Brian Candler wrote:

...

Your thinking is wrong.

However he is asserting a behaviour he has seen, which would be consistent with freeradius ignoring packets with bad secrets.

The server doesn't work like that. I said so:

...

If the RADIUS server receives a packet, it says so in debugging mode.

If tcpdump shows the packet and FreeRADIUS doesn't see it, then you

What is so hard to understand about that? This is the 13-year-old question. Why the HELL are people asking questions on the list when they immediately ignore the answer?

This means that something is wrong. It may mean that he is not in fact running the server in debugging mode;

Then he should have follow the instructions in the FAQ, "man" page, web page, and daily on the -users list. It's not hard.

or it may mean he is running some ancient freeradius,

It ALWAYS printed out packets received in debugging mode.

or one which has been hacked by the vendor to behave differently to standard code.

Then he should ask his vendor how it works. It's not *my* problem when people butcher FreeRADIUS.

Or it may not even be freeradius at all, but something completely different.

Then he's an idiot for asking questions on this list. And ALL of those reasons are post-facto excuses. The ONLY relevant item is that he asked a question, and ignored the answer.

Alan is of course right, freeradius doesn't behave in the way you describe; but I also believe that you are not lying when you say you see this behaviour, so we need additional information if you want us to help you pin down your problem.

I don't care what he *thinks* he's doing. What he *is* doing is not following instructions: 1) run the server in debug mode 2) check the firewall to be sure it isn't blocking RADIUS packets He had a problem and posted a question. Fine. But he MUST follow the existing documentation. He MUST follow instructions. I DO NOT accept excuses from him, or from anyone else. If people aren't going to follow instructions, they have no business posting to the list. It's ignorant, rude, and will result in them getting unsubscribed and banned. My patience for this kind of idiocy is at an end. Alan DeKok.

Brian Candler wrote:

A little politeness doesn't cost anything, and I am trying to be helpful.

That's uncalled for. My responses were polite, and helpful. My less than polite response was to *your* defense of inexcusable behavior.

I was picking up on something he said, which I believe amounted to the following:

- radtest to localhost with correct secret shows debug output - radtest to localhost with incorrect secret shows nothing

... in the radius.log. He *didn't* say he tried it in debugging mode.

That clearly *isn't* an IP firewall problem, and until this problem is understood, we cannot trust any debug output that the OP reports is/is not there.

I can believe (a) that the OP screwed up his description of what he did, or (b) that FreeRADIUS magically doesn't log packets it receives. (b) isn't impossible, but is overwhelmingly less likely.

It is therefore in the OP's interest, and ours if we are going to help with the original problem, to sort this out first.

My suggestions have stayed the same: a) run the server in debugging mode b) check the firewall. The server NOT receiving packets AND tcpdump receiving them means that a firewall is blocking them. It's happened many times before. The problem description is the same. The solution is the same. Run the server in debugging mode for packets received from the external NAS. Don't look at "radius.log" AS HE SAID HE DID. It's not rocket science. There is no excuse for it, and there is *no* reason for you to defend inexcusable behavior.

And personally I am not happy to see people being publicly branded as "idiots" after only one or two postings. If you don't have the patience, then please consider allowing the rest of the community to answer.

I answered politely. Twice. I only got testy when *you* stepped in to misconstrue what the OP said, and to defend his failure to follow decade-old documentation. So... get off your high horse. It's almost as annoying as people who ask questions and then ignore the answers. Alan DeKok.

On 24/09/12 11:45, Brian Candler wrote:

I was picking up on something he said, which I believe amounted to the following:

- radtest to localhost with correct secret shows debug output - radtest to localhost with incorrect secret shows nothing

My reading is subtly different. In his first email, he said: radtest to localhost - ok request from remote nas - no debug output ...but in a later email he says: radclient on localhost - fine request from remote nas - tcpdump shows packet, but "no info in the log" He then says: """ I've tried to send auth request from localhost againg, but with wrong key. As a result -- no log-info in radius.log """ It's not clear to me that he's consistently testing with "radiusd -X", or if he's looking at the "log { }" stanza output, which is not the right thing to do.