Hi<br><br>Using freeradius2.1.3 for seperate Auth and Acct servers in DSL/PPPoE n/w. Using CHAP auth only and lookup via dbm file with users.txt fallback.<br>Can successfully authenticate/authorise against specific user profiles in users dbm/txt but problems when trying to match realms.<br>
Have users dbm/txt file with list of DEFAULT realm=xxx followed by users profiles. realm matches simply returns L2TP tunnel profiles<br>for these realms (no fallthru). No realm match (null or other domains not in proxy.conf) will do lookup and return specific user profiles (i.e matching userxx Cleartext-Password := "xxxx").<br>
Debug shows the rlm_realms module logging error: [suffix] Looking up realm "dslip" for User-Name = "jean@dslip" [suffix] No such realm "dslip"<br><br>We are not proxying to remote servers but do local auth on matching realms. Am I missing some step/module which imports the proxy.conf<br>
file - or the order of modules in authorise{} This issue occurs regardless dbm or files based lookup and in realms module.If I remove proxy.conf<br>radius does not complain. <br><br>Ive looked in maillist for similiar problems. Some reference to include suffix in preacct module but ours is Auth server only. I have spent some time<br>
testing and read man pages, searching related etc before resorting to first my first query to this maillist.<br><br>Any help appreciated<br><br>SeamusB<br><br>Setup<br>----------<br><br>[1] Test users file with single record - a default realm :<br>
DEFAULT Realm == "dslip", Auth-Type := Accept<br>
Tunnel-Type:1 = L2TP,<br> Tunnel-Medium-Type:1 = IP,<br> Tunnel-Server-Endpoint:1 = "xxx.xxx.xxx.xxx",<br> Tunnel-Client-Auth-Id:1 = "yyy",<br> Tunnel-Password:1 = "yyy",<br>
Tunnel-Assignment-Id:1 = "dslip",<br> Tunnel_Algorithm = 2,<br> Tunnel_Domain = 1<br><br>Added to dbm file:<br>/usr/local/freeradius/bin/rlm_dbm_cat -f /usr/local/freeradius/etc/raddb/users<br>
DEFAULT Realm == "dslip", Auth-Type := Accept<br> Tunnel-Type:1 = L2TP, Tunnel-Medium-Type:1 = IPv4, Tunnel-Server-Endpoint:1 = "xxx.xxx.xxx.145", Tunnel-Client-Auth-Id:1 = "dslip", Tunnel-Password:1 = "xxxxxx", Tunnel-Assignment-Id:1 = "dslip", Tunnel_Algorithm = 2, Tunnel_Domain = 1<br>
<br>freeradiusdsldev00#<br><br><br>[2] proxy.conf has realm added as below and permissions 644 for radius/radadmin<br>realm dslip {<br> type = radius<br> authhost = LOCAL<br> accthost = LOCAL<br>
nostrip<br>}<br><br>[3] radiusd.conf includes reference to realm module and includes in authorise {} section. Also not including policy.conf which denies realms by default.<br><br>modules { <br>..<br>realm suffix {<br>
format = suffix<br> delimiter = "@"<br> ignore_default = no<br> ignore_null = no<br>}<br>}<br><br>authorize {<br> preprocess<br> suffix<br> chap<br> group {<br> dbm {<br>
ok = return<br> reject = return<br> notfound = return<br> fail = 1<br> }<br> files {<br> ok = return<br> reject = return<br> notfound = return<br>
fail = return<br> }<br> }<br>}<br><br>[4] Radiusd -X output<br>client freeradiusdsldev00 {<br> require_message_authenticator = no<br> secret = "testing123"<br> shortname = "freeradiusdsldev00"<br>
}<br>radiusd: #### Loading Realms and Home Servers ####<br>radiusd: #### Instantiating modules ####<br>radiusd: #### Loading Virtual Servers ####<br> modules {<br> Module: Checking authenticate {...} for more modules to load<br>
Module: Linked to module rlm_chap<br> Module: Instantiating chap<br> Module: Checking authorize {...} for more modules to load<br> Module: Linked to module rlm_preprocess<br> Module: Instantiating preprocess<br> preprocess {<br>
huntgroups = "/usr/local/freeradius/etc/raddb/huntgroups"<br> hints = "/usr/local/freeradius/etc/raddb/hints"<br> with_ascend_hack = no<br> ascend_channels_per_line = 23<br>
with_ntdomain_hack = no<br> with_specialix_jetstream_hack = no<br> with_cisco_vsa_hack = no<br> with_alvarion_vsa_hack = no<br> }<br> Module: Linked to module rlm_realm<br> Module: Instantiating suffix<br>
realm suffix {<br> format = "suffix"<br> delimiter = "@"<br> ignore_default = no<br> ignore_null = no<br> }<br> Module: Linked to module rlm_dbm<br> Module: Instantiating dbm<br>
dbm {<br> usersfile = "/usr/local/freeradius/etc/raddb/users"<br> byclid_length = 4<br> }<br> Module: Linked to module rlm_files<br> Module: Instantiating files<br> files {<br> usersfile = "/usr/local/freeradius/etc/raddb/users.txt"<br>
compat = "no"<br> byclid_length = 4<br> }<br> }<br>radiusd: #### Opening IP addresses and Ports ####<br> bind_address = *<br>WARNING: The directive 'bind_adress' is deprecated, and will be removed in future versions of FreeRADIUS. Please edit the configuration files to use<br>
the directive 'listen'.<br>Listening on authentication address * port 1812<br>Listening on accounting address * port 1813<br>Listening on proxy address * port 1814<br>Ready to process requests.<br><br><br><br><br>
[5] Test when using radclient with test username jean@dslip which should match the realm in proxy.conf and default profile in users.db. Server debug log:<br><br>rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx port 35210, id=168, length=201<br>
User-Name = "jean@dslip"<br> Acct-Session-Id = "5511534626"<br> CHAP-Password = 0xa812b2813543dd45b1434328ea423c83e4<br> Service-Type = Framed-User<br> Framed-Protocol = PPP<br>
+- entering group authorize {...}<br>++[preprocess] returns ok<br>[suffix] Looking up realm "dslip" for User-Name = "jean@dslip"<br>[suffix] No such realm "dslip"<br>++[suffix] returns noop<br>
[chap] Setting 'Auth-Type := CHAP'<br>++[chap] returns ok<br>++- entering group {...}<br>rlm_dbm: try open database file: /usr/local/freeradius/etc/raddb/users<br>rlm_dbm: Call parse_user:<br>sm_parse_user.c: check for loops<br>
Add jean@dslip to user list<br>rlm_dbm: User <jean@dslip> not found in database<br>Remove jean@dslip from user list<br>sm_parse_user.c: check for loops<br>Add DEFAULT to user list<br>sm_parse_user: start parsing: user: DEFAULT<br>
parse buffer: <<Realm == "dslip", Auth-Type := Accept>><br>rlm_dbm: recod parsed<br>process pattern<br>rlm_dbm: patern not matched, reply skiped<br>Remove DEFAULT from user list<br>+++[dbm] returns notfound<br>
++- group returns notfound<br>Found Auth-Type = CHAP<br>+- entering group CHAP {...}<br>[chap] login attempt by "jean@dslip" with CHAP password<br>[chap] Cleartext-Password is required for authentication<br>++[chap] returns invalid<br>
Failed to authenticate the user.<br>Login incorrect (rlm_chap: Clear text password not available): [jean@dslip/<CHAP-Password>] (from client freeradiusdsldev00 port 3525263410 cli :xxxxxx)<br>Sending Access-Reject of id 168 to xxx.xxx.xxx.xxx port 35210<br>
Finished request 0.<br>Going to the next request<br>Waking up in 4.9 seconds.<br>Cleaning up request 0 ID 168 with timestamp +5<br>Ready to process requests.<br><br><br><br>