18 Apr
2017
18 Apr
'17
3:32 a.m.
Il 18/04/2017 09:18, Alan Buxey ha scritto: > Why do you think those are debug logs? Alan DeKok said that :-) > > If they are only meant to be in debug then either code needs changing so > it's print statement is changed, report a bug OR your server is running > with eg the -l stdout argument with a wrapper ensuring that output also > goes to the standard log file , i think systemd does that. the server runs under systemd. I tried also to run the server manually without systemd, but the problem remains... > > For better logging and control of logging, use the linelog module Thank you for the suggestion. I will try it. > > alan > > On 18 Apr 2017 7:48 am, "Andrea Gabellini" < > andrea.gabellini@telecomitalia.sm> wrote: > >> Hi Alan, >> >> my problem is not what is going on. I'm forcing an error. >> >> My problem is why I get some debug errors in the log when the server is >> not running in debug mode. >> >> Andrea >> >> Il 14/04/2017 16:42, Alan Buxey ha scritto: >>> you are not - you are getting some of the stuff that gets logged. the >>> reason for 2 outputs is varied but usually seen with EAP tunneled >> methods >>> and the reaaon >>> for the auth failure AFTER things look okay is usually due to things like >>> failure for the server to log the event (in which case an error is seen >> and >>> the server >>> will reject the user). if you run in full debug mode then you will get >>> the full pucture of what is happening....and you've been told this many >>> times. just runt he server in full debug mode (radiusd -X) see what is >>> going on. fix it, THEN run it in production mode, there is no other >>> sensible way to proceed. >>> >>> alan >>> >>> On 14 April 2017 at 10:21, Andrea Gabellini < >>> andrea.gabellini@telecomitalia.sm> wrote: >>> >>>> Hi, >>>> >>>> the problem is the (0) and (1) in the log. I think this is the packet >>>> number. Using eap with wrong username or password logs some debug output >>>> (see previous posts). Alan DeKok says that this is a debug log, but >>>> radiusd isn't running debug mode. >>>> >>>> So the question is: why I got a debug output if the server is running >>>> without it? >>>> >>>> Thanks, >>>> Andrea >>>> >>>> Il 14/04/2017 11:03, Alan Buxey ha scritto: >>>>> hi, >>>>> >>>>> this is just the output of the standard freeradius logfile - which >> gives >>>>> you some basic info (with log_auth enabled) . >>>>> >>>>> you need to be looking at the output when you run the server in full >>>> debug >>>>> mode: >>>>> >>>>> radiusd -X >>>>> or >>>>> freeradiusd -X (if you're on debian/ubuntu builds) >>>>> >>>>> (and yes, thats just one big uppercase X) - as that will tell you >>>> exactly >>>>> what is happening and why something doesnt work. >>>>> >>>>> if this is a vanilla install with no local confidential stuff etc then >>>>> theres no reason to not post the output in full to the list - there >> will >>>> be >>>>> one or 2 obvious things >>>>> >>>>> >>>>> alan >>>>> >>>>> On 14 April 2017 at 08:19, Andrea Gabellini < >>>>> andrea.gabellini@telecomitalia.sm> wrote: >>>>> >>>>>> Il 13/04/2017 13:18, Alan DeKok ha scritto: >>>>>>> On Apr 13, 2017, at 3:41 AM, Andrea Gabellini <andrea.gabellini@ >>>>>> telecomitalia.sm> wrote: >>>>>>>> the server doesn't have any extra options: >>>>>>> <shrug> The server doesn't magically start printing all debug >>>>>> messages to the log file. >>>>>>> You've made some change in your local configuration to cause this >> to >>>>>> happen. Find it, and fix it. >>>>>>> $ cd /etc/raddb >>>>>>> $ grep -r debug . >>>>>>> >>>>>>> Maybe that will help. >>>>>> Hi Alan, >>>>>> >>>>>> the search for the debug keyword in the config directory doesn't >> return >>>>>> any hint. >>>>>> >>>>>> I removed the raddb directory and reinstalled all with make install. >>>>>> Just modified "auth = yes" and enabled the user "bob" from the default >>>>>> configuration: >>>>>> >>>>>> [09:14:22][radius31:/usr/local/freeradius/etc/raddb] #systemctl >> restart >>>>>> radiusd >>>>>> [09:14:26][radius31:/usr/local/freeradius/etc/raddb] #tail -f >>>>>> /var/log/radius/radius.log >>>>>> Fri Apr 14 09:14:26 2017 : Info: Debugger not attached >>>>>> Fri Apr 14 09:14:26 2017 : Warning: >>>>>> [/usr/local/freeradius/etc/raddb/mods-config/attr_filter/ >>>> access_reject]:11 >>>>>> Check item "FreeRADIUS-Response-Delay" found in filter list for >>>>>> realm "DEFAULT". >>>>>> Fri Apr 14 09:14:26 2017 : Warning: >>>>>> [/usr/local/freeradius/etc/raddb/mods-config/attr_filter/ >>>> access_reject]:11 >>>>>> Check item "FreeRADIUS-Response-Delay-USec" found in filter list for >>>>>> realm "DEFAULT". >>>>>> Fri Apr 14 09:14:26 2017 : Info: Loaded virtual server <default> >>>>>> Fri Apr 14 09:14:26 2017 : Warning: Ignoring "sql" (see >>>>>> raddb/mods-available/README.rst) >>>>>> Fri Apr 14 09:14:26 2017 : Warning: Ignoring "ldap" (see >>>>>> raddb/mods-available/README.rst) >>>>>> Fri Apr 14 09:14:26 2017 : Info: Loaded virtual server default >>>>>> Fri Apr 14 09:14:26 2017 : Info: # Skipping contents of 'if' as it is >>>>>> always 'false' -- >>>>>> /usr/local/freeradius/etc/raddb/sites-enabled/inner-tunnel:330 >>>>>> Fri Apr 14 09:14:26 2017 : Info: Loaded virtual server inner-tunnel >>>>>> Fri Apr 14 09:14:26 2017 : Info: Ready to process requests >>>>>> Fri Apr 14 09:14:30 2017 : Auth: (0) Login OK: [bob] (from client >>>>>> localhost port 0) >>>>>> Fri Apr 14 09:14:32 2017 : Auth: (1) Login incorrect (pap: Cleartext >>>>>> password "hellox" does not match "known good" password): [bob] (from >>>>>> client localhost port 0) >>>>>> >>>>>> Freeradius was compiled on CentOS 7 server with: ./configure >>>>>> --prefix=/usr/local/freeradius --enable-static=no --localstatedir=/var >>>>>> --with-docdir=no --with-vmps=no >>>>>> --with-oracle-include-dir=/usr/local/oracle/sdk/include >>>>>> --with-oracle-lib-dir=/usr/local/oracle >>>>>> >>>>>> Any idea on what I can check? >>>>>> >>>>>> Thanks, >>>>>> Andrea >>>>>> >>>>>>> Again, you *should* keep track of your local changes, and you >>>> *should* >>>>>> know what changes you made. >>>>>>> Alan DeKok. >>>>>>> >>>>>>> >>>>>>> - >>>>>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/ >>>>>> list/users.html >>>>>> >>>>>> -- >>>>>> ---------------------------------------------------------------- >>>>>> The box said: 'install on Windows 95, NT 4.0 or better'. So I >> installed >>>> it >>>>>> on Linux. >>>>>> >>>>>> ---------------------------------------------------------------- >>>>>> >>>>>> Ing. Andrea Gabellini >>>>>> Email: andrea.gabellini@telecomitalia.sm >>>>>> Skype: andreagabellini >>>>>> Tel: (+378) 0549 886111 >>>>>> Fax: (+378) 0549 886188 >>>>>> >>>>>> Telecom Italia San Marino S.p.A. >>>>>> Via XXVIII Luglio, 212 - Piano -2 >>>>>> 47893 Borgo Maggiore >>>>>> Republic of San Marino >>>>>> >>>>>> http://www.telecomitalia.sm >>>>>> >>>>>> - >>>>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/ >>>>>> list/users.html >>>>> - >>>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/ >>>> list/users.html >>>> >>>> -- >>>> ---------------------------------------------------------------- >>>> Hardware: The parts of a computer system that can be kicked. >>>> >>>> ---------------------------------------------------------------- >>>> >>>> Ing. Andrea Gabellini >>>> Email: andrea.gabellini@telecomitalia.sm >>>> Skype: andreagabellini >>>> Tel: (+378) 0549 886111 >>>> Fax: (+378) 0549 886188 >>>> >>>> Telecom Italia San Marino S.p.A. >>>> Via XXVIII Luglio, 212 - Piano -2 >>>> 47893 Borgo Maggiore >>>> Republic of San Marino >>>> >>>> http://www.telecomitalia.sm >>>> >>>> - >>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/ >>>> list/users.html >>>> >>> - >>> List info/subscribe/unsubscribe? See http://www.freeradius.org/ >> list/users.html >> >> -- >> ---------------------------------------------------------------- >> The statement below is true. The statement above is false. >> >> ---------------------------------------------------------------- >> >> Ing. Andrea Gabellini >> Email: andrea.gabellini@telecomitalia.sm >> Skype: andreagabellini >> Tel: (+378) 0549 886111 >> Fax: (+378) 0549 886188 >> >> Telecom Italia San Marino S.p.A. >> Via XXVIII Luglio, 212 - Piano -2 >> 47893 Borgo Maggiore >> Republic of San Marino >> >> http://www.telecomitalia.sm >> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/ >> list/users.html > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- ---------------------------------------------------------------- All generalizations are false, including this one. ---------------------------------------------------------------- Ing. Andrea Gabellini Email: andrea.gabellini@telecomitalia.sm Skype: andreagabellini Tel: (+378) 0549 886111 Fax: (+378) 0549 886188 Telecom Italia San Marino S.p.A. Via XXVIII Luglio, 212 - Piano -2 47893 Borgo Maggiore Republic of San Marino http://www.telecomitalia.sm