Authorization failed in cisco switch
Hi All i am getting some problem with authorization in free radius i configured the users file as below : DEFAULT Auth-Type := System cisco Auth-Type := System Service-Type = NAS-Prompt-User cisco-avpair = "shell:priv-lvl=15", When i try to login into a switch i receive the errore : Authorization Failed and during the debug i ve got : # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [++[reply_log] returns ok ++[exec] returns noop Can someone help me? thanks Marco Aresu
Marco Aresu wrote:
i am getting some problem with authorization in free radius i configured the users file as below :
DEFAULT Auth-Type := System cisco Auth-Type := System Service-Type = NAS-Prompt-User cisco-avpair = "shell:priv-lvl=15",
Is it *exactly* that? i.e. did you format the entries correctly?
When i try to login into a switch i receive the errore : Authorization Failed and during the debug i ve got :
# Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [++[reply_log] returns ok ++[exec] returns noop
You have rather a lot more than that. The whole point of the debug output is to READ IT. ALL of it. What ELSE does it say? Does the server return an Access-Accept? If so, blame the switch. Otherwise, READ THE DEBUG OUTPUT to see what's going on. Alan DeKok.
here the debug after authentication: Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "secret" [pap] Using CRYPT password "$6$GW4SlOPp$TZhPalub.qyMY8Z9zU03FMz3A.hSv0b6ycuZT5bYeyG89HPb2Gm/FINd2pdtU79NkgYhE5TUgp5e5/w6iNA40/" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 70 to 172.31.61.224 port 1812 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 70 with timestamp +12 Ready to process requests. i don't understand when he tried to find the authorizaziont because if i add a comment in the row of the user in the Users file, i get the same error. Marco Aresu On 22 July 2013 16:37, Alan DeKok <aland@deployingradius.com> wrote:
Marco Aresu wrote:
i am getting some problem with authorization in free radius i configured the users file as below :
DEFAULT Auth-Type := System cisco Auth-Type := System Service-Type = NAS-Prompt-User cisco-avpair = "shell:priv-lvl=15",
Is it *exactly* that? i.e. did you format the entries correctly?
When i try to login into a switch i receive the errore : Authorization Failed and during the debug i ve got :
# Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [++[reply_log] returns ok ++[exec] returns noop
You have rather a lot more than that.
The whole point of the debug output is to READ IT.
ALL of it.
What ELSE does it say? Does the server return an Access-Accept? If so, blame the switch. Otherwise, READ THE DEBUG OUTPUT to see what's going on.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Marco Aresu wrote:
here the debug after authentication:
If you're not going to follow instructions, you shouldn't be posting questions on this list. Since you're not willing to post the full debug output here, we can't help you. Go read it yourself.
i don't understand when he tried to find the authorizaziont because if i add a comment in the row of the user in the Users file, i get the same error.
If only there was some way for you to figure out what the server was doing. Like maybe a debug mode? That would be wonderful. Alan DeKok.
the only file to edit for the authorization is the Users file? thanks Marco Marco Aresu On 22 July 2013 17:03, Alan DeKok <aland@deployingradius.com> wrote:
Marco Aresu wrote:
here the debug after authentication:
If you're not going to follow instructions, you shouldn't be posting questions on this list.
Since you're not willing to post the full debug output here, we can't help you. Go read it yourself.
i don't understand when he tried to find the authorizaziont because if i add a comment in the row of the user in the Users file, i get the same error.
If only there was some way for you to figure out what the server was doing. Like maybe a debug mode?
That would be wonderful.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mon, Jul 22, 2013 at 04:44:29PM +0200, Marco Aresu wrote:
here the debug after authentication:
Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "secret" [pap] Using CRYPT password "$6$GW4SlOPp$TZhPalub.qyMY8Z9zU03FMz3A.hSv0b6ycuZT5bYeyG89HPb2Gm/FINd2pdtU79NkgYhE5TUgp5e5/w6iNA40/" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 70 to 172.31.61.224 port 1812 ...
The RADIUS server sent an Access-Accept. That means that if you still can't get in, it's the switch that has the problem. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
i created two users on freeradius server and when i tried to login with the new user that is not specify in the USERS file i ve got the same error "Authorization Failed" I think that i am editing the wrong USERS file but the directory is "/etc/raddb/users" Marco Aresu On 22 July 2013 17:19, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Mon, Jul 22, 2013 at 04:44:29PM +0200, Marco Aresu wrote:
here the debug after authentication:
Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "secret" [pap] Using CRYPT password
"$6$GW4SlOPp$TZhPalub.qyMY8Z9zU03FMz3A.hSv0b6ycuZT5bYeyG89HPb2Gm/FINd2pdtU79NkgYhE5TUgp5e5/w6iNA40/"
[pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 70 to 172.31.61.224 port 1812 ...
The RADIUS server sent an Access-Accept. That means that if you still can't get in, it's the switch that has the problem.
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, you sending the wrong attributes or your switchconfig is not correct. The switch needs for authorization only these two attributes: Service-Type := Login Cisco-AVPair := "shell:priv-lvl=15" And this is the working aaa config: aaa new-model aaa authentication login default group radius local aaa authorization exec default group radius local radius-server host 192.168.17.50 auth-port 1812 acct-port 1813 key 0 testing123 that's working on a WS-C2960-24TC-L with C2960 Software (C2960-LANBASEK9-M), Version 12.2(55)SE best regards, Max
On Mon, Jul 22, 2013 at 04:27:30PM +0200, Marco Aresu wrote:
i am getting some problem with authorization in free radius i configured the users file as below :
DEFAULT Auth-Type := System cisco Auth-Type := System Service-Type = NAS-Prompt-User cisco-avpair = "shell:priv-lvl=15",
If all you want is enable mode after login then send just Service-Type := Administrative-User and don't send the cisco-avpair at all. mk
now i can logon into the switch but i can with all USERS. Where i can specify who can access to the switch? I add a rown in the USERS file "user Auth-Type := Reject" but nothing change. thanks Marco Marco Aresu On 23 July 2013 10:06, Martin Kraus <lists_mk@wujiman.net> wrote:
On Mon, Jul 22, 2013 at 04:27:30PM +0200, Marco Aresu wrote:
i am getting some problem with authorization in free radius i configured the users file as below :
DEFAULT Auth-Type := System cisco Auth-Type := System Service-Type = NAS-Prompt-User cisco-avpair = "shell:priv-lvl=15",
If all you want is enable mode after login then send just
Service-Type := Administrative-User
and don't send the cisco-avpair at all.
mk - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Tue, Jul 23, 2013 at 03:12:33PM +0200, Marco Aresu wrote:
now i can logon into the switch but i can with all USERS. Where i can specify who can access to the switch? I add a rown in the USERS file "user Auth-Type := Reject" but nothing change.
The first match wins in users file unless the entry also has Fall-Through := Yes so you need to have something like username1 Service-Type := Administrative-User username2 Service-Type := Administrative-User DEFAULT Auth-Type := Reject mk
participants (5)
-
Alan DeKok -
Backs Max -
Marco Aresu -
Martin Kraus -
Matthew Newton