freeradius server works only on localhost
Hi All, I'm new here. <https://unix.stackexchange.com/posts/655577/timeline> I have a freeradius server setup but it only works on my localhost. I do see the frames from the remote host coming in on Wireshark, so the requests do arrive but on the client I just get: |radtest MAC foo host:1812 0 bar Sent Access-Request Id 67 from 0.0.0.0:47922 to host:1812 length 82 User-Name = "MAC" User-Password = "foo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "foo" Sent Access-Request Id 67 from 0.0.0.0:47922 to host:1812 length 82 User-Name = "MAC" User-Password = "foo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "foo" Sent Access-Request Id 67 from 0.0.0.0:47922 to host:1812 length 82 User-Name = "MAC" User-Password = "foo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "foo" (0) No reply from server for ID 67 socket 3 | While on localhost I get: |radtest MAC foo 127.0.0.1:1812 0 bar Sent Access-Request Id 12 from 0.0.0.0:50005 to 127.0.0.1:1812 length 82 User-Name = "MAC" User-Password = "foo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "foo" Received Access-Accept Id 12 from 127.0.0.1:1812 to 127.0.0.1:50005 length 20 | How do I open server access up to the outside, as well? Thanks!
On Jun 24, 2021, at 9:22 AM, Ron Eggler <ron.eggler@gmail.com> wrote:
I have a freeradius server setup but it only works on my localhost. I do see the frames from the remote host coming in on Wireshark, so the requests do arrive but on the client I just get:
... the frames blocked by your local firewall.
|radtest MAC foo host:1812 0 bar Sent Access-Request Id 67 from 0.0.0.0:47922 to host:1812 length 82 User-Name = "MAC" User-Password = "foo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "foo" Sent Access-Request Id 67 from 0.0.0.0:47922 to host:1812 length 82 User-Name = "MAC" User-Password = "foo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "foo" Sent Access-Request Id 67 from 0.0.0.0:47922 to host:1812 length 82 User-Name = "MAC" User-Password = "foo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "foo" (0) No reply from server for ID 67 socket 3 |
While on localhost I get:
|radtest MAC foo 127.0.0.1:1812 0 bar Sent Access-Request Id 12 from 0.0.0.0:50005 to 127.0.0.1:1812 length 82 User-Name = "MAC" User-Password = "foo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "foo" Received Access-Accept Id 12 from 127.0.0.1:1812 to 127.0.0.1:50005 length 20 |
How do I open server access up to the outside, as well?
Some combination of fixing SeLinux and/or your local IP firewall rules. Alan DeKok.
On 2021-06-24 6:55 a.m., Alan DeKok wrote:
On Jun 24, 2021, at 9:22 AM, Ron Eggler <ron.eggler@gmail.com> wrote:
I have a freeradius server setup but it only works on my localhost. I do see the frames from the remote host coming in on Wireshark, so the requests do arrive but on the client I just get: ... the frames blocked by your local firewall.
I do not have a firewall active on this computer and running Wireshark, I can see the the RADIUS request frames coming in from the client on my LAN as they correspond to the three requests before it gives up: 6508 13.018560775 192.168.1.87 192.168.1.221 RADIUS 126 Access-Request id=111 7900 18.026087338 192.168.1.87 192.168.1.221 RADIUS 126 Access-Request id=111, Duplicate Request 9210 23.042855784 192.168.1.87 192.168.1.221 RADIUS 126 Access-Request id=111, Duplicate Request Hence I suspect that the issue may be with the RADIUS server configuration, rather than with my network setup - is that suspicion wrong? [snip]
On 24/06/2021 15:22, Ron Eggler wrote:
6508 13.018560775 192.168.1.87 192.168.1.221 RADIUS 126 Access-Request id=111 7900 18.026087338 192.168.1.87 192.168.1.221 RADIUS 126 Access-Request id=111, Duplicate Request 9210 23.042855784 192.168.1.87 192.168.1.221 RADIUS 126 Access-Request id=111, Duplicate Request
Hence I suspect that the issue may be with the RADIUS server configuration, rather than with my network setup - is that suspicion wrong?
What does radiusd -X say? If the packets are hitting FreeRADIUS then it will tell you that (even if the client is unknown, it will say *something*). If they are not getting to FreeRADIUS, then they are being blocked/lost elsewhere (e.g. iptables, other firewall, wrong IP/port, etc). See https://wiki.freeradius.org/list-help for info on getting debug output. -- Matthew
On 2021-06-24 7:27 a.m., Matthew Newton wrote:
On 24/06/2021 15:22, Ron Eggler wrote:
6508 13.018560775 192.168.1.87 192.168.1.221 RADIUS 126 Access-Request id=111 7900 18.026087338 192.168.1.87 192.168.1.221 RADIUS 126 Access-Request id=111, Duplicate Request 9210 23.042855784 192.168.1.87 192.168.1.221 RADIUS 126 Access-Request id=111, Duplicate Request
Hence I suspect that the issue may be with the RADIUS server configuration, rather than with my network setup - is that suspicion wrong?
What does radiusd -X say?
Oh, that's good! listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 49015 Listening on proxy address :: port 56868 Ready to process requests and then when I sen the requests: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.87 port 45044 proto udp Ready to process requests Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.87 port 45044 proto udp Ready to process requests Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.87 port 45044 proto udp Ready to process requests I guess I'll need to configure the client somewhere first....
If the packets are hitting FreeRADIUS then it will tell you that (even if the client is unknown, it will say *something*).
If they are not getting to FreeRADIUS, then they are being blocked/lost elsewhere (e.g. iptables, other firewall, wrong IP/port, etc).
See https://wiki.freeradius.org/list-help for info on getting debug output.
On 2021-06-24 7:27 a.m., Matthew Newton wrote:
On 24/06/2021 15:22, Ron Eggler wrote:
6508 13.018560775 192.168.1.87 192.168.1.221 RADIUS 126 Access-Request id=111 7900 18.026087338 192.168.1.87 192.168.1.221 RADIUS 126 Access-Request id=111, Duplicate Request 9210 23.042855784 192.168.1.87 192.168.1.221 RADIUS 126 Access-Request id=111, Duplicate Request
Hence I suspect that the issue may be with the RADIUS server configuration, rather than with my network setup - is that suspicion wrong?
What does radiusd -X say?
If the packets are hitting FreeRADIUS then it will tell you that (even if the client is unknown, it will say *something*).
If they are not getting to FreeRADIUS, then they are being blocked/lost elsewhere (e.g. iptables, other firewall, wrong IP/port, etc).
See https://wiki.freeradius.org/list-help for info on getting debug output.
Just confirming, I added the host to my clients file and I received "Access-Accept" as expected! Thanks!
On Jun 24, 2021, at 10:22 AM, Ron Eggler <ron.eggler@gmail.com> wrote:
I do not have a firewall active on this computer and running Wireshark, I can see the the RADIUS request frames coming in from the client on my LAN as they correspond to the three requests before it gives up:
Wireshark looks at raw packets received on the network. i.e. before any firewall rules are applied.
6508 13.018560775 192.168.1.87 192.168.1.221 RADIUS 126 Access-Request id=111 7900 18.026087338 192.168.1.87 192.168.1.221 RADIUS 126 Access-Request id=111, Duplicate Request 9210 23.042855784 192.168.1.87 192.168.1.221 RADIUS 126 Access-Request id=111, Duplicate Request
Hence I suspect that the issue may be with the RADIUS server configuration, rather than with my network setup - is that suspicion wrong?
Yes. If the server receives a packet, it prints a debug message saying that. If the server receives a packet from an unknown client, it prints out "received packet from unknown client". If the server receives a packet from a known client, it processes the packet. As I said... look at SeLinux and/or firewall rules. No amount of poking FreeRADIUS will fix this. Alan DeKok.
On Thu, Jun 24, 2021 at 06:22:28AM -0700, Ron Eggler wrote:
Hi All,
I'm new here. <https://unix.stackexchange.com/posts/655577/timeline>
I have a freeradius server setup but it only works on my localhost. I do see the frames from the remote host coming in on Wireshark, so the requests do arrive but on the client I just get:
|radtest MAC foo host:1812 0 bar Sent Access-Request Id 67 from 0.0.0.0:47922 to host:1812 length 82 User-Name = "MAC" User-Password = "foo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "foo" Sent Access-Request Id 67 from 0.0.0.0:47922 to host:1812 length 82 User-Name = "MAC" User-Password = "foo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "foo" Sent Access-Request Id 67 from 0.0.0.0:47922 to host:1812 length 82 User-Name = "MAC" User-Password = "foo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "foo" (0) No reply from server for ID 67 socket 3 |
While on localhost I get:
|radtest MAC foo 127.0.0.1:1812 0 bar Sent Access-Request Id 12 from 0.0.0.0:50005 to 127.0.0.1:1812 length 82 User-Name = "MAC" User-Password = "foo" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "foo" Received Access-Accept Id 12 from 127.0.0.1:1812 to 127.0.0.1:50005 length 20 |
How do I open server access up to the outside, as well?
Thanks!
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Go a /path/to/command -i <your IP address> -p 1812 -- Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising! Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b What you need is not a special garment, but a perfect heart. -unknown Beware https://mindspring.com
participants (4)
-
Alan DeKok -
Matthew Newton -
Ron Eggler -
The Doctor