Freeradius-Announce

Download

freeradius-announce@lists.freeradius.org

3 participants
32 discussions

RE:Authenticating between a Cisco 3640 and radius server
by Nat 12 Sep '05

12 Sep '05

HI Amos, Your radius is sending out access-accept packets to the NAS-192.168.82.50:1645. Would it be possible to get all relevant 'aaa' config lines from your CISCO router. regards NAT Authenticating between a Cisco 3640 and radius server Amos Cottrill Tue, 06 Sep 2005 04:30:48 -0700 I setup free radius on a linux box and am trying to authenticate a user from a cisco 3640 router. Below is the output I am receiving when using radiusd -xxyz -l stdout. The router will not let me login, so something isn't working properly. Any suggestions??? I set the radius server up to use port 1645, so it resembles the cisco settings. Thread 1 waiting to be assigned a request Thread 2 waiting to be assigned a request Thread 3 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.82.50:1645, id=3, length=74 --- Walking the entire request list --- Waking up in 31 seconds... Threads: total/active/spare threads = 5/0/5 Thread 5 got semaphore Thread 5 handling request 0, (1 handled so far) NAS-IP-Address = 192.168.82.50 NAS-Port = 131 NAS-Port-Type = Virtual User-Name = "cisco" Calling-Station-Id = "10.0.1.19" User-Password = "harley" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cisco", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched cisco at 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [cisco] (from client spare_3640 port 131 cli 10.0.1.19) Sending Access-Accept of id 3 to 192.168.82.50:1645 Service-Type = Login-User Login-Service = Telnet Finished request 0 Going to the next request Thread 5 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.82.50:1645, id=3, length=74 Sending duplicate reply to client spare_3640:1645 - ID: 3 Re-sending Access-Accept of id 3 to 192.168.82.50:1645 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 3 with timestamp 43171770 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.82.50:1645, id=3, length=74 --- Walking the entire request list --- Waking up in 31 seconds... Thread 4 got semaphore Thread 4 handling request 1, (1 handled so far) NAS-IP-Address = 192.168.82.50 NAS-Port = 131 NAS-Port-Type = Virtual User-Name = "cisco" Calling-Station-Id = "10.0.1.19" User-Password = "harley" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "cisco", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched cisco at 152 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [cisco] (from client spare_3640 port 131 cli 10.0.1.19) Sending Access-Accept of id 3 to 192.168.82.50:1645 Service-Type = Login-User Login-Service = Telnet Finished request 1 Going to the next request Thread 4 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.82.50:1645, id=3, length=74 Sending duplicate reply to client spare_3640:1645 - ID: 3 Re-sending Access-Accept of id 3 to 192.168.82.50:1645 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 3 with timestamp 4317177a Nothing to do. Sleeping until we see a request. -- Amos Cottrill Assistant Network Coordinator - SEOVEC [EMAIL PROTECTED] Ph:(740) 594-7663 ext 119 Fax:(740) 592-6251

1 0

Re:[2] Problems when using Cisco-AVPairs[*]
by Nat 12 Sep '05

12 Sep '05

Thanks Nicloas, for your reply... > >Admin wrote: > >> I need some help with Cisco AVPAirs, I am using freeradius + postgresql. >> >> When I have the following entries in my radreply table - >> >> database=# SELECT * from radreply where username='test' order by id; >> id | username | attribute | op | value >> ----+----------+--------------+----+------------------------------------ >> 72 | test | Cisco-AVPair | = | ip:inacl#1=deny tcp any any eq 25 >> 73 | test | Cisco-AVPair | += | ip:inacl#1=permit ip any any >> 74 | test | Cisco-AVPair | += | ip:outacl#2=deny tcp any any eq 25 >> 75 | test | Cisco-AVPair | += | ip:outacl#2=permit ip any any >> >> the access list works. > >Indeed. That's how it's documented in doc/rlm_sql. > >> However, when I modify the entries >> >> database=# SELECT * from radreply where username='test' order by id; >> id | username | attribute | op | value >> ----+----------+-----------------+----+------------------------------------ >> 76 | test | Cisco-AVPair[0] | = | ip:inacl#1=deny tcp any any eq 25 >> 77 | test | Cisco-AVPair[1] | = | ip:inacl#1=permit ip any any >> 78 | test | Cisco-AVPair[2] | = | ip:outacl#2=deny tcp any any eq 25 >> 79 | test | Cisco-AVPair[3] | = | ip:outacl#2=permit ip any any >> >> none of the Cisco-AVPairs are passed to the Cisco NAS ( I can see that >> in the /var/log/radacct/{NAS-IP}/reply-detail file ). > >This syntax is not supported in a SQL database. Please let us know if >the documentation is inaccurate. Would you/someone know if/when this feature will be enabled for SQL. > >-- >Nicolas Baradakis

1 0