Dotaz: freeradius + pptp

[hates]

Mam dotaz ohledne autentifikace a autorizace pres pptp oproti radius serveru. pptp server i radius mam korektne nakonfigurovany a radius pomoci radtest overi uzivatele spravne a vrati mu i spravne hodnoty. horsi to uz je s nakonfigurovanym pptp. podle logu se vzdaleny PC na pptp server pripoji a ten se snazi ziskat overeni z radiusu ale to uz nejde. pokud mam pptpd nakonfigurovane ze uzivatele overuje podle souboru tak vse jde a tunel se vytvori. oproti radiusu me odmitne. autentizacni metodu pouzivam MS_CHAPv2. Pokud by mel nekdo link jak nakonfigurovat tabulky v radiusu byl bych velmi rad z aposkytnuti. Uz si s tim hraji 2 dny a porad mi to nefunguje. nejspis bude nekde chybny atribut v tabulce radreply.

Prosim pokud nekdo vite jak na to tak poradte google jsem prolezl snad uz i pozpatku a co me dovedlo alespon k tomuhle vysledku tak byly stranky s obrazkovym pismem a manual

Odpovědi

[hates]

opravdu nikdo netusi jak nakonfigurovat tuhle sluzbu ?

[hates]

tak se vracim ypet k tomuhle problemu., opravdu nikdo netusi jak spravne nakonfigurovat pptp abz i win klienti se mohli pripojit ??? logz muzu poskztnout ale netusim, ktere budete chtit videt jestli z pptpd nebo freeradiusu. z widli logz asi neschrastim nebo nevim jak

[pavlix]

Asi ti nepomůžu, ale po třech pokusech asi lepší nějaký komentář než žádný, že.

S dotazama v poradně to máš těžký, buď nikdo neví... nebo se jim nechce zrovna zabývat laděním win. Věřím, že pptp & freeradius nejsou zase tak časté, takže se není čemu divit.

Pokud jde o logy, pošli co máš a uvidíš. Pokud něco vytáhneš z windows, tak i ty.

[Dusan]

Radiusd.conf:

prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius
raddbdir = /etc/freeradius
radacctdir = ${logdir}/radacct

confdir = ${raddbdir}
run_dir = ${localstatedir}/run/freeradius

log_file = ${logdir}/radius.log

libdir = /usr/lib/freeradius
pidfile = ${run_dir}/freeradius.pid

user = freerad
group = freerad

max_request_time = 30
delete_blocked_requests = no
cleanup_delay = 5
max_requests = 1024
bind_address = *

port = 0

hostname_lookups = no
allow_core_dumps = no

regular_expressions     = yes
extended_expressions    = yes

log_stripped_names = no
log_auth = no
log_auth_badpass = no
log_auth_goodpass = no

usercollide = no

lower_user = before
lower_pass = before

nospace_user = before
nospace_pass = before

checkrad = ${sbindir}/checkrad

security {
        max_attributes = 200
        reject_delay = 1
        status_server = no
}

proxy_requests  = no

$INCLUDE  ${confdir}/clients.conf

snmp    = no

thread pool {
        start_servers = 5
        max_servers = 32
        min_spare_servers = 3
        max_spare_servers = 10
        max_requests_per_server = 0
}

modules {
        pap {
                encryption_scheme = crypt
        }
        chap {
                authtype = CHAP
        }
        mschap {
                authtype = MS-CHAP
                use_mppe = yes
                require_encryption=yes
                require_strong=yes
        }
        acct_unique {
                key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
        }
        $INCLUDE  ${confdir}/sql.conf
        $INCLUDE ${confdir}/sqlcounter.conf
        counter daily {
                filename = ${raddbdir}/db.daily
                key = User-Name
                count-attribute = Acct-Session-Time
                reset = daily
                counter-name = Daily-Session-Time
                check-name = Max-Daily-Session
                allowed-servicetype = Framed-User
                cache-size = 5000
        }
        always fail {
                rcode = fail
        }
        always reject {
                rcode = reject
        }
        always ok {
                rcode = ok
                simulcount = 0
                mpp = no
        }
}

instantiate {
}
authorize {
        chap
        mschap
        sql
        noresetcounter
        dailycounter
        weeklycounter
        monthlycounter
}
authenticate {
#        Auth-Type PAP {
#                pap
#        }
#        Auth-Type CHAP {
#                chap
#        }
        Auth-Type MS-CHAP {
                mschap
        }
}
preacct {
        acct_unique
}
accounting {
        sql
}

session {
        sql
}
post-auth {
        sql
}

pptpd-options:

name pptpd


refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128

ms-dns 192.168.1.1

proxyarp

nodefaultroute

lock

nobsdcomp
plugin radius.so


pptpd.conf:

option /etc/ppp/pptpd-options

logwtmp


localip 192.168.1.199
remoteip 192.168.1.200-210

[hates]

konfiguraci mam velice podobnou a pptpd mi s radiusem kominikuje. v logu radiusu se mi yobrayi tohle

Thu Jun 19 15:16:11 2008 : Auth: Login incorrect: [pptp/<no User-Password attribute>] (from client server1 port 0 cli 192.168.1.102)

spis bude problem jak zadat tz informace do DB. Zkousim se prihlasit jako uzivatel pptp s heslem 123456 a v DB mam v tabulce radcheck zadane parametrz takhle

id      UserName         Attribute              Op      Value
15  	pptp  	         CHAP-Password  	==  	123456

mam jeste nekde neco pridat nebo upravit aby mi to overilo, ostatni parametry potom zadavam do tabulky radreply ktere to predava klientovi.

[hates]

problem vyresen
V radiusclientovi je nutno pridat slovnik od microsoftu a naincludovat ho do jiy nacitanech slovniku. tohle je ten slovnik

#
#       Microsoft's VSA's, from RFC 2548
#
#       $Id: poptop_ads_howto_8.htm,v 1.7 2007/05/20 03:56:36 wskwok Exp $
#

VENDOR          Microsoft       311     Microsoft

ATTRIBUTE       MS-CHAP-Response        1       string  Microsoft
ATTRIBUTE       MS-CHAP-Error           2       string  Microsoft
ATTRIBUTE       MS-CHAP-CPW-1           3       string  Microsoft
ATTRIBUTE       MS-CHAP-CPW-2           4       string  Microsoft
ATTRIBUTE       MS-CHAP-LM-Enc-PW       5       string  Microsoft
ATTRIBUTE       MS-CHAP-NT-Enc-PW       6       string  Microsoft
ATTRIBUTE       MS-MPPE-Encryption-Policy 7     string  Microsoft
# This is referred to as both singular and plural in the RFC.
# Plural seems to make more sense.
ATTRIBUTE       MS-MPPE-Encryption-Type 8       string  Microsoft
ATTRIBUTE       MS-MPPE-Encryption-Types  8     string  Microsoft
ATTRIBUTE       MS-RAS-Vendor           9       integer Microsoft
ATTRIBUTE       MS-CHAP-Domain          10      string  Microsoft
ATTRIBUTE       MS-CHAP-Challenge       11      string  Microsoft
ATTRIBUTE       MS-CHAP-MPPE-Keys       12      string  Microsoft encrypt=1
ATTRIBUTE       MS-BAP-Usage            13      integer Microsoft
ATTRIBUTE       MS-Link-Utilization-Threshold 14 integer        Microsoft
ATTRIBUTE       MS-Link-Drop-Time-Limit 15      integer Microsoft
ATTRIBUTE       MS-MPPE-Send-Key        16      string  Microsoft
ATTRIBUTE       MS-MPPE-Recv-Key        17      string  Microsoft
ATTRIBUTE       MS-RAS-Version          18      string  Microsoft
ATTRIBUTE       MS-Old-ARAP-Password    19      string  Microsoft
ATTRIBUTE       MS-New-ARAP-Password    20      string  Microsoft
ATTRIBUTE       MS-ARAP-PW-Change-Reason 21     integer Microsoft

ATTRIBUTE       MS-Filter               22      string  Microsoft
ATTRIBUTE       MS-Acct-Auth-Type       23      integer Microsoft
ATTRIBUTE       MS-Acct-EAP-Type        24      integer Microsoft

ATTRIBUTE       MS-CHAP2-Response       25      string  Microsoft
ATTRIBUTE       MS-CHAP2-Success        26      string  Microsoft
ATTRIBUTE       MS-CHAP2-CPW            27      string  Microsoft

ATTRIBUTE       MS-Primary-DNS-Server   28      ipaddr
ATTRIBUTE       MS-Secondary-DNS-Server 29      ipaddr
ATTRIBUTE       MS-Primary-NBNS-Server  30      ipaddr
ATTRIBUTE       MS-Secondary-NBNS-Server 31     ipaddr

#ATTRIBUTE      MS-ARAP-Challenge       33      string  Microsoft

#
#       Integer Translations
#

#       MS-BAP-Usage Values

VALUE           MS-BAP-Usage            Not-Allowed     0
VALUE           MS-BAP-Usage            Allowed         1
VALUE           MS-BAP-Usage            Required        2

#       MS-ARAP-Password-Change-Reason Values

VALUE   MS-ARAP-PW-Change-Reason        Just-Change-Password            1
VALUE   MS-ARAP-PW-Change-Reason        Expired-Password                2
VALUE   MS-ARAP-PW-Change-Reason        Admin-Requires-Password-Change  3
VALUE   MS-ARAP-PW-Change-Reason        Password-Too-Short              4

#       MS-Acct-Auth-Type Values

VALUE           MS-Acct-Auth-Type       PAP             1
VALUE           MS-Acct-Auth-Type       CHAP            2
VALUE           MS-Acct-Auth-Type       MS-CHAP-1       3
VALUE           MS-Acct-Auth-Type       MS-CHAP-2       4
VALUE           MS-Acct-Auth-Type       EAP             5

#       MS-Acct-EAP-Type Values

VALUE           MS-Acct-EAP-Type        MD5             4
VALUE           MS-Acct-EAP-Type        OTP             5
VALUE           MS-Acct-EAP-Type        Generic-Token-Card      6
VALUE           MS-Acct-EAP-Type        TLS             13

END-VENDOR Microsoft