CHAP - FREERADIUS 2 to FRERRADIUS 3
Aurélio de Souza Ribeiro Neto
netolistas at mpc.com.br
Wed Aug 2 15:43:40 CEST 2017
Hello,
Sorry to importunate!!
I solved the problem.
In 3.0.15 version the return is fail and not invalid!
I changed in default file and all is ok!!
Really sorry!
Aurelio
Em 02/08/2017 09:37, Aurélio de Souza Ribeiro Neto escreveu:
> Hello,
>
> I did Upgrade from 2.2.9 to 3.0.15.
>
> For marketing purposes if my client is not on my base and tries to
> connect to my system, I permit the access in a specific pool.
>
> When I upgraded to 3, this stoped to work.
>
> Some help?
>
> Look more details.....
>
> In my default file:
>
> Auth-Type CHAP {
> chap {
> invalid = 1
> }
>
> if(invalid) {
>
> update control {
> Pool-Name := "mkt_pool"
> }
>
> update reply {
> Mikrotik-Rate-Limit := "300K/2M 600K/2200K
> 450K/1500K 10/10"
> }
>
> ok
> }
>
> }
>
>
> My radiusd -X output:
>
> Ready to process requests
> (0) Received Access-Request Id 199 from 172.17.6.2:42459 to
> 187.120.197.145:1812 length 152
> (0) Service-Type = Framed-User
> (0) Framed-Protocol = PPP
> (0) NAS-Port = 15736495
> (0) NAS-Port-Type = Ethernet
> (0) User-Name = "soniaregina"
> (0) Calling-Station-Id = "84:C9:B2:A3:BB:67"
> (0) Called-Station-Id = "CE - POP ITPM5"
> (0) NAS-Port-Id = "ether5"
> (0) CHAP-Challenge = 0x3cfe95eca592d11448a098b33412cd0b
> (0) CHAP-Password = 0x01cc08e5f2ad79880124b1d826606947b2
> (0) NAS-Identifier = "CE-ITPM"
> (0) NAS-IP-Address = 172.17.6.2
> (0) # Executing section authorize from file
> /usr/local/etc/raddb/sites-enabled/default
> (0) authorize {
> (0) [preprocess] = ok
> (0) chap: &control:Auth-Type := CHAP
> (0) [chap] = ok
> (0) [mschap] = noop
> (0) sql: EXPAND %{User-Name}
> (0) sql: --> soniaregina
> (0) sql: SQL-User-Name set to 'soniaregina'
> rlm_sql (sql): Reserved connection (1)
> (0) sql: EXPAND SELECT DISTINCT (R.id), R.username, R.attribute,
> R.value, R.op FROM
> mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist
> M WHERE R.username = BINARY
> '%{SQL-User-Name}' AND
> M.usuario_login = BINARY
> '%{SQL-User-Name}' AND N.nasname =
> '%{Nas-IP-Address}' AND N.gw_id =
> (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY
> '%{SQL-User-Name}' AND plano_id NOT IN (8,9,793) AND gateway_id = (
> SELECT gw_id FROM mpc_freeradius.nas WHERE nasname =
> '%{Nas-IP-Address}' ) ORDER BY ID)
> UNION ALL SELECT DISTINCT (R.id),
> R.username, R.attribute, R.value,
> R.op FROM mpc_freeradius.radcheck R,
> mpc_freeradius.nas N, mpc_lw.maclist
> M WHERE R.username = BINARY
> '%{SQL-User-Name}' AND
> M.usuario_login = BINARY
> '%{SQL-User-Name}' AND M.grupocliente
> = 'ALL-POPS'
> (0) sql: --> SELECT DISTINCT (R.id), R.username, R.attribute,
> R.value, R.op FROM
> mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist
> M WHERE R.username = BINARY
> 'soniaregina' AND M.usuario_login =
> BINARY 'soniaregina' AND N.nasname =
> '172.17.6.2' AND N.gw_id = (SELECT
> gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY
> 'soniaregina' AND plano_id NOT IN (8,9,793) AND gateway_id = ( SELECT
> gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.6.2'
> ) ORDER BY
> ID) UNION
> ALL SELECT DISTINCT (R.id),
> R.username, R.attribute, R.value,
> R.op FROM mpc_freeradius.radcheck R,
> mpc_freeradius.nas N, mpc_lw.maclist
> M WHERE R.username = BINARY
> 'soniaregina' AND M.usuario_login =
> BINARY 'soniaregina' AND
> M.grupocliente = 'ALL-POPS'
> (0) sql: Executing select query: SELECT DISTINCT (R.id), R.username,
> R.attribute, R.value, R.op FROM
> mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist
> M WHERE R.username = BINARY
> 'soniaregina' AND M.usuario_login =
> BINARY 'soniaregina' AND N.nasname =
> '172.17.6.2' AND N.gw_id = (SELECT
> gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY
> 'soniaregina' AND plano_id NOT IN (8,9,793) AND gateway_id = ( SELECT
> gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.6.2'
> ) ORDER BY
> ID) UNION
> ALL SELECT DISTINCT (R.id),
> R.username, R.attribute, R.value,
> R.op FROM mpc_freeradius.radcheck R,
> mpc_freeradius.nas N, mpc_lw.maclist
> M WHERE R.username = BINARY
> 'soniaregina' AND M.usuario_login =
> BINARY 'soniaregina' AND
> M.grupocliente = 'ALL-POPS'
> (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username =
> '%{SQL-User-Name}' ORDER BY priority
> (0) sql: --> SELECT groupname FROM radusergroup WHERE username =
> 'soniaregina' ORDER BY priority
> (0) sql: Executing select query: SELECT groupname FROM radusergroup
> WHERE username = 'soniaregina' ORDER BY priority
> (0) sql: User not found in any groups
> rlm_sql (sql): Released connection (1)
> Need 9 more connections to reach min connections (15)
> rlm_sql (sql): Opening additional connection (6), 1 of 58 pending
> slots used
> rlm_sql_mysql: Starting connect to MySQL server
> rlm_sql_mysql: Connected to database 'mpc_freeradius' on
> mysql.mpc.com.br via TCP/IP, server version
> 5.5.55-0ubuntu0.14.04.1-log, protocol version 10
> (0) [sql] = notfound
> (0) [expiration] = noop
> (0) [logintime] = noop
> (0) pap: WARNING: No "known good" password found for the user. Not
> setting Auth-Type
> (0) pap: WARNING: Authentication will fail unless a "known good"
> password is available
> (0) [pap] = noop
> (0) } # authorize = ok
> (0) Found Auth-Type = CHAP
> (0) # Executing group from file
> /usr/local/etc/raddb/sites-enabled/default
> (0) Auth-Type CHAP {
> (0) chap: ERROR: &control:Cleartext-Password is required for
> authentication
> (0) [chap] = fail
> (0) } # Auth-Type CHAP = fail
> (0) Failed to authenticate the user
> (0) Using Post-Auth-Type Reject
> (0) # Executing group from file
> /usr/local/etc/raddb/sites-enabled/default
> (0) Post-Auth-Type REJECT {
> (0) sql: EXPAND .query
> (0) sql: --> .query
> (0) sql: Using query template 'query'
> rlm_sql (sql): Reserved connection (2)
> (0) sql: EXPAND %{User-Name}
> (0) sql: --> soniaregina
> (0) sql: SQL-User-Name set to 'soniaregina'
> (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply,
> authdate) VALUES ( '%{SQL-User-Name}',
> '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')
> (0) sql: --> INSERT INTO radpostauth (username, pass, reply,
> authdate) VALUES ( 'soniaregina',
> '0x01cc08e5f2ad79880124b1d826606947b2', 'Access-Reject', '2017-08-02
> 09:11:51')
> (0) sql: Executing query: INSERT INTO radpostauth (username, pass,
> reply, authdate) VALUES ( 'soniaregina',
> '0x01cc08e5f2ad79880124b1d826606947b2', 'Access-Reject', '2017-08-02
> 09:11:51')
> (0) sql: SQL query returned: success
> (0) sql: 1 record(s) updated
> rlm_sql (sql): Released connection (2)
> (0) [sql] = ok
> (0) attr_filter.access_reject: EXPAND %{User-Name}
> (0) attr_filter.access_reject: --> soniaregina
> (0) attr_filter.access_reject: Matched entry DEFAULT at line 11
> (0) [attr_filter.access_reject] = updated
> (0) linelog: EXPAND messages.%{%{reply:Packet-Type}:-default}
> (0) linelog: --> messages.Access-Reject
> (0) linelog: No such entry ".messages.Access-Reject"
> (0) [linelog] = noop
> (0) } # Post-Auth-Type REJECT = updated
> (0) Login incorrect (chap: &control:Cleartext-Password is required for
> authentication): [soniaregina/<via Auth-Type = CHAP>] (from client
> ce-popitpm-rb port 15736495 cli 84:C9:B2:A3:BB:67)
> (0) Delaying response for 1.000000 seconds
>
>
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
More information about the Freeradius-Users
mailing list