CHAP - FREERADIUS 2 to FRERRADIUS 3
Aurélio de Souza Ribeiro Neto
netolistas at mpc.com.br
Wed Aug 2 14:37:57 CEST 2017
Hello,
I did Upgrade from 2.2.9 to 3.0.15.
For marketing purposes if my client is not on my base and tries to
connect to my system, I permit the access in a specific pool.
When I upgraded to 3, this stoped to work.
Some help?
Look more details.....
In my default file:
Auth-Type CHAP {
chap {
invalid = 1
}
if(invalid) {
update control {
Pool-Name := "mkt_pool"
}
update reply {
Mikrotik-Rate-Limit := "300K/2M 600K/2200K
450K/1500K 10/10"
}
ok
}
}
My radiusd -X output:
Ready to process requests
(0) Received Access-Request Id 199 from 172.17.6.2:42459 to
187.120.197.145:1812 length 152
(0) Service-Type = Framed-User
(0) Framed-Protocol = PPP
(0) NAS-Port = 15736495
(0) NAS-Port-Type = Ethernet
(0) User-Name = "soniaregina"
(0) Calling-Station-Id = "84:C9:B2:A3:BB:67"
(0) Called-Station-Id = "CE - POP ITPM5"
(0) NAS-Port-Id = "ether5"
(0) CHAP-Challenge = 0x3cfe95eca592d11448a098b33412cd0b
(0) CHAP-Password = 0x01cc08e5f2ad79880124b1d826606947b2
(0) NAS-Identifier = "CE-ITPM"
(0) NAS-IP-Address = 172.17.6.2
(0) # Executing section authorize from file
/usr/local/etc/raddb/sites-enabled/default
(0) authorize {
(0) [preprocess] = ok
(0) chap: &control:Auth-Type := CHAP
(0) [chap] = ok
(0) [mschap] = noop
(0) sql: EXPAND %{User-Name}
(0) sql: --> soniaregina
(0) sql: SQL-User-Name set to 'soniaregina'
rlm_sql (sql): Reserved connection (1)
(0) sql: EXPAND SELECT DISTINCT (R.id), R.username, R.attribute,
R.value, R.op FROM
mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist
M WHERE R.username = BINARY
'%{SQL-User-Name}' AND M.usuario_login
= BINARY '%{SQL-User-Name}' AND
N.nasname = '%{Nas-IP-Address}' AND
N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login =
BINARY '%{SQL-User-Name}' AND plano_id NOT IN
(8,9,793) AND
gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname =
'%{Nas-IP-Address}' ) ORDER BY
ID) UNION
ALL SELECT DISTINCT (R.id), R.username,
R.attribute, R.value, R.op FROM
mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist
M WHERE R.username = BINARY
'%{SQL-User-Name}' AND M.usuario_login
= BINARY '%{SQL-User-Name}' AND
M.grupocliente = 'ALL-POPS'
(0) sql: --> SELECT DISTINCT (R.id), R.username, R.attribute,
R.value, R.op FROM
mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist
M WHERE R.username = BINARY
'soniaregina' AND M.usuario_login =
BINARY 'soniaregina' AND N.nasname =
'172.17.6.2' AND N.gw_id = (SELECT
gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY
'soniaregina' AND plano_id NOT IN
(8,9,793) AND
gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname =
'172.17.6.2' ) ORDER BY
ID) UNION
ALL SELECT DISTINCT (R.id), R.username,
R.attribute, R.value, R.op FROM
mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist
M WHERE R.username = BINARY
'soniaregina' AND M.usuario_login =
BINARY 'soniaregina' AND M.grupocliente
= 'ALL-POPS'
(0) sql: Executing select query: SELECT DISTINCT (R.id), R.username,
R.attribute, R.value, R.op FROM
mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist
M WHERE R.username = BINARY
'soniaregina' AND M.usuario_login =
BINARY 'soniaregina' AND N.nasname =
'172.17.6.2' AND N.gw_id = (SELECT
gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY
'soniaregina' AND plano_id NOT IN
(8,9,793) AND
gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname =
'172.17.6.2' ) ORDER BY
ID) UNION
ALL SELECT DISTINCT (R.id), R.username,
R.attribute, R.value, R.op FROM
mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist
M WHERE R.username = BINARY
'soniaregina' AND M.usuario_login =
BINARY 'soniaregina' AND M.grupocliente
= 'ALL-POPS'
(0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username =
'%{SQL-User-Name}' ORDER BY priority
(0) sql: --> SELECT groupname FROM radusergroup WHERE username =
'soniaregina' ORDER BY priority
(0) sql: Executing select query: SELECT groupname FROM radusergroup
WHERE username = 'soniaregina' ORDER BY priority
(0) sql: User not found in any groups
rlm_sql (sql): Released connection (1)
Need 9 more connections to reach min connections (15)
rlm_sql (sql): Opening additional connection (6), 1 of 58 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'mpc_freeradius' on
mysql.mpc.com.br via TCP/IP, server version 5.5.55-0ubuntu0.14.04.1-log,
protocol version 10
(0) [sql] = notfound
(0) [expiration] = noop
(0) [logintime] = noop
(0) pap: WARNING: No "known good" password found for the user. Not
setting Auth-Type
(0) pap: WARNING: Authentication will fail unless a "known good"
password is available
(0) [pap] = noop
(0) } # authorize = ok
(0) Found Auth-Type = CHAP
(0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(0) Auth-Type CHAP {
(0) chap: ERROR: &control:Cleartext-Password is required for authentication
(0) [chap] = fail
(0) } # Auth-Type CHAP = fail
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
(0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(0) Post-Auth-Type REJECT {
(0) sql: EXPAND .query
(0) sql: --> .query
(0) sql: Using query template 'query'
rlm_sql (sql): Reserved connection (2)
(0) sql: EXPAND %{User-Name}
(0) sql: --> soniaregina
(0) sql: SQL-User-Name set to 'soniaregina'
(0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply,
authdate) VALUES ( '%{SQL-User-Name}',
'%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')
(0) sql: --> INSERT INTO radpostauth (username, pass, reply,
authdate) VALUES ( 'soniaregina',
'0x01cc08e5f2ad79880124b1d826606947b2', 'Access-Reject', '2017-08-02
09:11:51')
(0) sql: Executing query: INSERT INTO radpostauth (username, pass,
reply, authdate) VALUES ( 'soniaregina',
'0x01cc08e5f2ad79880124b1d826606947b2', 'Access-Reject', '2017-08-02
09:11:51')
(0) sql: SQL query returned: success
(0) sql: 1 record(s) updated
rlm_sql (sql): Released connection (2)
(0) [sql] = ok
(0) attr_filter.access_reject: EXPAND %{User-Name}
(0) attr_filter.access_reject: --> soniaregina
(0) attr_filter.access_reject: Matched entry DEFAULT at line 11
(0) [attr_filter.access_reject] = updated
(0) linelog: EXPAND messages.%{%{reply:Packet-Type}:-default}
(0) linelog: --> messages.Access-Reject
(0) linelog: No such entry ".messages.Access-Reject"
(0) [linelog] = noop
(0) } # Post-Auth-Type REJECT = updated
(0) Login incorrect (chap: &control:Cleartext-Password is required for
authentication): [soniaregina/<via Auth-Type = CHAP>] (from client
ce-popitpm-rb port 15736495 cli 84:C9:B2:A3:BB:67)
(0) Delaying response for 1.000000 seconds
More information about the Freeradius-Users
mailing list