I'm trying to set up FreeRadius to validate VPN users coming from a Cisco
2600 using MS-CHAP and 128-mppe. Does anyone have a working configuration I
could take a look at? I've not seen anything on the net and I even bought
the O'Reilly Radius book..........nothing in there.
Does 'modcall[authorize]: module "mschap" returns notfound' mean that mschap
is not configured correctly or not even installed?
Am I supposed to use smbpasswd to authenticate the users? Please help!
Users File:
slfries Auth-Type := MS-CHAP
Framed-Protocol = PPP,
NAS-Port = 2,
NAS-Port-Type = Virtual,
Service-Type = Framed-User
Server Output:
rad_recv: Access-Request packet from host 10.1.1.3:1645, id=78, length=133
Framed-Protocol = PPP
User-Name = "slfries"
MS-CHAP-Challenge = 0x9af275c4376dd713
MS-CHAP-Response =
0x5a01000000000000000000000000000000000000000000000000aff693f6f212e8f63a6b32
9b303976b8e7d442993371b87d
NAS-Port = 2
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-IP-Address = 10.1.1.3
modcall: entering group authorize
modcall[authorize]: module "preprocess" returns ok
rlm_chap: Could not find proper Chap-Password attribute in request
modcall[authorize]: module "chap" returns noop
modcall[authorize]: module "mschap" returns notfound
rlm_realm: No '@' in User-Name = "slfries", looking up realm NULL
rlm_realm: No such realm NULL
modcall[authorize]: module "suffix" returns noop
users: Matched slfries at 97
modcall[authorize]: module "files" returns ok
modcall: group authorize returns ok
rad_check_password: Found Auth-Type MS-CHAP
auth: type "MS-CHAP"
modcall: entering group authtype
rlm_mschap: No LM/NT password configured. Check authorization.
modcall[authenticate]: module "mschap" returns invalid
modcall: group authtype returns invalid
auth: Failed to validate the user.
Delaying request 16 for 1 seconds
Finished request 16
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Sending Access-Reject of id 78 to 10.1.1.3:1645
MS-CHAP-Error = "ZE=691 R=1"
MS-CHAP-Challenge = 0xb71e9278f330cfea
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 10.1.1.3:1645, id=78, length=133
Sending duplicate reply to client cisco2600:1645 - ID: 78
Re-sending Access-Reject of id 78 to 10.1.1.3:1645
MS-CHAP-Error = "ZE=691 R=1"
MS-CHAP-Challenge = 0xb71e9278f330cfea
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Cleaning up request 16 ID 78 with timestamp 3ef6638a
Nothing to do. Sleeping until we see a request.
rad_recv: Access-Request packet from host 10.1.1.3:1645, id=78, length=133
Framed-Protocol = PPP
User-Name = "slfries"
MS-CHAP-Challenge = 0x9af275c4376dd713
MS-CHAP-Response =
0x5a01000000000000000000000000000000000000000000000000aff693f6f212e8f63a6b32
9b303976b8e7d442993371b87d
NAS-Port = 2
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-IP-Address = 10.1.1.3
modcall: entering group authorize
modcall[authorize]: module "preprocess" returns ok
rlm_chap: Could not find proper Chap-Password attribute in request
modcall[authorize]: module "chap" returns noop
modcall[authorize]: module "mschap" returns notfound
rlm_realm: No '@' in User-Name = "slfries", looking up realm NULL
rlm_realm: No such realm NULL
modcall[authorize]: module "suffix" returns noop
users: Matched slfries at 97
modcall[authorize]: module "files" returns ok
modcall: group authorize returns ok
rad_check_password: Found Auth-Type MS-CHAP
auth: type "MS-CHAP"
modcall: entering group authtype
rlm_mschap: No LM/NT password configured. Check authorization.
modcall[authenticate]: module "mschap" returns invalid
modcall: group authtype returns invalid
auth: Failed to validate the user.
Delaying request 18 for 1 seconds
Finished request 18
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Sending Access-Reject of id 78 to 10.1.1.3:1645
MS-CHAP-Error = "ZE=691 R=1"
MS-CHAP-Challenge = 0xb71e9278f330cfea
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 10.1.1.3:1645, id=78, length=133
Sending duplicate reply to client cisco2600:1645 - ID: 78
Re-sending Access-Reject of id 78 to 10.1.1.3:1645
MS-CHAP-Error = "ZE=691 R=1"
MS-CHAP-Challenge = 0xb71e9278f330cfea
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Cleaning up request 18 ID 78 with timestamp 3ef66394
Nothing to do. Sleeping until we see a request.
rad_recv: Accounting-Request packet from host 10.1.1.3:1646, id=34,
length=119
Acct-Session-Id = "0000012B"
Tunnel-Client-Endpoint:0 = "\00067.66.159.34"
Tunnel-Assignment-Id:0 = "\000vpngroup"
Framed-Protocol = PPP
Framed-IP-Address = 10.1.100.23
Acct-Authentic = Local
User-Name = "slfries"
Acct-Status-Type = Start
NAS-Port = 2
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-IP-Address = 10.1.1.3
Acct-Delay-Time = 0
modcall: entering group preacct
modcall[preacct]: module "preprocess" returns noop
rlm_realm: No '@' in User-Name = "slfries", looking up realm NULL
rlm_realm: No such realm NULL
modcall[preacct]: module "suffix" returns noop
modcall[preacct]: module "files" returns noop
modcall: group preacct returns noop
modcall: entering group accounting
rlm_acct_unique: WARNING: Attribute 87 was not found in request, unique ID
MAY be inconsistent
rlm_acct_unique: Hashing ',Client-IP-Address = 10.1.1.3,NAS-IP-Address =
10.1.1.3,Acct-Session-Id = "0000012B",User-Name = "slfries"'
rlm_acct_unique: Acct-Unique-Session-ID = "4ff8e5cd59c0df11".
modcall[accounting]: module "acct_unique" returns ok
radius_xlat: '/usr/local/var/log/radius/radacct/10.1.1.3/detail-20030622'
rlm_detail:
/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands
to /usr/local/var/log/radius/radacct/10.1.1.3/detail-20030622
rlm_detail: Failed to create directory
/usr/local/var/log/radius/radacct/10.1.1.3: Permission denied
modcall[accounting]: module "detail" returns fail
modcall: group accounting returns fail
Finished request 20
Going to the next request
--- Walking the entire request list ---
Cleaning up request 20 ID 34 with timestamp 3ef6639e
Nothing to do. Sleeping until we see a request.
rad_recv: Accounting-Request packet from host 10.1.1.3:1646, id=102,
length=119
Acct-Session-Id = "0000012B"
Tunnel-Client-Endpoint:0 = "\00067.66.159.34"
Tunnel-Assignment-Id:0 = "\000vpngroup"
Framed-Protocol = PPP
Framed-IP-Address = 10.1.100.23
Acct-Authentic = Local
User-Name = "slfries"
Acct-Status-Type = Start
NAS-Port = 2
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-IP-Address = 10.1.1.3
Acct-Delay-Time = 5
modcall: entering group preacct
modcall[preacct]: module "preprocess" returns noop
rlm_realm: No '@' in User-Name = "slfries", looking up realm NULL
rlm_realm: Found realm NULL
rlm_realm: Adding Stripped-User-Name = "slfries"
rlm_realm: Proxying request from user slfries to realm NULL
rlm_realm: Adding Realm = "NULL"
rlm_realm: Preparing to proxy accounting request to realm NULL
modcall[preacct]: module "suffix" returns ok
modcall[preacct]: module "files" returns noop
modcall: group preacct returns ok
modcall: entering group accounting
rlm_acct_unique: WARNING: Attribute 87 was not found in request, unique ID
MAY be inconsistent
rlm_acct_unique: Hashing ',Client-IP-Address = 10.1.1.3,NAS-IP-Address =
10.1.1.3,Acct-Session-Id = "0000012B",User-Name = "slfries"'
rlm_acct_unique: Acct-Unique-Session-ID = "4ff8e5cd59c0df11".
modcall[accounting]: module "acct_unique" returns ok
radius_xlat: '/usr/local/var/log/radius/radacct/10.1.1.3/detail-20030622'
rlm_detail:
/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands
to /usr/local/var/log/radius/radacct/10.1.1.3/detail-20030622
rlm_detail: Failed to create directory
/usr/local/var/log/radius/radacct/10.1.1.3: Permission denied
modcall[accounting]: module "detail" returns fail
modcall: group accounting returns fail
Sending Accounting-Request of id 6 to 127.0.0.1:1601
User-Name = "slfries"
Acct-Session-Id = "0000012B"
Tunnel-Client-Endpoint:0 = "\00067.66.159.34"
Tunnel-Assignment-Id:0 = "\000vpngroup"
Framed-Protocol = PPP
Framed-IP-Address = 10.1.100.23
Acct-Authentic = Local
Acct-Status-Type = Start
NAS-Port = 2
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-IP-Address = 10.1.1.3
Acct-Delay-Time = 5
Proxy-State = "102"
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Accounting-Request packet from host 10.1.1.3:1646, id=103,
length=119
Acct-Session-Id = "0000012B"
Tunnel-Client-Endpoint:0 = "\00067.66.159.34"
Tunnel-Assignment-Id:0 = "\000vpngroup"
Framed-Protocol = PPP
Framed-IP-Address = 10.1.100.23
Acct-Authentic = Local
User-Name = "slfries"
Acct-Status-Type = Start
NAS-Port = 2
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-IP-Address = 10.1.1.3
Acct-Delay-Time = 10
modcall: entering group preacct
modcall[preacct]: module "preprocess" returns noop
rlm_realm: No '@' in User-Name = "slfries", looking up realm NULL
rlm_realm: Found realm NULL
rlm_realm: Adding Stripped-User-Name = "slfries"
rlm_realm: Proxying request from user slfries to realm NULL
rlm_realm: Adding Realm = "NULL"
rlm_realm: Preparing to proxy accounting request to realm NULL
modcall[preacct]: module "suffix" returns ok
modcall[preacct]: module "files" returns noop
modcall: group preacct returns ok
modcall: entering group accounting
rlm_acct_unique: WARNING: Attribute 87 was not found in request, unique ID
MAY be inconsistent
rlm_acct_unique: Hashing ',Client-IP-Address = 10.1.1.3,NAS-IP-Address =
10.1.1.3,Acct-Session-Id = "0000012B",User-Name = "slfries"'
rlm_acct_unique: Acct-Unique-Session-ID = "4ff8e5cd59c0df11".
modcall[accounting]: module "acct_unique" returns ok
radius_xlat: '/usr/local/var/log/radius/radacct/10.1.1.3/detail-20030622'
rlm_detail:
/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands
to /usr/local/var/log/radius/radacct/10.1.1.3/detail-20030622
rlm_detail: Failed to create directory
/usr/local/var/log/radius/radacct/10.1.1.3: Permission denied
modcall[accounting]: module "detail" returns fail
modcall: group accounting returns fail
Sending Accounting-Request of id 7 to 127.0.0.1:1601
User-Name = "slfries"
Acct-Session-Id = "0000012B"
Tunnel-Client-Endpoint:0 = "\00067.66.159.34"
Tunnel-Assignment-Id:0 = "\000vpngroup"
Framed-Protocol = PPP
Framed-IP-Address = 10.1.100.23
Acct-Authentic = Local
Acct-Status-Type = Start
NAS-Port = 2
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-IP-Address = 10.1.1.3
Acct-Delay-Time = 10
Proxy-State = "103"
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Sending Accounting-Request of id 6 to 127.0.0.1:1601
User-Name = "slfries"
Acct-Session-Id = "0000012B"
Tunnel-Client-Endpoint:0 = "\00067.66.159.34"
Tunnel-Assignment-Id:0 = "\000vpngroup"
Framed-Protocol = PPP
Framed-IP-Address = 10.1.100.23
Acct-Authentic = Local
Acct-Status-Type = Start
NAS-Port = 2
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-IP-Address = 10.1.1.3
Acct-Delay-Time = 10
Proxy-State = "102"
Waking up in 5 seconds...
rad_recv: Accounting-Request packet from host 10.1.1.3:1646, id=104,
length=119
Acct-Session-Id = "0000012B"
Tunnel-Client-Endpoint:0 = "\00067.66.159.34"
Tunnel-Assignment-Id:0 = "\000vpngroup"
Framed-Protocol = PPP
Framed-IP-Address = 10.1.100.23
Acct-Authentic = Local
User-Name = "slfries"
Acct-Status-Type = Start
NAS-Port = 2
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-IP-Address = 10.1.1.3
Acct-Delay-Time = 15
modcall: entering group preacct
modcall[preacct]: module "preprocess" returns noop
rlm_realm: No '@' in User-Name = "slfries", looking up realm NULL
rlm_realm: Found realm NULL
rlm_realm: Adding Stripped-User-Name = "slfries"
rlm_realm: Proxying request from user slfries to realm NULL
rlm_realm: Adding Realm = "NULL"
rlm_realm: Preparing to proxy accounting request to realm NULL
modcall[preacct]: module "suffix" returns ok
modcall[preacct]: module "files" returns noop
modcall: group preacct returns ok
modcall: entering group accounting
rlm_acct_unique: WARNING: Attribute 87 was not found in request, unique ID
MAY be inconsistent
rlm_acct_unique: Hashing ',Client-IP-Address = 10.1.1.3,NAS-IP-Address =
10.1.1.3,Acct-Session-Id = "0000012B",User-Name = "slfries"'
rlm_acct_unique: Acct-Unique-Session-ID = "4ff8e5cd59c0df11".
modcall[accounting]: module "acct_unique" returns ok
radius_xlat: '/usr/local/var/log/radius/radacct/10.1.1.3/detail-20030622'
rlm_detail:
/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands
to /usr/local/var/log/radius/radacct/10.1.1.3/detail-20030622
rlm_detail: Failed to create directory
/usr/local/var/log/radius/radacct/10.1.1.3: Permission denied
modcall[accounting]: module "detail" returns fail
modcall: group accounting returns fail
Sending Accounting-Request of id 8 to 127.0.0.1:1601
User-Name = "slfries"
Acct-Session-Id = "0000012B"
Tunnel-Client-Endpoint:0 = "\00067.66.159.34"
Tunnel-Assignment-Id:0 = "\000vpngroup"
Framed-Protocol = PPP
Framed-IP-Address = 10.1.100.23
Acct-Authentic = Local
Acct-Status-Type = Start
NAS-Port = 2
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-IP-Address = 10.1.1.3
Acct-Delay-Time = 15
Proxy-State = "104"
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Sending Accounting-Request of id 6 to 127.0.0.1:1601
User-Name = "slfries"
Acct-Session-Id = "0000012B"
Tunnel-Client-Endpoint:0 = "\00067.66.159.34"
Tunnel-Assignment-Id:0 = "\000vpngroup"
Framed-Protocol = PPP
Framed-IP-Address = 10.1.100.23
Acct-Authentic = Local
Acct-Status-Type = Start
NAS-Port = 2
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-IP-Address = 10.1.1.3
Acct-Delay-Time = 15
Proxy-State = "102"
Sending Accounting-Request of id 7 to 127.0.0.1:1601
User-Name = "slfries"
Acct-Session-Id = "0000012B"
Tunnel-Client-Endpoint:0 = "\00067.66.159.34"
Tunnel-Assignment-Id:0 = "\000vpngroup"
Framed-Protocol = PPP
Framed-IP-Address = 10.1.100.23
Acct-Authentic = Local
Acct-Status-Type = Start
NAS-Port = 2
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-IP-Address = 10.1.1.3
Acct-Delay-Time = 15
Proxy-State = "103"
Waking up in 5 seconds...
--- Walking the entire request list ---
Server rejecting request 21.
marking accounting server localhost:1601 for realm NULL dead
Sending Accounting-Request of id 7 to 127.0.0.1:1601
User-Name = "slfries"
Acct-Session-Id = "0000012B"
Tunnel-Client-Endpoint:0 = "\00067.66.159.34"
Tunnel-Assignment-Id:0 = "\000vpngroup"
Framed-Protocol = PPP
Framed-IP-Address = 10.1.100.23
Acct-Authentic = Local
Acct-Status-Type = Start
NAS-Port = 2
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-IP-Address = 10.1.1.3
Acct-Delay-Time = 20
Proxy-State = "103"
Sending Accounting-Request of id 8 to 127.0.0.1:1601
User-Name = "slfries"
Acct-Session-Id = "0000012B"
Tunnel-Client-Endpoint:0 = "\00067.66.159.34"
Tunnel-Assignment-Id:0 = "\000vpngroup"
Framed-Protocol = PPP
Framed-IP-Address = 10.1.100.23
Acct-Authentic = Local
Acct-Status-Type = Start
NAS-Port = 2
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-IP-Address = 10.1.1.3
Acct-Delay-Time = 20
Proxy-State = "104"
Waking up in 0 seconds...
--- Walking the entire request list ---
Cleaning up request 21 ID 102 with timestamp 3ef663a3
Waking up in 5 seconds...
--- Walking the entire request list ---
Server rejecting request 22.
marking accounting server localhost:1601 for realm NULL dead
Sending Accounting-Request of id 8 to 127.0.0.1:1601
User-Name = "slfries"
Acct-Session-Id = "0000012B"
Tunnel-Client-Endpoint:0 = "\00067.66.159.34"
Tunnel-Assignment-Id:0 = "\000vpngroup"
Framed-Protocol = PPP
Framed-IP-Address = 10.1.100.23
Acct-Authentic = Local
Acct-Status-Type = Start
NAS-Port = 2
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-IP-Address = 10.1.1.3
Acct-Delay-Time = 25
Proxy-State = "104"
Waking up in 0 seconds...
--- Walking the entire request list ---
Cleaning up request 22 ID 103 with timestamp 3ef663a8
Waking up in 5 seconds...
--- Walking the entire request list ---
Server rejecting request 23.
marking accounting server localhost:1601 for realm NULL dead
Waking up in 0 seconds...
--- Walking the entire request list ---
Cleaning up request 23 ID 104 with timestamp 3ef663ad
Nothing to do. Sleeping until we see a request.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
