IC radius question
I know this is the freeradius forum but I thought Id ask here. I have a customer using icradius and they say that they cant easily switch to freeradius because of several python scripts written to work with icradius. So, there problem. They are seeing THIS error in their radius logs: Check list does not match request list [USER] (from nas access-2#2/S99 cli 5094441590) It only happens with S99 and only with this 2nd Lucent Portmaster 4 they recently installed. The first pm4 and 2 other pm3's never get this error. They ARE using the NAS-PORT-TYPE attribute if that has possibly anything to do with it. Im wondering why, its coming from S99? There is no port s99 on a Portmaster 4. ~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~ Jake Messinger, VP. ph:713-772-6690 Visit: portmasters.com AMS, Inc. fx:713-774-3498 advmed.com 8300 Bissonnet #400 jake@jakes.org profjake.com Houston, Texas 77074 http://jakes.org homestarrunner.com ICQ# 4403734 YAHOO: prof_jake AIM: profjake MSN: jake@jakes.org Adjunct Professor University of Houston, CBA jake@uh.edu ~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~
I'm sure someone can give me a quick answer to this problem. I have one radius server that handles request in the form: username username@domain1.com username@domain2.net We this setup in our proxy.conf file: realm domain1.com { type = radius authhost = LOCAL accthost = LOCAL } realm domain2.net { type = radius authhost = server.domain2.net:1645 accthost = LOCAL secret = ********** } And uses the "users" file for local stuff.... Everything works fine except when the username at the realm domain2.net server matches a name in the "users" file on the domain1.com server. We have usernames on the domain1.com "users" file that reject: uername Auth-Type := Reject These users have DSL access but no phone line access and belong to the domain1.com server. But once in a while they will have the same username on each system. The result is domain2.net will Auth OK them but they cannot get on line because domain1.com will reject them because of the "users" file. How do I fix this problem? Thanks! Ken
On Monday 23 January 2006 20:37, User for Free Radius mail list wrote:
The result is domain2.net will Auth OK them but they cannot get on line because domain1.com will reject them because of the "users" file.
How do I fix this problem?
Thanks!
Ken
Running in debug mode should show you what is happening...have you done this? If you have and can't figure it out, post the debug output of an example where domain2.net auth fails so we can parse the output and hopefully determine what needs changed in your config. Kevin Bonner
Kevin, I did run this in debug mode before I posted on the list, and could not quite figure it out. So here is part of the debug out below. Thanks, Ken On Tue, 24 Jan 2006, Kevin Bonner wrote:
On Monday 23 January 2006 20:37, User for Free Radius mail list wrote:
The result is domain2.net will Auth OK them but they cannot get on line because domain1.com will reject them because of the "users" file.
How do I fix this problem?
Thanks!
Ken
Running in debug mode should show you what is happening...have you done this? If you have and can't figure it out, post the debug output of an example where domain2.net auth fails so we can parse the output and hopefully determine what needs changed in your config.
Kevin Bonner
I put in some notes <> and changed the IP addresses, names and passwords to protect the what ever... Going to the next request Thread 4 waiting to be assigned a request --- Walking the entire request list --- Threads: total/active/spare threads = 5/0/5 Waking up in 3 seconds... rad_recv: Access-Request packet from host 209.111.111.12:1025, id=95, length=92 Thread 5 assigned request 14 --- Walking the entire request list --- Threads: total/active/spare threads = 5/1/4 Waking up in 2 seconds... Thread 5 handling request 14, (3 handled so far) User-Name = "joeblow@domain2.net" User-Password = "xxxxxxxx" NAS-IP-Address = 209.111.111.12 NAS-Port = 20216 NAS-Port-Type = Async Service-Type = Framed-User Framed-Protocol = PPP State = 0x Acct-Session-Id = "450788469" modcall: entering group authorize modcall[authorize]: module "preprocess" returns ok rlm_realm: Looking up realm domain2.net for User-Name = "joeblow@domain2.net" rlm_realm: Found realm domain2.net rlm_realm: Adding Stripped-User-Name = "joeblow" rlm_realm: Proxying request from user jowblow to realm domain2.net rlm_realm: Adding Realm = "domain2.net" rlm_realm: Preparing to proxy authentication request to realm domain2.net modcall[authorize]: module "suffix" returns updated users: Matched orchids at 708 ^^^^^^^ < NOTE: this is where it searches the "users" file on domain1.com radius server for the name "joeblow" and finds it at line 708. But this user name is in this file for the domain1.com NOT domain2.net. For the realm domain2.net I do not want it to search the "user" file on the domain1.com server but just be redirected to the domain2.net server and wait for an answer. > modcall[authorize]: module "files" returns ok modcall: group authorize returns updated Sending Access-Request of id 5 to 209.111.120.21:1645 <<< this is domain2.net server> User-Name = "joeblow" User-Password = "L\013\315\2151F\017[\317\215\212\3150J\313\241" NAS-IP-Address = 209.111.111.12 NAS-Port = 20216 NAS-Port-Type = Async Service-Type = Framed-User Framed-Protocol = PPP State = 0x Acct-Session-Id = "450788469" Proxy-State = "95" Thread 5 waiting to be assigned a request rad_recv: Access-Accept packet from host 209.111.120.21:1645, id=5, <<< this is domain2.net server> length=42 Thread 1 assigned request 14 Waking up in 2 seconds... Thread 1 handling request 14, (4 handled so far) Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Proxy-State = 0x3935 modcall: entering group authorize modcall[authorize]: module "preprocess" returns ok rlm_realm: Proxy reply, or no user name. Ignoring. modcall[authorize]: module "suffix" returns noop users: Matched orchids at 708 modcall[authorize]: module "files" returns ok modcall: group authorize returns ok rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [joeblow@domain2.net/xxxxxxx] (from client abc8 port 20216) Delaying request 14 for 1 seconds Finished request 14 Going to the next request Thread 1 waiting to be assigned a request --- Walking the entire request list --- Threads: total/active/spare threads = 5/0/5 Sending Access-Reject of id 95 to 209.111.111.12:1025 Cleaning up request 10 ID 146 with timestamp 43d57a06 Waking up in 7 seconds... --- Walking the entire request list --- Cleaning up request 12 ID 193 with timestamp 43d57a0d Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 14 ID 95 with timestamp 43d57a0f Nothing to do. Sleeping until we see a request.
"Jake Messinger" <jake@portmasters.com> wrote:
I know this is the freeradius forum but I thought Id ask here. I have a customer using icradius and they say that they cant easily switch to freeradius because of several python scripts written to work with icradius.
They can switch to FreeRADIUS, which has a python module. Alan DeKok.
They seem very resistant to change to freeradius. They think that since the other portmasters are working fine, that it must be THIS portmaster causing their radius logs to fill with these strange messages: Check list does not match request list [USER] (from nas access-2#2/S99 cli 5094441590) Theyd prefer to try to find WHY they are getting this message. Id prefer that they switch to Freeradius. I am not certain that will fix their problem tho, so I would like to see if anyone ever got this error and what it may have been caused by. This error is occuring on an estimated 5% of their calls and on random users. Caller calls in, cant establish, the error occurs, they call back, same login, works fine, no error in the radius log. ~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~ Jake Messinger, VP. ph:713-772-6690 Visit: portmasters.com AMS, Inc. fx:713-774-3498 advmed.com 8300 Bissonnet #400 jake@jakes.org profjake.com Houston, Texas 77074 http://jakes.org homestarrunner.com ICQ# 4403734 YAHOO: prof_jake AIM: profjake MSN: jake@jakes.org Adjunct Professor University of Houston, CBA jake@uh.edu ~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~ ----- Original Message ----- From: "Alan DeKok" <aland@ox.org> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Monday, January 23, 2006 8:56 PM Subject: Re: IC radius question
"Jake Messinger" <jake@portmasters.com> wrote:
I know this is the freeradius forum but I thought Id ask here. I have a customer using icradius and they say that they cant easily switch to freeradius because of several python scripts written to work with icradius.
They can switch to FreeRADIUS, which has a python module.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jake Messinger wrote:
I know this is the freeradius forum but I thought Id ask here. I have a customer using icradius and they say that they cant easily switch to freeradius because of several python scripts written to work with icradius. Don't know anything about that error but if the python scripts look at the db they should be very easy to port.
-- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 Off. 325-691-1301 Cell 325-439-0533 fax 325-695-6841
participants (5)
-
Alan DeKok -
Jake Messinger -
Kevin Bonner -
Lewis Bergman -
User for Free Radius mail list