LinuxForum.Fans
Тема

Pptp + Freeradius + mysql = не работает

Автор: XliN 10 сообщений 5499 просмотров
#194581

Не могу подрубиться с вин машины, какие надо галки поставить с шифрованием? Выдает 754 ошибку.
Вот логи тестового прогона радиуса. Видно что все работает. Берется из базы и выдает IP.
Запускаю
[console]radiusd -X[/console]
Стартует без ошибок. На второй консоле делаю
[console]
[root@domain ~]# radtest user2 pass2 localhost 1812 atomserver
Sending Access-Request of id 83 to 127.0.0.1 port 1812
User-Name = "user2"
User-Password = "pass2"
NAS-IP-Address = 192.168.3.223
NAS-Port = 1812
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=83, length=50
Service-Type = Framed-User
Framed-Protocol = PPP
Framed-Compression = Van-Jacobson-TCP-IP
Framed-IP-Address = 192.168.80.61
Framed-IP-Netmask = 255.255.255.0[/console]

Radius отдает такой вывод
[console]
rad_recv: Access-Request packet from host 127.0.0.1 port 57770, id=207, length=57
User-Name = "user2"
User-Password = "pass2"
NAS-IP-Address = 192.168.3.223
NAS-Port = 1812
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "user2", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[unix] returns notfound
[files] users: Matched entry DEFAULT at line 1
[files] users: Matched entry DEFAULT at line 170
++[files] returns ok
[sql] expand: %{User-Name} -> user2
[sql] sql_set_user escaped user --> 'user2'
rlm_sql (sql): Reserving sql socket id: 1
[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user2' ORDER BY id
WARNING: Found User-Password == "...".
WARNING: Are you sure you don't mean Cleartext-Password?
WARNING: See "man rlm_pap" for more information.
[sql] User found in radcheck table
[sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'user2' ORDER BY id
[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'user2' ORDER BY priority
[sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dinamic-ip-vpn' ORDER BY id
[sql] User found in group dinamic-ip-vpn
[sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dinamic-ip-vpn' ORDER BY id
rlm_sql (sql): Released sql socket id: 1
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns updated
Found Auth-Type = PAP
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

User-Password in config items with Cleartext-Password.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

update your configuration so that the "known good"

text password is in Cleartext-Password, and not in User-Password.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+- entering group PAP {...}
[pap] login attempt with password "pass2"
[pap] Using clear text password "pass2"
[pap] User authenticated successfully
++[pap] returns ok
+- entering group session {...}
[radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp
++[radutmp] returns ok
+- entering group post-auth {...}
[main_pool] expand: %{NAS-IP-Address} %{NAS-Port} -> 192.168.3.223 1812
[main_pool] MD5 on 'key' directive maps to: 5f89596f3bc6e5e95ec287c6e6574fb2
[main_pool] Searching for an entry for key: '5f89596f3bc6e5e95ec287c6e6574fb2'
[main_pool] Found a stale entry for ip: 192.168.80.61
[main_pool] num: 0
rlm_ippool: Allocating ip to key: '5f89596f3bc6e5e95ec287c6e6574fb2'
[main_pool] num: 1
[main_pool] Allocated ip 192.168.80.55 to client key: 5f89596f3bc6e5e95ec287c6e6574fb2
++[main_pool] returns ok
[sql] expand: %{User-Name} -> user2
[sql] sql_set_user escaped user --> 'user2'
[sql] expand: %{User-Password} -> pass2
[sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'user2', 'pass2', 'Access-Accept', '2011-09-21 22:18:04')
rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'user2', 'pass2', 'Access-Accept', '2011-09-21 22:18:04')
rlm_sql (sql): Reserving sql socket id: 0
rlm_sql (sql): Released sql socket id: 0
++[sql] returns ok
++[exec] returns noop
Sending Access-Accept of id 207 to 127.0.0.1 port 57770
Service-Type := Framed-User
Framed-Protocol := PPP
Framed-Compression := Van-Jacobson-TCP-IP
Framed-IP-Address = 192.168.80.55
Framed-IP-Netmask = 255.255.255.0
Finished request 45.
Going to the next request
Waking up in 4.9 seconds.
[/console]
А вот с винды не прокатывает.Делаю по статье [url]http://habrahabr.ru/blogs/linux/128599/[/url]
Видно что авторизация идет по PAP и проходит успешно, но ..... (печалька) :)
#194584

Вот еще логи. Выдает 734 ошибку если подрубаться с винды и настройки оставить по дефолту

Показать
[console]Sep 21 22:25:12 domain pptpd[1710]: CTRL: Client 192.168.3.222 control connection started
Sep 21 22:25:12 domain pptpd[1710]: CTRL: Starting call (launching pppd, opening GRE)
Sep 21 22:25:12 domain pppd[1711]: Warning: can't open options file /root/.ppprc: Permission denied
Sep 21 22:25:12 domain pppd[1711]: Plugin radius.so loaded.
Sep 21 22:25:12 domain pppd[1711]: RADIUS plugin initialized.
Sep 21 22:25:12 domain pppd[1711]: Plugin radattr.so loaded.
Sep 21 22:25:12 domain pppd[1711]: RADATTR plugin initialized.
Sep 21 22:25:12 domain pppd[1711]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded.
Sep 21 22:25:12 domain pppd[1711]: pppd 2.4.5 started by root, uid 0
Sep 21 22:25:12 domain pppd[1711]: Using interface ppp0
Sep 21 22:25:12 domain pppd[1711]: Connect: ppp0 <--> /dev/pts/3
Sep 21 22:25:12 domain pptpd[1710]: GRE: Bad checksum from pppd.
Sep 21 22:25:15 domain pptpd[1710]: CTRL: Ignored a SET LINK INFO packet with real ACCMs!
Sep 21 22:25:15 domain pppd[1711]: MPPE required, but keys are not available. Possible plugin problem?
Sep 21 22:25:15 domain pppd[1711]: Connection terminated.
Sep 21 22:25:15 domain pppd[1711]: Connect time 0.1 minutes.
Sep 21 22:25:15 domain pppd[1711]: Sent 0 bytes, received 0 bytes.
Sep 21 22:25:15 domain pppd[1711]: Exit.
Sep 21 22:25:15 domain pptpd[1710]: CTRL: Client 192.168.3.222 control connection finished[/console]

Это радиус
[console]
rad_recv: Access-Request packet from host 127.0.0.1 port 49881, id=201, length=148
Service-Type = Framed-User
Framed-Protocol = PPP
User-Name = "user1"
MS-CHAP-Challenge = 0x70d02971fcfc17cb4065d1f14b3e6499
MS-CHAP2-Response = 0x990021d581b07e02bb127eba25c75c61f9350000000000000000eeed9f01bef537a0ce5aea79dc8f4992510661f61cd375c8
Calling-Station-Id = "192.168.3.222"
NAS-IP-Address = 192.168.3.223
NAS-Port = 0
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'
++[mschap] returns ok
[suffix] No '@' in User-Name = "user1", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[unix] returns notfound
[files] users: Matched entry DEFAULT at line 1
[files] users: Matched entry DEFAULT at line 170
[files] users: Matched entry DEFAULT at line 178
++[files] returns ok
[sql] expand: %{User-Name} -> user1
[sql] sql_set_user escaped user --> 'user1'
rlm_sql (sql): Reserving sql socket id: 2
[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user1' ORDER BY id
WARNING: Found User-Password == "...".
WARNING: Are you sure you don't mean Cleartext-Password?
WARNING: See "man rlm_pap" for more information.
[sql] User found in radcheck table
[sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'user1' ORDER BY id
[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'user1' ORDER BY priority
[sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'static-ip-vpn' ORDER BY id
[sql] User found in group static-ip-vpn
[sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'static-ip-vpn' ORDER BY id
rlm_sql (sql): Released sql socket id: 2
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] Found existing Auth-Type, not changing it.
++[pap] returns noop
Found Auth-Type = MSCHAP
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

User-Password in config items with Cleartext-Password.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

update your configuration so that the "known good"

text password is in Cleartext-Password, and not in User-Password.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+- entering group MS-CHAP {...}
[mschap] Told to do MS-CHAPv2 for user1 with NT-Password
++[mschap] returns ok
+- entering group session {...}
[radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp
++[radutmp] returns ok
+- entering group post-auth {...}
[main_pool] expand: %{NAS-IP-Address} %{NAS-Port} -> 192.168.3.223 0
[main_pool] MD5 on 'key' directive maps to: d3b375186e480ccb5dcfd383a2932f69
[main_pool] Searching for an entry for key: 'd3b375186e480ccb5dcfd383a2932f69'
[main_pool] Found Framed-IP-Address attribute in reply attribute list.
[main_pool] override is set to no. Return NOOP.
++[main_pool] returns noop
[sql] expand: %{User-Name} -> user1
[sql] sql_set_user escaped user --> 'user1'
[sql] expand: %{User-Password} ->
[sql] ... expanding second conditional
[sql] expand: %{Chap-Password} ->
[sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'user1', '', 'Access-Accept', '2011-09-21 22:26:07')
rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'user1', '', 'Access-Accept', '2011-09-21 22:26:07')
rlm_sql (sql): Reserving sql socket id: 1
rlm_sql (sql): Released sql socket id: 1
++[sql] returns ok
++[exec] returns noop
Sending Access-Accept of id 201 to 127.0.0.1 port 49881
Framed-Protocol := PPP
Framed-Compression := Van-Jacobson-TCP-IP
Framed-IP-Netmask := 255.255.255.255
Framed-IP-Address := 192.168.80.90
Service-Type := Framed-User
MS-CHAP2-Success = 0x99533d32313838334532424543414146374234383137354230354538453939453135304135333235304438
Finished request 50.
Going to the next request
Waking up in 4.9 seconds.
[/console]
#194632

Ну как всегда один на свои посты отвечаю. Может поможет мой iptables

Показать
[console][root@domain ~]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.7 on Wed Sep 21 21:39:07 2011
*mangle
:PREROUTING ACCEPT [375:29086]
:INPUT ACCEPT [374:28854]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [231:38180]
:POSTROUTING ACCEPT [231:38180]
COMMIT
# Completed on Wed Sep 21 21:39:07 2011
# Generated by iptables-save v1.4.7 on Wed Sep 21 21:39:07 2011
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [231:38180]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p gre -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 1723 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -s 192.168.80.0/24 -o eth0 -j ACCEPT
-A FORWARD -d 192.168.80.0/24 -i eth0 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Wed Sep 21 21:39:07 2011
# Generated by iptables-save v1.4.7 on Wed Sep 21 21:39:07 2011
*nat
:PREROUTING ACCEPT [8:748]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -s 192.168.80.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Wed Sep 21 21:39:07 2011[/console]
#194651

Проблема решилась. Мешала два пункта
1. Был включен SELinux
2. строчка MPPE required, but keys are not available. Possible plugin problem?

Нет работает этот плагин (модуль). Не знаете как его подгрузить? А именно mppe-64 или mppe-128

#194652

modprobe ppp_mppe не канает smile А шифрование трафика хочу сделать обязательно. Так как через быдло нет будет идти информация о личных данных, которую палить лишний раз не хочется.

#194653

Стоит добавить в /etc/ppp/options.pptpd

require-mppe
require-mppe-128

Так сразу получаю

MPPE required, but keys are not available. Possible plugin problem?
#205651

Лезет вот такая фигня после перезапуска сервера, где стоит pptp. У всех клиентов лезет 691 ошибка.
В логах видно что он на это ругается

Peer user1 failed CHAP authentication

Со временем ошибка исчезает и коннект к VPN работает нормально. Меня это не устраивает. Связка у меня, как видно из логов, freeradius+mysql+pptp

Показать
Nov 15 20:08:12 domain pptpd[2778]: CTRL: Client 192.168.3.77 control connection started
Nov 15 20:08:12 domain pptpd[2778]: CTRL: Starting call (launching pppd, opening GRE)
Nov 15 20:08:12 domain pppd[2780]: Plugin radius.so loaded.
Nov 15 20:08:12 domain pppd[2780]: RADIUS plugin initialized.
Nov 15 20:08:12 domain pppd[2780]: Plugin radattr.so loaded.
Nov 15 20:08:12 domain pppd[2780]: RADATTR plugin initialized.
Nov 15 20:08:12 domain pppd[2780]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded.
Nov 15 20:08:12 domain pppd[2780]: pppd 2.4.5 started by root, uid 0
Nov 15 20:08:12 domain lldpad[1107]: evb_ifdown:port ppp0 remove failed
Nov 15 20:08:12 domain lldpad[1107]: vdp_ifdown:ppp0 vdp data remove failed
Nov 15 20:08:12 domain pppd[2780]: Using interface ppp0
Nov 15 20:08:12 domain pppd[2780]: Connect: ppp0 <--> /dev/pts/2
Nov 15 20:08:12 domain pptpd[2778]: CTRL: Ignored a SET LINK INFO packet with real ACCMs!
Nov 15 20:08:13 domain pppd[2780]: Peer user1 failed CHAP authentication
Nov 15 20:08:13 domain pppd[2780]: Connection terminated.
Nov 15 20:08:13 domain kernel: libfcoe_device_notification: NETDEV_UNREGISTER ppp0
Nov 15 20:08:13 domain pppd[2780]: Exit.
Nov 15 20:08:13 domain pptpd[2778]: CTRL: Client 192.168.3.77 control connection finished

Есть какие соображения? Только не говорите переходить на OpenVPN :)

#205767

Я в своем репертуаре. Отвечаю сам себе. Если после перезапуска сервера постоянно вылетает 691 ошибка под всеми пользователями, то поможет создание нового пользователя в базе MySQL. После этого что то происходит и freeradius начинает нормально искать пользователей в базе.

Может база по рушилась? Есть какие средства для проверки?

#205781

Сделал

Показать
[console][root@domain ~]# mysqlcheck -p --databases radius
Enter password:
radius.radacct
warning : 4 clients are using or haven't closed the table properly
status : OK
radius.radcheck OK
radius.radgroupcheck OK
radius.radgroupreply OK
radius.radpostauth
warning : 4 clients are using or haven't closed the table properly
status : OK
radius.radreply OK
radius.radusergroup OK[/console]

Насторожило

warning : 4 clients are using or haven't closed the table properl

Потом сделал

Показать
[console][root@domain ~]# mysqlcheck -p -rq mysql
Enter password:
mysql.columns_priv OK
mysql.db OK
mysql.event OK
mysql.func OK
mysql.general_log OK
mysql.help_category OK
mysql.help_keyword OK
mysql.help_relation OK
mysql.help_topic OK
mysql.host OK
mysql.ndb_binlog_index OK
mysql.plugin OK
mysql.proc OK
mysql.procs_priv OK
mysql.servers OK
mysql.slow_log OK
mysql.tables_priv OK
mysql.time_zone OK
mysql.time_zone_leap_second OK
mysql.time_zone_name OK
mysql.time_zone_transition OK
mysql.time_zone_transition_type OK
mysql.user OK[/console]

После этого вывод стал нормальным
[console][root@domain ~]# mysqlcheck -p --databases radius
Enter password:
radius.radacct OK
radius.radcheck OK
radius.radgroupcheck OK
radius.radgroupreply OK
radius.radpostauth OK
radius.radreply OK
radius.radusergroup OK[/console]
Не знаю в этом дело было или нет, при возможности проверю

Войдите или зарегистрируйтесь, чтобы ответить.