On 2013.05.22 21:13, Alan DeKok wrote:
Mantas Šiurkus wrote:
I have configured FreeRADIUS to work with OpenLDAP. Created user in
OpenLDAP. Radtest from localhost works perfect. But I can't connect from
other devices (android phone, etc..). In logs I get:
[ldap] No default NMAS login sequence
[ldap] looking for check items in directory...
[ldap] looking for reply items in directory...
WARNING: No "known good" password was found in LDAP. Are you sure that
the user is configured correctly?
If FreeRADIUS can't find the user's password, then one of two things
is true:
a) you've misconfigured FreeRADIUS to look in the wrong place
or
b) the user doesn't have a password in LDAP.
I think it is problem in plain text password or something?
The problem is in the error message above. Why look somewhere else?
Is the debug log *lying* to you?
What can I do?
Ensure that FreeRADIUS is configured correctly. Ensure that the
rlm_ldap configuration is correct. Ensure that the "known good"
password is found in ldap.
Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thank you for the replay. Sorry I am new in freeradius and openldap.
I uncommented two lines in freeradius/modules/ldap
identity = "cn=admin,dc=my,dc=domain"
password = myldappass
And now freeradius debuging logs changed.
When I am connecting from android phone where - "EAP method : PEAP" and
"phase 2 authetication: MSCHAPV2"
I got thease logs:
[ldap] No default NMAS login sequence
[ldap] looking for check items in directory...
[ldap] userPassword -> Password-With-Header == "pass123"
[ldap] looking for reply items in directory...
[ldap] user radiusas authorized to use remote access
[ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] Failed to decode Password-With-Header = "pass123"
[pap] WARNING: Auth-Type already set. Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] # Executing group from file
/etc/freeradius/sites-enabled/inner-tunnel
[mschapv2] +- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured. Cannot create LM-Password.
[mschap] No Cleartext-Password configured. Cannot create NT-Password.
[mschap] Creating challenge hash with username: radiusas
[mschap] Told to do MS-CHAPv2 for radiusas with NT-Password
[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
[eap] Freeing handler
++[eap] returns reject
Failed to authenticate the user.
} # server inner-tunnel
[peap] Got tunneled reply code 3
MS-CHAP-Error = "\006E=691 R=1"
EAP-Message = 0x04060004
Message-Authenticator = 0x00000000000000000000000000000000
When I put user in freeradius/users than it connect. But via LDAP wont
connect.
Thank You for help.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
