18 Apr
2017
18 Apr
'17
2:48 a.m.
Hi Alan, my problem is not what is going on. I'm forcing an error. My problem is why I get some debug errors in the log when the server is not running in debug mode. Andrea Il 14/04/2017 16:42, Alan Buxey ha scritto: > you are not - you are getting some of the stuff that gets logged. the > reason for 2 outputs is varied but usually seen with EAP tunneled methods > and the reaaon > for the auth failure AFTER things look okay is usually due to things like > failure for the server to log the event (in which case an error is seen and > the server > will reject the user). if you run in full debug mode then you will get > the full pucture of what is happening....and you've been told this many > times. just runt he server in full debug mode (radiusd -X) see what is > going on. fix it, THEN run it in production mode, there is no other > sensible way to proceed. > > alan > > On 14 April 2017 at 10:21, Andrea Gabellini < > andrea.gabellini@telecomitalia.sm> wrote: > >> Hi, >> >> the problem is the (0) and (1) in the log. I think this is the packet >> number. Using eap with wrong username or password logs some debug output >> (see previous posts). Alan DeKok says that this is a debug log, but >> radiusd isn't running debug mode. >> >> So the question is: why I got a debug output if the server is running >> without it? >> >> Thanks, >> Andrea >> >> Il 14/04/2017 11:03, Alan Buxey ha scritto: >>> hi, >>> >>> this is just the output of the standard freeradius logfile - which gives >>> you some basic info (with log_auth enabled) . >>> >>> you need to be looking at the output when you run the server in full >> debug >>> mode: >>> >>> radiusd -X >>> or >>> freeradiusd -X (if you're on debian/ubuntu builds) >>> >>> (and yes, thats just one big uppercase X) - as that will tell you >> exactly >>> what is happening and why something doesnt work. >>> >>> if this is a vanilla install with no local confidential stuff etc then >>> theres no reason to not post the output in full to the list - there will >> be >>> one or 2 obvious things >>> >>> >>> alan >>> >>> On 14 April 2017 at 08:19, Andrea Gabellini < >>> andrea.gabellini@telecomitalia.sm> wrote: >>> >>>> Il 13/04/2017 13:18, Alan DeKok ha scritto: >>>>> On Apr 13, 2017, at 3:41 AM, Andrea Gabellini <andrea.gabellini@ >>>> telecomitalia.sm> wrote: >>>>>> the server doesn't have any extra options: >>>>> <shrug> The server doesn't magically start printing all debug >>>> messages to the log file. >>>>> You've made some change in your local configuration to cause this to >>>> happen. Find it, and fix it. >>>>> $ cd /etc/raddb >>>>> $ grep -r debug . >>>>> >>>>> Maybe that will help. >>>> Hi Alan, >>>> >>>> the search for the debug keyword in the config directory doesn't return >>>> any hint. >>>> >>>> I removed the raddb directory and reinstalled all with make install. >>>> Just modified "auth = yes" and enabled the user "bob" from the default >>>> configuration: >>>> >>>> [09:14:22][radius31:/usr/local/freeradius/etc/raddb] #systemctl restart >>>> radiusd >>>> [09:14:26][radius31:/usr/local/freeradius/etc/raddb] #tail -f >>>> /var/log/radius/radius.log >>>> Fri Apr 14 09:14:26 2017 : Info: Debugger not attached >>>> Fri Apr 14 09:14:26 2017 : Warning: >>>> [/usr/local/freeradius/etc/raddb/mods-config/attr_filter/ >> access_reject]:11 >>>> Check item "FreeRADIUS-Response-Delay" found in filter list for >>>> realm "DEFAULT". >>>> Fri Apr 14 09:14:26 2017 : Warning: >>>> [/usr/local/freeradius/etc/raddb/mods-config/attr_filter/ >> access_reject]:11 >>>> Check item "FreeRADIUS-Response-Delay-USec" found in filter list for >>>> realm "DEFAULT". >>>> Fri Apr 14 09:14:26 2017 : Info: Loaded virtual server <default> >>>> Fri Apr 14 09:14:26 2017 : Warning: Ignoring "sql" (see >>>> raddb/mods-available/README.rst) >>>> Fri Apr 14 09:14:26 2017 : Warning: Ignoring "ldap" (see >>>> raddb/mods-available/README.rst) >>>> Fri Apr 14 09:14:26 2017 : Info: Loaded virtual server default >>>> Fri Apr 14 09:14:26 2017 : Info: # Skipping contents of 'if' as it is >>>> always 'false' -- >>>> /usr/local/freeradius/etc/raddb/sites-enabled/inner-tunnel:330 >>>> Fri Apr 14 09:14:26 2017 : Info: Loaded virtual server inner-tunnel >>>> Fri Apr 14 09:14:26 2017 : Info: Ready to process requests >>>> Fri Apr 14 09:14:30 2017 : Auth: (0) Login OK: [bob] (from client >>>> localhost port 0) >>>> Fri Apr 14 09:14:32 2017 : Auth: (1) Login incorrect (pap: Cleartext >>>> password "hellox" does not match "known good" password): [bob] (from >>>> client localhost port 0) >>>> >>>> Freeradius was compiled on CentOS 7 server with: ./configure >>>> --prefix=/usr/local/freeradius --enable-static=no --localstatedir=/var >>>> --with-docdir=no --with-vmps=no >>>> --with-oracle-include-dir=/usr/local/oracle/sdk/include >>>> --with-oracle-lib-dir=/usr/local/oracle >>>> >>>> Any idea on what I can check? >>>> >>>> Thanks, >>>> Andrea >>>> >>>>> Again, you *should* keep track of your local changes, and you >> *should* >>>> know what changes you made. >>>>> Alan DeKok. >>>>> >>>>> >>>>> - >>>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/ >>>> list/users.html >>>> >>>> -- >>>> ---------------------------------------------------------------- >>>> The box said: 'install on Windows 95, NT 4.0 or better'. So I installed >> it >>>> on Linux. >>>> >>>> ---------------------------------------------------------------- >>>> >>>> Ing. Andrea Gabellini >>>> Email: andrea.gabellini@telecomitalia.sm >>>> Skype: andreagabellini >>>> Tel: (+378) 0549 886111 >>>> Fax: (+378) 0549 886188 >>>> >>>> Telecom Italia San Marino S.p.A. >>>> Via XXVIII Luglio, 212 - Piano -2 >>>> 47893 Borgo Maggiore >>>> Republic of San Marino >>>> >>>> http://www.telecomitalia.sm >>>> >>>> - >>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/ >>>> list/users.html >>> - >>> List info/subscribe/unsubscribe? See http://www.freeradius.org/ >> list/users.html >> >> -- >> ---------------------------------------------------------------- >> Hardware: The parts of a computer system that can be kicked. >> >> ---------------------------------------------------------------- >> >> Ing. Andrea Gabellini >> Email: andrea.gabellini@telecomitalia.sm >> Skype: andreagabellini >> Tel: (+378) 0549 886111 >> Fax: (+378) 0549 886188 >> >> Telecom Italia San Marino S.p.A. >> Via XXVIII Luglio, 212 - Piano -2 >> 47893 Borgo Maggiore >> Republic of San Marino >> >> http://www.telecomitalia.sm >> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/ >> list/users.html >> > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- ---------------------------------------------------------------- The statement below is true. The statement above is false. ---------------------------------------------------------------- Ing. Andrea Gabellini Email: andrea.gabellini@telecomitalia.sm Skype: andreagabellini Tel: (+378) 0549 886111 Fax: (+378) 0549 886188 Telecom Italia San Marino S.p.A. Via XXVIII Luglio, 212 - Piano -2 47893 Borgo Maggiore Republic of San Marino http://www.telecomitalia.sm