
Hi,
3. I looked at the /etc/raddb/radiusd.conf but I do not see the the LDAP section
modules/ldap
4. how can I integrate the my freeradius server to hook up with ldap server ?
edit modules/ldap - and then configure the 'ldap' section (you'll either need to uncomment or add it) into the required virtual servers - eg 'default' and/or 'inner-tunnel (for EAP)' alan
Hi Alan, I just checked in modules directory but could not find anything with ldap. This is what is in my /etc/raddb: root radiusd 671 Jul 19 2011 acct_users -rw-r----- 1 root radiusd 4174 Jul 19 2011 attrs -rw-r----- 1 root radiusd 513 Jul 19 2011 attrs.access_challenge -rw-r----- 1 root radiusd 458 Jul 19 2011 attrs.access_reject -rw-r----- 1 root radiusd 437 Jul 19 2011 attrs.accounting_response -rw-r----- 1 root radiusd 2022 Jul 19 2011 attrs.pre-proxy drwxrwx--- 2 root radiusd 4096 Mar 23 16:00 certs -rw-r----- 1 root radiusd 6703 Jul 19 2011 clients.conf -rw-r--r-- 1 root radiusd 877 Jul 19 2011 dictionary -rw-r----- 1 root radiusd 17831 Jul 19 2011 eap.conf -rw-r----- 1 root radiusd 4744 Jul 19 2011 example.pl -rw-r----- 1 root radiusd 2352 Jul 19 2011 hints -rw-r----- 1 root radiusd 1604 Jul 19 2011 huntgroups drwxr-x--- 2 root radiusd 4096 Mar 23 20:59 modules -rw-r----- 1 root radiusd 2840 Jul 19 2011 policy.conf -rw-r----- 1 root radiusd 4873 Jul 19 2011 policy.txt -rw-r----- 1 root radiusd 984 Jul 19 2011 preproxy_users -rw-r----- 1 root radiusd 26529 Jul 19 2011 proxy.conf -rw-r----- 1 root radiusd 27262 Mar 23 17:20 radiusd.conf -rw-r----- 1 root root 27202 Mar 23 16:26 radiusd.conf.ori drwxr-x--- 2 root radiusd 4096 Mar 23 16:00 sites-available drwxr-x--- 2 root radiusd 4096 Mar 23 16:00 sites-enabled drwxr-x--- 2 root radiusd 4096 Jul 19 2011 sql -rw-r----- 1 root radiusd 3042 Jul 19 2011 sql.conf -rw-r----- 1 root radiusd 2475 Jul 19 2011 sqlippool.conf -rw-r----- 1 root radiusd 3597 Jul 19 2011 templates.conf -rw-r----- 1 root radiusd 6524 Jul 19 2011 users And this is the list in /raddb/modules directory. -rw-r----- 1 root radiusd 457 Jul 19 2011 acct_unique -rw-r----- 1 root radiusd 420 Jul 19 2011 always -rw-r----- 1 root radiusd 1255 Jul 19 2011 attr_filter -rw-r----- 1 root radiusd 1336 Jul 19 2011 attr_rewrite -rw-r----- 1 root radiusd 139 Jul 19 2011 chap -rw-r----- 1 root radiusd 1376 Jul 19 2011 checkval -rw-r----- 1 root radiusd 2903 Jul 19 2011 counter -rw-r----- 1 root radiusd 509 Jul 19 2011 cui -rw-r----- 1 root radiusd 2134 Jul 19 2011 detail -rw-r----- 1 root radiusd 924 Jul 19 2011 detail.example.com -rw-r----- 1 root radiusd 1724 Jul 19 2011 detail.log -rw-r----- 1 root radiusd 273 Jul 19 2011 digest -rw-r----- 1 root radiusd 269 Jul 19 2011 dynamic_clients -rw-r----- 1 root radiusd 3289 Jul 19 2011 echo -rw-r----- 1 root radiusd 816 Jul 19 2011 etc_group -rw-r----- 1 root radiusd 766 Jul 19 2011 exec -rw-r----- 1 root radiusd 548 Jul 19 2011 expiration -rw-r----- 1 root radiusd 558 Jul 19 2011 expr -rw-r----- 1 root radiusd 1522 Jul 19 2011 files -rw-r----- 1 root radiusd 4465 Jul 19 2011 inner-eap -rw-r----- 1 root radiusd 2200 Jul 19 2011 ippool -rw-r----- 1 root radiusd 2502 Jul 19 2011 linelog -rw-r----- 1 root radiusd 1088 Jul 19 2011 logintime -rw-r----- 1 root radiusd 680 Jul 19 2011 mac2ip -rw-r----- 1 root radiusd 347 Jul 19 2011 mac2vlan -rw-r----- 1 root radiusd 2102 Mar 23 16:48 mschap -rw-r----- 1 root radiusd 379 Jul 19 2011 ntlm_auth -rw-r----- 1 root radiusd 287 Jul 19 2011 opendirectory -rw-r----- 1 root radiusd 3357 Jul 19 2011 otp -rw-r----- 1 root radiusd 642 Jul 19 2011 pam -rw-r----- 1 root radiusd 571 Jul 19 2011 pap -rw-r----- 1 root radiusd 1968 Jul 19 2011 passwd -rw-r----- 1 root radiusd 1587 Jul 19 2011 perl -rw-r----- 1 root radiusd 559 Jul 19 2011 policy -rw-r----- 1 root radiusd 1661 Jul 19 2011 preprocess -rw-r----- 1 root radiusd 1510 Jul 19 2011 radutmp -rw-r----- 1 root radiusd 847 Jul 19 2011 realm -rw-r----- 1 root radiusd 354 Jul 19 2011 smbpasswd -rw-r----- 1 root radiusd 1232 Jul 19 2011 smsotp -rw-r----- 1 root radiusd 2162 Jul 19 2011 sql_log -rw-r----- 1 root radiusd 601 Jul 19 2011 sqlcounter_expire_on_login -rw-r----- 1 root radiusd 442 Jul 19 2011 sradutmp -rw-r----- 1 root radiusd 543 Jul 19 2011 unix -rw-r----- 1 root radiusd 3526 Jul 19 2011 wimax Am I missing some package to install ? I also tested with samba- winbind to authentication againg active directory without freeradius - but I do not want to use activie directory and samba. ppptpd-radius-ldap (this is i am aiming.) K On Fri, Mar 23, 2012 at 8:00 PM, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
3. I looked at the /etc/raddb/radiusd.conf but I do not see the the LDAP section
modules/ldap
4. how can I integrate the my freeradius server to hook up with ldap server ?
edit modules/ldap - and then configure the 'ldap' section (you'll either need to uncomment or add it) into the required virtual servers - eg 'default' and/or 'inner-tunnel (for EAP)'
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 03/23/2012 05:07 PM, Khapare Joshi wrote:
Hi Alan,
I just checked in modules directory but could not find anything with ldap. This is what is in my /etc/raddb: ...
Am I missing some package to install ?
freeradius-ldap -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
Thanks guys, I should have search for it :) I configured the ldap section that fits to my environment. Now, how to load this ldap module in radiusd.conf file so it will use ldap authentication ? also where can i add the redundant ldap server in the ldap module ? sorry for too many my early beginners questions. K On Fri, Mar 23, 2012 at 9:17 PM, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
I just checked in modules directory but could not find anything with ldap. This is what is in my /etc/raddb:
you installed via package manager? you've probably got a freeradius-ldap package you need to install....
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hello there, I am now progressing - i think. but got stucked. I enabled the ldap plugin. radiusd -X display all the correct info. but when try to connect vpn from windows client. here is the error i get. Maybe you guys have some tips on it. GRE: read(fd=6,buffer=611860,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs Mar 26 10:58:10 blade201 pptpd[21153]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7) Mar 26 10:58:10 blade201 pptpd[21153]: CTRL: Client 192.168.1.1 control connection finished Mar 26 10:58:14 blade201 pptpd[21162]: CTRL: Client 192.168.1.1 control connection started Mar 26 10:58:14 blade201 pptpd[21162]: CTRL: Starting call (launching pppd, opening GRE) Mar 26 10:58:14 blade201 pppd[21163]: Plugin radius.so loaded. Mar 26 10:58:14 blade201 pppd[21163]: RADIUS plugin initialized. Mar 26 10:58:14 blade201 pppd[21163]: Plugin radattr.so loaded. Mar 26 10:58:14 blade201 pppd[21163]: RADATTR plugin initialized. Mar 26 10:58:14 blade201 pppd[21163]: Plugin /usr/lib64/pptpd/pptpd-logwtmp.so loaded. Mar 26 10:58:14 blade201 pppd[21163]: pppd 2.4.5 started by root, uid 0 Mar 26 10:58:14 blade201 pppd[21163]: Using interface ppp0 Mar 26 10:58:14 blade201 pppd[21163]: Connect: ppp0 <--> /dev/pts/1 Mar 26 10:58:17 blade201 pptpd[21162]: CTRL: Ignored a SET LINK INFO packet with real ACCMs! Mar 26 10:58:17 blade201 pppd[21163]: rc_read_dictionary: unknown vendor on line 22 of dictionary /etc/radiusclient-ng/dictionary.microsoft Mar 26 10:58:17 blade201 pppd[21163]: RADIUS: Can't read dictionary file /etc/radiusclient-ng/dictionary Mar 26 10:58:17 blade201 pppd[21163]: Peer nemandi@hi.is failed CHAP authentication Mar 26 10:58:17 blade201 pppd[21163]: Connection terminated. Mar 26 10:58:17 blade201 pppd[21163]: Exit. Mar 26 10:58:17 blade201 pptpd[21162]: GRE: read(fd=6,buffer=611860,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs Mar 26 10:58:17 blade201 pptpd[21162]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7) it seems i need some lines in my dictonary.microsoft file for pppd. How do i add this ? all I am trying to do here is pppd to delegate ip pool for client and radius to authentication for user via ldap. where I am missing thing ? Any help would be appreciated. K On Fri, Mar 23, 2012 at 10:53 PM, Khapare Joshi <khapare77@gmail.com> wrote:
Thanks guys, I should have search for it :) I configured the ldap section that fits to my environment. Now, how to load this ldap module in radiusd.conf file so it will use ldap authentication ? also where can i add the redundant ldap server in the ldap module ? sorry for too many my early beginners questions.
K
On Fri, Mar 23, 2012 at 9:17 PM, Alan Buxey <A.L.M.Buxey@lboro.ac.uk>wrote:
Hi,
I just checked in modules directory but could not find anything with ldap. This is what is in my /etc/raddb:
you installed via package manager? you've probably got a freeradius-ldap package you need to install....
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Khapare Joshi wrote:
I am now progressing - i think. but got stucked. I enabled the ldap plugin. radiusd -X display all the correct info. but when try to connect vpn from windows client. here is the error i get. Maybe you guys have some tips on it. ... Mar 26 10:58:17 blade201 pppd[21163]: rc_read_dictionary: unknown vendor on line 22 of dictionary /etc/radiusclient-ng/dictionary.microsoft Mar 26 10:58:17 blade201 pppd[21163]: RADIUS: Can't read dictionary file /etc/radiusclient-ng/dictionary
What is unclear about that message? It looks like you edited the dictionary file, and broke it. Don't do that.
it seems i need some lines in my dictonary.microsoft file for pppd. How do i add this ? all I am trying to do here is pppd to delegate ip pool for client and radius to authentication for user via ldap. where I am missing thing ?
You don't edit the dictionaries. All of the configuration is done in FreeRADIUS. Alan DeKok.
hi Alan, I now fixed that dictonary issue. I followed the guide lines from here http://wiki.freeradius.org/PopTop to see if pptp and radius works. I am getting this error : /var/log/message Mar 27 15:11:54 test45 pptpd[2121]: CTRL: Starting call (launching pppd, opening GRE) Mar 27 15:11:54 test45 pppd[2123]: Plugin radius.so loaded. Mar 27 15:11:54 test45 pppd[2123]: RADIUS plugin initialized. Mar 27 15:11:54 test45 pppd[2123]: Plugin radattr.so loaded. Mar 27 15:11:54 test45 pppd[2123]: RADATTR plugin initialized. Mar 27 15:11:54 test45 pppd[2123]: Plugin /usr/lib64/pptpd/pptpd-logwtmp.so loaded. Mar 27 15:11:54 test45 pppd[2123]: pppd 2.4.5 started by root, uid 0 Mar 27 15:11:54 test45 pppd[2123]: Using interface ppp0 Mar 27 15:11:54 test45 pppd[2123]: Connect: ppp0 <--> /dev/pts/1 Mar 27 15:11:57 test45 pptpd[2121]: CTRL: Ignored a SET LINK INFO packet with real ACCMs! Mar 27 15:11:58 test45 pppd[2123]: Peer testuser failed CHAP authentication Mar 27 15:11:58 test45 pppd[2123]: Connection terminated. Mar 27 15:11:58 test45 pppd[2123]: Exit. Mar 27 15:11:58 test45 pptpd[2121]: GRE: read(fd=6,buffer=611860,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs Mar 27 15:11:58 test45 pptpd[2121]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7) And in /var/log/radius/radius.log -- i get nothing Tue Mar 27 13:29:13 2012 : Info: Loaded virtual server <default> Tue Mar 27 13:29:13 2012 : Info: Ready to process requests. Tue Mar 27 14:23:53 2012 : Info: Exiting normally. Tue Mar 27 14:23:53 2012 : Info: Loaded virtual server inner-tunnel Tue Mar 27 14:23:53 2012 : Info: Loaded virtual server <default> Tue Mar 27 14:23:53 2012 : Info: Ready to process requests. Tue Mar 27 14:58:03 2012 : Info: Exiting normally. Tue Mar 27 15:03:26 2012 : Info: Loaded virtual server inner-tunnel Tue Mar 27 15:03:26 2012 : Info: Loaded virtual server <default> Tue Mar 27 15:03:26 2012 : Info: Ready to process requests. I must be doing something wrong. On Mon, Mar 26, 2012 at 1:56 PM, Alan DeKok <aland@deployingradius.com>wrote:
Khapare Joshi wrote:
I am now progressing - i think. but got stucked. I enabled the ldap plugin. radiusd -X display all the correct info. but when try to connect vpn from windows client. here is the error i get. Maybe you guys have some tips on it. ... Mar 26 10:58:17 blade201 pppd[21163]: rc_read_dictionary: unknown vendor on line 22 of dictionary /etc/radiusclient-ng/dictionary.microsoft Mar 26 10:58:17 blade201 pppd[21163]: RADIUS: Can't read dictionary file /etc/radiusclient-ng/dictionary
What is unclear about that message?
It looks like you edited the dictionary file, and broke it. Don't do that.
it seems i need some lines in my dictonary.microsoft file for pppd. How do i add this ? all I am trying to do here is pppd to delegate ip pool for client and radius to authentication for user via ldap. where I am missing thing ?
You don't edit the dictionaries. All of the configuration is done in FreeRADIUS.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
Tue Mar 27 14:23:53 2012 : Info: Ready to process requests. Tue Mar 27 14:58:03 2012 : Info: Exiting normally. Tue Mar 27 15:03:26 2012 : Info: Loaded virtual server inner-tunnel Tue Mar 27 15:03:26 2012 : Info: Loaded virtual server <default> Tue Mar 27 15:03:26 2012 : Info: Ready to process requests.
a few usual guesses..... such as the client cant talk to the server, local firewall issues etc...or you just dont have fail/success logging turned on. at this point you follow the docs and run 'radiusd -X' rather than a background daemon process...and then see what you see. alan
Khapare Joshi wrote:
hi Alan,
I now fixed that dictonary issue. I followed the guide lines from here http://wiki.freeradius.org/PopTop to see if pptp and radius works. I am getting this error :
How about asking the PPTP people how their software works?
Mar 27 15:11:58 test45 pppd[2123]: Peer testuser failed CHAP authentication
That message shouldn't be hard to understand.
And in /var/log/radius/radius.log -- i get nothing
How about running the server in debugging mode, as suggested in the FAQ, README, INSTALL, and daily on this list?
I must be doing something wrong.
Well... the RADIUS server isn't receiving packets. This isn't a RADIUS problem. It's an IP routing problem. Alan DeKok.
On 27/03/12 16:17, Khapare Joshi wrote:
And in /var/log/radius/radius.log -- i get nothing
Tue Mar 27 13:29:13 2012 : Info: Loaded virtual server <default> Tue Mar 27 13:29:13 2012 : Info: Ready to process requests. Tue Mar 27 14:23:53 2012 : Info: Exiting normally. Tue Mar 27 14:23:53 2012 : Info: Loaded virtual server inner-tunnel Tue Mar 27 14:23:53 2012 : Info: Loaded virtual server <default> Tue Mar 27 14:23:53 2012 : Info: Ready to process requests. Tue Mar 27 14:58:03 2012 : Info: Exiting normally. Tue Mar 27 15:03:26 2012 : Info: Loaded virtual server inner-tunnel Tue Mar 27 15:03:26 2012 : Info: Loaded virtual server <default> Tue Mar 27 15:03:26 2012 : Info: Ready to process requests.
I must be doing something wrong.
No radius packets are arriving at FreeRADIUS. Check your config. Check the IP addresses. Check any firewalls. Use tcpdump/wireshark/radsniff at both ends. This is not a FreeRADIUS problem, it's a basic unix troubleshooting problem.
Hi again, Just back to work desk now. I created the few users in /etc/radd/users as test Cleartext-Password := "test" i think radius and pptp are talking together now, but when i connect to vpn server from windows machine it looks authentication is working - however it doesnt get connected "it says registering your comptuer on the network" and returns back. What I am missing here. radiusd -X shows : +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry test at line 86 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: test [mschap] Told to do MS-CHAPv2 for test with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 159 to 127.0.0.1 port 39790 MS-CHAP2-Success = 0x4b533d35354641314645323332413231374238393043324335444342423933414244353038354638393531 MS-MPPE-Recv-Key = 0xdb929bd8753a3ae7ef0507710c972c0d MS-MPPE-Send-Key = 0xc58388c594a7e04d37a55da209b2d8f3 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 159 with timestamp +5 Ready to process requests. And pptpd logs shows : Apr 27 16:40:29 ioj-d00 pptpd[2868]: CTRL: Client 192.168.1.50 control connection started Apr 27 16:40:29 ioj-d00 pptpd[2868]: CTRL: Starting call (launching pppd, opening GRE) Apr 27 16:40:29 ioj-d00 pppd[2869]: Plugin radius.so loaded. Apr 27 16:40:29 ioj-d00 pppd[2869]: RADIUS plugin initialized. Apr 27 16:40:29 ioj-d00 pppd[2869]: Plugin radattr.so loaded. Apr 27 16:40:29 ioj-d00 pppd[2869]: RADATTR plugin initialized. Apr 27 16:40:29 ioj-d00 pppd[2869]: Plugin /usr/lib64/pptpd/pptpd-logwtmp.so loaded. Apr 27 16:40:29 ioj-d00 pppd[2869]: pppd 2.4.5 started by root, uid 0 Apr 27 16:40:29 ioj-d00 pppd[2869]: Using interface ppp0 Apr 27 16:40:29 ioj-d00 pppd[2869]: Connect: ppp0 <--> /dev/pts/3 Apr 27 16:40:32 ioj-d00 pptpd[2868]: CTRL: Ignored a SET LINK INFO packet with real ACCMs! Apr 27 16:40:32 ioj-d00 pppd[2869]: MPPE 128-bit stateless compression enabled Apr 27 16:40:33 ioj-d00 pppd[2869]: LCP terminated by peer (^@M-h^NM-^Z^@<M-Mt^@^@^@^@) Apr 27 16:40:33 ioj-d00 pppd[2869]: Modem hangup Apr 27 16:40:33 ioj-d00 pppd[2869]: Connection terminated. Apr 27 16:40:33 ioj-d00 pppd[2869]: Connect time 0.1 minutes. Apr 27 16:40:33 ioj-d00 pppd[2869]: Sent 70 bytes, received 138 bytes. Apr 27 16:40:33 ioj-d00 pppd[2869]: Exit. Apr 27 16:40:33 ioj-d00 pptpd[2868]: CTRL: Client 130.208.107.121 control connection finished what i am missing !! Have a good weekend
Khapare Joshi wrote:
i think radius and pptp are talking together now, but when i connect to vpn server from windows machine it looks authentication is working - however it doesnt get connected "it says registering your comptuer on the network" and returns back.
What I am missing here.
The RADIUS server is returning Access-Accept. This means that it thinks the user is OK.
Apr 27 16:40:33 ioj-d00 pppd[2869]: LCP terminated by peer (^@M-h^NM-^Z^@<M-Mt^@^@^@^@)
PPPD thinks that the PC is closing the connection.
what i am missing !!
Not much. Find out why the PC is closing the connection. Alan DeKok.
Hi Alan, thanks for your quick reply. I have re-look the configs and readme, and figure it out the issue why connection was not established. It was the pptp config file misconfiguration. I got the successfull connection. Then i tested with ldap authentication - configured /etc/modules/ldap section according to my ldap stuff and in sites-enabled/default enabled the ldap part. After that, restarted pptpd and re-run radiusd -X mode. itested with ldap account in localhost commandline as : localhost#radtest radiustest thepassword localhost 1812 testing123 Sending Access-Request of id 211 to 127.0.0.1 port 1812 User-Name = "radiustest" User-Password = "thepassword" NAS-IP-Address = 192.168.1.1 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=211, length=20 So this looks good, then I tried from windows machine and i get authentication failed. WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user nemandi authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: radiustest [mschap] Told to do MS-CHAPv2 for radiustest with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject As per log it mschap need cleartext password, and ldap does not store password in clear text. I do not want to integrate to windows server or samba stuff if possible. How can I achieve ldap authentication without installing samba and adding radius server into active directory ? Regards, Khapare On Sat, Apr 28, 2012 at 5:26 PM, Alan DeKok <aland@deployingradius.com>wrote:
Khapare Joshi wrote:
i think radius and pptp are talking together now, but when i connect to vpn server from windows machine it looks authentication is working - however it doesnt get connected "it says registering your comptuer on the network" and returns back.
What I am missing here.
The RADIUS server is returning Access-Accept. This means that it thinks the user is OK.
Apr 27 16:40:33 ioj-d00 pppd[2869]: LCP terminated by peer (^@M-h^NM-^Z^@<M-Mt^@^@^@^@)
PPPD thinks that the PC is closing the connection.
what i am missing !!
Not much. Find out why the PC is closing the connection.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mon, Apr 30, 2012 at 5:28 AM, Khapare Joshi <khapare77@gmail.com> wrote:
As per log it mschap need cleartext password,
NT-Hash will also work: http://deployingradius.com/documents/protocols/compatibility.html
and ldap does not store password in clear text. I do not want to integrate to windows server or samba stuff if possible. How can I achieve ldap authentication without installing samba and adding radius server into active directory ?
Not with your current setup. You need to either: - have cleartext or nt-hash stored in your LDAP schema, or - don't use mschap. Configure your client to ONLY use pap. -- Fajar
participants (6)
-
Alan Buxey -
Alan DeKok -
Fajar A. Nugraha -
John Dennis -
Khapare Joshi -
Phil Mayers