Just to be "sure", iptables has been set to accept all. A netstat shows:
udp 0 0 *:radius *:* udp 0 0 *:radius-acct *:*
So radius appears to be "listening" to the ports on "ALL" IPs. If the above is correct, then I should be able to do a radtest on any IPs associated with the box and get a response. Yet I am only able to get a response using localhost (127.0.0.1)... Just to be sure, I also did a localhost radtest on the machine:
radtest fred wilma localhost 1812 mysecret
And it resolved localhost as 127.0.0.1 (as expected) and responded the same as when I used 127.0.0.1 In radiusd.conf, bind_address = * and listen { } is all commented out. Running freeradius -XXX -A provides the following output:
root@server3:/home/kevin# freeradius -XXX -A Fri Dec 12 13:53:24 2008 : Info: Starting - reading configuration files ... Fri Dec 12 13:53:24 2008 : Debug: reread_config: reading radiusd.conf Fri Dec 12 13:53:24 2008 : Debug: Config: including file: /etc/freeradius/proxy.conf Fri Dec 12 13:53:24 2008 : Debug: Config: including file: /etc/freeradius/clients.conf Fri Dec 12 13:53:24 2008 : Debug: Config: including file: /etc/freeradius/snmp.conf Fri Dec 12 13:53:24 2008 : Debug: Config: including file: /etc/freeradius/eap.conf Fri Dec 12 13:53:24 2008 : Debug: Config: including file: /etc/freeradius/sql.conf Fri Dec 12 13:53:24 2008 : Debug: main: prefix = "/usr" Fri Dec 12 13:53:24 2008 : Debug: main: localstatedir = "/var" Fri Dec 12 13:53:24 2008 : Debug: main: logdir = "/var/log/freeradius" Fri Dec 12 13:53:24 2008 : Debug: main: libdir = "/usr/lib/freeradius" Fri Dec 12 13:53:24 2008 : Debug: main: radacctdir = "/var/log/freeradius/radacct" Fri Dec 12 13:53:24 2008 : Debug: main: hostname_lookups = no Fri Dec 12 13:53:24 2008 : Debug: main: max_request_time = 30 Fri Dec 12 13:53:24 2008 : Debug: main: cleanup_delay = 5 Fri Dec 12 13:53:24 2008 : Debug: main: max_requests = 1024 Fri Dec 12 13:53:24 2008 : Debug: main: delete_blocked_requests = 0 Fri Dec 12 13:53:24 2008 : Debug: main: port = 0 Fri Dec 12 13:53:24 2008 : Debug: main: allow_core_dumps = no Fri Dec 12 13:53:24 2008 : Debug: main: log_stripped_names = no Fri Dec 12 13:53:24 2008 : Debug: main: log_file = "/var/log/freeradius/radius.log" Fri Dec 12 13:53:24 2008 : Debug: main: log_auth = no Fri Dec 12 13:53:24 2008 : Debug: main: log_auth_badpass = no Fri Dec 12 13:53:24 2008 : Debug: main: log_auth_goodpass = no Fri Dec 12 13:53:24 2008 : Debug: main: pidfile = "/var/run/freeradius/freeradius.pid" Fri Dec 12 13:53:24 2008 : Debug: main: user = "freerad" Fri Dec 12 13:53:24 2008 : Debug: main: group = "freerad" Fri Dec 12 13:53:24 2008 : Debug: main: usercollide = no Fri Dec 12 13:53:24 2008 : Debug: main: lower_user = "no" Fri Dec 12 13:53:24 2008 : Debug: main: lower_pass = "no" Fri Dec 12 13:53:24 2008 : Debug: main: nospace_user = "no" Fri Dec 12 13:53:24 2008 : Debug: main: nospace_pass = "no" Fri Dec 12 13:53:24 2008 : Debug: main: checkrad = "/usr/sbin/checkrad" Fri Dec 12 13:53:24 2008 : Debug: main: proxy_requests = yes Fri Dec 12 13:53:24 2008 : Debug: proxy: retry_delay = 5 Fri Dec 12 13:53:24 2008 : Debug: proxy: retry_count = 3 Fri Dec 12 13:53:24 2008 : Debug: proxy: synchronous = no Fri Dec 12 13:53:24 2008 : Debug: proxy: default_fallback = yes Fri Dec 12 13:53:24 2008 : Debug: proxy: dead_time = 120 Fri Dec 12 13:53:24 2008 : Debug: proxy: post_proxy_authorize = no Fri Dec 12 13:53:24 2008 : Debug: proxy: wake_all_if_all_dead = no Fri Dec 12 13:53:24 2008 : Debug: security: max_attributes = 200 Fri Dec 12 13:53:24 2008 : Debug: security: reject_delay = 1 Fri Dec 12 13:53:24 2008 : Debug: security: status_server = no Fri Dec 12 13:53:24 2008 : Debug: main: debug_level = 0 Fri Dec 12 13:53:24 2008 : Debug: read_config_files: reading dictionary Fri Dec 12 13:53:24 2008 : Debug: read_config_files: reading naslist Fri Dec 12 13:53:24 2008 : Info: Using deprecated naslist file. Support for this will go away soon. Fri Dec 12 13:53:24 2008 : Debug: read_config_files: reading clients Fri Dec 12 13:53:24 2008 : Debug: read_config_files: reading realms Fri Dec 12 13:53:24 2008 : Debug: radiusd: entering modules setup Fri Dec 12 13:53:24 2008 : Debug: Module: Library search path is /usr/lib/freeradius Fri Dec 12 13:53:24 2008 : Debug: Module: Loaded exec Fri Dec 12 13:53:24 2008 : Debug: exec: wait = yes Fri Dec 12 13:53:24 2008 : Debug: exec: program = "(null)" Fri Dec 12 13:53:24 2008 : Debug: exec: input_pairs = "request" Fri Dec 12 13:53:24 2008 : Debug: exec: output_pairs = "(null)" Fri Dec 12 13:53:24 2008 : Debug: exec: packet_type = "(null)" Fri Dec 12 13:53:24 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Fri Dec 12 13:53:24 2008 : Debug: Module: Instantiated exec (exec) Fri Dec 12 13:53:24 2008 : Debug: Module: Loaded expr Fri Dec 12 13:53:24 2008 : Debug: Module: Instantiated expr (expr) Fri Dec 12 13:53:24 2008 : Debug: Module: Loaded PAP Fri Dec 12 13:53:24 2008 : Debug: pap: encryption_scheme = "crypt" Fri Dec 12 13:53:24 2008 : Debug: pap: auto_header = yes Fri Dec 12 13:53:24 2008 : Debug: Module: Instantiated pap (pap) Fri Dec 12 13:53:24 2008 : Debug: Module: Loaded CHAP Fri Dec 12 13:53:24 2008 : Debug: Module: Instantiated chap (chap) Fri Dec 12 13:53:24 2008 : Debug: Module: Loaded MS-CHAP Fri Dec 12 13:53:24 2008 : Debug: mschap: use_mppe = yes Fri Dec 12 13:53:24 2008 : Debug: mschap: require_encryption = no Fri Dec 12 13:53:24 2008 : Debug: mschap: require_strong = no Fri Dec 12 13:53:24 2008 : Debug: mschap: with_ntdomain_hack = no Fri Dec 12 13:53:24 2008 : Debug: mschap: passwd = "(null)" Fri Dec 12 13:53:24 2008 : Debug: mschap: ntlm_auth = "(null)" Fri Dec 12 13:53:24 2008 : Debug: Module: Instantiated mschap (mschap) Fri Dec 12 13:53:24 2008 : Debug: Module: Loaded System Fri Dec 12 13:53:24 2008 : Debug: unix: cache = no Fri Dec 12 13:53:24 2008 : Debug: unix: passwd = "(null)" Fri Dec 12 13:53:24 2008 : Debug: unix: shadow = "/etc/shadow" Fri Dec 12 13:53:24 2008 : Debug: unix: group = "(null)" Fri Dec 12 13:53:24 2008 : Debug: unix: radwtmp = "/var/log/freeradius/radwtmp" Fri Dec 12 13:53:24 2008 : Debug: unix: usegroup = no Fri Dec 12 13:53:24 2008 : Debug: unix: cache_reload = 600 Fri Dec 12 13:53:24 2008 : Debug: Module: Instantiated unix (unix) Fri Dec 12 13:53:24 2008 : Debug: Module: Loaded eap Fri Dec 12 13:53:24 2008 : Debug: eap: default_eap_type = "md5" Fri Dec 12 13:53:24 2008 : Debug: eap: timer_expire = 60 Fri Dec 12 13:53:24 2008 : Debug: eap: ignore_unknown_eap_types = no Fri Dec 12 13:53:24 2008 : Debug: eap: cisco_accounting_username_bug = no Fri Dec 12 13:53:24 2008 : Debug: rlm_eap: Loaded and initialized type md5 Fri Dec 12 13:53:24 2008 : Debug: rlm_eap: Loaded and initialized type leap Fri Dec 12 13:53:24 2008 : Debug: gtc: challenge = "Password: " Fri Dec 12 13:53:24 2008 : Debug: gtc: auth_type = "PAP" Fri Dec 12 13:53:24 2008 : Debug: rlm_eap: Loaded and initialized type gtc Fri Dec 12 13:53:24 2008 : Debug: mschapv2: with_ntdomain_hack = no Fri Dec 12 13:53:24 2008 : Debug: rlm_eap: Loaded and initialized type mschapv2 Fri Dec 12 13:53:24 2008 : Debug: Module: Instantiated eap (eap) Fri Dec 12 13:53:24 2008 : Debug: Module: Loaded preprocess Fri Dec 12 13:53:24 2008 : Debug: preprocess: huntgroups = "/etc/freeradius/huntgroups" Fri Dec 12 13:53:24 2008 : Debug: preprocess: hints = "/etc/freeradius/hints" Fri Dec 12 13:53:24 2008 : Debug: preprocess: with_ascend_hack = no Fri Dec 12 13:53:24 2008 : Debug: preprocess: ascend_channels_per_line = 23 Fri Dec 12 13:53:24 2008 : Debug: preprocess: with_ntdomain_hack = no Fri Dec 12 13:53:24 2008 : Debug: preprocess: with_specialix_jetstream_hack = no Fri Dec 12 13:53:24 2008 : Debug: preprocess: with_cisco_vsa_hack = no Fri Dec 12 13:53:24 2008 : Debug: preprocess: with_alvarion_vsa_hack = no Fri Dec 12 13:53:24 2008 : Debug: Module: Instantiated preprocess (preprocess) Fri Dec 12 13:53:24 2008 : Debug: Module: Loaded realm Fri Dec 12 13:53:24 2008 : Debug: realm: format = "suffix" Fri Dec 12 13:53:24 2008 : Debug: realm: delimiter = "@" Fri Dec 12 13:53:24 2008 : Debug: realm: ignore_default = no Fri Dec 12 13:53:24 2008 : Debug: realm: ignore_null = no Fri Dec 12 13:53:24 2008 : Debug: Module: Instantiated realm (suffix) Fri Dec 12 13:53:24 2008 : Debug: Module: Loaded files Fri Dec 12 13:53:24 2008 : Debug: files: usersfile = "/etc/freeradius/users" Fri Dec 12 13:53:24 2008 : Debug: files: acctusersfile = "/etc/freeradius/acct_users" Fri Dec 12 13:53:24 2008 : Debug: files: preproxy_usersfile = "/etc/freeradius/preproxy_users" Fri Dec 12 13:53:24 2008 : Debug: files: compat = "no" Fri Dec 12 13:53:24 2008 : Debug: Module: Instantiated files (files) Fri Dec 12 13:53:24 2008 : Debug: Module: Loaded Acct-Unique-Session-Id Fri Dec 12 13:53:24 2008 : Debug: acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Fri Dec 12 13:53:24 2008 : Debug: Module: Instantiated acct_unique (acct_unique) Fri Dec 12 13:53:24 2008 : Debug: Module: Loaded detail Fri Dec 12 13:53:24 2008 : Debug: detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Fri Dec 12 13:53:24 2008 : Debug: detail: detailperm = 384 Fri Dec 12 13:53:24 2008 : Debug: detail: dirperm = 493 Fri Dec 12 13:53:24 2008 : Debug: detail: locking = no Fri Dec 12 13:53:24 2008 : Debug: Module: Instantiated detail (detail) Fri Dec 12 13:53:24 2008 : Debug: Module: Loaded radutmp Fri Dec 12 13:53:24 2008 : Debug: radutmp: filename = "/var/log/freeradius/radutmp" Fri Dec 12 13:53:24 2008 : Debug: radutmp: username = "%{User-Name}" Fri Dec 12 13:53:24 2008 : Debug: radutmp: case_sensitive = yes Fri Dec 12 13:53:24 2008 : Debug: radutmp: check_with_nas = yes Fri Dec 12 13:53:24 2008 : Debug: radutmp: perm = 384 Fri Dec 12 13:53:24 2008 : Debug: radutmp: callerid = yes Fri Dec 12 13:53:24 2008 : Debug: Module: Instantiated radutmp (radutmp) Fri Dec 12 13:53:24 2008 : Debug: Listening on authentication *:1812 Fri Dec 12 13:53:24 2008 : Debug: Listening on accounting *:1813 Fri Dec 12 13:53:24 2008 : Info: Ready to process requests.
Still confused as to why it won't respond to other IPs on the server... :-( On Fri, 2008-12-12 at 18:27 +0000, Andy Billington wrote:
Check firewall ports - we had "fun" when FR was listening on the 18s but our firewall guy did his config using the "traditional" 16s. Also have you got your FR client configured so FR server knows to process requests from that source?
Hth Andy
On 12/12/2008, kevin <rat@yia.ca> wrote:
I was loathe to ask a newbie question, but it appears I have one.
How does one configure freeradius to listen on all IPs specific to a machine?
I have a remote Ubuntu 7.10 server (32bit) which I want to use for authentication via freeradius. It (freeradius 1.1.6-2) installed all nice and is running properly in default config, or it would seem. I cannot get a response when a remote authenticate is made.
When I ssh into the server, it appropriately responds to the following:
root@server3:/home/kevin# radtest fred wilma 127.0.0.1 1812 mysecret Sending Access-Request of id 1 to 127.0.0.1 port 1812 User-Name = "fred" User-Password = "wilma" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Re-sending Access-Request of id 1 to 127.0.0.1 port 1812 User-Name = "fred" User-Password = "wilma" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=1, length=20 rad_verify: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.)
When I try radtest on the network IP, it fails, as per:
root@server3:/home/kevin# radtest fred wilma 192.168.3.199 1812 mysecret Sending Access-Request of id 5 to 192.168.3.199 port 1812 User-Name = "fred" User-Password = "wilma" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Re-sending Access-Request of id 5 to 192.168.3.199 port 1812 User-Name = "fred" User-Password = "wilma" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812
etc...
I have tried setting the listen in Radiusd.conf to be the network IP of the machine (x.x.3.199), but that gave the same results.
Any thoughts on what this n00b is doing wrong?
Thanks,
Kevin
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html