Народ спасайте, а то голова совсем скоро отпадет.
Значит так есть FreeBSD5.1 + poptop-1.1.4.b3 + freeradius-0.8.1
Надо привязать аутенификацию VPN-клиентов через РАДИУС.
Итак, вот что имеется:
POPTOP
******************************************************
* /etc/ppp/ppp.conf *
************************
loop:
set timeout 0
set log phase chat connect lcp ipcp command
set device localhost:pptp
set dial
set login
set server /tmp/loop "" 0177
loop-in:
set timeout 0
set log phase lcp ipcp command
allow mode direct
pptp:
load loop
enable MSCHAPv2
disable chap
disable deflate pred1
deny deflate pred1
disable pap
disable ipv6cp
accept dns
set radius /etc/ppp/radius.conf
set dns xxx.xxx.xxx.xxx
set device !/etc/ppp/secure
******************************************************
* /etc/ppp/radius.conf *
************************
auth 127.0.0.1:1645 testing123
acct 127.0.0.1:1646 testing123
******************************************************
* /etc/ppp/secure *
************************
#!/bin/sh
exec /usr/sbin/ppp -direct loop-in
RADIUS
******************************************************
* /usr/local/etc/raddb/attrs *
**********************************
DEFAULT
Service-Type == Framed-User,
Service-Type == Login-User,
Login-Service == Telnet,
Login-Service == Rlogin,
Login-Service == TCP-Clear,
Login-TCP-Port <= 65536,
Framed-IP-Address == 255.255.255.254,
Framed-IP-Netmask == 255.255.255.255,
Framed-Protocol == PPP,
Framed-Protocol == SLIP,
Framed-Compression == Van-Jacobson-TCP-IP,
Framed-MTU >= 576,
Framed-Filter-ID =* ANY,
Reply-Message =* ANY,
Proxy-State =* ANY,
Session-Timeout <= 28800,
Idle-Timeout <= 600,
Port-Limit <= 2
******************************************************
* /usr/local/etc/raddb/clients *
**********************************
localhost testing123
yyy.yyy.yyy.yyy secretword
******************************************************
* /usr/local/etc/raddb/clients.conf *
***************************************
client 127.0.0.1 {
secret = testing123
shortname = localhost
nastype = other # localhost isn't usually a NAS...
}
client yyy.yyy.yyy.yyy {
secret = secretword
shortname = xep1
vendor = XXX
}
******************************************************
* /usr/local/etc/raddb/dictionary *
***************************************
....
ATTRIBUTE User-Name 1 string
ATTRIBUTE User-Password 2 string encrypt=1
ATTRIBUTE Password 2 string
ATTRIBUTE CHAP-Password 3 string
....
******************************************************
* /usr/local/etc/raddb/hints *
***************************************
DEFAULT Prefix = "U", Strip-User-Name = No
Hint = "UUCP"
DEFAULT Prefix = "P", Strip-User-Name = Yes
Hint = "PPP",
Service-Type = Framed-User,
Framed-Protocol = PPP
DEFAULT Prefix = "S", Strip-User-Name = Yes
Hint = "SLIP",
Service-Type = Framed-User,
Framed-Protocol = SLIP
DEFAULT Prefix = "C", Strip-User-Name = Yes
Hint = "CSLIP",
Service-Type = Framed-User,
Framed-Protocol = SLIP,
Framed-Compression = Van-Jacobson-TCP-IP
########################################################
DEFAULT Suffix = ".ppp", Strip-User-Name = Yes
Hint = "PPP",
Service-Type = Framed-User,
Framed-Protocol = PPP
DEFAULT Suffix = ".slip", Strip-User-Name = Yes
Hint = "SLIP",
Service-Type = Framed-User,
Framed-Protocol = SLIP
DEFAULT Suffix = ".cslip", Strip-User-Name = Yes
Hint = "CSLIP",
Service-Type = Framed-User,
Framed-Protocol = SLIP,
Framed-Compression = Van-Jacobson-TCP-IP
******************************************************
* /usr/local/etc/raddb/naslist *
***************************************
localhost local other
XXX XXX other
******************************************************
* /usr/local/etc/raddb/sql.conf *
***************************************
sql {
rlm_sql_iodbc, rlm_sql_oracle
driver = "rlm_sql_mysql"
server = "localhost"
login = "----"
password = "+++++"
radius_db = "radius"
acct_table1 = "radacct"
acct_table2 = "radacct"
authcheck_table = "radcheck"
authreply_table = "radreply"
groupcheck_table = "radgroupcheck"
groupreply_table = "radgroupreply"
usergroup_table = "usergroup"
deletestalesessions = yes
sqltrace = yes
sqltracefile = ${logdir}/sqltrace.sql
num_sql_socks = 5
sql_user_name = "%{User-Name}"
authorize_check_query = "SELECT id,UserName,Attribute,Value FROM ${authcheck_table} WHERE Username = '%{SQL-User-Name}' ORDER BY id"
authorize_reply_query = "SELECT id,UserName,Attribute,Value FROM ${authreply_table} WHERE Username = '%{SQL-User-Name}' ORDER BY id"
authorize_group_check_query = "SELECT ${groupcheck_table}.id,${groupcheck_table}.GroupName,${groupcheck_t
able}.Attribute,${groupcheck_table}.Value FROM ${groupcheck_table},${usergroup_table} WHERE ${usergroup_table}.Us
ername = '%{SQL-User-Name}' AND ${usergroup_table}.GroupName = ${groupcheck_table}.GroupName ORDER BY ${groupchec
k_table}.id"
authorize_group_reply_query = "SELECT ${groupreply_table}.id,${groupreply_table}.GroupName,${groupreply_t
able}.Attribute,${groupreply_table}.Value FROM ${groupreply_table},${usergroup_table} WHERE ${usergroup_table}.Us
ername = '%{SQL-User-Name}' AND ${usergroup_table}.GroupName = ${groupreply_table}.GroupName ORDER BY ${grouprepl
y_table}.id"
authenticate_query = "SELECT Value,Attribute FROM {authcheck_table} WHERE UserName = '%{User-Name}' AND
( Attribute = 'Password' OR Attribute = 'Crypt-Password' OR Attribute = 'User-Password') ORDER BY Attribute DESC"
******************************************************
* /usr/local/etc/raddb/users *
***************************************
DEFAULT Auth-Type := System
Fall-Through = 1
DEFAULT Service-Type == Framed-User
Framed-IP-Address = 255.255.255.254,
Framed-MTU = 576,
Service-Type = Framed-User,
Fall-Through = Yes
DEFAULT Framed-Protocol == PPP
Framed-Protocol = PPP,
Framed-Compression = Van-Jacobson-TCP-IP
DEFAULT Hint == "CSLIP"
Framed-Protocol = SLIP,
Framed-Compression = Van-Jacobson-TCP-IP
DEFAULT Hint == "SLIP"
Framed-Protocol = SLIP
Так вот с такими настройками "клиент" (Win2000) отваливается говорит, что мол нету такого пользователя в этом домене.
Вот какую ошибку дает RADIUS: Login incorrect: [b00zezik/<no User-Password attribute>] (from client local port 0) (лог см. ниже)
Вот чаго говорит ppp (ppp.log) (обратите внимание на Error: rad_get_vendor_attr: (failing!))
Sep 3 16:51:06 gw ppp[64133]: Phase: Using interface: tun0
Sep 3 16:51:06 gw ppp[64133]: Phase: deflink: Created in closed state
Sep 3 16:51:06 gw ppp[64133]: Command: loop: set device localhost:pptp
Sep 3 16:51:06 gw ppp[64133]: Command: loop: set dial
Sep 3 16:51:06 gw ppp[64133]: Command: loop: set login
Sep 3 16:51:06 gw ppp[64133]: Command: loop: set server /tmp/loop ******** 0177
Sep 3 16:51:06 gw ppp[64133]: Phase: Listening at local socket /tmp/loop.
Sep 3 16:51:06 gw ppp[64133]: Command: pptp: enable MSCHAPv2
Sep 3 16:51:06 gw ppp[64133]: Command: pptp: disable chap
Sep 3 16:51:06 gw ppp[64133]: Command: pptp: disable deflate pred1
Sep 3 16:51:06 gw ppp[64133]: Command: pptp: deny deflate pred1
Sep 3 16:51:06 gw ppp[64133]: Command: pptp: enable pap
Sep 3 16:51:06 gw ppp[64133]: Command: pptp: disable ipv6cp
Sep 3 16:51:06 gw ppp[64133]: Command: pptp: accept dns
Sep 3 16:51:06 gw ppp[64133]: Command: pptp: set radius /etc/ppp/radius.conf
Sep 3 16:51:06 gw ppp[64133]: Command: pptp: set dns 195.162.39.65
Sep 3 16:51:06 gw ppp[64133]: Command: pptp: set device !/etc/ppp/secure
Sep 3 16:51:06 gw ppp[64133]: Phase: PPP Started (direct mode).
Sep 3 16:51:06 gw ppp[64133]: Phase: bundle: Establish
Sep 3 16:51:06 gw ppp[64133]: Phase: deflink: closed -> opening
Sep 3 16:51:06 gw ppp[64133]: Phase: deflink: Connected!
Sep 3 16:51:06 gw ppp[64133]: Phase: deflink: opening -> carrier
Sep 3 16:51:06 gw ppp[64133]: Phase: deflink: carrier -> lcp
Sep 3 16:51:06 gw ppp[64133]: LCP: FSM: Using "deflink" as a transport
Sep 3 16:51:06 gw ppp[64133]: LCP: deflink: State change Initial --> Closed
Sep 3 16:51:06 gw ppp[64133]: LCP: deflink: State change Closed --> Stopped
Sep 3 16:51:07 gw ppp[64133]: LCP: deflink: LayerStart
Sep 3 16:51:07 gw ppp[64133]: LCP: deflink: SendConfigReq(1) state = Stopped
Sep 3 16:51:07 gw ppp[64133]: LCP: ACFCOMP[2]
Sep 3 16:51:07 gw ppp[64133]: LCP: PROTOCOMP[2]
Sep 3 16:51:07 gw ppp[64133]: LCP: ACCMAP[6] 0x00000000
Sep 3 16:51:07 gw ppp[64133]: LCP: MRU[4] 1500
Sep 3 16:51:07 gw ppp[64133]: LCP: MAGICNUM[6] 0xdeb1a899
Sep 3 16:51:07 gw ppp[64133]: LCP: AUTHPROTO[5] 0xc223 (CHAP 0x81)
Sep 3 16:51:07 gw ppp[64133]: LCP: deflink: State change Stopped --> Req-Sent
Sep 3 16:51:07 gw ppp[64133]: LCP: deflink: RecvConfigAck(1) state = Req-Sent
Sep 3 16:51:07 gw ppp[64133]: LCP: ACFCOMP[2]
Sep 3 16:51:07 gw ppp[64133]: LCP: PROTOCOMP[2]
Sep 3 16:51:07 gw ppp[64133]: LCP: ACCMAP[6] 0x00000000
Sep 3 16:51:07 gw ppp[64133]: LCP: MRU[4] 1500
Sep 3 16:51:07 gw ppp[64133]: LCP: MAGICNUM[6] 0xdeb1a899
Sep 3 16:51:07 gw ppp[64133]: LCP: AUTHPROTO[5] 0xc223 (CHAP 0x81)
Sep 3 16:51:07 gw ppp[64133]: LCP: deflink: State change Req-Sent --> Ack-Rcvd
Sep 3 16:51:07 gw ppp[64133]: LCP: deflink: RecvConfigReq(1) state = Ack-Rcvd
Sep 3 16:51:07 gw ppp[64133]: LCP: MAGICNUM[6] 0x6e2b04c5
Sep 3 16:51:07 gw ppp[64133]: LCP: PROTOCOMP[2]
Sep 3 16:51:07 gw ppp[64133]: LCP: ACFCOMP[2]
Sep 3 16:51:07 gw ppp[64133]: LCP: CALLBACK[3] CBCP
Sep 3 16:51:07 gw ppp[64133]: LCP: MRRU[4] 1614
Sep 3 16:51:07 gw ppp[64133]: LCP: ENDDISC[23] Local Addr: "?[|?iOM-^VM-^W/t_r^PM-^P]
Sep 3 16:51:07 gw ppp[64133]: LCP: deflink: SendConfigRej(1) state = Ack-Rcvd
Sep 3 16:51:07 gw ppp[64133]: LCP: CALLBACK[3] CBCP
Sep 3 16:51:07 gw ppp[64133]: LCP: MRRU[4] 1614
Sep 3 16:51:07 gw ppp[64133]: LCP: deflink: RecvConfigReq(2) state = Ack-Rcvd
Sep 3 16:51:07 gw ppp[64133]: LCP: MAGICNUM[6] 0x6e2b04c5
Sep 3 16:51:07 gw ppp[64133]: LCP: PROTOCOMP[2]
Sep 3 16:51:07 gw ppp[64133]: LCP: ACFCOMP[2]
Sep 3 16:51:07 gw ppp[64133]: LCP: ENDDISC[23] Local Addr: "?[|?iOM-^VM-^W/t_r^PM-^P]
Sep 3 16:51:07 gw ppp[64133]: LCP: deflink: SendConfigAck(2) state = Ack-Rcvd
Sep 3 16:51:07 gw ppp[64133]: LCP: MAGICNUM[6] 0x6e2b04c5
Sep 3 16:51:07 gw ppp[64133]: LCP: PROTOCOMP[2]
Sep 3 16:51:07 gw ppp[64133]: LCP: ACFCOMP[2]
Sep 3 16:51:07 gw ppp[64133]: LCP: ENDDISC[23] Local Addr: "?[|?iOM-^VM-^W/t_r^PM-^P]
Sep 3 16:51:07 gw ppp[64133]: LCP: deflink: State change Ack-Rcvd --> Opened
Sep 3 16:51:07 gw ppp[64133]: LCP: deflink: LayerUp
Sep 3 16:51:07 gw ppp[64133]: Phase: bundle: Authenticate
Sep 3 16:51:07 gw ppp[64133]: Phase: deflink: his = none, mine = CHAP 0x81
Sep 3 16:51:07 gw ppp[64133]: Phase: Chap Output: CHALLENGE
Sep 3 16:51:07 gw ppp[64133]: LCP: deflink: RecvIdent(3) state = Opened
Sep 3 16:51:07 gw ppp[64133]: LCP: MAGICNUM 6e2b04c5
Sep 3 16:51:07 gw ppp[64133]: LCP: TEXT MSRASV5.00
Sep 3 16:51:07 gw ppp[64133]: LCP: deflink: RecvIdent(4) state = Opened
Sep 3 16:51:07 gw ppp[64133]: LCP: MAGICNUM 6e2b04c5
Sep 3 16:51:07 gw ppp[64133]: LCP: TEXT MSRAS-1-ZPC
Sep 3 16:51:07 gw ppp[64133]: Phase: Chap Input: RESPONSE (49 bytes from b00zezik)
Sep 3 16:51:07 gw ppp[64133]: Phase: Radius: Request sent
Sep 3 16:51:09 gw ppp[64133]: Phase: Radius(auth): REJECT received
Sep 3 16:51:09 gw ppp[64133]: Error: rad_get_vendor_attr: (failing!)
Sep 3 16:51:09 gw ppp[64133]: Phase: Chap Output: FAILURE
Sep 3 16:51:09 gw ppp[64133]: LCP: deflink: LayerDown
Sep 3 16:51:09 gw ppp[64133]: LCP: deflink: SendTerminateReq(2) state = Opened
Sep 3 16:51:09 gw ppp[64133]: LCP: deflink: State change Opened --> Closing
Sep 3 16:51:09 gw ppp[64133]: LCP: deflink: RecvTerminateAck(2) state = Closing
Sep 3 16:51:09 gw ppp[64133]: LCP: deflink: LayerFinish
Sep 3 16:51:09 gw ppp[64133]: LCP: deflink: State change Closing --> Closed
Sep 3 16:51:09 gw ppp[64133]: LCP: deflink: State change Closed --> Initial
Sep 3 16:51:09 gw ppp[64133]: Phase: deflink: Disconnected!
Sep 3 16:51:09 gw ppp[64133]: Phase: deflink: Connect time: 3 secs: 363 octets in, 278 octets out
Sep 3 16:51:09 gw ppp[64133]: Phase: deflink: 6 packets in, 6 packets out
Sep 3 16:51:09 gw ppp[64133]: Phase: total 213 bytes/sec, peak 177 bytes/sec on Wed Sep 3 16:51:08 2003
Sep 3 16:51:09 gw ppp[64133]: Phase: deflink: lcp -> closed
Sep 3 16:51:09 gw ppp[64133]: Phase: bundle: Dead
Sep 3 16:51:09 gw ppp[64133]: Phase: PPP Terminated (normal).
А это мне говорит РАДИУС:
Starting - reading configuration files ...
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded PAP
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded MS-CHAP
Module: Instantiated mschap (mschap)
Module: Loaded SQL
rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked
rlm_sql (sql): Attempting to connect to root@localhost:/radius
rlm_sql (sql): starting 0
rlm_sql (sql): Attempting to connect rlm_sql_mysql #0
rlm_sql_mysql: Starting connect to MySQL server for #0
rlm_sql (sql): Connected new DB handle, #0
rlm_sql (sql): starting 1
rlm_sql (sql): Attempting to connect rlm_sql_mysql #1
rlm_sql_mysql: Starting connect to MySQL server for #1
rlm_sql (sql): Connected new DB handle, #1
rlm_sql (sql): starting 2
rlm_sql (sql): Attempting to connect rlm_sql_mysql #2
rlm_sql_mysql: Starting connect to MySQL server for #2
rlm_sql (sql): Connected new DB handle, #2
rlm_sql (sql): starting 3
rlm_sql (sql): Attempting to connect rlm_sql_mysql #3
rlm_sql_mysql: Starting connect to MySQL server for #3
rlm_sql (sql): Connected new DB handle, #3
rlm_sql (sql): starting 4
rlm_sql (sql): Attempting to connect rlm_sql_mysql #4
rlm_sql_mysql: Starting connect to MySQL server for #4
rlm_sql (sql): Connected new DB handle, #4
Module: Instantiated sql (sql)
Module: Loaded preprocess
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
Module: Instantiated realm (suffix)
Module: Loaded files
Module: Instantiated files (files)
Module: Loaded detail
Module: Instantiated detail (detail)
Module: Loaded radutmp
Module: Instantiated radutmp (radutmp)
Initializing the thread pool...
Listening on IP address *, ports 1645/udp and 1646/udp, with proxy on 1647/udp.
Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1:53047, id=12, length=140
User-Name = "b00zezik"
Service-Type = Framed-User
Framed-Protocol = PPP
MS-CHAP-Challenge = 0x34343839393436353037343736323335
MS-CHAP2-Response = 0x0100569e35cc18532b6696be34531980ef7f00000000000000007c3dc0058b5d3e0a09134d8ab323a6e514c2fe89359089fa
NAS-Identifier = "xep.xep.ru"
NAS-Port-Type = Virtual
rlm_sql (sql): Reserving sql socket id: 4
rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value FROM radcheck WHERE Username = 'b00zezik' ORDER BY id
rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value FROM radgroupcheck,usergroup WHERE usergroup.Username = 'b00zezik' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id
rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value FROM radreply WHERE Username = 'b00zezik' ORDER BY id
rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value FROM radgroupreply,usergroup WHERE usergroup.Username = 'b00zezik' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id
rlm_sql: The 'op' field for attribute 'Auth-Type = Local' is NULL, or non-existent.
rlm_sql: You MUST FIX THIS if you want the configuration to behave as you expect.
rlm_sql: The 'op' field for attribute 'Framed-Compression = Van-Jacobson-TCP-IP' is NULL, or non-existent.
rlm_sql: You MUST FIX THIS if you want the configuration to behave as you expect.
rlm_sql: The 'op' field for attribute 'Service-Type = Framed-User' is NULL, or non-existent.
rlm_sql: You MUST FIX THIS if you want the configuration to behave as you expect.
rlm_sql: The 'op' field for attribute 'Framed-Filter-Id = std.ppp' is NULL, or non-existent.
rlm_sql: You MUST FIX THIS if you want the configuration to behave as you expect.
rlm_sql: The 'op' field for attribute 'Framed-MTU = 1500' is NULL, or non-existent.
rlm_sql: You MUST FIX THIS if you want the configuration to behave as you expect.
rlm_sql: The 'op' field for attribute 'Framed-Routing = Broadcast-Listen' is NULL, or non-existent.
rlm_sql: You MUST FIX THIS if you want the configuration to behave as you expect.
rlm_sql: The 'op' field for attribute 'Framed-IP-Address = 192.168.10.1' is NULL, or non-existent.
rlm_sql: You MUST FIX THIS if you want the configuration to behave as you expect.
rlm_sql: The 'op' field for attribute 'MS-Primary-DNS-Server = xxx.xxx.xxx.xxx' is NULL, or non-existent.
rlm_sql: You MUST FIX THIS if you want the configuration to behave as you expect.
rlm_sql: The 'op' field for attribute 'USR-Primary_DNS_Server = xxx.xxx.xxx.xxx' is NULL, or non-existent.
rlm_sql: You MUST FIX THIS if you want the configuration to behave as you expect.
rlm_sql (sql): Released sql socket id: 4
Login incorrect: [b00zezik/<no User-Password attribute>] (from client local port 0)
Sending Access-Reject of id 12 to 127.0.0.1:53047
MS-Primary-DNS-Server == xxx.xxx.xxx.xxx
USR-Primary_DNS_Server == xxx.xxx.xxx.xxx
Вариант для распечатки
OpenNET: Виртуальная конференция (Public)
on
03-Сен-03, 14:52 (MSK)
