哪位老大熟悉freeradius作802.1x身份验证的，进来帮看看
我用freeradius 1.1.7，后台接oracle数据库，NAS用Cisco 3750交换机，给LAN里的PC做802.1x身份验证。现在作MD5身份验证没问题，但是要求换成peap-mschapv2，我现在有些没闹明白，搞这种验证方法是不是必须要配LDAP或是SMBA或/etc/passwd才行？难道不能让呀直接读数据库里的用户信息？我就是没有配LDAP、SMBA什么的呀就给我验证不过去。看看我配置文件中的相关内容：radiusd.conf:
authorize {
preprocess
mschap
sql
eap
}
authenticate {
Auth-Type MS-CHAP {
mschap
}
eap
}
eap.conf:
eap {
default_eap_type = peap
timer_expire = 60
ignore_unknown_eap_types = no
}
tls {
private_key_password = whatever
private_key_file = ${raddbdir}/certs/cert-srv.pem
certificate_file = ${raddbdir}/certs/cert-srv.pem
CA_file = ${raddbdir}/certs/demoCA/cacert.pem
dh_file = ${raddbdir}/certs/dh
random_file = ${raddbdir}/certs/random
fragment_size = 1024
}
peap {
default_eap_type = mschapv2
copy_request_to_tunnel = no
use_tunneled_reply = no
}
mschapv2 {
}
关键的，我一登录呀就给我报这个（我用的是xp自带的radius客户端）：
rad_recv: Access-Request packet from host 10.0.99.1:1645, id=141, length=252
NAS-IP-Address = 10.0.99.1
NAS-Port = 50441
Cisco-NAS-Port = "FastEthernet4/0/41"
NAS-Port-Type = Ethernet
User-Name = "testuser"
Called-Station-Id = "00-19-2F-E1-C0-AD"
Calling-Station-Id = "00-10-C6-A8-DA-00"
Service-Type = Framed-User
Framed-MTU = 1500
State = 0xb9868a780c968e9716093b01742690ee
EAP-Message = 0x0206005a1900170301004f4ea0464ecb62296c3fe83ddbe7cb46cfc87deccd3b5d7786299443f17d173f52209f2eefb5497f3153bdd751357d7b5beb55afb0d7e60d775792b375564444f5f30c0ad8cae5c74b398405d8cc4b63
Message-Authenticator = 0x3ced719a5b1cfdb5e3e3c49fa411e309
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 6
modcall: module "preprocess" returns ok for request 6
radius_xlat:'/usr/local/var/log/radius/radacct/10.0.99.1/auth-detail-20090225'
rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.99.1/auth-detail-20090225
modcall: module "auth_log" returns ok for request 6
modcall: module "mschap" returns noop for request 6
rlm_eap: EAP packet type response id 6 length 90
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall: module "eap" returns updated for request 6
radius_xlat:'testuser'
rlm_sql (sql): sql_set_user escaped user --> 'testuser'
radius_xlat:'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testuser' and (mac = '00-10-C6-A8-DA-00' or mac is null) ORDER BY id'
rlm_sql (sql): Reserving sql socket id: 2
radius_xlat:'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.opFROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id'
radius_xlat:'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'testuser' ORDER BY id'
radius_xlat:'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.opFROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id'
rlm_sql (sql): Released sql socket id: 2
modcall: module "sql" returns ok for request 6
modcall: leaving group authorize (returns updated) for request 6
rad_check_password:Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 6
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
eaptls_process returned 7
rlm_eap_peap: EAPTLS_OK
rlm_eap_peap: Session established.Decoding tunneled attributes.
rlm_eap_peap: EAP type mschapv2
rlm_eap_peap: Tunneled data is valid.
PEAP: Got tunneled EAP-Message
EAP-Message = 0x020600431a0206003e316cdcc08e1adf37fdb332d32419efee1300000000000000002667d1668b083c47ab1b70edc530d3d3d9f0bb9a4c254ce8007465737475736572
PEAP: Setting User-Name to testuser
PEAP: Adding old state with 64 0b
PEAP: Sending tunneled request
EAP-Message = 0x020600431a0206003e316cdcc08e1adf37fdb332d32419efee1300000000000000002667d1668b083c47ab1b70edc530d3d3d9f0bb9a4c254ce8007465737475736572
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "testuser"
State = 0x640b188d31bc5ddc785afe862ca9225f
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 6
modcall: module "preprocess" returns ok for request 6
radius_xlat:'/usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20090225'
rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20090225
modcall: module "auth_log" returns ok for request 6
modcall: module "mschap" returns noop for request 6
rlm_eap: EAP packet type response id 6 length 67
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall: module "eap" returns updated for request 6
radius_xlat:'testuser'
rlm_sql (sql): sql_set_user escaped user --> 'testuser'
radius_xlat:'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testuser' and (mac = '' or mac is null) ORDER BY id'
rlm_sql (sql): Reserving sql socket id: 1
rlm_sql (sql): User testuser not found in radcheck
radius_xlat:'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.opFROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id'
radius_xlat:'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.opFROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id'
rlm_sql (sql): User testuser not found in radgroupcheck
rlm_sql (sql): Released sql socket id: 1
rlm_sql (sql): User not found
modcall: module "sql" returns notfound for request 6
modcall: leaving group authorize (returns updated) for request 6
rad_check_password:Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 6
rlm_eap: Request found, released from the list
rlm_eap: EAP/mschapv2
rlm_eap: processing type mschapv2
Processing the authenticate section of radiusd.conf
modcall: entering group MS-CHAP for request 6
rlm_mschap: No User-Password configured.Cannot create LM-Password.
rlm_mschap: No User-Password configured.Cannot create NT-Password.
rlm_mschap: Told to do MS-CHAPv2 for testuser with NT-Password
rlm_mschap: FAILED: No NT/LM-Password.Cannot perform authentication.
rlm_mschap: FAILED: MS-CHAP2-Response is incorrect
modcall: module "mschap" returns reject for request 6
modcall: leaving group MS-CHAP (returns reject) for request 6
rlm_eap: Freeing handler
modcall: module "eap" returns reject for request 6
modcall: leaving group authenticate (returns reject) for request 6
auth: Failed to validate the user.
Login incorrect: (from client localhost port 0)
......
再后面：
......
modcall: leaving group authorize (returns updated) for request 7
rad_check_password:Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 7
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
eaptls_process returned 7
rlm_eap_peap: EAPTLS_OK
rlm_eap_peap: Session established.Decoding tunneled attributes.
rlm_eap_peap: Received EAP-TLV response.
rlm_eap_peap: Tunneled data is valid.
rlm_eap_peap:Had sent TLV failure.User was rejcted rejected earlier in this session.
rlm_eap: Handler failed in EAP/peap
rlm_eap: Failed in EAP select
modcall: module "eap" returns invalid for request 7
modcall: leaving group authenticate (returns invalid) for request 7
auth: Failed to validate the user.
Login incorrect: (from client bg3750 port 50441 cli 00-10-C6-A8-DA-00)
Delaying request 7 for 1 seconds
Finished request 7
Going to the next request
现在不知道该怎么办了，是不是必须要用/etc/passwd或LDAP验证？如果是这样还要我这数据库干吗？
数据库里现在已经有testuserUser-Password:=test123这个条目了。 大虾们都在哪 我用freeradius 2.1.4做peap认证的时候也遇到这个问题了。 楼主你的问题怎么解决的 ？
页:
[1]