CHAP - FREERADIUS 2 to FRERRADIUS 3

Aurélio de Souza Ribeiro Neto netolistas at mpc.com.br
Wed Aug 2 15:43:40 CEST 2017


Hello,

     Sorry to importunate!!
     I solved the problem.

     In 3.0.15 version the return is fail and not invalid!

     I changed in default file and all is ok!!

     Really sorry!

Aurelio


Em 02/08/2017 09:37, Aurélio de Souza Ribeiro Neto escreveu:
> Hello,
>
> I did Upgrade from 2.2.9 to 3.0.15.
>
> For marketing purposes if my client is not on my base and tries to 
> connect to my system, I permit the access in a specific pool.
>
> When I upgraded to 3, this stoped to work.
>
> Some help?
>
> Look more details.....
>
> In my default file:
>
>         Auth-Type CHAP {
>                chap  {
>                        invalid = 1
>                     }
>
>                     if(invalid) {
>
>                        update control {
>                          Pool-Name := "mkt_pool"
>                        }
>
>                        update reply {
>                          Mikrotik-Rate-Limit := "300K/2M 600K/2200K 
> 450K/1500K 10/10"
>                        }
>
>                        ok
>                    }
>
>         }
>
>
> My radiusd -X output:
>
> Ready to process requests
> (0) Received Access-Request Id 199 from 172.17.6.2:42459 to 
> 187.120.197.145:1812 length 152
> (0)   Service-Type = Framed-User
> (0)   Framed-Protocol = PPP
> (0)   NAS-Port = 15736495
> (0)   NAS-Port-Type = Ethernet
> (0)   User-Name = "soniaregina"
> (0)   Calling-Station-Id = "84:C9:B2:A3:BB:67"
> (0)   Called-Station-Id = "CE - POP ITPM5"
> (0)   NAS-Port-Id = "ether5"
> (0)   CHAP-Challenge = 0x3cfe95eca592d11448a098b33412cd0b
> (0)   CHAP-Password = 0x01cc08e5f2ad79880124b1d826606947b2
> (0)   NAS-Identifier = "CE-ITPM"
> (0)   NAS-IP-Address = 172.17.6.2
> (0) # Executing section authorize from file 
> /usr/local/etc/raddb/sites-enabled/default
> (0)   authorize {
> (0)     [preprocess] = ok
> (0) chap:   &control:Auth-Type := CHAP
> (0)     [chap] = ok
> (0)     [mschap] = noop
> (0) sql: EXPAND %{User-Name}
> (0) sql:    --> soniaregina
> (0) sql: SQL-User-Name set to 'soniaregina'
> rlm_sql (sql): Reserved connection (1)
> (0) sql: EXPAND SELECT DISTINCT (R.id), R.username, R.attribute, 
> R.value, R.op                                  FROM 
> mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist 
> M                                  WHERE R.username =  BINARY 
> '%{SQL-User-Name}'                                  AND 
> M.usuario_login =  BINARY 
> '%{SQL-User-Name}'                                  AND N.nasname = 
> '%{Nas-IP-Address}'                                  AND N.gw_id = 
> (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY 
> '%{SQL-User-Name}' AND plano_id NOT IN (8,9,793) AND gateway_id = ( 
> SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = 
> '%{Nas-IP-Address}' ) ORDER BY ID)                                  
> UNION ALL                                  SELECT DISTINCT (R.id), 
> R.username, R.attribute, R.value, 
> R.op                                  FROM mpc_freeradius.radcheck R, 
> mpc_freeradius.nas N, mpc_lw.maclist 
> M                                  WHERE R.username =  BINARY 
> '%{SQL-User-Name}'                                  AND 
> M.usuario_login =  BINARY 
> '%{SQL-User-Name}'                                  AND M.grupocliente 
> = 'ALL-POPS'
> (0) sql:    --> SELECT DISTINCT (R.id), R.username, R.attribute, 
> R.value, R.op                                  FROM 
> mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist 
> M                                  WHERE R.username =  BINARY 
> 'soniaregina'                                  AND M.usuario_login =  
> BINARY 'soniaregina'                                  AND N.nasname =  
> '172.17.6.2'                                  AND N.gw_id = (SELECT 
> gateway_id FROM mpc_lw.maclist WHERE usuario_login =  BINARY 
> 'soniaregina' AND plano_id NOT IN (8,9,793) AND gateway_id = ( SELECT 
> gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.6.2' 
> )                                  ORDER BY 
> ID)                                  UNION 
> ALL                                  SELECT DISTINCT (R.id), 
> R.username, R.attribute, R.value, 
> R.op                                  FROM mpc_freeradius.radcheck R, 
> mpc_freeradius.nas N, mpc_lw.maclist 
> M                                  WHERE R.username =  BINARY 
> 'soniaregina'                                  AND M.usuario_login =  
> BINARY 'soniaregina'                                  AND 
> M.grupocliente = 'ALL-POPS'
> (0) sql: Executing select query: SELECT DISTINCT (R.id), R.username, 
> R.attribute, R.value, R.op                                  FROM 
> mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist 
> M                                  WHERE R.username =  BINARY 
> 'soniaregina'                                  AND M.usuario_login =  
> BINARY 'soniaregina'                                  AND N.nasname =  
> '172.17.6.2'                                  AND N.gw_id = (SELECT 
> gateway_id FROM mpc_lw.maclist WHERE usuario_login =  BINARY 
> 'soniaregina' AND plano_id NOT IN (8,9,793) AND gateway_id = ( SELECT 
> gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.6.2' 
> )                                  ORDER BY 
> ID)                                  UNION 
> ALL                                  SELECT DISTINCT (R.id), 
> R.username, R.attribute, R.value, 
> R.op                                  FROM mpc_freeradius.radcheck R, 
> mpc_freeradius.nas N, mpc_lw.maclist 
> M                                  WHERE R.username =  BINARY 
> 'soniaregina'                                  AND M.usuario_login =  
> BINARY 'soniaregina'                                  AND 
> M.grupocliente = 'ALL-POPS'
> (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = 
> '%{SQL-User-Name}' ORDER BY priority
> (0) sql:    --> SELECT groupname FROM radusergroup WHERE username = 
> 'soniaregina' ORDER BY priority
> (0) sql: Executing select query: SELECT groupname FROM radusergroup 
> WHERE username = 'soniaregina' ORDER BY priority
> (0) sql: User not found in any groups
> rlm_sql (sql): Released connection (1)
> Need 9 more connections to reach min connections (15)
> rlm_sql (sql): Opening additional connection (6), 1 of 58 pending 
> slots used
> rlm_sql_mysql: Starting connect to MySQL server
> rlm_sql_mysql: Connected to database 'mpc_freeradius' on 
> mysql.mpc.com.br via TCP/IP, server version 
> 5.5.55-0ubuntu0.14.04.1-log, protocol version 10
> (0)     [sql] = notfound
> (0)     [expiration] = noop
> (0)     [logintime] = noop
> (0) pap: WARNING: No "known good" password found for the user. Not 
> setting Auth-Type
> (0) pap: WARNING: Authentication will fail unless a "known good" 
> password is available
> (0)     [pap] = noop
> (0)   } # authorize = ok
> (0) Found Auth-Type = CHAP
> (0) # Executing group from file 
> /usr/local/etc/raddb/sites-enabled/default
> (0)   Auth-Type CHAP {
> (0) chap: ERROR: &control:Cleartext-Password is required for 
> authentication
> (0)     [chap] = fail
> (0)   } # Auth-Type CHAP = fail
> (0) Failed to authenticate the user
> (0) Using Post-Auth-Type Reject
> (0) # Executing group from file 
> /usr/local/etc/raddb/sites-enabled/default
> (0)   Post-Auth-Type REJECT {
> (0) sql: EXPAND .query
> (0) sql:    --> .query
> (0) sql: Using query template 'query'
> rlm_sql (sql): Reserved connection (2)
> (0) sql: EXPAND %{User-Name}
> (0) sql:    --> soniaregina
> (0) sql: SQL-User-Name set to 'soniaregina'
> (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, 
> authdate) VALUES ( '%{SQL-User-Name}', 
> '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')
> (0) sql:    --> INSERT INTO radpostauth (username, pass, reply, 
> authdate) VALUES ( 'soniaregina', 
> '0x01cc08e5f2ad79880124b1d826606947b2', 'Access-Reject', '2017-08-02 
> 09:11:51')
> (0) sql: Executing query: INSERT INTO radpostauth (username, pass, 
> reply, authdate) VALUES ( 'soniaregina', 
> '0x01cc08e5f2ad79880124b1d826606947b2', 'Access-Reject', '2017-08-02 
> 09:11:51')
> (0) sql: SQL query returned: success
> (0) sql: 1 record(s) updated
> rlm_sql (sql): Released connection (2)
> (0)     [sql] = ok
> (0) attr_filter.access_reject: EXPAND %{User-Name}
> (0) attr_filter.access_reject:    --> soniaregina
> (0) attr_filter.access_reject: Matched entry DEFAULT at line 11
> (0)     [attr_filter.access_reject] = updated
> (0) linelog: EXPAND messages.%{%{reply:Packet-Type}:-default}
> (0) linelog:    --> messages.Access-Reject
> (0) linelog: No such entry ".messages.Access-Reject"
> (0)     [linelog] = noop
> (0)   } # Post-Auth-Type REJECT = updated
> (0) Login incorrect (chap: &control:Cleartext-Password is required for 
> authentication): [soniaregina/<via Auth-Type = CHAP>] (from client 
> ce-popitpm-rb port 15736495 cli 84:C9:B2:A3:BB:67)
> (0) Delaying response for 1.000000 seconds
>
>
>
> -
> List info/subscribe/unsubscribe? See 
> http://www.freeradius.org/list/users.html






More information about the Freeradius-Users mailing list