Hi Guys I am new to Freeradius and have got it working with Mysql , however run into an issue whereby I am seeing this for all requests rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [chrisk/password] (from client seccom port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> chrisk attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Can anyone help or let me know what other info may be required Thanks
Chris Kilian wrote:
I am new to Freeradius and have got it working with Mysql , however run into an issue whereby I am seeing this for all requests
rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this.
This is in the FAQ. Set up a sample user in the "users" file. Alan DeKok.
hi, you havent given the full debug...so its pretty much guesswork here with whats going wrong.. have you added the sql to the authorize section of your server? (uncomment the entry thats commented by default) are you using EAP etc? in which case you will also need to uncomment it in the inner-tunnel server. alan
Hi I believe that I have setup the FR configs correctly for use with MYSQL, I got it all working just fine when using a flat file and was able to authenticate etc with no issues, since moving to SQL I am getting this. rad_recv: Access-Request packet from host 10.5.5.55 port 57593, id=3, length=46 User-Name = "chrisk" User-Password = "user-password" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "chrisk", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop expand: %{User-Name} -> chrisk rlm_sql (sql): sql_set_user escaped user --> 'chrisk' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'chrisk' ORDER BY id expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'chrisk' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): User chrisk not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [chrisk/user-password] (from client seccom port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> chrisk attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 3 to 10.5.5.55 port 57593 So it appears that its using pap right? The database is very minimal and Im not sure if that's the issue, All I am needing to do is have user authenticate based on username and password IM not worried about anything other than that. Its for auth from a web server Thanks -----Original Message----- From: freeradius-users-bounces+chris.kilian=seccomglobal.com@lists.freeradius.org [mailto:freeradius-users-bounces+chris.kilian=seccomglobal.com@lists.freeradius.org] On Behalf Of Alan Buxey Sent: Tuesday, 1 March 2011 9:03 PM To: FreeRadius users mailing list Subject: Re: Free Radius Issues hi, you havent given the full debug...so its pretty much guesswork here with whats going wrong.. have you added the sql to the authorize section of your server? (uncomment the entry thats commented by default) are you using EAP etc? in which case you will also need to uncomment it in the inner-tunnel server. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, Mar 2, 2011 at 5:48 AM, Chris Kilian <chris.kilian@seccomglobal.com> wrote:
Hi
I believe that I have setup the FR configs correctly for use with MYSQL,
How did you determine that you have set it up CORRECTLY?
I got it all working just fine when using a flat file and was able to authenticate etc with no issues, since moving to SQL I am getting this.
... cause that would be the first indication that you didn't set it up correctly :)
rad_recv: Access-Request packet from host 10.5.5.55 port 57593, id=3, length=46 User-Name = "chrisk" User-Password = "user-password" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "chrisk", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop expand: %{User-Name} -> chrisk rlm_sql (sql): sql_set_user escaped user --> 'chrisk' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'chrisk' ORDER BY id expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'chrisk' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): User chrisk not found
start with that line. "User chrisk not found". What happens when you execute those select statements manually on MySQL? SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'chrisk' ORDER BY id SELECT groupname FROM usergroup WHERE username = 'chrisk' ORDER BY priority
The database is very minimal and Im not sure if that's the issue,
There's nothing wrong with having a minimal setup if you get it to work correctly. What IS wrong is if you take a quick look at the schema/configs, decide on a whim that some sections/parts are not needed, remove them, and complain when it didn't work. raddb/sql.conf, raddb/sql/mysql/dialup.conf, raddb/sql/mysql/schema.sql, and doc/rlm_sql.gz should provide a good place to start. -- Fajar
participants (4)
-
Alan Buxey -
Alan DeKok -
Chris Kilian -
Fajar A. Nugraha