Initial simple test fails. Ver 3.0.20 from Ubuntu
Dear experts, I'm very sorry for a lame help request but really don't know what else to do. I want to try the simplest setup for some small (embedded) client. So decided to begin with MD5 and username-password. Installed freeradius in Win11 WSL environment, Ubuntu 20.04.6 LTS, via apt install as usual. It brings version 3.0.20. As advised in "getting started" docum, made no changes anywhere besides adding a user and a client. In /etc/freeradius/3/0/users: at beginning: (which is symlnk to mods-config/files/authorize) JIG46 Cleartext-Password := "secret" In /etc/freeradius/3/0/clients.conf: after the existing localhost: client myswitch { ipaddr = 10.183.0.110 secret = testing123 require_message_authenticator = no proto = * nas_type = other } Then started the server on localohst and port 1645 (because the default port appears to be busy): sudo freeradius -X -xx -p 1645 -i localhost Then run : radtest -x -t eap-md5 JIG46 secret localhost:1645 0 testing123 Output: Loading input data... including dictionary file /usr/share/freeradius/dictionaryReading input vps from stdin Read 1 element(s) from input: stdin Loaded: 1 input element(s). Adding new socket: src: 0.0.0.0:0, dst: 127.0.0.1:1645 Added new socket: 5 (num sockets: 1) Transaction: 0, sending packet: 0 (id: 151)... Sent Access-Request Id 151 from 0.0.0.0:59783 to 127.0.0.1:1645 length 69 User-Name = "JIG46" Cleartext-Password = "secret" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 EAP-Code = Response EAP-Type-Identity = 0x4a49473436 EAP-Message = 0x024d000a014a49473436 Timeout for transaction: 0, tries (so far): 1 (max: 3)Transaction: 0, sending packet: 1 (id: 151)... ............ two more tries...... Timeout for transaction: 0, tries (so far): 3 (max: 3)No response for transaction: 0, giving upDeallocating (sockfd: 5, id: 151) Main loop: done. The server refuses to start EAP handshake - I don't see any errors due to unknown usernames or wrong passwords? Exactly the same outcome with a real client (a managed switch, with the client id myswitch, defined above). *** The complete log is here. https://gist.github.com/pavel-a/7b0c0c230ad28627218eade7fb0d1c61 Please advise? Is this because of WSL or something wrong in the configuration?? *** Windows firewall is OFF. - ddbug
CORRECTION: output of radtest is below - please ignore the output in prev. post: radtest -x -t eap-md5 JIG46 secret localhost:1645 0 testing123 Read 1 element(s) from input: stdin Loaded: 1 input element(s). Adding new socket: src: 0.0.0.0:0, dst: 127.0.0.1:1645 Added new socket: 5 (num sockets: 1) Transaction: 0, sending packet: 0 (id: 19)... Sent Access-Request Id 19 from 0.0.0.0:63517 to 127.0.0.1:1645 length 69 User-Name = "JIG46" Cleartext-Password = "secret" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 EAP-Code = Response EAP-Type-Identity = 0x4a49473436 EAP-Message = 0x025c000a014a49473436 failed decoding EAP: EAP-Message not found Transaction: 0, received packet (id: 19). Received Access-Reject Id 19 from 127.0.0.1:1645 to 0.0.0.0:63517 length 20 EAP transaction finished, but reply is not an Access-AcceptDeallocating (sockfd: 5, id: 19) Main loop: done. And on the server side: Sun Aug 13 16:22:52 2023 : Debug: (0) User-Name = "JIG46" Sun Aug 13 16:22:52 2023 : Debug: (0) NAS-IP-Address = 127.0.1.1 Sun Aug 13 16:22:52 2023 : Debug: (0) NAS-Port = 0 Sun Aug 13 16:22:52 2023 : Debug: (0) Message-Authenticator = 0xdc4c794f063de2f5ee2725854b6efc84 Sun Aug 13 16:22:52 2023 : Debug: (0) EAP-Message = 0x025c000a014a49473436 Sun Aug 13 16:22:52 2023 : Debug: (0) session-state: No State attribute Sun Aug 13 16:22:52 2023 : Debug: (0) Empty authorize section. Using default return values. Sun Aug 13 16:22:52 2023 : ERROR: (0) No Auth-Type found: rejecting the user via Post-Auth-Type = Reject Sun Aug 13 16:22:52 2023 : Debug: (0) Failed to authenticate the user Sun Aug 13 16:22:52 2023 : Debug: (0) Using Post-Auth-Type Reject Sun Aug 13 16:22:52 2023 : Debug: (0) Post-Auth-Type sub-section not found. Ignoring. Sun Aug 13 16:22:52 2023 : Debug: (0) Delaying response for 1.000000 seconds Sun Aug 13 16:22:52 2023 : Debug: Waking up in 0.3 seconds. Sun Aug 13 16:22:53 2023 : Debug: Waking up in 0.6 seconds. Sun Aug 13 16:22:53 2023 : Debug: (0) Sending delayed response Sun Aug 13 16:22:53 2023 : Debug: (0) Sent Access-Reject Id 19 from 127.0.0.1:1645 to 127.0.0.1:63517 length 20 -ddbug
On Aug 13, 2023, at 9:25 AM, Pavel Aronsky <pavel.aronsky@gmail.com> wrote:
CORRECTION: output of radtest is below - please ignore the output in prev. post:
There's a whole lot going on here. Most of it is addressed in the documentation. What we need when posting quesitons to the list: http://wiki.freeradius.org/list-help Note: "radtest" output isn't useful. "freeradius -Xxxxxxxxxxxx" isn't useful. How to read the output of "freeradius -X": http://wiki.freeradius.org/radiusd-X How to make changes to the configuration files: "man freeradius". Hint: Making massive changes to the configuration files isn't a good idea. My recommendations: * use the packages from http://packages.networkradius.com There is no reason to use a version of the server which is 4 years old. Updated packages are available, and are free. * run the server in debug mode as suggested by ALL of the documentation. Including the email you get when you join the list. * if you can't start the server in debug mode because "port is in use", then there is already a server running. See the OS documentation for how to stop background daemons. * Make SMALL changes to the configuration files, and test them. See the "man" page for details.
... Sun Aug 13 16:22:52 2023 : Debug: (0) Empty authorize section. Using default return values.
That should be a hint. Because you started the server using a different IP and port than what's in the configuration files, it's not using the "default" virtual server. So stop the server (service freeradius stop, or whatever your OS uses). Then run it in debug mode: freeradius -X It *will* work. Alan DeKok.
Thank you a lot, Alan DeKok, you've pointed exactly to the error.
Because you started the server using a different IP and port than what's in the configuration files, it's not using the "default" virtual server.
When started the server without -i and -p parameters, the radtest test passes and my external client works too. With both v. 3.2.x and 3.0.20. Could someone point me to documentation on how to change the default port? As the -p option must go with -i we have to specify the interface, even if it is localhost. When I start the server with default port, as: freeradius -X -i 127.0.0.1 -p 1812 or freeradius -X -i localhost -p 1812 the radtest test fails. A comment in sites-available/default : "The server ignore all "listen" section if you are using '-i' and '-p' # on the command line." suggests that command line options have preference - but instead nothing works at all. With all respect, this does not meet the "least surprise to the user" principle. --
On Aug 16, 2023, at 5:41 AM, Pavel Aronsky <pavel.aronsky@gmail.com> wrote:
When started the server without -i and -p parameters, the radtest test passes and my external client works too. With both v. 3.2.x and 3.0.20.
Could someone point me to documentation on how to change the default port?
Read sites-available/default The ports are defined there.
suggests that command line options have preference - but instead nothing works at all. With all respect, this does not meet the "least surprise to the user" principle.
Sure. We're happy to accept a patch to fix this behavior. Alan DeKok.
participants (2)
-
Alan DeKok -
Pavel Aronsky