Freeradius-Users Digest, Vol 164, Issue 43
soklang.sum
soklang.sum at cambotech.com
Fri Dec 21 04:35:31 CET 2018
Dear Support,
I would like to add google authenticator with freeradius. Please kindly assist to support as possible.
When I enable in /etc/freeradius/users
# Instruct FreeRADIUS to use PAM to authenticate users
DEFAULT Auth-Type := PAM
Username and password always reject PAM of user in MySQL.
Best regards,
Sum Soklang
Senior Network System Engineer
Cambo Technology ISP Co. Ltd.
+855 (0) 99 999 208
From: freeradius-users-request at lists.freeradius.org
Sent: Friday, December 21, 2018 3:54 AM
To: freeradius-users at lists.freeradius.org
Subject: Freeradius-Users Digest, Vol 164, Issue 43
Send Freeradius-Users mailing list submissions to
freeradius-users at lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.freeradius.org/mailman/listinfo/freeradius-users
or, via email, send a message with subject or body 'help' to
freeradius-users-request at lists.freeradius.org
You can reach the person managing the list at
freeradius-users-owner at lists.freeradius.org
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re: why user dosn`t connect ? (Alan DeKok)
2. Re: why user dosn`t connect ? (Alan Buxey)
3. Re: Capacity calculation (Alan Buxey)
4. Re: why user dosn`t connect ? (تعلم البرمجة)
5. Re: why user dosn`t connect ? (Alan Buxey)
6. Re: why user dosn`t connect ? (Alan DeKok)
7. Re: why user dosn`t connect ? (Alan Buxey)
8. Re: Ms-Chap + NT-Password (Anton Kiryushkin)
----------------------------------------------------------------------
Message: 1
Date: Thu, 20 Dec 2018 10:18:33 -0500
From: Alan DeKok <aland at deployingradius.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: why user dosn`t connect ?
Message-ID: <C061CF1B-7A61-493D-AE3F-6D1FF10E92AB at deployingradius.com>
Content-Type: text/plain; charset=utf-8
> On Dec 20, 2018, at 9:51 AM, تعلم البرمجة <mido2010bona at gmail.com> wrote:
>
> but why not added to radacct !!
If you're going to reply to your own messages, then PLEASE edit them so you don't post thousands of lines of the same debug output.
As for why there's no accounting packets, this is in the FAQ.
The NAS is supposed to send accounting packets. Poking FreeRADIUS won't magically make the NAS send accounting packets.
Go configure the NAS.
Alan DeKok.
------------------------------
Message: 2
Date: Thu, 20 Dec 2018 17:12:29 +0000
From: Alan Buxey <alan.buxey at gmail.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: why user dosn`t connect ?
Message-ID:
<CAOVYXj9dPO6m_PxKAxd1HL0_AZVC+n6174-8ZKMxt4=O7z=vpQ at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
hi,
but why not added to radacct !!
>
because the packet received by the server was an access-request, not an
accounting-start, interim update or stop. so no accounting
things were done.
alan
------------------------------
Message: 3
Date: Thu, 20 Dec 2018 17:18:23 +0000
From: Alan Buxey <alan.buxey at gmail.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: Capacity calculation
Message-ID:
<CAOVYXj9Jgz3-JOgi-iM6Jejp=vTYaKgsfu-kWUKx9Ku5PKJaVw at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
hi,
I want to understand how much TPS freeRADIUS will support for below
> configuration along with postgresql DB
>
>
as Nathan has said - this all depends on your configuration, requirements,
processes/policies that need to be dealt with, etc
you can easily do some local benchmarking on a local VM to work out
requirements for scaling - obviously the memory
requirement will be related to DB requirements (caching etc) - usually the
system will be constrained by steps such as
DB inserts etc (if doing live ones) rather than CPU - small institutions
could probably run FR on a RaspberryPi ...
alan
------------------------------
Message: 4
Date: Thu, 20 Dec 2018 19:21:27 +0200
From: تعلم البرمجة <mido2010bona at gmail.com>
To: freeradius-users at lists.freeradius.org
Subject: Re: why user dosn`t connect ?
Message-ID:
<CACe-uLw4kUSF6xP_tLH34EhvzZsmmYxs2GV9hCL09fbFa7qoOA at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
thanks allan , i get this error message "User or Chap Password in
non-access request"
>
>
------------------------------
Message: 5
Date: Thu, 20 Dec 2018 17:22:39 +0000
From: Alan Buxey <alan.buxey at gmail.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: why user dosn`t connect ?
Message-ID:
<CAOVYXj-hicmjZVHAMVNpYE_yqrkWT_9G-bBbBGf_=W+BV8TVqQ at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
hi,
your sending access requests to port 1813 of the server?
alan
On Thu, 20 Dec 2018 at 17:22, تعلم البرمجة <mido2010bona at gmail.com>
wrote:
> thanks allan , i get this error message "User or Chap Password in
> non-access request"
>
> >
> >
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
------------------------------
Message: 6
Date: Thu, 20 Dec 2018 12:24:35 -0500
From: Alan DeKok <aland at deployingradius.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: why user dosn`t connect ?
Message-ID: <7BBEF01A-206F-46DB-BF3E-2FE7326F31F7 at deployingradius.com>
Content-Type: text/plain; charset=utf-8
> On Dec 20, 2018, at 12:21 PM, تعلم البرمجة <mido2010bona at gmail.com> wrote:
>
> thanks allan , i get this error message "User or Chap Password in
> non-access request"
That message doesn't come from FreeRADIUS.
Alan DeKok.
------------------------------
Message: 7
Date: Thu, 20 Dec 2018 17:27:06 +0000
From: Alan Buxey <alan.buxey at gmail.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: why user dosn`t connect ?
Message-ID:
<CAOVYXj8c4XNngZ3-XAbxLk69WsDaQpDVgV65b42KfhEfHJQ=wg at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
indeed, looks like its from php-radius
https://github.com/LawnGnome/php-radius
alan
------------------------------
Message: 8
Date: Thu, 20 Dec 2018 20:52:14 +0000
From: Anton Kiryushkin <swood at fotofor.biz>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: Ms-Chap + NT-Password
Message-ID:
<CAM_jxg1hM8OLdKf0yHP6KkoXSRL+aCkfQHqk0ezQX+r1KPXcDw at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Hello, Alan.
I checked it.
Let me show you full log:
Thu Dec 20 01:10:08 2018 : Debug: (138) User-Name = "
anonymous at espressif.com"
Thu Dec 20 01:10:08 2018 : Debug: (138) Chargeable-User-Identity = 0x00
Thu Dec 20 01:10:08 2018 : Debug: (138) Location-Capable = Civic-Location
Thu Dec 20 01:10:08 2018 : Debug: (138) Calling-Station-Id =
"38-2b-78-03-ee-70"
Thu Dec 20 01:10:08 2018 : Debug: (138) Called-Station-Id =
"cc-46-d6-09-ed-50:BD"
Thu Dec 20 01:10:08 2018 : Debug: (138) NAS-Port = 13
Thu Dec 20 01:10:08 2018 : Debug: (138) Cisco-AVPair =
"audit-session-id=c0a807c8000000015ba9aa3b"
Thu Dec 20 01:10:08 2018 : Debug: (138) Acct-Session-Id =
"5ba9aa3b/38:2b:78:03:ee:70/1"
Thu Dec 20 01:10:08 2018 : Debug: (138) NAS-IP-Address = 192.168.1.200
Thu Dec 20 01:10:08 2018 : Debug: (138) NAS-Identifier = "wc-5508"
Thu Dec 20 01:10:08 2018 : Debug: (138) Airespace-Wlan-Id = 14
Thu Dec 20 01:10:08 2018 : Debug: (138) Service-Type = Framed-User
Thu Dec 20 01:10:08 2018 : Debug: (138) Framed-MTU = 1300
Thu Dec 20 01:10:08 2018 : Debug: (138) NAS-Port-Type = Wireless-802.11
Thu Dec 20 01:10:08 2018 : Debug: (138) Tunnel-Type:0 = VLAN
Thu Dec 20 01:10:08 2018 : Debug: (138) Tunnel-Medium-Type:0 = IEEE-802
Thu Dec 20 01:10:08 2018 : Debug: (138) Tunnel-Private-Group-Id:0 = "14"
Thu Dec 20 01:10:08 2018 : Debug: (138) EAP-Message =
0x0207007b19001703020070493c43a0045e1a736402d6353c2ebfd02b02b3da47074e8043e42814d384055eb07d8a3fdf5fc763651fee8a9c19e2525e0450f5bee24195a432757be658ec4fec63f0d1a904eaed55de4f98bc097aca893e67f8761a530e374122b3ba2c61eab23cf1af3ecd9ab8edf2907b
Thu Dec 20 01:10:08 2018 : Debug: (138) State =
0x9a0fd4fc9e08cd9b875e606333810d4e
Thu Dec 20 01:10:08 2018 : Debug: (138) Message-Authenticator =
0x3b8a82762eef0a453f82a36821b263f2
Thu Dec 20 01:10:08 2018 : Debug: (138) session-state: No cached attributes
Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing section authorize from
file /etc/raddb/sites-enabled/default
Thu Dec 20 01:10:08 2018 : Debug: (138) authorize {
Thu Dec 20 01:10:08 2018 : Debug: (138) if (!control:Cleartext-Password
&& &User-Password) {
Thu Dec 20 01:10:08 2018 : Debug: (138) if (!control:Cleartext-Password
&& &User-Password) -> FALSE
Thu Dec 20 01:10:08 2018 : Debug: (138) if (config:User-Password &&
config:Cleartext-Password) {
Thu Dec 20 01:10:08 2018 : Debug: (138) if (config:User-Password &&
config:Cleartext-Password) -> FALSE
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
preprocess (rlm_preprocess)
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned
from preprocess (rlm_preprocess)
Thu Dec 20 01:10:08 2018 : Debug: (138) [preprocess] = ok
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
chap (rlm_chap)
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned
from chap (rlm_chap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [chap] = noop
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
mschap (rlm_mschap)
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned
from mschap (rlm_mschap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [mschap] = noop
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
suffix (rlm_realm)
Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: Checking for suffix after
"@"
Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: Looking up realm "
espressif.com" for User-Name = "anonymous at espressif.com"
Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: No such realm "espressif.com
"
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned
from suffix (rlm_realm)
Thu Dec 20 01:10:08 2018 : Debug: (138) [suffix] = noop
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
eap (rlm_eap)
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent EAP Response (code
2) ID 7 length 123
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Continuing tunnel setup
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned
from eap (rlm_eap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [eap] = ok
Thu Dec 20 01:10:08 2018 : Debug: (138) } # authorize = ok
Thu Dec 20 01:10:08 2018 : Debug: (138) Found Auth-Type = eap
Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing group from file
/etc/raddb/sites-enabled/default
Thu Dec 20 01:10:08 2018 : Debug: (138) authenticate {
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]:
calling eap (rlm_eap)
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Expiring EAP session with
state 0x0d5314a80d540ec8
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Finished EAP session with
state 0x9a0fd4fc9e08cd9b
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Previous EAP request found for
state 0x9a0fd4fc9e08cd9b, released from the list
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent packet with method
EAP PEAP (25)
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Calling submodule eap_peap to
process data
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Continuing EAP-TLS
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Peer sent flags ---
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: [eaptls verify] = ok
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Done initial handshake
Thu Dec 20 01:10:08 2018 : Debug: Ignoring cbtls_msg call with pseudo
content type 256, version 0
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: [eaptls process] = ok
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Session established.
Decoding tunneled attributes
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: PEAP state phase2
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP method MSCHAPv2 (26)
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Got tunneled request
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP-Message =
0x020700441a0207003f3199f6449a50fa3b50be389565dde6ae4b0000000000000000e78496d30625840ded712d0b260d96bead07a7fdd950530a00792e6c696c656b6f76
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Setting User-Name to
testlogin
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Sending tunneled request
to default
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP-Message =
0x020700441a0207003f3199f6449a50fa3b50be389565dde6ae4b0000000000000000e78496d30625840ded712d0b260d96bead07a7fdd950530a00792e6c696c656b6f76
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: FreeRADIUS-Proxied-To =
127.0.0.1
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: User-Name = “testlogin"
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: State =
0x0d5314a80d540ec8eca17483a9cfe203
Thu Dec 20 01:10:08 2018 : Debug: (138) Virtual server default received
request
Thu Dec 20 01:10:08 2018 : Debug: (138) EAP-Message =
0x020700441a0207003f3199f6449a50fa3b50be389565dde6ae4b0000000000000000e78496d30625840ded712d0b260d96bead07a7fdd950530a00792e6c696c656b6f76
Thu Dec 20 01:10:08 2018 : Debug: (138) FreeRADIUS-Proxied-To = 127.0.0.1
Thu Dec 20 01:10:08 2018 : Debug: (138) User-Name = "testlogin "
Thu Dec 20 01:10:08 2018 : Debug: (138) State =
0x0d5314a80d540ec8eca17483a9cfe203
Thu Dec 20 01:10:08 2018 : Debug: (138) server default {
Thu Dec 20 01:10:08 2018 : Debug: (138) session-state: No cached
attributes
Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing section authorize
from file /etc/raddb/sites-enabled/default
Thu Dec 20 01:10:08 2018 : Debug: (138) authorize {
Thu Dec 20 01:10:08 2018 : Debug: (138) if
(!control:Cleartext-Password && &User-Password) {
Thu Dec 20 01:10:08 2018 : Debug: (138) if
(!control:Cleartext-Password && &User-Password) -> FALSE
Thu Dec 20 01:10:08 2018 : Debug: (138) if (config:User-Password &&
config:Cleartext-Password) {
Thu Dec 20 01:10:08 2018 : Debug: (138) if (config:User-Password &&
config:Cleartext-Password) -> FALSE
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
preprocess (rlm_preprocess)
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]:
returned from preprocess (rlm_preprocess)
Thu Dec 20 01:10:08 2018 : Debug: (138) [preprocess] = ok
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
chap (rlm_chap)
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]:
returned from chap (rlm_chap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [chap] = noop
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
mschap (rlm_mschap)
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]:
returned from mschap (rlm_mschap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [mschap] = noop
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
suffix (rlm_realm)
Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: Checking for suffix after
"@"
Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: No '@' in User-Name =
“testlogin", looking up realm NULL
Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: No such realm "NULL"
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]:
returned from suffix (rlm_realm)
Thu Dec 20 01:10:08 2018 : Debug: (138) [suffix] = noop
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
eap (rlm_eap)
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent EAP Response (code
2) ID 7 length 68
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: No EAP Start, assuming it's an
on-going EAP conversation
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]:
returned from eap (rlm_eap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [eap] = updated
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
sql-wifi (rlm_sql)
Thu Dec 20 01:10:08 2018 : Debug: %{User-Name}
Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree:
Thu Dec 20 01:10:08 2018 : Debug: attribute --> User-Name
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND %{User-Name}
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> testlogin
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: SQL-User-Name set to
’testlogin'
Thu Dec 20 01:10:08 2018 : Info: rlm_sql (sql-wifi): Closing connection
(28): Hit idle_timeout, was idle for 80 seconds
Thu Dec 20 01:10:08 2018 : Debug: rlm_sql (sql-wifi): You probably need to
lower "min"
Thu Dec 20 01:10:08 2018 : Debug: rlm_sql_mysql: Socket destructor called,
closing socket
Thu Dec 20 01:10:08 2018 : Debug: rlm_sql (sql-wifi): Reserved connection
(19)
Thu Dec 20 01:10:08 2018 : Debug: SELECT wifi_id as id, UserName,
'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE
username = '%{SQL-User-Name}' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree:
Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT wifi_id as id,
UserName, 'NT-Password' as attribute, pass_hash, ':=' as op FROM
userstable WHERE username = '
Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name
Thu Dec 20 01:10:08 2018 : Debug: literal --> ' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT wifi_id as
id, UserName, 'NT-Password' as attribute, pass_hash, ':=' as op FROM
userstable WHERE username = '%{SQL-User-Name}' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT wifi_id as
id, UserName, 'NT-Password' as attribute, pass_hash, ':=' as op FROM
userstable WHERE username = ’testlogin' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query:
SELECT wifi_id as id, UserName, 'NT-Password' as attribute, pass_hash, ':='
as op FROM userstable WHERE username = ’testlogin' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: User found in radcheck
table
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Conditional check items
matched, merging assignment check items
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password :=
0x3161666532333532663366363365333136376163646230306136646366386235
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 1 MAX 2
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: APPENDING NT-Password
FROM 0 TO 1
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 1 out 1
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[0] = Auth-Type
Thu Dec 20 01:10:08 2018 : Debug: SELECT wifi_id as id, username,
'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE
username = '%{SQL-User-Name}' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree:
Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT wifi_id as id,
username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM
userstable WHERE username = '
Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name
Thu Dec 20 01:10:08 2018 : Debug: literal --> ' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT wifi_id as
id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM
userstable WHERE username = '%{SQL-User-Name}' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT wifi_id as
id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM
userstable WHERE username = ’testlogin' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query:
SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':='
as op FROM userstable WHERE username = ’testlogin' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: User found in radreply
table, merging reply items
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password :=
0x3161666532333532663366363365333136376163646230306136646366386235
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 0 MAX 1
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: APPENDING NT-Password
FROM 0 TO 0
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 0 out 0
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ... falling-through to
group processing
Thu Dec 20 01:10:08 2018 : Debug: SELECT 'OfficeWifi' as GroupName FROM
userstable WHERE UserName='%{SQL-User-Name}'
Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree:
Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT 'OfficeWifi' as
GroupName FROM userstable WHERE UserName='
Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name
Thu Dec 20 01:10:08 2018 : Debug: literal --> '
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT
'OfficeWifi' as GroupName FROM userstable WHERE UserName='%{SQL-User-Name}'
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT
'OfficeWifi' as GroupName FROM userstable WHERE UserName='testlogin'
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query:
SELECT 'OfficeWifi' as GroupName FROM userstable WHERE UserName='testlogin'
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: User found in the group
table
Thu Dec 20 01:10:08 2018 : Debug: SELECT wifi_id as id, 'OfficeWifi' as
GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable
WHERE Username = '%{SQL-User-Name}' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree:
Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT wifi_id as id,
'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':='
as op FROM
userstable WHERE Username = '
Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name
Thu Dec 20 01:10:08 2018 : Debug: literal --> ' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT wifi_id as
id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':='
as op FROM userstable WHERE Username = '%{SQL-User-Name}'
ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT wifi_id as
id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':='
as op FROM userstable WHERE Username = ’testlogin'
ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query:
SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as
attribute, password, ':=' as op FROM userstable WHERE Username =
'testlogin' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Group "OfficeWifi":
Conditional check items matched
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Group "OfficeWifi":
Merging assignment check items
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password :=
0x696e616d6974414c545a694e3039393021
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 2 MAX 3
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: OVERWRITING
NT-Password FROM 0 TO 1
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 2 out 2
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[0] = Auth-Type
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[1] = NT-Password
Thu Dec 20 01:10:08 2018 : Debug: SELECT wifi_id as id, 'OfficeWifi' as
GroupName, 'NT-Password' as attribute, password, ':=' as op FROM
userstable WHERE Username = '%{SQL-User-Name}' ORDER BY
id
Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree:
Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT wifi_id as id,
'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op
FROM userstable WHERE Username = '
Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name
Thu Dec 20 01:10:08 2018 : Debug: literal --> ' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT wifi_id as
id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':='
as op FROM userstable WHERE Username = '%{SQL-User-Name}'
ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT wifi_id as
id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':='
as op FROM userstable WHERE Username = 'testlogin'
ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query:
SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as
attribute, password, ':=' as op FROM userstable WHERE
Username = 'testlogin' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Group "OfficeWifi":
Merging reply items
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password :=
0x696e616d6974414c545a694e3039393021
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 1 MAX 2
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: OVERWRITING
NT-Password FROM 0 TO 0
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 1 out 1
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[0] = NT-Password
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ... falling-through to
profile processing
Thu Dec 20 01:10:08 2018 : Debug: rlm_sql (sql-wifi): Released connection
(19)
Thu Dec 20 01:10:08 2018 : Info: Need 1 more connections to reach min
connections (5)
Thu Dec 20 01:10:08 2018 : Info: rlm_sql (sql-wifi): Opening additional
connection (30), 1 of 6 pending slots used
Thu Dec 20 01:10:08 2018 : Debug: rlm_sql_mysql: Starting connect to MySQL
server
Thu Dec 20 01:10:08 2018 : Debug: rlm_sql_mysql: Connected to database
'vpn_wifi' on 127.0.0.1 via TCP/IP, server version 5.7.19-17-log, protocol
version 10
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]:
returned from sql-wifi (rlm_sql)
Thu Dec 20 01:10:08 2018 : Debug: (138) [sql-wifi] = ok
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
pap (rlm_pap)
Thu Dec 20 01:10:08 2018 : WARNING: (138) pap: Auth-Type already set. Not
setting to PAP
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]:
returned from pap (rlm_pap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [pap] = noop
Thu Dec 20 01:10:08 2018 : Debug: (138) } # authorize = updated
Thu Dec 20 01:10:08 2018 : Debug: (138) Found Auth-Type = eap
Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing group from file
/etc/raddb/sites-enabled/default
Thu Dec 20 01:10:08 2018 : Debug: (138) authenticate {
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]:
calling eap (rlm_eap)
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Expiring EAP session with
state 0x0d5314a80d540ec8
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Finished EAP session with
state 0x0d5314a80d540ec8
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Previous EAP request found for
state 0x0d5314a80d540ec8, released from the list
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent packet with method
EAP MSCHAPv2 (26)
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Calling submodule eap_mschapv2
to process data
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_mschapv2: # Executing group
from file /etc/raddb/sites-enabled/default
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_mschapv2: Auth-Type MS-CHAP {
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_mschapv2:
modsingle[authenticate]: calling mschap (rlm_mschap)
Thu Dec 20 01:10:08 2018 : WARNING: (138) mschap: NT-Password found but
incorrect length, expected 16 bytes got 17 bytes. Authentication may fail
Thu Dec 20 01:10:08 2018 : WARNING: (138) mschap: No Cleartext-Password
configured. Cannot create NT-Password
Thu Dec 20 01:10:08 2018 : WARNING: (138) mschap: No Cleartext-Password
configured. Cannot create LM-Password
Thu Dec 20 01:10:08 2018 : Debug: (138) mschap: Creating challenge hash
with username: testlogin
Thu Dec 20 01:10:08 2018 : Debug: (138) mschap: Client is using MS-CHAPv2
Thu Dec 20 01:10:08 2018 : ERROR: (138) mschap: FAILED: No NT/LM-Password.
Cannot perform authentication
Thu Dec 20 01:10:08 2018 : ERROR: (138) mschap: MS-CHAP2-Response is
incorrect
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]:
returned from mschap (rlm_mschap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [mschap] = reject
Thu Dec 20 01:10:08 2018 : Debug: (138) } # Auth-Type MS-CHAP = reject
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Sending EAP Failure (code 4)
ID 7 length 4
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Freeing handler
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]:
returned from eap (rlm_eap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [eap] = reject
Thu Dec 20 01:10:08 2018 : Debug: (138) } # authenticate = reject
Thu Dec 20 01:10:08 2018 : Debug: (138) Failed to authenticate the user
Thu Dec 20 01:10:08 2018 : Debug: (138) Using Post-Auth-Type Reject
Thu Dec 20 01:10:08 2018 : Debug: (138) Post-Auth-Type sub-section not
found. Ignoring.
Thu Dec 20 01:10:08 2018 : Auth: (138) Login incorrect (mschap: FAILED:
No NT/LM-Password. Cannot perform authentication): [testlogin/<via
Auth-Type = eap>] (from client WC-5508_ port 0 via TLS tunnel)
Thu Dec 20 01:10:08 2018 : Debug: (138) } # server default
Thu Dec 20 01:10:08 2018 : Debug: (138) Virtual server sending reply
Thu Dec 20 01:10:08 2018 : Debug: (138) NT-Password =
0x696e616d6974414c545a694e3039393021
Thu Dec 20 01:10:08 2018 : Debug: (138) MS-CHAP-Error = "\007E=691 R=1
C=86e3f7442e804d519197bbbf0301334f V=3 M=Authentication rejected"
Thu Dec 20 01:10:08 2018 : Debug: (138) EAP-Message = 0x04070004
Thu Dec 20 01:10:08 2018 : Debug: (138) Message-Authenticator =
0x00000000000000000000000000000000
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Got tunneled reply code 3
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: NT-Password =
0x696e616d6974414c545a694e3039393021
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: MS-CHAP-Error =
"\007E=691 R=1 C=86e3f7442e804d519197bbbf0301334f V=3 M=Authentication
rejected"
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP-Message = 0x04070004
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Message-Authenticator =
0x00000000000000000000000000000000
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Got tunneled reply RADIUS
code 3
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: NT-Password =
0x696e616d6974414c545a694e3039393021
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: MS-CHAP-Error =
"\007E=691 R=1 C=86e3f7442e804d519197bbbf0301334f V=3 M=Authentication
rejected"
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP-Message = 0x04070004
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Message-Authenticator =
0x00000000000000000000000000000000
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Tunneled authentication
was rejected
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: FAILURE
Thu Dec 20 01:10:08 2018 : Debug: Ignoring cbtls_msg call with pseudo
content type 256, version 0
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Sending EAP Request (code 1)
ID 8 length 59
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: EAP session adding
&reply:State = 0x9a0fd4fc9f07cd9b
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]:
returned from eap (rlm_eap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [eap] = handled
Thu Dec 20 01:10:08 2018 : Debug: (138) } # authenticate = handled
Thu Dec 20 01:10:08 2018 : Debug: (138) Using Post-Auth-Type Challenge
Thu Dec 20 01:10:08 2018 : Debug: (138) Post-Auth-Type sub-section not
found. Ignoring.
Thu Dec 20 01:10:08 2018 : Debug: (138) session-state: Nothing to cache
Could you please explain, what for you mean with "It looks like you've
taken the input password, and then tried to use that as the NT hash."?
Which way I have to use for my case?
And what exactly meaning strings below:
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password :=
0x696e616d6974414c545a694e3039393021
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password :=
0x3161666532333532663366363365333136376163646230306136646366386235
That isn't my real hashes. Yes, I used the same hash as you provided via
smbencrypt.
I can provide with you my full configuration file as well is it could help.
чт, 20 дек. 2018 г. в 11:40, Alan DeKok <aland at deployingradius.com>:
> On Dec 20, 2018, at 2:47 AM, Anton Kiryushkin <swood at fotofor.biz> wrote:
> >
> > Hello, Matthew.
> >
> > Yes, I have the same fear about the hash.
> > I made it in the two ways:
> > - hash=$(printf '%s' "${pass}" | iconv -t utf16le | openssl md4
> 2>/dev/null
> > | awk '{print $NF}')
> > - smbencrypt
> >
> > Both ways are equal. Which method is right in my case?
>
> smbencrypt it preferred. I use:
>
> $ smbencrypt hello
> LM Hash NT Hash
> -------------------------------- --------------------------------
> FDA95FBECA288D44AAD3B435B51404EE 066DDFD4EF0E9CD7C256FE77191EF43C
>
> And the use the NT hash.
>
> There is just no way that an input password ends up being *all* ASCII
> characters after hashing. It looks like you've taken the input password,
> and then tried to use that as the NT hash.
>
> Alan DeKok.
>
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
--
Best regards,
Anton Kiryushkin
------------------------------
Subject: Digest Footer
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------
End of Freeradius-Users Digest, Vol 164, Issue 43
*************************************************
More information about the Freeradius-Users
mailing list