Using OpenWRT nas, identical shared secret, told "Shared secret is incorrect."

Toyam Cox aviator45003 at gmail.com
Wed Nov 11 16:43:26 CET 2015


Radtest from the server works. There are quotes when  add the secrets
that go away because of the selected views.


Line tested with on 10.0.0.4:
radtest -t mschap Aviator testpass 10.0.0.5:1812 0 testing123

I have successfully run the same test from 127.0.0.1 before.


radiusd: FreeRADIUS Version 2.2.7, for host x86_64-unknown-openbsd5.8,
built on Aug  8 2015 at 13:06:28
Copyright (C) 1999-2015 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License.
For more information about these matters, see the file named COPYRIGHT.
Starting - reading configuration files ...
including configuration file /etc/raddb/radiusd.conf
including configuration file /etc/raddb/clients.conf
including files in directory /etc/raddb/modules/
including configuration file /etc/raddb/modules/acct_unique
including configuration file /etc/raddb/modules/always
including configuration file /etc/raddb/modules/attr_filter
including configuration file /etc/raddb/modules/attr_rewrite
including configuration file /etc/raddb/modules/cache
including configuration file /etc/raddb/modules/chap
including configuration file /etc/raddb/modules/checkval
including configuration file /etc/raddb/modules/counter
including configuration file /etc/raddb/modules/cui
including configuration file /etc/raddb/modules/detail
including configuration file /etc/raddb/modules/detail.example.com
including configuration file /etc/raddb/modules/detail.log
including configuration file /etc/raddb/modules/dhcp_sqlippool
including configuration file /etc/raddb/modules/digest
including configuration file /etc/raddb/modules/dynamic_clients
including configuration file /etc/raddb/modules/echo
including configuration file /etc/raddb/modules/etc_group
including configuration file /etc/raddb/modules/exec
including configuration file /etc/raddb/modules/expiration
including configuration file /etc/raddb/modules/expr
including configuration file /etc/raddb/modules/files
including configuration file /etc/raddb/modules/inner-eap
including configuration file /etc/raddb/modules/ippool
including configuration file /etc/raddb/modules/linelog
including configuration file /etc/raddb/modules/logintime
including configuration file /etc/raddb/modules/mac2ip
including configuration file /etc/raddb/modules/mac2vlan
including configuration file /etc/raddb/modules/mschap
including configuration file /etc/raddb/modules/ntlm_auth
including configuration file /etc/raddb/modules/opendirectory
including configuration file /etc/raddb/modules/otp
including configuration file /etc/raddb/modules/pap
including configuration file /etc/raddb/modules/passwd
including configuration file /etc/raddb/modules/policy
including configuration file /etc/raddb/modules/preprocess
including configuration file /etc/raddb/modules/radrelay
including configuration file /etc/raddb/modules/radutmp
including configuration file /etc/raddb/modules/realm
including configuration file /etc/raddb/modules/redis
including configuration file /etc/raddb/modules/rediswho
including configuration file /etc/raddb/modules/replicate
including configuration file /etc/raddb/modules/smbpasswd
including configuration file /etc/raddb/modules/smsotp
including configuration file /etc/raddb/modules/soh
including configuration file /etc/raddb/modules/sql_log
including configuration file /etc/raddb/modules/sqlcounter_expire_on_login
including configuration file /etc/raddb/modules/sradutmp
including configuration file /etc/raddb/modules/unix
including configuration file /etc/raddb/modules/wimax
including configuration file /etc/raddb/eap.conf
including configuration file /etc/raddb/sql.conf
including configuration file /etc/raddb/sql/postgresql/dialup.conf
including configuration file /etc/raddb/policy.conf
including files in directory /etc/raddb/sites-enabled/
including configuration file /etc/raddb/sites-enabled/control-socket
including configuration file /etc/raddb/sites-enabled/default
including configuration file /etc/raddb/sites-enabled/inner-tunnel
main {
    user = "_freeradius"
    group = "_freeradius"
    allow_core_dumps = no
}
including dictionary file /etc/raddb/dictionary
main {
    name = "radiusd"
    prefix = "/usr/local"
    localstatedir = "/var"
    sbindir = "/usr/local/sbin"
    logdir = "/var/log/radius"
    run_dir = "/var/run/radiusd"
    libdir = "/usr/local/lib/freeradius"
    radacctdir = "/var/log/radius/radacct"
    hostname_lookups = no
    max_request_time = 30
    cleanup_delay = 5
    max_requests = 1024
    pidfile = "/var/run/radiusd/radiusd.pid"
    checkrad = "/usr/local/sbin/checkrad"
    debug_level = 0
    proxy_requests = no
 log {
     stripped_names = no
     auth = yes
     auth_badpass = yes
     auth_goodpass = no
 }
 security {
     max_attributes = 200
     reject_delay = 1
     status_server = yes
     allow_vulnerable_openssl = no
 }
}
radiusd: #### Loading Realms and Home Servers ####
radiusd: #### Loading Clients ####
 client localhost {
     ipaddr = 127.0.0.1
     require_message_authenticator = no
     secret = "testing123"
     nastype = "other"
 }
 client 10.0.0.4 {
     require_message_authenticator = no
     secret = "testing123"
     shortname = "test1"
     nastype = "other"
 }
radiusd: #### Instantiating modules ####
 instantiate {
 Module: Linked to module rlm_exec
 Module: Instantiating module "exec" from file /etc/raddb/modules/exec
  exec {
      wait = no
      input_pairs = "request"
      shell_escape = yes
      timeout = 10
  }
 Module: Linked to module rlm_expr
 Module: Instantiating module "expr" from file /etc/raddb/modules/expr
 Module: Linked to module rlm_expiration
 Module: Instantiating module "expiration" from file
/etc/raddb/modules/expiration
  expiration {
      reply-message = "Password Has Expired  "
  }
 Module: Linked to module rlm_logintime
 Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime
  logintime {
      reply-message = "You are calling outside your allowed timespan  "
      minimum-timeout = 60
  }
 }
radiusd: #### Loading Virtual Servers ####
server { # from file KQð???
 modules {
  Module: Creating Auth-Type = digest
 Module: Checking authenticate {...} for more modules to load
 Module: Linked to module rlm_pap
 Module: Instantiating module "pap" from file /etc/raddb/modules/pap
  pap {
      encryption_scheme = "auto"
      auto_header = no
  }
 Module: Linked to module rlm_chap
 Module: Instantiating module "chap" from file /etc/raddb/modules/chap
 Module: Linked to module rlm_mschap
 Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap
  mschap {
      use_mppe = yes
      require_encryption = no
      require_strong = no
      with_ntdomain_hack = no
      allow_retry = yes
  }
 Module: Linked to module rlm_digest
 Module: Instantiating module "digest" from file /etc/raddb/modules/digest
 Module: Linked to module rlm_unix
 Module: Instantiating module "unix" from file /etc/raddb/modules/unix
  unix {
      radwtmp = "/var/log/radius/radwtmp"
  }
 Module: Linked to module rlm_eap
 Module: Instantiating module "eap" from file /etc/raddb/eap.conf
  eap {
      default_eap_type = "md5"
      timer_expire = 60
      ignore_unknown_eap_types = no
      cisco_accounting_username_bug = no
      max_sessions = 1024
  }
 Module: Linked to sub-module rlm_eap_md5
 Module: Instantiating eap-md5
 Module: Linked to sub-module rlm_eap_leap
 Module: Instantiating eap-leap
 Module: Linked to sub-module rlm_eap_gtc
 Module: Instantiating eap-gtc
   gtc {
       challenge = "Password: "
       auth_type = "PAP"
   }
 Module: Linked to sub-module rlm_eap_tls
 Module: Instantiating eap-tls
   tls {
       rsa_key_exchange = no
       dh_key_exchange = yes
       rsa_key_length = 512
       dh_key_length = 512
       verify_depth = 0
       CA_path = "/etc/raddb/certs"
       pem_file_type = yes
       private_key_file = "/etc/raddb/certs/server.pem"
       certificate_file = "/etc/raddb/certs/server.pem"
       CA_file = "/etc/raddb/certs/ca.pem"
       private_key_password = "whatever"
       dh_file = "/etc/raddb/certs/dh"
       fragment_size = 1024
       include_length = yes
       check_crl = no
       cipher_list = "DEFAULT"
       make_cert_command = "/etc/raddb/certs/bootstrap"
       ecdh_curve = "prime256v1"
    cache {
        enable = no
        lifetime = 24
        max_entries = 255
    }
    verify {
    }
    ocsp {
        enable = no
        override_cert_url = yes
        url = "http://127.0.0.1/ocsp/"
        use_nonce = yes
        timeout = 0
        softfail = no
    }
   }
 Module: Linked to sub-module rlm_eap_ttls
 Module: Instantiating eap-ttls
   ttls {
       default_eap_type = "md5"
       copy_request_to_tunnel = no
       use_tunneled_reply = no
       virtual_server = "inner-tunnel"
       include_length = yes
   }
 Module: Linked to sub-module rlm_eap_peap
 Module: Instantiating eap-peap
   peap {
       default_eap_type = "mschapv2"
       copy_request_to_tunnel = no
       use_tunneled_reply = no
       proxy_tunneled_request_as_eap = yes
       virtual_server = "inner-tunnel"
       soh = no
   }
 Module: Linked to sub-module rlm_eap_mschapv2
 Module: Instantiating eap-mschapv2
   mschapv2 {
       with_ntdomain_hack = no
       send_error = no
   }
 Module: Checking authorize {...} for more modules to load
 Module: Loading virtual module filter_username
 Module: Linked to module rlm_always
 Module: Instantiating module "reject" from file /etc/raddb/modules/always
  always reject {
      rcode = "reject"
      simulcount = 0
      mpp = no
  }
 Module: Linked to module rlm_preprocess
 Module: Instantiating module "preprocess" from file
/etc/raddb/modules/preprocess
  preprocess {
      huntgroups = "/etc/raddb/huntgroups"
      hints = "/etc/raddb/hints"
      with_ascend_hack = no
      ascend_channels_per_line = 23
      with_ntdomain_hack = no
      with_specialix_jetstream_hack = no
      with_cisco_vsa_hack = no
      with_alvarion_vsa_hack = no
  }
reading pairlist file /etc/raddb/huntgroups
reading pairlist file /etc/raddb/hints
 Module: Linked to module rlm_detail
 Module: Instantiating module "auth_log" from file /etc/raddb/modules/detail.log
  detail auth_log {
      detailfile =
"/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
      header = "%t"
      detailperm = 384
      dirperm = 493
      locking = no
      log_packet_header = no
      escape_filenames = no
  }
 Module: Linked to module rlm_realm
 Module: Instantiating module "suffix" from file /etc/raddb/modules/realm
  realm suffix {
      format = "suffix"
      delimiter = "@"
      ignore_default = no
      ignore_null = no
  }
 Module: Linked to module rlm_files
 Module: Instantiating module "files" from file /etc/raddb/modules/files
  files {
      usersfile = "/etc/raddb/users"
      acctusersfile = "/etc/raddb/acct_users"
      preproxy_usersfile = "/etc/raddb/preproxy_users"
      compat = "no"
  }
reading pairlist file /etc/raddb/users
reading pairlist file /etc/raddb/acct_users
reading pairlist file /etc/raddb/preproxy_users
 Module: Linked to module rlm_sql
 Module: Instantiating module "sql" from file /etc/raddb/sql.conf
  sql {
      driver = "rlm_sql_postgresql"
      server = "localhost"
      port = ""
      login = "radius"
      password =
"J89DtRVV0m7kOAXPmDQ10BEqCYYTiagwJ/1yyoIRMPlJMvfq8b68bZVBosAzvWZw/pDe4uOaTbVf"
      radius_db = "radius"
      read_groups = yes
      sqltrace = yes
      sqltracefile = "/var/log/radius/sqltrace.sql"
      readclients = yes
      deletestalesessions = yes
      num_sql_socks = 32
      lifetime = 0
      max_queries = 0
      sql_user_name = "%{User-Name}"
      default_user_profile = ""
      nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas"
      authorize_check_query = "SELECT id, UserName, Attribute, Value,
Op   FROM radcheck   WHERE Username = '%{SQL-User-Name}'   ORDER BY
id"
      authorize_reply_query = "SELECT id, UserName, Attribute, Value,
Op   FROM radreply   WHERE Username = '%{SQL-User-Name}'   ORDER BY
id"
      authorize_group_check_query = "SELECT id, GroupName, Attribute,
Value, op   FROM radgroupcheck   WHERE GroupName = '%{Sql-Group}'
ORDER BY id"
      authorize_group_reply_query = "SELECT id, GroupName, Attribute,
Value, op   FROM radgroupreply   WHERE GroupName = '%{Sql-Group}'
ORDER BY id"
      accounting_onoff_query = "UPDATE radacct   SET AcctStopTime =
('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval),
AcctSessionTime = (EXTRACT(EPOCH FROM ('%S'::timestamp with time zone
- AcctStartTime::timestamp with time zone   -
'%{%{Acct-Delay-Time}:-0}'::interval)))::BIGINT,   AcctTerminateCause
= '%{Acct-Terminate-Cause}',   AcctStopDelay = 0   WHERE AcctStopTime
IS NULL   AND NASIPAddress= '%{NAS-IP-Address}'   AND AcctStartTime <=
'%S'::timestamp"
      accounting_update_query = "UPDATE radacct   SET FramedIPAddress
= NULLIF('%{Framed-IP-Address}', '')::inet,   AcctSessionTime =
NULLIF('%{Acct-Session-Time}','')::BIGINT,   AcctInputOctets =
(('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) +
'%{%{Acct-Input-Octets}:-0}'::bigint),   AcctOutputOctets =
(('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) +
'%{%{Acct-Output-Octets}:-0}'::bigint)   WHERE AcctSessionId =
'%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}'   AND
NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime IS NULL"
      accounting_update_query_alt = "INSERT INTO radacct
(AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress,
NASPortId, NASPortType, AcctStartTime,   AcctSessionTime,
AcctAuthentic, AcctInputOctets,   AcctOutputOctets, CalledStationId,
CallingStationId,   ServiceType, FramedProtocol, FramedIPAddress,
XAscendSessionSvrKey)   VALUES('%{Acct-Session-Id}',
'%{Acct-Unique-Session-Id}',   '%{SQL-User-Name}', NULLIF('%{Realm}',
''), '%{NAS-IP-Address}',   %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}',
 ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval -
'%{%{Acct-Session-Time}:-0}'::interval),
NULLIF('%{Acct-Session-Time}','')::BIGINT, '%{Acct-Authentic}',
(('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) +
'%{%{Acct-Input-Octets}:-0}'::bigint),
(('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) +
'%{%{Acct-Output-Octets}:-0}'::bigint),   '%{Called-Station-Id}',
'%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}',
NULLIF('%{Framed-IP-Address}', '')::inet,
'%{X-Ascend-Session-Svr-Key}')"
      accounting_start_query = "INSERT INTO radacct   (AcctSessionId,
AcctUniqueId, UserName, Realm, NASIPAddress,    NASPortId,
NASPortType, AcctStartTime, AcctAuthentic,   ConnectInfo_start,
CalledStationId, CallingStationId, ServiceType,   FramedProtocol,
FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey)
VALUES('%{Acct-Session-Id}',   '%{Acct-Unique-Session-Id}',
'%{SQL-User-Name}',   NULLIF('%{Realm}', ''),   '%{NAS-IP-Address}',
%{%{NAS-Port}:-NULL},   '%{NAS-Port-Type}',   ('%S'::timestamp -
'%{%{Acct-Delay-Time}:-0}'::interval),   '%{Acct-Authentic}',
'%{Connect-Info}',   '%{Called-Station-Id}',
'%{Calling-Station-Id}',   '%{Service-Type}',   '%{Framed-Protocol}',
 NULLIF('%{Framed-IP-Address}', '')::inet,   0,
'%{X-Ascend-Session-Svr-Key}')"
      accounting_start_query_alt = "UPDATE radacct   SET AcctStartTime
= ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval),
AcctStartDelay = 0,   ConnectInfo_start = '%{Connect-Info}'   WHERE
AcctSessionId = '%{Acct-Session-Id}'   AND UserName =
'%{SQL-User-Name}'   AND NASIPAddress = '%{NAS-IP-Address}'   AND
AcctStopTime IS NULL"
      accounting_stop_query = "UPDATE radacct   SET AcctStopTime =
('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval),
AcctSessionTime = CASE WHEN '%{Acct-Session-Time}' = '' THEN
(EXTRACT(EPOCH FROM ('%S'::TIMESTAMP WITH TIME ZONE -
AcctStartTime::TIMESTAMP WITH TIME ZONE   -
'%{%{Acct-Delay-Time}:-0}'::INTERVAL)))::BIGINT   ELSE
NULLIF('%{Acct-Session-Time}','')::BIGINT END,   AcctInputOctets =
(('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) +
'%{%{Acct-Input-Octets}:-0}'::bigint),   AcctOutputOctets =
(('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) +
'%{%{Acct-Output-Octets}:-0}'::bigint),   AcctTerminateCause =
'%{Acct-Terminate-Cause}',   AcctStopDelay = 0,   FramedIPAddress =
NULLIF('%{Framed-IP-Address}', '')::inet,   ConnectInfo_stop =
'%{Connect-Info}'   WHERE AcctSessionId = '%{Acct-Session-Id}'   AND
UserName = '%{SQL-User-Name}'   AND NASIPAddress = '%{NAS-IP-Address}'
  AND AcctStopTime IS NULL"
      accounting_stop_query_alt = "INSERT INTO radacct
(AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress,
NASPortId, NASPortType, AcctStartTime, AcctStopTime,
AcctSessionTime, AcctAuthentic, ConnectInfo_stop, AcctInputOctets,
AcctOutputOctets, CalledStationId,   CallingStationId,
AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress,
AcctStopDelay)   values('%{Acct-Session-Id}',
'%{Acct-Unique-Session-Id}',   '%{SQL-User-Name}',
NULLIF('%{Realm}', ''),   '%{NAS-IP-Address}',   %{%{NAS-Port}:-NULL},
  '%{NAS-Port-Type}',   ('%S'::timestamp -
'%{%{Acct-Delay-Time}:-0}'::interval -
'%{%{Acct-Session-Time}:-0}'::interval),   ('%S'::timestamp -
'%{%{Acct-Delay-Time}:-0}'::interval),
NULLIF('%{Acct-Session-Time}', '')::bigint, '%{Acct-Authentic}',
'%{Connect-Info}',   (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32)
+ '%{%{Acct-Input-Octets}:-0}'::bigint),
(('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) +
'%{%{Acct-Output-Octets}:-0}'::bigint),   '%{Called-Station-Id}',
'%{Calling-Station-Id}',   '%{Acct-Terminate-Cause}',
'%{Service-Type}',   '%{Framed-Protocol}',
NULLIF('%{Framed-IP-Address}', '')::inet, 0)"
      group_membership_query = "SELECT GroupName FROM radusergroup
WHERE UserName='%{SQL-User-Name}' ORDER BY priority"
      connect_failure_retry_delay = 60
      simul_count_query = ""
      simul_verify_query = ""
      postauth_query = "INSERT INTO radpostauth (username, pass,
reply, authdate)   VALUES ('%{User-Name}',
'%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW())"
      safe-characters =
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
/"
  }
rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql)
loaded and linked
rlm_sql (sql): Attempting to connect to radius at localhost:/radius
rlm_sql (sql): starting 0
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0
rlm_sql (sql): Connected new DB handle, #0
rlm_sql (sql): starting 1
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #1
rlm_sql (sql): Connected new DB handle, #1
rlm_sql (sql): starting 2
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #2
rlm_sql (sql): Connected new DB handle, #2
rlm_sql (sql): starting 3
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #3
rlm_sql (sql): Connected new DB handle, #3
rlm_sql (sql): starting 4
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #4
rlm_sql (sql): Connected new DB handle, #4
rlm_sql (sql): starting 5
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #5
rlm_sql (sql): Connected new DB handle, #5
rlm_sql (sql): starting 6
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #6
rlm_sql (sql): Connected new DB handle, #6
rlm_sql (sql): starting 7
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #7
rlm_sql (sql): Connected new DB handle, #7
rlm_sql (sql): starting 8
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #8
rlm_sql (sql): Connected new DB handle, #8
rlm_sql (sql): starting 9
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #9
rlm_sql (sql): Connected new DB handle, #9
rlm_sql (sql): starting 10
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #10
rlm_sql (sql): Connected new DB handle, #10
rlm_sql (sql): starting 11
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #11
rlm_sql (sql): Connected new DB handle, #11
rlm_sql (sql): starting 12
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #12
rlm_sql (sql): Connected new DB handle, #12
rlm_sql (sql): starting 13
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #13
rlm_sql (sql): Connected new DB handle, #13
rlm_sql (sql): starting 14
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #14
rlm_sql (sql): Connected new DB handle, #14
rlm_sql (sql): starting 15
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #15
rlm_sql (sql): Connected new DB handle, #15
rlm_sql (sql): starting 16
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #16
rlm_sql (sql): Connected new DB handle, #16
rlm_sql (sql): starting 17
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #17
rlm_sql (sql): Connected new DB handle, #17
rlm_sql (sql): starting 18
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #18
rlm_sql (sql): Connected new DB handle, #18
rlm_sql (sql): starting 19
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #19
rlm_sql (sql): Connected new DB handle, #19
rlm_sql (sql): starting 20
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #20
rlm_sql (sql): Connected new DB handle, #20
rlm_sql (sql): starting 21
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #21
rlm_sql (sql): Connected new DB handle, #21
rlm_sql (sql): starting 22
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #22
rlm_sql (sql): Connected new DB handle, #22
rlm_sql (sql): starting 23
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #23
rlm_sql (sql): Connected new DB handle, #23
rlm_sql (sql): starting 24
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #24
rlm_sql (sql): Connected new DB handle, #24
rlm_sql (sql): starting 25
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #25
rlm_sql (sql): Connected new DB handle, #25
rlm_sql (sql): starting 26
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #26
rlm_sql (sql): Connected new DB handle, #26
rlm_sql (sql): starting 27
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #27
rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server
radius at localhost:radius
rlm_sql (sql): Failed to connect DB handle #27
rlm_sql (sql): starting 28
rlm_sql (sql): starting 29
rlm_sql (sql): starting 30
rlm_sql (sql): starting 31
rlm_sql (sql): Processing generate_sql_clients
rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname,
shortname, type, secret, server FROM nas
rlm_sql (sql): Ignoring unconnected handle 31..
rlm_sql (sql): Ignoring unconnected handle 30..
rlm_sql (sql): Ignoring unconnected handle 29..
rlm_sql (sql): Ignoring unconnected handle 28..
rlm_sql (sql): Ignoring unconnected handle 27..
rlm_sql (sql): Reserving sql socket id: 26
rlm_sql (sql): got socket 26 after skipping 5 unconnected handles,
tried to reconnect 0 though
rlm_sql_postgresql: query: SELECT id, nasname, shortname, type,
secret, server FROM nas
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 1 , fields = 6
rlm_sql (sql): Read entry nasname=10.0.0.10,shortname=frank,secret=secret_shared
rlm_sql (sql): Adding client 10.0.0.10 (frank, server=<none>) to clients list
rlm_sql (sql): Released sql socket id: 26
 Module: Linked to module rlm_counter
 Module: Instantiating module "daily" from file /etc/raddb/modules/counter
  counter daily {
      filename = "/etc/raddb/db.daily"
      key = "User-Name"
      reset = "daily"
      count-attribute = "Acct-Session-Time"
      counter-name = "Daily-Session-Time"
      check-name = "Max-Daily-Session"
      reply-name = "Session-Timeout"
      allowed-servicetype = "Framed-User"
      cache-size = 5000
  }
rlm_counter: Counter attribute Daily-Session-Time is number 11273
rlm_counter: Current Time: 1447255190 [2015-11-11 10:19:50], Next
reset 1447304400 [2015-11-12 00:00:00]
 Module: Checking preacct {...} for more modules to load
 Module: Linked to module rlm_acct_unique
 Module: Instantiating module "acct_unique" from file
/etc/raddb/modules/acct_unique
  acct_unique {
      key = "User-Name, Acct-Session-Id, NAS-IP-Address,
NAS-Identifier, NAS-Port"
  }
 Module: Checking accounting {...} for more modules to load
 Module: Instantiating module "detail" from file /etc/raddb/modules/detail
  detail {
      detailfile =
"/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
      header = "%t"
      detailperm = 384
      dirperm = 493
      locking = no
      log_packet_header = no
      escape_filenames = no
  }
 Module: Linked to module rlm_attr_filter
 Module: Instantiating module "attr_filter.accounting_response" from
file /etc/raddb/modules/attr_filter
  attr_filter attr_filter.accounting_response {
      attrsfile = "/etc/raddb/attrs.accounting_response"
      key = "%{User-Name}"
      relaxed = no
  }
reading pairlist file /etc/raddb/attrs.accounting_response
 Module: Checking session {...} for more modules to load
 Module: Linked to module rlm_radutmp
 Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp
  radutmp {
      filename = "/var/log/radius/radutmp"
      username = "%{User-Name}"
      case_sensitive = yes
      check_with_nas = yes
      perm = 384
      callerid = yes
  }
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 Module: Instantiating module "attr_filter.access_reject" from file
/etc/raddb/modules/attr_filter
  attr_filter attr_filter.access_reject {
      attrsfile = "/etc/raddb/attrs.access_reject"
      key = "%{User-Name}"
      relaxed = no
  }
reading pairlist file /etc/raddb/attrs.access_reject
 } # modules
} # server
server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Checking authorize {...} for more modules to load
 Module: Checking session {...} for more modules to load
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 } # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
     type = "auth"
     ipaddr = *
     port = 0
}
listen {
     type = "acct"
     ipaddr = *
     port = 0
}
listen {
     type = "control"
 listen {
     socket = "/var/run/radiusd/radiusd.sock"
 }
}
listen {
      type = "auth"
      ipaddr = 127.0.0.1
      port = 18120
}
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on command file /var/run/radiusd/radiusd.sock
Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
Ready to process requests.
rad_recv: Access-Request packet from host 10.0.0.4 port 12936, id=253,
length=133
    User-Name = "Aviator"
    NAS-IP-Address = 10.0.0.4
    NAS-Port = 0
    Message-Authenticator = 0xe601d87c9065c214eb5461f06cf2c55b
    MS-CHAP-Challenge = 0xd2f6a4ad2ddb942b
    MS-CHAP-Response =
0x00010000000000000000000000000000000000000000000000007da48d7397f9b0eebf6182b70846bd09671dd019baa4eea8
# Executing section authorize from file /etc/raddb/sites-enabled/default
+group authorize {
++policy filter_username {
+++? if (User-Name =~ / /)
? Evaluating (User-Name =~ / /) -> FALSE
+++? if (User-Name =~ / /) -> FALSE
+++? if (User-Name =~ /@.*@/ )
? Evaluating (User-Name =~ /@.*@/) -> FALSE
+++? if (User-Name =~ /@.*@/ ) -> FALSE
+++? if (User-Name =~ /\\.\\./ )
? Evaluating (User-Name =~ /\\.\\./) -> FALSE
+++? if (User-Name =~ /\\.\\./ ) -> FALSE
+++? if (User-Name !~ /@(.+)\\.(.+)$/)
? Evaluating (User-Name !~ /@(.+)\\.(.+)$/) -> TRUE
+++? if (User-Name !~ /@(.+)\\.(.+)$/) -> TRUE
+++if (User-Name !~ /@(.+)\\.(.+)$/) {
++++update reply {
++++} # update reply = noop
++++[reject] = reject
+++} # if (User-Name !~ /@(.+)\\.(.+)$/) = reject
++} # policy filter_username = reject
+} # group authorize = reject
Invalid user: [Aviator/<no User-Password attribute>] (from client test1 port 0)
Using Post-Auth-Type Reject
# Executing group from file /etc/raddb/sites-enabled/default
+group REJECT {
[sql]     expand: %{User-Name} -> Aviator
[sql] sql_set_user escaped user --> 'Aviator'
[sql]     expand: %{User-Password} ->
[sql]     ... expanding second conditional
[sql]     expand: INSERT INTO radpostauth (username, pass, reply,
authdate)   VALUES ('%{User-Name}',
'%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW())
-> INSERT INTO radpostauth (username, pass, reply, authdate)   VALUES
('Aviator', 'Chap-Password', 'Access-Reject', NOW())
[sql]     expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql
rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth
(username, pass, reply, authdate)   VALUES ('Aviator',
'Chap-Password', 'Access-Reject', NOW())
rlm_sql (sql): Reserving sql socket id: 25
rlm_sql_postgresql: query: INSERT INTO radpostauth (username, pass,
reply, authdate)   VALUES ('Aviator', 'Chap-Password',
'Access-Reject', NOW())
rlm_sql_postgresql: Status: PGRES_COMMAND_OK
rlm_sql_postgresql: query affected rows = 1
rlm_sql (sql): Released sql socket id: 25
++[sql] = ok
[eap] Request didn't contain an EAP-Message, not inserting EAP-Failure
++[eap] = noop
[attr_filter.access_reject]     expand: %{User-Name} -> Aviator
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] = updated
+} # group REJECT = updated
Delaying reject of request 0 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 0
Sending Access-Reject of id 253 to 10.0.0.4 port 12936
    Reply-Message = "Rejected: Realm does not have at least one dot seperator"
Waking up in 4.9 seconds.



Is there any way to see the request the client is sending the server?

On Wed, Nov 11, 2015 at 9:05 AM,  <A.L.M.Buxey at lboro.ac.uk> wrote:
> hi,
>
> try defining your key with quotes eg "shared_secret"  ?
>
> alan
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html



More information about the Freeradius-Users mailing list