Re: Values for MySQL tables for pptpd ?
Steve Phillips <[email protected]> Thu, 24 May 2012 12:27:30 +1000
| Newsgroups | gmane.network.poptop |
|---|---|
| Message-ID | <[email protected]> |
This is why I was suggesting that before you do anything, you get the
radius system working as expected.
If you use the radtest tool that comes with freeradius you can generate
a simulated request and see what the server replies with.
Also, it is best to keep things really simple to start with. This means
pretty much having a user and a password as the check types, and have
something like 'service-type=framed' as the single reply, adding things
like framed-compression can cause the requesting client to fail for
unexplained reasons - once you have it working hten try adding some of
the extra features.
Now, looking at what you added her, it seems you added a check attribute
'Password', which is fine, but that attribute will need to be defined
exactly (case sensitive) as it appears in your dictionary, if the
definition in your dictionary matches the chap-password type (3) then
you'll be fine, but if the dictionary doesn't have this definition then
it will ignore it and usually complain about unknown attributes.
Because it is claiming that there is no User-Password or CHAP-Password
in the request, then I assume that these are the actual definitions in
the dictionary, and "Password" may not actually match any of these.
What you should do is try to get an actual radius packet trace which
will map all the attributes that come from the pptp system, this will
give you an idea on what to put into your database to match against (the
trace should come from free radius with freeradius using its dictionary
to turn the attribute values into human readable strings that you will
use to put into the database at match criteria)
What you should see is something like
User-Name = "nasser"
CHAP-Challenge = "dahreio493herg9843hmn,msndfgoirejoer"
(Or something similar)
Also, you will need to look up the freeradius documentation to find out
how server specific things such as Auth-Type are handled.
I'd seriously consider clearing the database out, then adding a single
user in the radcheck/radreply tables using a PAP Password (User-Name and
User-Password attributes only) with a simple reply "Service-Type =
Framed" and then use the radcheck tool to verify this works, then change
the User-Password to a CHAP-Password and then re-verify, and then try
from the pptp side of things.
RADIUS can be a bit daunting if you're unsure how it works, if you like,
I did a course on it a while back and still have some slides that
explain how it works, it might be worthwhile reading.
http://www.focb.co.nz/training/RADIUS_Intro.pdf
Hope this helps somewhat.
--
Steve.
On 23/05/2012 6:10 PM, Ali Jawad wrote:
> I did change the values and added as per your instructions..sample input
>
> INSERT INTO radgroupcheck (GroupName, Attribute, Value) VALUES ('normalusers','Auth-Type','MS-CHAP');
> INSERT INTO radgroupreply (GroupName, Attribute, Value) VALUES ('normalusers','Framed-Compression','Van-Jacobson-TCP-IP' );
> INSERT INTO radgroupreply (GroupName, Attribute, Value) VALUES ('normalusers','Framed-Protocol','PPP' );
> INSERT INTO radgroupreply (GroupName, Attribute, Value) VALUES ('normalusers','Service-Type','Framed-User' );
> INSERT INTO radusergroup (UserName, GroupName, priority) VALUES ('nasser','normalusers', 1);
> INSERT INTO radcheck (UserName, Attribute, Value) VALUES ('nasser','Password','123456');
> INSERT INTO radcheck VALUES ('2','nasser','Login-Time',':=','Al0800-1200');
> INSERT INTO radcheck VALUES ('','nasser','Max-Daily-Session',':=','3600');
> INSERT INTO radreply (UserName, Attribute, Value) VALUES ('nasser','Framed-IP-Address','172.16.1.33');
>
>
> and got
>
> auth: No User-Password or CHAP-Password attribute in the request
>
> On Wed, May 23, 2012 at 11:04 AM, Steve Phillips <[email protected]
> <mailto:[email protected]>> wrote:
>
> This appears to be a problem with your configuration of freeradius.
>
> From looking over the messages in your logfile, Its appears
> freeradius is trying to look the user up (after you added it) and
> this is succeeding, but then it tried to get the reply attributes,
> cant locate the user and so exits.
>
> Have you tried adding an entry in the radreply table as well ? (try
> adding something like, "Service-Type=Framed" and
> "Framed-Protocol=PPP" as reply attributes as they are pretty
> standard and it wont hurt to add them)
>
> Before doing the entire pptp thing, try using the command line
> radcheck tool (I forget the exact name of the binary, but it will be
> comething like radcheck or checkrad or radtest) that comes with free
> radius and ensure this is all working and you are getting good
> authentication replies before adding pptp into the mix.
>
> --
> Steve.
>
>
> On 23/05/2012 5:17 PM, Ali Jawad wrote:
>
> Hi
> I did setup pptpd with freeradius + mysql
> http://poptop.sourceforge.net/__dox/radius_mysql.html
> <http://poptop.sourceforge.net/dox/radius_mysql.html>.
> pptpd "poptop" works fine without freeradius, with freeradius and
> mysql, all seems fine apart from me not knowing what values to enter
> into the mysql tables of freeradius.
>
> With no entries in database I get
>
> Ready to process requests.
>
> rad_recv: Access-Request packet from host 127.0.0.1:45194
> <http://127.0.0.1:45194>
> <http://127.0.0.1:45194/>, id=198, length=67
>
> Service-Type = Framed-User
> Framed-Protocol = PPP
> User-Name = "test"
> Calling-Station-Id = "193.227.186.146"
> NAS-IP-Address = 127.0.0.1
> NAS-Port = 0
> Processing the authorize section of radiusd.conf
> modcall: entering group authorize for request 0
> modcall[authorize]: module "preprocess" returns ok for request 0
> rlm_realm: No '@' in User-Name = "test", looking up realm NULL
> rlm_realm: No such realm "NULL"
> modcall[authorize]: module "suffix" returns noop for request 0
> radius_xlat: 'test'
> rlm_sql (sql): sql_set_user escaped user --> 'test'
> radius_xlat: 'SELECT id, UserName, Attribute, Value, op
> FROM
> radcheck WHERE Username = 'test' ORDER BY id'
> rlm_sql (sql): Reserving sql socket id: 4
> rlm_sql (sql): User test not found in radcheck
> radius_xlat: 'SELECT radgroupcheck.id <http://radgroupcheck.id>
> <http://radgroupcheck.id/>,__radgroupcheck.GroupName,__radgroupcheck.Attribute,__radgroupcheck.Value,__radgroupcheck.op
>
> FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test' AND
> usergroup.GroupName = radgroupcheck.GroupName ORDER BY
> radgroupcheck.id <http://radgroupcheck.id>
> <http://radgroupcheck.id/>'
> radius_xlat: 'SELECT radgroupreply.id <http://radgroupreply.id>
> <http://radgroupreply.id/>,__radgroupreply.GroupName,__radgroupreply.Attribute,__radgroupreply.Value,__radgroupreply.op
>
> FROM radgroupreply,usergroup WHERE usergroup.Username = 'test' AND
> usergroup.GroupName = radgroupreply.GroupName ORDER BY
> radgroupreply.id <http://radgroupreply.id>
> <http://radgroupreply.id/>'
>
> rlm_sql (sql): User test not found in radgroupcheck
> rlm_sql (sql): Released sql socket id: 4
> rlm_sql (sql): User not found <#######################
> modcall[authorize]: module "sql" returns notfound for request 0
> modcall[authorize]: module "mschap" returns noop for request 0
> modcall: leaving group authorize (returns ok) for request 0
> auth: No authenticate method (Auth-Type) configuration found for the
> request: Rejecting the user
> auth: Failed to validate the user.
> Delaying request 0 for 1 seconds
> Finished request 0
> Going to the next request
> --- Walking the entire request list ---
> Waking up in 1 seconds...
> --- Walking the entire request list ---
> Waking up in 1 seconds...
> --- Walking the entire request list ---
> Sending Access-Reject of id 198 to 127.0.0.1 port 45194
> Waking up in 4 seconds...
> --- Walking the entire request list ---
> Cleaning up request 0 ID 198 with timestamp 4fbc8c9d
>
>
> When I do add to radcheck -
>
> INSERT INTO `radcheck` (`id`, `UserName`, `Attribute`, `op`,
> `Value`) VALUES
> (11, 'test', 'Chap-Password', '==', 'test');
>
> I get
>
> rad_recv: Access-Request packet from host 127.0.0.1:46882
> <http://127.0.0.1:46882>
> <http://127.0.0.1:46882/>, id=199, length=67
>
> Service-Type = Framed-User
> Framed-Protocol = PPP
> User-Name = "test"
> Calling-Station-Id = "193.227.186.146"
> NAS-IP-Address = 127.0.0.1
> NAS-Port = 0
> Processing the authorize section of radiusd.conf
> modcall: entering group authorize for request 1
> modcall[authorize]: module "preprocess" returns ok for request 1
> rlm_realm: No '@' in User-Name = "test", looking up realm NULL
> rlm_realm: No such realm "NULL"
> modcall[authorize]: module "suffix" returns noop for request 1
> radius_xlat: 'test'
> rlm_sql (sql): sql_set_user escaped user --> 'test'
> radius_xlat: 'SELECT id, UserName, Attribute, Value, op
> FROM
> radcheck WHERE Username = 'test' ORDER BY id'
> rlm_sql (sql): Reserving sql socket id: 3
> radius_xlat: 'SELECT radgroupcheck.id <http://radgroupcheck.id>
> <http://radgroupcheck.id/>,__radgroupcheck.GroupName,__radgroupcheck.Attribute,__radgroupcheck.Value,__radgroupcheck.op
>
> FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test' AND
> usergroup.GroupName = radgroupcheck.GroupName ORDER BY
> radgroupcheck.id <http://radgroupcheck.id>
> <http://radgroupcheck.id/>'
>
> radius_xlat: 'SELECT id, UserName, Attribute, Value, op
> FROM
> radreply WHERE Username = 'test' ORDER BY id'
> radius_xlat: 'SELECT radgroupreply.id <http://radgroupreply.id>
> <http://radgroupreply.id/>,__radgroupreply.GroupName,__radgroupreply.Attribute,__radgroupreply.Value,__radgroupreply.op
>
> FROM radgroupreply,usergroup WHERE usergroup.Username = 'test' AND
> usergroup.GroupName = radgroupreply.GroupName ORDER BY
> radgroupreply.id <http://radgroupreply.id>
> <http://radgroupreply.id/>'
>
> rlm_sql (sql): Released sql socket id: 3
> rlm_sql (sql): No matching entry in the database for request
> from user
> [test]
> modcall[authorize]: module "sql" returns notfound for request 1
> modcall[authorize]: module "mschap" returns noop for request 1
> modcall: leaving group authorize (returns ok) for request 1
> auth: No authenticate method (Auth-Type) configuration found for the
> request: Rejecting the user <#################
> auth: Failed to validate the user.
> Delaying request 1 for 1 seconds
> Finished request 1
> Going to the next request
> --- Walking the entire request list ---
> Waking up in 1 seconds...
> --- Walking the entire request list ---
> Waking up in 1 seconds...
> --- Walking the entire request list ---
> Sending Access-Reject of id 199 to 127.0.0.1 port 46882
> Waking up in 4 seconds...
> --- Walking the entire request list ---
> Cleaning up request 1 ID 199 with timestamp 4fbc8d01
> Nothing to do. Sleeping until we see a request.
>
>
> I am lost here, please advice.
>
>
> ------------------------------__------------------------------__------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond.
> Discussions
> will include endpoint security, mobile security and the latest
> in malware
> threats.
> http://www.accelacomm.com/jaw/__sfrnl04242012/114/50122263/
> <http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/>
>
>
>
> _________________________________________________
> Poptop-server mailing list
> Poptop-server@lists.__sourceforge.net
> <mailto:[email protected]>
> https://lists.sourceforge.net/__lists/listinfo/poptop-server
> <https://lists.sourceforge.net/lists/listinfo/poptop-server>
>
>
>
>
>
>
> --
> *Ali Jawad
> *
> *Information Systems Manager*
> *Splendor Telecom (www.splendor.net <http://www.splendor.net/>)
> Beirut, Lebanon
> Phone: +9611373725/ext 116
> FAX: +9611375554*
>
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/