Can use "auth" with radclient but not "status"
I believe that my Free Radius server is working, since I can query it successfully with "auth": % echo "User-Name = bortzmeyer\nUser-Password = foobar" | radclient jezabel auth mysharedsecret Received response ID 187, code 2, length = 44 Service-Type = Framed-User ... % echo "User-Name = bortzmeyer\nUser-Password = wrong" | radclient jezabel auth mysharedsecret Received response ID 189, code 3, length = 20 But "status" always fail: % echo "NAS-port = 1" | radclient jezabel status mysharedsecret radclient: no response from server for ID 198 (Same thing with 12 instead of status) On the server, running with -X, I just get: WARNING: Insecure packet from host 10.1.82.1: Packet does not contain required Message-Authenticator attribute Free Radius 1.1.7, Debian "lenny" OS
Stephane Bortzmeyer wrote:
I believe that my Free Radius server is working, since I can query it successfully with "auth": ... But "status" always fail:
% echo "NAS-port = 1" | radclient jezabel status mysharedsecret radclient: no response from server for ID 198 ... WARNING: Insecure packet from host 10.1.82.1: Packet does not contain required Message-Authenticator attribute
The purpose of "radclient" is to send *anything* in a RADIUS packet, even things that violate the RFC's. In this case, you will need to manually add a Message-Authenticator to the input attributes. Alan DeKok.
On Thu, Jan 31, 2008 at 03:22:41PM +0100, Alan DeKok <aland@deployingradius.com> wrote a message of 18 lines which said:
The purpose of "radclient" is to send *anything* in a RADIUS packet, even things that violate the RFC's. In this case, you will need to manually add a Message-Authenticator to the input attributes.
OK, many thanks, now it works: lilith:~ % echo "Message-Authenticator = 42" | radclient jezabel status toto Received response ID 131, code 2, length = 49 Reply-Message = "FreeRADIUS up 0 days, 00:02" Which RFC should I read, by the way? 2865 says very little about Server-Status. Otherwise, your explanation makes sense. But, in that case, the example in the man page of radclient is wrong: EXAMPLE A sample session that queries the remote server for Status-Server (not all servers support this, but FreeRADIUS has configurable support for it). $ echo "User-Name = fnord" | radclient 192.168.1.42 12 s3cr3t Sending request to server 192.168.1.42, port 1812. radrecv: Packet from host 192.168.1.42 code=2, id=140, length=54 Reply-Message = "FreeRADIUS up 21 days, 02:05"
Stephane Bortzmeyer wrote:
Which RFC should I read, by the way? 2865 says very little about Server-Status.
I have an expired I-D that I'll be updating soon.
Otherwise, your explanation makes sense. But, in that case, the example in the man page of radclient is wrong:
Fixed, thanks. Alan DeKok.
participants (2)
-
Alan DeKok -
Stephane Bortzmeyer