- Freeradius-Users - lists.freeradius.org

RE: Freeradius authentication question
by Kai Geek 20 Jan '06

20 Jan '06

hmm ok a lot thank you.. regards :) > ----- Original Message ----- > From: "Le Gal Philippe" <Philippe.LeGal(a)emea.eu.int> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: RE: Freeradius authentication question > Date: Fri, 20 Jan 2006 12:08:59 -0000 > > > > The Pam radius configuration file on the client machine should be > located here: /etc/raddb/server (cf pam radius INSTALL) > > I can't see why the radius server can not decrypt the password when > I know my shared secret is absolutely identical on the client and > on the radius server. > > Anyone ? > > Philippe > > -----Original Message----- > From: > freeradius-users-bounces+philippe.legal=emea.eu.int(a)lists.freeradius.org > [mailto:freeradius-users-bounces+philippe.legal=emea.eu.int@lists.freera > dius.org]On Behalf Of Kai Geek > Sent: 20 January 2006 12:00 > To: FreeRadius users mailing list > Subject: Re: Freeradius authentication question > > > Hello, > [root@us067 root]# vi /etc/raddb/server ?? > > the config file will this be ? > correct directory; > > #vi /etc/raddb/clients.conf > > oke. > > > ----- Original Message ----- > > From: "Le Gal Philippe" <Philippe.LeGal(a)emea.eu.int> > > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > > Subject: Freeradius authentication question Date: Fri, 20 Jan > > 2006 11:34:51 -0000 > > > > > > > > Hi everybody, > > > > I'm trying to authenticate users login in a machine using ssh. I > > have configured ssh & PAM on that server to autenticate against > > the radius server (Redhat Application Server 2.1). > > > > Please find below the debug of the radius server as well as my conf files. > > > > The Free radius server says : > > > > Login incorrect: [test/\010\n\INCORRECT] (from client > > us067.eudra.org port 1500 cli 192.168.xx.xx) > > WARNING: Unprintable characters in the password. ? > > Double-check the shared secret on the server and the NAS! > > > > So did I . I checked the secrets on the server and they are *IDENTICAL*... > > > > I used the NTRadPing utility with exactly the same parameters and > > it works absolutely fine ! > > > > Thank you for your help ! > > > > my /etc/raddb/server file : (on the client machine) : > > > > [root@us067 root]# vi /etc/raddb/server > > # pam_radius_auth configuration file. Copy to: /etc/raddb/server > > # > > # For proper security, this file SHOULD have permissions 0600, > > # that is readable by root, and NO ONE else. If anyone other than > > # root can read this file, then they can spoof responses from the server! > > # > > # There are 3 fields per line in this file. There may be multiple > > # lines. Blank lines or lines beginning with '#' are treated as > > # comments, and are ignored. The fields are: > > # > > # server[:port] secret [timeout] > > # > > # the port name or number is optional. The default port name is > > # "radius", and is looked up from /etc/services The timeout field is > > # optional. The default timeout is 3 seconds. > > # > > # If multiple RADIUS server lines exist, they are tried in order. The > > # first server to return success or failure causes the module to return > > # success or failure. Only if a server fails to response is it skipped, > > # and the next server in turn is used. > > # > > # The timeout field controls how many seconds the module waits before > > # deciding that the server has failed to respond. > > # > > # server[:port] shared_secret timeout (s) > > loginhost.eudra.org philippe123456 1 > > # > > # having localhost in your radius configuration is a Good Thing. > > # > > # See the INSTALL file for pam.conf hints. > > > > > > clients.conf : > > > > client us067.eudra.org { > > secret = philippe123456 > > shortname = us067.eudra.org > > } > > > > > > [root@us072 raddb]# radiusd -X > > Starting - reading configuration files ... > > reread_config: reading radiusd.conf > > Config: including file: /usr/local/etc/raddb/proxy.conf > > Config: including file: /usr/local/etc/raddb/clients.conf > > Config: including file: /usr/local/etc/raddb/snmp.conf > > Config: including file: /usr/local/etc/raddb/eap.conf > > Config: including file: /usr/local/etc/raddb/sql.conf > > main: prefix = "/usr/local" > > main: localstatedir = "/usr/local/var" > > main: logdir = "/usr/local/var/log/radius" > > main: libdir = "/usr/local/lib" > > main: radacctdir = "/usr/local/var/log/radius/radacct" > > main: hostname_lookups = no > > main: max_request_time = 30 > > main: cleanup_delay = 5 > > main: max_requests = 1024 > > main: delete_blocked_requests = 0 > > main: port = 0 > > main: allow_core_dumps = no > > main: log_stripped_names = no > > main: log_file = "/usr/local/var/log/radius/radius.log" > > main: log_auth = yes > > main: log_auth_badpass = yes > > main: log_auth_goodpass = yes > > main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" > > main: user = "(null)" > > main: group = "(null)" > > main: usercollide = no > > main: lower_user = "no" > > main: lower_pass = "no" > > main: nospace_user = "no" > > main: nospace_pass = "no" > > main: checkrad = "/usr/local/sbin/checkrad" > > main: proxy_requests = yes > > proxy: retry_delay = 5 > > proxy: retry_count = 3 > > proxy: synchronous = no > > proxy: default_fallback = yes > > proxy: dead_time = 120 > > proxy: post_proxy_authorize = yes > > proxy: wake_all_if_all_dead = no > > security: max_attributes = 200 > > security: reject_delay = 1 > > security: status_server = no > > main: debug_level = 0 > > read_config_files: reading dictionary > > read_config_files: reading naslist > > Using deprecated naslist file. Support for this will go away soon. > > read_config_files: reading clients > > read_config_files: reading realms > > radiusd: entering modules setup > > Module: Library search path is /usr/local/lib > > Module: Loaded exec > > exec: wait = yes > > exec: program = "(null)" > > exec: input_pairs = "request" > > exec: output_pairs = "(null)" > > exec: packet_type = "(null)" > > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > > Module: Instantiated exec (exec) > > Module: Loaded expr > > Module: Instantiated expr (expr) > > Module: Loaded PAP > > pap: encryption_scheme = "crypt" > > Module: Instantiated pap (pap) > > Module: Loaded CHAP > > Module: Instantiated chap (chap) > > Module: Loaded MS-CHAP > > mschap: use_mppe = yes > > mschap: require_encryption = no > > mschap: require_strong = no > > mschap: with_ntdomain_hack = no > > mschap: passwd = "(null)" > > mschap: authtype = "MS-CHAP" > > mschap: ntlm_auth = "(null)" > > Module: Instantiated mschap (mschap) > > Module: Loaded System > > unix: cache = no > > unix: passwd = "(null)" > > unix: shadow = "(null)" > > unix: group = "(null)" > > unix: radwtmp = "/usr/local/var/log/radius/radwtmp" > > unix: usegroup = no > > unix: cache_reload = 600 > > Module: Instantiated unix (unix) > > Module: Loaded eap > > eap: default_eap_type = "md5" > > eap: timer_expire = 60 > > eap: ignore_unknown_eap_types = no > > eap: cisco_accounting_username_bug = no > > rlm_eap: Loaded and initialized type md5 > > rlm_eap: Loaded and initialized type leap > > gtc: challenge = "Password: " > > gtc: auth_type = "PAP" > > rlm_eap: Loaded and initialized type gtc > > mschapv2: with_ntdomain_hack = no > > rlm_eap: Loaded and initialized type mschapv2 > > Module: Instantiated eap (eap) > > Module: Loaded preprocess > > preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" > > preprocess: hints = "/usr/local/etc/raddb/hints" > > preprocess: with_ascend_hack = no > > preprocess: ascend_channels_per_line = 23 > > preprocess: with_ntdomain_hack = no > > preprocess: with_specialix_jetstream_hack = no > > preprocess: with_cisco_vsa_hack = no > > Module: Instantiated preprocess (preprocess) > > Module: Loaded realm > > realm: format = "suffix" > > realm: delimiter = "@" > > realm: ignore_default = no > > realm: ignore_null = no > > Module: Instantiated realm (suffix) > > Module: Loaded files > > files: usersfile = "/usr/local/etc/raddb/users" > > files: acctusersfile = "/usr/local/etc/raddb/acct_users" > > files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > > files: compat = "no" > > Module: Instantiated files (files) > > Module: Loaded Acct-Unique-Session-Id > > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > > Client-IP-Address, NAS-Port" > > Module: Instantiated acct_unique (acct_unique) > > Module: Loaded detail > > detail: detailfile = > > "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > > detail: detailperm = 384 > > detail: dirperm = 493 > > detail: locking = no > > Module: Instantiated detail (detail) > > Module: Loaded radutmp > > radutmp: filename = "/usr/local/var/log/radius/radutmp" > > radutmp: username = "%{User-Name}" > > radutmp: case_sensitive = yes > > radutmp: check_with_nas = yes > > radutmp: perm = 384 > > radutmp: callerid = yes > > Module: Instantiated radutmp (radutmp) > > Listening on authentication *:1812 > > Listening on accounting *:1813 > > Ready to process requests. > > rad_recv: Access-Request packet from host 172.16.51.67:2531, id=82, length=89 > > User-Name = "test" > > User-Password = "\010\n\INCORRECT" > > NAS-IP-Address = 172.16.51.67 > > NAS-Identifier = "sshd" > > NAS-Port = 1506 > > NAS-Port-Type = Virtual > > Service-Type = Authenticate-Only > > Calling-Station-Id = "192.168.60.76" > > Processing the authorize section of radiusd.conf > > modcall: entering group authorize for request 0 > > modcall[authorize]: module "preprocess" returns ok for request 0 > > modcall[authorize]: module "chap" returns noop for request 0 > > modcall[authorize]: module "mschap" returns noop for request 0 > > rlm_realm: No '@' in User-Name = "test", looking up realm NULL > > rlm_realm: No such realm "NULL" > > modcall[authorize]: module "suffix" returns noop for request 0 > > rlm_eap: No EAP-Message, not doing EAP > > modcall[authorize]: module "eap" returns noop for request 0 > > users: Matched entry DEFAULT at line 156 > > modcall[authorize]: module "files" returns ok for request 0 > > modcall: group authorize returns ok for request 0 > > rad_check_password: Found Auth-Type System > > auth: type "System" > > Processing the authenticate section of radiusd.conf > > modcall: entering group authenticate for request 0 > > rlm_unix: [test]: invalid password > > modcall[authenticate]: module "unix" returns reject for request 0 > > modcall: group authenticate returns reject for request 0 > > auth: Failed to validate the user. > > Login incorrect: [test/\010\n\INCORRECT] (from client > > us067.eudra.org port 1506 cli 192.168.60.76) > > WARNING: Unprintable characters in the password. ? > > Double-check the shared secret on the server and the NAS! > > Delaying request 0 for 1 seconds > > Finished request 0 > > Going to the next request > > --- Walking the entire request list --- > > Waking up in 1 seconds... > > --- Walking the entire request list --- > > Waking up in 1 seconds... > > --- Walking the entire request list --- > > Sending Access-Reject of id 82 to 172.16.51.67:2531 > > Waking up in 4 seconds... > > --- Walking the entire request list --- > > Cleaning up request 0 ID 82 with timestamp 43d0c994 > > Nothing to do. Sleeping until we see a request. > > > > ________________________________________________________________________ > > This e-mail has been scanned for all known viruses by EMEA. > > ________________________________________________________________________ > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > > +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ > Version: GnuPG v1.4.2 (GNU/Linux) > .-. .-. _ > : : : : :_; > .-' : .--. : `-. .-. .--. ,-.,-. > ' .; :' '_.'' .; :: :' .; ; : ,. : > `.__.'`.__.'`.__.':_;`.__,_;:_;:_; > > Kai "Ozgur" Geek > Network Engineer > PGP ID: B1B63B6E > +-+-+-+ END PGP SIGNATURE +-+-+-+ > > > -- > _______________________________________________ > Check out the latest SMS services @ http://www.linuxmail.org > This allows you to send and receive SMS through your mailbox. > > Powered by Outblaze > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > ________________________________________________________________________ > This e-mail has been scanned for all known viruses by EMEA. > ________________________________________________________________________ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

1 0

RE: Freeradius authentication question
by Le Gal Philippe 20 Jan '06

20 Jan '06

The Pam radius configuration file on the client machine should be located here: /etc/raddb/server (cf pam radius INSTALL) I can't see why the radius server can not decrypt the password when I know my shared secret is absolutely identical on the client and on the radius server. Anyone ? Philippe -----Original Message----- From: freeradius-users-bounces+philippe.legal=emea.eu.int(a)lists.freeradius.org [mailto:freeradius-users-bounces+philippe.legal=emea.eu.int@lists.freera dius.org]On Behalf Of Kai Geek Sent: 20 January 2006 12:00 To: FreeRadius users mailing list Subject: Re: Freeradius authentication question Hello, [root@us067 root]# vi /etc/raddb/server ?? the config file will this be ? correct directory; #vi /etc/raddb/clients.conf oke. > ----- Original Message ----- > From: "Le Gal Philippe" <Philippe.LeGal(a)emea.eu.int> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Freeradius authentication question > Date: Fri, 20 Jan 2006 11:34:51 -0000 > > > > Hi everybody, > > I'm trying to authenticate users login in a machine using ssh. I > have configured ssh & PAM on that server to autenticate against the > radius server (Redhat Application Server 2.1). > > Please find below the debug of the radius server as well as my conf files. > > The Free radius server says : > > Login incorrect: [test/\010\n\INCORRECT] (from client > us067.eudra.org port 1500 cli 192.168.xx.xx) > WARNING: Unprintable characters in the password. ? Double-check > the shared secret on the server and the NAS! > > So did I . I checked the secrets on the server and they are *IDENTICAL*... > > I used the NTRadPing utility with exactly the same parameters and > it works absolutely fine ! > > Thank you for your help ! > > my /etc/raddb/server file : (on the client machine) : > > [root@us067 root]# vi /etc/raddb/server > # pam_radius_auth configuration file. Copy to: /etc/raddb/server > # > # For proper security, this file SHOULD have permissions 0600, > # that is readable by root, and NO ONE else. If anyone other than > # root can read this file, then they can spoof responses from the server! > # > # There are 3 fields per line in this file. There may be multiple > # lines. Blank lines or lines beginning with '#' are treated as > # comments, and are ignored. The fields are: > # > # server[:port] secret [timeout] > # > # the port name or number is optional. The default port name is > # "radius", and is looked up from /etc/services The timeout field is > # optional. The default timeout is 3 seconds. > # > # If multiple RADIUS server lines exist, they are tried in order. The > # first server to return success or failure causes the module to return > # success or failure. Only if a server fails to response is it skipped, > # and the next server in turn is used. > # > # The timeout field controls how many seconds the module waits before > # deciding that the server has failed to respond. > # > # server[:port] shared_secret timeout (s) > loginhost.eudra.org philippe123456 1 > # > # having localhost in your radius configuration is a Good Thing. > # > # See the INSTALL file for pam.conf hints. > > > clients.conf : > > client us067.eudra.org { > secret = philippe123456 > shortname = us067.eudra.org > } > > > [root@us072 raddb]# radiusd -X > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /usr/local/etc/raddb/proxy.conf > Config: including file: /usr/local/etc/raddb/clients.conf > Config: including file: /usr/local/etc/raddb/snmp.conf > Config: including file: /usr/local/etc/raddb/eap.conf > Config: including file: /usr/local/etc/raddb/sql.conf > main: prefix = "/usr/local" > main: localstatedir = "/usr/local/var" > main: logdir = "/usr/local/var/log/radius" > main: libdir = "/usr/local/lib" > main: radacctdir = "/usr/local/var/log/radius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/usr/local/var/log/radius/radius.log" > main: log_auth = yes > main: log_auth_badpass = yes > main: log_auth_goodpass = yes > main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = yes > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/local/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "(null)" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/usr/local/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" > preprocess: hints = "/usr/local/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/usr/local/etc/raddb/users" > files: acctusersfile = "/usr/local/etc/raddb/acct_users" > files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/usr/local/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Access-Request packet from host 172.16.51.67:2531, id=82, length=89 > User-Name = "test" > User-Password = "\010\n\INCORRECT" > NAS-IP-Address = 172.16.51.67 > NAS-Identifier = "sshd" > NAS-Port = 1506 > NAS-Port-Type = Virtual > Service-Type = Authenticate-Only > Calling-Station-Id = "192.168.60.76" > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "test", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry DEFAULT at line 156 > modcall[authorize]: module "files" returns ok for request 0 > modcall: group authorize returns ok for request 0 > rad_check_password: Found Auth-Type System > auth: type "System" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_unix: [test]: invalid password > modcall[authenticate]: module "unix" returns reject for request 0 > modcall: group authenticate returns reject for request 0 > auth: Failed to validate the user. > Login incorrect: [test/\010\n\INCORRECT] (from client > us067.eudra.org port 1506 cli 192.168.60.76) > WARNING: Unprintable characters in the password. ? Double-check > the shared secret on the server and the NAS! > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 82 to 172.16.51.67:2531 > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 82 with timestamp 43d0c994 > Nothing to do. Sleeping until we see a request. > > ________________________________________________________________________ > This e-mail has been scanned for all known viruses by EMEA. > ________________________________________________________________________ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________________________________________________ This e-mail has been scanned for all known viruses by EMEA. ________________________________________________________________________

1 0

Re: Freeradius authentication question
by Kai Geek 20 Jan '06

20 Jan '06

Hello, [root@us067 root]# vi /etc/raddb/server ?? the config file will this be ? correct directory; #vi /etc/raddb/clients.conf oke. > ----- Original Message ----- > From: "Le Gal Philippe" <Philippe.LeGal(a)emea.eu.int> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Freeradius authentication question > Date: Fri, 20 Jan 2006 11:34:51 -0000 > > > > Hi everybody, > > I'm trying to authenticate users login in a machine using ssh. I > have configured ssh & PAM on that server to autenticate against the > radius server (Redhat Application Server 2.1). > > Please find below the debug of the radius server as well as my conf files. > > The Free radius server says : > > Login incorrect: [test/\010\n\INCORRECT] (from client > us067.eudra.org port 1500 cli 192.168.xx.xx) > WARNING: Unprintable characters in the password. ? Double-check > the shared secret on the server and the NAS! > > So did I . I checked the secrets on the server and they are *IDENTICAL*... > > I used the NTRadPing utility with exactly the same parameters and > it works absolutely fine ! > > Thank you for your help ! > > my /etc/raddb/server file : (on the client machine) : > > [root@us067 root]# vi /etc/raddb/server > # pam_radius_auth configuration file. Copy to: /etc/raddb/server > # > # For proper security, this file SHOULD have permissions 0600, > # that is readable by root, and NO ONE else. If anyone other than > # root can read this file, then they can spoof responses from the server! > # > # There are 3 fields per line in this file. There may be multiple > # lines. Blank lines or lines beginning with '#' are treated as > # comments, and are ignored. The fields are: > # > # server[:port] secret [timeout] > # > # the port name or number is optional. The default port name is > # "radius", and is looked up from /etc/services The timeout field is > # optional. The default timeout is 3 seconds. > # > # If multiple RADIUS server lines exist, they are tried in order. The > # first server to return success or failure causes the module to return > # success or failure. Only if a server fails to response is it skipped, > # and the next server in turn is used. > # > # The timeout field controls how many seconds the module waits before > # deciding that the server has failed to respond. > # > # server[:port] shared_secret timeout (s) > loginhost.eudra.org philippe123456 1 > # > # having localhost in your radius configuration is a Good Thing. > # > # See the INSTALL file for pam.conf hints. > > > clients.conf : > > client us067.eudra.org { > secret = philippe123456 > shortname = us067.eudra.org > } > > > [root@us072 raddb]# radiusd -X > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /usr/local/etc/raddb/proxy.conf > Config: including file: /usr/local/etc/raddb/clients.conf > Config: including file: /usr/local/etc/raddb/snmp.conf > Config: including file: /usr/local/etc/raddb/eap.conf > Config: including file: /usr/local/etc/raddb/sql.conf > main: prefix = "/usr/local" > main: localstatedir = "/usr/local/var" > main: logdir = "/usr/local/var/log/radius" > main: libdir = "/usr/local/lib" > main: radacctdir = "/usr/local/var/log/radius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/usr/local/var/log/radius/radius.log" > main: log_auth = yes > main: log_auth_badpass = yes > main: log_auth_goodpass = yes > main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = yes > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/local/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "(null)" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/usr/local/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" > preprocess: hints = "/usr/local/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/usr/local/etc/raddb/users" > files: acctusersfile = "/usr/local/etc/raddb/acct_users" > files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/usr/local/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Access-Request packet from host 172.16.51.67:2531, id=82, length=89 > User-Name = "test" > User-Password = "\010\n\INCORRECT" > NAS-IP-Address = 172.16.51.67 > NAS-Identifier = "sshd" > NAS-Port = 1506 > NAS-Port-Type = Virtual > Service-Type = Authenticate-Only > Calling-Station-Id = "192.168.60.76" > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "test", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry DEFAULT at line 156 > modcall[authorize]: module "files" returns ok for request 0 > modcall: group authorize returns ok for request 0 > rad_check_password: Found Auth-Type System > auth: type "System" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_unix: [test]: invalid password > modcall[authenticate]: module "unix" returns reject for request 0 > modcall: group authenticate returns reject for request 0 > auth: Failed to validate the user. > Login incorrect: [test/\010\n\INCORRECT] (from client > us067.eudra.org port 1506 cli 192.168.60.76) > WARNING: Unprintable characters in the password. ? Double-check > the shared secret on the server and the NAS! > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 82 to 172.16.51.67:2531 > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 82 with timestamp 43d0c994 > Nothing to do. Sleeping until we see a request. > > ________________________________________________________________________ > This e-mail has been scanned for all known viruses by EMEA. > ________________________________________________________________________ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

1 0

Error with dialup admin
by bishal＠baayu.com.np 20 Jan '06

20 Jan '06

Hello all I have installed freeradius 1.1.0 in freebsd 6.0. While clicking on statistic menu of dialup page I got this error. Warning: mktime() expects parameter 1 to be long, string given in /usr/home/httpd/baayu.com.np/baayucom/dialbaayu/lib/functions.php3 on line 83 Warning: mktime() expects parameter 1 to be long, string given in /usr/home/httpd/baayu.com.np/baayucom/dialbaayu/lib/functions.php3 on line 83

1 0

LEAP
by John Peebles 20 Jan '06

20 Jan '06

We are having problems getting leap to authenticate. We are using FreeRadius 0.9.3, Cisco Arionet 1200 and eDir as a back end. Here is our config file: ! version 12.3 no service pad service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname TESTAP ! enable secret 5 $1$tQu6$CiVTpfiU2yIuDBoQveZtM1 ! ip subnet-zero ! ! aaa new-model ! ! aaa group server radius rad_eap ! aaa group server radius rad_mac ! aaa group server radius rad_acct ! aaa group server radius rad_admin cache expiry 1 cache authorization profile admin_cache cache authentication profile admin_cache ! aaa group server tacacs+ tac_admin cache expiry 1 cache authorization profile admin_cache cache authentication profile admin_cache ! aaa group server radius rad_pmip ! aaa group server radius dummy ! aaa group server radius rad_eap1 server 172.31.1.25 auth-port 1812 acct-port 1813 ! aaa authentication login eap_methods group rad_eap aaa authentication login mac_methods local aaa authentication login eap_methods1 group rad_eap1 aaa authorization exec default local aaa accounting network acct_methods start-stop group rad_acct aaa cache profile admin_cache all ! aaa session-id common ! dot11 ssid TESTAP authentication open eap eap_methods1 authentication network-eap eap_methods1 guest-mode ! ! ! username Cisco password 7 047802150C2E ! bridge irb ! ! interface Dot11Radio0 no ip address no ip route-cache ! encryption mode wep mandatory ! ssid TESTAP ! speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0 station-role root bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding bridge-group 1 spanning-disabled ! interface FastEthernet0 no ip address no ip route-cache duplex auto speed auto bridge-group 1 no bridge-group 1 source-learning bridge-group 1 spanning-disabled ! interface BVI1 ip address 172.31.1.79 255.255.255.0 no ip route-cache ! ip default-gateway 172.31.1.250 ip http server no ip http secure-server ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag ip radius source-interface BVI1 ! radius-server local no authentication eapfast no authentication mac eapfast server-key primary 7 C10D5BA1B105987DEA7DE22F1E2A3D7094 nas 172.31.1.79 key 7 040A59555B74 user testrad nthash 7 06255C771F6A5F412735372D5B560F7B720E6B657A46544F2051000B0E77005F57 ! radius-server attribute 32 include-in-access-req format %h radius-server host 172.31.1.25 auth-port 1812 acct-port 1813 key 7 101F5B4A5142 radius-server vsa send accounting ! control-plane ! bridge 1 route ip ! ! ! line con 0 transport preferred all transport output all line vty 0 4 transport preferred all transport input all transport output all line vty 5 15 transport preferred all transport input all transport output all ! end here is the error message we get: rad_recv: Access-Request packet from host 172.31.1.79:1645, id=5, length=131 User-Name = "testrad" Framed-MTU = 1400 Called-Station-Id = "0015.f947.8560" Calling-Station-Id = "0012.f0e3.7896" Service-Type = Login-User Message-Authenticator = 0xa00609077f82a3396080dcdcc8019804 EAP-Message = 0x0201000c0174657374726164 NAS-Port-Type = Wireless-802.11 NAS-Port = 466 NAS-IP-Address = 172.31.1.79 NAS-Identifier = "TESTAP" modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_realm: No '@' in User-Name = "testrad", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 users: Matched DEFAULT at 152 modcall[authorize]: module "files" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for testrad radius_xlat: '(uid=testrad)' radius_xlat: 'o=Village' ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=Village, with filter (uid=testrad) rlm_ldap: checking if remote access for testrad is allowed by dialupAccess rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user testrad authorized to use remote access ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" modcall: entering group Auth-Type for request 1 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap" returns invalid for request 1 modcall: group Auth-Type returns invalid for request 1 auth: Failed to validate the user. Login incorrect: [testrad/<no User-Password attribute>] (from client testap port 466 cli 0012.f0e3.7896) Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 5 to 172.31.1.79:1645 Waking up in 4 seconds... I can authenticate using a small utility called NTRadPing Test Utility from my desktop directly connecting to Freeradius. any thoughts? Thank you, John Peebles Village of Hoffman Estates IS Specialist (847) 882-9100 x2500

3 2

1.0.5 PEAP issue with Edirectory
by Anup Parkhi 19 Jan '06

19 Jan '06

Hi, Enviornment: FreeRadius version: 1.0.5 OS: Red Hat Linux ES3 Directory: Edirectory Auth-Type: EAP PEAP (EAP-MD5 worked though) I built FreeRadius 1.0.5 with (--with-edir). While sending EAP-PEAP request, the freeradius crashed. gdb backtrace indicated a problem in libssl. I was using openssl 0.9.7a. Tried with other versions of openssl with following results. . 0.9.6a & 0.9.8a -- did not compile . 0.9.6i - did not link However, i had a CVS snapshot of 12/19/05. using that, both EAP-MD5 and EAP-PEAP worked. For some reason i will have to use 1.0.5. I was wondering if anybody has success with 1.0.5/Edirectory/PEAP. If yes, which openssl i should use. I can provide logs or stack trace if needed. Thanks Anup

1 0

how to set crypted password in 'users' file?
by Min Qiu 19 Jan '06

19 Jan '06

Hi all, I'm able to make clear text password work by adding entry in 'users' file: mqiu Auth-Type := Local, User-Password == "clear-text" However, cut and past the crypted password from /etc/shadow to the entry failed: mqiu Auth-Type := Local, User-Password == "$1$CWOjXm2v$dzjrc385t1iQXMN0" Change above Auth-Type to "pam" or "unix" does not work. My question is how to set an crypted password in 'users' file? In addition, how to set different passwords for the same user in different hosts? something like: mqiu(a)10.1.1.0/24 Auth-Type := Local, User-Password == "pass1" mqiu(a)10.1.2.0/24 Auth-Type := Local, User-Password == "pass2" ... mqiu(a)10.1.N.0/24 Auth-Type := Local, User-Password == "passN" I have freeradius-1.0.4-1.FC4.1 installed. Thanks a lot, Min

2 1

Problem translating users file to Postgre DB
by Andrew Teixeira 19 Jan '06

19 Jan '06

Hello, I tried to port my users file to PostgreSQL today, but I am having a great deal of confusing trouble trying to get it to work. I am using the postgresql.conf file that came with Freeradius 1.1.0 and am having no trouble getting Freeradius to connect to Postgre. My problem comes when trying to authenticate to my firewall. First, I will explain the working "files-only" configuration: ::::::::::::::::: huntgroups ::::::::::::::::: switches NAS-IP-Address == 10.20.10.x switches NAS-IP-Address == 10.20.10.x switches NAS-IP-Address == 10.20.10.x switches NAS-IP-Address == 127.0.0.1 firewall NAS-IP-Address == 10.20.10.x firewall NAS-IP-Address == 10.20.10.x ::::::::: users ::::::::: DEFAULT Auth-Type = System Fall-Through = 1 admin Auth-Type := Kerberos, Huntgroup-Name == "switches" Service-Type == "Administrative-User" admin Auth-Type := Kerberos, Huntgroup-Name == "firewall" NS-Admin-Privilege = "All-VSYS-Root-Admin" When I do this with files only, it works great. I then tried to get the database setup to work. I left the huntgroups file alone and commented out the 2 'admin' entries in users. Now, this is my setup in the database that is not working: :::::::::::::::::::::: radgroupcheck :::::::::::::::::::::: id | groupname | attribute | op | value ----+-------------+----------------+----+------------- 1 | switches | Huntgroup-Name | == | switches 2 | firewall | Huntgroup-Name | == | firewall 5 | firewall | Auth-Type | := | Kerberos 6 | switches | Auth-Type | := | Kerberos ::::::::::::::::::::: radgroupreply ::::::::::::::::::::: id | groupname | attribute | op | value ----+-------------+--------------------+----+--------------------- 2 | firewall | NS-Admin-Privilege | = | All-VSYS-Root-Admin 1 | switches | Service-Type | = | Administrative-User ::::::::::::::: usergroup ::::::::::::::: id | username | groupname ----+----------+------------- 1 | admin | switches 2 | admin | firewall In this setup, I can authenticate with 'admin' using my Kerberos password for the 'switches' huntgroup, but I cannot authenticate to 'firewall'. Also, when I do radtest for an IP in the switches huntgroup, I get a reply of both 'Service-Type' and 'NS-Admin-Privilege', when I assumed that this would give me one or the other since they are in different groups. When running radiusd with the '-X' flag and trying to authenticate to firewall, I get the error: rlm_sql (sql): No matching entry in the database for request from user [admin] This shouldn't be the case since the user 'admin' is part of both groups. I am at a loss at this point what could be the problem. If anyone has any insight, I would greatly appreciate it. Thanks in advance.

1 0

RE: CIsco Pix and FreeRadius....
by Sills, Tripp 19 Jan '06

19 Jan '06

Done that fixed the issue....Now I want to use ldap with freeradius is that possible? Tripp Sills Senior Network Engineer - Information Technology tripp(a)dmenet.com Direct Mail Express 2441 Bellevue Avenue Extension Daytona Beach, FL Office # (386) 271 - 3288 Cell # (386) 566 - 4053 Fax # (386) 271 - 3289 The information in this Internet e-mail, including attachments, is confidential and may be legally privileged. It is intended solely for the addressee. Access by any other person to this Internet e-mail is not authorized. If you are not the intended recipient, please delete this Internet e-mail and notify me by return e-mail or at (386) 271-3288. Any unauthorized disclosure of the parties to this e-mail, and any unauthorized disclosure, dissemination, distribution, copying, or any action taken or omitted to be taken in reliance on this email, including attachments, is prohibited and may be unlawful. -----Original Message----- From: freeradius-users-bounces+tripp=dmenet.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+tripp=dmenet.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, January 18, 2006 11:22 AM To: FreeRadius users mailing list Subject: Re: CIsco Pix and FreeRadius.... "Sills, Tripp" <tripp(a)dmenet.com> wrote: > I am not altering the users file all I have in it is : > > I was using the same username and password for both. Below is my users > file. Perhaps I was unclear. *YOU* should read the users file and compare it's entries to what's in the debug log. If you don't understand what you configured or how it works, then you're never going to solve the problem. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Ippool and NAS
by Johansson, Daniel 19 Jan '06

19 Jan '06

Hi Freeradius users. I have compiled and installed the 1.1.0 version of Freeradius and made the basic configurations and everything works fine. Now I have 5 NAS boxes that is accessing the radius server the problem is that I want each NAS to use a set if ipadresses. So for NAS(1) the radius should return ippool(1) and so on. I have looked at the FAQ and have been searching in the mail archive for several hours and have only seen people asking about allocating ipadresses for specific user(s) or group(s) but not for a NAS. Could anyone please help me to get me started on this. Best Regards /Daniel Johansson Below is my NAS boxes in clients.conf # Client for RTP-RFTN, GGSN 1 client 192.168.9.1 { secret = xxx shortname = RTP-RFTN } # Client for S99, GGSN 249 client 192.168.15.249 { secret = xxx shortname = S99 GGSN 249 } # Client for S98, GGSN 254 client 192.168.13.254 { secret = xxx shortname = S98 GGSN 254 } # Client for GLANA, GGSN 250 client 192.168.11.250 { secret = xxx shortname = GLANA GGSN 250 } # Client for Telia GLANA, GGSN 249 client 192.168.11.249 { secret = xxx shortname = GLANA GGSN 249 }

3 2