Trouble with using virtual server tacacs'login
Hi,I used freeradius-server-4.0~alpha1 to use the tacacs virtual server, but I encountered some problems when I used the ppp authencation. Here are the debug info : (33) User-Name = "66" (33) Client-Port = "va100-0" (33) User-Password = "666" (33) tacacs - Running 'authenticate PAP' from file /usr/local/etc/raddb/sites-enabled/tacacs (33) tacacs - authenticate PAP { (33) pap - Login attempt with password (33) pap - ERROR: No "known good" password found for user I searched such problem and most of them say it is due to not setting the users file.(but I actually did it!) My configure steps are as followed: 1) A brand-new config dictionary. 2) CP tacacs from site-available to site -enable,while setting the secret. 3) Delete default in sites-enable. 4) Some modification to inner-tunnel ,I did not use that ,just to run the radius. 5) Add client in clients.conf(I think I need not do that but it does not matter). 6) Add 66 Password.Cleartext := "666" in the users file. I think maybe I should do step(6) in other places? But i did not find any doc,problem, or example show how to do it . Actually, I tried every method like pap ,chap ,mschap and got the same result. Thanks a lot for your help!!! 黄立成 2071264258@qq.com
On Nov 28, 2024, at 4:55 AM, 黄立成 via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Hi,I used freeradius-server-4.0~alpha1 to use the tacacs virtual server, but I encountered some problems when I used the ppp authencation. Here are the debug info :
You should use the most recent code from GitHub. The alpha1 code is fine, but there have been a number of fixes added since then.
(33) User-Name = "66" (33) Client-Port = "va100-0" (33) User-Password = "666" (33) tacacs - Running 'authenticate PAP' from file /usr/local/etc/raddb/sites-enabled/tacacs (33) tacacs - authenticate PAP { (33) pap - Login attempt with password (33) pap - ERROR: No "known good" password found for user
After upgrading, post the FULL debug log, as suggested in http://wiki.freeradius.org/list-help
I searched such problem and most of them say it is due to not setting the users file.(but I actually did it!)
It's not being used for TACACS. Read the debug output. Read sites-enabled/tacacs
My configure steps are as followed: 1) A brand-new config dictionary. 2) CP tacacs from site-available to site -enable,while setting the secret. 3) Delete default in sites-enable. 4) Some modification to inner-tunnel ,I did not use that ,just to run the radius. 5) Add client in clients.conf(I think I need not do that but it does not matter). 6) Add 66 Password.Cleartext := "666" in the users file.
I think maybe I should do step(6) in other places? But i did not find any doc,problem, or example show how to do it .
Actually, I tried every method like pap ,chap ,mschap and got the same result.
Try enabling the "files" module in sites-enabled/tacacs Alan DeKok.
You told me to enable the files module in tacacs, but I read the page of files module and cannot find any description of how to enable the file module, the only thing in that page is to tell me put my password at the top of user or authorize . I have done several changes in tacacs file in sites-enable as followed: 1)tacacs { Authentication { files ...} 2)authenticate PAP { files pap } authenticate CHAP { files chap } But that did not work, the result is still: (1) tacacs - Running 'authenticate ASCII' from file /usr/local/etc/raddb/sites-enabled/tacacs (1) tacacs - authenticate ASCII { (1) pap - Login attempt with password (1) pap - ERROR: No "known good" password found for user (1) tacacs - pap (fail) (1) tacacs - } # authenticate ASCII (fail) (1) tacacs - Failed to authenticate the user I want to know how to enable files module and what else should I do to solve the problem. Thank you for answering my questions. 黄立成 2071264258@qq.com ------------------ 原始邮件 ------------------ 发件人: "黄立成" <2071264258@qq.com>; 发送时间: 2024年11月28日(星期四) 下午5:55 收件人: "freeradius-users"<freeradius-users@lists.freeradius.org>; 主题: Trouble with using virtual server tacacs'login Hi,I used freeradius-server-4.0~alpha1 to use the tacacs virtual server, but I encountered some problems when I used the ppp authencation. Here are the debug info : (33) User-Name = "66" (33) Client-Port = "va100-0" (33) User-Password = "666" (33) tacacs - Running 'authenticate PAP' from file /usr/local/etc/raddb/sites-enabled/tacacs (33) tacacs - authenticate PAP { (33) pap - Login attempt with password (33) pap - ERROR: No "known good" password found for user I searched such problem and most of them say it is due to not setting the users file.(but I actually did it!) My configure steps are as followed: 1) A brand-new config dictionary. 2) CP tacacs from site-available to site -enable,while setting the secret. 3) Delete default in sites-enable. 4) Some modification to inner-tunnel ,I did not use that ,just to run the radius. 5) Add client in clients.conf(I think I need not do that but it does not matter). 6) Add 66 Password.Cleartext := "666" in the users file. I think maybe I should do step(6) in other places? But i did not find any doc,problem, or example show how to do it . Actually, I tried every method like pap ,chap ,mschap and got the same result. Thanks a lot for your help!!! 黄立成 2071264258@qq.com
On Nov 29, 2024, at 10:38 AM, 黄立成 via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
You told me to enable the files module in tacacs, but I read the page of files module and cannot find any description of how to enable the file module, the only thing in that page is to tell me put my password at the top of user or authorize .
I have done several changes in tacacs file in sites-enable as followed: 1)tacacs { Authentication {
There is no "Authentication" section in the default sites-available/tacacs Please use the latest code *and* configuration files from the "master" branch.
files ...}
Why HTML? Just normal text is fine.
2)authenticate PAP { files
Delete the "files" line from this section. I didn't say to add it here.
pap } authenticate CHAP { files
Delete the "files" line here, too.
chap } But that did not work, the result is still:
See http://wiki.freeradius.org/list-help for "it didn't work". Add the "files" module to the "recv Authentication-Start" section. It should work. And PLEASE post the FULL DEBUGGING OUTPUT. ALL OF IT. WE CANNOT HELP YOU IF YOU IGNORE ALL OF THE DOCUMENTATION AND POST ONLY 4-5 LNES FROM THE DEBUG OUTPUT. Alan DeKok.
Thanks for your Great Advice! That works!!! And I am sorry for not giving the debug info in the incorrect format,I promise to do so next time. Thanks again! 黄立成 2071264258@qq.com ------------------ 原始邮件 ------------------ 发件人: "Alan DeKok" <aland@deployingradius.com>; 发送时间: 2024年11月29日(星期五) 晚上11:54 收件人: "FreeRadius users mailing list"<freeradius-users@lists.freeradius.org>; 抄送: "黄立成"<2071264258@qq.com>; 主题: Re: Trouble with using virtual server tacacs'login On Nov 29, 2024, at 10:38 AM, 黄立成 via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote: > You told me to enable the files module in tacacs, but I read the page of files module and cannot find any description of how to enable the file module, the only thing in that page is to tell me put my password at the top of user or authorize . > > I have done several changes in tacacs file in sites-enable as followed: > 1)tacacs { > Authentication { There is no "Authentication" section in the default sites-available/tacacs Please use the latest code *and* configuration files from the "master" branch. > files > ...} Why HTML? Just normal text is fine. > 2)authenticate PAP { > files Delete the "files" line from this section. I didn't say to add it here. > pap > } > authenticate CHAP { > files Delete the "files" line here, too. > chap > } > But that did not work, the result is still: See http://wiki.freeradius.org/list-help for "it didn't work". Add the "files" module to the "recv Authentication-Start" section. It should work. And PLEASE post the FULL DEBUGGING OUTPUT. ALL OF IT. WE CANNOT HELP YOU IF YOU IGNORE ALL OF THE DOCUMENTATION AND POST ONLY 4-5 LNES FROM THE DEBUG OUTPUT. Alan DeKok.
participants (2)
-
Alan DeKok -
黄立成