Hi all I have a question regarding freeradius (specifically radtest) which I'm hoping somebody can shed some light on. I have configured a new radius server to replace one of our ancient legacy production systems which is currently running: FreeRADIUS Version 1.1.7, for host i386-portbld-freebsd6.2, built on Dec 2 2008 at 00:30:57. Considering the age of this system it will not be a surprise to learn that radiusd is currently listening on port 1645. I wish to replicate that behaviour on the replacement server. Consequently I have built a replacement like so: FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu, built on Sep 22 2015 at 15:27:25 When I configure the server using the default port 1812 everything works fine when testing via radtest (on a remote host): # radtest test testpass 1.2.3.4 1812 testing123 Sending Access-Request of id 95 to 1.2.3.4 port 1812 User-Name = "test" User-Password = "testpass" NAS-IP-Address = 2.3.4.5 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 1.2.3.4 port 1812, id=95, length=20 However, I do have a problem when trying to TEST authenticate when the server is using port 1645 using radtest on any system that is not ancient. I have tried radtest using port 1645 from the following systems; CentOS 6 - FAIL Ubuntu 16.04 - FAIL FreeBSD 10 - FAIL FreeBSD 6 - OK So radtest works on port 1645 from the vintage FreeBSD 6 machine but from all the other, newer systems I get the same result: radtest test testpass 1.2.3.9.4 1645 testing123 Sending Access-Request of id 160 to 1.2.3.4 port 1812 User-Name = "test" User-Password = "testpass" NAS-IP-Address = 2.3.4.5 NAS-Port = 1645 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 1.2.3.4 port 1812, id=160, length=20 Note the part where radtest has ignored the provided port 1645 and has gone ahead and used 1812 anyway, although the NAS-Port is (correctly shown as being 1645 later on. In fact if I revert the radius server back to port 1812 and issue the same radtest command (using port 1645) it still works, even though the server is on port 1812. (The FreeBSD 6 machine fails as expected) Then, while looking about on google I noticed various radtest examples which use 0, or 10 for the port, some of which explicitly state that it doesn't actually matter what you put in that "port" field at all. So I tried putting random numbers in and indeed it worked when the server is on port 1812 no matter what port number I provided. This would appear to be a bug in radtest that has been around for quite some time (because CentOS 6 is hardly a spring chicken either) Either that or support for user provided ports has been removed from radtest altogether but I can't find any release notes online or any other references that suggest this. I was going to submit a bug report but the "Report a bug" link to http://bugs.freeradius.org/ as displayed on the freeradius download site appears to be broken. Also, I am not 100% sure that it is a bug anyway. If the ability to choose a port other than 1812 has been removed from radtest then it would be kind of nice if that was documented somewhere that is easy to find. It's not a showstopper for me but it would be nice to understand what is going on anyway. Anyway, if you have gotten this far then thanks for reading. Cheers Brett
On 23 Feb 2017, at 03:17, Brett Glasson <Brett.Glasson@max.com.au> wrote:
Note the part where radtest has ignored the provided port 1645 and has gone ahead and used 1812 anyway, although the NAS-Port is (correctly shown as being 1645 later on.
The NAS-Port attribute and the UDP port used by FreeRADIUS aren't the same thing - NAS port is a hint to the RADIUS server about (if you were using a wired NAS) which physical port has a wire hanging out of it. You need to append :1645 to send the request to a different UDP port, e.g.: $ radtest test testpass 1.2.3.4:1645 10 testing123 Regards, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
From: Freeradius-Users <freeradius-users-bounces+brett.glasson=max.com.au@lists.freeradius.org> on behalf of Adam Bishop <Adam.Bishop@jisc.ac.uk> Sent: Thursday, 23 February 2017 2:29 PM To: FreeRadius users mailing list Subject: Re: Using radtest on port 1645
On 23 Feb 2017, at 03:17, Brett Glasson <Brett.Glasson@max.com.au> wrote:
Note the part where radtest has ignored the provided port 1645 and has gone ahead and used 1812 anyway, although the NAS-Port is (correctly shown as being 1645 later on.
The NAS-Port attribute and the UDP port used by FreeRADIUS aren't the same thing - NAS port is a hint to the RADIUS server about (if you were using a wired NAS) which physical port has a wire hanging out of it.
You need to append :1645 to send the request to a different UDP port, e.g.: $ radtest test testpass 1.2.3.4:1645 10 testing123
OK, thanks Adam! I had tried 1.2.3.4:1645 before but I had just replaced the space in 1.2.3.4 1645 with a colon.which meant that I'd left off the NAS port so I only got a syntax error for my trouble. After adding the NAS port back as well it worked perfectly. I guess I was thrown by the fact that my original command worked OK on the older server. Anyway, once again, thanks! Regards Brett
On 23/02/2017 03:17, Brett Glasson wrote:
radtest test testpass 1.2.3.9.4 1645 testing123 Sending Access-Request of id 160 to 1.2.3.4 port 1812 User-Name = "test" User-Password = "testpass" NAS-IP-Address = 2.3.4.5 NAS-Port = 1645 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 1.2.3.4 port 1812, id=160, length=20
Note the part where radtest has ignored the provided port 1645 and has gone ahead and used 1812 anyway, although the NAS-Port is (correctly shown as being 1645 later on.
You are confusing two things: the UDP port number to which the packet is sent, and the NAS-Port attribute which the NAS uses to indicate which physical port (e.g. modem) the user is requesting service on. You want: radtest test testpass 1.2.3.4:1645 1 testing123 This sets the UDP destination port to 1645, and the NAS-Port attribute to 1 One other thing: if you are rebuilding this system to replace an ancient FreeRADIUS, please go straight to 3.0.12. FreeRADIUS 2.x is also ancient and although it works, you will get little support for it. The first problem you come across, the most likely response you'll get will be "upgrade to 3.0.12"! Regards, Brian.
From: Brian Candler [mailto:b.candler@pobox.com]
You want:
radtest test testpass 1.2.3.4:1645 1 testing123
This sets the UDP destination port to 1645, and the NAS-Port attribute to 1
One other thing: if you are rebuilding this system to replace an ancient FreeRADIUS, please go straight to 3.0.12. FreeRADIUS 2.x is also ancient and although it works, you will get little support for it. The first problem you come across, the most likely response you'll get will be "upgrade to 3.0.12"!
Thanks Brian The server is part of a legacy LAMP stack that is running in maintenance mode for another 12 months while a replacement is implemented. This particular radius server is incredibly basic and just provides a single credential for a single upstream host. The rest of the stack is CentOS 6 and the Freeradius version I'm using is the standard CentOS binary. Rather than go and build radiusd from source for a temporary arrangement with such a basic use case I decided to just go with a simple setup. It will all be switched off in 12 months or so anyway. Thanks again Regards Brett
participants (3)
-
Adam Bishop -
Brett Glasson -
Brian Candler