Re: Issue with radius accounting
I am not interested in any argument, i wanted to check what may be the problem with my radius server as accounting is successful with free radius on other server. On May 26, 2013 6:51 AM, <freeradius-users-request@lists.freeradius.org> wrote:
Send Freeradius-Users mailing list submissions to freeradius-users@lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request@lists.freeradius.org
You can reach the person managing the list at freeradius-users-owner@lists.freeradius.org
When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re: Issue with radius accounting (Alan DeKok) 2. user from particular NAS-IP-Address (Pete Ashdown) 3. Re: user from particular NAS-IP-Address (Alan DeKok) 4. Error: rlm_sql_unixodbc: SQL down 08S01 [unixODBC][FreeTDS][SQL Server]Unable to connect: Adaptive Server is unavailable or does not exist (Bill Grant) 5. Re: Error: rlm_sql_unixodbc: SQL down 08S01 [unixODBC][FreeTDS][SQL Server]Unable to connect: Adaptive Server is unavailable or does not exist (Alan DeKok) 6. RE: Error: rlm_sql_unixodbc: SQL down 08S01 [unixODBC][FreeTDS][SQL Server]Unable to connect: Adaptive Server is unavailable or does not exist (Bill Grant) 7. Re: Auth-Type = Reject not being obeyed (Matthew Melbourne)
----------------------------------------------------------------------
Message: 1 Date: Sat, 25 May 2013 13:30:57 -0400 From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Cc: "freeradius-users@lists.freeradius.org" <freeradius-users@lists.freeradius.org> Subject: Re: Issue with radius accounting Message-ID: <B66BB339-4B2C-4608-BB8F-8C6E35F02481@deployingradius.com> Content-Type: text/plain; charset="us-ascii"
On 2013-05-25, at 12:39 PM, Arvind Bahuguni <arvindnb1@gmail.com> wrote:
Hi Alan, I am suspecting some radius setting on my server because free radius on other server is responding and authentication and accounting is successful
For one, you need to edit your posts. It's ridiculous to reply to a digest message, and include hundreds of lines of irrelevant text.
And if you know so much more than me about RADIUS, you shouldn't be asking questions on this list.
If you're going to ask questions and then argue with the answers, you will be unsubscribed from the list and banned permanently.
Alan DeKok.
Hi,
I am not interested in any argument, i wanted to check what may be the problem with my radius server as accounting is successful with free radius on other server.
..and as per response to emails you are sending me directly, this is nothing to do with the RADIUS server config. if a RADIUS server doesnt get accounting packets from a NAS then is an issue of the NAS - why do you believe that the NAS would send accounting packets to BOTH NASs ? a NAS will usually use just one RADIUS server and only use the next one if it gets no response (eg for auth) from the RADIUS server. alan
Arvind Bahuguni wrote:
I am not interested in any argument, i wanted to check what may be the problem with my radius server as accounting is successful with free radius on other server.
You were given an answer. You could have believed it, or asked a clarifying question. Instead, you argued with the answer. And then insisted you weren't arguing. You can continue to post *more* questions, just not the same ones. If you post one more message arguing about it, you will be unsubscribed and banned. If you post one more reply containing hundreds of lines of useless text, you will be unsubscribed and banned. It's really not hard. Follow instructions, and you *will* fix the problem. That's what this list is for. This list is *not* for people who refuse to follow instructions. They will be unsubscribed and banned. This is your last warning. Alan DeKok.
Hi All I am ready for an earbending likely from Alan but for the record I have read the debug and done as much searching as my brain can handle before this post I am setting up free radius 2.2.0 on two Ubuntu Servers server12 (192.168.0.92) and server13 (192.168.0.93). So far I have installed latest freeradius version 2.2.0 on each server and added a test user in the file users: username = user1 password = secret I have the added each machine as a client of the other for testing in clients.conf they both have the shared secret aaabbb With the following testing command on server12 (192.168.0.92) ( echo "User-Name = \"user1\""; \ echo "Cleartext-Password = \"secret\""; \ echo "EAP-Code = Response"; \ echo "EAP-Id = 210"; \ echo "EAP-Type-Identity = \"user1\""; \ echo "Message-Authenticator = 0x00"; ) | \ radeapclient -x 192.168.0.93 auth aaabbb I see on that same machine the following output Sending Access-Request packet to host 192.168.0.93 port 1812, id=125, length=0 User-Name = "user1" Cleartext-Password = "secret" EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = 0x7573657231 Message-Authenticator = 0x00 EAP-Message = 0x02d2000a017573657231 Received Access-Challenge packet from host 192.168.0.93 port 1812, id=125, length=80 EAP-Message = 0x01d300160410b96bc21423da6e34055a25bd522be5f4 Message-Authenticator = 0x0881b25f760ebcfb4a9e2a6fc18ee4e1 State = 0x79e3295879302d94ae994e3671a52576 EAP-Id = 211 EAP-Code = Request EAP-Type-MD5-Challenge = 0x10b96bc21423da6e34055a25bd522be5f4 Sending Access-Request packet to host 192.168.0.93 port 1812, id=126, length=57 User-Name = "user1" Cleartext-Password = "secret" EAP-Code = Response EAP-Id = 211 Message-Authenticator = 0x00000000000000000000000000000000 EAP-Type-MD5-Challenge = 0x10a6ecf77fb2601ce855274efb4523b6d7 State = 0x79e3295879302d94ae994e3671a52576 EAP-Message = 0x02d300160410a6ecf77fb2601ce855274efb4523b6d7 rad_verify: Received packet from 192.168.0.93 with invalid Message-Authenticator! (Shared secret is incorrect.) I have server13 (192.168.0.93) running in debug and its out put is below. It seems to end by successfully sending Sending Access-Accept of id 126 to 192.168.0.92 port 40535 Admittedly for some reason (?timing) there seems to be a duplicate rad_recv: Access-Request packet from host 192.168.0.92 port 40535, id=126, length=87 but it too is ultimately accepted Sending duplicate reply to client server12 port 40535 - ID: 126 Sending Access-Accept of id 126 to 192.168.0.92 port 40535 How do I reconcile this is it working or not (Sub question why are there two requests?) Debuging output from server13 (192.168.0.93) server13:~$ cat /tmp/debug.txt FreeRADIUS Version 2.2.0, for host i686-pc-linux-gnu, built on Apr 29 2013 at 12:57:54 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/counter including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/detail.example.com including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/dhcp_sqlippool including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/sqlcounter_expire_on_login including configuration file /etc/freeradius/mods-enabled/ippool including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/attr_rewrite including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/wimax including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/cache including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/cui including configuration file /etc/freeradius/mods-enabled/perl including configuration file /etc/freeradius/mods-enabled/ldap including configuration file /etc/freeradius/mods-enabled/radrelay including configuration file /etc/freeradius/mods-enabled/policy including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/smsotp including configuration file /etc/freeradius/mods-enabled/checkval including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/etc_group including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/redis including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/smbpasswd including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/otp including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/mac2vlan including configuration file /etc/freeradius/mods-enabled/mac2ip including configuration file /etc/freeradius/mods-enabled/acct_unique including configuration file /etc/freeradius/mods-enabled/inner-eap including configuration file /etc/freeradius/mods-enabled/krb5 including configuration file /etc/freeradius/mods-enabled/rediswho including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/sql_log including configuration file /etc/freeradius/mods-enabled/pam including configuration file /etc/freeradius/mods-enabled/opendirectory including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client server12 { ipaddr = 192.168.0.92 netmask = 32 require_message_authenticator = no secret = "aaabbb" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/mods-enabled/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/mods-enabled/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/mods-enabled/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/mods-enabled/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/mods-enabled/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 50043 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.92 port 40535, id=125, length=57 User-Name = "user1" Message-Authenticator = 0x7db7801ac036b755a1f837e5f569d423 EAP-Message = 0x02d2000a017573657231 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 210 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry user1 at line 173 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 125 to 192.168.0.92 port 40535 EAP-Message = 0x01d300160410b96bc21423da6e34055a25bd522be5f4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x79e3295879302d94ae994e3671a52576 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.92 port 40535, id=125, length=57 Sending duplicate reply to client server12 port 40535 - ID: 125 Sending Access-Challenge of id 125 to 192.168.0.92 port 40535 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.92 port 40535, id=126, length=87 User-Name = "user1" Message-Authenticator = 0xe3405f0eb17fbb3e31b973ea45563b7b State = 0x79e3295879302d94ae994e3671a52576 EAP-Message = 0x02d300160410a6ecf77fb2601ce855274efb4523b6d7 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 211 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry user1 at line 173 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 126 to 192.168.0.92 port 40535 EAP-Message = 0x03d30004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user1" Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.92 port 40535, id=126, length=87 Sending duplicate reply to client server12 port 40535 - ID: 126 Sending Access-Accept of id 126 to 192.168.0.92 port 40535 Waking up in 4.9 seconds. Cleaning up request 0 ID 125 with timestamp +16 Cleaning up request 1 ID 126 with timestamp +16 Ready to process requests.
it seems like you are using EAP authenication, if you are a new bee to freeradius, i will suggest you to do PAP authentication first, because it is easier and state forword. EAP is a complex techniqe to authenticate the users. you can find simple tutorials on PAP authentication of freeradius. On Mon, May 27, 2013 at 9:54 AM, Elizabeth Fife <fifeeliz1@hotmail.com>wrote:
Hi All I am ready for an earbending likely from Alan but for the record I have read the debug and done as much searching as my brain can handle before this post
I am setting up free radius 2.2.0 on two Ubuntu Servers server12 (192.168.0.92) and server13 (192.168.0.93). So far I have installed latest freeradius version 2.2.0 on each server and added a test user in the file users: username = user1 password = secret
I have the added each machine as a client of the other for testing in clients.conf they both have the shared secret aaabbb
With the following testing command on server12 (192.168.0.92) ( echo "User-Name = \"user1\""; \ echo "Cleartext-Password = \"secret\""; \ echo "EAP-Code = Response"; \ echo "EAP-Id = 210"; \ echo "EAP-Type-Identity = \"user1\""; \ echo "Message-Authenticator = 0x00"; ) | \ radeapclient -x 192.168.0.93 auth aaabbb
I see on that same machine the following output Sending Access-Request packet to host 192.168.0.93 port 1812, id=125, length=0 User-Name = "user1" Cleartext-Password = "secret" EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = 0x7573657231 Message-Authenticator = 0x00 EAP-Message = 0x02d2000a017573657231 Received Access-Challenge packet from host 192.168.0.93 port 1812, id=125, length=80 EAP-Message = 0x01d300160410b96bc21423da6e34055a25bd522be5f4 Message-Authenticator = 0x0881b25f760ebcfb4a9e2a6fc18ee4e1 State = 0x79e3295879302d94ae994e3671a52576 EAP-Id = 211 EAP-Code = Request EAP-Type-MD5-Challenge = 0x10b96bc21423da6e34055a25bd522be5f4 Sending Access-Request packet to host 192.168.0.93 port 1812, id=126, length=57 User-Name = "user1" Cleartext-Password = "secret" EAP-Code = Response EAP-Id = 211 Message-Authenticator = 0x00000000000000000000000000000000 EAP-Type-MD5-Challenge = 0x10a6ecf77fb2601ce855274efb4523b6d7 State = 0x79e3295879302d94ae994e3671a52576 EAP-Message = 0x02d300160410a6ecf77fb2601ce855274efb4523b6d7 rad_verify: Received packet from 192.168.0.93 with invalid Message-Authenticator! (Shared secret is incorrect.)
I have server13 (192.168.0.93) running in debug and its out put is below. It seems to end by successfully sending Sending Access-Accept of id 126 to 192.168.0.92 port 40535
Admittedly for some reason (?timing) there seems to be a duplicate rad_recv: Access-Request packet from host 192.168.0.92 port 40535, id=126, length=87 but it too is ultimately accepted Sending duplicate reply to client server12 port 40535 - ID: 126 Sending Access-Accept of id 126 to 192.168.0.92 port 40535
How do I reconcile this is it working or not
(Sub question why are there two requests?)
Debuging output from server13 (192.168.0.93)
server13:~$ cat /tmp/debug.txt FreeRADIUS Version 2.2.0, for host i686-pc-linux-gnu, built on Apr 29 2013 at 12:57:54 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/counter including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/ detail.example.com including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/dhcp_sqlippool including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/sqlcounter_expire_on_login including configuration file /etc/freeradius/mods-enabled/ippool including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/attr_rewrite including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/wimax including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/cache including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/cui including configuration file /etc/freeradius/mods-enabled/perl including configuration file /etc/freeradius/mods-enabled/ldap including configuration file /etc/freeradius/mods-enabled/radrelay including configuration file /etc/freeradius/mods-enabled/policy including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/smsotp including configuration file /etc/freeradius/mods-enabled/checkval including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/etc_group including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/redis including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/smbpasswd including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/otp including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/mac2vlan including configuration file /etc/freeradius/mods-enabled/mac2ip including configuration file /etc/freeradius/mods-enabled/acct_unique including configuration file /etc/freeradius/mods-enabled/inner-eap including configuration file /etc/freeradius/mods-enabled/krb5 including configuration file /etc/freeradius/mods-enabled/rediswho including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/sql_log including configuration file /etc/freeradius/mods-enabled/pam including configuration file /etc/freeradius/mods-enabled/opendirectory including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client server12 { ipaddr = 192.168.0.92 netmask = 32 require_message_authenticator = no secret = "aaabbb" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/mods-enabled/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/mods-enabled/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/mods-enabled/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/mods-enabled/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/mods-enabled/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 50043 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.92 port 40535, id=125, length=57 User-Name = "user1" Message-Authenticator = 0x7db7801ac036b755a1f837e5f569d423 EAP-Message = 0x02d2000a017573657231 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 210 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry user1 at line 173 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 125 to 192.168.0.92 port 40535 EAP-Message = 0x01d300160410b96bc21423da6e34055a25bd522be5f4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x79e3295879302d94ae994e3671a52576 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.92 port 40535, id=125, length=57 Sending duplicate reply to client server12 port 40535 - ID: 125 Sending Access-Challenge of id 125 to 192.168.0.92 port 40535 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.92 port 40535, id=126, length=87 User-Name = "user1" Message-Authenticator = 0xe3405f0eb17fbb3e31b973ea45563b7b State = 0x79e3295879302d94ae994e3671a52576 EAP-Message = 0x02d300160410a6ecf77fb2601ce855274efb4523b6d7 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 211 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry user1 at line 173 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 126 to 192.168.0.92 port 40535 EAP-Message = 0x03d30004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user1" Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.92 port 40535, id=126, length=87 Sending duplicate reply to client server12 port 40535 - ID: 126 Sending Access-Accept of id 126 to 192.168.0.92 port 40535 Waking up in 4.9 seconds. Cleaning up request 0 ID 125 with timestamp +16 Cleaning up request 1 ID 126 with timestamp +16 Ready to process requests.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Best Regards Muhammad Nadeem Muhammad Ali Jinnah University
Elizabeth Fife wrote:
I am ready for an earbending likely from Alan but for the record I have read the debug and done as much searching as my brain can handle before this post
You'll not that I get cranky when people *don't* follow instructions. You have followed them. So clearly you're a wonderful person.
I have the added each machine as a client of the other for testing in clients.conf they both have the shared secret aaabbb
Which should work. In short, the server gets an Access-Request and processes it. The client doesn't like the reply. Both Access-Request and Access-Challenge contain Message-Authenticator. The server processes the Access-Request *only* when the Message-Authenticator is correct. Which in turn depends on the shared secret. So the shared secret is the same on both ends. But, the client doesn't like the reply from the server. Which has a Message-Authenticator created using the same secret. I'm not really sure what to suggest here. This kind of thing should *never* happen. Did you install both servers from apt-get? Alan DeKok.
Both servers were installed from apt-get which presently gives you freeradius version 2.1.12 for ubuntu 13.04 servers I used apt-get -y install freeradius freeradius-common freeradius-mysql freeradius-utils freeradius-ldap libfreeradius2 (and apt-get -y install mysql-client mysql-server apt-get -y install php5 php-pear php5-gd php-DB) When this did not work I then upgraded to the latest version 2.2.0 using PPA I used add-apt-repository ppa:freeradius/stable apt-get -y update upgrade PS if it helps radtest user1 secret 192.168.0.93 1812 aaabbb works BUT Output received in response is TWO consecutive rad_recv: Access-Accept packet FOllOWED by one radclient: received response to request we did not send PPS
You'll not that I get cranky when people *don't* follow instructions. You have followed them. So clearly you're a wonderful person.
Praise from Cesar :)
Date: Mon, 27 May 2013 09:20:53 -0400 From: aland@deployingradius.com To: freeradius-users@lists.freeradius.org Subject: Re: Testing failure during setup
Elizabeth Fife wrote:
I am ready for an earbending likely from Alan but for the record I have read the debug and done as much searching as my brain can handle before this post
You'll not that I get cranky when people *don't* follow instructions. You have followed them. So clearly you're a wonderful person.
I have the added each machine as a client of the other for testing in clients.conf they both have the shared secret aaabbb
Which should work.
In short, the server gets an Access-Request and processes it. The client doesn't like the reply.
Both Access-Request and Access-Challenge contain Message-Authenticator. The server processes the Access-Request *only* when the Message-Authenticator is correct. Which in turn depends on the shared secret.
So the shared secret is the same on both ends.
But, the client doesn't like the reply from the server. Which has a Message-Authenticator created using the same secret.
I'm not really sure what to suggest here. This kind of thing should *never* happen.
Did you install both servers from apt-get?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I have not edited or altered proxy.conf It currently has the following format with only active lines shown (I removed commented lines for ease of viewing.) # Proxy server configuration proxy server { default_fallback = no } home_server localhost { type = auth ipaddr = 127.0.0.1 port = 1812 secret = testing123 require_message_authenticator = yes response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 max_outstanding = 65536 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } PS Mohammed -if it helps i already used radtest user1 secret 192.168.0.93 1812 aaabbb and it works BUT The output received following that command in response is TWO consecutive rad_recv: Access-Accept packet.... FOllOWED by ONE radclient: received response to request we did not send.... From: fifeeliz1@hotmail.com To: freeradius-users@lists.freeradius.org Subject: RE: Testing failure during setup Date: Mon, 27 May 2013 18:47:31 +0000 Both servers were installed from apt-get which presently gives you freeradius version 2.1.12 for ubuntu 13.04 servers I used apt-get -y install freeradius freeradius-common freeradius-mysql freeradius-utils freeradius-ldap libfreeradius2 (and apt-get -y install mysql-client mysql-server apt-get -y install php5 php-pear php5-gd php-DB) When this did not work I then upgraded to the latest version 2.2.0 using PPA I used add-apt-repository ppa:freeradius/stable apt-get -y update upgrade PS if it helps radtest user1 secret 192.168.0.93 1812 aaabbb works BUT Output received in response is TWO consecutive rad_recv: Access-Accept packet FOllOWED by one radclient: received response to request we did not send PPS
You'll not that I get cranky when people *don't* follow instructions. You have followed them. So clearly you're a wonderful person.
Praise from Cesar :)
Date: Mon, 27 May 2013 09:20:53 -0400 From: aland@deployingradius.com To: freeradius-users@lists.freeradius.org Subject: Re: Testing failure during setup
Elizabeth Fife wrote:
I am ready for an earbending likely from Alan but for the record I have read the debug and done as much searching as my brain can handle before this post
You'll not that I get cranky when people *don't* follow instructions. You have followed them. So clearly you're a wonderful person.
I have the added each machine as a client of the other for testing in clients.conf they both have the shared secret aaabbb
Which should work.
In short, the server gets an Access-Request and processes it. The client doesn't like the reply.
Both Access-Request and Access-Challenge contain Message-Authenticator. The server processes the Access-Request *only* when the Message-Authenticator is correct. Which in turn depends on the shared secret.
So the shared secret is the same on both ends.
But, the client doesn't like the reply from the server. Which has a Message-Authenticator created using the same secret.
I'm not really sure what to suggest here. This kind of thing should *never* happen.
Did you install both servers from apt-get?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Elizabeth Fife wrote:
Both servers were installed from apt-get which presently gives you freeradius version 2.1.12 for ubuntu 13.04 servers
Well, it *should* work. I don't recall ever seeing this issue before.
PS if it helps radtest user1 secret 192.168.0.93 1812 aaabbb works
Because it's not sending a Message-Authenticator, I think.
BUT Output received in response is TWO consecutive rad_recv: Access-Accept packet FOllOWED by one radclient: received response to request we did not send
That's just weird. Alan DeKok.
FYI -as this was odd though you would like to know Given the debug out put and packet collection results the anomouls behavior during radius authentication of wifi users was in your mind and mine - clearly the fault of the access-point (either in configuration or "hardware"). The radius servers were conversely clearly not at fault. Cisco TAC eventually agreed and sent a replacement - the replacement worked perfectly with the same configuration and without alteration to the radius server settings - meaning odd behavior was "hardware" failure. Thanks to those who thought on this
Date: Mon, 27 May 2013 09:20:53 -0400 From: aland@deployingradius.com To: freeradius-users@lists.freeradius.org Subject: Re: Testing failure during setup
Elizabeth Fife wrote:
I am ready for an earbending likely from Alan but for the record I have read the debug and done as much searching as my brain can handle before this post
You'll not that I get cranky when people *don't* follow instructions. You have followed them. So clearly you're a wonderful person.
I have the added each machine as a client of the other for testing in clients.conf they both have the shared secret aaabbb
Which should work.
In short, the server gets an Access-Request and processes it. The client doesn't like the reply.
Both Access-Request and Access-Challenge contain Message-Authenticator. The server processes the Access-Request *only* when the Message-Authenticator is correct. Which in turn depends on the shared secret.
So the shared secret is the same on both ends.
But, the client doesn't like the reply from the server. Which has a Message-Authenticator created using the same secret.
I'm not really sure what to suggest here. This kind of thing should *never* happen.
Did you install both servers from apt-get?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Arvind Bahuguni -
Elizabeth Fife -
Muhammad Nadeem