On Thu, Jun 24, 2021 at 1:55 PM Alan DeKok <aland@deployingradius.com> wrote:
On Jun 24, 2021, at 1:31 PM, Alberto Balsalm <twellborn23@gmail.com> wrote:
I recently updated my secondary RADIUS server from 2.X to 3.0.16. I am running Daloradius with MySQL. I am trying to authenticate through SQL via a user / group / NAS setup on DaloRadius, I receive "(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject" when attempting to authenticate via this secondary server.
You edited configuration and broke the server. Don't do that.
For upgrades, start with the default configuration in v3. Then, gradually make changes to copy over your v2 functionality. See raddb/README.rst for full details.
If you make 15 changes and it doesn't work, you have no idea what's wrong. If you make one change and it goes from working to not working, then you know exactly what's wrong.
My primary RADIUS server is still running a 2.X version of FreeRADIUS and runs its own instance of Daloradius and MySQL. This primary server functions fine and I am able to login via SQL authentication. The configurations for FreeRADIUS, DaloRADIUS, and MySQL are essentially mirrored, with changes being made on the secondary's config to accommodate the update to 3.0.
Changes such as... ?
I started with default 3.0 config, and then added the listening ports to radiusd.conf, enabled the MySQL module in mods-enabled/sql and adjusted the sql module to read clients from the 'nas' table i had created in MySQL, mirroring my previous configuration on 2.0.
Below is my Freeradius -X output for my secondary server. ... } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server
Why did you add this? i.e. you added an empty "server" section in the main radiusd.conf file.
Don't do that. The default virtual server is this one:
After searching through my radiusd.conf, I cannot find any additional server profile section at all. The edits I made to radiusd were adding listen sections, and tweaking a max_requests to match my previous config. I can post my radiusd.conf if needed.
server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default
It looked like you edited that a whole bunch, too.
server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel ... Listening on auth address * port 62502 Listening on acct address * port 62503 Listening on auth address * port 1645 Listening on acct address * port 1646
None of those listeners are bound to a virtual server. So they won't do anything.
Do the listeners need to be bound to a virtual server in order for them to properly pull client / nas info from MySQL? Looking at my 2.0 config, I did not have any virtual servers setup as far as I can tell
Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 42860 Ready to process requests (0) Received Access-Request Id 141 from 10.20.1.1:1645 to 192.168.1.100:62502 length 76 (0) User-Name = "user" (0) User-Password = "userpass" (0) NAS-Port = 1 (0) NAS-Port-Id = "tty1" (0) NAS-Port-Type = Virtual (0) NAS-IP-Address = 10.20.1.1 (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
Yup. They tried to run either no virtual server, or the empty one you added to radiusd.conf.
I don't see the empty server on my radiusd.conf, Is there another place that the debug output would be pulling that from?
PLEASE don't just mangle the heck out of the config and then ask "why doesn't it work".
Instead, do the upgrade slowly, as described above. If you have questions about how to do certain things, ask.
If you want to see how listeners are tied to virtual servers in v3, see raddb/sites-available/README
All of this is extensively documented.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
My next course of action will be to wipe and restart with a fresh FreeRadius install because it seems I have probably mucked something up. Thanks,