Re: What is this "group authentication"?
Gary Algier <[EMAIL PROTECTED]> wrote: > Problem solved. Here was what I finally googled on: > rlm_eap_peap: Received EAP-TLV response. That's just an informative message, and isn't the cause of the problem. > I could not find any mention of "eap-tlv" in any config files > or doc files, but in the mailing list someone else had this problem > and the answer to them was to configure "mschap". I had it configured, > but apparently not correctly. While the debug log you posted to the list was large, this information *was* in there. The MSCHAP module said authentication failed, and suggested a possible way to fix it. > and it worked. Perhaps it was the "with_ntdomain_hack". Which is what the mschap module suggested in the debug log. I understand the debug log is large and complicated, but the answers *are* in there most of the time. All it takes is patience to read 5-10 pages of gobbley-gook. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: What is this "group authentication"?
Gary Algier wrote:
Alan DeKok wrote:
Gary Algier <[EMAIL PROTECTED]> wrote:
I am trying to use the WinXP supplied supplicant and I am getting:
modcall: group authenticate returns invalid for request 41
Can someone give me a hint as to what this means?
Problem solved. Here was what I finally googled on:
rlm_eap_peap: Received EAP-TLV response.
I could not find any mention of "eap-tlv" in any config files
or doc files, but in the mailing list someone else had this problem
and the answer to them was to configure "mschap". I had it configured,
but apparently not correctly. I set it thus (thanks to
[EMAIL PROTECTED] for the example):
mschap {
authtype = MS-CHAP
use_mppe = yes
require_encryption = yes
require_strong = yes
with_ntdomain_hack = yes
}
and it worked. Perhaps it was the "with_ntdomain_hack". I had NOT
set it because somewhere else it said:
# This configuration entry SHOULD NOT be used.
and I misinterpreted it as a global statement.
Also thanks to [EMAIL PROTECTED] for the note about needing the
KB885453 Hotfix.
Thanks to everyone for their patience.
--
Gary Algier, WB2FWZ gaa at ulticom.com +1 856 787 2758
Ulticom Inc., 1020 Briggs Rd, Mt. Laurel, NJ 08054 Fax:+1 856 866 2033
Nielsen's First Law of Computer Manuals:
People don't read documentation voluntarily.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: What is this "group authentication"?
Alan DeKok wrote: Gary Algier <[EMAIL PROTECTED]> wrote: I am trying to use the WinXP supplied supplicant and I am getting: modcall: group authenticate returns invalid for request 41 Can someone give me a hint as to what this means? Read the *rest* of the debug log above that to see what's going on. I did and it I did not understand it (see below for the log). I thought that perhaps there was some sort of groups I needed to setup. When I use the WinXP bulitin supplicant in "Automatically use my Windows login..." mode, Freeradius fails with the group authentication message. It's not "group authentication", it's the "authentication" section of "radiusd.conf". If I uncheck that and type a login and password (but not a domain), it works fine. It never does any sort of group check. If I supply a domain, it does the group check (and fails). When does it check groups? What is it checking? Read the *rest* of the debug log. Here's the logs (when is fails with a domain supplied): --- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/ulcmit/raddb/clients.conf Config: including file: /etc/ulcmit/raddb/snmp.conf Config: including file: /etc/ulcmit/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "clear" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded Pam pam: pam_auth = "radiusd" Module: Instantiated pam (pam) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "mschapv2" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/ulcmit/raddb/certs/pyrope.ulticom.com.key" tls: certificate_file = "/etc/ulcmit/raddb/certs/pyrope.ulticom.com.crt" tls: CA_file = "/etc/ulcmit/raddb/certs/ca.pem" tls: private_key_password = "(null)" tls: dh_file = "/etc/ulcmit/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/ulcmit/raddb/huntgroups" preprocess: hints = "/etc/ul
Re: What is this "group authentication"?
Gary Algier <[EMAIL PROTECTED]> wrote: > I am trying to use the WinXP supplied supplicant and I am getting: > modcall: group authenticate returns invalid for request 41 > > Can someone give me a hint as to what this means? Read the *rest* of the debug log above that to see what's going on. > When I use the WinXP bulitin supplicant in "Automatically use my > Windows login..." mode, Freeradius fails with the group > authentication message. It's not "group authentication", it's the "authentication" section of "radiusd.conf". > If I uncheck that and type a login > and password (but not a domain), it works fine. It never does > any sort of group check. If I supply a domain, it does the group > check (and fails). When does it check groups? What is it > checking? Read the *rest* of the debug log. If all you do is look at the last line or two, you're guaranteed to not see what's going on. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
What is this "group authentication"?
Hi:
I am trying to use the WinXP supplied supplicant and I am getting:
modcall: group authenticate returns invalid for request 41
Can someone give me a hint as to what this means?
When I use the WinXP bulitin supplicant in "Automatically use my
Windows login..." mode, Freeradius fails with the group
authentication message. If I uncheck that and type a login
and password (but not a domain), it works fine. It never does
any sort of group check. If I supply a domain, it does the group
check (and fails). When does it check groups? What is it
checking?
I am using Freeradius 1.0.5, Sun's DS (with Samba attributes loaded),
and WinXP SP2.
BTW: I am stripping the hostname when doing the user lookups in LDAP
using this:
filter = "(&(objectclass=person)(uid=%{exec:/etc/ulcmit/raddb/nodomain
%{User-Name}}))"
where "nodomain" strips the domain portion. My LDAP lookups work fine.
--
Gary Algier, WB2FWZ gaa at ulticom.com +1 856 787 2758
Ulticom Inc., 1020 Briggs Rd, Mt. Laurel, NJ 08054 Fax:+1 856 866 2033
Nielsen's First Law of Computer Manuals:
People don't read documentation voluntarily.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
