Log files not being updated (version 2)
Hello, I meant to send this the other day, I goofed and just sent the output at the bottom - my apologies. I am running version 1.1.1 on FedoraCore 4. I am trying to get freeradius to work with our SkyPilot Extender DualBand AP as part of 802.1x. This is a very new to subject to me, but so far I've been able to install freeradius and I even had it running using MySQL successfully - I was able to test it using ntradping, and it responded as expected and the logs were added to properly. As part of the 802.1x setup, it turns out we need to be using eap and a few other things that I did not have running in this initial setup. The vendor was kind enough to send me a copy of a working raddb directory that they had along with some instructions. Because they were running version 1.1, I didn't want to just dump their files over mine.I first turned of the MySQL integration, tested again and it worked fine reading the text config files. I then compared their files to mine and made the changes that seemed appropriate. Now, when I start freeradius with 'radiusd -Xyfff', it boots up, and responds to requests as it should - but nothing gets added to the log file anymore. When this was originally working as expected, i was running radius as root. When I was comparing our files with the vendors and making the changes, my reading of the comments in the radius.conf file led me to believe I should run it as nobody instead. My first thought was that maybe I then had permission wrong on the log file -but changing the owner:group to nobody on the log didn't make a difference. I then changed it back to root and run radius as root (as I had been before) but no luck there either. I wonder if there's anything obvious to anyone in the output I get when I start freeradius (pasted below). I am hoping that don't have to revert to 1.1,but if that's the best way to get this to work, I'll do it for sure. Thanks for any suggestions. Hugo # radiusd -Xyfff Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "root" main: group = "root" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "mschapv2" ttls: copy_request_to_tunnel = yes ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = yes peap: use_tunneled_reply = yes peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/ auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/ detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests.
If I type this: radtest hugo test 127.0.0.1 1812 ******* then I get the following (but nothing shows up in the log). Strangely, what I do see in the log are a few lines from last weekend, when I was trying to get this to work (as I mentioned, I was changing the user this runs under from 'nobody'back to 'root'. Sat Jun 3 22:09:11 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Sat Jun 3 22:09:11 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Sat Jun 3 22:09:11 2006 : Info: Ready to process requests. Below is the output I got when I ran the radtest command. Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:33086, id=59, length=56 User-Name = "hugo" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/127.0.0.1/auth-detail-20060605' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-% Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20060605 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "hugo", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry hugo at line 216 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Login incorrect: [hugo/test] (from client localhost port 1812) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 59 to 127.0.0.1 port 33086 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 59 with timestamp 448458e9 Nothing to do. Sleeping until we see a request. And, when I ran it once more before I mailed this, just to make sure I was getting everything straight, I got this as part of the output: modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Login incorrect: [hugo/test] (from client localhost port 1812) I'm sure i didn't change anything, but now, it is saying System is an unknown value? Is this problem perhaps bigger than I realize -or am I just not thinking clearly... thanks, Hugo On Jun 5, 2006, at 11:43 AM, Alan DeKok wrote:
Hugo Heriz-Smith <hugo@heriz-smith.com> wrote:
I wonder if there's anything obvious to anyone in the output I get when I start freeradius (pasted below).
And what does it say when you send it a packet?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/ users.html
Hugo Heriz-Smith <hugo@heriz-smith.com> wrote:
If I type this:
radtest hugo test 127.0.0.1 1812 *******
then I get the following (but nothing shows up in the log).
Authentication != accounting
I'm sure i didn't change anything, but now, it is saying System is an unknown value? Is this problem perhaps bigger than I realize -or am I just not thinking clearly...
If it says System is unknown, you changed the default config to break it. Alan DeKok.
participants (2)
-
Alan DeKok -
Hugo Heriz-Smith