On Thu, Apr 24, 2008 at 1:11 PM, <A.L.M.Buxey@lboro.ac.uk> wrote:

...

Ignoring request from unknown client 172.29.11.1:21645

so it doesnt know about the client. but there is an entry in the clients.conf file - did you restart the freeradius process after adding that client?

Yes have i restarted service when i change my clients.conf

you've not sent the full output of radiusd -X either...could you post it...otherwise i have to ask questions like.. is clients.conf being refered to in your radiusd.conf file??are the permissions on clients.conf correct? are you really using clients.conf or is

In radiusd.conf $INCLUDE ${confdir}/clients.conf

your system using NAS list in SQL ?

I using a file with users , i don´t using SQL Here is my full freeradius -X -A output: root@zodiac:/etc/freeradius# freeradius -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 172.29.11.1:21645, id=26, length=123 Ignoring request from unknown client 172.29.11.1:21645 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.29.11.1:21645, id=26, length=123 Ignoring request from unknown client 172.29.11.1:21645 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.29.11.1:21645, id=26, length=123 Ignoring request from unknown client 172.29.11.1:21645 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.29.11.1:21645, id=26, length=123 Ignoring request from unknown client 172.29.11.1:21645 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. -- Xgalaga se disfruta más sobre NetBSD sparc64 Content Rules: ///// \\\/// ///\\\ The Duke of Url. { O--O } / /\ \ \ -- / [||]

On Thu, Apr 24, 2008 at 1:55 PM, <A.L.M.Buxey@lboro.ac.uk> wrote:

Hi,

...

Yes have i restarted service when i change my clients.conf

which clients.conf did you edit? /etc/freeradius/clients.conf ?

Yes and i put on radiusd.conf: $INCLUDE /etc/freeradius/clients.conf To force it to get this file ... -- Xgalaga se disfruta más sobre NetBSD sparc64 Content Rules: ///// \\\/// ///\\\ The Duke of Url. { O--O } / /\ \ \ -- / [||]

2008/4/24 Ivan Kalik <tnt@kalik.net>:

You have mutiple freeradius instalations. radiusd.conf you are editing is not the one installation you are running is using. You most likely have one lot in /usr/local/etc/raddb/ and one somewhere else. You also have two radiusd instances in sbin and it's subfolders. Find out which one do you need to run in order to use configuration files you are editing.

Ivan Kalik Kalik Informatika ISP

I only have one installation and one clients.conf: root@zodiac:/etc/freeradius# find / -iname "radiusd.conf" /etc/freeradius/radiusd.conf root@zodiac:/etc/freeradius# Also I install freeradius in two diferent servers and i get the same error , one with ubuntu and other with debian. I can force which config file use with freeradius in the command line? Thanks. -- Xgalaga se disfruta más sobre NetBSD sparc64 Content Rules: ///// \\\/// ///\\\ The Duke of Url. { O--O } / /\ \ \ -- / [||]

On Thu, Apr 24, 2008 at 4:35 PM, <A.L.M.Buxey@lboro.ac.uk> wrote:

ls -la /etc/freeradius

alan

In clients.conf i put a 744 permsions. root@zodiac:/etc/freeradius# ls -la total 236 drwxr-s--- 3 root freerad 4096 Apr 24 16:38 . drwxr-xr-x 86 root root 4096 Apr 24 12:10 .. -rw-r----- 1 root freerad 422 Aug 6 2006 acct_users -rw-r----- 1 root freerad 3454 Aug 6 2006 attrs drwxr-s--- 3 root freerad 4096 Apr 24 11:08 certs -rwxr--r-- 1 root freerad 3015 Apr 24 16:38 clients.conf -rw-r----- 1 root freerad 929 Aug 6 2006 dictionary -rw-r----- 1 root freerad 9080 Aug 6 2006 eap.conf -rw-r----- 1 root freerad 8266 Aug 6 2006 experimental.conf -rw-r----- 1 root freerad 2396 Aug 6 2006 hints -rw-r----- 1 root freerad 1604 Aug 6 2006 huntgroups -rw-r----- 1 root freerad 2333 Aug 6 2006 ldap.attrmap -rw-r----- 1 root freerad 9330 Aug 6 2006 mssql.conf -rw-r----- 1 root freerad 856 Aug 6 2006 naspasswd -rw-r----- 1 root freerad 12267 Aug 6 2006 oraclesql.conf -rw-r----- 1 root freerad 14156 Aug 6 2006 postgresql.conf -rw-r----- 1 root freerad 531 Aug 6 2006 preproxy_users -rw-r----- 1 root freerad 8862 Aug 6 2006 proxy.conf -rw-r----- 1 root freerad 57856 Apr 24 14:01 radiusd.conf -rw-r----- 1 root freerad 187 Aug 6 2006 realms -rw-r----- 1 root freerad 1405 Aug 6 2006 snmp.conf -rw-r----- 1 root freerad 13892 Aug 6 2006 sql.conf -rw-r----- 1 root freerad 7231 Apr 24 11:12 users -rw-r----- 1 root freerad 7267 Aug 6 2006 x99.conf -rw-r----- 1 root freerad 4165 Aug 6 2006 x99passwd.sample ------------------------------ And i start like Nicolas said with freeradius -A -X -d /etc/freeradius . It it is not working yet. Any other idea? -- Xgalaga se disfruta más sobre NetBSD sparc64 Content Rules: ///// \\\/// ///\\\ The Duke of Url. { O--O } / /\ \ \ -- / [||]

On Thu, Apr 24, 2008 at 5:07 PM, <A.L.M.Buxey@lboro.ac.uk> wrote:

hi,

just a wild stab in the dark.....

172.29.11.1 { secret = mecago shortname = cisco3560 nastype = other }

change that to

172.29.11.1/32 {

secret = mecago shortname = cisco3560 nastype = other }

or

172.29.11.1/0 {

secret = mecago shortname = cisco3560 nastype = other }

Alan , yes is a very wild stab in the dark, i test with 172.29.11.1/0 172.29.11.1/32 172.29.11.0/24 0.0.0.0/0 I´m thinking that it don´t open clients.conf is there any way to put clients on radiusd.conf without including this file. Any other idea? -- Xgalaga se disfruta más sobre NetBSD sparc64 Content Rules: ///// \\\/// ///\\\ The Duke of Url. { O--O } / /\ \ \ -- / [||]

A.L.M.Buxey@lboro.ac.uk wrote:

just a wild stab in the dark.....

172.29.11.1 {

? client 172.29.11.1 { ... } Naming a section by the IP address won't do anything useful. You have to label it a "client" section. Alan DeKok.