(RADIATOR) Problem with rewriteusername and chap
Hugh Irvine
hugh at open.com.au
Wed Jan 7 16:02:58 CST 2004
Hello Chris -
I believe the problem is to do with MS-CHAP V2 which uses the full
username to check the password.
Have a look at the comment header and the code in "Radius/MSCHAP.pm" in
the Radiator 3.8 distribution.
regards
Hugh
On 08/01/2004, at 5:18 AM, Chris Simmons wrote:
> Dear all,
> First, I must say sorry for the log post (and html). Secondly, we have
> a client sending:
> username =user2 at rn1-all.sghms.ac.ukvia MS-CAHP V2 and the password
> "password".
>
> We are running a simple config.file:
>
> RewriteUsername s/\@.*//
>
> <Client DEFAULT>
> Secret mysecret
> DupInterval 0
> </Client>
>
> <Realm DEFAULT>
> <AuthBy FILE>
> Filename /usr/local/etc/users
> </AuthBy>
> </Realm>
>
> the users file contains:
>
> user User-Password="password",
> user2 User-Password="password",
>
>
> But the following happens:
>
> Yeilds:
> Wed Jan 7 17:54:21 2004: DEBUG: Reading users file
> /usr/local/etc/users
> Wed Jan 7 17:54:21 2004: DEBUG: Finished reading configuration file
> '/usr/local/etc/simple.cfg'
> Wed Jan 7 17:54:21 2004: DEBUG: Reading dictionary file
> '/var/log/radius/dictionary'
> Wed Jan 7 17:54:21 2004: DEBUG: Creating authentication port
> 0.0.0.0:1813
> Wed Jan 7 17:54:21 2004: DEBUG: Creating accounting port 0.0.0.0:1812
> Wed Jan 7 17:54:21 2004: NOTICE: Server started: Radiator 3.8 on dns1
> Wed Jan 7 17:54:25 2004: DEBUG: Packet dump:
> *** Received from 172.16.1.52 port 1814 ....
> Code: Access-Request
> Identifier: 13
> Authentic: /s0<1><26><143><149><200>R<154><239><244>tu_<138>
> Attributes:
> MS-CHAP-Challenge =
> "o<167>k<193><136><128><203><138><26><214>&<160><230><127><0>K"
> MS-CHAP2-Response =
> "<1><0><145><228><250>/
> r<177>"E<13><148><236>%<25><182><230>Y<0><0><0><0><0><0><0><0>-
> <147><0><246><129>b<18><153><188><3><202><178><193><165><4><143>@<249>s
> <28>X<165>2<162>"
> User-Name ="user at rn1-all.sghms.ac.uk"
> NAS-IP-Address = 172.16.1.52
> NAS-Identifier ="roam at 10.0.1.0/24"
> Service-Type = Framed-User
> Framed-Protocol = PPP
> Proxy-State = 208
>
> Wed Jan 7 17:54:25 2004: DEBUG: Rewrote user name to user
> Wed Jan 7 17:54:25 2004: DEBUG: Handling request with Handler
> 'Realm=DEFAULT'
> Wed Jan 7 17:54:25 2004: DEBUG: Deleting session
> foruser2 at rn1-all.sghms.ac.uk, 172.16.1.52,
> Wed Jan 7 17:54:25 2004: DEBUG: Handling with Radius::AuthFILE:
> Wed Jan 7 17:54:25 2004: DEBUG: Radius::AuthFILE looks for match with
> user2
> Wed Jan 7 17:54:25 2004: DEBUG: Radius::AuthFILE REJECT: Bad Password
> Wed Jan 7 17:54:25 2004: INFO: Access rejected for user: Bad Password
> Wed Jan 7 17:54:25 2004: DEBUG: Packet dump:
> *** Sending to 172.16.1.52 port 1814 ....
> Code: Access-Reject
> Identifier: 13
> Authentic: /s0<1><26><143><149><200>R<154><239><244>tu_<138>
> Attributes:
> Reply-Message = "Request Denied"
> Proxy-State = 208
>
>
> But if the follwoing is used:
>
> radpwtst -useruser2 at rn1-all.sghms.ac.uk-password password
>
> the output below:
>
> *** Received from 127.0.0.1 port 60973 ....
> Code: Access-Request
> Identifier: 215
> Authentic: 1234567890123456
> Attributes:
> User-Name ="user2 at rn1-all.sghms.ac.uk"
> Service-Type = Framed-User
> NAS-IP-Address = 203.63.154.1
> NAS-Port = 1234
> Called-Station-Id = "123456789"
> Calling-Station-Id = "987654321"
> NAS-Port-Type = Async
> User-Password =
> "<137><234>,<222><216>3v<146><188>8<9><160><216>}x<153>"
>
> Wed Jan 7 18:05:05 2004: DEBUG: Rewrote user name to user2
> Wed Jan 7 18:05:05 2004: DEBUG: Handling request with Handler
> 'Realm=DEFAULT'
> Wed Jan 7 18:05:05 2004: DEBUG: Deleting session
> foruser2 at rn1-all.sghms.ac.uk, 203.63.154.1, 1234
> Wed Jan 7 18:05:05 2004: DEBUG: Handling with Radius::AuthFILE:
> Wed Jan 7 18:05:05 2004: DEBUG: Radius::AuthFILE looks for match with
> user2
> Wed Jan 7 18:05:05 2004: DEBUG: Radius::AuthFILE ACCEPT:
> Wed Jan 7 18:05:05 2004: DEBUG: Access accepted for user2
> Wed Jan 7 18:05:05 2004: DEBUG: Packet dump:
> *** Sending to 127.0.0.1 port 60973 ....
> Code: Access-Accept
> Identifier: 215
> Authentic: 1234567890123456
> Attributes:
>
>
> BUT With rewriteUsername OFF and using MS-CHAP V2, and chaging the
> user anmes in the users file touser2 at rn1-all.sghms.ac.uk
> It works.
>
> *** Received from 172.16.1.52 port 1814 ....
> Code: Access-Request
> Identifier: 14
> Authentic: <20><227>JyPz<8><192><168><183><245>M<252>k<139>j
> Attributes:
> MS-CHAP-Challenge =
> "<14>l<158><25><209><199><205>a8J<137>u<4>02<146>"
> MS-CHAP2-Response =
> "<1><0>F<195>ps<4><160>|<250><200><176><3>q<213>c<244>2<0><0><0><0><0><
> 0><0><0><175><224><26><9>j<180>"<220>3<238>?
> <157><230><231><206><184>*<192>K<<194><203>y<30>"
> User-Name ="user2 at rn1-all.sghms.ac.uk"
> NAS-IP-Address = 172.16.1.52
> NAS-Identifier ="roam at 10.0.1.0/24"
> Service-Type = Framed-User
> Framed-Protocol = PPP
> Proxy-State = 80
>
> Wed Jan 7 18:08:21 2004: DEBUG: Handling request with Handler
> 'Realm=DEFAULT'
> Wed Jan 7 18:08:21 2004: DEBUG: Deleting session
> foruser2 at rn1-all.sghms.ac.uk, 172.16.1.52,
> Wed Jan 7 18:08:21 2004: DEBUG: Handling with Radius::AuthFILE:
> Wed Jan 7 18:08:21 2004: DEBUG: Radius::AuthFILE looks for match
> withuser2 at rn1-all.sghms.ac.uk
> Wed Jan 7 18:08:21 2004: DEBUG: Radius::AuthFILE ACCEPT:
> Wed Jan 7 18:08:21 2004: DEBUG: Access accepted
> foruser2 at rn1-all.sghms.ac.uk
> Wed Jan 7 18:08:21 2004: DEBUG: Packet dump:
>
> Does anybody have any idea's where we would be going wrong?
>
> regards
>
> Chris.
>
> --
> Chris Simmons
> Network Engineer
> St Georges Hospital Medical School
>
> Tel: 020 8725 0234
> mail: chris at sghms.ac.uk
>
> --
> This message has been scanned for viruses and
> dangerous content byMailScanner, and is
> believed to be clean.
NB: have you included a copy of your configuration file (no secrets),
together with a trace 4 debug showing what is happening?
--
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. Available on *NIX, *BSD, Windows, MacOS X.
-
Nets: internetwork inventory and management - graphical, extensible,
flexible with hardware, software, platform and database independence.
-
CATool: Private Certificate Authority for Unix and Unix-like systems.
===
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.
More information about the radiator
mailing list