Hi all. have been enjoying radius for a while now. Had to make a severupgrade and move over to Fedora 8 for HW support. Still using 1.1.7 because it rocks. Well not quite any more, i moved over the configfiles i had on Debian and everything seems ok except for no users can login anymore via pptp on my firewall. My config: Linux ns.intern.fb.se 2.6.24.3-50.fc8 #1 SMP Thu Mar 20 14:47:10 EDT 2008 i686 i686 i386 GNU/Linux [root@ns usersdepot]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = yes main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/var/run/radius/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/ detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. When a user login: rad_recv: Access-Request packet from host 10.0.5.1:60461, id=3, length=181 NAS-Identifier = "halon" NAS-IP-Address = 10.0.5.1 Message-Authenticator = 0x18e8c7acd5db57751eb497c6d6c59503 NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "212.247.38.166" User-Name = "giobbi" MS-CHAP-Challenge = 0xbb1e6823d2ae12e363e056523f30a6de MS-CHAP2-Response = 0x01000357ec5a5b0eb534ea8682a730849e89000000000000000034ff990a30a4a24681b50b31d7da17a3d2634e2e55ad5e17 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 0 rlm_realm: No '@' in User-Name = "giobbi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 185 users: Matched entry giobbi at line 4 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: Told to do MS-CHAPv2 for giobbi with NT-Password rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 0 modcall: leaving group MS-CHAP (returns ok) for request 0 Login OK: [giobbi] (from client fw-halon port 0 cli 212.247.38.166) Sending Access-Accept of id 3 to 10.0.5.1 port 60461 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Service-Type = Framed-User Framed-Route = "10.0.4.0/24 10.0.5.245 10.0.5.0/24 10.0.5.1 10.0.8.0/24 10.0.5.245 10.0.9/24 10.0.5.245" MS-CHAP2-Success = 0x01533d34444432314431443741453246333335453632323046463633304643464435463835353236393736 MS-MPPE-Recv-Key = 0x9f2fb3fc6a24b8a5a5251de891f8ece8 MS-MPPE-Send-Key = 0xd488a4ec77025f4c8c3e4defc4fbdf70 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.5.1:60461, id=3, length=181 Sending duplicate reply to client fw-halon:60461 - ID: 3 Re-sending Access-Accept of id 3 to 10.0.5.1 port 60461 Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.5.1:60461, id=3, length=181 Sending duplicate reply to client fw-halon:60461 - ID: 3 Re-sending Access-Accept of id 3 to 10.0.5.1 port 60461 Waking up in 6 seconds... Firewall log: halon(Firewall_GOT)# system logs pptp PPTP: Incoming control connection from 212.247.38.166 55553 to 212.247.38.166 1723 pptp0: attached to connection with 212.247.38.166 55553 [pptp0] Accepting PPTP connection [pptp0] opening link "pptp0"... [pptp0] link: OPEN event [pptp0] LCP: Open event [pptp0] LCP: state change Initial --> Starting [pptp0] LCP: LayerStart [pptp0] PPTP: attaching to peer's outgoing call [pptp0] link: UP event [pptp0] link: origination is remote [pptp0] LCP: Up event [pptp0] LCP: state change Starting --> Req-Sent [pptp0] LCP: SendConfigReq #31 ACFCOMP PROTOCOMP MRU 1460 MAGICNUM a3e02c2f AUTHPROTO CHAP MSOFTv2 [pptp0] LCP: rec'd Configure Request #1 (Req-Sent) ACCMAP 0x00000000 MAGICNUM c5887687 PROTOCOMP ACFCOMP [pptp0] LCP: SendConfigAck #1 ACCMAP 0x00000000 MAGICNUM c5887687 PROTOCOMP ACFCOMP [pptp0] LCP: state change Req-Sent --> Ack-Sent [pptp0] LCP: SendConfigReq #32 ACFCOMP PROTOCOMP MRU 1460 MAGICNUM a3e02c2f AUTHPROTO CHAP MSOFTv2 [pptp0] LCP: rec'd Configure Ack #32 (Ack-Sent) ACFCOMP PROTOCOMP MRU 1460 MAGICNUM a3e02c2f AUTHPROTO CHAP MSOFTv2 [pptp0] LCP: state change Ack-Sent --> Opened [pptp0] LCP: auth: peer wants nothing, I want CHAP [pptp0] CHAP: sending CHALLENGE len:17 [pptp0] LCP: LayerUp [pptp0] CHAP: rec'd RESPONSE #1 Name: "giobbi" [pptp0] AUTH: Auth-Thread started [pptp0] AUTH: Trying RADIUS [pptp0] RADIUS: RadiusAuthenticate for: giobbi [pptp0] RADIUS: rad_send_request failed: No valid RADIUS responses received [pptp0] AUTH: RADIUS returned undefined [pptp0] AUTH: Trying INTERNAL AUTH: User "giobbi" not found in secret file [pptp0] AUTH: INTERNAL returned failed [pptp0] AUTH: ran out of backends [pptp0] AUTH: Auth-Thread finished normally [pptp0] CHAP: ChapInputFinish: status failed Reply message: E=691 R=0 M=Login incorrect [pptp0] CHAP: sending FAILURE len:27 [pptp0] LCP: authorization failed [pptp0] LCP: parameter negotiation failed [pptp0] LCP: state change Opened --> Stopping [pptp0] AUTH: Cleanup [pptp0] LCP: SendTerminateReq #33 [pptp0] LCP: LayerDown [pptp0] LCP: rec'd Terminate Request #2 (Stopping) [pptp0] LCP: SendTerminateAck #34 [pptp0] LCP: rec'd Terminate Ack #33 (Stopping) [pptp0] LCP: state change Stopping --> Stopped [pptp0] LCP: LayerFinish pptp0-0: clearing call pptp0-0: killing channel [pptp0] PPTP call terminated [pptp0] link: DOWN event [pptp0] LCP: Close event [pptp0] LCP: state change Stopped --> Closed [pptp0] LCP: Down event [pptp0] LCP: state change Closed --> Initial pptp0: closing connection with 212.247.38.166 55553 pptp0: ctrl connection closed by peer pptp0: killing connection with 212.247.38.166 55553 So here's the problem, the firewall doesn't like the response it gets, isn't valid for some reason. I'm using the exact same configs as in the working Debian version (same radius, 1.1.7), so in theory these should work just as fine in my Fedora setup right? Any clues or tip is greatly appreciated. thx p