Running Freeradius in k8s - No reply from server while the server refuses the auth client
I am trying to deploy a simple freeradius server in an on-prem k8s cluster. Here is my configuration Clients file: root@freeradius-6c7c4d8f68-6x9rg:/# cat /etc/raddb/clients.conf client all { ipaddr = 0.0.0.0 netmask = 0 proto = * secret = testing123 nas_type = other require_message_authenticator = no shortname = all limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Users file: root@freeradius-6c7c4d8f68-6x9rg:/# cat /etc/raddb/users testuser Cleartext-Password := "testing1234" Reply-Message := "Hello, %{User-Name}" otheruser Cleartext-Password := "blahblah" Reply-Message := "Hello, %{User-Name}" radiusd.conf: root@freeradius-6c7c4d8f68-6x9rg:/# cat /etc/raddb/radiusd.conf log { destination = files file = /var/log/freeradius/radius.log syslog_facility = daemon } listen { type = auth ipaddr = * port = 1812 } listen { type = acct ipaddr = * port = 1813 } listen { type = control socket = /etc/freeradius/control.sock mode = rw } Test output: $ radtest testuser testing1234 radius.myk8s.local:1812 0 testing123 Sent Access-Request Id 158 from 0.0.0.0:38170 to 10.1.6.66:1812 length 78 User-Name = "testuser" User-Password = "testing1234" NAS-IP-Address = 192.168.1.128 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "testing1234" Sent Access-Request Id 158 from 0.0.0.0:38170 to 10.1.6.66:1812 length 78 User-Name = "testuser" User-Password = "testing1234" NAS-IP-Address = 192.168.1.128 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "testing1234" Sent Access-Request Id 158 from 0.0.0.0:38170 to 10.1.6.66:1812 length 78 User-Name = "testuser" User-Password = "testing1234" NAS-IP-Address = 192.168.1.128 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "testing1234" (0) No reply from server for ID 158 socket 3 Server logs: Listening on auth address * port 1812 Listening on acct address * port 1813 Listening on command file /etc/freeradius/control.sock Ready to process requests Ignoring request to auth address * port 1812 from unknown client 10.1.148.201 port 55669 proto udp Ready to process requests Ignoring request to auth address * port 1812 from unknown client 10.1.148.201 port 55669 proto udp Ready to process requests Ignoring request to auth address * port 1812 from unknown client 10.1.148.201 port 55669 proto udp Ready to process requests What am I missing?
On Feb 26, 2025, at 11:26 AM, Dan Yasny <dyasny@gmail.com> wrote:
I am trying to deploy a simple freeradius server in an on-prem k8s cluster.
Here is my configuration
Why? https://wiki.freeradius.org/list-help When you join the mailing list, you get an email asking you to read that page, and follow the instructions.
Test output:
$ radtest testuser testing1234 radius.myk8s.local:1812 0 testing123
You can't debug the server by looking at the client.
Server logs:
Listening on auth address * port 1812 Listening on acct address * port 1813
In which almost everything useful has been deleted.
What am I missing?
Read the documentation. Post the debug output. ALL OF IT. Or, read the debug output. It will print out the list of clients it's loading. My guess is that it doesn't print out the "client all" definition. Which means that client definition isn't being used, and the server is correct to say "unknown client". Alan DeKok.
participants (2)
-
Alan DeKok -
Dan Yasny