Hello, I was running FreeRadius version 2.1.1 on Fedora Core 4. This worked fine, using a vanilla configuration with perhaps a dozen users defined. Due to a hard disk crash we had to replace our radius server PC. Our newer PC is running Fedora Core 21. We then downloaded the FreeRadius 3.0.8 tar.gz file, built and installed it. We now cannot get past the following errors (in bold below). We have tried reconfiguring the shared secret as suggested, on the server (editing the clients.conf file and retyping the secret) and the client side but still get these errors. In the 2.1.1 version, the only files we changed were "radiusd.conf", "clients.conf" and "users" and added our own dictionary file. So for 3.0.8, we followed suit. Any assistance would be most appreciated. Thanks, Phil Partial output from running radiusd -X: I have attached the entire output. Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 54743 Ready to process requests (0) Received Access-Request Id 24 from 10.242.135.17:1026 to 10.242.135.10:1812 length 68 (0) MRV-Remote-Access-List = 'gina' (0) MRV-Outlet-Group-Access-List = ' ???' (0) MRV-Login-Mode = ' (0) NAS-Port-Type = Virtual (0) MRV-Port-Access-List = '^????D???a????S?' (0) MRV-Menu-Name = ' (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (!&User-Name) { (0) if (!&User-Name) -> TRUE (0) if (!&User-Name) { (0) [noop] = noop (0) } # if (!&User-Name) = noop (0) if (&User-Name =~ / /) { (0) ERROR: Failed retrieving values required to evaluate condition (0) if (&User-Name =~ /@.*@/<mailto:/@.*@/> ) { (0) ERROR: Failed retrieving values required to evaluate condition (0) if (&User-Name =~ /\.\./ ) { (0) ERROR: Failed retrieving values required to evaluate condition (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))<mailto:/@(.+)\.(.+)$/))> { (0) ERROR: Failed retrieving values required to evaluate condition (0) if (&User-Name =~ /\.$/) { (0) ERROR: Failed retrieving values required to evaluate condition (0) if (&User-Name =~ /@\./<mailto:/@\./>) { (0) ERROR: Failed retrieving values required to evaluate condition (0) } # policy filter_username = noop (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "gina", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry gina at line 128 (0) [files] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: ERROR: Cleartext password does not match "known good" password (0) pap: Passwords don't match (0) [pap] = reject (0) } # Auth-Type PAP = reject (0) Failed to authenticate the user (0) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! (0) Using Post-Auth-Type Reject (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> (0) [attr_filter.access_reject] = noop (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = noop (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) <delay>: Sending delayed response (0) <delay>: Sent Access-Reject Id 24 from 10.242.135.10:1812 to 10.242.135.17:1026 length 20 Waking up in 3.9 seconds. (0) <delay>: Cleaning up request packet ID 24 with timestamp +19 Ready to process requests Phil Bellino Principal Software Engineer | MRV Communications Inc. 300 Apollo Drive | Chelmsford, MA 01824 Phone: 978-674-6870 | Fax: 978-674-6799 www.mrv.com [MRV-email] [E-Banner]<http://www.mrv.com/landing/video-datasheet-mrvs-optidriver-platform> MRV Communications is a global supplier of packet and optical solutions that power the world's largest networks. Our products combine innovative hardware with intelligent software to make networks smarter, faster and more efficient. The contents of this message, together with any attachments, are intended only for the use of the person(s) to whom they are addressed and may contain confidential and/or privileged information. If you are not the intended recipient, immediately advise the sender, delete this message and any attachments and note that any distribution, or copying of this message, or any attachment, is prohibited.
On May 14, 2015, at 3:40 PM, Philip Bellino <pbellino@mrv.com> wrote:
Due to a hard disk crash we had to replace our radius server PC. Our newer PC is running Fedora Core 21. We then downloaded the FreeRadius 3.0.8 tar.gz file, built and installed it. We now cannot get past the following errors (in bold below). We have tried reconfiguring the shared secret as suggested, on the server (editing the clients.conf file and retyping the secret) and the client side but still get these errors.
I think you've broken something.
In the 2.1.1 version, the only files we changed were "radiusd.conf", "clients.conf" and "users" and added our own dictionary file. So for 3.0.8, we followed suit.
What did you put into the dictionary file?
Ready to process requests (0) Received Access-Request Id 24 from 10.242.135.17:1026 to 10.242.135.10:1812 length 68 (0) MRV-Remote-Access-List = 'gina' (0) MRV-Outlet-Group-Access-List = ' ???' (0) MRV-Login-Mode = ' (0) NAS-Port-Type = Virtual (0) MRV-Port-Access-List = '^????D???a????S?' (0) MRV-Menu-Name = '
What are those attributes? They are NOT standard RADIUS attributes. There is no User-Name in the packet, which is typically required. There is no User-Password in the packet, which is also typically required.
(0) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS!
That message is printed ONLY if there's a User-Password in the attribute. So.. .you've done something, and broken the server. The short answer is "don't do that". Go back to the default configuration. i.e. back out ALL of your local changes. Check that you can get users authenticated, by adding a Cleartext-Password for that user. Check that it works with radtest. Then, make another change. You've fallen into the trap of "make 100 changes, and then something doesn't work". You'll never get it debugged doing that. Make ONE change. Test it. Make ANOTHER change. Test it. This is all documented in "man radiusd". And post your dictionary here. Odds are it poaches on the standard space, and breaks all of RADIUS. Alan DeKok.
Alan, Your points are well taken. Thank you. We commented out using including our dictionary.mrv file (attached) in dictionary and references to our attributes in the users file and now Radius authentication succeeds. Here is an entry in the users file that used our attributes successfully in freeradius 2.1.1 ################################### # MRV Vender Specific Testing ################################### zeusCleartext-Password := "dog" Service-Type == NAS-Prompt-User, Idle-Timeout == 60, MRV-Login-Mode == "cli", MRV-Security-Level == "outlet shell", MRV-Command-Logging == "syslog", MRV-Audit-Logging == "syslog", MRV-User-Prompt == "zeus", MRV-Menu-Name == "/config/M_demo_menu", MRV-Web-Menu-Name == "/config/M_demo_menu", MRV-Port-Access-List == "2 4", MRV-Remote-Access-List == "telnet", MRV-Outlet-Access-List == "3:1 4:1", MRV-Outlet-Group-Access-List == "2" If you can point me in the right direction with regards to what I need to change to use our dictionary attributes, I would appreciate it. Thanks again, Phil -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+pbellino=mrv.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, May 14, 2015 4:02 PM To: FreeRadius users mailing list Subject: Re: Help with Radius errors On May 14, 2015, at 3:40 PM, Philip Bellino <pbellino@mrv.com> wrote:
Due to a hard disk crash we had to replace our radius server PC. Our newer PC is running Fedora Core 21. We then downloaded the FreeRadius 3.0.8 tar.gz file, built and installed it. We now cannot get past the following errors (in bold below). We have tried reconfiguring the shared secret as suggested, on the server (editing the clients.conf file and retyping the secret) and the client side but still get these errors.
I think you've broken something.
In the 2.1.1 version, the only files we changed were "radiusd.conf", "clients.conf" and "users" and added our own dictionary file. So for 3.0.8, we followed suit.
What did you put into the dictionary file?
Ready to process requests (0) Received Access-Request Id 24 from 10.242.135.17:1026 to 10.242.135.10:1812 length 68 (0) MRV-Remote-Access-List = 'gina' (0) MRV-Outlet-Group-Access-List = ' ???' (0) MRV-Login-Mode = ' (0) NAS-Port-Type = Virtual (0) MRV-Port-Access-List = '^????D???a????S?' (0) MRV-Menu-Name = '
What are those attributes? They are NOT standard RADIUS attributes. There is no User-Name in the packet, which is typically required. There is no User-Password in the packet, which is also typically required.
(0) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS!
That message is printed ONLY if there's a User-Password in the attribute. So.. .you've done something, and broken the server. The short answer is "don't do that". Go back to the default configuration. i.e. back out ALL of your local changes. Check that you can get users authenticated, by adding a Cleartext-Password for that user. Check that it works with radtest. Then, make another change. You've fallen into the trap of "make 100 changes, and then something doesn't work". You'll never get it debugged doing that. Make ONE change. Test it. Make ANOTHER change. Test it. This is all documented in "man radiusd". And post your dictionary here. Odds are it poaches on the standard space, and breaks all of RADIUS. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html [E-Banner]<http://www.mrv.com/landing/video-datasheet-mrvs-optidriver-platform> MRV Communications is a global supplier of packet and optical solutions that power the world’s largest networks. Our products combine innovative hardware with intelligent software to make networks smarter, faster and more efficient. The contents of this message, together with any attachments, are intended only for the use of the person(s) to whom they are addressed and may contain confidential and/or privileged information. If you are not the intended recipient, immediately advise the sender, delete this message and any attachments and note that any distribution, or copying of this message, or any attachment, is prohibited.
You're missing the BEGIN-VENDOR/END-VENDOR statements, so this overwrites the existing attributes. Just take a random dictionary from the release as an example. Herwin On 15-05-15 12:06, Philip Bellino wrote:
Alan, Your points are well taken. Thank you. We commented out using including our dictionary.mrv file (attached) in dictionary and references to our attributes in the users file and now Radius authentication succeeds.
Here is an entry in the users file that used our attributes successfully in freeradius 2.1.1
################################### # MRV Vender Specific Testing ################################### zeusCleartext-Password := "dog" Service-Type == NAS-Prompt-User, Idle-Timeout == 60, MRV-Login-Mode == "cli", MRV-Security-Level == "outlet shell", MRV-Command-Logging == "syslog", MRV-Audit-Logging == "syslog", MRV-User-Prompt == "zeus", MRV-Menu-Name == "/config/M_demo_menu", MRV-Web-Menu-Name == "/config/M_demo_menu", MRV-Port-Access-List == "2 4", MRV-Remote-Access-List == "telnet", MRV-Outlet-Access-List == "3:1 4:1", MRV-Outlet-Group-Access-List == "2"
If you can point me in the right direction with regards to what I need to change to use our dictionary attributes, I would appreciate it. Thanks again, Phil
-----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+pbellino=mrv.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, May 14, 2015 4:02 PM To: FreeRadius users mailing list Subject: Re: Help with Radius errors
On May 14, 2015, at 3:40 PM, Philip Bellino <pbellino@mrv.com> wrote:
Due to a hard disk crash we had to replace our radius server PC. Our newer PC is running Fedora Core 21. We then downloaded the FreeRadius 3.0.8 tar.gz file, built and installed it. We now cannot get past the following errors (in bold below). We have tried reconfiguring the shared secret as suggested, on the server (editing the clients.conf file and retyping the secret) and the client side but still get these errors.
I think you've broken something.
In the 2.1.1 version, the only files we changed were "radiusd.conf", "clients.conf" and "users" and added our own dictionary file. So for 3.0.8, we followed suit.
What did you put into the dictionary file?
Ready to process requests (0) Received Access-Request Id 24 from 10.242.135.17:1026 to 10.242.135.10:1812 length 68 (0) MRV-Remote-Access-List = 'gina' (0) MRV-Outlet-Group-Access-List = ' ???' (0) MRV-Login-Mode = ' (0) NAS-Port-Type = Virtual (0) MRV-Port-Access-List = '^????D???a????S?' (0) MRV-Menu-Name = '
What are those attributes? They are NOT standard RADIUS attributes. There is no User-Name in the packet, which is typically required. There is no User-Password in the packet, which is also typically required.
(0) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS!
That message is printed ONLY if there's a User-Password in the attribute.
So.. .you've done something, and broken the server. The short answer is "don't do that".
Go back to the default configuration. i.e. back out ALL of your local changes. Check that you can get users authenticated, by adding a Cleartext-Password for that user. Check that it works with radtest. Then, make another change.
You've fallen into the trap of "make 100 changes, and then something doesn't work". You'll never get it debugged doing that.
Make ONE change. Test it. Make ANOTHER change. Test it. This is all documented in "man radiusd".
And post your dictionary here. Odds are it poaches on the standard space, and breaks all of RADIUS.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html [E-Banner]<http://www.mrv.com/landing/video-datasheet-mrvs-optidriver-platform>
MRV Communications is a global supplier of packet and optical solutions that power the world’s largest networks. Our products combine innovative hardware with intelligent software to make networks smarter, faster and more efficient.
The contents of this message, together with any attachments, are intended only for the use of the person(s) to whom they are addressed and may contain confidential and/or privileged information. If you are not the intended recipient, immediately advise the sender, delete this message and any attachments and note that any distribution, or copying of this message, or any attachment, is prohibited.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On May 15, 2015, at 6:06 AM, Philip Bellino <pbellino@mrv.com> wrote:
We commented out using including our dictionary.mrv file (attached)
You attached a "users" file. Not a dictionary. The format of the "users" file is wrong, too. You've put "==" everywhere. See "man users" as to why it's wrong.
If you can point me in the right direction with regards to what I need to change to use our dictionary attributes, I would appreciate it.
Post the dictionary. Alan DeKok.
Alan, I attached an edited dictionary.mrv by mistake. I attached our original one for you here. My apologies. Phil -----Original Message----- From: Philip Bellino Sent: Friday, May 15, 2015 6:08 AM To: FreeRadius users mailing list Subject: RE: Help with Radius errors Alan, Your points are well taken. Thank you. We commented out using including our dictionary.mrv file (attached) in dictionary and references to our attributes in the users file and now Radius authentication succeeds. Here is an entry in the users file that used our attributes successfully in freeradius 2.1.1 ################################### # MRV Vender Specific Testing ################################### zeusCleartext-Password := "dog" Service-Type == NAS-Prompt-User, Idle-Timeout == 60, MRV-Login-Mode == "cli", MRV-Security-Level == "outlet shell", MRV-Command-Logging == "syslog", MRV-Audit-Logging == "syslog", MRV-User-Prompt == "zeus", MRV-Menu-Name == "/config/M_demo_menu", MRV-Web-Menu-Name == "/config/M_demo_menu", MRV-Port-Access-List == "2 4", MRV-Remote-Access-List == "telnet", MRV-Outlet-Access-List == "3:1 4:1", MRV-Outlet-Group-Access-List == "2" If you can point me in the right direction with regards to what I need to change to use our dictionary attributes, I would appreciate it. Thanks again, Phil -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+pbellino=mrv.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, May 14, 2015 4:02 PM To: FreeRadius users mailing list Subject: Re: Help with Radius errors On May 14, 2015, at 3:40 PM, Philip Bellino <pbellino@mrv.com> wrote:
Due to a hard disk crash we had to replace our radius server PC. Our newer PC is running Fedora Core 21. We then downloaded the FreeRadius 3.0.8 tar.gz file, built and installed it. We now cannot get past the following errors (in bold below). We have tried reconfiguring the shared secret as suggested, on the server (editing the clients.conf file and retyping the secret) and the client side but still get these errors.
I think you've broken something.
In the 2.1.1 version, the only files we changed were "radiusd.conf", "clients.conf" and "users" and added our own dictionary file. So for 3.0.8, we followed suit.
What did you put into the dictionary file?
Ready to process requests (0) Received Access-Request Id 24 from 10.242.135.17:1026 to 10.242.135.10:1812 length 68 (0) MRV-Remote-Access-List = 'gina' (0) MRV-Outlet-Group-Access-List = ' ???' (0) MRV-Login-Mode = ' (0) NAS-Port-Type = Virtual (0) MRV-Port-Access-List = '^????D???a????S?' (0) MRV-Menu-Name = '
What are those attributes? They are NOT standard RADIUS attributes. There is no User-Name in the packet, which is typically required. There is no User-Password in the packet, which is also typically required.
(0) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS!
That message is printed ONLY if there's a User-Password in the attribute. So.. .you've done something, and broken the server. The short answer is "don't do that". Go back to the default configuration. i.e. back out ALL of your local changes. Check that you can get users authenticated, by adding a Cleartext-Password for that user. Check that it works with radtest. Then, make another change. You've fallen into the trap of "make 100 changes, and then something doesn't work". You'll never get it debugged doing that. Make ONE change. Test it. Make ANOTHER change. Test it. This is all documented in "man radiusd". And post your dictionary here. Odds are it poaches on the standard space, and breaks all of RADIUS. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html [E-Banner]<http://www.mrv.com/landing/video-datasheet-mrvs-optidriver-platform> MRV Communications is a global supplier of packet and optical solutions that power the world’s largest networks. Our products combine innovative hardware with intelligent software to make networks smarter, faster and more efficient. The contents of this message, together with any attachments, are intended only for the use of the person(s) to whom they are addressed and may contain confidential and/or privileged information. If you are not the intended recipient, immediately advise the sender, delete this message and any attachments and note that any distribution, or copying of this message, or any attachment, is prohibited.
On May 15, 2015, at 8:48 AM, Philip Bellino <pbellino@mrv.com> wrote:
I attached an edited dictionary.mrv by mistake. I attached our original one for you here.
Read "man dictionary". This is documented. My comments are below VENDOR MRV 33 Is this really your assigned vendor number? If not, you're poaching on someone else's space. Don't do that. And the rest of the dictionary doesn't have BEGIN-VENDOR / END-VENDOR blocks. So it's re-defining standard attributes. See the hundreds of other vendor dictionaries for examples of how to create a correct vendor dictionary. Alan DeKok.
Alan, Thank you for your help. It was an education going from Freeradius 2.1.1 to 3.0.8. FYI: Our assigned number is in fact 33. See the link below: https://www.iana.org/assignments/enterprise-numbers/enterprise-numbers Phil -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+pbellino=mrv.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, May 15, 2015 9:45 AM To: FreeRadius users mailing list Subject: Re: Help with Radius errors On May 15, 2015, at 8:48 AM, Philip Bellino <pbellino@mrv.com> wrote:
I attached an edited dictionary.mrv by mistake. I attached our original one for you here.
Read "man dictionary". This is documented. My comments are below VENDOR MRV 33 Is this really your assigned vendor number? If not, you're poaching on someone else's space. Don't do that. And the rest of the dictionary doesn't have BEGIN-VENDOR / END-VENDOR blocks. So it's re-defining standard attributes. See the hundreds of other vendor dictionaries for examples of how to create a correct vendor dictionary. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html [E-Banner]<http://www.mrv.com/landing/video-datasheet-mrvs-optidriver-platform> MRV Communications is a global supplier of packet and optical solutions that power the world’s largest networks. Our products combine innovative hardware with intelligent software to make networks smarter, faster and more efficient. The contents of this message, together with any attachments, are intended only for the use of the person(s) to whom they are addressed and may contain confidential and/or privileged information. If you are not the intended recipient, immediately advise the sender, delete this message and any attachments and note that any distribution, or copying of this message, or any attachment, is prohibited.
Alan, I sent it as an attachment. I will include it here inline: # # dictionary.mrv # # Version:$Id: dictionary.mrv,v 1.0 2002/11/12 15:44:38 nminka Exp $ # VENDOR MRV 33 ATTRIBUTE MRV-Remote-Access-List 1 string MRV ATTRIBUTE MRV-Port-Access-List 2 string MRV ATTRIBUTE MRV-Outlet-Access-List 3 string MRV ATTRIBUTE MRV-Outlet-Group-Access-List 4 string MRV ATTRIBUTE MRV-Login-Mode 5 string MRV ATTRIBUTE MRV-Menu-Name 6 string MRV ATTRIBUTE MRV-Web-Menu-Name 7 string MRV ATTRIBUTE MRV-Security-Level 8 string MRV ATTRIBUTE MRV-User-Prompt 9 string MRV ATTRIBUTE MRV-Command-Logging 10 string MRV ATTRIBUTE MRV-Audit-Logging 11 string MRV ATTRIBUTE MRV-Web-Login-Mode 12 string MRV ATTRIBUTE MRV-Connect-Escape-Char 13 string MRV ATTRIBUTE MRV-Port-ReadOnly-List 14 string MRV # ATTRIBUTE MRV-Acct-Command-Log 100 string MRV ATTRIBUTE MRV-Acct-Audit-Log 101 string MRV -----Original Message----- From: Philip Bellino Sent: Friday, May 15, 2015 8:50 AM To: 'FreeRadius users mailing list' Subject: RE: Help with Radius errors Alan, I attached an edited dictionary.mrv by mistake. I attached our original one for you here. My apologies. Phil -----Original Message----- From: Philip Bellino Sent: Friday, May 15, 2015 6:08 AM To: FreeRadius users mailing list Subject: RE: Help with Radius errors Alan, Your points are well taken. Thank you. We commented out using including our dictionary.mrv file (attached) in dictionary and references to our attributes in the users file and now Radius authentication succeeds. Here is an entry in the users file that used our attributes successfully in freeradius 2.1.1 ################################### # MRV Vender Specific Testing ################################### zeusCleartext-Password := "dog" Service-Type == NAS-Prompt-User, Idle-Timeout == 60, MRV-Login-Mode == "cli", MRV-Security-Level == "outlet shell", MRV-Command-Logging == "syslog", MRV-Audit-Logging == "syslog", MRV-User-Prompt == "zeus", MRV-Menu-Name == "/config/M_demo_menu", MRV-Web-Menu-Name == "/config/M_demo_menu", MRV-Port-Access-List == "2 4", MRV-Remote-Access-List == "telnet", MRV-Outlet-Access-List == "3:1 4:1", MRV-Outlet-Group-Access-List == "2" If you can point me in the right direction with regards to what I need to change to use our dictionary attributes, I would appreciate it. Thanks again, Phil -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+pbellino=mrv.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, May 14, 2015 4:02 PM To: FreeRadius users mailing list Subject: Re: Help with Radius errors On May 14, 2015, at 3:40 PM, Philip Bellino <pbellino@mrv.com> wrote:
Due to a hard disk crash we had to replace our radius server PC. Our newer PC is running Fedora Core 21. We then downloaded the FreeRadius 3.0.8 tar.gz file, built and installed it. We now cannot get past the following errors (in bold below). We have tried reconfiguring the shared secret as suggested, on the server (editing the clients.conf file and retyping the secret) and the client side but still get these errors.
I think you've broken something.
In the 2.1.1 version, the only files we changed were "radiusd.conf", "clients.conf" and "users" and added our own dictionary file. So for 3.0.8, we followed suit.
What did you put into the dictionary file?
Ready to process requests (0) Received Access-Request Id 24 from 10.242.135.17:1026 to 10.242.135.10:1812 length 68 (0) MRV-Remote-Access-List = 'gina' (0) MRV-Outlet-Group-Access-List = ' ???' (0) MRV-Login-Mode = ' (0) NAS-Port-Type = Virtual (0) MRV-Port-Access-List = '^????D???a????S?' (0) MRV-Menu-Name = '
What are those attributes? They are NOT standard RADIUS attributes. There is no User-Name in the packet, which is typically required. There is no User-Password in the packet, which is also typically required.
(0) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS!
That message is printed ONLY if there's a User-Password in the attribute. So.. .you've done something, and broken the server. The short answer is "don't do that". Go back to the default configuration. i.e. back out ALL of your local changes. Check that you can get users authenticated, by adding a Cleartext-Password for that user. Check that it works with radtest. Then, make another change. You've fallen into the trap of "make 100 changes, and then something doesn't work". You'll never get it debugged doing that. Make ONE change. Test it. Make ANOTHER change. Test it. This is all documented in "man radiusd". And post your dictionary here. Odds are it poaches on the standard space, and breaks all of RADIUS. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html [E-Banner]<http://www.mrv.com/landing/video-datasheet-mrvs-optidriver-platform> MRV Communications is a global supplier of packet and optical solutions that power the world’s largest networks. Our products combine innovative hardware with intelligent software to make networks smarter, faster and more efficient. The contents of this message, together with any attachments, are intended only for the use of the person(s) to whom they are addressed and may contain confidential and/or privileged information. If you are not the intended recipient, immediately advise the sender, delete this message and any attachments and note that any distribution, or copying of this message, or any attachment, is prohibited.
Alan, I changed the == to = for all entries in the users file and added the Begin-VENDOR and END-VENDOR in our dictionary.mrv file (thanks Herwin) and now it all performs perfectly. Thanks for all your help. Phil -----Original Message----- From: Philip Bellino Sent: Friday, May 15, 2015 9:03 AM To: 'FreeRadius users mailing list' Subject: RE: Help with Radius errors Alan, I sent it as an attachment. I will include it here inline: # # dictionary.mrv # # Version:$Id: dictionary.mrv,v 1.0 2002/11/12 15:44:38 nminka Exp $ # VENDOR MRV 33 ATTRIBUTE MRV-Remote-Access-List 1 string MRV ATTRIBUTE MRV-Port-Access-List 2 string MRV ATTRIBUTE MRV-Outlet-Access-List 3 string MRV ATTRIBUTE MRV-Outlet-Group-Access-List 4 string MRV ATTRIBUTE MRV-Login-Mode 5 string MRV ATTRIBUTE MRV-Menu-Name 6 string MRV ATTRIBUTE MRV-Web-Menu-Name 7 string MRV ATTRIBUTE MRV-Security-Level 8 string MRV ATTRIBUTE MRV-User-Prompt 9 string MRV ATTRIBUTE MRV-Command-Logging 10 string MRV ATTRIBUTE MRV-Audit-Logging 11 string MRV ATTRIBUTE MRV-Web-Login-Mode 12 string MRV ATTRIBUTE MRV-Connect-Escape-Char 13 string MRV ATTRIBUTE MRV-Port-ReadOnly-List 14 string MRV # ATTRIBUTE MRV-Acct-Command-Log 100 string MRV ATTRIBUTE MRV-Acct-Audit-Log 101 string MRV -----Original Message----- From: Philip Bellino Sent: Friday, May 15, 2015 8:50 AM To: 'FreeRadius users mailing list' Subject: RE: Help with Radius errors Alan, I attached an edited dictionary.mrv by mistake. I attached our original one for you here. My apologies. Phil -----Original Message----- From: Philip Bellino Sent: Friday, May 15, 2015 6:08 AM To: FreeRadius users mailing list Subject: RE: Help with Radius errors Alan, Your points are well taken. Thank you. We commented out using including our dictionary.mrv file (attached) in dictionary and references to our attributes in the users file and now Radius authentication succeeds. Here is an entry in the users file that used our attributes successfully in freeradius 2.1.1 ################################### # MRV Vender Specific Testing ################################### zeusCleartext-Password := "dog" Service-Type == NAS-Prompt-User, Idle-Timeout == 60, MRV-Login-Mode == "cli", MRV-Security-Level == "outlet shell", MRV-Command-Logging == "syslog", MRV-Audit-Logging == "syslog", MRV-User-Prompt == "zeus", MRV-Menu-Name == "/config/M_demo_menu", MRV-Web-Menu-Name == "/config/M_demo_menu", MRV-Port-Access-List == "2 4", MRV-Remote-Access-List == "telnet", MRV-Outlet-Access-List == "3:1 4:1", MRV-Outlet-Group-Access-List == "2" If you can point me in the right direction with regards to what I need to change to use our dictionary attributes, I would appreciate it. Thanks again, Phil -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+pbellino=mrv.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, May 14, 2015 4:02 PM To: FreeRadius users mailing list Subject: Re: Help with Radius errors On May 14, 2015, at 3:40 PM, Philip Bellino <pbellino@mrv.com> wrote:
Due to a hard disk crash we had to replace our radius server PC. Our newer PC is running Fedora Core 21. We then downloaded the FreeRadius 3.0.8 tar.gz file, built and installed it. We now cannot get past the following errors (in bold below). We have tried reconfiguring the shared secret as suggested, on the server (editing the clients.conf file and retyping the secret) and the client side but still get these errors.
I think you've broken something.
In the 2.1.1 version, the only files we changed were "radiusd.conf", "clients.conf" and "users" and added our own dictionary file. So for 3.0.8, we followed suit.
What did you put into the dictionary file?
Ready to process requests (0) Received Access-Request Id 24 from 10.242.135.17:1026 to 10.242.135.10:1812 length 68 (0) MRV-Remote-Access-List = 'gina' (0) MRV-Outlet-Group-Access-List = ' ???' (0) MRV-Login-Mode = ' (0) NAS-Port-Type = Virtual (0) MRV-Port-Access-List = '^????D???a????S?' (0) MRV-Menu-Name = '
What are those attributes? They are NOT standard RADIUS attributes. There is no User-Name in the packet, which is typically required. There is no User-Password in the packet, which is also typically required.
(0) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS!
That message is printed ONLY if there's a User-Password in the attribute. So.. .you've done something, and broken the server. The short answer is "don't do that". Go back to the default configuration. i.e. back out ALL of your local changes. Check that you can get users authenticated, by adding a Cleartext-Password for that user. Check that it works with radtest. Then, make another change. You've fallen into the trap of "make 100 changes, and then something doesn't work". You'll never get it debugged doing that. Make ONE change. Test it. Make ANOTHER change. Test it. This is all documented in "man radiusd". And post your dictionary here. Odds are it poaches on the standard space, and breaks all of RADIUS. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html [E-Banner]<http://www.mrv.com/landing/video-datasheet-mrvs-optidriver-platform> MRV Communications is a global supplier of packet and optical solutions that power the world’s largest networks. Our products combine innovative hardware with intelligent software to make networks smarter, faster and more efficient. The contents of this message, together with any attachments, are intended only for the use of the person(s) to whom they are addressed and may contain confidential and/or privileged information. If you are not the intended recipient, immediately advise the sender, delete this message and any attachments and note that any distribution, or copying of this message, or any attachment, is prohibited.
participants (3)
-
Alan DeKok -
Herwin Weststrate -
Philip Bellino