Nie jesteś zalogowany.
Jeśli nie posiadasz konta, zarejestruj je już teraz! Pozwoli Ci ono w pełni korzystać z naszego serwisu. Spamerom dziękujemy!

Ogłoszenie

Prosimy o pomoc dla małej Julki — przekaż 1% podatku na Fundacji Dzieciom zdazyć z Pomocą.
Więcej informacji na dug.net.pl/pomagamy/.

Strony: 1

 

#1  2011-07-21 13:25:11

  czeri - Użytkownik

czeri
Użytkownik
Zarejestrowany: 2011-07-08

Debian Squeeze FreeRadius + OpenLDAP

Cześć, połączył już ktoś z was FreeRadiusa z OpenLdap-em na debianie 6 ? Bo mi coś nie chce działać. Użytkowników wpisywanych bezpośrednio w pliku users autoryzuje, tych z bazdy ldap już nie.

moduł ldap:

Kod:

ldap {
    server = "localhost"
    basedn = "dc=mojafirma,dc=msft"
    filter = (uid=%{%{Stripped-User-Name}:-%{User-Name}})"
    ldap_connections_number = 5
    timeout = 4
    timelimit = 3
    net_timeout = 1
    dictionary_mapping = ${confdir}/ldap.attrmap
    password_attribute = "userPassword"

clients.conf

Kod:

client 192.168.0.0/24{
secret = testing123
shorname = Ap_w_sieci_testowej
}

sites-enable/default

Kod:

authorize {
  preprocess
  chap
  mschap
  digest
  suffix
  files
  ldap
  expiration
  logintime
  pap
}

authenticate {

Auth-Type PAP {
    pap
}

Auth-Type CHAP {
    chap
}

Auth-Type MS-CHAP {
    mschap
}

digest
pam
unix

Auth-Type LDAP {
   ldap
}

eap
}

Takie dosteje logi:

Kod:

rad_recv: Access-Request packet from host 192.168.0.50 port 3072, id=97, length=175
    User-Name = "ccolumbus"
    NAS-IP-Address = 192.168.0.50
    NAS-Port = 0
    Called-Station-Id = "00195b54c564"
    Calling-Station-Id = "001f5bb7c6a0"
    NAS-Identifier = "Realtek Access Point. 8181"
    Framed-MTU = 1400
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0200000e0163636f6c756d627573
    Message-Authenticator = 0xd279a0f07fadc5d261ff07e3d2e3790b
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "ccolumbus", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 0 length 14
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
[ldap] performing user authorization for ccolumbus
[ldap]     expand: %{Stripped-User-Name} -> 
[ldap]     ... expanding second conditional
[ldap]     expand: %{User-Name} -> ccolumbus
[ldap]     expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ccolumbus)
[ldap]     expand: dc=mojafirma,dc=msft -> dc=mojafirma,dc=msft
  [ldap] ldap_get_conn: Checking Id: 0
  [ldap] ldap_get_conn: Got Id: 0
  [ldap] attempting LDAP reconnection
  [ldap] (re)connect to localhost:389, authentication 0
  [ldap] bind as / to localhost:389
  [ldap] waiting for bind result ...
  [ldap] Bind was successful
  [ldap] performing search in dc=mojafirma,dc=msft, with filter (uid=ccolumbus)
[ldap] No default NMAS login sequence
[ldap] looking for check items in directory...
[ldap] looking for reply items in directory...
WARNING: No "known good" password was found in LDAP.  Are you sure that the user is configured correctly?
[ldap] user ccolumbus authorized to use remote access
  [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.  Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type md5
rlm_eap_md5: Issuing Challenge
++[eap] returns handled
Sending Access-Challenge of id 97 to 192.168.0.50 port 3072
    EAP-Message = 0x010100160410d6ebd1894e28e4eef2706d607a3636cc
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x09beaa5b09bfae452e59a5fef2645ec6
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.0.50 port 3072, id=98, length=179
    User-Name = "ccolumbus"
    NAS-IP-Address = 192.168.0.50
    NAS-Port = 0
    Called-Station-Id = "00195b54c564"
    Calling-Station-Id = "001f5bb7c6a0"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x020100060319
    State = 0x09beaa5b09bfae452e59a5fef2645ec6
    Message-Authenticator = 0xfa0b4f5092f53afe601847069312fc96
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "ccolumbus", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 1 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
[ldap] performing user authorization for ccolumbus
[ldap]     expand: %{Stripped-User-Name} -> 
[ldap]     ... expanding second conditional
[ldap]     expand: %{User-Name} -> ccolumbus
[ldap]     expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ccolumbus)
[ldap]     expand: dc=mojafirma,dc=msft -> dc=mojafirma,dc=msft
  [ldap] ldap_get_conn: Checking Id: 0
  [ldap] ldap_get_conn: Got Id: 0
  [ldap] performing search in dc=mojafirma,dc=msft, with filter (uid=ccolumbus)
[ldap] No default NMAS login sequence
[ldap] looking for check items in directory...
[ldap] looking for reply items in directory...
WARNING: No "known good" password was found in LDAP.  Are you sure that the user is configured correctly?
[ldap] user ccolumbus authorized to use remote access
  [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.  Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP NAK
[eap] EAP-NAK asked for EAP-Type/peap
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 98 to 192.168.0.50 port 3072
    EAP-Message = 0x010200061920
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x09beaa5b08bcb3452e59a5fef2645ec6
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.0.50 port 3072, id=99, length=285
    User-Name = "ccolumbus"
    NAS-IP-Address = 192.168.0.50
    NAS-Port = 0
    Called-Station-Id = "00195b54c564"
    Calling-Station-Id = "001f5bb7c6a0"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0202007019800000006616030100610100005d03014e280a460a696babe7f9079aa7ced8cca7dc9c99553852f403b04906f032e6bd000036002f000500040035000a000900030008000600320033003800390016001500140013001200110034003a0018001b001a0017001900010100
    State = 0x09beaa5b08bcb3452e59a5fef2645ec6
    Message-Authenticator = 0x318a1819f573cb9fef3951dee09ca46b
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "ccolumbus", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 2 length 112
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
  TLS Length 102
[peap] Length Included
[peap] eaptls_verify returned 11 
[peap]     (other): before/accept initialization
[peap]     TLS_accept: before/accept initialization
[peap] <<< TLS 1.0 Handshake [length 0061], ClientHello  
[peap]     TLS_accept: SSLv3 read client hello A
[peap] >>> TLS 1.0 Handshake [length 002a], ServerHello  
[peap]     TLS_accept: SSLv3 write server hello A
[peap] >>> TLS 1.0 Handshake [length 0898], Certificate  
[peap]     TLS_accept: SSLv3 write certificate A
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone  
[peap]     TLS_accept: SSLv3 write server done A
[peap]     TLS_accept: SSLv3 flush data
[peap]     TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase 
In SSL Accept mode  
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 99 to 192.168.0.50 port 3072
    EAP-Message = 0x0103040019c0000008d5160301002a0200002603014e280a42a4ae7c9673b5ab374daa6e80a36ba424878abf9d8009364632e3235900002f0016030108980b0008940008910003c0308203bc308202a4a003020102020101300d06092a864886f70d010104050030819d310b300906035504061302504c311e301c06035504081315546573746f77792d7365727765722d5261646975733110300e06035504071307476c697769636531173015060355040a130e4d6f6a616669726d612e6d7366743123302106092a864886f70d010901161461646d696e406d6f6a616669726d612e6d736674311e301c06035504031315546573746f777920736572
    EAP-Message = 0x77657220526164697573301e170d3131303731393131313631345a170d3132303731383131313631345a30818b310b300906035504061302504c311e301c06035504081315546573746f77792d7365727765722d52616469757331173015060355040a130e4d6f6a616669726d612e6d736674311e301c06035504031315546573746f777920736572776572205261646975733123302106092a864886f70d010901161461646d696e406d6f6a616669726d612e6d73667430820122300d06092a864886f70d01010105000382010f003082010a0282010100cc8e6457806403ac2c0806a110894649f18880528931ca104b7c31c70263235a09bb2b11
    EAP-Message = 0xaa0975a675c9c14355bbeb665e47b9ee0ebcce4287e98378c4f80276263c97533c8f645753dce7dbf4d463b52dee1f2273c55b965658b07d7d64e1617b1786e68029c1d20a0adfce06e4b7e1ab0000c221dea679f4fafbf6b3ad56b90b368787e822cedaa32c3f39bd10fd668037822fa658ebbe1f4bf1d38042506521aed72876f02ce8227d712ccc562accca41ee72fcec0b9625bd7da32980dcf75f095a5a7118a9d759e49834776857090b25d613cff0c721bd7a0a32fb3af485fe18fbf2499c47fa2237eaf8b5a30d92abcfd2aaa4d16d526a8337ef0dfe8bd50203010001a317301530130603551d25040c300a06082b06010505070301300d06
    EAP-Message = 0x092a864886f70d0101040500038201010092e9d4fc98969267e9f150b44b8a227f4aadddc2bef70268d0c6f90b53f754b978eb7e9d2e21f94ae437206af452d2b004d27b524f572e4f991a1a124687934da8146765542a7820f89fc10745655225977cf1c37e1224a7d99d88781bb67319e21727b4e4b81b966b5766a192e64679536356153fc3b5c97bf4706441d374ed5a7ed5d07ef6f03abed54e291c89f51e7540209196a27437e56e18c3404f09a6d9d26acdcadd7cf369912c28d2dfbd80c7af71321a522d2ac477c404959b1409d75973640e50596195086c9c980cb208626e8400e2bb769f2b3075d5ba8f2765730a48245a2f1389f55aa7cf
    EAP-Message = 0x616f90001b8381b16d5f1bde
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x09beaa5b0bbdb3452e59a5fef2645ec6
Finished request 2.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.0.50 port 3072, id=100, length=179
    User-Name = "ccolumbus"
    NAS-IP-Address = 192.168.0.50
    NAS-Port = 0
    Called-Station-Id = "00195b54c564"
    Calling-Station-Id = "001f5bb7c6a0"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x020300061900
    State = 0x09beaa5b0bbdb3452e59a5fef2645ec6
    Message-Authenticator = 0x94e25096927490a9c5bc3ad01bc0dc90
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "ccolumbus", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 3 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 100 to 192.168.0.50 port 3072
    EAP-Message = 0x010403fc194017a728f361e364a20004cb308204c7308203afa003020102020900b20eb3984bc43950300d06092a864886f70d010105050030819d310b300906035504061302504c311e301c06035504081315546573746f77792d7365727765722d5261646975733110300e06035504071307476c697769636531173015060355040a130e4d6f6a616669726d612e6d7366743123302106092a864886f70d010901161461646d696e406d6f6a616669726d612e6d736674311e301c06035504031315546573746f77792073657277657220526164697573301e170d3131303731393131313631345a170d3236303731353131313631345a30819d310b
    EAP-Message = 0x300906035504061302504c311e301c06035504081315546573746f77792d7365727765722d5261646975733110300e06035504071307476c697769636531173015060355040a130e4d6f6a616669726d612e6d7366743123302106092a864886f70d010901161461646d696e406d6f6a616669726d612e6d736674311e301c06035504031315546573746f7779207365727765722052616469757330820122300d06092a864886f70d01010105000382010f003082010a0282010100d584d59b13afef8f99cfb120e28985bf0b86f05d678724b804e68d255efacfac25ad5454bce32b49ebaa1fa44b2077980db5a2a4c908b73371599bf000e52a59c4
    EAP-Message = 0x8d83978ccde1146defb06498bae5bf6e6caae91bf05887d721d4c97c3adfddcad32770f897be4c3599cfeaef2f2c0803ec1bbd5a211af19f5e8e89fd0bc20bc269b1784068fe5de41f6e7ba791339a54c2791d78dab98bc798943f0388da2c2e9a5924d8ba74162bfed0cdfcfbaacadbc8a1f6102cb445f1e7d7ec8e485dd696bf4b915a5e64147887d05c40dffe6348e1f1257e231951ee8822541fdb305f2b19106d4baf0c0ca4e21b1898d36f5cac6c9d515fd36afaf4ff06c9fd6c36f70203010001a382010630820102301d0603551d0e04160414eabea23c21752f4d7a18b51f0802695027ab7a993081d20603551d230481ca3081c78014eabe
    EAP-Message = 0xa23c21752f4d7a18b51f0802695027ab7a99a181a3a481a030819d310b300906035504061302504c311e301c06035504081315546573746f77792d7365727765722d5261646975733110300e06035504071307476c697769636531173015060355040a130e4d6f6a616669726d612e6d7366743123302106092a864886f70d010901161461646d696e406d6f6a616669726d612e6d736674311e301c06035504031315546573746f77792073657277657220526164697573820900b20eb3984bc43950300c0603551d13040530030101ff300d06092a864886f70d010105050003820101001bf10f5174227fe922436c05a40f78cd49de1e8b9681a4cf
    EAP-Message = 0x7f5ab105dcdf0c5c
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x09beaa5b0abab3452e59a5fef2645ec6
Finished request 3.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.0.50 port 3072, id=101, length=179
    User-Name = "ccolumbus"
    NAS-IP-Address = 192.168.0.50
    NAS-Port = 0
    Called-Station-Id = "00195b54c564"
    Calling-Station-Id = "001f5bb7c6a0"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x020400061900
    State = 0x09beaa5b0abab3452e59a5fef2645ec6
    Message-Authenticator = 0xe8bea6291a3140e19e5bd8cbcc76fc22
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "ccolumbus", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 4 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 101 to 192.168.0.50 port 3072
    EAP-Message = 0x010500ef190096af66cb6f59b63640df390ae8139205e6ca35a2ad43b2460b08d2bae33d342ad369523c23f6922446c4d5c83ccf3861198366fb0bbfe6df95c33deccd613f5056b84d2b0a2abd4861c45b2bad3cf4600f268e8b00563319ac198216eb0a9de50fd3011fb5af1a7adff69bd999a5652f62288ba9f9f7822467bd63bb1ac83db9e58fc9bfa41c9f148d233dcb9529b644aa051fccabd14c562aa7bc9b2f6e2db0928e11f0f13d61393b510bea0b29d54bb0990dfe95f0236d93573829044a33884748abfb383ddcb01818af3d1b723bfdc1e27a3f19e688a3b3ec6efd274f05b216030100040e000000
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x09beaa5b0dbbb3452e59a5fef2645ec6
Finished request 4.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.0.50 port 3072, id=102, length=511
    User-Name = "ccolumbus"
    NAS-IP-Address = 192.168.0.50
    NAS-Port = 0
    Called-Station-Id = "00195b54c564"
    Calling-Station-Id = "001f5bb7c6a0"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0205015019800000014616030101061000010201006d0458a2af0a1bcb736fac4ff0711161bb28e6c464e30478587efefa06469bf4f3b7310e264b965955a59d1580b0a0f3ed9ac5ec7a5e34798e65bcf4d16edcac142a85eff70393c633a7eb142b287cae046051ba59ba3a90fce97f09c6b95a49cc950305d2c9f37f26bea810a85404aad442f37563716f35c2c6f54a1357ab6c676c6e6178466366a02a4a6805ac8d103dc7cb3f7eedac243e8403dcac240c9614a7b5b748b68157238a2e861704c9bef06f4c7a2f6f4c3641bdb0b7c1161030a4e8766e4ed5abd4f63c5b7720168710fe5ec71a981b849c34a5c23f392fbecaee3d0dcf4617ce2f
    EAP-Message = 0x400991414a15bbfd1249f91a8a5d1132fda22fc3bd82eb1c1403010001011603010030bbb77cef62eba6772246428290320ac3f51e9857a71b7d93b42a59df5b19c019eb0e5e15aa1e12f2677b22c3dff28b01
    State = 0x09beaa5b0dbbb3452e59a5fef2645ec6
    Message-Authenticator = 0x7336abe7b707c96dd81ba2280b245679
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "ccolumbus", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 5 length 253
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
  TLS Length 326
[peap] Length Included
[peap] eaptls_verify returned 11 
[peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange  
[peap]     TLS_accept: SSLv3 read client key exchange A
[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001]  
[peap] <<< TLS 1.0 Handshake [length 0010], Finished  
[peap]     TLS_accept: SSLv3 read finished A
[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001]  
[peap]     TLS_accept: SSLv3 write change cipher spec A
[peap] >>> TLS 1.0 Handshake [length 0010], Finished  
[peap]     TLS_accept: SSLv3 write finished A
[peap]     TLS_accept: SSLv3 flush data
[peap]     (other): SSL negotiation finished successfully
SSL Connection Established 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 102 to 192.168.0.50 port 3072
    EAP-Message = 0x010600411900140301000101160301003068db7618d35762e660eed690e9ac074aa4c08b46c9025916d466642594ff5e9b81a71dced8c8ce9e00ae41d99591be5c
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x09beaa5b0cb8b3452e59a5fef2645ec6
Finished request 5.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.0.50 port 3072, id=103, length=179
    User-Name = "ccolumbus"
    NAS-IP-Address = 192.168.0.50
    NAS-Port = 0
    Called-Station-Id = "00195b54c564"
    Calling-Station-Id = "001f5bb7c6a0"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x020600061900
    State = 0x09beaa5b0cb8b3452e59a5fef2645ec6
    Message-Authenticator = 0x0c794741e1dd3e59e7b3231aecd2d3af
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "ccolumbus", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 6 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake is finished
[peap] eaptls_verify returned 3 
[peap] eaptls_process returned 3 
[peap] EAPTLS_SUCCESS
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state TUNNEL ESTABLISHED
++[eap] returns handled
Sending Access-Challenge of id 103 to 192.168.0.50 port 3072
    EAP-Message = 0x0107002b190017030100205c58413bd4f0c4c84b900b65e82b0b6a5ff1033513445cc583d874d623ecd6b3
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x09beaa5b0fb9b3452e59a5fef2645ec6
Finished request 6.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 192.168.0.50 port 3072, id=104, length=216
    User-Name = "ccolumbus"
    NAS-IP-Address = 192.168.0.50
    NAS-Port = 0
    Called-Station-Id = "00195b54c564"
    Calling-Station-Id = "001f5bb7c6a0"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0207002b19001703010020083c1fcf5a952a3643988af6c41b6c4656cd98f52f29a455ba30284292f6ae9b
    State = 0x09beaa5b0fb9b3452e59a5fef2645ec6
    Message-Authenticator = 0x4d65dd1aebc251285cb30c0ca6c09af4
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "ccolumbus", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 7 length 43
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state WAITING FOR INNER IDENTITY
[peap] Identity - ccolumbus
[peap] Got inner identity 'ccolumbus'
[peap] Setting default EAP type for tunneled EAP session.
[peap] Got tunneled request
    EAP-Message = 0x0207000e0163636f6c756d627573
server  {
  PEAP: Setting User-Name to ccolumbus
Sending tunneled request
    EAP-Message = 0x0207000e0163636f6c756d627573
    FreeRADIUS-Proxied-To = 127.0.0.1
    User-Name = "ccolumbus"
    NAS-IP-Address = 192.168.0.50
    NAS-Port = 0
    Called-Station-Id = "00195b54c564"
    Calling-Station-Id = "001f5bb7c6a0"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
server inner-tunnel {
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "ccolumbus", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 7 length 14
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
    EAP-Message = 0x010800231a0108001e105a241fc3c62d43d48e74b20a8c7623d963636f6c756d627573
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xa91c8167a9149ba4324d04d3a5627cf8
[peap] Got tunneled reply RADIUS code 11
    EAP-Message = 0x010800231a0108001e105a241fc3c62d43d48e74b20a8c7623d963636f6c756d627573
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xa91c8167a9149ba4324d04d3a5627cf8
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 104 to 192.168.0.50 port 3072
    EAP-Message = 0x0108004b19001703010040b486fed39a2a41418ce8b31f6232bbe14d79fc6e5b24c53a4749c590aba16059a6f5bd6cc10e14ab29248c2ae33c8d52713ee687791709ff67b5031d93ce8991
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x09beaa5b0eb6b3452e59a5fef2645ec6
Finished request 7.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 192.168.0.50 port 3072, id=105, length=280
    User-Name = "ccolumbus"
    NAS-IP-Address = 192.168.0.50
    NAS-Port = 0
    Called-Station-Id = "00195b54c564"
    Calling-Station-Id = "001f5bb7c6a0"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0208006b19001703010060548a6b5b23bc4e915ce3faad9484a91c94b80207e7dad8c911f095672dc307ff168cbee8b324c1b8f61bdd3ab0e926f3d161a6cc150beb673c19413c12e56a5b760e0c81d50a2946bfdc5f95603de697edf7bb47e9b08f083e88b95e40233191
    State = 0x09beaa5b0eb6b3452e59a5fef2645ec6
    Message-Authenticator = 0x4ca38762bcce7195b74cd403e6bd0411
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "ccolumbus", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 8 length 107
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type mschapv2
[peap] Got tunneled request
    EAP-Message = 0x020800441a0208003f316604890151ee2e011d624a1825f75c280000000000000000ef037d5745f8dcb7f349d55996246908d1cc4c7436d05e1b0063636f6c756d627573
server  {
  PEAP: Setting User-Name to ccolumbus
Sending tunneled request
    EAP-Message = 0x020800441a0208003f316604890151ee2e011d624a1825f75c280000000000000000ef037d5745f8dcb7f349d55996246908d1cc4c7436d05e1b0063636f6c756d627573
    FreeRADIUS-Proxied-To = 127.0.0.1
    User-Name = "ccolumbus"
    State = 0xa91c8167a9149ba4324d04d3a5627cf8
    NAS-IP-Address = 192.168.0.50
    NAS-Port = 0
    Called-Station-Id = "00195b54c564"
    Calling-Station-Id = "001f5bb7c6a0"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
server inner-tunnel {
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "ccolumbus", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 8 length 68
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
[mschapv2] +- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured.  Cannot create LM-Password.
[mschap] No Cleartext-Password configured.  Cannot create NT-Password.
[mschap] Creating challenge hash with username: ccolumbus
[mschap] Told to do MS-CHAPv2 for ccolumbus with NT-Password
[mschap] FAILED: No NT/LM-Password.  Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
[eap] Freeing handler
++[eap] returns reject
Failed to authenticate the user.
} # server inner-tunnel
[peap] Got tunneled reply code 3
    MS-CHAP-Error = "\010E=691 R=1"
    EAP-Message = 0x04080004
    Message-Authenticator = 0x00000000000000000000000000000000
[peap] Got tunneled reply RADIUS code 3
    MS-CHAP-Error = "\010E=691 R=1"
    EAP-Message = 0x04080004
    Message-Authenticator = 0x00000000000000000000000000000000
[peap] Tunneled authentication was rejected.
[peap] FAILURE
++[eap] returns handled
Sending Access-Challenge of id 105 to 192.168.0.50 port 3072
    EAP-Message = 0x0109002b19001703010020c45ee2c7f3ed65acad1fd8283c7b86d6354cbbf5538e818052e2d82031cc1a60
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x09beaa5b01b7b3452e59a5fef2645ec6
Finished request 8.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 192.168.0.50 port 3072, id=106, length=216
    User-Name = "ccolumbus"
    NAS-IP-Address = 192.168.0.50
    NAS-Port = 0
    Called-Station-Id = "00195b54c564"
    Calling-Station-Id = "001f5bb7c6a0"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0209002b19001703010020d2f008952080a098546701a0c532e4900169b61fff567d137fb02e855a48c804
    State = 0x09beaa5b01b7b3452e59a5fef2645ec6
    Message-Authenticator = 0x15d2f4ddbd27906fb975ac84dd8a2bd9
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "ccolumbus", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 9 length 43
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state send tlv failure
[peap] Received EAP-TLV response.
[peap]  The users session was previously rejected: returning reject (again.)
[peap]  *** This means you need to read the PREVIOUS messages in the debug output
[peap]  *** to find out the reason why the user was rejected.
[peap]  *** Look for "reject" or "fail".  Those earlier messages will tell you.
[peap]  *** what went wrong, and how to fix the problem.
[eap] Handler failed in EAP/peap
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
Using Post-Auth-Type Reject
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject]     expand: %{User-Name} -> ccolumbus
 attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 9 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 9
Sending Access-Reject of id 106 to 192.168.0.50 port 3072
    EAP-Message = 0x04090004
    Message-Authenticator = 0x00000000000000000000000000000000

baza danych LDAP stworzona zgodnie z tym poradnikiem: [url]http://www.rjsystems.nl/en/2100-d6-openldap-provider.php[/url]

Offline

 

#2  2011-07-21 13:34:32

  Jacekalex - Podobno człowiek...;)

Jacekalex
Podobno człowiek...;)
Skąd: /dev/urandom
Zarejestrowany: 2008-01-07

Re: Debian Squeeze FreeRadius + OpenLDAP

Ja bym Ldap wypier* w kosmos, a postawoł Radiusa z Mysql lub Postgres.
Wtedy masz stabilne i dzialające rozwiazanie.

W dodatku 5 razy łatwie skonfigurować Mysql niż Ldapa, a jeśli użyjesz modułu pam_radius lub pam_mysql, to na jednej bazie można uwierzytelniać kilka usług, np dostep do AP, Sambę, Ftp, i Postifxa/Dovecota, wszystko bez kłopotu współpracuje z Mysql.

To by było na tyle
;-)

Ostatnio edytowany przez Jacekalex (2011-07-21 15:05:15)

W demokracji każdy naród ma taką władzę, na jaką zasługuje ;)
Si vis pacem  para bellum  ;)       |       Pozdrawiam :)

Offline

 

#3  2011-07-25 13:53:03

  czeri - Użytkownik

czeri
Użytkownik
Zarejestrowany: 2011-07-08

Re: Debian Squeeze FreeRadius + OpenLDAP

tylko jak to skonfigurować niezabardzo wiem, tego radiusa z mysql-em


Będe wdzięczny za jakieś podpowiedzi

Ostatnio edytowany przez czeri (2011-07-25 14:00:15)

Offline

 

#4  2011-07-27 14:54:43

  czeri - Użytkownik

czeri
Użytkownik
Zarejestrowany: 2011-07-08

Re: Debian Squeeze FreeRadius + OpenLDAP

Nikt niema pomysłów jak to rozwiązać z ldap bądź z mysql. Przy mysql-u mam znowu to samo autoryzacja lokalnie działa poprzez access pointa juz nie , w czym może być problem ?

Offline

 

#5  2011-07-27 20:24:57

  Jacekalex - Podobno człowiek...;)

Jacekalex
Podobno człowiek...;)
Skąd: /dev/urandom
Zarejestrowany: 2008-01-07

Re: Debian Squeeze FreeRadius + OpenLDAP

Jezeli lokalnie działa, to sam moduł sql chodzi prawidłowo.
Jeśli nie dział przez AP, to obstawiałbym na niekompatybilność  radiusa z AP -  w zakresie sposobu uwierzytelnienia.

Ale nie widzę na forum wróżki, która powie, jaki system (architektura), która wersja radiusa, jaki konfig , i jaki AP.

Radziłbym wyłączyć Radiusa, potem odpalić go w trybie debug z konsoli.
polecenie:

Kod:

radiusd -X &>/radius.log

potem próby logwania do AP i lokalnie.
Następnie z logu usuń hasło do bazy danych, i wklej taki log na [url=http://pastebin.com/]pastebin[/url] lub wkleja.

W logu będzie dokladny  zapis działania radiusa.

Ja z radiusa jestem lama, ale kilka osób tutaj dobrze zna to ustrojstwo.

To by było na tyle
;-)

Ostatnio edytowany przez Jacekalex (2011-07-27 20:58:18)

W demokracji każdy naród ma taką władzę, na jaką zasługuje ;)
Si vis pacem  para bellum  ;)       |       Pozdrawiam :)

Offline

 

#6  2011-07-27 23:28:57

  czeri - Użytkownik

czeri
Użytkownik
Zarejestrowany: 2011-07-08

Re: Debian Squeeze FreeRadius + OpenLDAP

logi z lokalnego logowania poprzez [url=http://pastebin.com/5CzNqiDn]Radtest[/url]

logi z logowania poprzez [url=http://pastebin.com/YgDPmGGm]Access Pointa[/url]

Jeśli chodzi o access pointa to mam:
Dlink DWL-G700

Offline

 

#7  2011-07-28 02:08:49

  Jacekalex - Podobno człowiek...;)

Jacekalex
Podobno człowiek...;)
Skąd: /dev/urandom
Zarejestrowany: 2008-01-07

Re: Debian Squeeze FreeRadius + OpenLDAP

[quote="Jacekalex"]potem próby logwania do AP i lokalnie.
Następnie z [b]logu usuń hasło do bazy danych[/b], i wklej taki log na pastebin lub wkleja.[/quote]
[quote="czeri  (na pastebin)"]driver = "rlm_sql_mysql"
        server = "localhost"
        port = ""
        login = "[b]root[/b]"
        password = "[b]zaq12wsx[/b]"
        radius_db = "radius"
        read_groups = yes
        sqltrace = no[/quote]
Pierwsze primo: zmień hasło do bazy danych, i ustaw usera radiusd, a nie roota do bazy. :xD

Drugie primo - niezła choinka  wyrysowana przez zapytania do bazy danych. :xD

Trzecie primo: Radius grzecznie zameldował, że konfiguracja uwierzytelnienia MS-CHAP
jest nieprawidłowa:

Kod:

# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group MS-CHAP {...}
[mschap] ERROR: You set 'Auth-Type = MS-CHAP' for a request that does not contain any MS-CHAP attributes!
++[mschap] returns reject
Failed to authenticate the user.

Spróbuj, czy ruszy na takim konfigu mschap:

Kod:

egrep -v '#|^$' /etc/raddb/modules/mschap 
mschap {
        authtype = MS-CHAP
        use-mppe = yes
        require_encryption = yes
        require_strong = yes
}

Powinno pomóc, choć pewności nie mam.

To by było na tyle.
;-)

Ostatnio edytowany przez Jacekalex (2011-07-28 02:14:50)

W demokracji każdy naród ma taką władzę, na jaką zasługuje ;)
Si vis pacem  para bellum  ;)       |       Pozdrawiam :)

Offline

 

 

Strony: 1

Stopka forum

Powered by PunBB
© Copyright 2002–2005 Rickard Andersson
To nie jest tylko forum, to nasza mała ojczyzna ;-)

[ Generated in 0.011 seconds, 9 queries executed ]

Informacje debugowania

Time (s) Query
0.00010 SET CHARSET latin2
0.00004 SET NAMES latin2
0.00123 SELECT u.*, g.*, o.logged FROM punbb_users AS u INNER JOIN punbb_groups AS g ON u.group_id=g.g_id LEFT JOIN punbb_online AS o ON o.ident='18.117.186.92' WHERE u.id=1
0.00094 REPLACE INTO punbb_online (user_id, ident, logged) VALUES(1, '18.117.186.92', 1715901078)
0.00065 SELECT * FROM punbb_online WHERE logged<1715900778
0.00063 SELECT t.subject, t.closed, t.num_replies, t.sticky, f.id AS forum_id, f.forum_name, f.moderators, fp.post_replies, 0 FROM punbb_topics AS t INNER JOIN punbb_forums AS f ON f.id=t.forum_id LEFT JOIN punbb_forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id=3) WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND t.id=19395 AND t.moved_to IS NULL
0.00009 SELECT search_for, replace_with FROM punbb_censoring
0.00325 SELECT u.email, u.title, u.url, u.location, u.use_avatar, u.signature, u.email_setting, u.num_posts, u.registered, u.admin_note, p.id, p.poster AS username, p.poster_id, p.poster_ip, p.poster_email, p.message, p.hide_smilies, p.posted, p.edited, p.edited_by, g.g_id, g.g_user_title, o.user_id AS is_online FROM punbb_posts AS p INNER JOIN punbb_users AS u ON u.id=p.poster_id INNER JOIN punbb_groups AS g ON g.g_id=u.group_id LEFT JOIN punbb_online AS o ON (o.user_id=u.id AND o.user_id!=1 AND o.idle=0) WHERE p.topic_id=19395 ORDER BY p.id LIMIT 0,25
0.00163 UPDATE punbb_topics SET num_views=num_views+1 WHERE id=19395
Total query time: 0.00856 s