<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hi all.<div><br></div><div>have been enjoying radius for a while now. Had to make a severupgrade and move over to Fedora 8 for HW support. Still using 1.1.7 because it rocks. Well not quite any more, i moved over the configfiles i had on Debian and everything seems ok except for no users can login anymore via pptp on my firewall.</div><div><br></div><div>My config:</div><div><div><i>Linux ns.intern.fb.se 2.6.24.3-50.fc8 #1 SMP Thu Mar 20 14:47:10 EDT 2008 i686 i686 i386 GNU/Linux</i></div><div><i>[root@ns usersdepot]# radiusd -X</i></div><div><i>Starting - reading configuration files ...</i></div><div><i>reread_config: reading radiusd.conf</i></div><div><i>Config: including file: /etc/raddb/proxy.conf</i></div><div><i>Config: including file: /etc/raddb/clients.conf</i></div><div><i>Config: including file: /etc/raddb/snmp.conf</i></div><div><i>Config: including file: /etc/raddb/eap.conf</i></div><div><i>Config: including file: /etc/raddb/sql.conf</i></div><div><i> main: prefix = "/usr"</i></div><div><i> main: localstatedir = "/var"</i></div><div><i> main: logdir = "/var/log/radius"</i></div><div><i> main: libdir = "/usr/lib"</i></div><div><i> main: radacctdir = "/var/log/radius/radacct"</i></div><div><i> main: hostname_lookups = yes</i></div><div><i> main: snmp = no</i></div><div><i> main: max_request_time = 30</i></div><div><i> main: cleanup_delay = 5</i></div><div><i> main: max_requests = 1024</i></div><div><i> main: delete_blocked_requests = 0</i></div><div><i> main: port = 0</i></div><div><i> main: allow_core_dumps = no</i></div><div><i> main: log_stripped_names = no</i></div><div><i> main: log_file = "/var/log/radius/radius.log"</i></div><div><i> main: log_auth = yes</i></div><div><i> main: log_auth_badpass = yes</i></div><div><i> main: log_auth_goodpass = no</i></div><div><i> main: pidfile = "/var/run/radius/radiusd.pid"</i></div><div><i> main: user = "(null)"</i></div><div><i> main: group = "(null)"</i></div><div><i> main: usercollide = no</i></div><div><i> main: lower_user = "no"</i></div><div><i> main: lower_pass = "no"</i></div><div><i> main: nospace_user = "no"</i></div><div><i> main: nospace_pass = "no"</i></div><div><i> main: checkrad = "/usr/sbin/checkrad"</i></div><div><i> main: proxy_requests = yes</i></div><div><i> proxy: retry_delay = 5</i></div><div><i> proxy: retry_count = 3</i></div><div><i> proxy: synchronous = no</i></div><div><i> proxy: default_fallback = yes</i></div><div><i> proxy: dead_time = 120</i></div><div><i> proxy: post_proxy_authorize = no</i></div><div><i> proxy: wake_all_if_all_dead = no</i></div><div><i> security: max_attributes = 200</i></div><div><i> security: reject_delay = 1</i></div><div><i> security: status_server = no</i></div><div><i> main: debug_level = 0</i></div><div><i>read_config_files: reading dictionary</i></div><div><i>read_config_files: reading naslist</i></div><div><i>Using deprecated naslist file. Support for this will go away soon.</i></div><div><i>read_config_files: reading clients</i></div><div><i>read_config_files: reading realms</i></div><div><i>radiusd: entering modules setup</i></div><div><i>Module: Library search path is /usr/lib</i></div><div><i>Module: Loaded exec </i></div><div><i> exec: wait = yes</i></div><div><i> exec: program = "(null)"</i></div><div><i> exec: input_pairs = "request"</i></div><div><i> exec: output_pairs = "(null)"</i></div><div><i> exec: packet_type = "(null)"</i></div><div><i>rlm_exec: Wait=yes but no output defined. Did you mean output=none?</i></div><div><i>Module: Instantiated exec (exec) </i></div><div><i>Module: Loaded expr </i></div><div><i>Module: Instantiated expr (expr) </i></div><div><i>Module: Loaded PAP </i></div><div><i> pap: encryption_scheme = "crypt"</i></div><div><i> pap: auto_header = yes</i></div><div><i>Module: Instantiated pap (pap) </i></div><div><i>Module: Loaded CHAP </i></div><div><i>Module: Instantiated chap (chap) </i></div><div><i>Module: Loaded MS-CHAP </i></div><div><i> mschap: use_mppe = yes</i></div><div><i> mschap: require_encryption = no</i></div><div><i> mschap: require_strong = no</i></div><div><i> mschap: with_ntdomain_hack = no</i></div><div><i> mschap: passwd = "(null)"</i></div><div><i> mschap: ntlm_auth = "(null)"</i></div><div><i>Module: Instantiated mschap (mschap) </i></div><div><i>Module: Loaded System </i></div><div><i> unix: cache = no</i></div><div><i> unix: passwd = "(null)"</i></div><div><i> unix: shadow = "(null)"</i></div><div><i> unix: group = "(null)"</i></div><div><i> unix: radwtmp = "/var/log/radius/radwtmp"</i></div><div><i> unix: usegroup = no</i></div><div><i> unix: cache_reload = 600</i></div><div><i>Module: Instantiated unix (unix) </i></div><div><i>Module: Loaded eap </i></div><div><i> eap: default_eap_type = "md5"</i></div><div><i> eap: timer_expire = 60</i></div><div><i> eap: ignore_unknown_eap_types = no</i></div><div><i> eap: cisco_accounting_username_bug = no</i></div><div><i>rlm_eap: Loaded and initialized type md5</i></div><div><i>rlm_eap: Loaded and initialized type leap</i></div><div><i> gtc: challenge = "Password: "</i></div><div><i> gtc: auth_type = "PAP"</i></div><div><i>rlm_eap: Loaded and initialized type gtc</i></div><div><i> mschapv2: with_ntdomain_hack = no</i></div><div><i>rlm_eap: Loaded and initialized type mschapv2</i></div><div><i>Module: Instantiated eap (eap) </i></div><div><i>Module: Loaded preprocess </i></div><div><i> preprocess: huntgroups = "/etc/raddb/huntgroups"</i></div><div><i> preprocess: hints = "/etc/raddb/hints"</i></div><div><i> preprocess: with_ascend_hack = no</i></div><div><i> preprocess: ascend_channels_per_line = 23</i></div><div><i> preprocess: with_ntdomain_hack = no</i></div><div><i> preprocess: with_specialix_jetstream_hack = no</i></div><div><i> preprocess: with_cisco_vsa_hack = no</i></div><div><i> preprocess: with_alvarion_vsa_hack = no</i></div><div><i>Module: Instantiated preprocess (preprocess) </i></div><div><i>Module: Loaded realm </i></div><div><i> realm: format = "suffix"</i></div><div><i> realm: delimiter = "@"</i></div><div><i> realm: ignore_default = no</i></div><div><i> realm: ignore_null = no</i></div><div><i>Module: Instantiated realm (suffix) </i></div><div><i>Module: Loaded files </i></div><div><i> files: usersfile = "/etc/raddb/users"</i></div><div><i> files: acctusersfile = "/etc/raddb/acct_users"</i></div><div><i> files: preproxy_usersfile = "/etc/raddb/preproxy_users"</i></div><div><i> files: compat = "no"</i></div><div><i>Module: Instantiated files (files) </i></div><div><i>Module: Loaded Acct-Unique-Session-Id </i></div><div><i> acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"</i></div><div><i>Module: Instantiated acct_unique (acct_unique) </i></div><div><i>Module: Loaded detail </i></div><div><i> detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"</i></div><div><i> detail: detailperm = 384</i></div><div><i> detail: dirperm = 493</i></div><div><i> detail: locking = no</i></div><div><i>Module: Instantiated detail (detail) </i></div><div><i>Module: Loaded radutmp </i></div><div><i> radutmp: filename = "/var/log/radius/radutmp"</i></div><div><i> radutmp: username = "%{User-Name}"</i></div><div><i> radutmp: case_sensitive = yes</i></div><div><i> radutmp: check_with_nas = yes</i></div><div><i> radutmp: perm = 384</i></div><div><i> radutmp: callerid = yes</i></div><div><i>Module: Instantiated radutmp (radutmp) </i></div><div><i>Listening on authentication *:1812</i></div><div><i>Listening on accounting *:1813</i></div><div><i>Ready to process requests.</i></div><div><br></div><div>When a user login:</div><div><div><i>rad_recv: Access-Request packet from host 10.0.5.1:60461, id=3, length=181</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>NAS-Identifier = "halon"</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>NAS-IP-Address = 10.0.5.1</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>Message-Authenticator = 0x18e8c7acd5db57751eb497c6d6c59503</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>NAS-Port = 0</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>NAS-Port-Type = Virtual</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>Service-Type = Framed-User</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>Framed-Protocol = PPP</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>Calling-Station-Id = "212.247.38.166"</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>User-Name = "giobbi"</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>MS-CHAP-Challenge = 0xbb1e6823d2ae12e363e056523f30a6de</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>MS-CHAP2-Response = 0x01000357ec5a5b0eb534ea8682a730849e89000000000000000034ff990a30a4a24681b50b31d7da17a3d2634e2e55ad5e17</i></div><div><i> Processing the authorize section of radiusd.conf</i></div><div><i>modcall: entering group authorize for request 0</i></div><div><i> modcall[authorize]: module "preprocess" returns ok for request 0</i></div><div><i> modcall[authorize]: module "chap" returns noop for request 0</i></div><div><i> rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap'</i></div><div><i> modcall[authorize]: module "mschap" returns ok for request 0</i></div><div><i> rlm_realm: No '@' in User-Name = "giobbi", looking up realm NULL</i></div><div><i> rlm_realm: No such realm "NULL"</i></div><div><i> modcall[authorize]: module "suffix" returns noop for request 0</i></div><div><i> rlm_eap: No EAP-Message, not doing EAP</i></div><div><i> modcall[authorize]: module "eap" returns noop for request 0</i></div><div><i> users: Matched entry DEFAULT at line 185</i></div><div><i> users: Matched entry giobbi at line 4</i></div><div><i> modcall[authorize]: module "files" returns ok for request 0</i></div><div><i>rlm_pap: Found existing Auth-Type, not changing it.</i></div><div><i> modcall[authorize]: module "pap" returns noop for request 0</i></div><div><i>modcall: leaving group authorize (returns ok) for request 0</i></div><div><i> rad_check_password: Found Auth-Type MS-CHAP</i></div><div><i>auth: type "MS-CHAP"</i></div><div><i> Processing the authenticate section of radiusd.conf</i></div><div><i>modcall: entering group MS-CHAP for request 0</i></div><div><i> rlm_mschap: Told to do MS-CHAPv2 for giobbi with NT-Password</i></div><div><i>rlm_mschap: adding MS-CHAPv2 MPPE keys</i></div><div><i> modcall[authenticate]: module "mschap" returns ok for request 0</i></div><div><i>modcall: leaving group MS-CHAP (returns ok) for request 0</i></div><div><i>Login OK: [giobbi] (from client fw-halon port 0 cli 212.247.38.166)</i></div><div><i>Sending Access-Accept of id 3 to 10.0.5.1 port 60461</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>Framed-Protocol = PPP</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>Framed-Compression = Van-Jacobson-TCP-IP</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>Service-Type = Framed-User</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>Framed-Route = "10.0.4.0/24 10.0.5.245 10.0.5.0/24 10.0.5.1 10.0.8.0/24 10.0.5.245 10.0.9/24 10.0.5.245"</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>MS-CHAP2-Success = 0x01533d34444432314431443741453246333335453632323046463633304643464435463835353236393736</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>MS-MPPE-Recv-Key = 0x9f2fb3fc6a24b8a5a5251de891f8ece8</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>MS-MPPE-Send-Key = 0xd488a4ec77025f4c8c3e4defc4fbdf70</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>MS-MPPE-Encryption-Policy = 0x00000001</i></div><div><span class="Apple-tab-span" style="white-space:pre"><i> </i></span><i>MS-MPPE-Encryption-Types = 0x00000006</i></div><div><i>Finished request 0</i></div><div><i>Going to the next request</i></div><div><i>--- Walking the entire request list ---</i></div><div><i>Waking up in 6 seconds...</i></div><div><i>rad_recv: Access-Request packet from host 10.0.5.1:60461, id=3, length=181</i></div><div><i>Sending duplicate reply to client fw-halon:60461 - ID: 3</i></div><div><i>Re-sending Access-Accept of id 3 to 10.0.5.1 port 60461</i></div><div><i>Waking up in 6 seconds...</i></div><div><i>rad_recv: Access-Request packet from host 10.0.5.1:60461, id=3, length=181</i></div><div><i>Sending duplicate reply to client fw-halon:60461 - ID: 3</i></div><div><i>Re-sending Access-Accept of id 3 to 10.0.5.1 port 60461</i></div><div><i>Waking up in 6 seconds...</i></div><div><br></div><div>Firewall log:</div><div><div><i>halon(Firewall_GOT)# system logs pptp</i></div><div><i>PPTP: Incoming control connection from 212.247.38.166 55553 to 212.247.38.166 1723</i></div><div><i>pptp0: attached to connection with 212.247.38.166 55553</i></div><div><i>[pptp0] Accepting PPTP connection</i></div><div><i>[pptp0] opening link "pptp0"...</i></div><div><i>[pptp0] link: OPEN event</i></div><div><i>[pptp0] LCP: Open event</i></div><div><i>[pptp0] LCP: state change Initial --> Starting</i></div><div><i>[pptp0] LCP: LayerStart</i></div><div><i>[pptp0] PPTP: attaching to peer's outgoing call</i></div><div><i>[pptp0] link: UP event</i></div><div><i>[pptp0] link: origination is remote</i></div><div><i>[pptp0] LCP: Up event</i></div><div><i>[pptp0] LCP: state change Starting --> Req-Sent</i></div><div><i>[pptp0] LCP: SendConfigReq #31</i></div><div><i> ACFCOMP</i></div><div><i> PROTOCOMP</i></div><div><i> MRU 1460</i></div><div><i> MAGICNUM a3e02c2f</i></div><div><i> AUTHPROTO CHAP MSOFTv2</i></div><div><i>[pptp0] LCP: rec'd Configure Request #1 (Req-Sent)</i></div><div><i> ACCMAP 0x00000000</i></div><div><i> MAGICNUM c5887687</i></div><div><i> PROTOCOMP</i></div><div><i> ACFCOMP</i></div><div><i>[pptp0] LCP: SendConfigAck #1</i></div><div><i> ACCMAP 0x00000000</i></div><div><i> MAGICNUM c5887687</i></div><div><i> PROTOCOMP</i></div><div><i> ACFCOMP</i></div><div><i>[pptp0] LCP: state change Req-Sent --> Ack-Sent</i></div><div><i>[pptp0] LCP: SendConfigReq #32</i></div><div><i> ACFCOMP</i></div><div><i> PROTOCOMP</i></div><div><i> MRU 1460</i></div><div><i> MAGICNUM a3e02c2f</i></div><div><i> AUTHPROTO CHAP MSOFTv2</i></div><div><i>[pptp0] LCP: rec'd Configure Ack #32 (Ack-Sent)</i></div><div><i> ACFCOMP</i></div><div><i> PROTOCOMP</i></div><div><i> MRU 1460</i></div><div><i> MAGICNUM a3e02c2f</i></div><div><i> AUTHPROTO CHAP MSOFTv2</i></div><div><i>[pptp0] LCP: state change Ack-Sent --> Opened</i></div><div><i>[pptp0] LCP: auth: peer wants nothing, I want CHAP</i></div><div><i>[pptp0] CHAP: sending CHALLENGE len:17</i></div><div><i>[pptp0] LCP: LayerUp</i></div><div><i>[pptp0] CHAP: rec'd RESPONSE #1</i></div><div><i> Name: "giobbi"</i></div><div><i>[pptp0] AUTH: Auth-Thread started</i></div><div><i>[pptp0] AUTH: Trying RADIUS</i></div><div><i>[pptp0] RADIUS: RadiusAuthenticate for: giobbi</i></div><div><i><b>[pptp0] RADIUS: rad_send_request failed: No valid RADIUS responses received</b></i></div><div><i>[pptp0] AUTH: RADIUS returned undefined</i></div><div><i>[pptp0] AUTH: Trying INTERNAL</i></div><div><i>AUTH: User "giobbi" not found in secret file</i></div><div><i>[pptp0] AUTH: INTERNAL returned failed</i></div><div><i>[pptp0] AUTH: ran out of backends</i></div><div><i>[pptp0] AUTH: Auth-Thread finished normally</i></div><div><i>[pptp0] CHAP: ChapInputFinish: status failed</i></div><div><i> Reply message: E=691 R=0 M=Login incorrect</i></div><div><i>[pptp0] CHAP: sending FAILURE len:27</i></div><div><i>[pptp0] LCP: authorization failed</i></div><div><i>[pptp0] LCP: parameter negotiation failed</i></div><div><i>[pptp0] LCP: state change Opened --> Stopping</i></div><div><i>[pptp0] AUTH: Cleanup</i></div><div><i>[pptp0] LCP: SendTerminateReq #33</i></div><div><i>[pptp0] LCP: LayerDown</i></div><div><i>[pptp0] LCP: rec'd Terminate Request #2 (Stopping)</i></div><div><i>[pptp0] LCP: SendTerminateAck #34</i></div><div><i>[pptp0] LCP: rec'd Terminate Ack #33 (Stopping)</i></div><div><i>[pptp0] LCP: state change Stopping --> Stopped</i></div><div><i>[pptp0] LCP: LayerFinish</i></div><div><i>pptp0-0: clearing call</i></div><div><i>pptp0-0: killing channel</i></div><div><i>[pptp0] PPTP call terminated</i></div><div><i>[pptp0] link: DOWN event</i></div><div><i>[pptp0] LCP: Close event</i></div><div><i>[pptp0] LCP: state change Stopped --> Closed</i></div><div><i>[pptp0] LCP: Down event</i></div><div><i>[pptp0] LCP: state change Closed --> Initial</i></div><div><i>pptp0: closing connection with 212.247.38.166 55553</i></div><div><i>pptp0: ctrl connection closed by peer</i></div><div><i>pptp0: killing connection with 212.247.38.166 55553</i></div><div><br></div><div>So here's the problem, the firewall doesn't like the response it gets, isn't valid for some reason. I'm using the exact same configs as in the working Debian version (same radius, 1.1.7), so in theory these should work just as fine in my Fedora setup right?</div><div><br></div><div>Any clues or tip is greatly appreciated.</div><div><br></div><div>thx</div><div><br></div><div>p</div></div></div></div></body></html>