radtest No "known good" password
Have done much Googling/Binging, cant find a similar situation. Debian 11. Installed with apt-get install freeradius freeradius-mysql freeradius-utils. Added to /etc/freeradius/mods-config/files/authorize: testing Cleartext-Password := password During that process I had to create the folder /etc/freeradius/mods-config/files, it was not already present. Naturally due to this, the authorize file is empty other than the one line I added. Then I: radtest testing password 127.0.0.1 0 testing123 Outputs are: On Terminal A: Sent Access-Request Id 29 from 0.0.0.0:53848 to 127.0.0.1:1812 length 77 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "password" Received Access-Reject Id 29 from 127.0.0.1:1812 to 127.0.0.1:53848 length 20 (0) -: Expected Access-Accept got Access-Reject Debug from Terminal B: (8) Received Access-Request Id 29 from 127.0.0.1:53848 to 127.0.0.1:1812 length 77 (8) User-Name = "testing" (8) User-Password = "password" (8) NAS-IP-Address = 127.0.1.1 (8) NAS-Port = 0 (8) Message-Authenticator = 0xbf1bb85fcdf0c1a4fbc4c65ff5c466b0 (8) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /@\./) { (8) if (&User-Name =~ /@\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "testing", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) eap: No EAP-Message, not doing EAP (8) [eap] = noop (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (8) pap: WARNING: Authentication will fail unless a "known good" password is available (8) [pap] = noop (8) } # authorize = ok (8) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (8) Failed to authenticate the user (8) Using Post-Auth-Type Reject (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (8) Post-Auth-Type REJECT { (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> testing (8) attr_filter.access_reject: Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated (8) [eap] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 29 from 127.0.0.1:1812 to 127.0.0.1:53848 length 20 Waking up in 3.9 seconds. (8) Cleaning up request packet ID 29 with timestamp +2957 Random thought: is the MySQL package making FreeRadius expect a different configuration method? I thought it was required to install but Im not using any MySQL as far as I know, Im doing a very basic setup, authorizing some Cisco vIOS routers/switches. Im probably missing something fairly obvious. Please help? -- Tristan Henderson Network Support Engineer <mailto:thenderson@system.de> thenderson@system.de system.de System & Project GmbH Knesebeckstr. 96, 10623 Berlin <http://www.system.de/> www.system.de T +49 30 2902315 350 F +49 30 2902315 440 Amtsgericht Berlin-Charlottenburg: HRB 53740 Geschäftsführer: Peter Schulte, Wilhelm Boeddinghaus Think before you print!
Sorry, I’m not sure I know what you mean? It’s copied directly from wiki.freeradius.org/guide/Getting-Started under Initial Tests. Do you mean the quotation marks themselves? In the file they are in-fact "password" not “password.” Von: Josef Vybíhal <josef.vybihal@gmail.com> Gesendet: Thursday, August 10, 2023 12:52 An: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Cc: thenderson@system.de Betreff: Re: radtest No "known good" password Those are not correct string quotes. Can you re-check? On Thu, Aug 10, 2023 at 12:11 PM Tristan via Freeradius-Users <freeradius-users@lists.freeradius.org <mailto:freeradius-users@lists.freeradius.org> > wrote: testing Cleartext-Password := “password”
Thanks for your help Matthew. Installed the Network RADISU packages and authorize file is installed the expected location now (and is populated with the default settings). However, now when I try freeradius -X, I get: FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including configuration file /etc/freeradius/radiusd.conf Unable to open file "/etc/freeradius/radiusd.conf": No such file or directory Errors reading or parsing /etc/freeradius/radiusd.conf I can confirm there is radiusd.conf inside /etc/freeradius/3.0/ but not inside /etc/freeradius where it is looking….instead of copying everything over, is there a way to get it to look at the /3.0/ folder instead of one directory higher? Von: Josef Vybíhal <josef.vybihal@gmail.com> Gesendet: Thursday, August 10, 2023 12:52 An: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Cc: thenderson@system.de Betreff: Re: radtest No "known good" password Those are not correct string quotes. Can you re-check? On Thu, Aug 10, 2023 at 12:11 PM Tristan via Freeradius-Users <freeradius-users@lists.freeradius.org <mailto:freeradius-users@lists.freeradius.org> > wrote: testing Cleartext-Password := “password”
On Aug 10, 2023, at 8:43 AM, Tristan via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Thanks for your help Matthew. Installed the Network RADISU packages and authorize file is installed the expected location now (and is populated with the default settings).
I would double-check the that you don't have the old configuration files still around. That is a recipe for disaster.
However, now when I try freeradius -X, I get: ... including configuration file /etc/freeradius/radiusd.conf
Unable to open file "/etc/freeradius/radiusd.conf": No such file or directory
That's pretty clear.
Errors reading or parsing /etc/freeradius/radiusd.conf
I can confirm there is radiusd.conf inside /etc/freeradius/3.0/ but not inside /etc/freeradius where it is looking….instead of copying everything over, is there a way to get it to look at the /3.0/ folder instead of one directory higher?
The packages don't over-write existing configuration files. You've installed multiple different packages, and therefore have multiple different configuration files in /etc/freeradius. Don't do this. Remove all of /etc/freeradius. Then, re-install the Network RADIUS packages. Then verify that the configuration files exist in /etc/freeradius. Alan DeKok.
Thanks Alan … things were getting really weird, even after removing/purging etc … started from a fresh Debian image and now everything is working correctly, successful Access-Accept. Von: thenderson@system.de <thenderson@system.de> Gesendet: Thursday, August 10, 2023 14:44 An: 'mcn@freeradius.org' <mcn@freeradius.org>; 'FreeRadius users mailing list' <freeradius-users@lists.freeradius.org> Betreff: radtest No "known good" password Thanks for your help Matthew. Installed the Network RADISU packages and authorize file is installed the expected location now (and is populated with the default settings). However, now when I try freeradius -X, I get: FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including configuration file /etc/freeradius/radiusd.conf Unable to open file "/etc/freeradius/radiusd.conf": No such file or directory Errors reading or parsing /etc/freeradius/radiusd.conf I can confirm there is radiusd.conf inside /etc/freeradius/3.0/ but not inside /etc/freeradius where it is looking….instead of copying everything over, is there a way to get it to look at the /3.0/ folder instead of one directory higher? Von: Josef Vybíhal <josef.vybihal@gmail.com <mailto:josef.vybihal@gmail.com> > Gesendet: Thursday, August 10, 2023 12:52 An: FreeRadius users mailing list <freeradius-users@lists.freeradius.org <mailto:freeradius-users@lists.freeradius.org> > Cc: thenderson@system.de <mailto:thenderson@system.de> Betreff: Re: radtest No "known good" password Those are not correct string quotes. Can you re-check? On Thu, Aug 10, 2023 at 12:11 PM Tristan via Freeradius-Users <freeradius-users@lists.freeradius.org <mailto:freeradius-users@lists.freeradius.org> > wrote: testing Cleartext-Password := “password”
On Aug 10, 2023, at 6:11 AM, Tristan via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
During that process I had to create the folder /etc/freeradius/mods-config/files, it was not already present.
That should be your first hint that something is wrong. When you install the server, the configuration directories are created. So you don't need to create them yourself. Since you created them yourself, this means that: * the server is reading its files from directory A * you put files into directory B And then you're wondering why the server isn't reading the files you created.
Outputs are:
On Terminal A:
ALL of the documentation says to post the output of "radiusd -X". We don't need to see the output of radclient. It doesn't help.
Debug from Terminal B:
(8) Received Access-Request Id 29 from 127.0.0.1:53848 to 127.0.0.1:1812 length 77
ALL of the documentation says to post the debug output. ALL OF IT. http://wiki.freeradius.org/radiusd-X Specifically: https://wiki.freeradius.org/guide/radiusd-X#startup-text_modules The server tells you which configuration files it is reading. The example in the documentation even shows which files the "files" module is reading.
I’m probably missing something fairly obvious. Please help?
Follow the documentation. Read the debug output. See what files it is reading. Then... edit those files. Not some random other one that you created. Alan DeKok.
On 10/08/2023 11:11, Tristan via Freeradius-Users wrote:
Debian 11. Installed with apt-get install freeradius freeradius-mysql freeradius-utils.
Debian put their config in a non-standard location. As Alan said, read the "freeradius -X" debug output, it will tell you where it's reading the files from. You probably either want /etc/freeradius/3.0/mods-config/files/authorize Or install the Network RADIUS packages which use the expected location: https://packages.networkradius.com/ -- Matthew
participants (4)
-
Alan DeKok -
Josef Vybíhal -
Matthew Newton -
thenderson＠system.de