Sorry, this may annoy some of you.
Some people pointed out that I didnt put enough information in my last mail, so I am sending this mail again with informations required in FAQ.
I want my freeradius server to send Access-Reject packet with Reply-Message in it, so that NAS can alert user when authentication fails. But, it's not working so far.
When authentication succeeds, my freeradius server sends Access-Accept packet
with Reply-Message in it. But when authentication fails, it sends Access Reject packet
with no Reply-Message in it..
So my question is why my freeradius doesn't include Reply-Message into Access-Reject
packet, and how can I fix this problem?
Attached logs are:
1)relevant portion of users
2)debugging output of 'radiusd -X'
(I have send 2 access-request messages after radiusd boots up, one with correct password
and one with wrong password.)
3)debuggin output of 'radtest'
4)version of Linux and radiusd
-------users--------
[EMAIL PROTECTED] Auth-Type :=Local, User-Password == "secret"
Service-Type = Framed-User,
Framed-Protocol = PPP,
Framed-IP-address = 192.168.200.1,
Framed-IP-Netmask = 255.255.255.0,
Session-Timeout = 30,
Reply-Message="1111111111111111111111111111111",
Reply-Message="2222222222222222222222222222222",
Reply-Message="3333333333333333333333333333333",
--------radius -X---------
[EMAIL PROTECTED] raddb]#
[EMAIL PROTECTED] raddb]# radiusd -X
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config: including file: /etc/raddb/proxy.conf
Config: including file: /etc/raddb/clients.conf
Config: including file: /etc/raddb/snmp.conf
Config: including file: /etc/raddb/sql.conf
main: prefix = "/usr"
main: localstatedir = "/var"
main: logdir = "/var/log/radius"
main: libdir = "/usr/lib"
main: radacctdir = "/var/log/radius/radacct"
main: hostname_lookups = no
read_config_files: reading dictionary
read_config_files: reading clients
read_config_files: reading realms
read_config_files: reading naslist
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 1645
main: allow_core_dumps = no
main: log_stripped_names = no
main: log_auth = no
main: log_auth_badpass = no
main: log_auth_goodpass = no
main: pidfile = "/var/run/radiusd.pid"
main: user = "root"
main: group = "root"
main: usercollide = no
main: lower_user = "no"
main: lower_pass = "no"
main: nospace_user = "no"
main: nospace_pass = "no"
main: proxy_requests = yes
proxy: retry_delay = 5
proxy: retry_count = 3
proxy: synchronous = no
proxy: default_fallback = yes
proxy: dead_time = 120
security: max_attributes = 200
security: reject_delay = 0
main: debug_level = 0
read_config_files: entering modules setup
Module: Library search path is /usr/lib
Module: Loaded System
unix: cache = no
unix: passwd = "/etc/passwd"
unix: shadow = "(null)"
unix: group = "/etc/group"
unix: radwtmp = "/var/log/radius/radwtmp"
unix: usegroup = no
unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded preprocess
preprocess: huntgroups = "/etc/raddb/huntgroups"
preprocess: hints = "/etc/raddb/hints"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line = 23
preprocess: with_ntdomain_hack = no
preprocess: with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
realm: format = "suffix"
realm: delimiter = "@"
Module: Instantiated realm (suffix)
Module: Loaded files
files: usersfile = "/etc/raddb/users"
files: acctusersfile = "/etc/raddb/acct_users"
files: compat = "no"
Module: Instantiated files (files)
Module: Loaded detail
detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail"
detail: detailperm = 384
detail: dirperm = 493
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename = "/var/log/radius/radutmp"
radutmp: username = "%{User-Name}"
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on IP address *, ports 1645/udp and 1646/udp, with proxy on 1647/udp.
Ready to process requests.
/*authentication request with correct password is received*/
rad_recv: Access-Request packet from host 10.151.0.2:21645, id=77, length=85
Framed-Protocol = PPP
User-Name = "[EMAIL PROTECTED]"
User-Password = "\325\333\255\352O\2517\254\251\241{\300\324\222.\246"
NAS-Port-Type = Virtual
NAS-Port = 0
Service-Type = Framed-User
NAS-IP-Address = 10.151.0.2
modcall: entering group authorize
modcall[authorize]: module "preprocess" returns ok
modcall[authorize]: module "suffix" returns ok
users: Matched [EMAIL PROTECTED] at 33
modcall[authorize]: module "files" returns ok
modcall: group authorize returns ok
rad_check_password: Found Auth-Type Local
auth: type Local
auth: user supplied User-Password matches local User-Password
radius_xlat: '1111111111111111111111111111111'
radius_xlat: '2222222222222222222222222222222'
radius_xlat: '3333333333333333333333333333333'
Sending Access-Accept of id 77 to 10.151.0.2:21645
Service-Type = Framed-User
Framed-Protocol = PPP
Framed-IP-Address = 192.168.200.1
Framed-IP-Netmask = 255.255.255.0
Session-Timeout = 30
Reply-Message = "1111111111111111111111111111111"
Reply-Message = "2222222222222222222222222222222"
Reply-Message = "3333333333333333333333333333333"
Finished request 1
Going to the next request
Waking up in 6 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 76 with timestamp 3f940bc8
Cleaning up request 1 ID 77 with timestamp 3f940bc8
Nothing to do. Sleeping until we see a request.
/*authentication request with wrong password is received*/
rad_recv: Access-Request packet from host 10.151.0.2:21645, id=79, length=85
Framed-Protocol = PPP
User-Name = "[EMAIL PROTECTED]"
User-Password = "\372\370T%G\247\004\260\304\216\017ExW?\256"
NAS-Port-Type = Virtual
NAS-Port = 0
Service-Type = Framed-User
NAS-IP-Address = 10.151.0.2
modcall: entering group authorize
modcall[authorize]: module "preprocess" returns ok
modcall[authorize]: module "suffix" returns ok
modcall[authorize]: module "files" returns notfound
modcall: group authorize returns ok
auth: No Auth-Type configuration for the request, rejecting the user
auth: Failed to validate the user.
Sending Access-Reject of id 79 to 10.151.0.2:21645
Finished request 3
Going to the next request
Waking up in 6 seconds...
--- Walking the entire request list ---
Cleaning up request 2 ID 78 with timestamp 3f940c1c
Cleaning up request 3 ID 79 with timestamp 3f940c1c
Nothing to do. Sleeping until we see a request.
---------radtest---------
[EMAIL PROTECTED] raddb]#
[EMAIL PROTECTED] raddb]# radtest [EMAIL PROTECTED] secret localhost:1645 10 testing123
Sending Access-Request of id 180 to 127.0.0.1:1645
User-Name = "[EMAIL PROTECTED]"
User-Password = "\240$'\0022\273X\331W\362\373\265q{\030\350"
NAS-IP-Address = localhost.localdomain
NAS-Port-Id = "10"
rad_recv: Access-Accept packet from host 127.0.0.1:1645, id=180, length=149
Service-Type = Framed-User
Framed-Protocol = PPP
Framed-IP-Address = 192.168.200.1
Framed-IP-Netmask = 255.255.255.0
Session-Timeout = 30
Reply-Message = "1111111111111111111111111111111"
Reply-Message = "2222222222222222222222222222222"
Reply-Message = "3333333333333333333333333333333"
[EMAIL PROTECTED] raddb]#
[EMAIL PROTECTED] raddb]#
[EMAIL PROTECTED] raddb]# radtest [EMAIL PROTECTED] foo localhost:1645 10 testing123
Sending Access-Request of id 184 to 127.0.0.1:1645
User-Name = "[EMAIL PROTECTED]"
User-Password = "\014\347\005\320I\000G\245F\375\334\353\006+\274Y"
NAS-IP-Address = localhost.localdomain
NAS-Port-Id = "10"
rad_recv: Access-Reject packet from host 127.0.0.1:1645, id=184, length=20
[EMAIL PROTECTED] raddb]#
--------version---------
[EMAIL PROTECTED] raddb]# dmesg | grep 'Linux version'
Linux version 2.4.18-0.12 ([EMAIL PROTECTED]) (gcc version 2.
96 20000731 (Red Hat Linux 7.2 2.96-109)) #1 Wed Mar 27 16:37:34 EST 2002
[EMAIL PROTECTED] raddb]#
[EMAIL PROTECTED] raddb]#
[EMAIL PROTECTED] raddb]# radiusd -v
radiusd: FreeRADIUS Version 0.5, for host i686-redhat-linux-gnu, built on Apr 4
2002 at 04:33:11
[EMAIL PROTECTED] raddb]#
End of Mail
_________________________________________________________________
あなたのPCを守るために定期的なセキュリティ対策を。マイクロソフト セキュリ
ティ情報センター http://www.microsoft.com/japan/protect/hm.asp
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
