Re: Reply-Message

Christopher Price Fri, 08 Oct 2004 05:40:28 -0700

I was told to change as little as possible in the configuration files and PEAP/MSCHAPv2 using Microsoft's 802.1x client with and LDAP backend DB would work fine. This is not the case and I would appreciate any suggestions on what to modify to make this work. The only portion of the config that I changed was the ldap module section (to point to my ldap server) and the ldap line in the authorize section (uncommented the single line). I have included some output from the server when I attempt to authenticate.

Starting - reading configuration files ...

Using deprecated naslist file. Support for this will go away soon.

Module: Loaded exec

rlm_exec: Wait=yes but no output defined. Did you mean output=none?

Module: Instantiated exec (exec)

Module: Loaded expr

Module: Instantiated expr (expr)

Module: Loaded PAP

Module: Instantiated pap (pap)

Module: Loaded CHAP

Module: Instantiated chap (chap)

Module: Loaded MS-CHAP

Module: Instantiated mschap (mschap)

Module: Loaded System

Module: Instantiated unix (unix)

Module: Loaded eap

rlm_eap: Loaded and initialized type md5

rlm_eap: Loaded and initialized type leap

rlm_eap: Loaded and initialized type gtc

rlm_eap: Loaded and initialized type mschapv2

Module: Instantiated eap (eap)

Module: Loaded preprocess

Module: Instantiated preprocess (preprocess)

Module: Loaded realm

Module: Instantiated realm (suffix)

Module: Loaded files

Module: Instantiated files (files)

Module: Loaded LDAP

rlm_ldap: Registering ldap_groupcmp for Ldap-Group

rlm_ldap: Registering ldap_xlat with xlat_name ldap

rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap

rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$

rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$

rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type

rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use

rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id

rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id

rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password

rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password

rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT

rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration

rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type

rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol

rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address

rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask

rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route

rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing

rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id

rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU

rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression

rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host

rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service

rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port

rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number

rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id

rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network

rlm_ldap: LDAP radiusClass mapped to RADIUS Class

rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout

rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout

rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action

rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service

rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node

rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group

rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link

rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network

rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone

rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit

rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port

conns: 0x80aa600

Module: Instantiated ldap (ldap)

Module: Loaded Acct-Unique-Session-Id

Module: Instantiated acct_unique (acct_unique)

Module: Loaded detail

Module: Instantiated detail (detail)

Module: Loaded radutmp

Module: Instantiated radutmp (radutmp)

Initializing the thread pool...

Listening on authentication *:1812

Listening on accounting *:1813

Listening on proxy *:1814

Ready to process requests.

rad_recv: Access-Request packet from host 172.16.83.1:32830, id=20, length=111

User-Name = "cprice"

NAS-IP-Address = 172.16.80.4

NAS-Port = 29

NAS-Port-Type = Wireless-802.11

Calling-Station-Id = "00904B91CCAF"

Called-Station-Id = "000B86010C80"

Framed-MTU = 1300

EAP-Message = 0x0217000b01637072696365

Message-Authenticator = 0xa125c1b253031500294644d1f713050e

rlm_ldap: - authorize

rlm_ldap: performing user authorization for cprice

rlm_ldap: ldap_get_conn: Checking Id: 0

rlm_ldap: ldap_get_conn: Got Id: 0

rlm_ldap: (re)connect to atilla.olivet.edu:636, authentication 0

rlm_ldap: setting TLS mode to 1

rlm_ldap: bind as / to atilla.olivet.edu:636

rlm_ldap: waiting for bind result ...

rlm_ldap: Bind was successful

rlm_ldap: looking for check items in directory...

rlm_ldap: looking for reply items in directory...

rlm_ldap: user cprice authorized to use remote access

rlm_ldap: ldap_release_conn: Release Id: 0

rlm_eap_md5: Issuing Challenge

Sending Access-Challenge of id 20 to 172.16.83.1:32830

EAP-Message = 0x0118001604103aa9151925733b3bd2fb8dde505ba265

Message-Authenticator = 0x00000000000000000000000000000000

State = 0xed87b3f30ffb19344826f885ff1d404a

rad_recv: Access-Request packet from host 172.16.83.1:32830, id=21, length=124