Community discussions

 
wheminghou
just joined
Topic Author
Posts: 15
Joined: Mon Jan 31, 2011 9:34 pm

Help with freeRADIUS and PPTP authentication?

Sat Jan 11, 2014 6:52 pm

Ok, I have freeRADIUS set up and working perfectly fine for winbox logins, I even have the groups working...

I am NOT using mySQL, just the users file. I cannot seem to get authentication to work for PPTP. I run radius in debug and get the following Errors:

rad_recv: Access-Request packet from host xx.xx.xx.xx port 43984, id=95, length=176
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 85
NAS-Port-Type = Virtual
User-Name = "joshp"
Calling-Station-Id = "xx.xxx.xx.xx"
Called-Station-Id = "xx.xx.xx.xx"
MS-CHAP-Challenge = xxxxxxxxxxxxxx
MS-CHAP2-Response = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
NAS-Identifier = "Niagara3"
NAS-IP-Address = xx.xx.xx.xx
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'
++[mschap] returns ok
++[digest] returns noop
[suffix] No '@' in User-Name = "joshp", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
[files] users: Matched entry DEFAULT at line 172
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = MSCHAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured. Cannot create LM-Password.
[mschap] No Cleartext-Password configured. Cannot create NT-Password.
[mschap] Creating challenge hash with username: joshp
[mschap] Told to do MS-CHAPv2 for joshp with NT-Password
[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
Failed to authenticate the user.
Using Post-Auth-Type Reject
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject] expand: %{User-Name} -> joshp
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 0 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
rad_recv: Access-Request packet from host 71.13.94.63 port 43984, id=95, length=176
Waiting to send Access-Reject to client Niagara2 port 43984 - ID: 95
Waking up in 0.6 seconds.
rad_recv: Access-Request packet from host 71.13.94.63 port 43984, id=95, length=176
Waiting to send Access-Reject to client Niagara2 port 43984 - ID: 95
Waking up in 0.3 seconds.
Sending delayed reject for request 0
Sending Access-Reject of id 95 to 71.13.94.63 port 43984
MS-CHAP-Error = "\001E=691 R=1"
Waking up in 4.9 seconds.
Cleaning up request 0 ID 95 with timestamp +12
 
wheminghou
just joined
Topic Author
Posts: 15
Joined: Mon Jan 31, 2011 9:34 pm

Re: Help with freeRADIUS and PPTP authentication?

Tue Jan 14, 2014 4:04 pm

No one? Nothing? Seems that the request is getting ot the MT and the MT is polling the RADIUS server, so we got that far. What it looks like to me is that the mschap requests are not hitting the user file for authentication (not using sql). Help please
 
Twido
newbie
Posts: 30
Joined: Fri Apr 05, 2013 11:33 pm

Re: Help with freeRADIUS and PPTP authentication?

Wed Jan 15, 2014 1:13 pm

please show us the content of /etc/raddb/sites-enabled/default file
 
wheminghou
just joined
Topic Author
Posts: 15
Joined: Mon Jan 31, 2011 9:34 pm

Re: Help with freeRADIUS and PPTP authentication?

Sun Mar 02, 2014 9:08 pm

please show us the content of /etc/raddb/sites-enabled/default file
You do not have the required permissions to view the files attached to this post.
 
wheminghou
just joined
Topic Author
Posts: 15
Joined: Mon Jan 31, 2011 9:34 pm

Re: Help with freeRADIUS and PPTP authentication?

Tue Mar 04, 2014 2:06 pm

Looks like my winbox requests are being authenticated CHAP but VPN connections from windows machines will not authenticate CHAP. I imagine they are not sending cleartext passwords? Probably have to get them to connect MSCHAP2? I thought RADIUS is supposed to convert the cleartext password to use for MSCHAP, but that does not appear to be working. What am I missing?
 
wheminghou
just joined
Topic Author
Posts: 15
Joined: Mon Jan 31, 2011 9:34 pm

Re: Help with freeRADIUS and PPTP authentication?

Wed Feb 03, 2016 3:35 pm

Anyone?? Still never figured this out! Can't find any related articles on how to do it
 
lambert
Long time Member
Long time Member
Posts: 533
Joined: Fri Jul 23, 2010 1:09 am

Re: Help with freeRADIUS and PPTP authentication?

Thu Feb 04, 2016 12:03 am

Actually reading the radius debug output shows that you do not have a password for joshp in a format which is compatible with MS-CHAP.

It even tells you it needs a "Cleartext-Password". So configure your users file to provide a "Cleartext-Password" value pair or configure your PPTP server to only allow PAP authentication.
Found Auth-Type = MSCHAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured. Cannot create LM-Password.
[mschap] No Cleartext-Password configured. Cannot create NT-Password.
[mschap] Creating challenge hash with username: joshp
[mschap] Told to do MS-CHAPv2 for joshp with NT-Password
[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
Failed to authenticate the user.

Who is online

Users browsing this forum: Google [Bot], Petrw and 107 guests