Hello I have interesting problems with freeradius authentication. NAS - cisco 2801 radius - freeradius running on freebsd with mysql db. I had a lot of such errors in radius.log: Auth: Login incorrect (rlm_pap: CRYPT password check failed): [1-102/D\014\003\222\374\267<z\013y\005\200\354S\373\344] (from client plaza port 0) In debug output i get "unprintable characters". In the same time authentication was working fine from other hosts, for example smtp server. Problem was solved in interesting way, on cisco i specified radius source interface. It was working fine until mysql server crashed and i got same garbage in authentication. I removed source radius interface from cisco configuration and everything started to work fine again. Any ideas?
Edgars Makņa wrote:
Hello I have interesting problems with freeradius authentication. NAS - cisco 2801 radius - freeradius running on freebsd with mysql db. I had a lot of such errors in radius.log: Auth: Login incorrect (rlm_pap: CRYPT password check failed): [1-102/D\014\003\222\374\267<z\013y\005\200\354S\373\344] (from client plaza port 0) In debug output i get "unprintable characters".
Then the shared secret is wrong.
In the same time authentication was working fine from other hosts, for example smtp server.
The shared secret is different for each host.
Problem was solved in interesting way, on cisco i specified radius source interface.
Which changes the IP address seen by the server, meaning it uses a different shared secret.
It was working fine until mysql server crashed and i got same garbage in authentication. I removed source radius interface from cisco configuration and everything started to work fine again. Any ideas?
You mistyped something in MySQL, started RADIUS, noticed a problem, and then re-started both MySQL and RADIUS. Alan DeKok.
No, shared secret was not wrong, for this case i used "special" secret, on both hosts in configuration - 1 From one works, from other no. Nothing more was changed. Alan DeKok wrote:
Edgars Makņa wrote:
Hello I have interesting problems with freeradius authentication. NAS - cisco 2801 radius - freeradius running on freebsd with mysql db. I had a lot of such errors in radius.log: Auth: Login incorrect (rlm_pap: CRYPT password check failed): [1-102/D\014\003\222\374\267<z\013y\005\200\354S\373\344] (from client plaza port 0) In debug output i get "unprintable characters".
Then the shared secret is wrong.
In the same time authentication was working fine from other hosts, for example smtp server.
The shared secret is different for each host.
Problem was solved in interesting way, on cisco i specified radius source interface.
Which changes the IP address seen by the server, meaning it uses a different shared secret.
It was working fine until mysql server crashed and i got same garbage in authentication. I removed source radius interface from cisco configuration and everything started to work fine again. Any ideas?
You mistyped something in MySQL, started RADIUS, noticed a problem, and then re-started both MySQL and RADIUS.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Edgars Makņa wrote:
No, shared secret was not wrong, for this case i used "special" secret, on both hosts in configuration - 1 From one works, from other no. Nothing more was changed.
(a) the shared secret is wrong (b) the client is buggy (c) the client really is sending a garbage password Alan DeKok.
a) not possible b) with client you mean cisco or end user? c) not possible Alan DeKok wrote:
Edgars Makņa wrote:
No, shared secret was not wrong, for this case i used "special" secret, on both hosts in configuration - 1 From one works, from other no. Nothing more was changed.
(a) the shared secret is wrong (b) the client is buggy (c) the client really is sending a garbage password
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Edgars Makņa wrote:
a) not possible b) with client you mean cisco or end user?
RADIUS client.
c) not possible
<shrug> Then I guess the problem isn't happening. When you said that it doesn't work with one IP, but does work with the other, that means that the shared secrets are wrong. They're wrong on the Cisco end, or in FreeRADIUS. There isn't much else that can cause those problems. This isn't magic. There are always a very small number of causes for such problems. a) it's magic (transient memory fault, etc.) b) someone mis-typed a shared secret Which one is more likely? Alan DeKok.
Nobbody changed that secret. it's same for both hosts. cisco iso is an almost freshest version. Ok, will try to dig in the cisco-nas mailing list Alan DeKok wrote:
Edgars Makņa wrote:
a) not possible b) with client you mean cisco or end user?
RADIUS client.
c) not possible
<shrug>
Then I guess the problem isn't happening.
When you said that it doesn't work with one IP, but does work with the other, that means that the shared secrets are wrong. They're wrong on the Cisco end, or in FreeRADIUS. There isn't much else that can cause those problems.
This isn't magic. There are always a very small number of causes for such problems.
a) it's magic (transient memory fault, etc.) b) someone mis-typed a shared secret
Which one is more likely?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Edgars Makņa