Re: Freeradius as a proxy to Windows IAS - not solved after all :-(
Hi everyone Thanks for all the help and advice so far :-) I have installed freeradius 1.1.7 and get the appended message when I try to use it as a proxy between a Linux/Moodle/PHP radius client and a Windows IAS server. The shared secrets are definitely the same. The Linux/Moodle/PHP radius client authenticates directly with the Windows IAS server without any problems, but it will not authenticate with the freeradius proxy in between! I need a working freeradius proxy. Help... Clive Sending Access-Request of id 0 to 10.200.0.2 port 1812 NAS-Identifier = "vle.bromley.ac.uk" NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "127.0.0.1" User-Name = "cliveg@staff.bromley.local" MS-CHAP2-Response = removed from message MS-CHAP-Challenge = removed from message NAS-IP-Address = 10.200.0.14 Proxy-State = 0x3832 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 10.200.0.2:1812, id=0, length=235 Received Access-Accept packet from client 10.200.0.2 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) Dropping packet without response.
Hi,
Windows IAS server. The shared secrets are definitely the same.
i would beg to say they arent. have you double checked the shared secrets for both ends of the link ie linux VLE <-----> FR proxy <-------> IAS 1 2 need to check the client and server shared secrets for both 1 and 2 so VLE client/server relationship with FR and FR relationship with IAS alan
Clive Gould said:
I have installed freeradius 1.1.7 and get the appended message when I try to use it as a proxy between a Linux/Moodle/PHP radius client and a Windows IAS server. The shared secrets are definitely the same.
[snip]
Received Access-Accept packet from client 10.200.0.2 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) Dropping packet without response.
Have you actually retyped the secret in FR (or better yet, copy and paste from your Moodle config) and restarted the service? Sometimes our eyes can deceive us, and even on close inspection, we can see what we expect to see, not what is actually there. Have you tried running a 'radclient' test by hand from the FR box to IAS, copying and pasting the secret onto the command line from your FR config? BTW, in an earlier email you said:
I do not have physical access to the IAS server and cannot change it's shared secret
How are you actually checking the secret on IAS? I haven't run IAS for a looong time ... does it have a way of verifying a shared secret for a client? For instance, in Funk's SBRNT there is a 'verify' button, that lets you type (or paste) the secret in a modal dialog and it'll tell you if you have it right or not. Last idea ... do you have spaces in the secret? I'm not sure how FR would handle that, i.e. might it require quotes around the secret in clients.conf? -- hugh
Hugh Messenger wrote:
Clive Gould said:
I have installed freeradius 1.1.7 and get the appended message when I try to use it as a proxy between a Linux/Moodle/PHP radius client and a Windows IAS server. The shared secrets are definitely the same.
[snip]
Received Access-Accept packet from client 10.200.0.2 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) Dropping packet without response.
Have you actually retyped the secret in FR (or better yet, copy and paste from your Moodle config) (check for trailing spaces) :) and restarted the service? Sometimes our eyes can deceive us, and even on close inspection, we can see what we expect to see, not what is actually there.
Moodle as in the VLE (Virtual Learning Environment) ? Didn't know that supported RADIUS Authentication.. It's most likely that they've used the authentication framework classes from the pecl repository, and I know for a fact that , that uses the standard RADIUS extension which works just fine ... If you want I've got a very simple php RADIUS auth class you can test with your proxy server just to make sure it's not a bug in Moodle, mangling up strings from the configuration database or some other weird Moodle thing..
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Arran Cudbard-Bell -
Clive Gould -
Hugh Messenger