哪位老大熟悉freeradius作802.1x身份驗證的，進來幫看看
我用freeradius 1.1.7，後台接oracle資料庫，NAS用Cisco 3750交換機，給LAN里的PC做802.1x身份驗證。現在作MD5身份驗證沒問題，但是要求換成peap-mschapv2，我現在有些沒鬧明白，搞這種驗證方法是不是必須要配LDAP或是SMBA或/etc/passwd才行？難道不能讓呀直接讀資料庫里的用戶信息？我就是沒有配LDAP、SMBA什麼的呀就給我驗證不過去。看看我配置文件中的相關內容：
radiusd.conf:
authorize {
preprocess
mschap
sql
eap
}
authenticate {
Auth-Type MS-CHAP {
mschap
}
eap
}
eap.conf:
eap {
default_eap_type = peap
timer_expire = 60
ignore_unknown_eap_types = no
}
tls {
private_key_password = whatever
private_key_file = ${raddbdir}/certs/cert-srv.pem
certificate_file = ${raddbdir}/certs/cert-srv.pem
CA_file = ${raddbdir}/certs/demoCA/cacert.pem
dh_file = ${raddbdir}/certs/dh
random_file = ${raddbdir}/certs/random
fragment_size = 1024
}
peap {
default_eap_type = mschapv2
copy_request_to_tunnel = no
use_tunneled_reply = no
}
mschapv2 {
}
關鍵的，我一登錄呀就給我報這個（我用的是xp自帶的radius客戶端）：
rad_recv: Access-Request packet from host 10.0.99.1:1645, id=141, length=252
NAS-IP-Address = 10.0.99.1
NAS-Port = 50441
Cisco-NAS-Port = "FastEthernet4/0/41"
NAS-Port-Type = Ethernet
User-Name = "testuser"
Called-Station-Id = "00-19-2F-E1-C0-AD"
Calling-Station-Id = "00-10-C6-A8-DA-00"
Service-Type = Framed-User
Framed-MTU = 1500
State = 0xb9868a780c968e9716093b01742690ee
EAP-Message = 0x0206005a1900170301004f4ea0464ecb62296c3fe83ddbe7cb46cfc87deccd3b5d7786299443f17d173f52209f2eefb5497f3153bdd751357d7b5beb55afb0d7e60d775792b375564444f5f30c0ad8cae5c74b398405d8cc4b63
Message-Authenticator = 0x3ced719a5b1cfdb5e3e3c49fa411e309
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 6
modcall: module "preprocess" returns ok for request 6
radius_xlat: '/usr/local/var/log/radius/radacct/10.0.99.1/auth-detail-20090225'
rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.99.1/auth-detail-20090225
modcall: module "auth_log" returns ok for request 6
modcall: module "mschap" returns noop for request 6
rlm_eap: EAP packet type response id 6 length 90
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall: module "eap" returns updated for request 6
radius_xlat: 'testuser'
rlm_sql (sql): sql_set_user escaped user --> 'testuser'
radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testuser' and (mac = '00-10-C6-A8-DA-00' or mac is null) ORDER BY id'
rlm_sql (sql): Reserving sql socket id: 2
radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id'
radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'testuser' ORDER BY id'
radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id'
rlm_sql (sql): Released sql socket id: 2
modcall: module "sql" returns ok for request 6
modcall: leaving group authorize (returns updated) for request 6
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 6
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
eaptls_process returned 7
rlm_eap_peap: EAPTLS_OK
rlm_eap_peap: Session established. Decoding tunneled attributes.
rlm_eap_peap: EAP type mschapv2
rlm_eap_peap: Tunneled data is valid.
PEAP: Got tunneled EAP-Message
EAP-Message = 0x020600431a0206003e316cdcc08e1adf37fdb332d32419efee1300000000000000002667d1668b083c47ab1b70edc530d3d3d9f0bb9a4c254ce8007465737475736572
PEAP: Setting User-Name to testuser
PEAP: Adding old state with 64 0b
PEAP: Sending tunneled request
EAP-Message = 0x020600431a0206003e316cdcc08e1adf37fdb332d32419efee1300000000000000002667d1668b083c47ab1b70edc530d3d3d9f0bb9a4c254ce8007465737475736572
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "testuser"
State = 0x640b188d31bc5ddc785afe862ca9225f
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 6
modcall: module "preprocess" returns ok for request 6
radius_xlat: '/usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20090225'
rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20090225
modcall: module "auth_log" returns ok for request 6
modcall: module "mschap" returns noop for request 6
rlm_eap: EAP packet type response id 6 length 67
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall: module "eap" returns updated for request 6
radius_xlat: 'testuser'
rlm_sql (sql): sql_set_user escaped user --> 'testuser'
radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testuser' and (mac = '' or mac is null) ORDER BY id'
rlm_sql (sql): Reserving sql socket id: 1
rlm_sql (sql): User testuser not found in radcheck
radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id'
radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id'
rlm_sql (sql): User testuser not found in radgroupcheck
rlm_sql (sql): Released sql socket id: 1
rlm_sql (sql): User not found
modcall: module "sql" returns notfound for request 6
modcall: leaving group authorize (returns updated) for request 6
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 6
rlm_eap: Request found, released from the list
rlm_eap: EAP/mschapv2
rlm_eap: processing type mschapv2
Processing the authenticate section of radiusd.conf
modcall: entering group MS-CHAP for request 6
rlm_mschap: No User-Password configured. Cannot create LM-Password.
rlm_mschap: No User-Password configured. Cannot create NT-Password.
rlm_mschap: Told to do MS-CHAPv2 for testuser with NT-Password
rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication.
rlm_mschap: FAILED: MS-CHAP2-Response is incorrect
modcall: module "mschap" returns reject for request 6
modcall: leaving group MS-CHAP (returns reject) for request 6
rlm_eap: Freeing handler
modcall: module "eap" returns reject for request 6
modcall: leaving group authenticate (returns reject) for request 6
auth: Failed to validate the user.
Login incorrect: (from client localhost port 0)
......
再後面：
......
modcall: leaving group authorize (returns updated) for request 7
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 7
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
eaptls_process returned 7
rlm_eap_peap: EAPTLS_OK
rlm_eap_peap: Session established. Decoding tunneled attributes.
rlm_eap_peap: Received EAP-TLV response.
rlm_eap_peap: Tunneled data is valid.
rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session.
rlm_eap: Handler failed in EAP/peap
rlm_eap: Failed in EAP select
modcall: module "eap" returns invalid for request 7
modcall: leaving group authenticate (returns invalid) for request 7
auth: Failed to validate the user.
Login incorrect: (from client bg3750 port 50441 cli 00-10-C6-A8-DA-00)
Delaying request 7 for 1 seconds
Finished request 7
Going to the next request
現在不知道該怎麼辦了，是不是必須要用/etc/passwd或LDAP驗證？如果是這樣還要我這資料庫幹嗎？
資料庫里現在已經有 testuser User-Password := test123 這個條目了。
《解決方案》
大蝦們都在哪
