哪位老大熟悉freeradius作802.1x身份验证的，进来帮看看

zhangjiuhu

我用freeradius 1.1.7，后台接oracle数据库，NAS用Cisco 3750交换机，给LAN里的PC做802.1x身份验证。现在作MD5身份验证没问题，但是要求换成peap-mschapv2，我现在有些没闹明白，搞这种验证方法是不是必须要配LDAP或是SMBA或/etc/passwd才行？难道不能让呀直接读数据库里的用户信息？我就是没有配LDAP、SMBA什么的呀就给我验证不过去。看看我配置文件中的相关内容：\r\nradiusd.conf:\r\nauthorize {\r\n        preprocess\r\n        mschap\r\n        sql\r\n        eap\r\n    }\r\n    \r\n    authenticate {\r\n         \r\n         Auth-Type MS-CHAP {\r\n               mschap\r\n          }\r\n         eap\r\n     }\r\n\r\neap.conf:\r\neap {\r\n     default_eap_type = peap\r\n     timer_expire     = 60\r\n     ignore_unknown_eap_types = no\r\n     \r\n     }\r\n\r\ntls {\r\n    private_key_password = whatever    \r\n    private_key_file = ${raddbdir}/certs/cert-srv.pem\r\n    certificate_file = ${raddbdir}/certs/cert-srv.pem\r\n    CA_file = ${raddbdir}/certs/demoCA/cacert.pem\r\n    dh_file = ${raddbdir}/certs/dh \r\n    random_file = ${raddbdir}/certs/random\r\n    fragment_size = 1024\r\n    }\r\n\r\npeap {\r\n    default_eap_type = mschapv2\r\n    copy_request_to_tunnel = no\r\n    use_tunneled_reply = no\r\n  }\r\nmschapv2 {\r\n  }\r\n      \r\n关键的，我一登录呀就给我报这个（我用的是xp自带的radius客户端）：\r\nrad_recv: Access-Request packet from host 10.0.99.1:1645, id=141, length=252\r\n        NAS-IP-Address = 10.0.99.1\r\n        NAS-Port = 50441\r\n        Cisco-NAS-Port = \"FastEthernet4/0/41\"\r\n        NAS-Port-Type = Ethernet\r\n        User-Name = \"testuser\"\r\n        Called-Station-Id = \"00-19-2F-E1-C0-AD\"\r\n        Calling-Station-Id = \"00-10-C6-A8-DA-00\"\r\n        Service-Type = Framed-User\r\n        Framed-MTU = 1500\r\n        State = 0xb9868a780c968e9716093b01742690ee\r\n        EAP-Message = 0x0206005a1900170301004f4ea0464ecb62296c3fe83ddbe7cb46cfc87deccd3b5d7786299443f17d173f52209f2eefb5497f3153bdd751357d7b5beb55afb0d7e60d775792b375564444f5f30c0ad8cae5c74b398405d8cc4b63\r\n        Message-Authenticator = 0x3ced719a5b1cfdb5e3e3c49fa411e309\r\n  Processing the authorize section of radiusd.conf\r\nmodcall: entering group authorize for request 6\r\n  modcall[authorize]: module \"preprocess\" returns ok for request 6\r\nradius_xlat:  \'/usr/local/var/log/radius/radacct/10.0.99.1/auth-detail-20090225\'\r\nrlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.99.1/auth-detail-20090225\r\n  modcall[authorize]: module \"auth_log\" returns ok for request 6\r\n  modcall[authorize]: module \"mschap\" returns noop for request 6\r\n  rlm_eap: EAP packet type response id 6 length 90\r\n  rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation\r\n  modcall[authorize]: module \"eap\" returns updated for request 6\r\nradius_xlat:  \'testuser\'\r\nrlm_sql (sql): sql_set_user escaped user --> \'testuser\'\r\nradius_xlat:  \'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = \'testuser\' and (mac = \'00-10-C6-A8-DA-00\' or mac is null) ORDER BY id\'\r\nrlm_sql (sql): Reserving sql socket id: 2\r\nradius_xlat:  \'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op  FROM radgroupcheck,usergroup WHERE usergroup.Username = \'testuser\' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id\'\r\nradius_xlat:  \'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = \'testuser\' ORDER BY id\'\r\nradius_xlat:  \'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op  FROM radgroupreply,usergroup WHERE usergroup.Username = \'testuser\' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id\'\r\nrlm_sql (sql): Released sql socket id: 2\r\n  modcall[authorize]: module \"sql\" returns ok for request 6\r\nmodcall: leaving group authorize (returns updated) for request 6\r\n  rad_check_password:  Found Auth-Type EAP\r\nauth: type \"EAP\"\r\n  Processing the authenticate section of radiusd.conf\r\nmodcall: entering group authenticate for request 6\r\n  rlm_eap: Request found, released from the list\r\n  rlm_eap: EAP/peap\r\n  rlm_eap: processing type peap\r\n  rlm_eap_peap: Authenticate\r\n  rlm_eap_tls: processing TLS\r\n  eaptls_verify returned 7 \r\n  rlm_eap_tls: Done initial handshake\r\n  eaptls_process returned 7 \r\n  rlm_eap_peap: EAPTLS_OK\r\n  rlm_eap_peap: Session established.  Decoding tunneled attributes.\r\n  rlm_eap_peap: EAP type mschapv2\r\n  rlm_eap_peap: Tunneled data is valid.\r\n  PEAP: Got tunneled EAP-Message\r\n        EAP-Message = 0x020600431a0206003e316cdcc08e1adf37fdb332d32419efee1300000000000000002667d1668b083c47ab1b70edc530d3d3d9f0bb9a4c254ce8007465737475736572\r\n  PEAP: Setting User-Name to testuser\r\n  PEAP: Adding old state with 64 0b\r\n  PEAP: Sending tunneled request\r\n        EAP-Message = 0x020600431a0206003e316cdcc08e1adf37fdb332d32419efee1300000000000000002667d1668b083c47ab1b70edc530d3d3d9f0bb9a4c254ce8007465737475736572\r\n        FreeRADIUS-Proxied-To = 127.0.0.1\r\n        User-Name = \"testuser\"\r\n        State = 0x640b188d31bc5ddc785afe862ca9225f\r\n  Processing the authorize section of radiusd.conf\r\nmodcall: entering group authorize for request 6\r\n  modcall[authorize]: module \"preprocess\" returns ok for request 6\r\nradius_xlat:  \'/usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20090225\'\r\nrlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20090225\r\n  modcall[authorize]: module \"auth_log\" returns ok for request 6\r\n  modcall[authorize]: module \"mschap\" returns noop for request 6\r\n  rlm_eap: EAP packet type response id 6 length 67\r\n  rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation\r\n  modcall[authorize]: module \"eap\" returns updated for request 6\r\nradius_xlat:  \'testuser\'\r\nrlm_sql (sql): sql_set_user escaped user --> \'testuser\'\r\nradius_xlat:  \'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = \'testuser\' and (mac = \'\' or mac is null) ORDER BY id\'\r\nrlm_sql (sql): Reserving sql socket id: 1\r\nrlm_sql (sql): User testuser not found in radcheck\r\nradius_xlat:  \'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op  FROM radgroupcheck,usergroup WHERE usergroup.Username = \'testuser\' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id\'\r\nradius_xlat:  \'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op  FROM radgroupreply,usergroup WHERE usergroup.Username = \'testuser\' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id\'\r\n  rlm_sql (sql): User testuser not found in radgroupcheck\r\n  rlm_sql (sql): Released sql socket id: 1\r\n  rlm_sql (sql): User not found\r\n  modcall[authorize]: module \"sql\" returns notfound for request 6\r\n  modcall: leaving group authorize (returns updated) for request 6\r\n  rad_check_password:  Found Auth-Type EAP\r\n  auth: type \"EAP\"\r\n  Processing the authenticate section of radiusd.conf\r\n  modcall: entering group authenticate for request 6\r\n  rlm_eap: Request found, released from the list\r\n  rlm_eap: EAP/mschapv2\r\n  rlm_eap: processing type mschapv2\r\n  Processing the authenticate section of radiusd.conf\r\n  modcall: entering group MS-CHAP for request 6\r\n  rlm_mschap: No User-Password configured.  Cannot create LM-Password.\r\n  rlm_mschap: No User-Password configured.  Cannot create NT-Password.\r\n  rlm_mschap: Told to do MS-CHAPv2 for testuser with NT-Password\r\n  rlm_mschap: FAILED: No NT/LM-Password.  Cannot perform authentication.\r\n  rlm_mschap: FAILED: MS-CHAP2-Response is incorrect \r\n  modcall[authenticate]: module \"mschap\" returns reject for request 6\r\n  modcall: leaving group MS-CHAP (returns reject) for request 6\r\n  rlm_eap: Freeing handler\r\n  modcall[authenticate]: module \"eap\" returns reject for request 6\r\n  modcall: leaving group authenticate (returns reject) for request 6\r\n  auth: Failed to validate the user.\r\n  Login incorrect: [testuser/<no User-Password attribute>] (from client localhost port 0)\r\n                                                 ......\r\n再后面：\r\n                                 ......\r\n  modcall: leaving group authorize (returns updated) for request 7\r\n  rad_check_password:  Found Auth-Type EAP\r\n  auth: type \"EAP\"\r\n  Processing the authenticate section of radiusd.conf\r\n  modcall: entering group authenticate for request 7\r\n  rlm_eap: Request found, released from the list\r\n  rlm_eap: EAP/peap\r\n  rlm_eap: processing type peap\r\n  rlm_eap_peap: Authenticate\r\n  rlm_eap_tls: processing TLS\r\n  eaptls_verify returned 7 \r\n  rlm_eap_tls: Done initial handshake\r\n  eaptls_process returned 7 \r\n  rlm_eap_peap: EAPTLS_OK\r\n  rlm_eap_peap: Session established.  Decoding tunneled attributes.\r\n  rlm_eap_peap: Received EAP-TLV response.\r\n  rlm_eap_peap: Tunneled data is valid.\r\n  rlm_eap_peap:  Had sent TLV failure.  User was rejcted rejected earlier in this session.\r\n  rlm_eap: Handler failed in EAP/peap\r\n  rlm_eap: Failed in EAP select\r\n  modcall[authenticate]: module \"eap\" returns invalid for request 7\r\n  modcall: leaving group authenticate (returns invalid) for request 7\r\n  auth: Failed to validate the user.\r\n  Login incorrect: [testuser/<no User-Password attribute>] (from client bg3750 port 50441 cli 00-10-C6-A8-DA-00)\r\n  Delaying request 7 for 1 seconds\r\n  Finished request 7\r\n  Going to the next request\r\n\r\n现在不知道该怎么办了，是不是必须要用/etc/passwd或LDAP验证？如果是这样还要我这数据库干吗？\r\n数据库里现在已经有  testuser  User-Password  :=  test123  这个条目了。

hjp0021

最近也在用freeradius，这玩意资料不多。我也只能看看RFC和wiki的内容。\r\n\r\n到linux版问问看。

kongxin2

我来强烈的支持一下楼主