For some reason, you have the LDAP module set up to pull an MD5-hashed password from your LDAP tree and add it as the NT-Password attribute. This won't work. In order to use PEAP, you have to have either a clear-text password or an NT-hashed password.
--Mike On Wed, 2004-11-17 at 03:44, Pål Hjelmeseth Myklebust wrote: > I have a problem i cant seem to figure out, so i wondered if any of you > have a suggestion. It looks like everything is working as intended, the > ldap finds the account, and authorize the client, but then it sends > Access-Reject. > > [EMAIL PROTECTED] log]# /usr/sbin/radiusd -x -A > Starting - reading configuration files ... > Using deprecated naslist file. Support for this will go away soon. > Module: Loaded exec > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded MS-CHAP > Module: Instantiated mschap (mschap) > Module: Loaded System > Module: Instantiated unix (unix) > Module: Loaded preprocess > Module: Instantiated preprocess (preprocess) > Module: Loaded detail > Module: Instantiated detail (auth_log) > Module: Loaded LDAP > rlm_ldap: Registering ldap_groupcmp for Ldap-Group > rlm_ldap: Registering ldap_xlat with xlat_name ldap > rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap > rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ > rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ > rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type > rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use > rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id > rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id > rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password > rlm_ldap: LDAP userPassword mapped to RADIUS NT-Password > rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT > rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration > rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type > rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol > rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address > rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask > rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route > rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing > rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id > rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU > rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression > rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host > rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service > rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port > rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number > rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id > rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network > rlm_ldap: LDAP radiusClass mapped to RADIUS Class > rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout > rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout > rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action > rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service > rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node > rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group > rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS > Framed-AppleTalk-Link > rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS > Framed-AppleTalk-Network > rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS > Framed-AppleTalk-Zone > rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit > rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port > conns: 0x97ac438 > Module: Instantiated ldap (ldap) > Module: Loaded realm > Module: Instantiated realm (suffix) > Module: Loaded files > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > Module: Instantiated acct_unique (acct_unique) > Module: Instantiated detail (detail) > Module: Loaded radutmp > Module: Instantiated radutmp (radutmp) > Module: Loaded eap > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > rlm_eap: Loaded and initialized type gtc > rlm_eap: Loaded and initialized type tls > rlm_eap: Loaded and initialized type peap > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Initializing the thread pool... > Listening on authentication *:1645 > Listening on accounting *:1646 > Listening on proxy *:1647 > Ready to process requests. > rad_recv: Access-Request packet from host 158.36.80.3:1645, id=33, length=125 > User-Name = "pmyklebu" > Framed-MTU = 1400 > Called-Station-Id = "0040.96a0.1b31" > Calling-Station-Id = "000e.3526.4533" > Message-Authenticator = 0xaf9422f5561d549ae6f7be33b6c134ef > EAP-Message = 0x0202000d01706d796b6c656275 > NAS-Port-Type = Virtual > NAS-Port = 339 > NAS-IP-Address = 158.36.80.3 > NAS-Identifier = "ap01" > rlm_ldap: - authorize > rlm_ldap: performing user authorization for pmyklebu > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: (re)connect to ldap.mf.no:389, authentication 0 > rlm_ldap: bind as cn=Manager,dc=mf,dc=no/MF1d4p to ldap.mf.no:389 > rlm_ldap: waiting for bind result ... > rlm_ldap: Bind was successful > rlm_ldap: Added password $1$mshPSBT6$L/rKT1A/OlI.YG85/TCIo1 in check items > rlm_ldap: looking for check items in directory... > rlm_ldap: Adding userPassword as NT-Password, value > $1$mshPSBT6$L/rKT1A/OlI.YG85/TCIo1 & op=21 > rlm_ldap: looking for reply items in directory... > rlm_ldap: user pmyklebu authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > rad_recv: Access-Request packet from host 158.36.80.3:1645, id=33, length=125 > Sending Access-Reject of id 33 to 158.36.80.3:1645 > > Any idea what to look for? > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
