Hi,
I'm new to radius world, so please bear with me.
I've successfully configure freeradius with PAP, however when trying to use CHAP or MSCHAP I always get this error (radiusd -X ) :
-----
rad_recv: Access-Request packet from host 10.2.100.202:2049, id=15,
length=135
User-Name = "testuser"
CHAP-Challenge =
0x110b76f0ef9b54040c1b8b19d3c85da67e937fa9afc51100a3469aec1680a2288b1a197bb56d80c2890cdc5dd53a0454ce84fe7e4b10
CHAP-Password = 0x01355e4b8ae9bd8fc0a51616f4c9c4f0c7
NAS-Port = 0
NAS-Port-Type = Virtual
Service-Type = Framed-User
Framed-Protocol = PPP
Framed-IP-Address = 10.202.154.1
rad_lowerpair: User-Name now 'testuser'
rad_rmspace_pair: User-Name now 'testuser'
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module "preprocess" returns ok for request 0
modcall[authorize]: module "mschap" returns noop for request 0
rlm_ldap: - authorize
rlm_ldap: performing user authorization for testuser
radius_xlat: '(uid=testuser)'
radius_xlat: 'ou=people,ou=jakarta,dc=mydomain,dc=com'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: attempting LDAP reconnection
rlm_ldap: (re)connect to 10.10.10.3:389, authentication 0
rlm_ldap: bind as / to 10.10.10.3:389
rlm_ldap: waiting for bind result ...
rlm_ldap: Bind was successful
rlm_ldap: performing search in ou=people,ou=jakarta,dc=mydomain,dc=com,
with filter (uid=testuser)
rlm_ldap: looking for check items in directory...
rlm_ldap: looking for reply items in directory...
rlm_ldap: user testuser authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
modcall[authorize]: module "ldap" returns ok for request 0
modcall: group authorize returns ok for request 0
rad_check_password: Found Auth-Type LDAP
auth: type "LDAP"
Processing the authenticate section of radiusd.conf
modcall: entering group Auth-Type for request 0
rlm_ldap: - authenticate
rlm_ldap: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password".
modcall[authenticate]: module "ldap" returns invalid for request 0
modcall: group Auth-Type returns invalid for request 0
auth: Failed to validate the user.
--------
radiusd.conf :
modules {
chap {
authtype = CHAP
} mschap {
authtype = MS-CHAP}
ldap {
server = "10.10.10.3"
basedn = "ou=people,ou=jakarta,dc=mydomain,dc=com"
filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
start_tls = no
password_attribute = sambaNTPassword
dictionary_mapping = ${raddbdir}/ldap.attrmap
ldap_connections_number = 5
timeout = 4
timelimit = 3
net_timeout = 1
}authorize {
preprocess
mschap
ldap
}
authenticate {
Auth-Type MS-CHAP {
mschap
}
Auth-Type LDAP {
ldap
}
}In ldap.attrmap, I add :
checkItem LM-Password sambaLMPassword checkItem NT-Password sambaNTPassword checkItem Crypt-Password userPassword
In ldap, each account having these attributes :
userPassword:: e2NyeXB0fSQxJGdyNUVXdDVRJHdPN3NYMjRydVd6bkNhU3lYRC5KQzA= sambaLMPassword: 192C01E786D3642765C4A55F32B3BF83 sambaNTPassword: 8F83F19E1C90CE4B86D7D5356424555F
1. What other files need to be fix? 2. With all those ldap attribute, what auth type can be supported?
Thanks.
--
--beast
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
