(RADIATOR) Bad password count on Win2k Active Directory

Mike McCauley mikem at open.com.au
Mon Aug 11 18:33:50 CDT 2003


Hello Mike,

On Mon, 11 Aug 2003 10:53 pm, Smith, Mike (Toronto) wrote:
> I'm using an LDAP browser to view user attributes in the Active Directory.

Which browser?

> Every user has an attribute 'badpwdcount' which increases by 1 for every
> failed login.  As far as I know, the 'radpwtst' utility only sends one
> request, and just to be sure only one request is made I set the DupInterval
> on radiator to 20 seconds.  If radpwtst retries authentication, radiator
> should ignore it.  The rapwtst program does not run for more than 20
> seconds.  My question is this:  Does the radius server retry authentication
> when the AD rejects it because of a bad password?  

No.

> If it does, can I change
> it's behaviour so it only tries once?
>
> Thanks.
>
>
>
> -----Original Message-----
> From: Mike McCauley [mailto:mikem at open.com.au]
> Sent: Sunday, August 10, 2003 3:38 AM
> To: Smith, Mike (Toronto); 'radiator at open.com.au'
> Subject: Re: (RADIATOR) Bad password count on Win2k Active Directory
>
>
> Hello Steve,
>
> On Sat, 9 Aug 2003 01:22 am, Smith, Mike (Toronto) wrote:
> > Hello,
> >
> > I am using Radiator to authenticate dialin users against our AD.
> > However, when a user enters a bad password, the bad password count in
> > the AD (attribute is called "badpwdcount" in AD) increases by 2.  If
> > the SearchAttribute is defined, the bad password count increases by 3.
> > It is not caused by duplicate requests from the dialin client because
> > I set the DupInterval to 20 seconds.  I believe Radiator is making
> > only one request to the AD, but somehow the bad password count
> > increases by 2 or 3.  I've attached the output of the 'radpwtst' test
> > program and the radius server as well as my config file.  In this test
> > run, I purposely used a wrong password and the bad password count
> > increased by 2.
> >
> > Any Ideas?
>
> I cant explain that yet.
> How are you getting the badpwdcount after the bad logins?
> Are you quite sure there are not multiple authentication requests
> happening,
>
> perhaps due to retransmissions etc?
>
> > Thanks in advance,
> >
> > Mike Smith
> >
> >
> >
> >
> > Radpwtst output
> > ---------------------------------------------------------------------
> >
> > C:\Radius>perl radpwtst -s 127.0.0.1 -secret test -user lupu -password
> > test sending Access-Request...
> > Rejected: Request Denied
> > sending Accounting-Request Start...
> > OK
> > sending Accounting-Request Stop...
> > OK
> >
> >
> >
> >
> > Radiusd output
> > -------------------------------------------------------------
> >
> > C:\Radius>perl radiusd -config_file c:\radiator\radius.cfg
> >
> > Wed Aug  6 21:07:57 2003: DEBUG: Packet dump:
> > *** Received from 127.0.0.1 port 4109 ....
> > Code:       Access-Request
> > Identifier: 132
> > Authentic:  1234567890123456
> > Attributes:
> >         User-Name = "lupu"
> >         Service-Type = Framed-User
> >         NAS-IP-Address = 203.63.154.1
> >         NAS-Port = 1234
> >         Called-Station-Id = "123456789"
> >         Calling-Station-Id = "987654321"
> >         NAS-Port-Type = Async
> >         User-Password =
> > "<159><234><28><161><247>~<222><178>z<199><246>h<138><6>8<128>"
> >
> > Wed Aug  6 21:07:57 2003: DEBUG: Handling request with Handler
> > 'Client-Identifier=TestAD' Wed Aug  6 21:07:57 2003: DEBUG:  Deleting
> > session for lupu, 203.63.154.1, 1234
> > Wed Aug  6 21:07:57 2003: DEBUG: Handling with ASDI
> > Wed Aug  6 21:07:57 2003: DEBUG: BindString converted to
> > LDAP://toradtest/cn=lupu,cn=Users,dc=torzentest,dc=ca
> > Wed Aug  6 21:07:57 2003: DEBUG: AuthUser converted to lupu
> > Wed Aug  6 21:07:57 2003: DEBUG: Connecting to namespace: LDAP:
> > Wed Aug  6 21:07:57 2003: DEBUG: Running OpenDSObject on
> > LDAP://toradtest/cn=lupu,cn=Users,dc=torzentest,dc=ca
> > Wed Aug  6 21:07:57 2003: DEBUG: Could not get user object:
> > Win32::OLE(0.1601) error 0x8007052e: "Logon failure: unknown user name or
> > bad password"
> >     in METHOD/PROPERTYGET "OpenDSObject"
> > Wed Aug  6 21:07:57 2003: INFO: Access rejected for lupu: Could not find
> > user
> >
> > Wed Aug  6 21:07:57 2003: DEBUG: Packet dump:
> > *** Sending to 127.0.0.1 port 4109 ....
> > Code:       Access-Reject
> > Identifier: 132
> > Authentic:  1234567890123456
> > Attributes:
> >         Reply-Message = "Request Denied"
> >
> > Wed Aug  6 21:07:57 2003: DEBUG: Packet dump:
> > *** Received from 127.0.0.1 port 4109 ....
> > Code:       Accounting-Request
> > Identifier: 133
> > Authentic:  <23><234>1<25><243>LQ<5>l<188>-`<145><214><26>3
> > Attributes:
> >         User-Name = "lupu"
> >         Service-Type = Framed-User
> >         NAS-IP-Address = 203.63.154.1
> >         NAS-Port = 1234
> >         NAS-Port-Type = Async
> >         Acct-Session-Id = "00001234"
> >         Acct-Status-Type = Start
> >         Called-Station-Id = "123456789"
> >         Calling-Station-Id = "987654321"
> >         Acct-Delay-Time = 0
> >
> > Wed Aug  6 21:07:57 2003: DEBUG: Handling request with Handler
> > 'Client-Identifier=TestAD' Wed Aug  6 21:07:57 2003: DEBUG:  Adding
> > session for lupu, 203.63.154.1, 1234
> > Wed Aug  6 21:07:57 2003: DEBUG: Handling with ASDI
> > Wed Aug  6 21:07:57 2003: DEBUG: Accounting accepted
> >
> > Wed Aug  6 21:07:57 2003: DEBUG: Packet dump:
> > *** Sending to 127.0.0.1 port 4109 ....
> > Code:       Accounting-Response
> > Identifier: 133
> > Authentic:  <23><234>1<25><243>LQ<5>l<188>-`<145><214><26>3
> > Attributes:
> >
> > Wed Aug  6 21:07:57 2003: DEBUG: Packet dump:
> > *** Received from 127.0.0.1 port 4109 ....
> > Code:       Accounting-Request
> > Identifier: 134
> > Authentic:
> > <247><153>-<222>[<188><176><151><184><192>1<15>l<128><190>2
> > Attributes:
> >         User-Name = "lupu"
> >         Service-Type = Framed-User
> >         NAS-IP-Address = 203.63.154.1
> >         NAS-Port = 1234
> >         NAS-Port-Type = Async
> >         Acct-Session-Id = "00001234"
> >         Acct-Status-Type = Stop
> >         Called-Station-Id = "123456789"
> >         Calling-Station-Id = "987654321"
> >         Acct-Delay-Time = 0
> >         Acct-Session-Time = 1000
> >         Acct-Input-Octets = 20000
> >         Acct-Output-Octets = 30000
> >
> > Wed Aug  6 21:07:57 2003: DEBUG: Handling request with Handler
> > 'Client-Identifier=TestAD' Wed Aug  6 21:07:57 2003: DEBUG:  Deleting
> > session for lupu, 203.63.154.1, 1234
> > Wed Aug  6 21:07:57 2003: DEBUG: Handling with ASDI
> > Wed Aug  6 21:07:57 2003: DEBUG: Accounting accepted
> >
> > Wed Aug  6 21:07:57 2003: DEBUG: Packet dump:
> > *** Sending to 127.0.0.1 port 4109 ....
> > Code:       Accounting-Response
> > Identifier: 134
> > Authentic:
> > <247><153>-<222>[<188><176><151><184><192>1<15>l<128><190>2
> > Attributes:
> >
> >
> > Config file
> > ---------------------------------------------------------------------
> >
> > Foreground
> > LogStdout
> > LogDir		c:/Radiator
> > DbDir		c:/Radiator
> >
> >
> > Trace 		4
> >
> >
> > #
> > #  Baystack Switches
> > #
> >
> > # test switch
> > <Client 10.34.0.15>
> > 	Secret	test
> > 	DupInterval 20
> > 	Identifier BayStackSwitch
> > </Client>
> >
> >
> > #
> > #  Shiva Lanrovers
> > #
> >
> > # shivas
> > <Client 10.36.1.34>
> > 	Secret  test
> > 	DupInterval 20
> > 	Identifier ShivaLanRover
> > </Client>
> >
> > <Client 127.0.0.1>
> > 	Secret  test
> > 	DupInterval 20
> > 	Identifier TestAD
> > </Client>
> >
> > <Client DEFAULT>
> > 	Secret	mypass
> > 	DupInterval 20
> > </Client>
> >
> >
> > <Handler Client-Identifier=BayStackSwitch>
> >
> > 	<AuthBy ADSI>
> > 		Identifier ADSI
> >
> > 		SearchAttribute   sAMAccountName
> > 		BindString LDAP://toradtest/cn=Users,dc=torzentest,dc=ca
> > 		AuthUser %0
> >
> > 		DefaultReply Service-Type=Administrative-User
> > 		GroupRequired  CN=net admin
> > 	</AuthBy>
> >
> > </Handler>
> >
> > <Handler Client-Identifier=ShivaLanRover>
> >
> > 	<AuthBy ADSI>
> > 		Identifier ADSI
> >
> > 		SearchAttribute   sAMAccountName
> > 		BindString LDAP://toradtest/cn=Users,dc=torzentest,dc=ca
> > 		AuthUser %0
> >
> > 		DefaultReply Service-Type=Framed-User
> > 		GroupRequired  CN=dialin
> > 	</AuthBy>
> >
> > </Handler>
> >
> > <Handler Client-Identifier=TestAD>
> >
> > 	<AuthBy ADSI>
> > 		Identifier ADSI
> >
> > #		SearchAttribute   sAMAccountName
> > 		BindString
>
> LDAP://toradtest/cn=%0,cn=Users,dc=torzentest,dc=ca
>
> > 		AuthUser %0
> >
> > 		DefaultReply Service-Type=Framed-User
> > 	</AuthBy>
> >
> > </Handler>

-- 
Mike McCauley                               mikem at open.com.au
Open System Consultants Pty. Ltd            Unix, Perl, Motif, C++, WWW
24 Bateman St Hampton, VIC 3188 Australia   http://www.open.com.au
Phone +61 3 9598-0985                       Fax   +61 3 9598-0955

Radiator: the most portable, flexible and configurable RADIUS server 
anywhere. SQL, proxy, DBM, files, LDAP, NIS+, password, NT, Emerald, 
Platypus, Freeside, TACACS+, PAM, external, Active Directory, EAP, TLS, 
TTLS, PEAP etc on Unix, Windows, MacOS etc.

===
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.


More information about the radiator mailing list