PPTP + FreeRadius + LDAP
Hey guys, i'm trying configure a VPN Server with PPTP, using the 'radiusclient', to connect on a FreeRadius, with auth in a LDAP Server. I "finished" the configure, but when a try connect with a client Windows XP, don't work. The radiusd -X output: ===== [root@server /usr/local/etc/raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = no Module: Instantiated pap (pap) Module: Loaded LDAP ldap: server = "ldap.telemedicina.ufsc.br" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=telemedicina,dc=ufsc,dc=br" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "XXXXXXX" ldap: basedn = "ou=Users,dc=telemedicina,dc=ufsc,dc=br" ldap: filter = "(&(objectClass=posixAccount)(uid=%u))" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "{Cleartext-Password}" ldap: password_attribute = "sambaNTPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x5bc100 Module: Instantiated ldap (ldap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 150.162.67.254:32838, id=28, length=94 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "nobody" CHAP-Challenge = 0x5eeda4e624ec08496ead36b7895bb06f1eb3a24801 CHAP-Password = 0xe41a875f6823b9777d806817d4d3a3121d NAS-IP-Address = 1.1.1.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry DEFAULT at line 198 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for nobody radius_xlat: '(&(objectClass=posixAccount)(uid=nobody))' radius_xlat: 'ou=Users,dc=telemedicina,dc=ufsc,dc=br' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.telemedicina.ufsc.br:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=telemedicina,dc=ufsc,dc=br/XXXXX to ldap.telemedicina.ufsc.br:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=Users,dc=telemedicina,dc=ufsc,dc=br, with filter (&(objectClass=posixAccount)(uid=nobody)) rlm_ldap: Password header not found in password 5A88C11C0EDC83D3DEA6AE1A0653E889 for user nobody rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNtPassword as NT-Password, value 5A88C11C0EDC83D3DEA6AE1A0653E889 & op=21 rlm_ldap: Adding sambaLmPassword as LM-Password, value 89E0B38AC380D2B8AAD3B435B51404EE & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user nobody authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "nobody", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_pap: Normalizing NT-Password from hex encoding rlm_pap: Normalizing LM-Password from hex encoding rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 0 rlm_chap: login attempt by "nobody" with CHAP password rlm_chap: Could not find clear text password for user nobody modcall[authenticate]: module "chap" returns invalid for request 0 modcall: leaving group CHAP (returns invalid) for request 0 auth: Failed to validate the user. *Login incorrect (rlm_chap: Clear text password not available): *[nobody] (from client access-vpn port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 28 to 150.162.67.254 port 32838 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 28 with timestamp 492d66b7 Nothing to do. Sleeping until we see a request. ==== The result of 'radtest': epiderme:/etc/ppp# radtest nobody XXXXX ldap.telemedicina.ufsc.br:1812 1 XXXXXX Sending Access-Request of id 241 to 150.162.67.5 port 1812 User-Name = "nobody" User-Password = "0101" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 rad_recv: Access-Accept packet from host 150.162.67.5:1812, id=241, length=20 == Please, anyone can help me? Thanks in advanced. Douglas
Douglas Macedo wrote:
i'm trying configure a VPN Server with PPTP, using the 'radiusclient', to connect on a FreeRadius, with auth in a LDAP Server.
I "finished" the configure, but when a try connect with a client Windows XP, don't work.
The radiusd -X output:
The client is doing CHAP, and the LDAP database only has NT passwords in it. It is impossible to get this to work. http://deployingradius.com/documents/protocols/compatibility.html
The result of 'radtest':
Which does PAP authentication. The above web page shows that the combination of PAP and NT passwords will work. Alan DeKok.
Alan, how I can fix that? Thanks in advanced, Douglas On Wed, Nov 26, 2008 at 4:54 PM, Alan DeKok <aland@deployingradius.com>wrote:
Douglas Macedo wrote:
i'm trying configure a VPN Server with PPTP, using the 'radiusclient', to connect on a FreeRadius, with auth in a LDAP Server.
I "finished" the configure, but when a try connect with a client Windows XP, don't work.
The radiusd -X output:
The client is doing CHAP, and the LDAP database only has NT passwords in it. It is impossible to get this to work.
http://deployingradius.com/documents/protocols/compatibility.html
The result of 'radtest':
Which does PAP authentication. The above web page shows that the combination of PAP and NT passwords will work.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant)
Sorry Alan, but the webpage tells that its don't work. Its impossible? Correct? So, how I can fix that the other way? My pptp-options: == epiderme:/etc/ppp# cat pptpd-options name pptpd refuse-pap ##refuse-chap require-chap ##refuse-mschap require-mschap require-mschap-v2 require-mppe-128 proxyarp nodefaultroute debug lock nobsdcomp plugin radius.so #plugin radattr.so radius-config-file /etc/radiusclient/radiusclient.conf auth == And my radiusd.conf: == prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = no $INCLUDE ${confdir}/clients.conf snmp = no thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } mschap { authtype = MS-CHAP use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes } ldap { server = "ldap.telemedicina.ufsc.br" identity = "cn=Manager,dc=telemedicina,dc=ufsc,dc=br" password = "XXXXXXX" basedn = "ou=Users,dc=telemedicina,dc=ufsc,dc=br" filter = "(&(objectClass=posixAccount)(uid=%u))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_header = "{Cleartext-Password}" password_attribute = sambaNTPassword timeout = 4 timelimit = 3 net_timeout = 1 compare_check_items = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 150.162.67.201 range-stop = 150.162.67.220 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess files ldap chap mschap suffix #eap pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix #eap } preacct { preprocess #acct_unique #files } accounting { detail unix radutmp } session { radutmp } post-auth { #main_pool #ldap } pre-proxy { } post-proxy { #eap } == I apreciate your help. Thanks a lot, Douglas On Wed, Nov 26, 2008 at 5:04 PM, Alan DeKok <aland@deployingradius.com>wrote:
Douglas Macedo wrote:
how I can fix that?
Read the web page. It tells you.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant)
trying forcing windows pptp client to use mschapv2 Le 26.11.2008 09:15, Douglas Macedo a écrit :
Sorry Alan,
but the webpage tells that its don't work. Its impossible? Correct?
So, how I can fix that the other way?
My pptp-options:
== epiderme:/etc/ppp# cat pptpd-options name pptpd refuse-pap ##refuse-chap require-chap ##refuse-mschap require-mschap require-mschap-v2 require-mppe-128 proxyarp nodefaultroute debug lock nobsdcomp plugin radius.so #plugin radattr.so radius-config-file /etc/radiusclient/radiusclient.conf auth ==
And my radiusd.conf:
== prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = no $INCLUDE ${confdir}/clients.conf snmp = no thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } mschap { authtype = MS-CHAP use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes } ldap { server = "ldap.telemedicina.ufsc.br <http://ldap.telemedicina.ufsc.br>" identity = "cn=Manager,dc=telemedicina,dc=ufsc,dc=br" password = "XXXXXXX" basedn = "ou=Users,dc=telemedicina,dc=ufsc,dc=br" filter = "(&(objectClass=posixAccount)(uid=%u))"
start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_header = "{Cleartext-Password}" password_attribute = sambaNTPassword timeout = 4 timelimit = 3 net_timeout = 1 compare_check_items = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 150.162.67.201 <http://150.162.67.201> range-stop = 150.162.67.220 <http://150.162.67.220> netmask = 255.255.255.0 <http://255.255.255.0> cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess files ldap chap mschap suffix #eap pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix #eap } preacct { preprocess #acct_unique #files } accounting { detail unix radutmp } session { radutmp } post-auth { #main_pool #ldap } pre-proxy { } post-proxy { #eap } ==
I apreciate your help.
Thanks a lot, Douglas
On Wed, Nov 26, 2008 at 5:04 PM, Alan DeKok <aland@deployingradius.com <mailto:aland@deployingradius.com>> wrote:
Douglas Macedo wrote: > how I can fix that?
Read the web page. It tells you.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com <mailto:dmacedo@gmail.com> -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant) ------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Alexandre, if I try mschapv2 in Windons client: -- rad_recv: Access-Request packet from host 150.162.67.254:32839, id=46, length=52 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "nobody" NAS-IP-Address = 1.1.1.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry DEFAULT at line 198 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for nobody radius_xlat: '(&(objectClass=posixAccount)(uid=nobody))' radius_xlat: 'ou=Users,dc=telemedicina,dc=ufsc,dc=br' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.telemedicina.ufsc.br:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=telemedicina,dc=ufsc,dc=br/ckf45c to ldap.telemedicina.ufsc.br:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=Users,dc=telemedicina,dc=ufsc,dc=br, with filter (&(objectClass=posixAccount)(uid=nobody)) rlm_ldap: Password header not found in password 5A88C11C0EDC83D3DEA6AE1A0653E889 for user nobody rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNtPassword as NT-Password, value 5A88C11C0EDC83D3DEA6AE1A0653E889 & op=21 rlm_ldap: Adding sambaLmPassword as LM-Password, value 89E0B38AC380D2B8AAD3B435B51404EE & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user nobody authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "nobody", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_pap: Normalizing NT-Password from hex encoding rlm_pap: Normalizing LM-Password from hex encoding rlm_ldap: looking for reply items in directory... rlm_ldap: user nobody authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "nobody", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_pap: Normalizing NT-Password from hex encoding rlm_pap: Normalizing LM-Password from hex encoding rlm_pap: No clear-text password in the request. Not performing PAP. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [nobody] (from client access-vpn port 0) Delaying request 1 for 1 seconds Finished request 1 Going to the next request -- Any idea? Thanks in advanced, Douglas On Wed, Nov 26, 2008 at 5:27 PM, Alexandre Chapellon < alexandre.chapellon@mana.pf> wrote:
trying forcing windows pptp client to use mschapv2
Le 26.11.2008 09:15, Douglas Macedo a écrit :
Sorry Alan,
but the webpage tells that its don't work. Its impossible? Correct?
So, how I can fix that the other way?
My pptp-options:
== epiderme:/etc/ppp# cat pptpd-options name pptpd refuse-pap ##refuse-chap require-chap ##refuse-mschap require-mschap require-mschap-v2 require-mppe-128 proxyarp nodefaultroute debug lock nobsdcomp plugin radius.so #plugin radattr.so radius-config-file /etc/radiusclient/radiusclient.conf auth ==
And my radiusd.conf:
== prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = no $INCLUDE ${confdir}/clients.conf snmp = no thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } mschap { authtype = MS-CHAP use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes } ldap { server = "ldap.telemedicina.ufsc.br" identity = "cn=Manager,dc=telemedicina,dc=ufsc,dc=br" password = "XXXXXXX" basedn = "ou=Users,dc=telemedicina,dc=ufsc,dc=br" filter = "(&(objectClass=posixAccount)(uid=%u))"
start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_header = "{Cleartext-Password}" password_attribute = sambaNTPassword timeout = 4 timelimit = 3 net_timeout = 1 compare_check_items = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 150.162.67.201 range-stop = 150.162.67.220 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess files ldap chap mschap suffix #eap pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix #eap } preacct { preprocess #acct_unique #files } accounting { detail unix radutmp } session { radutmp } post-auth { #main_pool #ldap } pre-proxy { } post-proxy { #eap } ==
I apreciate your help.
Thanks a lot, Douglas
On Wed, Nov 26, 2008 at 5:04 PM, Alan DeKok <aland@deployingradius.com>wrote:
Douglas Macedo wrote:
how I can fix that?
Read the web page. It tells you.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant)
------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant)
Le 26.11.2008 09:32, Douglas Macedo a écrit :
Alexandre,
if I try mschapv2 in Windons client:
-- rad_recv: Access-Request packet from host 150.162.67.254:32839 <http://150.162.67.254:32839>, id=46, length=52 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "nobody" NAS-IP-Address = 1.1.1.1 <http://1.1.1.1> NAS-Port = 0
Did you truncated the Access-request before posting???.... there is no information about CHAP chalenge so there is no way freeradius can handle with rlm_chap... Additionnally your pptp config seems strange to me.... You *REQUIRE* chap + mschap + mschapv2!!! Shouldn't a requirement be uniq? I would just keep require mschapv2 (and so force win client to use it)
Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry DEFAULT at line 198 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for nobody radius_xlat: '(&(objectClass=posixAccount)(uid=nobody))' radius_xlat: 'ou=Users,dc=telemedicina,dc=ufsc,dc=br' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.telemedicina.ufsc.br:389 <http://ldap.telemedicina.ufsc.br:389>, authentication 0 rlm_ldap: bind as cn=Manager,dc=telemedicina,dc=ufsc,dc=br/ckf45c to ldap.telemedicina.ufsc.br:389 <http://ldap.telemedicina.ufsc.br:389> rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=Users,dc=telemedicina,dc=ufsc,dc=br, with filter (&(objectClass=posixAccount)(uid=nobody)) rlm_ldap: Password header not found in password 5A88C11C0EDC83D3DEA6AE1A0653E889 for user nobody rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNtPassword as NT-Password, value 5A88C11C0EDC83D3DEA6AE1A0653E889 & op=21 rlm_ldap: Adding sambaLmPassword as LM-Password, value 89E0B38AC380D2B8AAD3B435B51404EE & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user nobody authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "nobody", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_pap: Normalizing NT-Password from hex encoding rlm_pap: Normalizing LM-Password from hex encoding rlm_ldap: looking for reply items in directory... rlm_ldap: user nobody authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "nobody", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_pap: Normalizing NT-Password from hex encoding rlm_pap: Normalizing LM-Password from hex encoding rlm_pap: No clear-text password in the request. Not performing PAP. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [nobody] (from client access-vpn port 0) Delaying request 1 for 1 seconds Finished request 1 Going to the next request --
Any idea?
Thanks in advanced, Douglas
On Wed, Nov 26, 2008 at 5:27 PM, Alexandre Chapellon <alexandre.chapellon@mana.pf <mailto:alexandre.chapellon@mana.pf>> wrote:
trying forcing windows pptp client to use mschapv2
Le 26.11.2008 09:15, Douglas Macedo a écrit :
Sorry Alan,
but the webpage tells that its don't work. Its impossible? Correct?
So, how I can fix that the other way?
My pptp-options:
== epiderme:/etc/ppp# cat pptpd-options name pptpd refuse-pap ##refuse-chap require-chap ##refuse-mschap require-mschap require-mschap-v2 require-mppe-128 proxyarp nodefaultroute debug lock nobsdcomp plugin radius.so #plugin radattr.so radius-config-file /etc/radiusclient/radiusclient.conf auth ==
And my radiusd.conf:
== prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = no $INCLUDE ${confdir}/clients.conf snmp = no thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } mschap { authtype = MS-CHAP use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes } ldap { server = "ldap.telemedicina.ufsc.br <http://ldap.telemedicina.ufsc.br>" identity = "cn=Manager,dc=telemedicina,dc=ufsc,dc=br" password = "XXXXXXX" basedn = "ou=Users,dc=telemedicina,dc=ufsc,dc=br" filter = "(&(objectClass=posixAccount)(uid=%u))"
start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_header = "{Cleartext-Password}" password_attribute = sambaNTPassword timeout = 4 timelimit = 3 net_timeout = 1 compare_check_items = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 150.162.67.201 <http://150.162.67.201> range-stop = 150.162.67.220 <http://150.162.67.220> netmask = 255.255.255.0 <http://255.255.255.0> cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess files ldap chap mschap suffix #eap pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix #eap } preacct { preprocess #acct_unique #files } accounting { detail unix radutmp } session { radutmp } post-auth { #main_pool #ldap } pre-proxy { } post-proxy { #eap } ==
I apreciate your help.
Thanks a lot, Douglas
On Wed, Nov 26, 2008 at 5:04 PM, Alan DeKok <aland@deployingradius.com <mailto:aland@deployingradius.com>> wrote:
Douglas Macedo wrote: > how I can fix that?
Read the web page. It tells you.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com <mailto:dmacedo@gmail.com> -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant) ------------------------------------------------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com <mailto:dmacedo@gmail.com> -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant) ------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
if I try mschapv2 in Windons client:
-- rad_recv: Access-Request packet from host 150.162.67.254:32839, id=46, length=52 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "nobody" NAS-IP-Address = 1.1.1.1 NAS-Port = 0
This is not an mschap request. http://wiki.freeradius.org/index.php/FreeRADIUS_Wiki:FAQ#How_do_I_make_Windo... In your case, leave only mschapv2. That will force Windows to use it (if mschapv2 is not enabled on the pptp server connection will fail without authentication). Ivan Kalik Kalik Informatika ISP
Hey guys, i force in WIndows Client to use only mschap2, but the problem continue: - Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 150.162.67.254:32858, id=109, length=53 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "douglas" NAS-IP-Address = 1.1.1.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "douglas", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [douglas] (from client access-vpn port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request -- In PPTP debug show: -- Nov 27 11:35:39 epiderme pptpd[12253]: MGR: Launching /usr/sbin/pptpctrl to handle client Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: local address = 150.162.67.200 Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: remote address = 150.162.67.201 Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: pppd options file = /etc/ppp/pptpd-options Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: Client 150.162.67.54 control connection started Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: Received PPTP Control Message (type: 1) Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: Made a START CTRL CONN RPLY packet Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: I wrote 156 bytes to the client. Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: Sent packet to client Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: Received PPTP Control Message (type: 7) Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: Set parameters to 100000000 maxbps, 64 window size Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: Made a OUT CALL RPLY packet Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: Starting call (launching pppd, opening GRE) Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: pty_fd = 6 Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: tty_fd = 7 Nov 27 11:35:39 epiderme pptpd[12254]: CTRL (PPPD Launcher): program binary = /usr/sbin/pppd Nov 27 11:35:39 epiderme pptpd[12254]: CTRL (PPPD Launcher): local address = 150.162.67.200 Nov 27 11:35:39 epiderme pptpd[12254]: CTRL (PPPD Launcher): remote address = 150.162.67.201 Nov 27 11:35:39 epiderme pppd[12254]: Plugin radius.so loaded. Nov 27 11:35:39 epiderme pppd[12254]: RADIUS plugin initialized. Nov 27 11:35:39 epiderme pppd[12254]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded. Nov 27 11:35:39 epiderme pppd[12254]: pptpd-logwtmp: $Version$ Nov 27 11:35:39 epiderme pppd[12254]: pppd 2.4.4 started by root, uid 0 Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: I wrote 32 bytes to the client. Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: Sent packet to client Nov 27 11:35:39 epiderme pppd[12254]: using channel 291 Nov 27 11:35:39 epiderme pppd[12254]: Using interface ppp0 Nov 27 11:35:39 epiderme pppd[12254]: Connect: ppp0 <--> /dev/pts/1 Nov 27 11:35:39 epiderme pppd[12254]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x7ba9ed09> <pcomp> <accomp>] Nov 27 11:35:39 epiderme pptpd[12253]: GRE: Bad checksum from pppd. Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: Received PPTP Control Message (type: 15) Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: Got a SET LINK INFO packet with standard ACCMs Nov 27 11:35:39 epiderme pptpd[12253]: GRE: accepting packet #0 Nov 27 11:35:39 epiderme pptpd[12253]: GRE: accepting packet #1 Nov 27 11:35:39 epiderme pppd[12254]: rcvd [LCP ConfReq id=0x0 <mru 1400> <magic 0x2f814697> <pcomp> <accomp> <callback CBCP>] Nov 27 11:35:39 epiderme pppd[12254]: sent [LCP ConfRej id=0x0 <callback CBCP>] Nov 27 11:35:39 epiderme pppd[12254]: rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x7ba9ed09> <pcomp> <accomp>] Nov 27 11:35:39 epiderme pptpd[12253]: GRE: accepting packet #2 Nov 27 11:35:39 epiderme pppd[12254]: rcvd [LCP ConfReq id=0x1 <mru 1400> <magic 0x2f814697> <pcomp> <accomp>] Nov 27 11:35:39 epiderme pppd[12254]: sent [LCP ConfAck id=0x1 <mru 1400> <magic 0x2f814697> <pcomp> <accomp>] Nov 27 11:35:39 epiderme pppd[12254]: sent [LCP EchoReq id=0x0 magic=0x7ba9ed09] Nov 27 11:35:39 epiderme pppd[12254]: sent [CHAP Challenge id=0xed <f0334ca2b790e04dd584cd16234b2d12>, name = "pptpd"] Nov 27 11:35:39 epiderme pptpd[12253]: GRE: accepting packet #3 Nov 27 11:35:39 epiderme pptpd[12253]: GRE: accepting packet #4 Nov 27 11:35:39 epiderme pptpd[12253]: GRE: accepting packet #5 Nov 27 11:35:39 epiderme pppd[12254]: rcvd [LCP Ident id=0x2 magic=0x2f814697 "MSRASV5.10"] Nov 27 11:35:39 epiderme pppd[12254]: rcvd [LCP Ident id=0x3 magic=0x2f814697 "MSRAS-0-MOLAR"] Nov 27 11:35:39 epiderme pppd[12254]: rcvd [LCP Ident id=0x2 magic=0x2f814697 "MSRASV5.10"] Nov 27 11:35:39 epiderme pppd[12254]: rcvd [LCP Ident id=0x3 magic=0x2f814697 "MSRAS-0-MOLAR"] Nov 27 11:35:39 epiderme pppd[12254]: rcvd [LCP EchoRep id=0x0 magic=0x2f814697] Nov 27 11:35:39 epiderme pptpd[12253]: GRE: accepting packet #6 Nov 27 11:35:39 epiderme pppd[12254]: rcvd [CHAP Response id=0xed <4231ee0d3b4c2d2ae9cfb13528b2449a0000000000000000a70bfbedcf96842050bbf5c9ebcb329e326d29c3190e5d1a00>, name = "douglas"] Nov 27 11:35:39 epiderme pppd[12254]: rc_avpair_new: unknown attribute 11 Nov 27 11:35:39 epiderme pppd[12254]: rc_avpair_new: unknown attribute 25 Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: Received PPTP Control Message (type: 15) Nov 27 11:35:39 epiderme pptpd[12253]: CTRL: Ignored a SET LINK INFO packet with real ACCMs! Nov 27 11:35:41 epiderme pptpd[12253]: GRE: accepting packet #7 Nov 27 11:35:41 epiderme pppd[12254]: Peer douglas failed CHAP authentication Nov 27 11:35:41 epiderme pppd[12254]: sent [CHAP Failure id=0xed ""] Nov 27 11:35:41 epiderme pppd[12254]: sent [LCP TermReq id=0x2 "Authentication failed"] Nov 27 11:35:41 epiderme pppd[12254]: rcvd [CHAP Response id=0xed <4231ee0d3b4c2d2ae9cfb13528b2449a0000000000000000a70bfbedcf96842050bbf5c9ebcb329e326d29c3190e5d1a00>, name = "douglas"] Nov 27 11:35:41 epiderme pppd[12254]: Discarded non-LCP packet when LCP not open Nov 27 11:35:41 epiderme pptpd[12253]: CTRL: Received PPTP Control Message (type: 15) Nov 27 11:35:41 epiderme pptpd[12253]: CTRL: Got a SET LINK INFO packet with standard ACCMs Nov 27 11:35:41 epiderme pptpd[12253]: GRE: accepting packet #8 Nov 27 11:35:41 epiderme pppd[12254]: rcvd [LCP TermAck id=0x2 "Authentication failed"] Nov 27 11:35:41 epiderme pppd[12254]: Connection terminated. Nov 27 11:35:41 epiderme pptpd[12253]: CTRL: Received PPTP Control Message (type: 12) Nov 27 11:35:41 epiderme pptpd[12253]: CTRL: Made a CALL DISCONNECT RPLY packet Nov 27 11:35:41 epiderme pptpd[12253]: CTRL: Received CALL CLR request (closing call) Nov 27 11:35:41 epiderme pptpd[12253]: CTRL: Reaping child PPP[12254] Nov 27 11:35:41 epiderme pppd[12254]: Exit. Nov 27 11:35:41 epiderme pptpd[12253]: CTRL: Client 150.162.67.54 control connection finished Nov 27 11:35:41 epiderme pptpd[12253]: CTRL: Exiting now Nov 27 11:35:41 epiderme pptpd[11948]: MGR: Reaped child 12253 -- My pptp-options: -- epiderme:/etc/ppp# cat pptpd-options lock debug name pptpd proxyarp asyncmap 0 -chap -mschap +mschap-v2 require-mppe lcp-echo-failure 30 lcp-echo-interval 5 ipcp-accept-local ipcp-accept-remote plugin radius.so radius-config-file /etc/radiusclient/radiusclient.conf -- Anyone can help me? Please ... Thanks in advanced, Douglas On Wed, Nov 26, 2008 at 7:34 PM, <tnt@kalik.net> wrote:
if I try mschapv2 in Windons client:
-- rad_recv: Access-Request packet from host 150.162.67.254:32839, id=46, length=52 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "nobody" NAS-IP-Address = 1.1.1.1 NAS-Port = 0
This is not an mschap request.
http://wiki.freeradius.org/index.php/FreeRADIUS_Wiki:FAQ#How_do_I_make_Windo...
In your case, leave only mschapv2. That will force Windows to use it (if mschapv2 is not enabled on the pptp server connection will fail without authentication).
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant)
i force in WIndows Client to use only mschap2, but the problem continue:
- Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 150.162.67.254:32858, id=109, length=53 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "douglas" NAS-IP-Address = 1.1.1.1 NAS-Port = 0
This is nothing to do with freeradius. I don't see your NAS sending mschap attributes.
In PPTP debug show:
..
Nov 27 11:35:39 epiderme pppd[12254]: rc_avpair_new: unknown attribute 11 Nov 27 11:35:39 epiderme pppd[12254]: rc_avpair_new: unknown attribute 25
Has your radius client got mschap dictionary? Ivan Kalik Kalik Informatika ISP
Hey TNT, On Thu, Nov 27, 2008 at 2:54 PM, <tnt@kalik.net> wrote:
i force in WIndows Client to use only mschap2, but the problem continue:
- Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 150.162.67.254:32858, id=109, length=53 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "douglas" NAS-IP-Address = 1.1.1.1 NAS-Port = 0
This is nothing to do with freeradius. I don't see your NAS sending mschap attributes.
How I can fix that? Where i configure that?
In PPTP debug show:
..
Nov 27 11:35:39 epiderme pppd[12254]: rc_avpair_new: unknown attribute 11 Nov 27 11:35:39 epiderme pppd[12254]: rc_avpair_new: unknown attribute 25
Has your radius client got mschap dictionary?
I'm using the RadiusClient1 of Debian. -- epiderme:/etc/radiusclient# ls -l total 52 -rw-r--r-- 1 root root 6502 2008-11-26 13:10 dictionary -rw-r--r-- 1 root root 12388 2006-10-29 08:54 dictionary.ascend -rw-r--r-- 1 root root 1517 2006-10-29 08:54 dictionary.compat -rw-r--r-- 1 root root 599 2006-10-29 08:54 dictionary.merit -rw-r--r-- 1 root root 135 2006-10-29 08:54 issue -rw-r--r-- 1 root root 410 2006-10-29 08:54 port-id-map -rw-r--r-- 1 root root 2630 2008-11-24 15:24 radiusclient.conf -rwxr-xr-x 1 root root 2621 2008-11-24 13:33 radiusclient.conf.EPI -rw------- 1 root root 272 2008-11-24 13:12 servers -- -- epiderme:/etc/radiusclient# cat radiusclient.conf auth_order radius,local login_tries 4 login_timeout 60 nologin /etc/nologin issue /etc/radiusclient/issue authserver ldap.telemedicina.ufsc.br acctserver ldap.telemedicina.ufsc.br servers /etc/radiusclient/servers dictionary /etc/radiusclient/dictionary login_radius /usr/sbin/login.radius seqfile /var/run/radius.seq mapfile /etc/radiusclient/port-id-map default_realm radius_timeout 10 radius_retries 3 login_local /bin/login -- But I don't found the attributes to MS-CHAP: -- epiderme:/etc/radiusclient# cat dictionary | grep MS-CHAP epiderme:/etc/radiusclient# cat dictionary | grep MSCHAP epiderme:/etc/radiusclient# cat dictionary | grep mschap -- Just to CHAP: -- epiderme:/etc/radiusclient# cat dictionary | grep -i chap ATTRIBUTE CHAP-Password 3 string ATTRIBUTE Chap-Challenge 60 string -- That's correct? Thanks a lot in advanced, Douglas
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant)
Le 27.11.2008 07:17, Douglas Macedo a écrit :
Hey TNT,
On Thu, Nov 27, 2008 at 2:54 PM, <tnt@kalik.net <mailto:tnt@kalik.net>> wrote:
>i force in WIndows Client to use only mschap2, but the problem continue: > >- >Module: Instantiated radutmp (radutmp) >Listening on authentication *:1812 >Listening on accounting *:1813 >Ready to process requests. >rad_recv: Access-Request packet from host 150.162.67.254:32858 <http://150.162.67.254:32858>, id=109, >length=53 > Service-Type = Framed-User > Framed-Protocol = PPP > User-Name = "douglas" > NAS-IP-Address = 1.1.1.1 <http://1.1.1.1> > NAS-Port = 0
This is nothing to do with freeradius. I don't see your NAS sending mschap attributes.
How I can fix that? Where i configure that?
>In PPTP debug show: > .. >Nov 27 11:35:39 epiderme pppd[12254]: rc_avpair_new: unknown attribute 11 >Nov 27 11:35:39 epiderme pppd[12254]: rc_avpair_new: unknown attribute 25
Has your radius client got mschap dictionary?
I'm using the RadiusClient1 of Debian.
-- epiderme:/etc/radiusclient# ls -l total 52 -rw-r--r-- 1 root root 6502 2008-11-26 13:10 dictionary -rw-r--r-- 1 root root 12388 2006-10-29 08:54 dictionary.ascend -rw-r--r-- 1 root root 1517 2006-10-29 08:54 dictionary.compat -rw-r--r-- 1 root root 599 2006-10-29 08:54 dictionary.merit -rw-r--r-- 1 root root 135 2006-10-29 08:54 issue -rw-r--r-- 1 root root 410 2006-10-29 08:54 port-id-map -rw-r--r-- 1 root root 2630 2008-11-24 15:24 radiusclient.conf -rwxr-xr-x 1 root root 2621 2008-11-24 13:33 radiusclient.conf.EPI -rw------- 1 root root 272 2008-11-24 13:12 servers --
Copy microsoft dictionnary from your freeradius install to your pptp server, and add it to the dictionnary list. Additionnaly (this may not be related to your problem) having multiple require-<protocols> in pptpd config is a non-sense, if you want to enable multiples protocols for authentications, use +pap, +chap, +mschap.... instead of require-...
-- epiderme:/etc/radiusclient# cat radiusclient.conf auth_order radius,local login_tries 4 login_timeout 60 nologin /etc/nologin issue /etc/radiusclient/issue authserver ldap.telemedicina.ufsc.br <http://ldap.telemedicina.ufsc.br> acctserver ldap.telemedicina.ufsc.br <http://ldap.telemedicina.ufsc.br> servers /etc/radiusclient/servers dictionary /etc/radiusclient/dictionary login_radius /usr/sbin/login.radius seqfile /var/run/radius.seq mapfile /etc/radiusclient/port-id-map default_realm radius_timeout 10 radius_retries 3 login_local /bin/login --
But I don't found the attributes to MS-CHAP:
-- epiderme:/etc/radiusclient# cat dictionary | grep MS-CHAP epiderme:/etc/radiusclient# cat dictionary | grep MSCHAP epiderme:/etc/radiusclient# cat dictionary | grep mschap --
Just to CHAP:
-- epiderme:/etc/radiusclient# cat dictionary | grep -i chap ATTRIBUTE CHAP-Password 3 string ATTRIBUTE Chap-Challenge 60 string --
That's correct?
No you need MS-CHAP Attributes
Thanks a lot in advanced, Douglas
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com <mailto:dmacedo@gmail.com> -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant) ------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hey, i copy the dictionary to /etc/radiusclient. But now the connections don't target the Radius Server. -- epiderme:/etc/radiusclient# ls -l total 68 -rw-r--r-- 1 root root 6593 2008-11-27 15:02 dictionary -rw-r--r-- 1 root root 12388 2006-10-29 08:54 dictionary.ascend -rw-r--r-- 1 root root 1517 2006-10-29 08:54 dictionary.compat -rw-r--r-- 1 root root 646 2008-11-27 14:20 dictionary.merit -rw-r--r-- 1 root root 599 2008-11-27 14:20 dictionary.merit.BKP -rwxr-xr-x 1 root root 3639 2008-11-27 14:42 dictionary.microsoft -rwxr-xr-x 1 root root 2697 2008-11-27 14:20 dictionary.microsoft.BKP -rw-r--r-- 1 root root 135 2006-10-29 08:54 issue -rw-r--r-- 1 root root 410 2006-10-29 08:54 port-id-map -rw-r--r-- 1 root root 508 2008-11-27 13:29 radiusclient.conf -rwxr-xr-x 1 root root 2621 2008-11-24 13:33 radiusclient.conf.EPI -rw-r--r-- 1 root root 435 2008-11-27 12:17 radiusclient.conf.LIMPO -rw------- 1 root root 272 2008-11-24 13:12 servers -- And include on dictionary: -- epiderme:/etc/radiusclient# cat dictionary | grep INCLUDE INCLUDE /etc/radiusclient/dictionary.merit INCLUDE /etc/radiusclient/dictionary.microsoft -- Now, the pptp log: -- Nov 27 15:14:32 epiderme pptpd[13058]: MGR: Launching /usr/sbin/pptpctrl to handle client Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: local address = 150.162.67.200 Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: remote address = 150.162.67.201 Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: pppd options file = /etc/ppp/pptpd-options Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Client 150.162.67.54 control connection started Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Received PPTP Control Message (type: 1) Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Made a START CTRL CONN RPLY packet Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: I wrote 156 bytes to the client. Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Sent packet to client Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Received PPTP Control Message (type: 7) Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Set parameters to 100000000 maxbps, 64 window size Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Made a OUT CALL RPLY packet Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Starting call (launching pppd, opening GRE) Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: pty_fd = 6 Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: tty_fd = 7 Nov 27 15:14:32 epiderme pptpd[13059]: CTRL (PPPD Launcher): program binary = /usr/sbin/pppd Nov 27 15:14:32 epiderme pptpd[13059]: CTRL (PPPD Launcher): local address = 150.162.67.200 Nov 27 15:14:32 epiderme pptpd[13059]: CTRL (PPPD Launcher): remote address = 150.162.67.201 Nov 27 15:14:32 epiderme pppd[13059]: Plugin radius.so loaded. Nov 27 15:14:32 epiderme pppd[13059]: RADIUS plugin initialized. Nov 27 15:14:32 epiderme pppd[13059]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded. Nov 27 15:14:32 epiderme pppd[13059]: pptpd-logwtmp: $Version$ Nov 27 15:14:32 epiderme pppd[13059]: pppd 2.4.4 started by root, uid 0 Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: I wrote 32 bytes to the client. Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Sent packet to client Nov 27 15:14:32 epiderme pppd[13059]: using channel 322 Nov 27 15:14:32 epiderme pppd[13059]: Using interface ppp0 Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Received PPTP Control Message (type: 15) Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Got a SET LINK INFO packet with standard ACCMs Nov 27 15:14:32 epiderme pppd[13059]: Connect: ppp0 <--> /dev/pts/2 Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x35f8d0db> <pcomp> <accomp>] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: Bad checksum from pppd. Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #0 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP ConfReq id=0x0 <mru 1400> <magic 0x31fa2cf6> <pcomp> <accomp> <callback CBCP>] Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP ConfRej id=0x0 <callback CBCP>] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #1 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x35f8d0db> <pcomp> <accomp>] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #2 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP ConfReq id=0x1 <mru 1400> <magic 0x31fa2cf6> <pcomp> <accomp>] Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP ConfAck id=0x1 <mru 1400> <magic 0x31fa2cf6> <pcomp> <accomp>] Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP EchoReq id=0x0 magic=0x35f8d0db] Nov 27 15:14:32 epiderme pppd[13059]: sent [CHAP Challenge id=0x43 <8643b88179a03fce2ca15689bf84147b>, name = "pptpd"] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #3 Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #4 Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #5 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP Ident id=0x2 magic=0x31fa2cf6 "MSRASV5.10"] Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP Ident id=0x3 magic=0x31fa2cf6 "MSRAS-0-MOLAR"] Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP EchoRep id=0x0 magic=0x31fa2cf6] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #6 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [CHAP Response id=0x43 <318ca3c0e7f2e099a1f93ed8ca10717e00000000000000006b76deecbf9b1bd51ccc27f8183335f703835d5f6589e20400>, name = "douglas"] Nov 27 15:14:32 epiderme pppd[13059]: rc_avpair_new: unknown attribute 6 Nov 27 15:14:32 epiderme pppd[13059]: rc_avpair_new: unknown attribute 7 Nov 27 15:14:32 epiderme pppd[13059]: rc_avpair_new: unknown attribute 1 Nov 27 15:14:32 epiderme pppd[13059]: rc_avpair_new: unknown attribute 4 Nov 27 15:14:32 epiderme pppd[13059]: Peer douglas failed CHAP authentication Nov 27 15:14:32 epiderme pppd[13059]: sent [CHAP Failure id=0x43 ""] Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP TermReq id=0x2 "Authentication failed"] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #7 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP TermAck id=0x2 "Authentication failed"] Nov 27 15:14:32 epiderme pppd[13059]: Connection terminated. Nov 27 15:14:32 epiderme pppd[13059]: Exit. Nov 27 15:14:32 epiderme pptpd[13058]: GRE: read(fd=6,buffer=8058640,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7) Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Reaping child PPP[13059] Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Client 150.162.67.54 control connection finished Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Exiting now Nov 27 15:14:32 epiderme pptpd[13024]: MGR: Reaped child 13058 -- So, the problem persist: Nov 27 15:10:43 epiderme pppd[13043]: rc_avpair_new: unknown attribute 6 Nov 27 15:10:43 epiderme pppd[13043]: rc_avpair_new: unknown attribute 7 Nov 27 15:10:43 epiderme pppd[13043]: rc_avpair_new: unknown attribute 1 Nov 27 15:10:43 epiderme pppd[13043]: rc_avpair_new: unknown attribute 4 And: Nov 27 15:14:32 epiderme pptpd[13058]: GRE: read(fd=6,buffer=8058640,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7) What you think? I put de dictionaries here to you look it: (dictionary.microsoft) -- # # Microsoft's VSA's, from RFC 2548 # # $Id: dictionary.microsoft,v 1.1 2002/03/06 13:23:09 dfs Exp $ # VENDOR Microsoft 311 Microsoft ATTRIBUTE MS-CHAP-Response 1 string Microsoft ATTRIBUTE MS-CHAP-Error 2 string Microsoft ATTRIBUTE MS-CHAP-CPW-1 3 string Microsoft ATTRIBUTE MS-CHAP-CPW-2 4 string Microsoft ATTRIBUTE MS-CHAP-LM-Enc-PW 5 string Microsoft ATTRIBUTE MS-CHAP-NT-Enc-PW 6 string Microsoft ATTRIBUTE MS-MPPE-Encryption-Policy 7 string Microsoft # This is referred to as both singular and plural in the RFC. # Plural seems to make more sense. ATTRIBUTE MS-MPPE-Encryption-Type 8 string Microsoft ATTRIBUTE MS-MPPE-Encryption-Types 8 string Microsoft ATTRIBUTE MS-RAS-Vendor 9 integer Microsoft ATTRIBUTE MS-CHAP-Domain 10 string Microsoft ATTRIBUTE MS-CHAP-Challenge 11 string Microsoft ATTRIBUTE MS-CHAP-MPPE-Keys 12 string Microsoft ATTRIBUTE MS-BAP-Usage 13 integer Microsoft ATTRIBUTE MS-Link-Utilization-Threshold 14 integer Microsoft ATTRIBUTE MS-Link-Drop-Time-Limit 15 integer Microsoft ATTRIBUTE MS-MPPE-Send-Key 16 string Microsoft ATTRIBUTE MS-MPPE-Recv-Key 17 string Microsoft ATTRIBUTE MS-RAS-Version 18 string Microsoft ATTRIBUTE MS-Old-ARAP-Password 19 string Microsoft ATTRIBUTE MS-New-ARAP-Password 20 string Microsoft ATTRIBUTE MS-ARAP-PW-Change-Reason 21 integer Microsoft ATTRIBUTE MS-Filter 22 string Microsoft ATTRIBUTE MS-Acct-Auth-Type 23 integer Microsoft ATTRIBUTE MS-Acct-EAP-Type 24 integer Microsoft ATTRIBUTE MS-CHAP2-Response 25 string Microsoft ATTRIBUTE MS-CHAP2-Success 26 string Microsoft ATTRIBUTE MS-CHAP2-CPW 27 string Microsoft ATTRIBUTE MS-Primary-DNS-Server 28 ipaddr Microsoft ATTRIBUTE MS-Secondary-DNS-Server 29 ipaddr Microsoft ATTRIBUTE MS-Primary-NBNS-Server 30 ipaddr Microsoft ATTRIBUTE MS-Secondary-NBNS-Server 31 ipaddr Microsoft #ATTRIBUTE MS-ARAP-Challenge 33 string Microsoft # # Integer Translations # # MS-BAP-Usage Values VALUE MS-BAP-Usage Not-Allowed 0 VALUE MS-BAP-Usage Allowed 1 VALUE MS-BAP-Usage Required 2 # MS-ARAP-Password-Change-Reason Values VALUE MS-ARAP-PW-Change-Reason Just-Change-Password 1 VALUE MS-ARAP-PW-Change-Reason Expired-Password 2 VALUE MS-ARAP-PW-Change-Reason Admin-Requires-Password-Change 3 VALUE MS-ARAP-PW-Change-Reason Password-Too-Short 4 # MS-Acct-Auth-Type Values VALUE MS-Acct-Auth-Type PAP 1 VALUE MS-Acct-Auth-Type CHAP 2 VALUE MS-Acct-Auth-Type MS-CHAP-1 3 VALUE MS-Acct-Auth-Type MS-CHAP-2 4 VALUE MS-Acct-Auth-Type EAP 5 # MS-Acct-EAP-Type Values VALUE MS-Acct-EAP-Type MD5 4 VALUE MS-Acct-EAP-Type OTP 5 VALUE MS-Acct-EAP-Type Generic-Token-Card 6 VALUE MS-Acct-EAP-Type TLS 13 ---- Thanks in advanced! Douglas On Thu, Nov 27, 2008 at 4:06 PM, Alexandre Chapellon < alexandre.chapellon@mana.pf> wrote:
Le 27.11.2008 07:17, Douglas Macedo a écrit :
Hey TNT,
On Thu, Nov 27, 2008 at 2:54 PM, <tnt@kalik.net> wrote:
i force in WIndows Client to use only mschap2, but the problem continue:
- Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 150.162.67.254:32858, id=109, length=53 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "douglas" NAS-IP-Address = 1.1.1.1 NAS-Port = 0
This is nothing to do with freeradius. I don't see your NAS sending mschap attributes.
How I can fix that? Where i configure that?
In PPTP debug show:
..
Nov 27 11:35:39 epiderme pppd[12254]: rc_avpair_new: unknown attribute 11 Nov 27 11:35:39 epiderme pppd[12254]: rc_avpair_new: unknown attribute 25
Has your radius client got mschap dictionary?
I'm using the RadiusClient1 of Debian.
-- epiderme:/etc/radiusclient# ls -l total 52 -rw-r--r-- 1 root root 6502 2008-11-26 13:10 dictionary -rw-r--r-- 1 root root 12388 2006-10-29 08:54 dictionary.ascend -rw-r--r-- 1 root root 1517 2006-10-29 08:54 dictionary.compat -rw-r--r-- 1 root root 599 2006-10-29 08:54 dictionary.merit -rw-r--r-- 1 root root 135 2006-10-29 08:54 issue -rw-r--r-- 1 root root 410 2006-10-29 08:54 port-id-map -rw-r--r-- 1 root root 2630 2008-11-24 15:24 radiusclient.conf -rwxr-xr-x 1 root root 2621 2008-11-24 13:33 radiusclient.conf.EPI -rw------- 1 root root 272 2008-11-24 13:12 servers --
Copy microsoft dictionnary from your freeradius install to your pptp server, and add it to the dictionnary list. Additionnaly (this may not be related to your problem) having multiple require-<protocols> in pptpd config is a non-sense, if you want to enable multiples protocols for authentications, use +pap, +chap, +mschap.... instead of require-...
-- epiderme:/etc/radiusclient# cat radiusclient.conf auth_order radius,local login_tries 4 login_timeout 60 nologin /etc/nologin issue /etc/radiusclient/issue authserver ldap.telemedicina.ufsc.br acctserver ldap.telemedicina.ufsc.br servers /etc/radiusclient/servers dictionary /etc/radiusclient/dictionary login_radius /usr/sbin/login.radius seqfile /var/run/radius.seq mapfile /etc/radiusclient/port-id-map default_realm radius_timeout 10 radius_retries 3 login_local /bin/login --
But I don't found the attributes to MS-CHAP:
-- epiderme:/etc/radiusclient# cat dictionary | grep MS-CHAP epiderme:/etc/radiusclient# cat dictionary | grep MSCHAP epiderme:/etc/radiusclient# cat dictionary | grep mschap --
Just to CHAP:
-- epiderme:/etc/radiusclient# cat dictionary | grep -i chap ATTRIBUTE CHAP-Password 3 string ATTRIBUTE Chap-Challenge 60 string --
That's correct?
No you need MS-CHAP Attributes
Thanks a lot in advanced, Douglas
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant)
------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant)
Le 27.11.2008 10:15, Douglas Macedo a écrit :
Hey,
i copy the dictionary to /etc/radiusclient. But now the connections don't target the Radius Server. -- epiderme:/etc/radiusclient# ls -l total 68 -rw-r--r-- 1 root root 6593 2008-11-27 15:02 dictionary -rw-r--r-- 1 root root 12388 2006-10-29 08:54 dictionary.ascend -rw-r--r-- 1 root root 1517 2006-10-29 08:54 dictionary.compat -rw-r--r-- 1 root root 646 2008-11-27 14:20 dictionary.merit -rw-r--r-- 1 root root 599 2008-11-27 14:20 dictionary.merit.BKP -rwxr-xr-x 1 root root 3639 2008-11-27 14:42 dictionary.microsoft -rwxr-xr-x 1 root root 2697 2008-11-27 14:20 dictionary.microsoft.BKP -rw-r--r-- 1 root root 135 2006-10-29 08:54 issue -rw-r--r-- 1 root root 410 2006-10-29 08:54 port-id-map -rw-r--r-- 1 root root 508 2008-11-27 13:29 radiusclient.conf -rwxr-xr-x 1 root root 2621 2008-11-24 13:33 radiusclient.conf.EPI -rw-r--r-- 1 root root 435 2008-11-27 12:17 radiusclient.conf.LIMPO -rw------- 1 root root 272 2008-11-24 13:12 servers --
And include on dictionary:
-- epiderme:/etc/radiusclient# cat dictionary | grep INCLUDE INCLUDE /etc/radiusclient/dictionary.merit INCLUDE /etc/radiusclient/dictionary.microsoft --
Now, the pptp log:
Weird! you don't receive request on radius anymore?
-- Nov 27 15:14:32 epiderme pptpd[13058]: MGR: Launching /usr/sbin/pptpctrl to handle client Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: local address = 150.162.67.200 <http://150.162.67.200> Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: remote address = 150.162.67.201 <http://150.162.67.201> Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: pppd options file = /etc/ppp/pptpd-options Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Client 150.162.67.54 <http://150.162.67.54> control connection started Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Received PPTP Control Message (type: 1) Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Made a START CTRL CONN RPLY packet Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: I wrote 156 bytes to the client. Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Sent packet to client Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Received PPTP Control Message (type: 7) Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Set parameters to 100000000 maxbps, 64 window size Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Made a OUT CALL RPLY packet Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Starting call (launching pppd, opening GRE) Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: pty_fd = 6 Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: tty_fd = 7 Nov 27 15:14:32 epiderme pptpd[13059]: CTRL (PPPD Launcher): program binary = /usr/sbin/pppd Nov 27 15:14:32 epiderme pptpd[13059]: CTRL (PPPD Launcher): local address = 150.162.67.200 <http://150.162.67.200> Nov 27 15:14:32 epiderme pptpd[13059]: CTRL (PPPD Launcher): remote address = 150.162.67.201 <http://150.162.67.201> Nov 27 15:14:32 epiderme pppd[13059]: Plugin radius.so loaded. Nov 27 15:14:32 epiderme pppd[13059]: RADIUS plugin initialized. Nov 27 15:14:32 epiderme pppd[13059]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded. Nov 27 15:14:32 epiderme pppd[13059]: pptpd-logwtmp: $Version$ Nov 27 15:14:32 epiderme pppd[13059]: pppd 2.4.4 started by root, uid 0 Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: I wrote 32 bytes to the client. Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Sent packet to client Nov 27 15:14:32 epiderme pppd[13059]: using channel 322 Nov 27 15:14:32 epiderme pppd[13059]: Using interface ppp0 Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Received PPTP Control Message (type: 15) Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Got a SET LINK INFO packet with standard ACCMs Nov 27 15:14:32 epiderme pppd[13059]: Connect: ppp0 <--> /dev/pts/2 Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x35f8d0db> <pcomp> <accomp>] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: Bad checksum from pppd. Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #0 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP ConfReq id=0x0 <mru 1400> <magic 0x31fa2cf6> <pcomp> <accomp> <callback CBCP>] Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP ConfRej id=0x0 <callback CBCP>] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #1 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x35f8d0db> <pcomp> <accomp>] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #2 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP ConfReq id=0x1 <mru 1400> <magic 0x31fa2cf6> <pcomp> <accomp>] Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP ConfAck id=0x1 <mru 1400> <magic 0x31fa2cf6> <pcomp> <accomp>] Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP EchoReq id=0x0 magic=0x35f8d0db] Nov 27 15:14:32 epiderme pppd[13059]: sent [CHAP Challenge id=0x43 <8643b88179a03fce2ca15689bf84147b>, name = "pptpd"] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #3 Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #4 Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #5 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP Ident id=0x2 magic=0x31fa2cf6 "MSRASV5.10"] Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP Ident id=0x3 magic=0x31fa2cf6 "MSRAS-0-MOLAR"] Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP EchoRep id=0x0 magic=0x31fa2cf6] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #6 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [CHAP Response id=0x43 <318ca3c0e7f2e099a1f93ed8ca10717e00000000000000006b76deecbf9b1bd51ccc27f8183335f703835d5f6589e20400>, name = "douglas"] Nov 27 15:14:32 epiderme pppd[13059]: rc_avpair_new: unknown attribute 6 Nov 27 15:14:32 epiderme pppd[13059]: rc_avpair_new: unknown attribute 7 Nov 27 15:14:32 epiderme pppd[13059]: rc_avpair_new: unknown attribute 1 Nov 27 15:14:32 epiderme pppd[13059]: rc_avpair_new: unknown attribute 4 Nov 27 15:14:32 epiderme pppd[13059]: Peer douglas failed CHAP authentication Nov 27 15:14:32 epiderme pppd[13059]: sent [CHAP Failure id=0x43 ""] Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP TermReq id=0x2 "Authentication failed"] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #7 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP TermAck id=0x2 "Authentication failed"] Nov 27 15:14:32 epiderme pppd[13059]: Connection terminated. Nov 27 15:14:32 epiderme pppd[13059]: Exit. Nov 27 15:14:32 epiderme pptpd[13058]: GRE: read(fd=6,buffer=8058640,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7) Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Reaping child PPP[13059] Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Client 150.162.67.54 <http://150.162.67.54> control connection finished Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Exiting now Nov 27 15:14:32 epiderme pptpd[13024]: MGR: Reaped child 13058 --
Have you tested your pptpd work with local authentication first (without radius)?
So, the problem persist:
Nov 27 15:10:43 epiderme pppd[13043]: rc_avpair_new: unknown attribute 6 Nov 27 15:10:43 epiderme pppd[13043]: rc_avpair_new: unknown attribute 7 Nov 27 15:10:43 epiderme pppd[13043]: rc_avpair_new: unknown attribute 1 Nov 27 15:10:43 epiderme pppd[13043]: rc_avpair_new: unknown attribute 4
And:
Nov 27 15:14:32 epiderme pptpd[13058]: GRE: read(fd=6,buffer=8058640,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7)
that's why you should first test with credential in chap-secrets, and only after setup radius (if you haven't already done so).
What you think? I put de dictionaries here to you look it:
(dictionary.microsoft) --
# # Microsoft's VSA's, from RFC 2548 # # $Id: dictionary.microsoft,v 1.1 2002/03/06 13:23:09 dfs Exp $ #
VENDOR Microsoft 311 Microsoft
ATTRIBUTE MS-CHAP-Response 1 string Microsoft ATTRIBUTE MS-CHAP-Error 2 string Microsoft ATTRIBUTE MS-CHAP-CPW-1 3 string Microsoft ATTRIBUTE MS-CHAP-CPW-2 4 string Microsoft ATTRIBUTE MS-CHAP-LM-Enc-PW 5 string Microsoft ATTRIBUTE MS-CHAP-NT-Enc-PW 6 string Microsoft ATTRIBUTE MS-MPPE-Encryption-Policy 7 string Microsoft # This is referred to as both singular and plural in the RFC. # Plural seems to make more sense. ATTRIBUTE MS-MPPE-Encryption-Type 8 string Microsoft ATTRIBUTE MS-MPPE-Encryption-Types 8 string Microsoft ATTRIBUTE MS-RAS-Vendor 9 integer Microsoft ATTRIBUTE MS-CHAP-Domain 10 string Microsoft ATTRIBUTE MS-CHAP-Challenge 11 string Microsoft ATTRIBUTE MS-CHAP-MPPE-Keys 12 string Microsoft ATTRIBUTE MS-BAP-Usage 13 integer Microsoft ATTRIBUTE MS-Link-Utilization-Threshold 14 integer Microsoft ATTRIBUTE MS-Link-Drop-Time-Limit 15 integer Microsoft ATTRIBUTE MS-MPPE-Send-Key 16 string Microsoft ATTRIBUTE MS-MPPE-Recv-Key 17 string Microsoft ATTRIBUTE MS-RAS-Version 18 string Microsoft ATTRIBUTE MS-Old-ARAP-Password 19 string Microsoft ATTRIBUTE MS-New-ARAP-Password 20 string Microsoft ATTRIBUTE MS-ARAP-PW-Change-Reason 21 integer Microsoft
ATTRIBUTE MS-Filter 22 string Microsoft ATTRIBUTE MS-Acct-Auth-Type 23 integer Microsoft ATTRIBUTE MS-Acct-EAP-Type 24 integer Microsoft
ATTRIBUTE MS-CHAP2-Response 25 string Microsoft ATTRIBUTE MS-CHAP2-Success 26 string Microsoft ATTRIBUTE MS-CHAP2-CPW 27 string Microsoft
ATTRIBUTE MS-Primary-DNS-Server 28 ipaddr Microsoft ATTRIBUTE MS-Secondary-DNS-Server 29 ipaddr Microsoft ATTRIBUTE MS-Primary-NBNS-Server 30 ipaddr Microsoft ATTRIBUTE MS-Secondary-NBNS-Server 31 ipaddr Microsoft
#ATTRIBUTE MS-ARAP-Challenge 33 string Microsoft
# # Integer Translations #
# MS-BAP-Usage Values
VALUE MS-BAP-Usage Not-Allowed 0 VALUE MS-BAP-Usage Allowed 1 VALUE MS-BAP-Usage Required 2
# MS-ARAP-Password-Change-Reason Values
VALUE MS-ARAP-PW-Change-Reason Just-Change-Password 1 VALUE MS-ARAP-PW-Change-Reason Expired-Password 2 VALUE MS-ARAP-PW-Change-Reason Admin-Requires-Password-Change 3 VALUE MS-ARAP-PW-Change-Reason Password-Too-Short 4
# MS-Acct-Auth-Type Values
VALUE MS-Acct-Auth-Type PAP 1 VALUE MS-Acct-Auth-Type CHAP 2 VALUE MS-Acct-Auth-Type MS-CHAP-1 3 VALUE MS-Acct-Auth-Type MS-CHAP-2 4 VALUE MS-Acct-Auth-Type EAP 5
# MS-Acct-EAP-Type Values
VALUE MS-Acct-EAP-Type MD5 4 VALUE MS-Acct-EAP-Type OTP 5 VALUE MS-Acct-EAP-Type Generic-Token-Card 6 VALUE MS-Acct-EAP-Type TLS 13 ----
Thanks in advanced!
Douglas
On Thu, Nov 27, 2008 at 4:06 PM, Alexandre Chapellon <alexandre.chapellon@mana.pf <mailto:alexandre.chapellon@mana.pf>> wrote:
Le 27.11.2008 07:17, Douglas Macedo a écrit :
Hey TNT,
On Thu, Nov 27, 2008 at 2:54 PM, <tnt@kalik.net <mailto:tnt@kalik.net>> wrote:
>i force in WIndows Client to use only mschap2, but the problem continue: > >- >Module: Instantiated radutmp (radutmp) >Listening on authentication *:1812 >Listening on accounting *:1813 >Ready to process requests. >rad_recv: Access-Request packet from host 150.162.67.254:32858 <http://150.162.67.254:32858>, id=109, >length=53 > Service-Type = Framed-User > Framed-Protocol = PPP > User-Name = "douglas" > NAS-IP-Address = 1.1.1.1 <http://1.1.1.1> > NAS-Port = 0
This is nothing to do with freeradius. I don't see your NAS sending mschap attributes.
How I can fix that? Where i configure that?
>In PPTP debug show: > .. >Nov 27 11:35:39 epiderme pppd[12254]: rc_avpair_new: unknown attribute 11 >Nov 27 11:35:39 epiderme pppd[12254]: rc_avpair_new: unknown attribute 25
Has your radius client got mschap dictionary?
I'm using the RadiusClient1 of Debian.
-- epiderme:/etc/radiusclient# ls -l total 52 -rw-r--r-- 1 root root 6502 2008-11-26 13:10 dictionary -rw-r--r-- 1 root root 12388 2006-10-29 08:54 dictionary.ascend -rw-r--r-- 1 root root 1517 2006-10-29 08:54 dictionary.compat -rw-r--r-- 1 root root 599 2006-10-29 08:54 dictionary.merit -rw-r--r-- 1 root root 135 2006-10-29 08:54 issue -rw-r--r-- 1 root root 410 2006-10-29 08:54 port-id-map -rw-r--r-- 1 root root 2630 2008-11-24 15:24 radiusclient.conf -rwxr-xr-x 1 root root 2621 2008-11-24 13:33 radiusclient.conf.EPI -rw------- 1 root root 272 2008-11-24 13:12 servers --
Copy microsoft dictionnary from your freeradius install to your pptp server, and add it to the dictionnary list. Additionnaly (this may not be related to your problem) having multiple require-<protocols> in pptpd config is a non-sense, if you want to enable multiples protocols for authentications, use +pap, +chap, +mschap.... instead of require-...
-- epiderme:/etc/radiusclient# cat radiusclient.conf auth_order radius,local login_tries 4 login_timeout 60 nologin /etc/nologin issue /etc/radiusclient/issue authserver ldap.telemedicina.ufsc.br <http://ldap.telemedicina.ufsc.br> acctserver ldap.telemedicina.ufsc.br <http://ldap.telemedicina.ufsc.br> servers /etc/radiusclient/servers dictionary /etc/radiusclient/dictionary login_radius /usr/sbin/login.radius seqfile /var/run/radius.seq mapfile /etc/radiusclient/port-id-map default_realm radius_timeout 10 radius_retries 3 login_local /bin/login --
But I don't found the attributes to MS-CHAP:
-- epiderme:/etc/radiusclient# cat dictionary | grep MS-CHAP epiderme:/etc/radiusclient# cat dictionary | grep MSCHAP epiderme:/etc/radiusclient# cat dictionary | grep mschap --
Just to CHAP:
-- epiderme:/etc/radiusclient# cat dictionary | grep -i chap ATTRIBUTE CHAP-Password 3 string ATTRIBUTE Chap-Challenge 60 string --
That's correct?
No you need MS-CHAP Attributes
Thanks a lot in advanced, Douglas
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com <mailto:dmacedo@gmail.com> -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant) ------------------------------------------------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com <mailto:dmacedo@gmail.com> -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant) ------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Alexandre, that's work. The problem is that the dictionaries of radiusclient, isn't correct. The default microsoft dictionary don't work perfectly. I use this page to modify my dictionary.microsoft: http://wiki.freeradius.org/PopTop#The_radiusclient_setup_part_.28on_the_Popt... Now thats fine!! Thanks a lot all!! Thanks .. Cheers, Douglas On Thu, Nov 27, 2008 at 6:40 PM, Alexandre Chapellon < alexandre.chapellon@mana.pf> wrote:
Le 27.11.2008 10:15, Douglas Macedo a écrit :
Hey,
i copy the dictionary to /etc/radiusclient. But now the connections don't target the Radius Server. -- epiderme:/etc/radiusclient# ls -l total 68 -rw-r--r-- 1 root root 6593 2008-11-27 15:02 dictionary -rw-r--r-- 1 root root 12388 2006-10-29 08:54 dictionary.ascend -rw-r--r-- 1 root root 1517 2006-10-29 08:54 dictionary.compat -rw-r--r-- 1 root root 646 2008-11-27 14:20 dictionary.merit -rw-r--r-- 1 root root 599 2008-11-27 14:20 dictionary.merit.BKP -rwxr-xr-x 1 root root 3639 2008-11-27 14:42 dictionary.microsoft -rwxr-xr-x 1 root root 2697 2008-11-27 14:20 dictionary.microsoft.BKP -rw-r--r-- 1 root root 135 2006-10-29 08:54 issue -rw-r--r-- 1 root root 410 2006-10-29 08:54 port-id-map -rw-r--r-- 1 root root 508 2008-11-27 13:29 radiusclient.conf -rwxr-xr-x 1 root root 2621 2008-11-24 13:33 radiusclient.conf.EPI -rw-r--r-- 1 root root 435 2008-11-27 12:17 radiusclient.conf.LIMPO -rw------- 1 root root 272 2008-11-24 13:12 servers --
And include on dictionary:
-- epiderme:/etc/radiusclient# cat dictionary | grep INCLUDE INCLUDE /etc/radiusclient/dictionary.merit INCLUDE /etc/radiusclient/dictionary.microsoft --
Now, the pptp log:
Weird! you don't receive request on radius anymore?
-- Nov 27 15:14:32 epiderme pptpd[13058]: MGR: Launching /usr/sbin/pptpctrl to handle client Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: local address = 150.162.67.200 Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: remote address = 150.162.67.201 Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: pppd options file = /etc/ppp/pptpd-options Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Client 150.162.67.54 control connection started Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Received PPTP Control Message (type: 1) Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Made a START CTRL CONN RPLY packet Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: I wrote 156 bytes to the client. Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Sent packet to client Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Received PPTP Control Message (type: 7) Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Set parameters to 100000000 maxbps, 64 window size Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Made a OUT CALL RPLY packet Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Starting call (launching pppd, opening GRE) Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: pty_fd = 6 Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: tty_fd = 7 Nov 27 15:14:32 epiderme pptpd[13059]: CTRL (PPPD Launcher): program binary = /usr/sbin/pppd Nov 27 15:14:32 epiderme pptpd[13059]: CTRL (PPPD Launcher): local address = 150.162.67.200 Nov 27 15:14:32 epiderme pptpd[13059]: CTRL (PPPD Launcher): remote address = 150.162.67.201 Nov 27 15:14:32 epiderme pppd[13059]: Plugin radius.so loaded. Nov 27 15:14:32 epiderme pppd[13059]: RADIUS plugin initialized. Nov 27 15:14:32 epiderme pppd[13059]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded. Nov 27 15:14:32 epiderme pppd[13059]: pptpd-logwtmp: $Version$ Nov 27 15:14:32 epiderme pppd[13059]: pppd 2.4.4 started by root, uid 0 Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: I wrote 32 bytes to the client. Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Sent packet to client Nov 27 15:14:32 epiderme pppd[13059]: using channel 322 Nov 27 15:14:32 epiderme pppd[13059]: Using interface ppp0 Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Received PPTP Control Message (type: 15) Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Got a SET LINK INFO packet with standard ACCMs Nov 27 15:14:32 epiderme pppd[13059]: Connect: ppp0 <--> /dev/pts/2 Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x35f8d0db> <pcomp> <accomp>] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: Bad checksum from pppd. Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #0 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP ConfReq id=0x0 <mru 1400> <magic 0x31fa2cf6> <pcomp> <accomp> <callback CBCP>] Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP ConfRej id=0x0 <callback CBCP>] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #1 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x35f8d0db> <pcomp> <accomp>] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #2 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP ConfReq id=0x1 <mru 1400> <magic 0x31fa2cf6> <pcomp> <accomp>] Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP ConfAck id=0x1 <mru 1400> <magic 0x31fa2cf6> <pcomp> <accomp>] Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP EchoReq id=0x0 magic=0x35f8d0db] Nov 27 15:14:32 epiderme pppd[13059]: sent [CHAP Challenge id=0x43 <8643b88179a03fce2ca15689bf84147b>, name = "pptpd"] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #3 Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #4 Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #5 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP Ident id=0x2 magic=0x31fa2cf6 "MSRASV5.10"] Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP Ident id=0x3 magic=0x31fa2cf6 "MSRAS-0-MOLAR"] Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP EchoRep id=0x0 magic=0x31fa2cf6] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #6 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [CHAP Response id=0x43 <318ca3c0e7f2e099a1f93ed8ca10717e00000000000000006b76deecbf9b1bd51ccc27f8183335f703835d5f6589e20400>, name = "douglas"] Nov 27 15:14:32 epiderme pppd[13059]: rc_avpair_new: unknown attribute 6 Nov 27 15:14:32 epiderme pppd[13059]: rc_avpair_new: unknown attribute 7 Nov 27 15:14:32 epiderme pppd[13059]: rc_avpair_new: unknown attribute 1 Nov 27 15:14:32 epiderme pppd[13059]: rc_avpair_new: unknown attribute 4 Nov 27 15:14:32 epiderme pppd[13059]: Peer douglas failed CHAP authentication Nov 27 15:14:32 epiderme pppd[13059]: sent [CHAP Failure id=0x43 ""] Nov 27 15:14:32 epiderme pppd[13059]: sent [LCP TermReq id=0x2 "Authentication failed"] Nov 27 15:14:32 epiderme pptpd[13058]: GRE: accepting packet #7 Nov 27 15:14:32 epiderme pppd[13059]: rcvd [LCP TermAck id=0x2 "Authentication failed"] Nov 27 15:14:32 epiderme pppd[13059]: Connection terminated. Nov 27 15:14:32 epiderme pppd[13059]: Exit. Nov 27 15:14:32 epiderme pptpd[13058]: GRE: read(fd=6,buffer=8058640,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7) Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Reaping child PPP[13059] Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Client 150.162.67.54 control connection finished Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: Exiting now Nov 27 15:14:32 epiderme pptpd[13024]: MGR: Reaped child 13058 --
Have you tested your pptpd work with local authentication first (without radius)?
So, the problem persist:
Nov 27 15:10:43 epiderme pppd[13043]: rc_avpair_new: unknown attribute 6 Nov 27 15:10:43 epiderme pppd[13043]: rc_avpair_new: unknown attribute 7 Nov 27 15:10:43 epiderme pppd[13043]: rc_avpair_new: unknown attribute 1 Nov 27 15:10:43 epiderme pppd[13043]: rc_avpair_new: unknown attribute 4
And:
Nov 27 15:14:32 epiderme pptpd[13058]: GRE: read(fd=6,buffer=8058640,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs Nov 27 15:14:32 epiderme pptpd[13058]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7)
that's why you should first test with credential in chap-secrets, and only after setup radius (if you haven't already done so).
What you think? I put de dictionaries here to you look it:
(dictionary.microsoft) --
# # Microsoft's VSA's, from RFC 2548 # # $Id: dictionary.microsoft,v 1.1 2002/03/06 13:23:09 dfs Exp $ #
VENDOR Microsoft 311 Microsoft
ATTRIBUTE MS-CHAP-Response 1 string Microsoft ATTRIBUTE MS-CHAP-Error 2 string Microsoft ATTRIBUTE MS-CHAP-CPW-1 3 string Microsoft ATTRIBUTE MS-CHAP-CPW-2 4 string Microsoft ATTRIBUTE MS-CHAP-LM-Enc-PW 5 string Microsoft ATTRIBUTE MS-CHAP-NT-Enc-PW 6 string Microsoft ATTRIBUTE MS-MPPE-Encryption-Policy 7 string Microsoft # This is referred to as both singular and plural in the RFC. # Plural seems to make more sense. ATTRIBUTE MS-MPPE-Encryption-Type 8 string Microsoft ATTRIBUTE MS-MPPE-Encryption-Types 8 string Microsoft ATTRIBUTE MS-RAS-Vendor 9 integer Microsoft ATTRIBUTE MS-CHAP-Domain 10 string Microsoft ATTRIBUTE MS-CHAP-Challenge 11 string Microsoft ATTRIBUTE MS-CHAP-MPPE-Keys 12 string Microsoft ATTRIBUTE MS-BAP-Usage 13 integer Microsoft ATTRIBUTE MS-Link-Utilization-Threshold 14 integer Microsoft ATTRIBUTE MS-Link-Drop-Time-Limit 15 integer Microsoft ATTRIBUTE MS-MPPE-Send-Key 16 string Microsoft ATTRIBUTE MS-MPPE-Recv-Key 17 string Microsoft ATTRIBUTE MS-RAS-Version 18 string Microsoft ATTRIBUTE MS-Old-ARAP-Password 19 string Microsoft ATTRIBUTE MS-New-ARAP-Password 20 string Microsoft ATTRIBUTE MS-ARAP-PW-Change-Reason 21 integer Microsoft
ATTRIBUTE MS-Filter 22 string Microsoft ATTRIBUTE MS-Acct-Auth-Type 23 integer Microsoft ATTRIBUTE MS-Acct-EAP-Type 24 integer Microsoft
ATTRIBUTE MS-CHAP2-Response 25 string Microsoft ATTRIBUTE MS-CHAP2-Success 26 string Microsoft ATTRIBUTE MS-CHAP2-CPW 27 string Microsoft
ATTRIBUTE MS-Primary-DNS-Server 28 ipaddr Microsoft ATTRIBUTE MS-Secondary-DNS-Server 29 ipaddr Microsoft ATTRIBUTE MS-Primary-NBNS-Server 30 ipaddr Microsoft ATTRIBUTE MS-Secondary-NBNS-Server 31 ipaddr Microsoft
#ATTRIBUTE MS-ARAP-Challenge 33 string Microsoft
# # Integer Translations #
# MS-BAP-Usage Values
VALUE MS-BAP-Usage Not-Allowed 0 VALUE MS-BAP-Usage Allowed 1 VALUE MS-BAP-Usage Required 2
# MS-ARAP-Password-Change-Reason Values
VALUE MS-ARAP-PW-Change-Reason Just-Change-Password 1 VALUE MS-ARAP-PW-Change-Reason Expired-Password 2 VALUE MS-ARAP-PW-Change-Reason Admin-Requires-Password-Change 3 VALUE MS-ARAP-PW-Change-Reason Password-Too-Short 4
# MS-Acct-Auth-Type Values
VALUE MS-Acct-Auth-Type PAP 1 VALUE MS-Acct-Auth-Type CHAP 2 VALUE MS-Acct-Auth-Type MS-CHAP-1 3 VALUE MS-Acct-Auth-Type MS-CHAP-2 4 VALUE MS-Acct-Auth-Type EAP 5
# MS-Acct-EAP-Type Values
VALUE MS-Acct-EAP-Type MD5 4 VALUE MS-Acct-EAP-Type OTP 5 VALUE MS-Acct-EAP-Type Generic-Token-Card 6 VALUE MS-Acct-EAP-Type TLS 13 ----
Thanks in advanced!
Douglas
On Thu, Nov 27, 2008 at 4:06 PM, Alexandre Chapellon < alexandre.chapellon@mana.pf> wrote:
Le 27.11.2008 07:17, Douglas Macedo a écrit :
Hey TNT,
On Thu, Nov 27, 2008 at 2:54 PM, <tnt@kalik.net> wrote:
i force in WIndows Client to use only mschap2, but the problem continue:
- Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 150.162.67.254:32858, id=109, length=53 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "douglas" NAS-IP-Address = 1.1.1.1 NAS-Port = 0
This is nothing to do with freeradius. I don't see your NAS sending mschap attributes.
How I can fix that? Where i configure that?
In PPTP debug show:
..
Nov 27 11:35:39 epiderme pppd[12254]: rc_avpair_new: unknown attribute 11 Nov 27 11:35:39 epiderme pppd[12254]: rc_avpair_new: unknown attribute 25
Has your radius client got mschap dictionary?
I'm using the RadiusClient1 of Debian.
-- epiderme:/etc/radiusclient# ls -l total 52 -rw-r--r-- 1 root root 6502 2008-11-26 13:10 dictionary -rw-r--r-- 1 root root 12388 2006-10-29 08:54 dictionary.ascend -rw-r--r-- 1 root root 1517 2006-10-29 08:54 dictionary.compat -rw-r--r-- 1 root root 599 2006-10-29 08:54 dictionary.merit -rw-r--r-- 1 root root 135 2006-10-29 08:54 issue -rw-r--r-- 1 root root 410 2006-10-29 08:54 port-id-map -rw-r--r-- 1 root root 2630 2008-11-24 15:24 radiusclient.conf -rwxr-xr-x 1 root root 2621 2008-11-24 13:33 radiusclient.conf.EPI -rw------- 1 root root 272 2008-11-24 13:12 servers --
Copy microsoft dictionnary from your freeradius install to your pptp server, and add it to the dictionnary list. Additionnaly (this may not be related to your problem) having multiple require-<protocols> in pptpd config is a non-sense, if you want to enable multiples protocols for authentications, use +pap, +chap, +mschap.... instead of require-...
-- epiderme:/etc/radiusclient# cat radiusclient.conf auth_order radius,local login_tries 4 login_timeout 60 nologin /etc/nologin issue /etc/radiusclient/issue authserver ldap.telemedicina.ufsc.br acctserver ldap.telemedicina.ufsc.br servers /etc/radiusclient/servers dictionary /etc/radiusclient/dictionary login_radius /usr/sbin/login.radius seqfile /var/run/radius.seq mapfile /etc/radiusclient/port-id-map default_realm radius_timeout 10 radius_retries 3 login_local /bin/login --
But I don't found the attributes to MS-CHAP:
-- epiderme:/etc/radiusclient# cat dictionary | grep MS-CHAP epiderme:/etc/radiusclient# cat dictionary | grep MSCHAP epiderme:/etc/radiusclient# cat dictionary | grep mschap --
Just to CHAP:
-- epiderme:/etc/radiusclient# cat dictionary | grep -i chap ATTRIBUTE CHAP-Password 3 string ATTRIBUTE Chap-Challenge 60 string --
That's correct?
No you need MS-CHAP Attributes
Thanks a lot in advanced, Douglas
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant)
------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant)
------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Douglas Macedo dmacedo@gmail.com -- Avalia-se a inteligência de um indivíduo pela quantidade de incertezas que ele é capaz de suportar. (Immanuel Kant)
Douglas Macedo wrote:
but the webpage tells that its don't work. Its impossible? Correct?
Since I wrote that web page... I won't disagee with it.
So, how I can fix that the other way?
Do you have questions about the suggestions on the web page?
My pptp-options:
== epiderme:/etc/ppp# cat pptpd-options name pptpd refuse-pap ##refuse-chap require-chap ##refuse-mschap require-mschap require-mschap-v2
Hmm... maybe some of those configuration options could help PPTP meet the requirements listed on the web page? Please read the PPTP documentation for additional information. Alan DeKok.
participants (4)
-
Alan DeKok -
Alexandre Chapellon -
Douglas Macedo -
tnt＠kalik.net