RADIUS CONFIGURAÇÃO PEAP/MSCHAPv2

EduardoBelmonte
(usa Slackware)

Enviado em 26/08/2015 - 15:05h

Boa tarde galera, blza ?
Estou tentando configurar um servidor RADIUS autenticando na minha base do LDAP em um ap.
quando conecto com ele pelo meu smarth ele funciona mas somente com a configuração PEAP/GTC ou TTLS/PAP autentica na base e estabelece a conexão, mas preciso configurar ele para PEAP/MSCHAPv2 para autenticação windows, se alguem puder me ajudar, eu agradeço, segue o tutorial que eu estou seguindo e o radiusd -X.
Detalhe: meu LDAP não possui TLS.

http://wiki.brivaldojunior.facom.ufms.br/index.php/FreeRadius

Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.1.0.249 port 2048, id=162, length=271
        User-Name = "eduardo.xxxx"
        NAS-IP-Address = 10.1.0.249
        NAS-Port = 0
        Called-Station-Id = "64-70-02-44-16-56:__3r"
        Calling-Station-Id = "E4-90-7E-75-55-FA"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x0208006b190017030100605244fa18a97cefe5286e48103ac0614848c2240a3b33cb3eea3847ae634694b70b978fe83248eac674216e45a716439e21ded9a05eacb5969ecc73c474c36807de40e4396880bd75776397119bd751d915b6caacd5b0a187afc2c9b05102f1a0
        State = 0x0311bf9a0419a64c8fa43dd51798a5f2
        Message-Authenticator = 0xa2bdf5f82385f0910ca3bf4b04a22cb1
# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
[suffix] No '@' in User-Name = "eduardo.xxxx", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] = noop
[ntdomain] No '\' in User-Name = "eduardo.xxxx", looking up realm NULL
[ntdomain] No such realm "NULL"
++[ntdomain] = noop
[eap] EAP packet type response id 8 length 107
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /usr/local/etc/raddb/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type mschapv2
[peap] Got tunneled request
        EAP-Message = 0x0208004a1a02080045317c69c9814ac058b9f3ec1fb26051bd500000000000000000812e52930d139f9c018946064f9d372fe550d794b5bd6e38006564756172646f2e70657265697261
server  {
[peap] Setting User-Name to eduardo.xxxx
Sending tunneled request
        EAP-Message = 0x0208004a1a02080045317c69c9814ac058b9f3ec1fb26051bd500000000000000000812e52930d139f9c018946064f9d372fe550d794b5bd6e38006564756172646f2e70657265697261
        FreeRADIUS-Proxied-To = 127.0.0.1
        User-Name = "eduardo.xxxxx"
        State = 0x5f7d70975f756a2a1ba794dad71e8734
server inner-tunnel {
# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
+group authorize {
++[chap] = noop
++[mschap] = noop
[ntdomain] No '\' in User-Name = "eduardo.xxxx", looking up realm NULL
[ntdomain] No such realm "NULL"
++[ntdomain] = noop
++update control {
++} # update control = noop
[eap] EAP packet type response id 8 length 74
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] = updated
++[files] = noop
[ldap] performing user authorization for eduardo.xxxx
[ldap]  expand: (uid=%u) -> (uid=eduardo.xxxxx)
[ldap]  expand: ou=Usuarios,dc=xxxx,dc=com,dc=br -> ou=Usuarios,dc=tntedu,dc=com,dc=br
  [ldap] ldap_get_conn: Checking Id: 0
  [ldap] ldap_get_conn: Got Id: 0
  [ldap] performing search in ou=Usuarios,dc=xxxxxdc=com,dc=br, with filter (uid=eduardo.pereira)
[ldap] Password header not found in password {CRYPT}$1$6TlGRzaJ$8Kf310rzDvkD8o2ONgA6y1 for user eduardo.pereira
[ldap] Added User-Password = {CRYPT}$1$6TlGRzaJ$8Kf310rzDvkD8o2ONgA6y1 in check items
[ldap] looking for check items in directory...
  [ldap] userPassword -> User-Password == "{CRYPT}$1$6TlGRzaJ$8Kf310rzDvkD8o2ONgA6y1"
  [ldap] userPassword -> Password-With-Header == "{CRYPT}$1$6TlGRzaJ$8Kf310rzDvkD8o2ONgA6y1"
[ldap] looking for reply items in directory...
  [ldap] ldap_release_conn: Release Id: 0
++[ldap] = ok
++[expiration] = noop
++[logintime] = noop
[pap] WARNING: Auth-Type already set.  Not setting to PAP
++[pap] = noop
+} # group authorize = updated
Found Auth-Type = EAP
# Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
[mschapv2] +group MS-CHAP {
[mschap] No Cleartext-Password configured.  Cannot create LM-Password.
[mschap] No Cleartext-Password configured.  Cannot create NT-Password.
[mschap] Creating challenge hash with username: eduardo.xxxx
[mschap] Client is using MS-CHAPv2 for eduardo.pereira, we need NT-Password
[mschap] FAILED: No NT/LM-Password.  Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] = reject
+} # group MS-CHAP = reject
MSCHAP Failure 
++[eap] = handled
+} # group authenticate = handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
        EAP-Message = 0x010900121a0408000d453d36393120523d31
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x5f7d70975e746a2a1ba794dad71e8734
[peap] Got tunneled reply RADIUS code 11
        EAP-Message = 0x010900121a0408000d453d36393120523d31
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x5f7d70975e746a2a1ba794dad71e8734
[peap] Got tunneled Access-Challenge
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 162 to 10.1.0.249 port 2048
        EAP-Message = 0x0109003b19001703010030dd98404fc072f7b92d47dfe2d96bfd4be0684a2f7faa57660a935cadc89a75a29648c2f8d5cb48949c5361f0ab442ed4
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x0311bf9a0b18a64c8fa43dd51798a5f2
Finished request 76.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 68 ID 154 with timestamp +2049
Cleaning up request 69 ID 155 with timestamp +2049
Cleaning up request 70 ID 156 with timestamp +2049
Cleaning up request 71 ID 157 with timestamp +2049
Cleaning up request 72 ID 158 with timestamp +2049
Cleaning up request 73 ID 159 with timestamp +2049
Cleaning up request 74 ID 160 with timestamp +2049
Cleaning up request 75 ID 161 with timestamp +2049
Cleaning up request 76 ID 162 with timestamp +2049
WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
WARNING: !! EAP session for state 0x0311bf9a0b18a64c did not finish!
WARNING: !! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility
WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Ready to process requests.