"Shared secret is incorrect" - but it is identical!
Josh Howlett
Josh.Howlett at ja.net
Tue Jul 3 23:19:21 CEST 2007
Hi Ken,
What happens if, using radtest, you specify the username *without* the
realm from the remote machine?
josh.
> -----Original Message-----
> From:
> freeradius-users-bounces+j.howlett=ukerna.ac.uk at lists.freeradi
> us.org
> [mailto:freeradius-users-bounces+j.howlett=ukerna.ac.uk at lists.
freeradius.org] On Behalf Of ken
> Sent: 03 July 2007 22:02
> To: FreeRadius users mailing list
> Subject: "Shared secret is incorrect" - but it is identical!
>
> I'm trying to get FreeRadius working on a Fedora Core 6
> server with a view to eventually using it to authenticate
> against Windows Active Directory via ntlm_auth for the Janet
> Roaming Service. The first attempts at configuring it failed
> rather drastically so I went back to the beginning and I'm
> doing things one step at at time, making one-line changes to
> configs then using radtest and/or radclient to ensure it
> still works. I can now authenticate a users defined in users
> file, or in the Unix passwd file, from radtest on local
> machine. (i.e. the same one the server is running on). Next
> step is to check that I can use FreeRadius over the network
> by trying radclient on another machine.
>
> It doesn't work from the networked machine. I see the
> "invalid signature (err=2)! (Shared secret is incorrect.)" message.
>
> Debug log says to "double check the shared secret on the
> server". I have more than double checked it. I'm using the
> same shared secret on both machines. I "know" the shared
> secret is correct because it works from the local machine.
> But obviously it isn't! Because the encrypted password can't
> be read on the server. What can I do to make sure the shared
> secret truly is correct?
>
> The definitions for both hosts are identical in the
> clients.conf file. At one point I manually edited them to
> swap the names of servers while leaving the secrets the same,
> just in case there was some hidden unprintable character -
> but the new local one still worked, proving that the two
> entries in the clients.conf file are in fact identical.
>
> The shared secrets used in the radtest command are identical.
> I'm cutting and pasting the *same* radtest command in, not
> retyping it.
>
> To test for sure I put radclient commands in scripts on the
> remote machine, where they failed. Then I ftped them from
> the machine they failed on to the other one - where they
> worked! So it *has* to be the same! And if I alter it in any
> way there then radtest fails so its not getting a free
> passage just because its local.
>
> I have a horrid fear I've missed something totally obvious
> about how radclient works and that I'm doing something really
> really stupid stupid - but I can't see what. And I've been
> stuck here for over a week now. Any clues?
>
> From the local machine I get:
>
> ===================
> [ken at monstera ~]$ /usr/local/bin/radtest -d /etc/raddb
> username at bbk.ac.uk password server.IP.addr 122 sharedsecret
> Sending Access-Request of id 121 to server.IP.addr port 1812
> User-Name = "username at bbk.ac.uk"
> User-Password = "password"
> NAS-IP-Address = 255.255.255.255
> NAS-Port = 122
> rad_recv: Access-Accept packet from host server.IP.addr:1812,
> id=121, length=20 ===================
>
> But when I try from the remote machine I get:
>
> ===================
> /usr/local/bin/radtest -d /etc/raddb username at bbk.ac.uk
> password server.IP.addr 122 sharedsecret Sending
> Access-Request of id 184 to server.IP.addr port 1812
> User-Name = "username at bbk.ac.uk"
> User-Password = "password"
> NAS-IP-Address = 255.255.255.255
> NAS-Port = 122
> rad_recv: Access-Reject packet from host server.IP.addr:1812,
> id=184, length=20
> rad_verify: Received Access-Reject packet from client
> server.IP.addr port 1812 with invalid signature (err=2)!
> (Shared secret is incorrect.)
> [ken at ficus ~]$ /usr/local/bin/radtest -d /etc/raddb
> username at bbk.ac.uk password server.IP.addr 122 sharedsecret
> Sending Access-Request of id 246 to server.IP.addr port 1812
> User-Name = "username at bbk.ac.uk"
> User-Password = "password"
> NAS-IP-Address = 255.255.255.255
> NAS-Port = 122
> rad_recv: Access-Reject packet from host server.IP.addr:1812,
> id=246, length=20
> rad_verify: Received Access-Reject packet from client
> server.IP.addr port 1812 with invalid signature (err=2)!
> (Shared secret is incorrect.)
> [ken at ficus ~]$ /usr/local/bin/radtest -d /etc/raddb
> username at bbk.ac.uk password server.IP.addr 122 sharedsecret
> Sending Access-Request of id 7 to server.IP.addr port 1812
> User-Name = "username at bbk.ac.uk"
> User-Password = "password"
> NAS-IP-Address = 255.255.255.255
> NAS-Port = 122
> rad_recv: Access-Reject packet from host server.IP.addr:1812,
> id=7, length=20
> rad_verify: Received Access-Reject packet from client
> server.IP.addr port 1812 with invalid signature (err=2)!
> (Shared secret is incorrect.)
> ==================
>
>
> I strongly suspect that I am doing something stupid on the
> client side, because the same request works from the local
> server. But just in case its relevant, on the server in debug
> mode the failed transaction looks like this:
>
>
> ==================
> rad_recv: Access-Request packet from host
> client.IP.addr:32772, id=61, length=68
> User-Name = "username at bbk.ac.uk"
> User-Password =
> "V\303\245\321\364Fb\334\373\275\242\203\\o6\264"
> NAS-IP-Address = 255.255.255.255
> NAS-Port = 122
> Processing the authorize section of radiusd.conf
> modcall: entering group authorize for request 9
> modcall[authorize]: module "preprocess" returns ok for request 9
> radius_xlat:
> '/var/log/radius/radacct/client.IP.addr/auth-detail-20070703'
> rlm_detail:
> /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d
> expands to
> /var/log/radius/radacct/client.IP.addr/auth-detail-20070703
> modcall[authorize]: module "auth_log" returns ok for request 9
> modcall[authorize]: module "chap" returns noop for request 9
> modcall[authorize]: module "mschap" returns noop for request 9
> rlm_realm: Looking up realm "bbk.ac.uk" for User-Name =
> "username at bbk.ac.uk"
> rlm_realm: Found realm "bbk.ac.uk"
> rlm_realm: Adding Stripped-User-Name = "username"
> rlm_realm: Proxying request from user username to realm bbk.ac.uk
> rlm_realm: Adding Realm = "bbk.ac.uk"
> rlm_realm: Authentication realm is LOCAL.
> modcall[authorize]: module "suffix" returns noop for request 9
> rlm_eap: No EAP-Message, not doing EAP
> modcall[authorize]: module "eap" returns noop for request 9
> users: Matched entry DEFAULT at line 20
> modcall[authorize]: module "files" returns ok for request 9
> rlm_pap: WARNING! No "known good" password found for the user.
> Authentication may fail because of this.
> modcall[authorize]: module "pap" returns noop for request 9
> modcall: leaving group authorize (returns ok) for request 9
> rad_check_password: Found Auth-Type System
> auth: type "System"
> Processing the authenticate section of radiusd.conf
> modcall: entering group authenticate for request 9
> modcall[authenticate]: module "unix" returns notfound for request 9
> modcall: leaving group authenticate (returns notfound) for request 9
> auth: Failed to validate the user.
> WARNING: Unprintable characters in the password. ?
> Double-check the shared secret on the server and the NAS!
> Delaying request 9 for 1 seconds
> Finished request 9
> Going to the next request
> --- Walking the entire request list ---
> Waking up in 1 seconds...
> --- Walking the entire request list ---
> Waking up in 1 seconds...
> --- Walking the entire request list ---
> Sending Access-Reject of id 61 to client.IP.addr port 32772
> Waking up in 4 seconds...
> --- Walking the entire request list ---
> Cleaning up request 9 ID 61 with timestamp 468aaada Nothing
> to do. Sleeping until we see a request.
> ==================
>
>
> And a successful one looks like this - the obvious difference
> is that the password is in clear (though I have obfuscated it
> here) - as would be expected if there was no shared secret.
>
> ==================
> rad_recv: Access-Request packet from host
> server.IP.addr:32770, id=170, length=46
> User-Name = "username"
> User-Password = "password"
> Processing the authorize section of radiusd.conf
> modcall: entering group authorize for request 10
> modcall[authorize]: module "preprocess" returns ok for request 10
> radius_xlat:
> '/var/log/radius/radacct/server.IP.addr/auth-detail-20070703'
> rlm_detail:
> /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d
> expands to
> /var/log/radius/radacct/server.IP.addr/auth-detail-20070703
> modcall[authorize]: module "auth_log" returns ok for request 10
> modcall[authorize]: module "chap" returns noop for request 10
> modcall[authorize]: module "mschap" returns noop for request 10
> rlm_realm: No '@' in User-Name = "username", looking up
> realm NULL
> rlm_realm: Found realm "NULL"
> rlm_realm: Adding Stripped-User-Name = "username"
> rlm_realm: Proxying request from user username to realm NULL
> rlm_realm: Adding Realm = "NULL"
> rlm_realm: Authentication realm is LOCAL.
> modcall[authorize]: module "suffix" returns noop for request 10
> rlm_eap: No EAP-Message, not doing EAP
> modcall[authorize]: module "eap" returns noop for request 10
> users: Matched entry username at line 2
> modcall[authorize]: module "files" returns ok for request 10
> rlm_pap: Found existing Auth-Type, not changing it.
> modcall[authorize]: module "pap" returns noop for request 10
> modcall: leaving group authorize (returns ok) for request 10
> rad_check_password: Found Auth-Type Local
> auth: type Local
> auth: user supplied User-Password matches local User-Password
> Processing the post-auth section of radiusd.conf
> modcall: entering group post-auth for request 10
> radius_xlat:
> '/var/log/radius/radacct/server.IP.addr/reply-detail-20070703'
> rlm_detail:
> /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d
> expands to
> /var/log/radius/radacct/server.IP.addr/reply-detail-20070703
> modcall[post-auth]: module "reply_log" returns ok for request 10
> modcall: leaving group post-auth (returns ok) for request 10
> Sending Access-Accept of id 170 to server.IP.addr port 32770
> Finished request 10 Going to the next request
> --- Walking the entire request list ---
> Waking up in 6 seconds...
> --- Walking the entire request list ---
> Cleaning up request 10 ID 170 with timestamp 468aab69 Nothing
> to do. Sleeping until we see a ==================
>
>
> Debug of startup looks like this (same in both cases obviously).
> I made new conf files to contain any local changes I might
> make & to yhelp me find my way aroudn radiusd.conf more
> easily - but they are just the sections of conf I might want
> to change pulled out and INCLUDEd back in so no substantial change:
>
> ==================
> /usr/local/sbin/radiusd -X -d /etc/raddb Starting - reading
> configuration files ...
> reread_config: reading radiusd.conf
> Config: including file: /etc/raddb/bbk_fr_listen.conf
> Config: including file: /etc/raddb/bbk_fr_security.conf
> Config: including file: /etc/raddb/proxy.conf
> Config: including file: /etc/raddb/clients.conf
> Config: including file: /etc/raddb/snmp.conf
> Config: including file: /etc/raddb/eap.conf
> Config: including file: /etc/raddb/bbk_fr_mschap.conf
> Config: including file: /etc/raddb/bbk_fr_ldap.conf
> Config: including file: /etc/raddb/bbk_fr_passwd.conf
> Config: including file: /etc/raddb/bbk_fr_realms.conf
> Config: including file: /etc/raddb/bbk_fr_details.conf
> Config: including file: /etc/raddb/sql.conf
> Config: including file: /etc/raddb/bbk_fr_radutmp.conf
> Config: including file: /etc/raddb/bbk_fr_counters.conf
> Config: including file: /etc/raddb/bbk_fr_exec.conf
> Config: including file: /etc/raddb/bbk_fr_ippool.conf
> main: prefix = "/usr/local"
> main: localstatedir = "/var"
> main: logdir = "/var/log/radius"
> main: libdir = "/usr/local/lib"
> main: radacctdir = "/var/log/radius/radacct"
> main: hostname_lookups = no
> main: max_request_time = 30
> main: cleanup_delay = 5
> main: max_requests = 1024
> main: delete_blocked_requests = 0
> main: port = 0
> main: allow_core_dumps = no
> main: log_stripped_names = no
> main: log_file = "/var/log/radius/radius.log"
> main: log_auth = no
> main: log_auth_badpass = no
> main: log_auth_goodpass = no
> main: pidfile = "/var/run/radiusd/radiusd.pid"
> main: user = "(null)"
> main: group = "(null)"
> main: usercollide = no
> main: lower_user = "no"
> main: lower_pass = "no"
> main: nospace_user = "no"
> main: nospace_pass = "no"
> main: checkrad = "/usr/local/sbin/checkrad"
> main: proxy_requests = yes
> proxy: retry_delay = 5
> proxy: retry_count = 3
> proxy: synchronous = no
> proxy: default_fallback = yes
> proxy: dead_time = 120
> proxy: post_proxy_authorize = no
> proxy: wake_all_if_all_dead = no
> security: max_attributes = 200
> security: reject_delay = 1
> security: status_server = yes
> main: debug_level = 0
> read_config_files: reading dictionary
> read_config_files: reading naslist
> Using deprecated naslist file. Support for this will go away soon.
> read_config_files: reading clients
> read_config_files: reading realms
> radiusd: entering modules setup
> Module: Library search path is /usr/local/lib
> Module: Loaded exec
> exec: wait = yes
> exec: program = "(null)"
> exec: input_pairs = "request"
> exec: output_pairs = "(null)"
> exec: packet_type = "(null)"
> rlm_exec: Wait=yes but no output defined. Did you mean output=none?
> Module: Instantiated exec (exec)
> Module: Loaded expr
> Module: Instantiated expr (expr)
> Module: Loaded PAP
> pap: encryption_scheme = "crypt"
> pap: auto_header = yes
> Module: Instantiated pap (pap)
> Module: Loaded CHAP
> Module: Instantiated chap (chap)
> Module: Loaded MS-CHAP
> mschap: use_mppe = yes
> mschap: require_encryption = yes
> mschap: require_strong = yes
> mschap: with_ntdomain_hack = yes
> mschap: passwd = "(null)"
> mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
> --username=%{Stripped-User-Name:-%{User-Name:-None}}
> --challenge=%{mschap:Challenge:-00}
> --nt-response=%{mschap:NT-Response:-00}"
> Module: Instantiated mschap (mschap)
> Module: Loaded System
> unix: cache = no
> unix: passwd = "(null)"
> unix: shadow = "(null)"
> unix: group = "(null)"
> unix: radwtmp = "/var/log/radius/radwtmp"
> unix: usegroup = no
> unix: cache_reload = 600
> Module: Instantiated unix (unix)
> Module: Loaded eap
> eap: default_eap_type = "peap"
> eap: timer_expire = 60
> eap: ignore_unknown_eap_types = no
> eap: cisco_accounting_username_bug = no
> rlm_eap: Loaded and initialized type md5
> rlm_eap: Loaded and initialized type leap
> gtc: challenge = "Password: "
> gtc: auth_type = "PAP"
> rlm_eap: Loaded and initialized type gtc
> tls: rsa_key_exchange = no
> tls: dh_key_exchange = yes
> tls: rsa_key_length = 512
> tls: dh_key_length = 512
> tls: verify_depth = 0
> tls: CA_path = "(null)"
> tls: pem_file_type = yes
> tls: private_key_file = "/etc/raddb/certs/radius2.bbk.ac.uk.key"
> tls: certificate_file = "/etc/raddb/certs/radius2.bbk.ac.uk.pem"
> tls: CA_file = "/etc/raddb/certs/ct_root.pem"
> tls: private_key_password = "whatever"
> tls: dh_file = "/etc/raddb/certs/dh"
> tls: random_file = "/dev/urandom"
> tls: fragment_size = 1024
> tls: include_length = yes
> tls: check_crl = no
> tls: check_cert_cn = "(null)"
> tls: cipher_list = "(null)"
> tls: check_cert_issuer = "(null)"
> rlm_eap_tls: Loading the certificate file as a chain
> rlm_eap: Loaded and initialized type tls
> peap: default_eap_type = "mschapv2"
> peap: copy_request_to_tunnel = no
> peap: use_tunneled_reply = no
> peap: proxy_tunneled_request_as_eap = yes
> rlm_eap: Loaded and initialized type peap
> mschapv2: with_ntdomain_hack = no
> rlm_eap: Loaded and initialized type mschapv2
> Module: Instantiated eap (eap)
> Module: Loaded preprocess
> preprocess: huntgroups = "/etc/raddb/huntgroups"
> preprocess: hints = "/etc/raddb/hints"
> preprocess: with_ascend_hack = no
> preprocess: ascend_channels_per_line = 23
> preprocess: with_ntdomain_hack = no
> preprocess: with_specialix_jetstream_hack = no
> preprocess: with_cisco_vsa_hack = no
> preprocess: with_alvarion_vsa_hack = no
> Module: Instantiated preprocess (preprocess)
> Module: Loaded detail
> detail: detailfile =
> "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d"
> detail: detailperm = 384
> detail: dirperm = 493
> detail: locking = no
> Module: Instantiated detail (auth_log)
> Module: Loaded realm
> realm: format = "suffix"
> realm: delimiter = "@"
> realm: ignore_default = no
> realm: ignore_null = no
> Module: Instantiated realm (suffix)
> Module: Loaded files
> files: usersfile = "/etc/raddb/users"
> files: acctusersfile = "/etc/raddb/acct_users"
> files: preproxy_usersfile = "/etc/raddb/preproxy_users"
> files: compat = "no"
> Module: Instantiated files (files)
> Module: Loaded Acct-Unique-Session-Id
> acct_unique: key = "User-Name, Acct-Session-Id,
> NAS-IP-Address, Client-IP-Address, NAS-Port"
> Module: Instantiated acct_unique (acct_unique)
> detail: detailfile =
> "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
> detail: detailperm = 384
> detail: dirperm = 493
> detail: locking = no
> Module: Instantiated detail (detail)
> Module: Loaded radutmp
> radutmp: filename = "/var/log/radius/radutmp"
> radutmp: username = "%{User-Name}"
> radutmp: case_sensitive = yes
> radutmp: check_with_nas = yes
> radutmp: perm = 384
> radutmp: callerid = yes
> Module: Instantiated radutmp (radutmp)
> detail: detailfile =
> "/var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d"
> detail: detailperm = 384
> detail: dirperm = 493
> detail: locking = no
> Module: Instantiated detail (pre_proxy_log)
> detail: detailfile =
> "/var/log/radius/radacct/%{Client-IP-Address}/post-proxy-detai
l-%Y%m%d"
> detail: detailperm = 384
> detail: dirperm = 493
> detail: locking = no
> Module: Instantiated detail (post_proxy_log)
> detail: detailfile =
> "/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d"
> detail: detailperm = 384
> detail: dirperm = 493
> detail: locking = no
> Module: Instantiated detail (reply_log)
> Listening on authentication *:1812
> Listening on accounting *:1813
> Listening on proxy *:1814
> Ready to process requests.
>
> ==================
>
>
> FreeRADIUS Version 1.1.5, for host i686-pc-linux-gnu, built
> on Mar 9 2007 at 15:07:40
>
>
> The configurations are minimal:
>
>
> relevant entries in clients file:
>
> ==================
> client nnn.nnn.nnn.nnn {
> secret = sharedsecret
> shortname = monstera
> nastype = other
> }
> client nnn.nnn.nnn.nnn {
> secret = sharedsecret
> shortname = ficus
> nastype = other
> }
> ==================
>
> relevant entry in users file
>
> ==================
> username Auth-Type := Local, User-Password == "password"
> ==================
>
>
> As I said, authentication works for the host on which Freeradius
> is running, but not on the other.
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>
More information about the Freeradius-Users
mailing list