Freeradius-Users Digest, Vol 164, Issue 44
soklang.sum
soklang.sum at cambotech.com
Fri Dec 21 04:57:29 CET 2018
Dear support,
This my log:
# tail -f /var/log/radius/radius.log
Info: Loaded virtual server <default>
Warning: Ignoring "ldap" (see raddb/mods-available/README.rst)
Info: Loaded virtual server default
Info: # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:330
Info: Loaded virtual server inner-tunnel
Info: Ready to process requests
Info: Need 4 more connections to reach 10 spares
Info: rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used
ERROR: (0) pam: ERROR: pam_authenticate failed: Authentication failure
Auth: (0) Login incorrect (pam: pam_authenticate failed: Authentication failure): [linux/linux at 123]
Best regards,
Debug radius -X
(3) Received Access-Request Id 1 from 172.26.10.34:63261 to 172.24.0.10:1812 length 45
(3) User-Name = "linux"
(3) User-Password = "linux at 123"
(3) # Executing section authorize from file /etc/raddb/sites-enabled/default
(3) authorize {
(3) policy filter_username {
(3) if (&User-Name) {
(3) if (&User-Name) -> TRUE
(3) if (&User-Name) {
(3) if (&User-Name =~ / /) {
(3) if (&User-Name =~ / /) -> FALSE
(3) if (&User-Name =~ /@[^@]*@/ ) {
(3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(3) if (&User-Name =~ /\.\./ ) {
(3) if (&User-Name =~ /\.\./ ) -> FALSE
(3) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(3) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE
(3) if (&User-Name =~ /\.$/) {
(3) if (&User-Name =~ /\.$/) -> FALSE
(3) if (&User-Name =~ /@\./) {
(3) if (&User-Name =~ /@\./) -> FALSE
(3) } # if (&User-Name) = notfound
(3) } # policy filter_username = notfound
(3) [preprocess] = ok
(3) auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(3) auth_log: --> /var/log/radius/radacct/172.26.10.34/auth-detail-20181221
(3) auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.26.10.34/auth-detail-20181221
(3) auth_log: EXPAND %t
(3) auth_log: --> Fri Dec 21 10:56:45 2018
(3) [auth_log] = ok
(3) [chap] = noop
(3) [mschap] = noop
(3) [digest] = noop
(3) suffix: Checking for suffix after "@"
(3) suffix: No '@' in User-Name = "linux", looking up realm NULL
(3) suffix: No such realm "NULL"
(3) [suffix] = noop
(3) eap: No EAP-Message, not doing EAP
(3) [eap] = noop
(3) files: Failed resolving UID: No error
(3) files: users: Matched entry DEFAULT at line 221
(3) [files] = ok
(3) sql: EXPAND %{User-Name}
(3) sql: --> linux
(3) sql: SQL-User-Name set to 'linux'
rlm_sql (sql): Closing connection (1): Hit idle_timeout, was idle for 76 seconds
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing connection (6): Hit idle_timeout, was idle for 76 seconds
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing connection (2): Hit idle_timeout, was idle for 76 seconds
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing connection (3): Hit idle_timeout, was idle for 67 seconds
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing connection (7): Hit idle_timeout, was idle for 67 seconds
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing connection (4): Hit idle_timeout, was idle for 67 seconds
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Reserved connection (0)
(3) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
(3) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'linux' ORDER BY id
(3) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'linux' ORDER BY id
(3) sql: User found in radcheck table
(3) sql: Conditional check items matched, merging assignment check items
(3) sql: MD5-Password := 0x6662656262336539353530303464363162623635616539376331656239616333
(3) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id
(3) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'linux' ORDER BY id
(3) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'linux' ORDER BY id
(3) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
(3) sql: --> SELECT groupname FROM radusergroup WHERE username = 'linux' ORDER BY priority
(3) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'linux' ORDER BY priority
(3) sql: User not found in any groups
rlm_sql (sql): Released connection (0)
Need 7 more connections to reach 10 spares
rlm_sql (sql): Opening additional connection (9), 1 of 29 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radiusdb' on Localhost via UNIX socket, server version 10.3.11-MariaDB, protocol version 10
(3) [sql] = ok
(3) [expiration] = noop
(3) [logintime] = noop
(3) pap: Normalizing MD5-Password from hex encoding, 32 bytes -> 16 bytes
(3) pap: WARNING: Auth-Type already set. Not setting to PAP
(3) [pap] = noop
(3) } # authorize = ok
(3) Found Auth-Type = pam
(3) # Executing group from file /etc/raddb/sites-enabled/default
(3) authenticate {
(3) pam: Using pamauth string "radiusd" for pam.conf lookup
(3) pam: ERROR: pam_authenticate failed: Authentication failure
(3) [pam] = reject
(3) } # authenticate = reject
(3) Failed to authenticate the user
(3) Login incorrect (pam: pam_authenticate failed: Authentication failure): [linux/linux at 123] (from client private-net1e port 0)
(3) Using Post-Auth-Type Reject
(3) # Executing group from file /etc/raddb/sites-enabled/default
(3) Post-Auth-Type REJECT {
(3) sql: EXPAND .query
(3) sql: --> .query
(3) sql: Using query template 'query'
rlm_sql (sql): Reserved connection (8)
(3) sql: EXPAND %{User-Name}
(3) sql: --> linux
(3) sql: SQL-User-Name set to 'linux'
(3) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')
(3) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'linux', 'linux at 123', 'Access-Reject', '2018-12-21 10:56:45.628824')
(3) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'linux', 'linux at 123', 'Access-Reject', '2018-12-21 10:56:45.628824')
(3) sql: SQL query returned: success
(3) sql: 1 record(s) updated
rlm_sql (sql): Released connection (8)
(3) [sql] = ok
(3) attr_filter.access_reject: EXPAND %{User-Name}
(3) attr_filter.access_reject: --> linux
(3) attr_filter.access_reject: Matched entry DEFAULT at line 11
(3) [attr_filter.access_reject] = updated
(3) [eap] = noop
(3) policy remove_reply_message_if_eap {
(3) if (&reply:EAP-Message && &reply:Reply-Message) {
(3) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(3) else {
(3) [noop] = noop
(3) } # else = noop
(3) } # policy remove_reply_message_if_eap = noop
(3) } # Post-Auth-Type REJECT = updated
(3) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(3) Sending delayed response
(3) Sent Access-Reject Id 1 from 172.24.0.10:1812 to 172.26.10.34:63261 length 20
Waking up in 3.9 seconds.
(3) Cleaning up request packet ID 1 with timestamp +91
Ready to process requests
Sum Soklang
Senior Network System Engineer
Cambo Technology ISP Co. Ltd.
+855 (0) 99 999 208
From: freeradius-users-request at lists.freeradius.org
Sent: Friday, December 21, 2018 10:36 AM
To: freeradius-users at lists.freeradius.org
Subject: Freeradius-Users Digest, Vol 164, Issue 44
Send Freeradius-Users mailing list submissions to
freeradius-users at lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.freeradius.org/mailman/listinfo/freeradius-users
or, via email, send a message with subject or body 'help' to
freeradius-users-request at lists.freeradius.org
You can reach the person managing the list at
freeradius-users-owner at lists.freeradius.org
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re: Ms-Chap + NT-Password (Alan DeKok)
2. Re: Ms-Chap + NT-Password (Anton Kiryushkin)
3. Re: Ms-Chap + NT-Password (Alan DeKok)
4. RE: Freeradius-Users Digest, Vol 164, Issue 43 (soklang.sum)
----------------------------------------------------------------------
Message: 1
Date: Thu, 20 Dec 2018 16:06:05 -0500
From: Alan DeKok <aland at deployingradius.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: Ms-Chap + NT-Password
Message-ID: <1AD55C6B-C125-4B3B-BEB9-45FFF80D38A7 at deployingradius.com>
Content-Type: text/plain; charset=us-ascii
On Dec 20, 2018, at 3:52 PM, Anton Kiryushkin <swood at fotofor.biz> wrote:
>
> Hello, Alan.
>
> I checked it.
>
> Let me show you full log:
>
> Thu Dec 20 01:10:08 2018 : Debug: (138) User-Name = "
> anonymous at espressif.com"
Please post the log from "radiusd -X" as suggested *EVERYWHERE* in the documentation.
For some unknown reason people recently seem to be ignoring all of the documentation that says to post "radiusd -X". This is mentioned in the "man" page, the Wiki, and in the email you get when you join the list.
Out of general principle, I'm going to ignore messages which fail to follow the documentation.
Re-post this with the *correct* debug log, and I will read it.
Alan DeKok.
------------------------------
Message: 2
Date: Thu, 20 Dec 2018 23:18:00 +0000
From: Anton Kiryushkin <swood at fotofor.biz>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: Ms-Chap + NT-Password
Message-ID:
<CAM_jxg2Lf_HKfGd3kU4qdbdQmq+SkUbc=-Tvk=W0+jYdzQs1OQ at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Hello, Alan.
You're right. My fault. Please see log below:
(9) User-Name = "testlogin"
(9) NAS-Port = 215
(9) State = 0x5d9ac8cb5bb0d1b476356bca7bc2305b
(9) EAP-Message =
0x022a00681900170303005d0000000000000002301470a7306238a494e48f971e6c3870bb09639041141c00594ceaf49ffe07ac3d0ecdb68988c165ca8f370152e4cc61bf8065410eb9cf70432c800237bc3f4b089aaa37633688a6abe470d7f72aacf17e16110ef7
(9) Message-Authenticator = 0x3a5c65e42a9d0494a1805e850396ff75
(9) Acct-Session-Id = "8O2.1x811d36760006c7c6"
(9) NAS-Port-Id = "ge-3/0/40.0"
(9) Calling-Station-Id = "2c-4d-54-65-19-3b"
(9) Called-Station-Id = "88-e0-f3-b0-d6-00"
(9) NAS-IP-Address = 192.168.7.2
(9) NAS-Identifier = "sw-ex6210"
(9) NAS-Port-Type = Ethernet
(9) session-state: No cached attributes
(9) # Executing section authorize from file /etc/raddb/sites-enabled/default
(9) authorize {
(9) if (!control:Cleartext-Password && &User-Password) {
(9) if (!control:Cleartext-Password && &User-Password) -> FALSE
(9) if (config:User-Password && config:Cleartext-Password) {
(9) if (config:User-Password && config:Cleartext-Password) -> FALSE
(9) [preprocess] = ok
(9) [chap] = noop
(9) [mschap] = noop
(9) suffix: Checking for suffix after "@"
(9) suffix: No '@' in User-Name = "testlogin", looking up realm NULL
(9) suffix: No such realm "NULL"
(9) [suffix] = noop
(9) eap: Peer sent EAP Response (code 2) ID 42 length 104
(9) eap: Continuing tunnel setup
(9) [eap] = ok
(9) } # authorize = ok
(9) Found Auth-Type = eap
(9) # Executing group from file /etc/raddb/sites-enabled/default
(9) authenticate {
(9) eap: Expiring EAP session with state 0x1b445c8e1b6e4610
(9) eap: Finished EAP session with state 0x5d9ac8cb5bb0d1b4
(9) eap: Previous EAP request found for state 0x5d9ac8cb5bb0d1b4, released
from the list
(9) eap: Peer sent packet with method EAP PEAP (25)
(9) eap: Calling submodule eap_peap to process data
(9) eap_peap: Continuing EAP-TLS
(9) eap_peap: [eaptls verify] = ok
(9) eap_peap: Done initial handshake
(9) eap_peap: [eaptls process] = ok
(9) eap_peap: Session established. Decoding tunneled attributes
(9) eap_peap: PEAP state phase2
(9) eap_peap: EAP method MSCHAPv2 (26)
(9) eap_peap: Got tunneled request
(9) eap_peap: EAP-Message =
0x022a00491a022a0044314bdbebd0c0d0e6a8932b5fcdc388361a00000000000000004318685452e8005b97b446f5c1c0d23265bc1198557b1aa900646d697472792e616e616e796576
(9) eap_peap: Setting User-Name to testlogin
(9) eap_peap: Sending tunneled request to default
(9) eap_peap: EAP-Message =
0x022a00491a022a0044314bdbebd0c0d0e6a8932b5fcdc388361a00000000000000004318685452e8005b97b446f5c1c0d23265bc1198557b1aa900646d697472792e616e616e796576
(9) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1
(9) eap_peap: User-Name = "testlogin"
(9) eap_peap: State = 0x1b445c8e1b6e4610f294f492105a1239
(9) Virtual server default received request
(9) EAP-Message =
0x022a00491a022a0044314bdbebd0c0d0e6a8932b5fcdc388361a00000000000000004318685452e8005b97b446f5c1c0d23265bc1198557b1aa900646d697472792e616e616e796576
(9) FreeRADIUS-Proxied-To = 127.0.0.1
(9) User-Name = "testlogin"
(9) State = 0x1b445c8e1b6e4610f294f492105a1239
(9) WARNING: Outer and inner identities are the same. User privacy is
compromised.
(9) server default {
(9) session-state: No cached attributes
(9) # Executing section authorize from file
/etc/raddb/sites-enabled/default
(9) authorize {
(9) if (!control:Cleartext-Password && &User-Password) {
(9) if (!control:Cleartext-Password && &User-Password) -> FALSE
(9) if (config:User-Password && config:Cleartext-Password) {
(9) if (config:User-Password && config:Cleartext-Password) -> FALSE
(9) [preprocess] = ok
(9) [chap] = noop
(9) [mschap] = noop
(9) suffix: Checking for suffix after "@"
(9) suffix: No '@' in User-Name = "testlogin", looking up realm NULL
(9) suffix: No such realm "NULL"
(9) [suffix] = noop
(9) eap: Peer sent EAP Response (code 2) ID 42 length 73
(9) eap: No EAP Start, assuming it's an on-going EAP conversation
(9) [eap] = updated
(9) sql-wifi: EXPAND %{User-Name}
(9) sql-wifi: --> testlogin
(9) sql-wifi: SQL-User-Name set to 'testlogin'
rlm_sql (sql-wifi): Reserved connection (2)
(9) sql-wifi: EXPAND SELECT wifi_id as id, username, 'NT-Password' as
attribute, pass_hash, ':=' as op FROM userstable WHERE username =
'%{SQL-User-Name}' ORDER BY id
(9) sql-wifi: --> SELECT wifi_id as id, username, 'NT-Password' as
attribute, pass_hash, ':=' as op FROM userstable WHERE username =
'testlogin' ORDER BY id
(9) sql-wifi: Executing select query: SELECT wifi_id as id, username,
'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE
username = 'testlogin' ORDER BY id
(9) sql-wifi: User found in radcheck table
(9) sql-wifi: Conditional check items matched, merging assignment check
items
(9) sql-wifi: NT-Password :=
0x6336623331333036323736373866653636626166393538616561356566363138
(9) sql-wifi: EXPAND SELECT wifi_id as id, username, 'NT-Password' as
attribute, pass_hash, ':=' as op FROM userstable WHERE username =
'%{SQL-User-Name}' ORDER BY id
(9) sql-wifi: --> SELECT wifi_id as id, username, 'NT-Password' as
attribute, pass_hash, ':=' as op FROM userstable WHERE username =
'testlogin' ORDER BY id
(9) sql-wifi: Executing select query: SELECT wifi_id as id, username,
'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE
username = 'testlogin' ORDER BY id
(9) sql-wifi: User found in radreply table, merging reply items
(9) sql-wifi: NT-Password :=
0x6336623331333036323736373866653636626166393538616561356566363138
(9) sql-wifi: EXPAND SELECT 'OfficeWifi' as GroupName FROM userstable WHERE
UserName='%{SQL-User-Name}'
(9) sql-wifi: --> SELECT 'OfficeWifi' as GroupName FROM userstable WHERE
UserName='testlogin'
(9) sql-wifi: Executing select query: SELECT 'OfficeWifi' as GroupName FROM
userstable WHERE UserName='testlogin'
(9) sql-wifi: User found in the group table
(9) sql-wifi: EXPAND SELECT wifi_id as id, 'OfficeWifi' as GroupName,
'NT-Password' as attribute, password, ':=' as op FROM userstable
WHERE Username = '%{SQL-User-Name}' ORDER BY id
(9) sql-wifi: --> SELECT wifi_id as id, 'OfficeWifi' as GroupName,
'NT-Password' as attribute, password, ':=' as op FROM userstable
WHERE Username = 'testlogin' ORDER BY id
(9) sql-wifi: Executing select query: SELECT wifi_id as id, 'OfficeWifi' as
GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable
WHERE Username = 'testlogin' ORDER BY id
(9) sql-wifi: Group "OfficeWifi": Conditional check items matched
(9) sql-wifi: Group "OfficeWifi": Merging assignment check items
(9) sql-wifi: NT-Password := 0x61675648496e73416b666d41
(9) sql-wifi: EXPAND SELECT wifi_id as id, 'OfficeWifi' as GroupName,
'NT-Password' as attribute, password, ':=' as op FROM userstable
WHERE Username = '%{SQL-User-Name}' ORDER BY id
(9) sql-wifi: --> SELECT wifi_id as id, 'OfficeWifi' as GroupName,
'NT-Password' as attribute, password, ':=' as op FROM userstable
WHERE Username = 'testlogin' ORDER BY id
(9) sql-wifi: Executing select query: SELECT wifi_id as id, 'OfficeWifi' as
GroupName, 'NT-Password' as attribute, password, ':=' as op FROM
userstable WHERE Username = 'testlogin' ORDER BY id
(9) sql-wifi: Group "OfficeWifi": Merging reply items
(9) sql-wifi: NT-Password := 0x61675648496e73416b666d41
rlm_sql (sql-wifi): Released connection (2)
(9) [sql-wifi] = ok
(9) pap: WARNING: Auth-Type already set. Not setting to PAP
(9) [pap] = noop
(9) } # authorize = updated
(9) Found Auth-Type = eap
(9) # Executing group from file /etc/raddb/sites-enabled/default
(9) authenticate {
(9) eap: Expiring EAP session with state 0x1b445c8e1b6e4610
(9) eap: Finished EAP session with state 0x1b445c8e1b6e4610
(9) eap: Previous EAP request found for state 0x1b445c8e1b6e4610, released
from the list
(9) eap: Peer sent packet with method EAP MSCHAPv2 (26)
(9) eap: Calling submodule eap_mschapv2 to process data
(9) eap_mschapv2: # Executing group from file
/etc/raddb/sites-enabled/default
(9) eap_mschapv2: Auth-Type MS-CHAP {
(9) mschap: WARNING: NT-Password found but incorrect length, expected 16
bytes got 12 bytes. Authentication may fail
(9) mschap: WARNING: No Cleartext-Password configured. Cannot create
NT-Password
(9) mschap: WARNING: No Cleartext-Password configured. Cannot create
LM-Password
(9) mschap: Creating challenge hash with username: testlogin
(9) mschap: Client is using MS-CHAPv2
(9) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication
(9) mschap: ERROR: MS-CHAP2-Response is incorrect
(9) [mschap] = reject
(9) } # Auth-Type MS-CHAP = reject
чт, 20 дек. 2018 г. в 21:06, Alan DeKok <aland at deployingradius.com>:
> On Dec 20, 2018, at 3:52 PM, Anton Kiryushkin <swood at fotofor.biz> wrote:
> >
> > Hello, Alan.
> >
> > I checked it.
> >
> > Let me show you full log:
> >
> > Thu Dec 20 01:10:08 2018 : Debug: (138) User-Name = "
> > anonymous at espressif.com"
>
> Please post the log from "radiusd -X" as suggested *EVERYWHERE* in the
> documentation.
>
> For some unknown reason people recently seem to be ignoring all of the
> documentation that says to post "radiusd -X". This is mentioned in the
> "man" page, the Wiki, and in the email you get when you join the list.
>
> Out of general principle, I'm going to ignore messages which fail to
> follow the documentation.
>
> Re-post this with the *correct* debug log, and I will read it.
>
> Alan DeKok.
>
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
--
Best regards,
Anton Kiryushkin
------------------------------
Message: 3
Date: Thu, 20 Dec 2018 19:13:12 -0500
From: Alan DeKok <aland at deployingradius.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: Ms-Chap + NT-Password
Message-ID: <CF585B0B-C5DC-4341-9620-1879A9BD52C0 at deployingradius.com>
Content-Type: text/plain; charset=us-ascii
On Dec 20, 2018, at 6:18 PM, Anton Kiryushkin <swood at fotofor.biz> wrote:
> You're right. My fault. Please see log below:
Thanks.
> ...
> (9) sql-wifi: Conditional check items matched, merging assignment check
> items
> (9) sql-wifi: NT-Password :=
> 0x6336623331333036323736373866653636626166393538616561356566363138
Again... that's all ASCII data. You've taken the hex form of the string:
c6b3130627678fe66baf958aea5ef618
And instead of just putting this into SQL:
NT-Password := 0xc6b3130627678fe66baf958aea5ef618
You've converted the ASCII representation to hex again... and then set that as the NT password.
Don't do that.
> ...
> (9) eap_mschapv2: Auth-Type MS-CHAP {
> (9) mschap: WARNING: NT-Password found but incorrect length, expected 16
> bytes got 12 bytes. Authentication may fail
And the NT password is mangled, as noted above.
Why are you converting the hex string to ASCII *twice*? Just take the output of smbencrypt, put a "0x" in front of it, and set it as NT-Password in the database:
Again:
$ smbencrypt hello
LM Hash NT Hash
-------------------------------- --------------------------------
FDA95FBECA288D44AAD3B435B51404EE 066DDFD4EF0E9CD7C256FE77191EF43C
And then:
NT-Password := 0x066DDFD4EF0E9CD7C256FE77191EF43C
You *don't* have to hex-encode the hex output of smbencrypt.
Alan DeKok.
------------------------------
Message: 4
Date: Fri, 21 Dec 2018 10:35:31 +0700
From: "soklang.sum" <soklang.sum at cambotech.com>
To: "freeradius-users at lists.freeradius.org"
<freeradius-users at lists.freeradius.org>
Subject: RE: Freeradius-Users Digest, Vol 164, Issue 43
Message-ID: <5c1c5f83.1c69fb81.e454f.3e46 at mx.google.com>
Content-Type: text/plain; charset="utf-8"
Dear Support,
I would like to add google authenticator with freeradius. Please kindly assist to support as possible.
When I enable in /etc/freeradius/users
# Instruct FreeRADIUS to use PAM to authenticate users
DEFAULT Auth-Type := PAM
Username and password always reject PAM of user in MySQL.
Best regards,
Sum Soklang
Senior Network System Engineer
Cambo Technology ISP Co. Ltd.
+855 (0) 99 999 208
From: freeradius-users-request at lists.freeradius.org
Sent: Friday, December 21, 2018 3:54 AM
To: freeradius-users at lists.freeradius.org
Subject: Freeradius-Users Digest, Vol 164, Issue 43
Send Freeradius-Users mailing list submissions to
freeradius-users at lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.freeradius.org/mailman/listinfo/freeradius-users
or, via email, send a message with subject or body 'help' to
freeradius-users-request at lists.freeradius.org
You can reach the person managing the list at
freeradius-users-owner at lists.freeradius.org
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re: why user dosn`t connect ? (Alan DeKok)
2. Re: why user dosn`t connect ? (Alan Buxey)
3. Re: Capacity calculation (Alan Buxey)
4. Re: why user dosn`t connect ? (تعلم البرمجة)
5. Re: why user dosn`t connect ? (Alan Buxey)
6. Re: why user dosn`t connect ? (Alan DeKok)
7. Re: why user dosn`t connect ? (Alan Buxey)
8. Re: Ms-Chap + NT-Password (Anton Kiryushkin)
----------------------------------------------------------------------
Message: 1
Date: Thu, 20 Dec 2018 10:18:33 -0500
From: Alan DeKok <aland at deployingradius.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: why user dosn`t connect ?
Message-ID: <C061CF1B-7A61-493D-AE3F-6D1FF10E92AB at deployingradius.com>
Content-Type: text/plain; charset=utf-8
> On Dec 20, 2018, at 9:51 AM, تعلم البرمجة <mido2010bona at gmail.com> wrote:
>
> but why not added to radacct !!
If you're going to reply to your own messages, then PLEASE edit them so you don't post thousands of lines of the same debug output.
As for why there's no accounting packets, this is in the FAQ.
The NAS is supposed to send accounting packets. Poking FreeRADIUS won't magically make the NAS send accounting packets.
Go configure the NAS.
Alan DeKok.
------------------------------
Message: 2
Date: Thu, 20 Dec 2018 17:12:29 +0000
From: Alan Buxey <alan.buxey at gmail.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: why user dosn`t connect ?
Message-ID:
<CAOVYXj9dPO6m_PxKAxd1HL0_AZVC+n6174-8ZKMxt4=O7z=vpQ at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
hi,
but why not added to radacct !!
>
because the packet received by the server was an access-request, not an
accounting-start, interim update or stop. so no accounting
things were done.
alan
------------------------------
Message: 3
Date: Thu, 20 Dec 2018 17:18:23 +0000
From: Alan Buxey <alan.buxey at gmail.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: Capacity calculation
Message-ID:
<CAOVYXj9Jgz3-JOgi-iM6Jejp=vTYaKgsfu-kWUKx9Ku5PKJaVw at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
hi,
I want to understand how much TPS freeRADIUS will support for below
> configuration along with postgresql DB
>
>
as Nathan has said - this all depends on your configuration, requirements,
processes/policies that need to be dealt with, etc
you can easily do some local benchmarking on a local VM to work out
requirements for scaling - obviously the memory
requirement will be related to DB requirements (caching etc) - usually the
system will be constrained by steps such as
DB inserts etc (if doing live ones) rather than CPU - small institutions
could probably run FR on a RaspberryPi ...
alan
------------------------------
Message: 4
Date: Thu, 20 Dec 2018 19:21:27 +0200
From: تعلم البرمجة <mido2010bona at gmail.com>
To: freeradius-users at lists.freeradius.org
Subject: Re: why user dosn`t connect ?
Message-ID:
<CACe-uLw4kUSF6xP_tLH34EhvzZsmmYxs2GV9hCL09fbFa7qoOA at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
thanks allan , i get this error message "User or Chap Password in
non-access request"
>
>
------------------------------
Message: 5
Date: Thu, 20 Dec 2018 17:22:39 +0000
From: Alan Buxey <alan.buxey at gmail.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: why user dosn`t connect ?
Message-ID:
<CAOVYXj-hicmjZVHAMVNpYE_yqrkWT_9G-bBbBGf_=W+BV8TVqQ at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
hi,
your sending access requests to port 1813 of the server?
alan
On Thu, 20 Dec 2018 at 17:22, تعلم البرمجة <mido2010bona at gmail.com>
wrote:
> thanks allan , i get this error message "User or Chap Password in
> non-access request"
>
> >
> >
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
------------------------------
Message: 6
Date: Thu, 20 Dec 2018 12:24:35 -0500
From: Alan DeKok <aland at deployingradius.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: why user dosn`t connect ?
Message-ID: <7BBEF01A-206F-46DB-BF3E-2FE7326F31F7 at deployingradius.com>
Content-Type: text/plain; charset=utf-8
> On Dec 20, 2018, at 12:21 PM, تعلم البرمجة <mido2010bona at gmail.com> wrote:
>
> thanks allan , i get this error message "User or Chap Password in
> non-access request"
That message doesn't come from FreeRADIUS.
Alan DeKok.
------------------------------
Message: 7
Date: Thu, 20 Dec 2018 17:27:06 +0000
From: Alan Buxey <alan.buxey at gmail.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: why user dosn`t connect ?
Message-ID:
<CAOVYXj8c4XNngZ3-XAbxLk69WsDaQpDVgV65b42KfhEfHJQ=wg at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
indeed, looks like its from php-radius
https://github.com/LawnGnome/php-radius
alan
------------------------------
Message: 8
Date: Thu, 20 Dec 2018 20:52:14 +0000
From: Anton Kiryushkin <swood at fotofor.biz>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: Ms-Chap + NT-Password
Message-ID:
<CAM_jxg1hM8OLdKf0yHP6KkoXSRL+aCkfQHqk0ezQX+r1KPXcDw at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Hello, Alan.
I checked it.
Let me show you full log:
Thu Dec 20 01:10:08 2018 : Debug: (138) User-Name = "
anonymous at espressif.com"
Thu Dec 20 01:10:08 2018 : Debug: (138) Chargeable-User-Identity = 0x00
Thu Dec 20 01:10:08 2018 : Debug: (138) Location-Capable = Civic-Location
Thu Dec 20 01:10:08 2018 : Debug: (138) Calling-Station-Id =
"38-2b-78-03-ee-70"
Thu Dec 20 01:10:08 2018 : Debug: (138) Called-Station-Id =
"cc-46-d6-09-ed-50:BD"
Thu Dec 20 01:10:08 2018 : Debug: (138) NAS-Port = 13
Thu Dec 20 01:10:08 2018 : Debug: (138) Cisco-AVPair =
"audit-session-id=c0a807c8000000015ba9aa3b"
Thu Dec 20 01:10:08 2018 : Debug: (138) Acct-Session-Id =
"5ba9aa3b/38:2b:78:03:ee:70/1"
Thu Dec 20 01:10:08 2018 : Debug: (138) NAS-IP-Address = 192.168.1.200
Thu Dec 20 01:10:08 2018 : Debug: (138) NAS-Identifier = "wc-5508"
Thu Dec 20 01:10:08 2018 : Debug: (138) Airespace-Wlan-Id = 14
Thu Dec 20 01:10:08 2018 : Debug: (138) Service-Type = Framed-User
Thu Dec 20 01:10:08 2018 : Debug: (138) Framed-MTU = 1300
Thu Dec 20 01:10:08 2018 : Debug: (138) NAS-Port-Type = Wireless-802.11
Thu Dec 20 01:10:08 2018 : Debug: (138) Tunnel-Type:0 = VLAN
Thu Dec 20 01:10:08 2018 : Debug: (138) Tunnel-Medium-Type:0 = IEEE-802
Thu Dec 20 01:10:08 2018 : Debug: (138) Tunnel-Private-Group-Id:0 = "14"
Thu Dec 20 01:10:08 2018 : Debug: (138) EAP-Message =
0x0207007b19001703020070493c43a0045e1a736402d6353c2ebfd02b02b3da47074e8043e42814d384055eb07d8a3fdf5fc763651fee8a9c19e2525e0450f5bee24195a432757be658ec4fec63f0d1a904eaed55de4f98bc097aca893e67f8761a530e374122b3ba2c61eab23cf1af3ecd9ab8edf2907b
Thu Dec 20 01:10:08 2018 : Debug: (138) State =
0x9a0fd4fc9e08cd9b875e606333810d4e
Thu Dec 20 01:10:08 2018 : Debug: (138) Message-Authenticator =
0x3b8a82762eef0a453f82a36821b263f2
Thu Dec 20 01:10:08 2018 : Debug: (138) session-state: No cached attributes
Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing section authorize from
file /etc/raddb/sites-enabled/default
Thu Dec 20 01:10:08 2018 : Debug: (138) authorize {
Thu Dec 20 01:10:08 2018 : Debug: (138) if (!control:Cleartext-Password
&& &User-Password) {
Thu Dec 20 01:10:08 2018 : Debug: (138) if (!control:Cleartext-Password
&& &User-Password) -> FALSE
Thu Dec 20 01:10:08 2018 : Debug: (138) if (config:User-Password &&
config:Cleartext-Password) {
Thu Dec 20 01:10:08 2018 : Debug: (138) if (config:User-Password &&
config:Cleartext-Password) -> FALSE
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
preprocess (rlm_preprocess)
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned
from preprocess (rlm_preprocess)
Thu Dec 20 01:10:08 2018 : Debug: (138) [preprocess] = ok
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
chap (rlm_chap)
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned
from chap (rlm_chap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [chap] = noop
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
mschap (rlm_mschap)
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned
from mschap (rlm_mschap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [mschap] = noop
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
suffix (rlm_realm)
Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: Checking for suffix after
"@"
Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: Looking up realm "
espressif.com" for User-Name = "anonymous at espressif.com"
Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: No such realm "espressif.com
"
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned
from suffix (rlm_realm)
Thu Dec 20 01:10:08 2018 : Debug: (138) [suffix] = noop
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
eap (rlm_eap)
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent EAP Response (code
2) ID 7 length 123
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Continuing tunnel setup
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned
from eap (rlm_eap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [eap] = ok
Thu Dec 20 01:10:08 2018 : Debug: (138) } # authorize = ok
Thu Dec 20 01:10:08 2018 : Debug: (138) Found Auth-Type = eap
Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing group from file
/etc/raddb/sites-enabled/default
Thu Dec 20 01:10:08 2018 : Debug: (138) authenticate {
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]:
calling eap (rlm_eap)
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Expiring EAP session with
state 0x0d5314a80d540ec8
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Finished EAP session with
state 0x9a0fd4fc9e08cd9b
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Previous EAP request found for
state 0x9a0fd4fc9e08cd9b, released from the list
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent packet with method
EAP PEAP (25)
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Calling submodule eap_peap to
process data
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Continuing EAP-TLS
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Peer sent flags ---
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: [eaptls verify] = ok
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Done initial handshake
Thu Dec 20 01:10:08 2018 : Debug: Ignoring cbtls_msg call with pseudo
content type 256, version 0
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: [eaptls process] = ok
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Session established.
Decoding tunneled attributes
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: PEAP state phase2
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP method MSCHAPv2 (26)
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Got tunneled request
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP-Message =
0x020700441a0207003f3199f6449a50fa3b50be389565dde6ae4b0000000000000000e78496d30625840ded712d0b260d96bead07a7fdd950530a00792e6c696c656b6f76
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Setting User-Name to
testlogin
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Sending tunneled request
to default
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP-Message =
0x020700441a0207003f3199f6449a50fa3b50be389565dde6ae4b0000000000000000e78496d30625840ded712d0b260d96bead07a7fdd950530a00792e6c696c656b6f76
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: FreeRADIUS-Proxied-To =
127.0.0.1
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: User-Name = “testlogin"
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: State =
0x0d5314a80d540ec8eca17483a9cfe203
Thu Dec 20 01:10:08 2018 : Debug: (138) Virtual server default received
request
Thu Dec 20 01:10:08 2018 : Debug: (138) EAP-Message =
0x020700441a0207003f3199f6449a50fa3b50be389565dde6ae4b0000000000000000e78496d30625840ded712d0b260d96bead07a7fdd950530a00792e6c696c656b6f76
Thu Dec 20 01:10:08 2018 : Debug: (138) FreeRADIUS-Proxied-To = 127.0.0.1
Thu Dec 20 01:10:08 2018 : Debug: (138) User-Name = "testlogin "
Thu Dec 20 01:10:08 2018 : Debug: (138) State =
0x0d5314a80d540ec8eca17483a9cfe203
Thu Dec 20 01:10:08 2018 : Debug: (138) server default {
Thu Dec 20 01:10:08 2018 : Debug: (138) session-state: No cached
attributes
Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing section authorize
from file /etc/raddb/sites-enabled/default
Thu Dec 20 01:10:08 2018 : Debug: (138) authorize {
Thu Dec 20 01:10:08 2018 : Debug: (138) if
(!control:Cleartext-Password && &User-Password) {
Thu Dec 20 01:10:08 2018 : Debug: (138) if
(!control:Cleartext-Password && &User-Password) -> FALSE
Thu Dec 20 01:10:08 2018 : Debug: (138) if (config:User-Password &&
config:Cleartext-Password) {
Thu Dec 20 01:10:08 2018 : Debug: (138) if (config:User-Password &&
config:Cleartext-Password) -> FALSE
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
preprocess (rlm_preprocess)
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]:
returned from preprocess (rlm_preprocess)
Thu Dec 20 01:10:08 2018 : Debug: (138) [preprocess] = ok
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
chap (rlm_chap)
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]:
returned from chap (rlm_chap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [chap] = noop
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
mschap (rlm_mschap)
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]:
returned from mschap (rlm_mschap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [mschap] = noop
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
suffix (rlm_realm)
Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: Checking for suffix after
"@"
Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: No '@' in User-Name =
“testlogin", looking up realm NULL
Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: No such realm "NULL"
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]:
returned from suffix (rlm_realm)
Thu Dec 20 01:10:08 2018 : Debug: (138) [suffix] = noop
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
eap (rlm_eap)
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent EAP Response (code
2) ID 7 length 68
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: No EAP Start, assuming it's an
on-going EAP conversation
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]:
returned from eap (rlm_eap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [eap] = updated
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
sql-wifi (rlm_sql)
Thu Dec 20 01:10:08 2018 : Debug: %{User-Name}
Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree:
Thu Dec 20 01:10:08 2018 : Debug: attribute --> User-Name
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND %{User-Name}
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> testlogin
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: SQL-User-Name set to
’testlogin'
Thu Dec 20 01:10:08 2018 : Info: rlm_sql (sql-wifi): Closing connection
(28): Hit idle_timeout, was idle for 80 seconds
Thu Dec 20 01:10:08 2018 : Debug: rlm_sql (sql-wifi): You probably need to
lower "min"
Thu Dec 20 01:10:08 2018 : Debug: rlm_sql_mysql: Socket destructor called,
closing socket
Thu Dec 20 01:10:08 2018 : Debug: rlm_sql (sql-wifi): Reserved connection
(19)
Thu Dec 20 01:10:08 2018 : Debug: SELECT wifi_id as id, UserName,
'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE
username = '%{SQL-User-Name}' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree:
Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT wifi_id as id,
UserName, 'NT-Password' as attribute, pass_hash, ':=' as op FROM
userstable WHERE username = '
Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name
Thu Dec 20 01:10:08 2018 : Debug: literal --> ' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT wifi_id as
id, UserName, 'NT-Password' as attribute, pass_hash, ':=' as op FROM
userstable WHERE username = '%{SQL-User-Name}' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT wifi_id as
id, UserName, 'NT-Password' as attribute, pass_hash, ':=' as op FROM
userstable WHERE username = ’testlogin' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query:
SELECT wifi_id as id, UserName, 'NT-Password' as attribute, pass_hash, ':='
as op FROM userstable WHERE username = ’testlogin' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: User found in radcheck
table
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Conditional check items
matched, merging assignment check items
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password :=
0x3161666532333532663366363365333136376163646230306136646366386235
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 1 MAX 2
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: APPENDING NT-Password
FROM 0 TO 1
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 1 out 1
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[0] = Auth-Type
Thu Dec 20 01:10:08 2018 : Debug: SELECT wifi_id as id, username,
'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE
username = '%{SQL-User-Name}' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree:
Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT wifi_id as id,
username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM
userstable WHERE username = '
Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name
Thu Dec 20 01:10:08 2018 : Debug: literal --> ' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT wifi_id as
id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM
userstable WHERE username = '%{SQL-User-Name}' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT wifi_id as
id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM
userstable WHERE username = ’testlogin' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query:
SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':='
as op FROM userstable WHERE username = ’testlogin' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: User found in radreply
table, merging reply items
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password :=
0x3161666532333532663366363365333136376163646230306136646366386235
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 0 MAX 1
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: APPENDING NT-Password
FROM 0 TO 0
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 0 out 0
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ... falling-through to
group processing
Thu Dec 20 01:10:08 2018 : Debug: SELECT 'OfficeWifi' as GroupName FROM
userstable WHERE UserName='%{SQL-User-Name}'
Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree:
Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT 'OfficeWifi' as
GroupName FROM userstable WHERE UserName='
Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name
Thu Dec 20 01:10:08 2018 : Debug: literal --> '
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT
'OfficeWifi' as GroupName FROM userstable WHERE UserName='%{SQL-User-Name}'
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT
'OfficeWifi' as GroupName FROM userstable WHERE UserName='testlogin'
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query:
SELECT 'OfficeWifi' as GroupName FROM userstable WHERE UserName='testlogin'
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: User found in the group
table
Thu Dec 20 01:10:08 2018 : Debug: SELECT wifi_id as id, 'OfficeWifi' as
GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable
WHERE Username = '%{SQL-User-Name}' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree:
Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT wifi_id as id,
'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':='
as op FROM
userstable WHERE Username = '
Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name
Thu Dec 20 01:10:08 2018 : Debug: literal --> ' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT wifi_id as
id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':='
as op FROM userstable WHERE Username = '%{SQL-User-Name}'
ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT wifi_id as
id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':='
as op FROM userstable WHERE Username = ’testlogin'
ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query:
SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as
attribute, password, ':=' as op FROM userstable WHERE Username =
'testlogin' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Group "OfficeWifi":
Conditional check items matched
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Group "OfficeWifi":
Merging assignment check items
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password :=
0x696e616d6974414c545a694e3039393021
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 2 MAX 3
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: OVERWRITING
NT-Password FROM 0 TO 1
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 2 out 2
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[0] = Auth-Type
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[1] = NT-Password
Thu Dec 20 01:10:08 2018 : Debug: SELECT wifi_id as id, 'OfficeWifi' as
GroupName, 'NT-Password' as attribute, password, ':=' as op FROM
userstable WHERE Username = '%{SQL-User-Name}' ORDER BY
id
Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree:
Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT wifi_id as id,
'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op
FROM userstable WHERE Username = '
Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name
Thu Dec 20 01:10:08 2018 : Debug: literal --> ' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT wifi_id as
id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':='
as op FROM userstable WHERE Username = '%{SQL-User-Name}'
ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT wifi_id as
id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':='
as op FROM userstable WHERE Username = 'testlogin'
ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query:
SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as
attribute, password, ':=' as op FROM userstable WHERE
Username = 'testlogin' ORDER BY id
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Group "OfficeWifi":
Merging reply items
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password :=
0x696e616d6974414c545a694e3039393021
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 1 MAX 2
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: OVERWRITING
NT-Password FROM 0 TO 0
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 1 out 1
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[0] = NT-Password
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ... falling-through to
profile processing
Thu Dec 20 01:10:08 2018 : Debug: rlm_sql (sql-wifi): Released connection
(19)
Thu Dec 20 01:10:08 2018 : Info: Need 1 more connections to reach min
connections (5)
Thu Dec 20 01:10:08 2018 : Info: rlm_sql (sql-wifi): Opening additional
connection (30), 1 of 6 pending slots used
Thu Dec 20 01:10:08 2018 : Debug: rlm_sql_mysql: Starting connect to MySQL
server
Thu Dec 20 01:10:08 2018 : Debug: rlm_sql_mysql: Connected to database
'vpn_wifi' on 127.0.0.1 via TCP/IP, server version 5.7.19-17-log, protocol
version 10
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]:
returned from sql-wifi (rlm_sql)
Thu Dec 20 01:10:08 2018 : Debug: (138) [sql-wifi] = ok
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling
pap (rlm_pap)
Thu Dec 20 01:10:08 2018 : WARNING: (138) pap: Auth-Type already set. Not
setting to PAP
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]:
returned from pap (rlm_pap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [pap] = noop
Thu Dec 20 01:10:08 2018 : Debug: (138) } # authorize = updated
Thu Dec 20 01:10:08 2018 : Debug: (138) Found Auth-Type = eap
Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing group from file
/etc/raddb/sites-enabled/default
Thu Dec 20 01:10:08 2018 : Debug: (138) authenticate {
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]:
calling eap (rlm_eap)
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Expiring EAP session with
state 0x0d5314a80d540ec8
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Finished EAP session with
state 0x0d5314a80d540ec8
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Previous EAP request found for
state 0x0d5314a80d540ec8, released from the list
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent packet with method
EAP MSCHAPv2 (26)
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Calling submodule eap_mschapv2
to process data
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_mschapv2: # Executing group
from file /etc/raddb/sites-enabled/default
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_mschapv2: Auth-Type MS-CHAP {
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_mschapv2:
modsingle[authenticate]: calling mschap (rlm_mschap)
Thu Dec 20 01:10:08 2018 : WARNING: (138) mschap: NT-Password found but
incorrect length, expected 16 bytes got 17 bytes. Authentication may fail
Thu Dec 20 01:10:08 2018 : WARNING: (138) mschap: No Cleartext-Password
configured. Cannot create NT-Password
Thu Dec 20 01:10:08 2018 : WARNING: (138) mschap: No Cleartext-Password
configured. Cannot create LM-Password
Thu Dec 20 01:10:08 2018 : Debug: (138) mschap: Creating challenge hash
with username: testlogin
Thu Dec 20 01:10:08 2018 : Debug: (138) mschap: Client is using MS-CHAPv2
Thu Dec 20 01:10:08 2018 : ERROR: (138) mschap: FAILED: No NT/LM-Password.
Cannot perform authentication
Thu Dec 20 01:10:08 2018 : ERROR: (138) mschap: MS-CHAP2-Response is
incorrect
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]:
returned from mschap (rlm_mschap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [mschap] = reject
Thu Dec 20 01:10:08 2018 : Debug: (138) } # Auth-Type MS-CHAP = reject
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Sending EAP Failure (code 4)
ID 7 length 4
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Freeing handler
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]:
returned from eap (rlm_eap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [eap] = reject
Thu Dec 20 01:10:08 2018 : Debug: (138) } # authenticate = reject
Thu Dec 20 01:10:08 2018 : Debug: (138) Failed to authenticate the user
Thu Dec 20 01:10:08 2018 : Debug: (138) Using Post-Auth-Type Reject
Thu Dec 20 01:10:08 2018 : Debug: (138) Post-Auth-Type sub-section not
found. Ignoring.
Thu Dec 20 01:10:08 2018 : Auth: (138) Login incorrect (mschap: FAILED:
No NT/LM-Password. Cannot perform authentication): [testlogin/<via
Auth-Type = eap>] (from client WC-5508_ port 0 via TLS tunnel)
Thu Dec 20 01:10:08 2018 : Debug: (138) } # server default
Thu Dec 20 01:10:08 2018 : Debug: (138) Virtual server sending reply
Thu Dec 20 01:10:08 2018 : Debug: (138) NT-Password =
0x696e616d6974414c545a694e3039393021
Thu Dec 20 01:10:08 2018 : Debug: (138) MS-CHAP-Error = "\007E=691 R=1
C=86e3f7442e804d519197bbbf0301334f V=3 M=Authentication rejected"
Thu Dec 20 01:10:08 2018 : Debug: (138) EAP-Message = 0x04070004
Thu Dec 20 01:10:08 2018 : Debug: (138) Message-Authenticator =
0x00000000000000000000000000000000
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Got tunneled reply code 3
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: NT-Password =
0x696e616d6974414c545a694e3039393021
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: MS-CHAP-Error =
"\007E=691 R=1 C=86e3f7442e804d519197bbbf0301334f V=3 M=Authentication
rejected"
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP-Message = 0x04070004
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Message-Authenticator =
0x00000000000000000000000000000000
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Got tunneled reply RADIUS
code 3
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: NT-Password =
0x696e616d6974414c545a694e3039393021
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: MS-CHAP-Error =
"\007E=691 R=1 C=86e3f7442e804d519197bbbf0301334f V=3 M=Authentication
rejected"
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP-Message = 0x04070004
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Message-Authenticator =
0x00000000000000000000000000000000
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Tunneled authentication
was rejected
Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: FAILURE
Thu Dec 20 01:10:08 2018 : Debug: Ignoring cbtls_msg call with pseudo
content type 256, version 0
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Sending EAP Request (code 1)
ID 8 length 59
Thu Dec 20 01:10:08 2018 : Debug: (138) eap: EAP session adding
&reply:State = 0x9a0fd4fc9f07cd9b
Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]:
returned from eap (rlm_eap)
Thu Dec 20 01:10:08 2018 : Debug: (138) [eap] = handled
Thu Dec 20 01:10:08 2018 : Debug: (138) } # authenticate = handled
Thu Dec 20 01:10:08 2018 : Debug: (138) Using Post-Auth-Type Challenge
Thu Dec 20 01:10:08 2018 : Debug: (138) Post-Auth-Type sub-section not
found. Ignoring.
Thu Dec 20 01:10:08 2018 : Debug: (138) session-state: Nothing to cache
Could you please explain, what for you mean with "It looks like you've
taken the input password, and then tried to use that as the NT hash."?
Which way I have to use for my case?
And what exactly meaning strings below:
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password :=
0x696e616d6974414c545a694e3039393021
Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password :=
0x3161666532333532663366363365333136376163646230306136646366386235
That isn't my real hashes. Yes, I used the same hash as you provided via
smbencrypt.
I can provide with you my full configuration file as well is it could help.
чт, 20 дек. 2018 г. в 11:40, Alan DeKok <aland at deployingradius.com>:
> On Dec 20, 2018, at 2:47 AM, Anton Kiryushkin <swood at fotofor.biz> wrote:
> >
> > Hello, Matthew.
> >
> > Yes, I have the same fear about the hash.
> > I made it in the two ways:
> > - hash=$(printf '%s' "${pass}" | iconv -t utf16le | openssl md4
> 2>/dev/null
> > | awk '{print $NF}')
> > - smbencrypt
> >
> > Both ways are equal. Which method is right in my case?
>
> smbencrypt it preferred. I use:
>
> $ smbencrypt hello
> LM Hash NT Hash
> -------------------------------- --------------------------------
> FDA95FBECA288D44AAD3B435B51404EE 066DDFD4EF0E9CD7C256FE77191EF43C
>
> And the use the NT hash.
>
> There is just no way that an input password ends up being *all* ASCII
> characters after hashing. It looks like you've taken the input password,
> and then tried to use that as the NT hash.
>
> Alan DeKok.
>
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
--
Best regards,
Anton Kiryushkin
------------------------------
Subject: Digest Footer
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------
End of Freeradius-Users Digest, Vol 164, Issue 43
*************************************************
------------------------------
Subject: Digest Footer
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------
End of Freeradius-Users Digest, Vol 164, Issue 44
*************************************************
More information about the Freeradius-Users
mailing list