(RADIATOR) Windows LSA, LEAP, and RewriteUsername
Kawakubo, Ken
kkawakub at fhcrc.org
Thu Sep 16 17:42:29 CDT 2004
Hi Mike,
I downloaded the latest patch and copied EAP_17.pm of exactly 5760 bytes to
C:\Perl\site\lib\Radius directory and my radiator "distribution" directory.
I restarted radiator and tried LEAP authentication. I am getting the same
authentication failure with a username with realm. I paste the log here
again. The config is the same as bebore.
What I do not understand is that there is a line with "DEBUG:
Radius::AuthLSA ACCEPT:" and then the next line says WARNING: Could not
LogonUserNetworkMSCHAP: Logon failure: unknown user name or bad password."
Ken Kawakubo
Code: Access-Request
Identifier: 150
Authentic: <164><227>"<139><187>u<199><134>VL<14><249>Z<<138>q
Attributes:
User-Name = "wireless1 at fhcrc.org"
Framed-MTU = 1400
Called-Station-Id = "0011.21fd.20e0"
Calling-Station-Id = "0030.6528.c3fa"
Service-Type = Login-User
Message-Authenticator =
<160><134><240><159><201>U8<19><179>I<179><174>.<207><6><210>
EAP-Message =
<2><2><0>3<17><1><0><24><160><137>|<15><17><128><187><168><152><127><153><31
>/<159>|<147><231>$<127>S<168><197>k<215>wireless1 at fhcrc.org
NAS-Port-Type = Wireless-IEEE-802-11
NAS-Port = 436
NAS-IP-Address = aaa.bbb.ccc.ddd
NAS-Identifier = "test1g-ap "
Thu Sep 16 15:22:00 2004: DEBUG: Handling request with Handler ''
Thu Sep 16 15:22:00 2004: DEBUG: Deleting session for wireless1 at fhcrc.org,
aaa.bbb.ccc.ddd, 436
Thu Sep 16 15:22:00 2004: DEBUG: Handling with Radius::AuthLSA:
Thu Sep 16 15:22:00 2004: DEBUG: Handling with EAP: code 2, 2, 51
Thu Sep 16 15:22:00 2004: DEBUG: Response type 17
Thu Sep 16 15:22:00 2004: DEBUG: Rewrote identity to wireless1
Thu Sep 16 15:22:00 2004: DEBUG: Radius::AuthLSA looks for match with
wireless1
Thu Sep 16 15:22:00 2004: DEBUG: Radius::AuthLSA ACCEPT:
Thu Sep 16 15:22:00 2004: WARNING: Could not LogonUserNetworkMSCHAP: Logon
failure: unknown user name or bad password.
Thu Sep 16 15:22:00 2004: DEBUG: EAP result: 1, Bad LEAP Password
Thu Sep 16 15:22:00 2004: INFO: Access rejected for wireless1 at fhcrc.org: Bad
LEAP Password
Thu Sep 16 15:22:00 2004: DEBUG: Packet dump:
*** Sending to 140.107.74.146 port 21652 ....
Code: Access-Reject
Identifier: 150
Authentic: <164><227>"<139><187>u<199><134>VL<14><249>Z<<138>q
Attributes:
EAP-Message = <4><2><0><4>
Message-Authenticator =
<0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0>
Reply-Message = "Request Denied"
-----Original Message-----
From: Mike McCauley [mailto:mikem at open.com.au]
Sent: Thursday, September 16, 2004 2:47 PM
To: Kawakubo, Ken
Cc: radiator at open.com.au
Subject: Re: (RADIATOR) Windows LSA, LEAP, and RewriteUsername
Hello Ken,
there was a recent problem with the 3.9 patch set: the EAP_17.pm that should
have been included was inadvertently left out.
You should confirm that you have the very latest patch set, including
EAP_17.pm of exactly 5760 bytes.
Cheers.
On Friday 17 September 2004 02:46, Kawakubo, Ken wrote:
> All,
>
> I am in the process of migrating Radiator 3.9 with the latest patches
> from Linux to Windows platform to take advantage of Authby LSA for
> PEAP, EAP-TTLS, and LEAP wireless access.
>
> I have managed to get PEAP and EAP-TTLS to work with LSA but having
> problems with LEAP.
>
> I created a test radius.conf which is only concerned with LEAP LSA
> authentication.
>
> Here is the snippet.
>
> <Handler>
> <AuthBy LSA>
>
> RewriteUsername s/^([^@]+).*/$1/
>
> Domain fhcrc
>
> DefaultDomain fhcrc
>
> DomainController wluc01
>
> EAPType LEAP
>
> </AuthBy>
>
> AcctLogFileName %L/detail
> AuthLog eap-authlog
> </Handler>
>
> I tested with MacOSX Internet Connect. When I enter a username without
> realm name, I get Access-Accept, but when I enter a username with a
> realm name, I get Access-Reject.
>
> Here are the differences in Trace 4 logs.
>
> When I enter a username without realm name:
>
> Thu Sep 16 09:31:53 2004: DEBUG: Packet dump:
> *** Received from aaa.bbb.ccc.ddd port 21651 ....
> Code: Access-Request
> Identifier: 76
> Authentic: <181><166>9<2>v<19><20><249><171><13>?:7<141><186><154>
> Attributes:
> User-Name = "wireless1"
> Framed-MTU = 1400
> Called-Station-Id = "0011.21fd.20e0"
> Calling-Station-Id = "0030.6528.c3fa"
> Service-Type = Login-User
> Message-Authenticator = iED>@<170>H<0><138><9>b<8>T<136><6><179>
> EAP-Message =
> <1><2><0><25><17><1><0><8><2>x<186><196>4W<195>twireless1
> NAS-Port-Type = Wireless-IEEE-802-11
> NAS-Port = 319
> NAS-IP-Address = aaa.bbb.ccc.ddd
> NAS-Identifier = "test1g-ap "
>
> Thu Sep 16 09:31:53 2004: DEBUG: Handling request with Handler '' Thu
>Sep 16 09:31:53 2004: DEBUG: Deleting session for wireless1,
>aaa.bbb.ccc.ddd, 319 Thu Sep 16 09:31:53 2004: DEBUG: Handling with
>Radius::AuthLSA: Thu Sep 16 09:31:53 2004: DEBUG: Handling with EAP:
>code 1, 2, 25 Thu Sep 16 09:31:53 2004: DEBUG: EAP Request 17
> Thu Sep 16 09:31:53 2004: DEBUG: Rewrote identity to wireless1
> Thu Sep 16 09:31:53 2004: DEBUG: Radius::AuthLSA looks for match with
> wireless1
> Thu Sep 16 09:31:53 2004: DEBUG: Radius::AuthLSA ACCEPT:
> Thu Sep 16 09:31:53 2004: DEBUG: EAP result: 0, EAP LEAP Accept
> Thu Sep 16 09:31:53 2004: DEBUG: Access accepted for wireless1
> Thu Sep 16 09:31:53 2004: DEBUG: Packet dump:
> *** Sending to 140.107.74.146 port 21651 ....
> Code: Access-Accept
> Identifier: 76
> Authentic: <181><166>9<2>v<19><20><249><171><13>?:7<141><186><154>
> Attributes:
> EAP-Message =
>
<2><2><0>)<17><1><0><24><159><186><226>2<7>l<17><215><192>F)<217><231><23><
>1 54><136><144><158><218><145><216>k[<185>wireless1
> Message-Authenticator =
> <0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0>
> cisco-avpair =
>
"leap:session-key=<181>ga<8><185>,a<166>;H2<182><152>"<150><206>k<28><10>"n
>G <10><11><5>^<12><127>K7<168><13><127>~
>
>
> when I enter a username with realm name:
>
> Thu Sep 16 09:32:25 2004: DEBUG: Packet dump:
> *** Received from aaa.bbb.ccc.ddd port 21651 ....
> Code: Access-Request
> Identifier: 80
> Authentic: Q<"<130>xx<154><132><231><248>\<21><217>a<150><250>
> Attributes:
> User-Name = "wireless1 at fhcrc.org"
> Framed-MTU = 1400
> Called-Station-Id = "0011.21fd.20e0"
> Calling-Station-Id = "0030.6528.c3fa"
> Service-Type = Login-User
> Message-Authenticator =
>hvEQ<241><200>`<176><130><27><201><217><20><178><245><165>
> EAP-Message =
><2><2><0>3<17><1><0><24><186><242><144><131><174><188>7,l;<150><206>!G<
>3><2
>0
>
> ><133>W<147>ln<214>])wireless1 at fhcrc.org
>
> NAS-Port-Type = Wireless-IEEE-802-11
> NAS-Port = 320
> NAS-IP-Address = aaa.bbb.ccc.ddd
> NAS-Identifier = "test1g-ap "
>
> Thu Sep 16 09:32:25 2004: DEBUG: Handling request with Handler '' Thu
> Sep 16 09:32:25 2004: DEBUG: Deleting session for
> wireless1 at fhcrc.org, aaa.bbb.ccc.ddd, 320 Thu Sep 16 09:32:25 2004:
> DEBUG: Handling with Radius::AuthLSA: Thu Sep 16 09:32:25 2004: DEBUG:
> Handling with EAP: code 2, 2, 51 Thu Sep 16 09:32:25 2004: DEBUG:
> Response type 17 Thu Sep 16 09:32:25 2004: DEBUG: Rewrote identity to
> wireless1 Thu Sep 16 09:32:25 2004: DEBUG: Radius::AuthLSA looks for
> match with wireless1
> Thu Sep 16 09:32:25 2004: DEBUG: Radius::AuthLSA ACCEPT:
> Thu Sep 16 09:32:25 2004: WARNING: Could not LogonUserNetworkMSCHAP: Logon
> failure: unknown user name or bad password.
>
>
> Thu Sep 16 09:32:25 2004: DEBUG: EAP result: 1, Bad LEAP Password Thu
> Sep 16 09:32:25 2004: INFO: Access rejected for wireless1 at fhcrc.org:
> Bad LEAP Password Thu Sep 16 09:32:25 2004: DEBUG: Packet dump:
> *** Sending to 140.107.74.146 port 21651 ....
> Code: Access-Reject
> Identifier: 80
> Authentic: Q<"<130>xx<154><132><231><248>\<21><217>a<150><250>
> Attributes:
> EAP-Message = <4><2><0><4>
> Message-Authenticator =
> <0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0>
> Reply-Message = "Request Denied"
>
> Please note that RewriteUsername appears to be removing realm name in
> either case. I made sure that I used the same password in both cases.
> I read in the mailing archive that a patch was issued for LEAP to
> accept RewriteUsername previously, but the patch does not seem to be
> working. I am using EAP_17.pm dated 12/23/2003 3:40pm.
>
> Ken Kawakubo
> FHCRC IT
>
> --
> Archive at http://www.open.com.au/archives/radiator/
> Announcements on radiator-announce at open.com.au
> To unsubscribe, email 'majordomo at open.com.au' with 'unsubscribe
> radiator' in the body of the message.
--
Mike McCauley mikem at open.com.au
Open System Consultants Pty. Ltd Unix, Perl, Motif, C++, WWW
9 Bulbul Place Currumbin Waters QLD 4223 Australia http://www.open.com.au
Phone +61 7 5598-7474 Fax +61 7 5598-7070
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. SQL, proxy, DBM, files, LDAP, NIS+, password, NT, Emerald,
Platypus, Freeside, TACACS+, PAM, external, Active Directory, EAP, TLS,
TTLS, PEAP etc on Unix, Windows, MacOS etc.
--
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.
More information about the radiator
mailing list