(RADIATOR) AuthBy LSA / Domain keyword
Stuart Kendrick
skendric at fhcrc.org
Sun Sep 10 21:59:55 CDT 2006
hi,
my question:
What is it about LEAP which makes using the 'Domain' keyword in the
<AuthBy LSA> stanza unproductive?
here's my story:
i have a working Handler for LEAP clients:
#### Wireless Clients using LEAP #####
<Handler Realm=fhcrc.org>
AuthByPolicy ContinueWhileReject
<AuthBy LSA>
RewriteUsername s/^([^@]+).*/$1/
DomainController dc1
EAPType LEAP
</AuthBy>
# Log it
AuthLog wap-authlog
AcctLogFileName %L/Acct/%Y-%m-%d-acct
</Handler>
where 'dc1' is the name of a domain controller
but what happens if 'dc1' is down? how do i tell Radiator to consult
other domain controllers?
so i tried this:
#### Wireless Clients using LEAP #####
<Handler Realm=fhcrc.org>
AuthByPolicy ContinueWhileReject
<AuthBy LSA>
RewriteUsername s/^([^@]+).*/$1/
Domain company.com
EAPType LEAP
</AuthBy>
# Log it
AuthLog wap-authlog
AcctLogFileName %L/Acct/%Y-%m-%d-acct
</Handler>
where 'company.com' is the name of my Active Directory domain. but now,
LEAP clients fail to authenticate:
Sun Sep 10 19:44:32 2006: DEBUG: Packet dump:
*** Received from 10.2.3.4 port 1645 ....
Code: Access-Request
Identifier: 42
Authentic: <181>q[...]
<174>
Attributes:
User-Name = "skendric at fhcrc.org"
Framed-MTU = 1400
Called-Station-Id = "0013.c48a.e0e0"
Calling-Station-Id = "000d.282e.7ca8"
Service-Type = Login-User
Message-Authenticator = z&1<200>[...]*<251><215>
EAP-Message = <2><1><0><21><1>skendric at fhcrc.org
NAS-Port-Type = Wireless-IEEE-802-11
NAS-Port = 274
NAS-IP-Address = 10.2.3.4
NAS-Identifier = "test-ap "
Sun Sep 10 19:44:32 2006: DEBUG: Handling request with Handler
'Realm=company.com'
Sun Sep 10 19:44:32 2006: DEBUG: Deleting session for
skendric at fhcrc.org, 10.2.3.4, 274
Sun Sep 10 19:44:32 2006: DEBUG: Handling with Radius::AuthLSA:
Sun Sep 10 19:44:32 2006: DEBUG: Handling with EAP: code 2, 1, 21
Sun Sep 10 19:44:32 2006: DEBUG: Response type 1
Sun Sep 10 19:44:32 2006: DEBUG: EAP result: 3, EAP LEAP Challenge
Sun Sep 10 19:44:32 2006: DEBUG: AuthBy LSA result: CHALLENGE, EAP LEAP
Challenge
Sun Sep 10 19:44:32 2006: DEBUG: Access challenged for
skendric at fhcrc.org: EAP LEAP Challenge
Sun Sep 10 19:44:32 2006: DEBUG: Packet dump:
*** Sending to 10.2.3.4 port 1645 ....
Code: Access-Challenge
Identifier: 42
Authentic: <181>q[...]<174>
Attributes:
EAP-Message = <1><2>[...]skendric at fhcrc.org
Message-Authenticator =
<0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0>
Sun Sep 10 19:44:32 2006: DEBUG: Packet dump:
*** Received from 10.2.3.4 port 1645 ....
Code: Access-Request
Identifier: 43
Authentic: j([...]$<240>
Attributes:
User-Name = "skendric at fhcrc.org"
Framed-MTU = 1400
Called-Station-Id = "0013.c48a.e0e0"
Calling-Station-Id = "000d.282e.7ca8"
Service-Type = Login-User
Message-Authenticator = <139>s[...]G<225>
EAP-Message = <2><2><0>0[...]F<149>+9m+'skendric at fhcrc.org
NAS-Port-Type = Wireless-IEEE-802-11
NAS-Port = 274
NAS-IP-Address = 10.2.3.4
NAS-Identifier = "test-ap "
Sun Sep 10 19:44:32 2006: DEBUG: Handling request with Handler
'Realm=company.com'
Sun Sep 10 19:44:32 2006: DEBUG: Deleting session for
skendric at fhcrc.org, 1.2.3.4, 274
Sun Sep 10 19:44:32 2006: DEBUG: Handling with Radius::AuthLSA:
Sun Sep 10 19:44:32 2006: DEBUG: Handling with EAP: code 2, 2, 48
Sun Sep 10 19:44:32 2006: DEBUG: Response type 17
Sun Sep 10 19:44:32 2006: DEBUG: Rewrote identity to skendric
Sun Sep 10 19:44:32 2006: DEBUG: Radius::AuthLSA looks for match with
skendric[skendric at fhcrc.org]
Sun Sep 10 19:44:32 2006: DEBUG: Radius::AuthLSA ACCEPT: :
skendric[skendric at fhcrc.org]
Sun Sep 10 19:44:32 2006: WARNING: Could not LogonUserNetworkMSCHAP:
Logon failure: unknown user name or bad password.
Sun Sep 10 19:44:32 2006: DEBUG: EAP result: 1, Bad LEAP Password
Sun Sep 10 19:44:32 2006: DEBUG: AuthBy LSA result: REJECT, Bad LEAP
Password
Sun Sep 10 19:44:32 2006: INFO: Access rejected for skendric at fhcrc.org:
Bad LEAP Password
Sun Sep 10 19:44:32 2006: DEBUG: Packet dump:
*** Sending to 10.2.3.4 port 1645 ....
Code: Access-Reject
Identifier: 43
Authentic: j([...]$<240>
Attributes:
EAP-Message = <4><2><0><4>
Message-Authenticator =
<0><0><0><0><0><0><0><0><0><0><0><0><0><0><0><0>
Reply-Message = "Request Denied"
^C
G:\Radiator\Logs>
i also tried using the NetBIOS name for my domain, i.e. "COMPANY"
#### Wireless Clients using LEAP #####
<Handler Realm=fhcrc.org>
AuthByPolicy ContinueWhileReject
<AuthBy LSA>
RewriteUsername s/^([^@]+).*/$1/
Domain COMPANY
EAPType LEAP
</AuthBy>
# Log it
AuthLog wap-authlog
AcctLogFileName %L/Acct/%Y-%m-%d-acct
</Handler>
but that didn't help.
interestingly enough, i use the 'Domain COMPANY' keyword successfully
elsewhere, for example see here ... a larger snippet of my radius.cfg file:
[...]
#### Wireless Clients using PEAP #####
<Handler TunnelledByPEAP=1>
<AuthBy LSA>
Domain COMPANY
EAPType MSCHAP-V2
</AuthBy>
# Log it
AuthLog wap-authlog
AcctLogFileName %L/Acct/%Y-%m-%d-acct
</Handler>
#### Wireless Clients using EAP-TLS #####
<Handler TunnelledByTTLS=1>
<AuthBy LSA>
Domain COMPANY
</AuthBy>
# Log it
AuthLog wap-authlog
AcctLogFileName %L/Acct/%Y-%m-%d-acct
</Handler>
#### Wireless Clients using LEAP #####
<Handler Realm=fhcrc.org>
AuthByPolicy ContinueWhileReject
<AuthBy LSA>
RewriteUsername s/^([^@]+).*/$1/
# Domain COMPANY
DomainController dc1
EAPType LEAP
</AuthBy>
# Log it
AuthLog wap-authlog
AcctLogFileName %L/Acct/%Y-%m-%d-acct
</Handler>
#### Wireless Clients using PEAP and EAP-TTLS #####
# This is also the default handler
<Handler>
AuthByPolicy ContinueUntilAccept
<AuthBy FILE>
Filename %D/users.anonymous
EAPType PEAP,TTLS
EAPTLS_PEAPVersion 0
EAPTLS_CAFile C:/[...]/cacert.pem
EAPTLS_CertificateFile C:/[...]/straus.pem
EAPTLS_CertificateType PEM
EAPTLS_PrivateKeyFile C:/[...]/straus.pem
EAPTLS_PrivateKeyPassword secret
EAPTLS_MaxFragmentSize 1024
AutoMPPEKeys
SSLeayTrace 4
</AuthBy>
# Log it
AuthLog wap-authlog
AcctLogFileName %L/Acct/%Y-%m-%d-acct
</Handler>
What is it about LEAP which makes using the 'Domain' keyword in the
<AuthBy LSA> stanza unproductive?
--sk
stuart kendrick
fhcrc
--
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.
More information about the radiator
mailing list