MS-CHAP2-Response is incorrect with Freeradius 2.1.12
Dear all, I'm looking for some help regarding my Freeradius 2.1.12 config. It is running on a Debian Wheezy machine. I need to authenticate my users with EAP-MSCHAPv2 method based upon information stored on a LDAP. Freeradius is bind to LDAP using a service account a retrieving NT and LM-Password hashes (smbldap-tools generated previously). I'm not using the LDAP AuthType and my users file is empty. You'll find attached my launch log and request process log. During any authentication process, Freeradius is throwing the line "Info : [mschap] FAILED : MS-CHAP2-Response is incorrect" without any more detail (line 622). It seems this line appears when NT or LM-Password are missing in the LDAP, but here Freeradius find them successfully earlier. I don't understand this message. Would you have any hint to fix this problem and make Freeradius authenticate my users ? Feel free to give any piece of advice regarding my config. All the best François -- François Lacombe @InfosReseaux
On Aug 29, 2015, at 7:25 AM, François Lacombe <fl.infosreseaux@gmail.com> wrote:
During any authentication process, Freeradius is throwing the line "Info : [mschap] FAILED : MS-CHAP2-Response is incorrect" without any more detail (line 622).
It means that the passwords don't match.
It seems this line appears when NT or LM-Password are missing in the LDAP, but here Freeradius find them successfully earlier.
No, the message does NOT appear when the NT-Password is missing.
Would you have any hint to fix this problem and make Freeradius authenticate my users ?
Have the user enter the correct password. And upgrade. There are fixes to the MS-CHAP module which allow it to better handle non-ASCII passwords. Alan DeKok.
Thank you Alan for this answer 2015-08-29 15:22 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
It means that the passwords don't match.
It's difficult to believe it : the password is "abc" for this test... and I'm pretty sure they match. Is there a way to test eap-maschapv2 method in local instead of using the NAS currently used ?
It seems this line appears when NT or LM-Password are missing in the LDAP, but here Freeradius find them successfully earlier.
No, the message does NOT appear when the NT-Password is missing.
I don't understand : someone here (http://lists.freeradius.org/pipermail/freeradius-users/2010-March/045323.htm...) is reporting a log like that : [mschap] Told to do MS-CHAPv2 for bernard with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect Thanks in advance François -- François Lacombe @InfosReseaux
Is there a way to test eap-maschapv2 method in local instead of using the NAS currently used ?
Hi Francois, Yes, use eapol_test. http://deployingradius.com/scripts/eapol_test/ :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
On Aug 30, 2015, at 4:57 PM, François Lacombe <fl.infosreseaux@gmail.com> wrote:
2015-08-29 15:22 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
It means that the passwords don't match.
It's difficult to believe it : the password is "abc" for this test... and I'm pretty sure they match.
<shrug> They don't match.
Is there a way to test eap-maschapv2 method in local instead of using the NAS currently used ?
see eapol_test.
It seems this line appears when NT or LM-Password are missing in the LDAP, but here Freeradius find them successfully earlier.
No, the message does NOT appear when the NT-Password is missing.
I don't understand : someone here (http://lists.freeradius.org/pipermail/freeradius-users/2010-March/045323.htm...) is reporting a log like that : [mschap] Told to do MS-CHAPv2 for bernard with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect
Those messages are DIFFERENT than the ones you see. The messages are simple, and should be clear. What's the confusion? Alan DeKok.
participants (3)
-
Alan DeKok -
François Lacombe -
Stefan Paetow