Помогите настроить FreeRADIUS Version 2.0.0 + MSCHAP V2

[ran]

Хорошо - уговорили

та если б хорошо уговорил - вот это

А пока надо что бы mppe работало.

бы отпало

[mnk]

Так оно должно работать. И давайте отдадим пользователю возможность решать - что ему нужно.
Если работает без abills, при вводе пользователя в файл users, то это значит, что где то в настройках при интегрировании abills - ошибка.

[ran]

давайте отдадим пользователю возможность решать - что ему нужно

ну и давай... и тогда сам настраивайся под него... я лично предпочитаю описать - должно быть настроено ТАК и тем не менее все довольны... а если так как хочется усеру - пжалста... по мере возможности за очень отдельную плату под ключ... есть и такие у меня... и тоже довольны

а теперь по теме... если б ты вместо того чтоб плакать "не работает " обращал внимание на то что тебе пишут

судя по вотетому:
Цитата:
+- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured. Cannot create LM-Password.
[mschap] No Cleartext-Password configured. Cannot create NT-Password.
[mschap] Told to do MS-CHAPv2 for mnk with NT-Password
[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
настройками модуля мсчап радиуса добиваться получения гдета ватетого:

то уже давно прогуглил бы вот это

[mschap] No Cleartext-Password configured. Cannot create NT-Password.

в первой же ссылке нашёл бы ответ на свой вопрос и давно закрыл бы тему

[Andrushka]

Код: Выделить всё

       MS-MPPE-Recv-Key = 0x4fd92b60467642213b9f57838fa2df65
        MS-MPPE-Send-Key = 0x1f033b44eddda0bc9f4421324322fee9

Чего в новом радиусе не происходит.

Куда дальше копать - даже и не знаю. А mppe - мне очень нужен.

Дело в том что несовсем полностью описана конфигурация в доке для v.2.x.x

Кроме того что описано надо сделать pre_auth, он выдаст Cleartext-Password аттрибут радиусу и он счастливый сгенерит MPPE Keys (учитывая что Auth.pm уже исправили и он выдает Cleartext-Password := "пароль" вместо User-Password == "пароль").

Да, только теперь надо mschap в конфиге поставить перед files и auth abills'a.

[mnk]

А поподробнее можно, а то немного не понятно.
1. Что за pre_auth и куда ее влепить?
2. Секция authorize должна выглядеть - так?

Код: Выделить всё

authorize {                                                     
           preprocess                                                        
           mschap
           files                   
           auth
}

[Andrushka]

1. Что за pre_auth и куда ее влепить?

Я описал модули
abills_preauth
exec abills_preauth {
program = "/usr/abills/libexec/rauth.pl pre_auth"
wait = yes
input_pairs = request
shell_escape = yes
#output = no
output_pairs = config
}


abills_postauth
exec abills_postauth {
program = "/usr/abills/libexec/rauth.pl post_auth"
wait = yes
input_pairs = request
shell_escape = yes
#output = no
output_pairs = config
}

abills_auth
exec abills_auth {
program = "/usr/abills/libexec/rauth.pl"
wait = yes
input_pairs = request
shell_escape = yes
output = no
output_pairs = reply
}

abills_acc
exec abills_acc {
program = "/usr/abills/libexec/racct.pl"
wait = yes
input_pairs = request
shell_escape = yes
output = no
output_pairs = reply
}

все в raddb/modules

В raddb/sites-enabled файл твоего сайта, у меня default
authorize {
preprocess
abills_preauth
mschap
files
abills_auth
}

preacct {
preprocess
abills_acc
}

post-auth {
Post-Auth-Type REJECT {
abills_postauth
}
}

accounting {
по вкусу
}

[mnk]

Сделал, ка Вы написали. Вот вывод radius -X

Код: Выделить всё

rad_recv: Access-Request packet from host 127.0.0.1 port 38884, id=235, length=147
        Service-Type = Framed-User                                                
        Framed-Protocol = PPP                                                     
        User-Name = "mnk"                                                         
        MS-CHAP-Challenge = 0xe002620512169812336b6f24e0d946d9                    
        MS-CHAP2-Response = 0x7900e185a7086ef5a501e570f425b44dce3f00000000000000006f5146a9c9292466514a2e49fa7dc4bb2d513cce258e99cf                                                                                          
        Calling-Station-Id = "172.16.130.156"                                                                 
        NAS-IP-Address = 127.0.0.1                                                                            
        NAS-Port = 1                                                                                          
+- entering group authorize {...}                                                                             
++[preprocess] returns ok                                                                                     
Exec-Program output: User-Password == "qwerty"                                                                
Exec-Program-Wait: value-pairs: User-Password == "qwerty"                                                     
Exec-Program: returned: 0                                                                                     
++[abills_preauth] returns ok                                                                                 
[mschap] Found MS-CHAP attributes.  Setting 'Auth-Type  = mschap'                                             
++[mschap] returns ok                                                                                         
[files] users: Matched entry DEFAULT at line 1                                                                
++[files] returns ok                                                                                          
Exec-Program output: Acct-Interim-Interval = 60, Session-Timeout = 1329046, Octets-Direction = 0, MS-MPPE-Encryption-Types = 0x00000006, Session-Octets-Limit = 2146435072, MS-CHAP2-SUCCESS = 0x79533d45313539353045373432303142443945443039464339453239393732324136353431333746393436, MS-MPPE-Encryption-Policy = 0x00000001,          
Exec-Program-Wait: value-pairs: Acct-Interim-Interval = 60, Session-Timeout = 1329046, Octets-Direction = 0, MS-MPPE-Encryption-Types = 0x00000006, Session-Octets-Limit = 2146435072, MS-CHAP2-SUCCESS = 0x79533d45313539353045373432303142443945443039464339453239393732324136353431333746393436, MS-MPPE-Encryption-Policy = 0x00000001,                                                                                                             
Exec-Program: returned: 0                                                                                     
++[abills_auth] returns ok                                                                                    
Found Auth-Type = MSCHAP                                                                                      
+- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured.  Cannot create LM-Password.
[mschap] No Cleartext-Password configured.  Cannot create NT-Password.
[mschap] Told to do MS-CHAPv2 for mnk with NT-Password
[mschap] FAILED: No NT/LM-Password.  Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
Failed to authenticate the user.
Using Post-Auth-Type Reject
+- entering group REJECT {...}
Exec-Program output:
Exec-Program: returned: 0
++[abills_postauth] returns ok

И что значит?

Код: Выделить всё

accounting { 
по вкусу 
}

[Andrushka]

Я писал перед этим
(учитывая что Auth.pm уже исправили и он выдает Cleartext-Password := "пароль" вместо User-Password == "пароль").

Если совсем точно то в Auth.pm
#*******************************************************************
# Authorization module
# pre_auth()
#*******************************************************************
sub pre_auth {


if ($self->{TOTAL} > 0) {
my $list = $self->{list}->[0];
my $password = $list->[0];
$self->{'RAD_CHECK'}{'User-Password'}="$password";
# freeeradius 1xx
#print "User-Password == \"$password\"";
# freeradius v2
print "Cleartext-Password := \"$password\"";
return 0;
}

это уже исправленный вариант. Надеюсь не составит трудности особой подправить.

Аккаунтинг по вкусу как вам нравится. У себя я использую unix и radutmp, вариантов там много разных других.

[mnk]

Огромное спасибо - все заработало.

[mnk]

to ~AsmodeuS~
Может было бы удобно, если не надо было править файл Auth.pm.
А ввести в файл config.pl пременную, с типом радиуса и в зависимости от нее подставлялось бы значение для freeeradius 1xx
print "User-Password == \"$password\"";
а для freeradius v2
print "Cleartext-Password := \"$password\"";

[Xramovnik]

Настраиваю связку CentOS 6.5 + Abills + Freeradius 2.1.12 + Mikrotik PPPoE
Взял версию 0.56 из CVS. завел пользователей, насроил тарифы, но авторизация не проходит:

Код: Выделить всё

rad_recv: Access-Request packet from host 192.168.2.1 port 40333, id=58, length=200
        Service-Type = Framed-User
        Framed-Protocol = PPP
        NAS-Port = 7817
        NAS-Port-Type = Ethernet
        User-Name = "test"
        Calling-Station-Id = "94:DE:80:E2:FC:1D"
        Called-Station-Id = "ZN-mikro-ppp"
        NAS-Port-Id = "eth2_lan"
        MS-CHAP-Challenge = 0x290c789a9326ee27139e270b01a02bf7
        MS-CHAP2-Response = 0x0100cea8d0a13a300f14e7ca38ef3dfb0f6100000000000000002269b2d10a9dfc6ef1ec51d883d17c1ed5a498a7ee45a3ea
        NAS-Identifier = "MikroTik"
        NAS-IP-Address = 192.168.2.1
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
Exec-Program output:
Exec-Program: returned: 0
++[abills_preauth] returns ok
[mschap] Found MS-CHAP attributes.  Setting 'Auth-Type  = mschap'
++[mschap] returns ok
[files] users: Matched entry DEFAULT at line 1
++[files] returns ok
Exec-Program output:
Exec-Program: returned: 0
++[abills_auth] returns ok
Found Auth-Type = MSCHAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured.  Cannot create LM-Password.
[mschap] No Cleartext-Password configured.  Cannot create NT-Password.
[mschap] Creating challenge hash with username: chernobaev_as
[mschap] Told to do MS-CHAPv2 for test with NT-Password
[mschap] FAILED: No NT/LM-Password.  Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
Failed to authenticate the user.
Using Post-Auth-Type Reject
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group REJECT {...}
Exec-Program output:
Exec-Program: returned: 0
++[abills_postauth] returns ok
Delaying reject of request 0 for 1 seconds
Going to the next request
Waking up in 0.6 seconds.
Sending delayed reject for request 0
Sending Access-Reject of id 58 to 192.168.2.1 port 40333
        MS-CHAP-Error = "\001E=691 R=1"
rad_recv: Access-Request packet from host 192.168.2.1 port 40333, id=58, length=200
Sending duplicate reply to client ZN-mikrotik-PPPoE port 40333 - ID: 58
Sending Access-Reject of id 58 to 192.168.2.1 port 40333
        MS-CHAP-Error = "\001E=691 R=1"
Waking up in 4.9 seconds.
Cleaning up request 0 ID 58 with timestamp +21
Ready to process requests.

Все файлы конфигурации радиуса делал по инструкции с сайта (не rlm_perl). Есть у кого какие идеи почему не передается пароль?

clients.conf
client 192.168.2.1 {
secret = radsecret
shortname = ZN-mikrotik-PPPoE
nastype = other

radiusd.conf
prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = /usr/sbin
logdir = ${localstatedir}/log/radius
raddbdir = ${sysconfdir}/raddb
radacctdir = ${logdir}/radacct

#
# name of the running server. See also the "-n" command-line option.
name = radiusd

# Location of config and logfiles.
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/${name}

# Should likely be ${localstatedir}/lib/radiusd
db_dir = ${raddbdir}

# libdir: Where to find the rlm_* modules.
libdir = /usr/lib64/freeradius

# pidfile: Where to place the PID of the RADIUS server.
pidfile = ${run_dir}/${name}.pid

# chroot: directory where the server does "chroot".
#chroot = /path/to/chroot/directory

# user/group: The name (or #number) of the user/group to run radiusd as.
#
user = radiusd
group = radiusd

max_request_time = 30

cleanup_delay = 5

max_requests = 1024

listen {
type = auth
ipaddr = *
# ipv6addr = :: # any. ::1 == localhost
# interface = eth0
# clients = per_socket_clients
}

# This second "listen" section is for listening on the accounting
# port, too.
#
listen {
ipaddr = *
# ipv6addr = ::
port = 0
type = acct
# interface = eth0
# clients = per_socket_clients
}

hostname_lookups = no

allow_core_dumps = no

regular_expressions = yes
extended_expressions = yes

log {
destination = files
file = ${logdir}/radius.log
#requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log
syslog_facility = daemon
stripped_names = no
auth = no
auth_badpass = no
auth_goodpass = no
# msg_goodpass = ""
# msg_badpass = ""
}

checkrad = ${sbindir}/checkrad

security {
max_attributes = 200
reject_delay = 1
status_server = yes
}

proxy_requests = yes
$INCLUDE proxy.conf
$INCLUDE clients.conf
#
thread pool {
start_servers = 5
max_servers = 32
min_spare_servers = 3
max_spare_servers = 10
# max_queue_size = 65536
max_requests_per_server = 0
}

modules {
$INCLUDE ${confdir}/modules/
$INCLUDE eap.conf

abills_preauth
exec abills_preauth {
program = "/usr/abills/libexec/rauth.pl pre_auth"
wait = yes
input_pairs = request
shell_escape = yes
#output = no
output_pairs = config
}

abills_postauth
exec abills_postauth {
program = "/usr/abills/libexec/rauth.pl post_auth"
wait = yes
input_pairs = request
shell_escape = yes
#output = no
output_pairs = config
}

abills_auth
exec abills_auth {
program = "/usr/abills/libexec/rauth.pl"
wait = yes
input_pairs = request
shell_escape = yes
output = no
output_pairs = reply
}
abills_acc
exec abills_acc {
program = "/usr/abills/libexec/racct.pl"
wait = yes
input_pairs = request
shell_escape = yes
output = no
output_pairs = reply
}
}

instantiate {
exec
expr
# daily
expiration
logintime
}

$INCLUDE policy.conf
$INCLUDE sites-enabled/

default
authorize {
preprocess
abills_preauth
# chap
mschap
files
abills_auth
}


authenticate {
Auth-Type PAP {
pap
}
Auth-Type CHAP {
chap
}
Auth-Type MS-CHAP {
mschap
}
digest
# pam
unix
# Auth-Type LDAP {
# ldap
# }
eap
# Auth-Type eap {
# eap {
# handled = 1
# }
# if (handled && (Response-Packet-Type == Access-Challenge)) {
# attr_filter.access_challenge.post-auth
# handled # override the "updated" code from attr_filter
# }
# }
}


#
# Pre-accounting. Decide which accounting type to use.
#
preacct {
preprocess
abills_acc
}

#
# Accounting. Log the accounting data.
#
accounting {
#
# Create a 'detail'ed log of the packets.
# Note that accounting requests which are proxied
# are also logged in the detail file.
detail
# daily

# Update the wtmp file
#
# If you don't use "radlast", you can delete this line.
unix

#
# For Simultaneous-Use tracking.
#
# Due to packet losses in the network, the data here
# may be incorrect. There is little we can do about it.
radutmp
# sradutmp

# Return an address to the IP Pool when we see a stop record.
# main_pool

#
# Log traffic to an SQL database.
#
# See "Accounting queries" in sql.conf
# sql

#
# If you receive stop packets with zero session length,
# they will NOT be logged in the database. The SQL module
# will print a message (only in debugging mode), and will
# return "noop".
#
# You can ignore these packets by uncommenting the following
# three lines. Otherwise, the server will not respond to the
# accounting request, and the NAS will retransmit.
#
# if (noop) {
# ok
# }

#
# Instead of sending the query to the SQL server,
# write it into a log file.
#
# sql_log

# Cisco VoIP specific bulk accounting
# pgsql-voip

# For Exec-Program and Exec-Program-Wait
exec

# Filter attributes from the accounting response.
attr_filter.accounting_response

#
# See "Autz-Type Status-Server" for how this works.
#
# Acct-Type Status-Server {
#
# }
}


# Session database, used for checking Simultaneous-Use. Either the radutmp
# or rlm_sql module can handle this.
# The rlm_sql module is *much* faster
session {
radutmp

#
# See "Simultaneous Use Checking Queries" in sql.conf
# sql
}


# Post-Authentication
# Once we KNOW that the user has been authenticated, there are
# additional steps we can take.
post-auth {
Post-Auth-Type REJECT {
abills_postauth
}
# }


# If the WiMAX module did it's work, you may want to do more
# things here, like delete the MS-MPPE-*-Key attributes.
#
# if (updated) {
# update reply {
# MS-MPPE-Recv-Key !* 0x00
# MS-MPPE-Send-Key !* 0x00
# }
# }

#
# Access-Reject packets are sent through the REJECT sub-section of the
# post-auth section.
#
# Add the ldap module name (or instance) if you have set
# 'edir_account_policy_check = yes' in the ldap module configuration
#
Post-Auth-Type REJECT {
# log failed authentications in SQL, too.
# sql
attr_filter.access_reject
}
}

#
# When the server decides to proxy a request to a home server,
# the proxied request is first passed through the pre-proxy
# stage. This stage can re-write the request, or decide to
# cancel the proxy.
#
# Only a few modules currently have this method.
#
pre-proxy {
# attr_rewrite

# Uncomment the following line if you want to change attributes
# as defined in the preproxy_users file.
# files

# Uncomment the following line if you want to filter requests
# sent to remote servers based on the rules defined in the
# 'attrs.pre-proxy' file.
# attr_filter.pre-proxy

# If you want to have a log of packets proxied to a home
# server, un-comment the following line, and the
# 'detail pre_proxy_log' section, above.
# pre_proxy_log
}

#
# When the server receives a reply to a request it proxied
# to a home server, the request may be massaged here, in the
# post-proxy stage.
#
post-proxy {

# post_proxy_log

# attr_rewrite

# attr_filter.post-proxy


eap

# Post-Proxy-Type Fail {
# detail
# }
}

[~AsmodeuS~]

без rlm_perl работать не будет


вот пошаговый пример как настроить на линуксе

http://abills.net.ua/wiki/doku.php/abil ... vka_radius

[Xramovnik]

без rlm_perl работать не будет

Спасибо! настроил уже с rlm_perl. Подключается, пашет. Теперь не режет скорость подключений на микротике, хотя в тарифах все как положено выставляю.

[~AsmodeuS~]

http://abills.net.ua/wiki/doku.php/abil ... _shejperom

[Xramovnik]

http://abills.net.ua/wiki/doku.php/abil ... _shejperom

Спасибо! Со скоростями буду пробовать уже на рабочем биллинге. Мне главное на данный момент авторизация и отключение по достижению лимита суточного.