Помогите разобраться, плз.Стоит связка
freeradius-1.0.1
radiusclient-0.4.8
ppp-2.4.3-r1
pptpd-1.2.1
mysql-4.0.20
gentoo linuxЛогины/пароли клиентов должны храниться в sql базе.
на ppp и ядро наложен патч, чтобы они понимали mppe/mppc.Настраивал все это по вот этим двум документам:
http://www.opennet.ru/base/net/freeradius_mpd_vpn.txt.html
http://poptop.sourceforge.net/dox/radius_mysql.htmlПроблема в следующем - при попытке авторизироваться на vpn сервере с виндовой машины
(пароли в radius/sql) - получаем "invalid user/password".
Если отключаем radius.so плагин в options.pptpd, то авторизируемся нормально.В базе заведен user1/pass1.
radtest работает:
radtest user1 pass1 localhost 1812 tmppass
Sending Access-Request of id 132 to 127.0.0.1:1812
User-Name = "user1"
User-Password = "pass1"
NAS-IP-Address = vpnsrv
NAS-Port = 1812
rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=132, length=32
Framed-IP-Address = 192.168.10.55
Framed-IP-Netmask = 255.255.255.255Но при попытке подключения к vpn pptpd в логах радиуса видим:
<....>
Module: Loaded MS-CHAP
mschap: use_mppe = yes
mschap: require_encryption = no
mschap: require_strong = no
mschap: with_ntdomain_hack = no
mschap: passwd = "(null)"
mschap: authtype = "MS-CHAP"
mschap: ntlm_auth = "(null)"
Module: Instantiated mschap (mschap)
<...>rad_recv: Access-Request packet from host 127.0.0.1:54792, id=126, length=65
Service-Type = Framed-User
Framed-Protocol = PPP
User-Name = "user1"
Calling-Station-Id = "192.168.30.17"
NAS-IP-Address = 10.0.0.1
NAS-Port = 0
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 4
modcall[authorize]: module "preprocess" returns ok for request 4
modcall[authorize]: module "mschap" returns noop for request 4
rlm_realm: No '@' in User-Name = "user1", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 4
radius_xlat: 'user1'
rlm_sql (sql): sql_set_user escaped user --> 'user1'
radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'user1' ORDER BY id'
rad_recv: Access-Request packet from host 127.0.0.1:54792, id=126, length=65
rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'user1' ORDER BY id
radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id'
rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id
radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'user1' ORDER BY id'
rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'user1'ORDER BY id
radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'user1' AND usergro
up.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id'rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgr
oupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.idrlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 4
modcall: group authorize returns ok for request 4
auth: type Local
auth: No User-Password or CHAP-Password attribute in the request
auth: Failed to validate the user.
Login incorrect: [user1/<no User-Password attribute>] (from client localhost port 0 cli 192.168.30.17)
Delaying request 4 for 1 seconds
Finished request 4На мой взгляд, проблема тут:
rad_recv: Access-Request packet from host 127.0.0.1:54792, id=126, length=65
Service-Type = Framed-User
Framed-Protocol = PPP
User-Name = "user1"
Calling-Station-Id = "192.168.30.17"
NAS-IP-Address = 10.0.0.1
NAS-Port = 0
тут не пишется, что аутентификация проходит по ms-chap.
Но как это исправить, мне неясно.Помогите, плз, уже мозги дымяться - непонятно, в какую сторону копать :(
а про chap работает? может нету ms словарей? что в логах радиуса?
>а про chap работает?
>
Да, обычный chap работает:rad_recv: Access-Request packet from host 127.0.0.1:55996, id=129, length=104
Service-Type = Framed-User
Framed-Protocol = PPP
User-Name = "user1"
CHAP-Challenge = 0xf83e9c31f03f5d71bb210741029e37e103ce
CHAP-Password = 0xf8def806b22af48ab3818ce341bb8be470
Calling-Station-Id = "192.168.30.17"
NAS-IP-Address = 10.0.0.1
NAS-Port = 0
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 2
modcall[authorize]: module "preprocess" returns ok for request 2
rlm_chap: Setting 'Auth-Type := CHAP'
modcall[authorize]: module "chap" returns ok for request 2
modcall[authorize]: module "mschap" returns noop for request 2
rlm_realm: No '@' in User-Name = "user1", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 2
radius_xlat: 'user1'
rlm_sql (sql): sql_set_user escaped user --> 'user1'
radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'user1' ORDER BY id'
rlm_sql (sql): Reserving sql socket id: 2
rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'user1'ORDER BY id
radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id'
rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id
radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'user1' ORDER BY id'rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'user1'ORDER BY id
radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id'
rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'user1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 2
modcall[authorize]: module "sql" returns ok for request 2
modcall: group authorize returns ok for request 2
rad_check_password: Found Auth-Type CHAP
auth: type "CHAP"
Processing the authenticate section of radiusd.conf
modcall: entering group Auth-Type for request 2
rlm_chap: login attempt by "user1" with CHAP password
rlm_chap: Using clear text password pass1 for user user1 authentication.
rlm_chap: chap user user1 authenticated succesfully
modcall[authenticate]: module "chap" returns ok for request 2
modcall: group Auth-Type returns ok for request 2
Login OK: [user1] (from client localhost port 0 cli 192.168.1.17)
Sending Access-Accept of id 129 to 127.0.0.1:55996
Framed-IP-Address := 192.168.10.55
Framed-IP-Netmask := 255.255.255.255
Finished request 2
Going to the next request
--- Walking the entire request list --->может нету ms словарей? что в логах радиуса?
>Вот все упоминания chap в freeradius dictionary:
cat /usr/share/freeradius/dictionary | grep -i chap
ATTRIBUTE CHAP-Password 3 octets
ATTRIBUTE CHAP-Challenge 60 octets
ATTRIBUTE MS-CHAP-Use-NTLM-Auth 1082 integer
VALUE Auth-Type CHAP 1025
VALUE Auth-Type MS-CHAP 1028
VALUE EAP-Type EAP-MSCHAP-V2 29
# having two MS-CHAPv2 EAP types.
VALUE EAP-Type Microsoft-MS-CHAPv2 26
VALUE EAP-Type Cisco-MS-CHAPv2 29
# And this is what most people mean by MS-CHAPv2
VALUE EAP-Type MS-CHAP-V2 26
# For MS-CHAP, do we run ntlm_auth, or not.
VALUE MS-CHAP-Use-NTLM-Auth No 0
VALUE MS-CHAP-Use-NTLM-Auth Yes 1
А вот упоминания про chap в radiusclient:
grep -i chap /etc/radiusclient/dictionary
ATTRIBUTE CHAP-Password 3 string
ATTRIBUTE CHAP-Challenge 60 stringЯ правильно понимаю, что словарь radiusclient-а тоже должен содержать упоминания о ms-chap? В моем случае он их не содержит.
Я попробовал подсунуть radiusclient-у (в его конфиге) словарь от freeradius - но клиент ругается на несоответствие строк/форматов.
>что в логах радиуса?
не совсем понял, нужны еще какие то дополнительные логи?
Те, что я прислал, были получены по radiusd -X
Разобрался.Как правильно подсказывал DarkDen, radiusclient-у не хватало microsoft-овских словарей.
В гентушной поставке radiusclient-а (radiusclient-0.4.8) файл dictionary.microsoft отсутствует, как класс. Я нашел его в файле
http://www.elminster.com/xoops/modules/mydownloads/visit.php...
IPCop Addons/Customisations : PPP Radius Plugin: http://www.elminster.com/xoops/modules/mydownloads/viewcat.p...переписал в /etc/radiusclient и в файл /etc/radiusclient/dictionary добавил строчку
INCLUDE /etc/radiusclient/dictionary.microsoftПосле этого все завелось:
rad_recv: Access-Request packet from host 127.0.0.1:33261, id=146, length=147
Service-Type = Framed-User
Framed-Protocol = PPP
User-Name = "user1"
MS-CHAP-Challenge = 0x2b666ec59ef847a0313e9a9d88a49893
MS-CHAP2-Response = 0x8000aa494ded1523159a0d2c61dc86ff67e20000000000000000e9ed1b3f35729a7d63241c0a7dec
c53b6da386e2036a7034
Calling-Station-Id = "192.168.30.17"
NAS-IP-Address = 10.0.0.1
NAS-Port = 0<...>
modcall[authorize]: module "sql" returns ok for request 11
modcall: group authorize returns ok for request 11
rad_check_password: Found Auth-Type MS-CHAP
auth: type "MS-CHAP"
Processing the authenticate section of radiusd.conf
modcall: entering group Auth-Type for request 11
rlm_mschap: Told to do MS-CHAPv2 for user1 with NT-Password
rlm_mschap: adding MS-CHAPv2 MPPE keys
modcall[authenticate]: module "mschap" returns ok for request 11
modcall: group Auth-Type returns ok for request 11
Login OK: [user1] (from client localhost port 0 cli 192.168.30.17)