(RADIATOR) MS-Chap ver2 from a Watchguard Firebox

Hugh Irvine hugh at open.com.au
Tue Jan 4 01:24:34 CST 2005


Hello Erik -

Have you checked the username and password using the "radpwtst" utility?

Can you please send me a copy of the user record from the database?

regards

Hugh


On 3 Jan 2005, at 23:48, Erik Wirring LE34 Trimble Center Danmark wrote:

> Hi
>
> I am trying to setup Radiator to validate VPN (pptp) users on a  
> Watchguard Firebox but I am getting no succes.
> I am pretty sure that it is not the password that is wrong.
>
> I have the un-encrypted password in the database field PASSWORD
> Her is the debug respons:
>
> Mon Jan  3 12:25:41 2005: DEBUG: Packet dump:
> *** Received from 192.168.34.200 port 16478 ....
> Code:       Access-Request
> Identifier: 31
> Authentic:   
> <31><228><205><211><130>V<136><239><31><198><224>ep<221><241>/
> Attributes:
> 	User-Name = "EW"
> 	MS-CHAP-Challenge = c~<140><222><2>?<247><185><4>tyQ<10>Y<175>J
> 	MS-CHAP2-Response =  
> <129><0><17><14>*<215>z'Qda<25><181>(<132><243>/ 
> N<0><0><0><0><0><0><0><0><239><227>~C/ 
> *a<171>e<225>{@<214>*ly<169>+%9<0><224><255><242>
> 	NAS-Identifier = "firebox"
> 	NAS-Port = 15453
> 	NAS-Port-Type = Virtual
> 	Service-Type = Authenticate-Only
>
> Mon Jan  3 12:25:41 2005: DEBUG: Handling request with Handler  
> 'Realm=DZONG'
> Mon Jan  3 12:25:41 2005: DEBUG: DZONGDB Deleting session for EW,  
> 192.168.34.200, 15453
> Mon Jan  3 12:25:41 2005: DEBUG: do query is: 'delete from RADONLINE  
> where NASIDENTIFIER='192.168.34.200' and NASPORT=015453':
> Mon Jan  3 12:25:41 2005: DEBUG: Handling with Radius::AuthSQL
> Mon Jan  3 12:25:41 2005: DEBUG: Handling with Radius::AuthSQL:
> Mon Jan  3 12:25:41 2005: DEBUG: Query is: 'select PASSWORD,  
> CHECKATTR, REPLYATTR from DzongLogin where BINARY  
> USERNAME='EW at DZONG'':
> Mon Jan  3 12:25:41 2005: DEBUG: Radius::AuthSQL looks for match with  
> EW at DZONG
> Mon Jan  3 12:25:41 2005: DEBUG: Radius::AuthSQL REJECT: Bad Password
> Mon Jan  3 12:25:41 2005: DEBUG: Query is: 'select PASSWORD,  
> CHECKATTR, REPLYATTR from DzongLogin where BINARY USERNAME='DEFAULT'':
> Mon Jan  3 12:25:41 2005: INFO: Access rejected for EW at DZONG: Bad  
> Password
> Mon Jan  3 12:25:41 2005: DEBUG: Packet dump:
> *** Sending to 192.168.34.200 port 16478 ....
> Code:       Access-Reject
> Identifier: 31
> Authentic:   
> <31><228><205><211><130>V<136><239><31><198><224>ep<221><241>/
> Attributes:
> 	Reply-Message = "Request Denied"
>
> Here a part of the config:
>>
> # WatchGuard Firebox X700 Dzong
> <Client 192.168.34.200>
> 	Secret	*********
> 	DupInterval 2
> 	DefaultRealm DZONG
> </Client>
> .
> .
> .
> <SessionDatabase SQL>
>
> 	DBSource	dbi:mysql:radius
> 	DBUsername	ob
> 	DBAuth		*********
> 	Identifier  DZONGDB
> 	
> 	#AddQuery insert into DZONGONLINE (USERNAME, NASIDENTIFIER,  
> ACCTSESSIONID, TIME_STAMP, FRAMEDIPADDRESS) values  
> ('%{Calling-Station-Id}', '%N', '%{Acct-Session-Id}', %{Timestamp},  
> '%{Framed-IP-Address}')
> 	#DeleteQuery delete from DZONGONLINE where NASIDENTIFIER='%N' and  
> USERNAME='%{Calling-Station-Id}'
> 	#ClearNasQuery delete from DZONGONLINE where NASIDENTIFIER='%N'
> 	#CountQuery select NASIDENTIFIER, ACCTSESSIONID from GPRSONLINE where  
> USERNAME='%{Calling-Station-Id}'
>
> </SessionDatabase>
>
> # This will authenticate users from SUBSCRIBERS
> <Realm DEFAULT>
> .
> .
> .
> </Realm>
>
> <Realm DZONG>
>
>    <AuthBy SQL>
>
> 	#RewriteUsername s/^([^@]+).*/$1/
>
> 	DBSource	dbi:mysql:radius
> 	DBUsername	ob
> 	DBAuth		****************
>    AuthSelect select PASSWORD, CHECKATTR, REPLYATTR from DzongLogin  
> where BINARY USERNAME=%0
>
> 	AutoMPPEKeys
> 	AddToReply Filter-Id = pptp_users
>
> 	# You may want to tailor these for your ACCOUNTING table
> 	# You can add your own columns to store whatever you like
>
>
>     </AuthBy>
>     SessionDatabase DZONGDB
> </Realm>
>
> Best Regards
>
> Erik Wirring
> Chief Software Engineer
> Chartered Surveyor
>
> Email: EW at TrimbleCenter.Dk
> Direct tel: +45 77 332 257
> Mobile   : +45 51 314 257
>
> Trimble Center Danmark A/S
> Energivej 34
> DK-2750 Ballerup
> Denmark
> Tel: +45 77 332 233
> Fax.+45 77 332 299
> Http://www.TrimbleCenter.Dk
> Http://GPSnet.dk     The Electronic Referencenetwork of Denmark
>
> --
> Archive at http://www.open.com.au/archives/radiator/
> Announcements on radiator-announce at open.com.au
> To unsubscribe, email 'majordomo at open.com.au' with
> 'unsubscribe radiator' in the body of the message.
>
>

NB:

Have you read the reference manual ("doc/ref.html")?
Have you searched the mailing list archive  
(www.open.com.au/archives/radiator)?
Have you had a quick look on Google (www.google.com)?
Have you included a copy of your configuration file (no secrets),
together with a trace 4 debug showing what is happening?

-- 
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. Available on *NIX, *BSD, Windows, MacOS X.
-
Nets: internetwork inventory and management - graphical, extensible,
flexible with hardware, software, platform and database independence.
-
CATool: Private Certificate Authority for Unix and Unix-like systems.

--
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.


More information about the radiator mailing list