Re: EAP-MD5 auth failure

Artur Hecker Mon, 03 Mar 2003 08:46:58 -0800

i would put the eap module as the last one in authorize and as the only one in the authenticate, just like in the faq. why don't you begin with a _simple_ configuration and add things later? why are you using a huge one with 10 modules in every section?

and then, is your user configured properly? Auth-Type := Local?

ciao
artur

[EMAIL PROTECTED] wrote:

yes I also think there's something wrong in the configuration. I put in attach my authorize/authenticate section configuration. Where do you think I'm getting wrong??

Thank you very much for your help!!
emi

hi

comments inline.

I'm trying to authenticate a client with EAP-MD5. I followed directives coming from the link

http://www.freeradius.org/doc/EAP-MD5.html, but I have some problems. In attach is reported the output of radiusd -X. Could someone give a little look to it and help me to understand the meaning of those messages? I don't understand for example why there are message related to rlm_chap whereas rlm_eap is not mentioned.

Thanks in advance,

emi

i think that your authenticate/authorize sections are not properly configured since the eap module is not involved in request processing.

check the configuration.

ciao
artur

------------------------------------------------------------------------

rad_recv: Access-Request packet from host 172.31.71.202:1212, id=186, length=144
       User-Name = "pippo"
       Cisco-AVPair = "ssid=tsunami"
       NAS-IP-Address = 172.31.71.202
       Called-Station-Id = "000bfd04198e"
       Calling-Station-Id = "000b46563147"
       NAS-Identifier = "AP1200-04198e"
       NAS-Port = 37
       Framed-MTU = 1400
       NAS-Port-Type = Wireless-802.11
       EAP-Message = "\002\002\000\n\001pippo"
       Message-Authenticator = 0x66fe8b278590ec51c42880de858063e1
modcall: entering group authorize
 modcall[authorize]: module "preprocess" returns ok
rlm_chap: Could not find proper Chap-Password attribute in request
 modcall[authorize]: module "chap" returns noop
 modcall[authorize]: module "mschap" returns notfound
 modcall[authorize]: module "eap" returns updated
   rlm_realm: No '@' in User-Name = "pippo", looking up realm NULL
   rlm_realm: No such realm NULL
 modcall[authorize]: module "suffix" returns noop
   users: Matched pippo at 65
 modcall[authorize]: module "files" returns ok
modcall: group authorize returns updated
 rad_check_password:  Found Auth-Type EAP
 rad_check_password:  Found Auth-Type Local
Warning:  Found 2 auth-types on request for user 'pippo'
auth: type Local
auth: No User-Password or CHAP-Password attribute in the request
auth: Failed to validate the user.
Delaying request 4 for 1 seconds
Finished request 4
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Sending Access-Reject of id 186 to 172.31.71.202:1212
Waking up in 4 seconds...
--- Walking the entire request list ---
Cleaning up request 4 ID 186 with timestamp 3e63636b
Nothing to do.  Sleeping until we see a request.

------------------------------------------------------------------------

modules {... # Extensible Authentication Protocol # # For all EAP related authentications eap { # Invoke the default supported EAP type when # EAP-Identity response is received # default_eap_type = md5

                # Default expiry time to clean the EAP list,
                # It is maintained to co-relate the
                # EAP-response for each EAP-request sent.
                #       timer_expire     = 60

# Supported EAP-types

                    default_eap_type=md5
                    md5 {
                }


authorize {
        #
        #  The preprocess module takes care of sanitizing some bizarre
        #  attributes in the request, and turning them into attributes
        #  which are more standard.
        #
        #  It takes care of processing the 'raddb/hints' and the
        #  'raddb/huntgroups' files.
        #
        #  It also adds a Client-IP-Address attribute to the request.
        preprocess
        
        #
        #  The chap module will set 'Auth-Type := CHAP' if we are
        #  handling a CHAP request and Auth-Type has not already been set
        chap

        #
        #  If the users are logging in with an MS-CHAP-Challenge
        #  attribute for authentication, the mschap module will find
        #  the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP'
        #  to the request, which will cause the server to then use
        #  the mschap module for authentication.
        mschap

        counter
        attr_filter

eap

        suffix
        files
        etc_smbpasswd

# The ldap module will set Auth-Type to LDAP if it has not already been set ldap }


authenticate {
          #
        #  PAP authentication, when a back-end database listed
        #  in the 'authorize' section supplies a password.  The
        #  password can be clear-text, or encrypted.
        authtype PAP {
                pap
        }

        #
        #  Most people want CHAP authentication
        #  A back-end database listed in the 'authorize' section
        #  MUST supply a CLEAR TEXT password.  Encrypted passwords
        #  won't work.
        authtype CHAP {
                chap
        }

        #
        #  MSCHAP authentication.
        authtype MS-CHAP {
                mschap
        }

pam

# # See 'man getpwent' for information on how the 'unix' # module checks the users password. Note that packets # containing CHAP-Password attributes CANNOT be authenticated # against /etc/passwd! See the FAQ for details. # unix

        # Uncomment it if you want to use ldap for authentication
        authtype LDAP {
                ldap
        }

eap }

--
Artur Hecker
Département Informatique et Réseaux, ENST Paris
http://www.infres.enst.fr/~hecker


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: EAP-MD5 auth failure

Reply via email to