PPTP+FreeRadius+Abills не работает авторизация

Littlewolf · Чт окт 02, 2008 5:34 am

Помогите разобраться с проблемой. Мозг кипит, уже не соображаю ничего.
Нужен vpn-сервер. Установил pptp, ppp - работали(с авторизацией через файл /etc/ppp/chap-secrets). Стал прикручивать авторизацию через радиус - и не могу никак. Связка Freeradius+Abills вроде работает, а вот ppptp+FreeRadius никак не отрабатывает.

Логи:
# freeradius -X
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config: including file: /etc/freeradius/proxy.conf
Config: including file: /etc/freeradius/clients.conf
Config: including file: /etc/freeradius/snmp.conf
Config: including file: /etc/freeradius/eap.conf
Config: including file: /etc/freeradius/sql.conf
main: prefix = "/usr"
main: localstatedir = "/var"
main: logdir = "/var/log/freeradius"
main: libdir = "/usr/lib/freeradius"
main: radacctdir = "/var/log/freeradius/radacct"
main: hostname_lookups = no
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 0
main: allow_core_dumps = no
main: log_stripped_names = no
main: log_file = "/var/log/freeradius/radius.log"
main: log_auth = no
main: log_auth_badpass = no
main: log_auth_goodpass = no
main: pidfile = "/var/run/freeradius/freeradius.pid"
main: user = "freerad"
main: group = "freerad"
main: usercollide = no
main: lower_user = "no"
main: lower_pass = "no"
main: nospace_user = "no"
main: nospace_pass = "no"
main: checkrad = "/usr/sbin/checkrad"
main: proxy_requests = yes
proxy: retry_delay = 5
proxy: retry_count = 3
proxy: synchronous = no
proxy: default_fallback = yes
proxy: dead_time = 120
proxy: post_proxy_authorize = no
proxy: wake_all_if_all_dead = no
security: max_attributes = 200
security: reject_delay = 1
security: status_server = no
main: debug_level = 0
read_config_files: reading dictionary
read_config_files: reading naslist
Using deprecated naslist file. Support for this will go away soon.
read_config_files: reading clients
read_config_files: reading realms
radiusd: entering modules setup
Module: Library search path is /usr/lib/freeradius
Module: Loaded exec
exec: wait = yes
exec: program = "(null)"
exec: input_pairs = "request"
exec: output_pairs = "(null)"
exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded PAP
pap: encryption_scheme = "crypt"
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded MS-CHAP
mschap: use_mppe = yes
mschap: require_encryption = yes
mschap: require_strong = yes
mschap: with_ntdomain_hack = no
mschap: passwd = "(null)"
mschap: ntlm_auth = "(null)"
Module: Instantiated mschap (mschap)
Module: Loaded System
unix: cache = no
unix: passwd = "(null)"
unix: shadow = "/etc/shadow"
unix: group = "(null)"
unix: radwtmp = "/var/log/freeradius/radwtmp"
unix: usegroup = no
unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded eap
eap: default_eap_type = "md5"
eap: timer_expire = 60
eap: ignore_unknown_eap_types = no
eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
gtc: challenge = "Password: "
gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
preprocess: huntgroups = "/etc/freeradius/huntgroups"
preprocess: hints = "/etc/freeradius/hints"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line = 23
preprocess: with_ntdomain_hack = no
preprocess: with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack = no
preprocess: with_alvarion_vsa_hack = no
Module: Instantiated preprocess (preprocess)
exec: wait = yes
exec: program = "/usr/abills/libexec/rauth.pl pre_auth"
exec: input_pairs = "request"
exec: output_pairs = "config"
exec: packet_type = "(null)"
Module: Instantiated exec (pre_auth)
Module: Loaded realm
realm: format = "suffix"
realm: delimiter = "@"
realm: ignore_default = no
realm: ignore_null = no
Module: Instantiated realm (suffix)
Module: Loaded files
files: usersfile = "/etc/freeradius/users"
files: acctusersfile = "/etc/freeradius/acct_users"
files: preproxy_usersfile = "/etc/freeradius/preproxy_users"
files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename = "/var/log/freeradius/radutmp"
radutmp: username = "%{User-Name}"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
exec: wait = yes
exec: program = "/usr/abills/libexec/rauth.pl post_auth"
exec: input_pairs = "request"
exec: output_pairs = "config"
exec: packet_type = "(null)"
Module: Instantiated exec (post_auth)
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.

/etc/ppp/pptpd-options

name pptpd
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
auth
plugin radius.so
plugin radattr.so
ms-dns 192.168.1.2
proxyarp
nodefaultroute
debug
dump
lock
nobsdcomp
lcp-echo-failure 5
lcp-echo-interval 30

messages.log

Oct 2 11:15:50 testserver pppd[2761]: Plugin radius.so loaded.
Oct 2 11:15:50 testserver pppd[2761]: RADIUS plugin initialized.
Oct 2 11:15:50 testserver pppd[2761]: Plugin radattr.so loaded.
Oct 2 11:15:50 testserver pppd[2761]: RADATTR plugin initialized.
Oct 2 11:15:50 testserver pppd[2761]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded.
Oct 2 11:15:50 testserver pppd[2761]: pptpd-logwtmp: $Version$
Oct 2 11:15:50 testserver pppd[2761]: pppd options in effect:
Oct 2 11:15:50 testserver pppd[2761]: debug debug^I^I# (from /etc/ppp/pptpd-options)
Oct 2 11:15:50 testserver pppd[2761]: dump^I^I# (from /etc/ppp/pptpd-options)
Oct 2 11:15:50 testserver pppd[2761]: plugin radius.so^I^I# (from /etc/ppp/pptpd-options)
Oct 2 11:15:50 testserver pppd[2761]: plugin radattr.so^I^I# (from command line)
Oct 2 11:15:50 testserver pppd[2761]: plugin /usr/lib/pptpd/pptpd-logwtmp.so^I^I# (from command line)
Oct 2 11:15:50 testserver pppd[2761]: auth^I^I# (from /etc/ppp/pptpd-options)
Oct 2 11:15:50 testserver pppd[2761]: refuse-pap^I^I# (from /etc/ppp/pptpd-options)
Oct 2 11:15:50 testserver pppd[2761]: refuse-chap^I^I# (from /etc/ppp/pptpd-options)
Oct 2 11:15:50 testserver pppd[2761]: refuse-mschap^I^I# (from /etc/ppp/pptpd-options)
Oct 2 11:15:50 testserver pppd[2761]: name pptpd^I^I# (from /etc/ppp/pptpd-options)
Oct 2 11:15:50 testserver pppd[2761]: pptpd-original-ip 192.168.1.223^I^I# (from command line)
Oct 2 11:15:50 testserver pppd[2761]: 115200^I^I# (from command line)
Oct 2 11:15:50 testserver pppd[2761]: lock^I^I# (from /etc/ppp/pptpd-options)
Oct 2 11:15:50 testserver pppd[2761]: crtscts^I^I# (from /etc/ppp/options)
Oct 2 11:15:50 testserver pppd[2761]: local^I^I# (from command line)
Oct 2 11:15:50 testserver pppd[2761]: asyncmap 0^I^I# (from /etc/ppp/options)
Oct 2 11:15:50 testserver pppd[2761]: lcp-echo-failure 5^I^I# (from /etc/ppp/pptpd-options)
Oct 2 11:15:50 testserver pppd[2761]: lcp-echo-interval 30^I^I# (from /etc/ppp/pptpd-options)
Oct 2 11:15:50 testserver pppd[2761]: hide-password^I^I# (from /etc/ppp/options)
Oct 2 11:15:50 testserver pppd[2761]: ipparam 192.168.1.223^I^I# (from command line)
Oct 2 11:15:50 testserver pppd[2761]: ms-dns xxx # [don't know how to print value]^I^I# (from /etc/ppp/pptpd-options)
Oct 2 11:15:50 testserver pppd[rver pppd[2761]: proxyarp^I^I# (from /etc/ppp/pptpd-options)
Oct 2 11:15:50 testserver pppd[2761]: 10.0.0.1:192.168.1.1^I^I# (from command line)
Oct 2 11:15:50 testserver pppd[2761]: nobsdcomp^I^I# (from /etc/ppp/pptpd-options)
Oct 2 11:15:50 testserver pppd[2761]: require-mppe-128^I^I# (from /etc/ppp/pptpd-options)
Oct 2 11:15:50 testserver pppd[2761]: noipx^I^I# (from /etc/ppp/options)
Oct 2 11:15:50 testserver pppd[2761]: pppd 2.4.4 started by root, uid 0
Oct 2 11:15:50 testserver pppd[2761]: Using interface ppp0
Oct 2 11:15:50 testserver pppd[2761]: Connect: ppp0 <--> /dev/pts/2
Oct 2 11:15:53 testserver pppd[2761]: Peer test1 failed CHAP authentication
Oct 2 11:15:53 testserver pppd[2761]: Connection terminated.
Oct 2 11:15:53 testserver pppd[2761]: Exit.

/var/log/debug

Oct 2 11:15:50 testserver pppd[2761]: using channel 3
Oct 2 11:15:50 testserver pppd[2761]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x275eb576> <pcomp> <accomp>]
Oct 2 11:15:50 testserver pppd[2761]: rcvd [LCP ConfReq id=0x0 <mru 1400> <magic 0x25e3cec> <pcomp> <accomp> <callback CBCP>]
Oct 2 11:15:50 testserver pppd[2761]: sent [LCP ConfRej id=0x0 <callback CBCP>]
Oct 2 11:15:50 testserver pppd[2761]: rcvd [LCP ConfReq id=0x1 <mru 1400> <magic 0x25e3cec> <pcomp> <accomp>]
Oct 2 11:15:50 testserver pppd[2761]: sent [LCP ConfAck id=0x1 <mru 1400> <magic 0x25e3cec> <pcomp> <accomp>]
Oct 2 11:15:53 testserver pppd[2761]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x275eb576> <pcomp> <accomp>]
Oct 2 11:15:53 testserver pppd[2761]: rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x275eb576> <pcomp> <accomp>]
Oct 2 11:15:53 testserver pppd[2761]: sent [LCP EchoReq id=0x0 magic=0x275eb576]
Oct 2 11:15:53 testserver pppd[2761]: sent [CHAP Challenge id=0xc0 <3a50e7613aa4f68e9dc33e395677e1f4>, name = "pptpd"]
Oct 2 11:15:53 testserver pppd[2761]: rcvd [LCP Ident id=0x2 magic=0x25e3cec "MSRASV5.10"]
Oct 2 11:15:53 testserver pppd[2761]: rcvd [LCP Ident id=0x3 magic=0x25e3cec "MSRAS-0-LITTLEWOLF"]
Oct 2 11:15:53 testserver pppd[2761]: rcvd [LCP EchoRep id=0x0 magic=0x25e3cec]
Oct 2 11:15:53 testserver pppd[2761]: rcvd [CHAP Response id=0xc0 <7988f4e0b1a9202045a5f2a7b8ec663400000000000000000882e03fa5eb4a2ac6bd1e60a2bfddb988ebf5b92ca446d800>, name = "test1"]
Oct 2 11:15:53 testserver pppd[2761]: sent [CHAP Failure id=0xc0 ""]
Oct 2 11:15:53 testserver pppd[2761]: sent [LCP TermReq id=0x2 "Authentication failed"]
Oct 2 11:15:53 testserver pppd[2761]: rcvd [LCP TermAck id=0x2 "Authentication failed"]
Oct 2 11:15:53 testserver pptpd[27pppd[2761]: RADATTR plugin removed file /var/run/radattr.ppp0.

Извиняюсь за большой пост, просто сразу хотел предоставить всю информацию.

Если нужны еще какие-то логи - предоставлю в тот же момент

ran · Сообщение **ran** » Чт окт 02, 2008 11:04 am

Если нужны еще какие-то логи - предоставлю в тот же момент

логи-то все... только не тогда когда нада

нехватает самого интересного - дебаг лога радиуса в момент подключения а в момент инициализации - нафига он?

Littlewolf · Пт окт 03, 2008 3:39 am

Вот лог радиуса:
Fri Oct 3 09:33:13 2008 : Info: Using deprecated naslist file. Support for this will go away soon.
Fri Oct 3 09:33:13 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Fri Oct 3 09:33:13 2008 : Info: Ready to process requests.
Fri Oct 3 09:36:29 2008 : Auth: Login OK: [test1/12345] (from client localhost port 0)

Fri Oct 3 09:36:29 2008 : Auth: Login OK: [test1/12345] (from client localhost port 0) - это при подключении локально командой radtest test1 12345 127.0.0.1:1812 0 testing123 0 127.0.0.1.

А при подключении с удаленного компа в логах пусто... И при запуске freeradius -X все заканчивается на строчке Ready to process requests. И все... Если бы что-то в логах было, я бы может и сам сообразил, в чем проблема. А на удаленном компе выдает ошибку 691

NiTr0 · Пт окт 03, 2008 8:32 am

Файрвол отключен? На удаленной машине (где pptp) - радиусклиент корректно настроен?

Littlewolf · Пт окт 03, 2008 9:16 am

Файрволл отключен. Возможно неправильно объяснил

При подключении клиентской машины (она под виндой, подключаю впн) выдается ошибка 691. Радиусклиент, фреерадиус, pptp, абиллс - все это на одной машине

ran · Сообщение **ran** » Пт окт 03, 2008 10:11 am

Вот лог радиуса:

ran писал(а):нехватает самого интересного - дебаг лога радиуса в момент подключения

radiusd -X и прцитировать что он скажет в момент подключения

Littlewolf · Пт окт 03, 2008 10:15 am

freeradius -X

.....
Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1:32769, id=81, length=63
User-Name = "test1"
User-Password = "12345"
NAS-IP-Address = 127.0.0.1
NAS-Port = 0
Framed-Protocol = PPP
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module "preprocess" returns ok for request 0
radius_xlat: '/usr/abills/libexec/rauth.pl pre_auth'
Exec-Program: /usr/abills/libexec/rauth.pl pre_auth
Exec-Program output: Auth-Type := Accept
Exec-Program-Wait: value-pairs: Auth-Type := Accept
Exec-Program: returned: 0
modcall[authorize]: module "pre_auth" returns ok for request 0
modcall[authorize]: module "mschap" returns noop for request 0
rlm_realm: No '@' in User-Name = "test1", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 0
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 0
modcall: leaving group authorize (returns ok) for request 0
rad_check_password: Found Auth-Type Accept
rad_check_password: Auth-Type = Accept, accepting the user
radius_xlat: '/usr/abills/libexec/rauth.pl'
Exec-Program: /usr/abills/libexec/rauth.pl
Exec-Program output: Session-Timeout = 2450693, Octets-Direction = 0, Framed-IP-Address = 192.168.1.171, Session-Octets-Limit = 2147483648, Framed-IP-Netmask = 255.255.255.255,
Exec-Program-Wait: value-pairs: Session-Timeout = 2450693, Octets-Direction = 0, Framed-IP-Address = 192.168.1.171, Session-Octets-Limit = 2147483648, Framed-IP-Netmask = 255.255.255.255,
Exec-Program: returned: 0
Login OK: [test1/12345] (from client localhost port 0)
Sending Access-Accept of id 81 to 127.0.0.1 port 32769
Session-Timeout = 2450693
Octets-Direction = Route-IP-No
Framed-IP-Address = 192.168.1.171
Session-Octets-Limit = 2147483648
Framed-IP-Netmask = 255.255.255.255
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 81 with timestamp 48e5f0ab
Nothing to do. Sleeping until we see a request.

Это при подключении radtest'ом на этой же машине с другой консоли. А когда пытаешься подключиться по vpn с виндового клиента последнее сообщение
Ready to process requests.
И все, больше ничего нет.

ran · Сообщение **ran** » Пт окт 03, 2008 10:31 am

А когда пытаешься подключиться по vpn с виндового клиента последнее сообщение
Ready to process requests.
И все, больше ничего нет.

ну дык начит никто к радиуссерверу и не обращается

в конфиге радиусклиента всё пучком?

Littlewolf · Пт окт 03, 2008 10:43 am

Насколько я понял, все. Вот он

auth_order radius,local
login_tries 4
login_timeout 60
nologin /etc/nologin
issue /etc/radiusclient/issue
authserver localhost
acctserver localhost
servers /etc/radiusclient/servers
dictionary /etc/radiusclient/dictionary
login_radius /usr/sbin/login.radius
seqfile /var/run/radius.seq
mapfile /etc/radiusclient/port-id-map
default_realm
radius_timeout 10
radius_retries 3
login_local /bin/login

Я сильно подозреваю, что ошибка может быть в dictionary, но где - не соображу

ran · Сообщение **ran** » Пт окт 03, 2008 10:49 am

Я сильно подозреваю, что ошибка может быть в dictionary, но где - не соображу

не лизь попэрэд батьки... до словарей мы ещё не доехали - это на закуску

отута /etc/radiusclient/servers у тебя что?

Littlewolf · Пт окт 03, 2008 10:59 am

аха! В них ничего небыло, прописал
localhost testing123

freeradius -X теперь в момент подключения выдает
Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1:32769, id=177, length=148
Service-Type = Framed-User
Framed-Protocol = PPP
User-Name = "test1"
MS-CHAP-Challenge = 0x0456b64593dae5261afd74bde0d3dce0
MS-CHAP2-Response = 0x420027c34f351b048196d7ad71691522066a00000000000000007d4ea5db1dfe4d3eb94e5b5a72ebbcce9278513900bec8a9
Calling-Station-Id = "192.168.1.223"
NAS-IP-Address = 127.0.1.1
NAS-Port = 0
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module "preprocess" returns ok for request 0
radius_xlat: '/usr/abills/libexec/rauth.pl pre_auth'
Exec-Program: /usr/abills/libexec/rauth.pl pre_auth
Exec-Program output: User-Password == "12345"
Exec-Program-Wait: value-pairs: User-Password == "12345"
Exec-Program: returned: 0
modcall[authorize]: module "pre_auth" returns ok for request 0
rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap'
modcall[authorize]: module "mschap" returns ok for request 0
rlm_realm: No '@' in User-Name = "test1", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 0
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 0
modcall: leaving group authorize (returns ok) for request 0
rad_check_password: Found Auth-Type MS-CHAP
auth: type "MS-CHAP"
Processing the authenticate section of radiusd.conf
modcall: entering group MS-CHAP for request 0
rlm_mschap: Told to do MS-CHAPv2 for test1 with NT-Password
rlm_mschap: adding MS-CHAPv2 MPPE keys
modcall[authenticate]: module "mschap" returns ok for request 0
modcall: leaving group MS-CHAP (returns ok) for request 0
radius_xlat: '/usr/abills/libexec/rauth.pl'
Exec-Program: /usr/abills/libexec/rauth.pl
Exec-Program output: Reply-Message = "Unknow server '127.0.1.1'"
Exec-Program-Wait: value-pairs: Reply-Message = "Unknow server '127.0.1.1'"
Exec-Program: returned: 1
Login incorrect (external check said so): [test1/<no User-Password attribute>] (from client localhost port 0 cli 192.168.1.223)
Found Post-Auth-Type
Processing the post-auth section of radiusd.conf
modcall: entering group REJECT for request 0
radius_xlat: '/usr/abills/libexec/rauth.pl post_auth'
Exec-Program: /usr/abills/libexec/rauth.pl post_auth
Exec-Program output:
Exec-Program: returned: 0
modcall[post-auth]: module "post_auth" returns ok for request 0
modcall: leaving group REJECT (returns ok) for request 0
Delaying request 0 for 1 seconds
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Sending Access-Reject of id 177 to 127.0.0.1 port 32769
Reply-Message = "Unknow server '127.0.1.1'"
Waking up in 4 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 177 with timestamp 48e5faef
Nothing to do. Sleeping until we see a request.

ran · Сообщение **ran** » Пт окт 03, 2008 11:08 am

дык ясно ж пишет:

Reply-Message = "Unknow server '127.0.1.1'"

или с переводом проблем?

Littlewolf · Пт окт 03, 2008 11:12 am

Проблем похоже с мозгами.... Откуда берется 127.0.1.1? Если во всех конфигах прописан localhost (то есть 127.0.0.1). Или надо писать внешний адрес сервера?

ran · Сообщение **ran** » Пт окт 03, 2008 11:35 am

Если во всех конфигах прописан localhost

а в базе в серверах доступа?

Littlewolf · Пт окт 03, 2008 11:37 am

Там цифрами прописано 127.0.0.1. Имеется ввиду база Abills, я правильно понял? Которая через веб-интерфейс настраивается?