I have tried to hire someone to help with my Radius over the last 6 month's but have not been able to get it working correctly. I seem to be getting answers from my MySql database but when a CHAP request comes in, it will not authorize and ells us Auth-Type already set. The database seems to be answering fine from local dialup, but when one comes in from over our Level3 network it errors out and won't allow them to connect. I can provide a major city access number if that will help anyone for testing also. I'm also getting the run time error that it's using my realms file, but there is nothing in that file as instructed. I went to 1.0.5 and things improved a little that we started seeing the response from the MySql database but still nothing in CHAP. I'm sure I'm missing a setting somewhere because of the Auth-Type warning. If someone can actually help get this running that is well versed with FreeRadius please give me a cost or if I need to send the config files I can also do that. Here is my debug print out. Thanks Waking up in 1 seconds... rad_recv: Access-Request packet from host 216.127.146.29:61336, id=16, length=231 User-Name = "awarren@surftheusa.com" CHAP-Password = 0x01d84611071bc09d90932c0cb55f287648 NAS-IP-Address = 63.215.26.177 NAS-Port = 404 Service-Type = Framed-User Framed-Protocol = PPP Ascend-Data-Rate = 31200 Ascend-Calling-Id-Type-Of-Num = Unknown Ascend-Calling-Id-Number-Plan = Unknown Ascend-Xmit-Rate = 49333 Called-Station-Id = "9283774011" Calling-Station-Id = "928-Deleted" NAS-Identifier = "nas3.2az1.Level3.net" Acct-Session-Id = "404029672" NAS-Port-Type = Async Ascend-NAS-Port-Format = 2_4_5_5 Vendor-7005-Attr-12 = 0x4469616c7570555341 Attr-102 = 0x6c33 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 14 hints: Matched other at 63 modcall[authorize]: module "preprocess" returns ok for request 14 radius_xlat: 'awarren' rlm_sql (sql): sql_set_user escaped user --> 'awarren' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'awarren' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'awarren' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'awarren' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'awarren' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 14 rlm_chap: WARNING: Auth-Type already set. Not setting to CHAP modcall[authorize]: module "chap" returns noop for request 14 rlm_realm: No '@' in User-Name = "awarren", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 14 users: Matched entry DEFAULT at line 174 users: Matched entry DEFAULT at line 205 modcall[authorize]: module "files" returns ok for request 14 modcall: group authorize returns ok for request 14 rad_check_password: Found Auth-Type Local rad_check_password: Found Auth-Type System Warning: Found 2 auth-types on request for user 'awarren' auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14 rlm_unix: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". modcall[authenticate]: module "unix" returns invalid for request 14 modcall: group authenticate returns invalid for request 14 auth: Failed to validate the user. Login incorrect: [awarren/<CHAP-Password>] (from client usa1 port 404 cli 9287572602) Delaying request 14 for 1 seconds Finished request 14 Going to the next request Sending Access-Reject of id 14 to 216.127.146.30:56516 Waking up in 2 seconds... rad_recv: Access-Request packet from host 216.127.146.30:56516, id=15, length=231 User-Name = "awarren@surftheusa.com" CHAP-Password = 0x0103a463bb5007b7eb6f49b6d4176c5386 NAS-IP-Address = 63.215.26.177 NAS-Port = 402 Service-Type = Framed-User Framed-Protocol = PPP Ascend-Data-Rate = 31200 Ascend-Calling-Id-Type-Of-Num = Unknown Ascend-Calling-Id-Number-Plan = Unknown Ascend-Xmit-Rate = 49333 Called-Station-Id = "9283774011" Calling-Station-Id = "928-deleted" NAS-Identifier = "nas3.2az1.Level3.net" Acct-Session-Id = "404029734" NAS-Port-Type = Async Ascend-NAS-Port-Format = 2_4_5_5 Vendor-7005-Attr-12 = 0x4469616c7570555341 Attr-102 = 0x6c33 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 hints: Matched other at 63 modcall[authorize]: module "preprocess" returns ok for request 7 radius_xlat: 'awarren' rlm_sql (sql): sql_set_user escaped user --> 'awarren' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'awarren' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'awarren' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'awarren' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'awarren' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 7 rlm_chap: WARNING: Auth-Type already set. Not setting to CHAP modcall[authorize]: module "chap" returns noop for request 7 rlm_realm: No '@' in User-Name = "awarren", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 users: Matched entry DEFAULT at line 174 users: Matched entry DEFAULT at line 205 modcall[authorize]: module "files" returns ok for request 7 modcall: group authorize returns ok for request 7 rad_check_password: Found Auth-Type Local rad_check_password: Found Auth-Type System Warning: Found 2 auth-types on request for user 'awarren' auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_unix: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". modcall[authenticate]: module "unix" returns invalid for request 7 modcall: group authenticate returns invalid for request 7 auth: Failed to validate the user. Login incorrect: [awarren/<CHAP-Password>] (from client usa1 port 402 cli 9287572602) Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 2 seconds... - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
radius@kingmanaz.net wrote:
I have tried to hire someone to help with my Radius over the last 6 month's but have not been able to get it working correctly.
As much as I would like to take your money, its probably not necessary. :-) This is usually a very simple thing to get working.
I seem to be getting answers from my MySql database but when a CHAP request comes in, it will not authorize and ells us Auth-Type already set.
Make sure the op column is set to ":=" for Auth-Type attribute in your mysql db. This will ensure that the Auth-Type you set there will override any previous. This is definitely one problem your having. Its indicated by this error message in debugging: rlm_chap: WARNING: Auth-Type already set. Not setting to CHAP You must make sure this is fixed and CHAP is being used. This is the first problem to solve. You can see that next in the auth section its trying to use rlm_unix. That means something is setting the Auth-Type to system. It looks like its getting set to Local also. Also be particular about the ordering of your modules in the Authorize {} block of radiusd.conf as well. These modules are called in descending order. This could be the source of your incorrect Auth-Type setting. Solve this problem and write back with any new errors or problems. -Chris Carver
When I put the := system first and := local second in the user file, it started working. DEFAULT Auth-Type := System Fall-Though = Yes DEFAULT Auth-Type := Local Fall-Though = Yes It's working for both PAP and CHAP login's. I heard this is not the way to do this, but it does seem to be working. ----- Original Message ----- From: "Christopher Carver" <ccarver@pennswoods.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Thursday, November 24, 2005 6:10 AM Subject: Re: CHAP Problems
radius@kingmanaz.net wrote:
I have tried to hire someone to help with my Radius over the last 6 month's but have not been able to get it working correctly.
As much as I would like to take your money, its probably not necessary. :-) This is usually a very simple thing to get working.
I seem to be getting answers from my MySql database but when a CHAP request comes in, it will not authorize and ells us Auth-Type already set. Make sure the op column is set to ":=" for Auth-Type attribute in your mysql db. This will ensure that the Auth-Type you set there will override any previous. This is definitely one problem your having. Its indicated by this error message in debugging: rlm_chap: WARNING: Auth-Type already set. Not setting to CHAP
You must make sure this is fixed and CHAP is being used. This is the first problem to solve. You can see that next in the auth section its trying to use rlm_unix. That means something is setting the Auth-Type to system. It looks like its getting set to Local also. Also be particular about the ordering of your modules in the Authorize {} block of radiusd.conf as well. These modules are called in descending order. This could be the source of your incorrect Auth-Type setting. Solve this problem and write back with any new errors or problems.
-Chris Carver - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Radius wrote:
When I put the := system first and := local second in the user file, it started working.
DEFAULT Auth-Type := System Fall-Though = Yes
DEFAULT Auth-Type := Local Fall-Though = Yes
It's working for both PAP and CHAP login's.
I heard this is not the way to do this, but it does seem to be working.
Because the Local is overriding the system Auth-Type assignment. Thats what the ":=" operator does. users(5). You can just remove the first two lines.
radius@kingmanaz.net wrote:
I went to 1.0.5 and things improved a little that we started seeing the response from the MySql database but still nothing in CHAP. I'm sure I'm missing a setting somewhere because of the Auth-Type warning.
Something, somewhere is setting Auth-Type := System. The debug log tells you where.
users: Matched entry DEFAULT at line 174 users: Matched entry DEFAULT at line 205
What are those entries?
Warning: Found 2 auth-types on request for user 'awarren'
This ONLY happens if you configured the server to add 2 Auth-Types. The solution is don't do that. Alan DeKok.
participants (4)
-
Alan DeKok -
Christopher Carver -
Radius -
radius＠kingmanaz.net