Ошибка 742 (решено) теперь ошибка 691

[VecH]

rradtest vech xxx 127.0.0.1:1812 0 xxx 0 127.0.0.1
проходит успешно

Код: Выделить всё

Sending Access-Request of id 149 to 127.0.0.1 port 1812
        User-Name = "vech"
        User-Password = "123qsc"
        NAS-IP-Address = 127.0.0.1
        NAS-Port = 0
        Framed-Protocol = PPP
rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=149, length=56
        Acct-Interim-Interval = 60
        Session-Timeout = 1892606
        Octets-Direction = Route-IP-Yes
        Framed-IP-Address = 192.168.120.2
        Session-Octets-Limit = 2146435072
        Framed-IP-Netmask = 255.255.255.255

Включил шифрацию, показывает ошибку 742
radtest проходит все успешно

Код: Выделить всё

# freeradius -X
Starting - reading configuration files ...
reread_config:  reading radiusd.conf
Config:   including file: /etc/freeradius/proxy.conf
Config:   including file: /etc/freeradius/clients.conf
Config:   including file: /etc/freeradius/snmp.conf
Config:   including file: /etc/freeradius/eap.conf
Config:   including file: /etc/freeradius/sql.conf
 main: prefix = "/usr"
 main: localstatedir = "/var"
 main: logdir = "/var/log/freeradius"
 main: libdir = "/usr/lib/freeradius"
 main: radacctdir = "/var/log/freeradius/radacct"
 main: hostname_lookups = no
 main: snmp = no
 main: max_request_time = 30
 main: cleanup_delay = 5
 main: max_requests = 1024
 main: delete_blocked_requests = 0
 main: port = 0
 main: allow_core_dumps = no
 main: log_stripped_names = no
 main: log_file = "/var/log/freeradius/radius.log"
 main: log_auth = no
 main: log_auth_badpass = no
 main: log_auth_goodpass = no
 main: pidfile = "/var/run/freeradius/freeradius.pid"
 main: user = "freerad"
 main: group = "freerad"
 main: usercollide = no
 main: lower_user = "no"
 main: lower_pass = "no"
 main: nospace_user = "no"
 main: nospace_pass = "no"
 main: checkrad = "/usr/sbin/checkrad"
 main: proxy_requests = yes
 proxy: retry_delay = 5
 proxy: retry_count = 3
 proxy: synchronous = no
 proxy: default_fallback = yes
 proxy: dead_time = 120
 proxy: post_proxy_authorize = no
 proxy: wake_all_if_all_dead = no
 security: max_attributes = 200
 security: reject_delay = 1
 security: status_server = no
 main: debug_level = 0
read_config_files:  reading dictionary
read_config_files:  reading naslist
Using deprecated naslist file.  Support for this will go away soon.
read_config_files:  reading clients
read_config_files:  reading realms
radiusd:  entering modules setup
Module: Library search path is /usr/lib/freeradius
Module: Loaded exec
 exec: wait = yes
 exec: program = "(null)"
 exec: input_pairs = "request"
 exec: output_pairs = "(null)"
 exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded PAP
 pap: encryption_scheme = "crypt"
 pap: auto_header = yes
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded MS-CHAP
 mschap: use_mppe = yes
 mschap: require_encryption = yes
 mschap: require_strong = yes
 mschap: with_ntdomain_hack = no
 mschap: passwd = "(null)"
 mschap: ntlm_auth = "(null)"
Module: Instantiated mschap (mschap)
Module: Loaded System
 unix: cache = no
 unix: passwd = "(null)"
 unix: shadow = "/etc/shadow"
 unix: group = "(null)"
 unix: radwtmp = "/var/log/freeradius/radwtmp"
 unix: usegroup = no
 unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded eap
 eap: default_eap_type = "md5"
 eap: timer_expire = 60
 eap: ignore_unknown_eap_types = no
 eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
 gtc: challenge = "Password: "
 gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
 mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
 preprocess: huntgroups = "/etc/freeradius/huntgroups"
 preprocess: hints = "/etc/freeradius/hints"
 preprocess: with_ascend_hack = no
 preprocess: ascend_channels_per_line = 23
 preprocess: with_ntdomain_hack = no
 preprocess: with_specialix_jetstream_hack = no
 preprocess: with_cisco_vsa_hack = no
 preprocess: with_alvarion_vsa_hack = no
Module: Instantiated preprocess (preprocess)
 exec: wait = yes
 exec: program = "/usr/abills/libexec/rauth.pl pre_auth"
 exec: input_pairs = "request"
 exec: output_pairs = "config"
 exec: packet_type = "(null)"
Module: Instantiated exec (pre_auth)
Module: Loaded realm
 realm: format = "suffix"
 realm: delimiter = "@"
 realm: ignore_default = no
 realm: ignore_null = no
Module: Instantiated realm (suffix)
Module: Loaded files
 files: usersfile = "/etc/freeradius/users"
 files: acctusersfile = "/etc/freeradius/acct_users"
 files: preproxy_usersfile = "/etc/freeradius/preproxy_users"
 files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
 acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
 detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
 detail: detailperm = 384
 detail: dirperm = 493
 detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
 radutmp: filename = "/var/log/freeradius/radutmp"
 radutmp: username = "%{User-Name}"
 radutmp: case_sensitive = yes
 radutmp: check_with_nas = yes
 radutmp: perm = 384
 radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
 exec: wait = yes
 exec: program = "/usr/abills/libexec/rauth.pl post_auth"
 exec: input_pairs = "request"
 exec: output_pairs = "config"
 exec: packet_type = "(null)"
Module: Instantiated exec (post_auth)
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.
rad_recv: Access-Request packet from host 192.168.101.11:55378, id=46, length=147
        Service-Type = Framed-User
        Framed-Protocol = PPP
        User-Name = "VecH"
        MS-CHAP-Challenge = 0x5722eeba8cc6d9ebc8d4b43134218980
        MS-CHAP2-Response = 0x860091a813c833041bc3621b242285b9410c0000000000000000d9e4f13df3e4fd75753cb61f8de0d1622d16f31ecbef6f11
        Calling-Station-Id = "192.168.101.3"
        NAS-IP-Address = 127.0.0.1
        NAS-Port = 0
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
  modcall[authorize]: module "preprocess" returns ok for request 0
Exec-Program output: User-Password == "123qsc"
Exec-Program-Wait: value-pairs: User-Password == "123qsc"
Exec-Program: returned: 0
  modcall[authorize]: module "pre_auth" returns ok for request 0
  modcall[authorize]: module "chap" returns noop for request 0
  rlm_mschap: Found MS-CHAP attributes.  Setting 'Auth-Type  = mschap'
  modcall[authorize]: module "mschap" returns ok for request 0
    rlm_realm: No '@' in User-Name = "VecH", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 0
    users: Matched entry DEFAULT at line 217
  modcall[authorize]: module "files" returns ok for request 0
modcall: leaving group authorize (returns ok) for request 0
  rad_check_password:  Found Auth-Type MS-CHAP
auth: type "MS-CHAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group MS-CHAP for request 0
  rlm_mschap: Told to do MS-CHAPv2 for VecH with NT-Password
rlm_mschap: adding MS-CHAPv2 MPPE keys
  modcall[authenticate]: module "mschap" returns ok for request 0
modcall: leaving group MS-CHAP (returns ok) for request 0
Exec-Program output: Acct-Interim-Interval = 60, Session-Timeout = 1891108, Octets-Direction = 1, Framed-IP-Address = 192.168.120.2, Session-Octets-Limit = 2146435072, Framed-IP-Netmask = 255.255.255.255,
Exec-Program-Wait: value-pairs: Acct-Interim-Interval = 60, Session-Timeout = 1891108, Octets-Direction = 1, Framed-IP-Address = 192.168.120.2, Session-Octets-Limit = 2146435072, Framed-IP-Netmask = 255.255.255.255,
Exec-Program: returned: 0
Sending Access-Accept of id 46 to 192.168.101.11 port 55378
        MS-CHAP2-Success = 0x86533d38343931344538454131463737304535413742463134333541323137323935423646343441303841
        MS-MPPE-Recv-Key = 0x06bb7201c249f9b3e51b666b61fdcc99
        MS-MPPE-Send-Key = 0xc5524c5469cb354b1feed62b5da22649
        MS-MPPE-Encryption-Policy = 0x00000002
        MS-MPPE-Encryption-Types = 0x00000004
        Acct-Interim-Interval = 60
        Session-Timeout = 1891108
        Octets-Direction = Route-IP-Yes
        Framed-IP-Address = 192.168.120.2
        Session-Octets-Limit = 2146435072
        Framed-IP-Netmask = 255.255.255.255
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...

Решилось в radiusclient/dictionary
исправить строку:
INCLUDE /etc/radiusclient/dictionary.microsoft
на
$INCLUDE /etc/radiusclient/dictionary.microsoft

Теперь
при попытке подключения показывает ошибку 691
хотя radtest проходит нормально
вот лог после попытки подключения:

Код: Выделить всё

# freeradius -X
Starting - reading configuration files ...
reread_config:  reading radiusd.conf
Config:   including file: /etc/freeradius/proxy.conf
Config:   including file: /etc/freeradius/clients.conf
Config:   including file: /etc/freeradius/snmp.conf
Config:   including file: /etc/freeradius/eap.conf
Config:   including file: /etc/freeradius/sql.conf
 main: prefix = "/usr"
 main: localstatedir = "/var"
 main: logdir = "/var/log/freeradius"
 main: libdir = "/usr/lib/freeradius"
 main: radacctdir = "/var/log/freeradius/radacct"
 main: hostname_lookups = no
 main: snmp = no
 main: max_request_time = 30
 main: cleanup_delay = 5
 main: max_requests = 1024
 main: delete_blocked_requests = 0
 main: port = 0
 main: allow_core_dumps = no
 main: log_stripped_names = no
 main: log_file = "/var/log/freeradius/radius.log"
 main: log_auth = no
 main: log_auth_badpass = no
 main: log_auth_goodpass = no
 main: pidfile = "/var/run/freeradius/freeradius.pid"
 main: user = "freerad"
 main: group = "freerad"
 main: usercollide = no
 main: lower_user = "no"
 main: lower_pass = "no"
 main: nospace_user = "no"
 main: nospace_pass = "no"
 main: checkrad = "/usr/sbin/checkrad"
 main: proxy_requests = yes
 proxy: retry_delay = 5
 proxy: retry_count = 3
 proxy: synchronous = no
 proxy: default_fallback = yes
 proxy: dead_time = 120
 proxy: post_proxy_authorize = no
 proxy: wake_all_if_all_dead = no
 security: max_attributes = 200
 security: reject_delay = 1
 security: status_server = no
 main: debug_level = 0
read_config_files:  reading dictionary
read_config_files:  reading naslist
Using deprecated naslist file.  Support for this will go away soon.
read_config_files:  reading clients
read_config_files:  reading realms
radiusd:  entering modules setup
Module: Library search path is /usr/lib/freeradius
Module: Loaded exec
 exec: wait = yes
 exec: program = "(null)"
 exec: input_pairs = "request"
 exec: output_pairs = "(null)"
 exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded PAP
 pap: encryption_scheme = "crypt"
 pap: auto_header = yes
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded MS-CHAP
 mschap: use_mppe = yes
 mschap: require_encryption = yes
 mschap: require_strong = yes
 mschap: with_ntdomain_hack = no
 mschap: passwd = "(null)"
 mschap: ntlm_auth = "(null)"
Module: Instantiated mschap (mschap)
Module: Loaded System
 unix: cache = no
 unix: passwd = "(null)"
 unix: shadow = "/etc/shadow"
 unix: group = "(null)"
 unix: radwtmp = "/var/log/freeradius/radwtmp"
 unix: usegroup = no
 unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded eap
 eap: default_eap_type = "md5"
 eap: timer_expire = 60
 eap: ignore_unknown_eap_types = no
 eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
 gtc: challenge = "Password: "
 gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
 mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
 preprocess: huntgroups = "/etc/freeradius/huntgroups"
 preprocess: hints = "/etc/freeradius/hints"
 preprocess: with_ascend_hack = no
 preprocess: ascend_channels_per_line = 23
 preprocess: with_ntdomain_hack = no
 preprocess: with_specialix_jetstream_hack = no
 preprocess: with_cisco_vsa_hack = no
 preprocess: with_alvarion_vsa_hack = no
Module: Instantiated preprocess (preprocess)
 exec: wait = yes
 exec: program = "/usr/abills/libexec/rauth.pl pre_auth"
 exec: input_pairs = "request"
 exec: output_pairs = "config"
 exec: packet_type = "(null)"
Module: Instantiated exec (pre_auth)
Module: Loaded realm
 realm: format = "suffix"
 realm: delimiter = "@"
 realm: ignore_default = no
 realm: ignore_null = no
Module: Instantiated realm (suffix)
Module: Loaded files
 files: usersfile = "/etc/freeradius/users"
 files: acctusersfile = "/etc/freeradius/acct_users"
 files: preproxy_usersfile = "/etc/freeradius/preproxy_users"
 files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
 acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
 detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
 detail: detailperm = 384
 detail: dirperm = 493
 detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
 radutmp: filename = "/var/log/freeradius/radutmp"
 radutmp: username = "%{User-Name}"
 radutmp: case_sensitive = yes
 radutmp: check_with_nas = yes
 radutmp: perm = 384
 radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
 exec: wait = yes
 exec: program = "/usr/abills/libexec/rauth.pl post_auth"
 exec: input_pairs = "request"
 exec: output_pairs = "config"
 exec: packet_type = "(null)"
Module: Instantiated exec (post_auth)
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.
rad_recv: Access-Request packet from host 192.168.101.11:43311, id=53, length=65
        Service-Type = Framed-User
        Framed-Protocol = PPP
        User-Name = "VecH"
        Calling-Station-Id = "192.168.101.3"
        NAS-IP-Address = 127.0.0.1
        NAS-Port = 0
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
  modcall[authorize]: module "preprocess" returns ok for request 0
Exec-Program output: Auth-Type := Accept
Exec-Program-Wait: value-pairs: Auth-Type := Accept
Exec-Program: returned: 0
  modcall[authorize]: module "pre_auth" returns ok for request 0
  modcall[authorize]: module "chap" returns noop for request 0
  modcall[authorize]: module "mschap" returns noop for request 0
    rlm_realm: No '@' in User-Name = "VecH", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 0
    users: Matched entry DEFAULT at line 217
  modcall[authorize]: module "files" returns ok for request 0
modcall: leaving group authorize (returns ok) for request 0
  rad_check_password:  Found Auth-Type Accept
  rad_check_password: Auth-Type = Accept, accepting the user
Exec-Program output: Acct-Interim-Interval = 60, Session-Timeout = 1890288, Octets-Direction = 1, Framed-IP-Address = 192.168.120.2, Session-Octets-Limit = 2146435072, Framed-IP-Netmask = 255.255.255.255,
Exec-Program-Wait: value-pairs: Acct-Interim-Interval = 60, Session-Timeout = 1890288, Octets-Direction = 1, Framed-IP-Address = 192.168.120.2, Session-Octets-Limit = 2146435072, Framed-IP-Netmask = 255.255.255.255,
Exec-Program: returned: 0
Sending Access-Accept of id 53 to 192.168.101.11 port 43311
        Acct-Interim-Interval = 60
        Session-Timeout = 1890288
        Octets-Direction = Route-IP-Yes
        Framed-IP-Address = 192.168.120.2
        Session-Octets-Limit = 2146435072
        Framed-IP-Netmask = 255.255.255.255
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...

Где теперь собака зарыта?

P.S. ubuntu 8.04 i386

[ran]

ну при ошибке 691 абиллс чё-нить в лог пишет... что именно? кроме того не кисло бы поглядеть пппдшный лог подключения (естессно добавив в опции пппд debug и dump)

[lasik]

А может файла лога вообще нет. Его создавать кстати нужно
/usr/abiils/var/log/abills.log или /usr/abiils/var/log/abills.log . Попробуй, вдруг поможет

[NiTr0]

Смотреть в лог пппд - радиус все корректно возвращает судя по логу (Sending Access-Accept of id 53 to 192.168.101.11 port 43311)

[~AsmodeuS~]

http://abills.net.ua/wiki/doku.php/abil ... 1%82%D0%B0

[smilethebest]

имею:
pppd сервер ubuntu 8.04 abills
проблема у windows клиента ошибка 691... faq смотрел перепроверил всё в порядке.
это в /usr/abills/var/log/abills.log

2009-09-25 09:01:09 LOG_WARNING: AUTH [qweqwe] NAS: 0 Unknow server '192.168.0.201' [2] ERROR_NOT_EXIST
2009-09-25 09:01:10 LOG_INFO: AUTH [qweqwe] AUTH REJECT CID 192.168.0.46

это мне говорит freeradius -x

Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1:45466, id=15, length=110
Service-Type = Framed-User
Framed-Protocol = PPP
User-Name = "qweqwe"
CHAP-Challenge = 0xe8eee7bcf0462c96cf9a97d3593cac0da55253985debbd
CHAP-Password = 0x1f0ccd62d68de1c5bc84d13c6f280c7126
Calling-Station-Id = "192.168.0.46"
NAS-IP-Address = 192.168.0.201
NAS-Port = 0
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module "preprocess" returns ok for request 0
rlm_realm: No '@' in User-Name = "qweqwe", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 0
users: Matched entry DEFAULT at line 216
modcall[authorize]: module "files" returns ok for request 0
modcall: leaving group authorize (returns ok) for request 0
rad_check_password: Found Auth-Type Accept
rad_check_password: Auth-Type = Accept, accepting the user
Exec-Program output: Reply-Message = "Unknow server '192.168.0.201'"
Exec-Program-Wait: value-pairs: Reply-Message = "Unknow server '192.168.0.201'"
Exec-Program: returned: 1
Found Post-Auth-Type
Processing the post-auth section of radiusd.conf
modcall: entering group REJECT for request 0
Exec-Program output:
Exec-Program: returned: 0
modcall[post-auth]: module "post_auth" returns ok for request 0
modcall: leaving group REJECT (returns ok) for request 0
Delaying request 0 for 1 seconds
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Sending Access-Reject of id 15 to 127.0.0.1 port 45466
Reply-Message = "Unknow server '192.168.0.201'"
Waking up in 4 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 15 with timestamp 4abc4248
Nothing to do. Sleeping until we see a request.

раньше проблема была такая же только в связке с микротиком как решил не помню хоть убейте...
конфиг радиуса (/etc/freeradius/radiusd.conf секция authorize):

authorize {
# pre_auth
preprocess
suffix
files
}

[smilethebest]

сообщаю решение вышесказаной мной проблемы "Unknow server"
дело в том что в /etc/freeradius/clients.conf имя сервера обязательно должно совпадать с сервером доступа NAS указанный в админке (регистр тоже)
добавьте пунктик в мануал потому что по поиску решение данной проблемы не найти
всем спасибо

[~AsmodeuS~]

http://abills.net.ua/wiki/doku.php/abil ... ules:dv:ru

Ошибки

Ошибки авторизации и другие сообщения в abills.log
(/ Reports/ Internet / Error/)

*
AUTH [upn] NAS: 2 (127.0.0.1) CID: 192.168.34.53 GT: 0.12589 - Пользователь авторизировалса
*
AUTH [unp] NAS: 16 More then allow login (1/1) - Превышено количество одновременных соединений разрешённых этому логину.
Количество одновременных соединений указывается в тарифном плане или в акаунте пользователя при заведении сервиса. Пользовательские настройки имеют более высокий приоритет, чем указанные в тарифном плане.
*
AUTH [unp] NAS: 4 Login Not Exist - Логин не существует или время действия аккаунта истекло.
*
AUTH [unp] NAS: 4 SQL error - Ошибка выполнения SQL запроса.
*
AUTH [unp] NAS: 5 Wrong password '6576567' - Неправильный пароль. При PAP авторизации, в кавычках неправильный пароль.
*
AUTH [unp] NAS: 0 unknown server 127.0.0.1 - Неизвестный NAS сервер. IP передаваемый радиусом в атрибуте NAS-IP-Address не соответствует ни одному серверу доступа, зарегистрированного в системе. см. Nas Servers
*
AUTH [unp] NAS: 16 You are not authorized to log in 16 (192.168.101.133) - пользователю запрещено подключаться к даному NAS ID: 16 IP: 192.168.101.133. см. Tariff Nas, User Nas
*
AUTH [unp] NAS: 16 Rejected! There is no free IPs in address pools (USED: 62) - Исчерпали количество выделеных IP адресов для NAS, Использовано все 62 адреса. Расширте пул Nas Servers
*
AUTH [unp] NAS: 16 Wrong port '11' - Пользователь пробует подключится на запрещёный порт при использовании привязки логинов по портам. Возможно имеет место подмена IP или MAC адреса.
*
AUTH [unp] NAS: 3 Wrong MAC '0:0:21:28:9c:c4' - Неправильный MAC адресс.