Fwd: (RADIATOR) Help with configure radius.cfg with eap and ldap
Mike McCauley
mikem at open.com.au
Thu Jan 22 01:50:47 CST 2004
Hello Andy,
On Thu, 22 Jan 2004 09:03 am, tudalat at shaw.ca wrote:
> ----- Original Message -----
> From: Mike McCauley <mikem at open.com.au>
> Date: Tuesday, January 20, 2004 2:50 pm
> Subject: Re: Fwd: (RADIATOR) Help with configure radius.cfg with eap and
> ldap
>
> > Hello Andy,
>
> Hi Mike:
> > I think the problem is that you do not have PasswordAttr defined
> > in your
> > config file for AuthBy LDAP2. You should have seen an error
> > message about that when it starts up? Its not required with
>
> There was no error when ServerChecksPassword is not used. I tried
> "PasswordAttr userPassword" and I got "There was no password attribute
> found" PasswordAttr (alone) and EncryptedPasswordAttr, however, work
> successfully with LDAP but MD5-Challenge still fails. Just wonder if it's
> because of our
> peculiar way of implementing ldap. I am not allowed to retrieve
> the UserPassword, I can only use it to do a LDAP bind.
I think that will be the problem. In order for Radiator to support
MD5-Challenge, it needs to be able to get the plaintext password from the
LDAP server in the LDAP attribute named by PasswordAttr.
Cheers.
>
>
> Here are the two logs, .1 with "PasswordAttr userPassword"
> and .2 with "PasswordAttr "
>
> .1
> *** Received from xxx.xxx.254.224 port 1024 ....
> Code: Access-Request
> Identifier: 165
> Authentic:
> <187>O<211><155><163><153><10><156>C<179><242>9<230><208><164><144>
> Attributes:
> Framed-MTU = 1480
> NAS-IP-Address = xxx.xxx.254.224
> NAS-Identifier = "HP ProCurve Switch 2626"
> User-Name = "tudalat"
> Service-Type = Framed-User
> Framed-Protocol = PPP
> NAS-Port = 21
> NAS-Port-Type = Ethernet
> NAS-Port-Id = "21"
> Called-Station-Id = "00-30-6e-ae-d1-2b"
> Calling-Station-Id = "00-d0-b7-70-8d-7c"
> Connect-Info = "CONNECT Ethernet 10Mbps Half duplex"
> Tunnel-Type = VLAN
> Tunnel-Medium-Type = IEEE-802
> Tunnel-Private-Group-ID = "1"
> EAP-Message =
> <2><2><0><28><4><16>Y<10><4>>l8<155>Y<158><133><166>xl<185>J<204>tudalat
> Message-Authenticator =
> <139><249>p<127><184>70<165><139>K<207>w<181><182><141>x
>
> Wed Jan 21 14:34:35 2004: DEBUG: Handling request with Handler
> 'Realm=DEFAULT' Wed Jan 21 14:34:35 2004: DEBUG: Rewrote user name to
> tudalat
> Wed Jan 21 14:34:35 2004: DEBUG: Deleting session for tudalat,
> xxx.xxx.254.224, 21 Wed Jan 21 14:34:35 2004: DEBUG: Handling with
> Radius::AuthLDAP2: uidauthent Wed Jan 21 14:34:35 2004: DEBUG: Handling
> with EAP: code 2, 2, 28
> Wed Jan 21 14:34:35 2004: DEBUG: Response type 4
> Wed Jan 21 14:34:35 2004: INFO: Connecting to test.ldap.ucalgary.ca, port
> 389 Wed Jan 21 14:34:35 2004: INFO: Attempting to bind to LDAP server
> test.ldap.ucalgary.ca:389) Wed Jan 21 14:34:35 2004: DEBUG: LDAP got result
> for uid=tudalat,ou=uidauthent,o=ucalgary.ca Wed Jan 21 14:34:35 2004: ERR:
> There was no password attribute found for tudalat. Check your LDAP
> database. Wed Jan 21 14:34:35 2004: DEBUG: Radius::AuthLDAP2 looks for
> match with tudalat Wed Jan 21 14:34:35 2004: DEBUG: Radius::AuthLDAP2
> ACCEPT:
> Wed Jan 21 14:34:35 2004: DEBUG: EAP result: 1, EAP MD5-Challenge failed
> Wed Jan 21 14:34:35 2004: INFO: Access rejected for tudalat: EAP
> MD5-Challenge failed Wed Jan 21 14:34:35 2004: DEBUG: Packet dump:
> *** Sending to xxx.xxx.254.224 port 1024 ....
> Code: Access-Reject
> Identifier: 165
> Authentic:
> <187>O<211><155><163><153><10><156>C<179><242>9<230><208><164><144>
> Attributes:
> EAP-Message = <4><2><0><4>
> Message-Authenticator =
> <0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0> Reply-Message = "Request
> Denied"
>
> .2
>
> And here is the log for just "PasswordAttr"*** Received from
> xxx.xxx.254.224 port 1024 .... Code: Access-Request
> Identifier: 167
> Authentic: <3><187><208>-3{e<252>H<196>)e<250><185><171><127>
> Attributes:
> Framed-MTU = 1480
> NAS-IP-Address = xxx.xxx.254.224
> NAS-Identifier = "HP ProCurve Switch 2626"
> User-Name = "tudalat"
> Service-Type = Framed-User
> Framed-Protocol = PPP
> NAS-Port = 21
> NAS-Port-Type = Ethernet
> NAS-Port-Id = "21"
> Called-Station-Id = "00-30-6e-ae-d1-2b"
> Calling-Station-Id = "00-d0-b7-70-8d-7c"
> Connect-Info = "CONNECT Ethernet 10Mbps Half duplex"
> Tunnel-Type = VLAN
> Tunnel-Medium-Type = IEEE-802
> Tunnel-Private-Group-ID = "1"
> EAP-Message =
> <2><2><0><28><4><16><241><185><222><167><132><20><175><196><10>;<234><21><1
>38>d<242>+tudalat Message-Authenticator = F<1>Q(|3Oc<5>$@4<22>t<208>~
>
> Wed Jan 21 14:52:33 2004: DEBUG: Handling request with Handler
> 'Realm=DEFAULT' Wed Jan 21 14:52:33 2004: DEBUG: Rewrote user name to
> tudalat
> Wed Jan 21 14:52:33 2004: DEBUG: Deleting session for tudalat,
> xxx.xxx.254.224, 21 Wed Jan 21 14:52:33 2004: DEBUG: Handling with
> Radius::AuthLDAP2: uidauthent Wed Jan 21 14:52:33 2004: DEBUG: Handling
> with EAP: code 2, 2, 28
> Wed Jan 21 14:52:33 2004: DEBUG: Response type 4
> Wed Jan 21 14:52:33 2004: INFO: Connecting to test.ldap.ucalgary.ca, port
> 389 Wed Jan 21 14:52:33 2004: INFO: Attempting to bind to LDAP server
> test.ldap.ucalgary.ca:389) Wed Jan 21 14:52:33 2004: DEBUG: LDAP got result
> for uid=tudalat,ou=uidauthent,o=ucalgary.ca Wed Jan 21 14:52:33 2004:
> DEBUG: Radius::AuthLDAP2 looks for match with tudalat Wed Jan 21 14:52:33
> 2004: DEBUG: Radius::AuthLDAP2 ACCEPT:
> Wed Jan 21 14:52:33 2004: DEBUG: EAP result: 1, EAP MD5-Challenge failed
> Wed Jan 21 14:52:33 2004: INFO: Access rejected for tudalat: EAP
> MD5-Challenge failed Wed Jan 21 14:52:33 2004: DEBUG: Packet dump:
> *** Sending to xxx.xxx.254.224 port 1024 ....
> Code: Access-Reject
> Identifier: 167
> Authentic: <3><187><208>-3{e<252>H<196>)e<250><185><171><127>
> Attributes:
> EAP-Message = <4><2><0><4>
> Message-Authenticator =
> <0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0> Reply-Message = "Request
> Denied"
>
> Can you advise?
>
> thanks
> Andy Dalat
> tudalat at shaw.ca
--
Mike McCauley mikem at open.com.au
Open System Consultants Pty. Ltd Unix, Perl, Motif, C++, WWW
9 Bulbul Place Currumbin Waters QLD 4223 Australia http://www.open.com.au
Phone +61 7 5598-7474 Fax +61 7 5598-7070
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. SQL, proxy, DBM, files, LDAP, NIS+, password, NT, Emerald,
Platypus, Freeside, TACACS+, PAM, external, Active Directory, EAP, TLS,
TTLS, PEAP etc on Unix, Windows, MacOS etc.
===
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.
More information about the radiator
mailing list