Hello everyone. I have a very weird problem with my setup. my clients.conf client 127.0.0.1 { secret = testing123 shortname = Localhost } client 20.20.20.20 { secret = pfsense shortname = pfsense } client 20.20.20.17 { secret = testing shortname = ubuntu } with this setup I can only connect through the pfsense's captive portal when I try to use radtest in both localhost and the remote ubuntu i get a nas not found response I'm using mysql authentication and the debugging output is the following rad_recv: Access-Request packet from host 20.20.20.17 port 55281, id=56, length=67 User-Name = "northpole" User-Password = "1234" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Framed-Protocol = PPP +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "northpole", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 50 [files] expand: /usr/local/bin/rmauth "%{NAS-IP-Address}" "%{User-Name}" "%{Calling-Station-Id}" -> /usr/local/bin/rmauth "127.0.1.1" "northpole" "" ++[files] returns ok [sql] expand: %{User-Name} -> northpole [sql] sql_set_user escaped user --> 'northpole' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'northpole' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'northpole' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'northpole' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request is correct. +- entering group session {...} [sql] expand: %{User-Name} -> northpole [sql] sql_set_user escaped user --> 'northpole' [sql] expand: SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL -> SELECT COUNT(*) FROM radacct WHERE username = 'northpole' AND acctstoptime IS NULL rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok +- entering group post-auth {...} [sqlippool] No Pool-Name defined. [sqlippool] expand: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> No Pool-Name defined (did cli port 1812 user northpole) No Pool-Name defined (did cli port 1812 user northpole) ++[sqlippool] returns noop Exec-Program output: Reply-Message="NAS not found!" Exec-Program-Wait: value-pairs: Reply-Message="NAS not found!" Exec-Program: returned: 1 [exec] Login incorrect (external check said so) ++[exec] returns reject Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> northpole attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 56 to 20.20.20.17 port 55281 Reply-Message = "NAS not found!" Waking up in 4.9 seconds. Cleaning up request 7 ID 56 with timestamp +358 Ready to process requests. what am I missing here?
Check that the firewall in front of your radius server accept 1812 to 1814 tcp connexion. Le mercredi 25 avril 2012 à 13:58 +0300, NorthPole a écrit :
Hello everyone.
I have a very weird problem with my setup.
my clients.conf
client 127.0.0.1 { secret = testing123 shortname = Localhost } client 20.20.20.20 { secret = pfsense shortname = pfsense } client 20.20.20.17 { secret = testing shortname = ubuntu }
with this setup I can only connect through the pfsense's captive portal when I try to use radtest in both localhost and the remote ubuntu i get a nas not found response I'm using mysql authentication and the debugging output is the following
rad_recv: Access-Request packet from host 20.20.20.17 port 55281, id=56, length=67 User-Name = "northpole" User-Password = "1234" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Framed-Protocol = PPP +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "northpole", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 50 [files] expand: /usr/local/bin/rmauth "%{NAS-IP-Address}" "%{User-Name}" "%{Calling-Station-Id}" -> /usr/local/bin/rmauth "127.0.1.1" "northpole" "" ++[files] returns ok [sql] expand: %{User-Name} -> northpole [sql] sql_set_user escaped user --> 'northpole' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'northpole' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'northpole' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'northpole' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request is correct. +- entering group session {...} [sql] expand: %{User-Name} -> northpole [sql] sql_set_user escaped user --> 'northpole' [sql] expand: SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL -> SELECT COUNT(*) FROM radacct WHERE username = 'northpole' AND acctstoptime IS NULL rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok +- entering group post-auth {...} [sqlippool] No Pool-Name defined. [sqlippool] expand: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> No Pool-Name defined (did cli port 1812 user northpole) No Pool-Name defined (did cli port 1812 user northpole) ++[sqlippool] returns noop Exec-Program output: Reply-Message="NAS not found!" Exec-Program-Wait: value-pairs: Reply-Message="NAS not found!" Exec-Program: returned: 1 [exec] Login incorrect (external check said so) ++[exec] returns reject Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> northpole attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 56 to 20.20.20.17 port 55281 Reply-Message = "NAS not found!" Waking up in 4.9 seconds. Cleaning up request 7 ID 56 with timestamp +358 Ready to process requests.
what am I missing here? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 25/04/12 11:58, NorthPole wrote:
with this setup I can only connect through the pfsense's captive portal when I try to use radtest in both localhost and the remote ubuntu i get a nas not found response
You are running an external script, and it is giving the error. Fix the external script.
Exec-Program output: Reply-Message="NAS not found!" Exec-Program-Wait: value-pairs: Reply-Message="NAS not found!" Exec-Program: returned: 1 [exec] Login incorrect (external check said so) ++[exec] returns reject
See? As above...
My worst fear came true... Now I have to find why the custom(?) external script returns errors and the guy who possibly wrote it quit ages ago. I'll need coffee for this. Thank you for the prompt and enlightening response. :-) On Wed, Apr 25, 2012 at 2:20 PM, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 25/04/12 11:58, NorthPole wrote:
with this setup I can only connect through the pfsense's captive portal when I try to use radtest in both localhost and the remote ubuntu i get a nas not found response
You are running an external script, and it is giving the error. Fix the external script.
Exec-Program output: Reply-Message="NAS not found!" Exec-Program-Wait: value-pairs: Reply-Message="NAS not found!" Exec-Program: returned: 1 [exec] Login incorrect (external check said so) ++[exec] returns reject
See? As above...
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
My worst fear came true... Now I have to find why the custom(?) external script returns errors and the guy who possibly wrote it quit ages ago. I'll need coffee for this.
read the script. its likely that it has a list of NAS or queries a DB for a list of NAS. you just need to ensure your NAS is in that list either way alan
In the db the only relevant tables included my nas (ip 20.20.20.17) in which conf file Is defined the path of the external script? On Wed, Apr 25, 2012 at 3:49 PM, alan buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
My worst fear came true... Now I have to find why the custom(?) external script returns errors and the guy who possibly wrote it quit ages ago. I'll need coffee for this.
read the script. its likely that it has a list of NAS or queries a DB for a list of NAS. you just need to ensure your NAS is in that list either way
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Try configure your NAS to set the correct IP address in the access-request packet for the NAS-IP-Address Attribute. This is from your debug output: rad_recv: Access-Request packet from host 20.20.20.17 port 55281, id=56, length=67 User-Name = "northpole" User-Password = "1234" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Framed-Protocol = PPP It seems that your script parses only for the NAS-IP-Address Attribute to identify the NAS and not the source address of the packet itself. Well, just a workaround, you might better fix your script. Regards, Tobias Hachmer
NorthPole wrote:
with this setup I can only connect through the pfsense's captive portal when I try to use radtest in both localhost and the remote ubuntu i get a nas not found response
That message is not part of the default configuration.
[pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead.
That needs to be fixed, too.
Exec-Program output: Reply-Message="NAS not found!" Exec-Program-Wait: value-pairs: Reply-Message="NAS not found!" Exec-Program: returned: 1 [exec] Login incorrect (external check said so)
You're using a "Exec-Program-Wait" check. That program is returning "NAS not found". This is a program on your local machine. Likely one that you wrote. Go fix it, and make sure it works.
what am I missing here?
Reading the debug output helps. The *server* isn't returning a "NAS not found" message. *Your* program is returning it. That's what the debug output says. Once that is clear, the solution is obvious: fix your program. Alan DeKok.
participants (6)
-
alan buxey -
Alan DeKok -
NorthPole -
Phil Mayers -
Tobias Hachmer -
yzy-oui-fi