Wireless-Italia

lato server:

	rad_recv: Access-Request packet from host 172.28.33.231:21648,

	id=227, length=163

	        User-Name = "cammani"

	        Framed-MTU = 1400

	        Called-Station-Id = "000e.84e2.0bb0"

	        Calling-Station-Id = "000e.35e5.14a6"

	        Message-Authenticator = 0xfd12688b453279797cb655e9e2cd898c

	        EAP-Message = 0x0201002c0163616d6d616e690000ff1c5379676174

	6553656375726974794167656e74000000000000000000

	        NAS-Port-Type = Wireless-802.11

	        NAS-Port = 474

	        Service-Type = Framed-User

	        NAS-IP-Address = 172.28.33.231

	        NAS-Identifier = "csapw1"

	  Processing the authorize section of radiusd.conf

	modcall: entering group authorize for request 0

	  modcall[authorize]: module "preprocess" returns ok for request 0

	    users: Matched cammani at 98

	radius_xlat:  'Hello, cammani'

	  modcall[authorize]: module "files" returns ok for request 0

	rlm_ldap: - authorize

	rlm_ldap: performing user authorization for cammani

	radius_xlat:  '(uid=cammani)'

	radius_xlat:  'dc=fis,dc=unipr,dc=it'

	rlm_ldap: ldap_get_conn: Checking Id: 0

	rlm_ldap: ldap_get_conn: Got Id: 0

	rlm_ldap: attempting LDAP reconnection

	rlm_ldap: (re)connect to ldap.fis.unipr.it:389, authentication 0

	rlm_ldap: bind as / to ldap.fis.unipr.it:389

	rlm_ldap: waiting for bind result ...

	rlm_ldap: Bind was successful

	rlm_ldap: performing search in dc=fis,dc=unipr,dc=it, with filter

	(uid=cammani)

	rlm_ldap: looking for check items in directory...

	rlm_ldap: looking for reply items in directory...

	rlm_ldap: user cammani authorized to use remote access

	rlm_ldap: ldap_release_conn: Release Id: 0

	  modcall[authorize]: module "ldap" returns ok for request 0

	modcall: group authorize returns ok for request 0

	  rad_check_password:  Found Auth-Type LDAP

	auth: type "LDAP"

	  Processing the authenticate section of radiusd.conf

	modcall: entering group Auth-Type for request 0

	rlm_ldap: - authenticate

	rlm_ldap: Attribute "User-Password" is required for authentication.

	  modcall[authenticate]: module "ldap" returns invalid for request 0

	modcall: group Auth-Type returns invalid for request 0

	auth: Failed to validate the user.

	Delaying request 0 for 1 seconds

	Finished request 0

	Going to the next request

	--- Walking the entire request list ---

	Waking up in 1 seconds...

	--- Walking the entire request list ---

	Waking up in 1 seconds...

	--- Walking the entire request list ---

	Sending Access-Reject of id 227 to 172.28.33.231:21648

	        Reply-Message = "Hello, cammani"

	Waking up in 4 seconds...

	

Il risultato dell'autenticazione e' un Access-Reject: l'ipotesi pi valida osservando il log del server e' che lo schema LEAP si aspetta di trovare sul database LDAP una coppia User password come testimoniato dalla riga seguente: rlm_ldap: Attribute "User-Password" is required for authentication. Indagando nel file eap.conf e' possibile trovare un indizio molto interessante As a result, LEAP *requires* access to the plain-text User-Password, or the NT-Password attributes. Infatti l'autenticazione basata sul client di test e' andata a buon fine, mostrando che il server radius e il database LDAP sono interfacciati correttamente (in quell'autenticazione il LEAP non gioca alcun ruolo). E' possibile effettuare un altro test: l'access point permette di loggarsi come amministratori utilizzando un server radius. Spuntando questa opzione e effettuando una connessione con l'utente LDAP l'autenticazione ha successo: il nome utente e la password sono stati inseriti sulla pagina HTML di configurazione ignorando quindi l'autenticazione LEAP.