FreeRadius not responding to a remote machine
Hi, I am trying to setup freeradius server (ver 1.0.5). I have installed the server and tested it successfully from the local machine using RADCLIENT utility. But I am not able to connect to the freeradius from a remote machine runs on Linux. I have configured the remote machine in the clients.conf file and ran the server on debug mode. But the server is not showing any trace of getting a connection from the server. I even tried to connnect to the server from a windows XP machine using a utility called NTRadPing. But it also behaves the same way. Here are the trace from my Server and the Client consoles. Can anyone please suggest a solution? [root@99Y69F3 root]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 9.22.81.109:32780 , id=244, length=44 User-Name = "root" User-Password = "ibmlinux1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "root", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns ok for request 0 modcall: group authenticate returns ok for request 0 Sending Access-Accept of id 244 to 9.22.81.109:32780 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 244 with timestamp 43c7c359 Nothing to do. Sleeping until we see a request. -------------------------------------------------------- Radclient:Response : Local Client ---------------------------------------------------------- [root@99Y69F3 root]# echo "User-Name=root, User-Password = ibmlinux1" | \radclient -x 9.22.81.109:1812 auth testing123 Sending Access-Request of id 244 to 9.22.81.109:1812 User-Name = "root" User-Password = "ibmlinux1" rad_recv: Access-Accept packet from host 9.22.81.109:1812, id=244, length=20 ---------------------------------------------------------------- Radclient:Response : Remote Client (Linux Machine) The machine is already configured in the clients.conf file with a secret key testing234 ---------------------------------------------------------------- [root@99Y69G3 root]# echo "User-Name=root, User-Password = ibmlinux1" | \radclient -x 9.22.81.109 auth testing234 Sending Access-Request of id 14 to 9.22.81.109:1812 User-Name = "root" User-Password = "ibmlinux1" Re-sending Access-Request of id 14 to 9.22.81.109:1812 User-Name = "root" User-Password = "\355\371*\025uD\007\221\2476C\330\356\2621\316" Re-sending Access-Request of id 14 to 9.22.81.109:1812 User-Name = "root" User-Password = "\355\371*\025uD\007\221\2476C\330\356\2621\316" Re-sending Access-Request of id 14 to 9.22.81.109:1812 User-Name = "root" User-Password = "\355\371*\025uD\007\221\2476C\330\356\2621\316"
But I am not able to connect to the freeradius from a remote machine runs on Linux. I have configured the remote machine in the clients.conf file and ran the server on debug mode. But the server is not showing any trace of getting a connection from the server. I even tried to connnect to the server from a windows XP machine using a utility called NTRadPing. But it also behaves the same way.
Firewall or routing.
Dusty, Thanks for the reply. My Servers and clints are under the corporate firewall. But there is no personal firewall installed on the machines. Can you please suggest how can I overcome this situation..? Regards, Shan On 1/13/06, Dusty Doris <freeradius@mail.doris.cc> wrote:
But I am not able to connect to the freeradius from a remote machine runs on Linux. I have configured the remote machine in the clients.conf file and ran the server on debug mode. But the server is not showing any trace of getting a connection from the server. I even tried to connnect to the server from a windows XP machine using a utility called NTRadPing. But it also behaves the same way.
Firewall or routing.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Dusty, Thanks a lot for the hint.. Radius port was not configured in the firewall.. Actually this is not mentioned in any of the documentation.. How can we miss such a basic step..? Now I have configured the port in the firewall and it worked fine.. -A INPUT -p udp -m udp --dport 1812 -j ACCEPT -A INPUT -p tcp -m tcp --dport 1812 -j ACCEPT Add these lines in /etc/sysconfig/iptables Then, restart the firewall: using service iptables restart Thanks again. Shan Thanks, Shan. On 1/13/06, Dusty Doris <freeradius@mail.doris.cc> wrote:
But I am not able to connect to the freeradius from a remote machine runs on Linux. I have configured the remote machine in the clients.conf file and ran the server on debug mode. But the server is not showing any trace of getting a connection from the server. I even tried to connnect to the server from a windows XP machine using a utility called NTRadPing. But it also behaves the same way.
Firewall or routing.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Hi,
firewall.. Actually this is not mentioned in any of the documentation.. How can we miss such a basic step..?
because everyone has completely different network setups? maybe the best thing to do is have a 'make sure that if you are running a firewall it has been configured to allow the traffic through (eg UDP to ports 1812, 1813 and 1814)' in the docs. its commons sense but should suffice. the users list is full of people who dont understand such network issues might affect FreeRADIUS :-( Alan
shan t <tshan77@gmail.com> wrote:
Thanks a lot for the hint.. Radius port was not configured in the firewall.. Actually this is not mentioned in any of the documentation.. How can we miss such a basic step..?
Because most machines don't firewall all ports. The FreeRADIUS documentation *cannot* include instructions for making the server work on all possible variations of all possible systems. At some point, the local administrator must be aware of what his system is doing and how it is configured. The FreeRADIUS documentation describes how to configure FreeRADIUS, not your local machine. Alan DeKok.
Hi All, I apologize for the comment I made.. I am really new to this area..:( On 1/13/06, Alan DeKok <aland@ox.org> wrote:
shan t <tshan77@gmail.com> wrote:
Thanks a lot for the hint.. Radius port was not configured in the firewall.. Actually this is not mentioned in any of the documentation.. How can we miss such a basic step..?
Because most machines don't firewall all ports.
The FreeRADIUS documentation *cannot* include instructions for making the server work on all possible variations of all possible systems. At some point, the local administrator must be aware of what his system is doing and how it is configured. The FreeRADIUS documentation describes how to configure FreeRADIUS, not your local machine.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Dusty,
Thanks a lot for the hint.. Radius port was not configured in the firewall.. Actually this is not mentioned in any of the documentation.. How can we miss such a basic step..?
Now I have configured the port in the firewall and it worked fine..
-A INPUT -p udp -m udp --dport 1812 -j ACCEPT -A INPUT -p tcp -m tcp --dport 1812 -j ACCEPT
Add these lines in /etc/sysconfig/iptables Then, restart the firewall: using
service iptables restart
Good to hear. :)
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Dusty Doris -
Shan T -
shan t