[RADIATOR] AuthBy Safeword problem

Hugh Irvine hugh at open.com.au
Wed Jul 9 01:48:16 CDT 2008


Hello Johan -

The person who needs to look at this is away this week, but I should  
be able to get an answer for you next week.

Apologies for the delay.

regards

Hugh


On 6 Jul 2008, at 19:45, Johan Frid wrote:

> I'm ruining version v5.8.8 built for i486-linux.
> //Johan Frid
> TeliaSonera
>
>
> Hugh Irvine wrote:
>>
>> Hello Johan -
>>
>> My tests here show the Timeout parameter does indeed change the  
>> behaviour as expected.
>>
>> Can you tell me what version of Perl you are running?
>>
>> regards
>>
>> Hugh
>>
>>
>> On 3 Jul 2008, at 20:49, Johan Frid wrote:
>>
>>> Yes I'm running Radiator 4.2 and the Timeout parameter is  
>>> accepted in the
>>> configfile, but doesn't seems to do nothing. I have even  
>>> attempted to set a
>>> higher value, but the timeout seams to be about  10s any way.
>>> /Johan Frid
>>> TeliaSonear
>>>
>>> ---------------------------------------
>>> /radiusd -config_file /etc/radiusradiator/safeword.cfg
>>> Thu Jul  3 14:35:28 2008: DEBUG: Finished reading configuration file
>>> '/etc/radiusradiator/safeword.cfg'
>>> This Radiator license will expire on 2008-08-30
>>> This Radiator license will stop operating after 1000 requests
>>> To purchase an unlimited full source version of Radiator, see
>>> http://www.open.com.au/ordering.html
>>> To extend your license period, contact admin at open.com.au
>>>
>>> Thu Jul  3 14:35:28 2008: DEBUG: Reading dictionary file
>>> '/etc/radiusradiator/dictionary/dictionary'
>>> Thu Jul  3 14:35:28 2008: DEBUG: Creating authentication port  
>>> 0.0.0.0:1645
>>> Thu Jul  3 14:35:28 2008: DEBUG: Creating accounting port  
>>> 0.0.0.0:1646
>>> Thu Jul  3 14:35:28 2008: NOTICE: Server started: Radiator 4.2 on  
>>> gentoo
>>> (LOCKED)
>>>
>>> ----------------------------------
>>>
>>>
>>>
>>> On 3:57 am 07/03/08 Hugh Irvine <hugh at open.com.au> wrote:
>>>>
>>>> Hello Johan -
>>>>
>>>> This is odd - are you running Radiator 4.2? And do you mean the
>>>> Timeout parameter is not accepted in your configuration, or just  
>>>> that
>>>> it seems to do nothing?
>>>>
>>>> Have you restarted Radiator to re-read the configuration file?
>>>>
>>>> regards
>>>>
>>>> Hugh
>>>>
>>>>
>>>> On 2 Jul 2008, at 18:19, Johan Frid wrote:
>>>>
>>>>>  Theirs no firewall between and Timeout doesn't work in AuthBy
>>>>>  SAFEWORD.
>>>>>  Have attempted to add Timeout 3 in AuthBy SAFEWORD clause but
>>>>>  nothing changes.
>>>>>
>>>>>  Does there exist any keep live function against the Safeword
>>>>> server?
>>>>>  //Johan Frid
>>>>>  TeliaSonera
>>>>>
>>>>>
>>>>>  On 8:05 am 07/01/08 Hugh Irvine <hugh at open.com.au> wrote:
>>>>>>
>>>>>>  Hello Johan -
>>>>>>
>>>>>>  Is there perhaps a firewall between the Radiator host and the
>>>>>>  Safeword host?
>>>>>>
>>>>>>  It looks to me like the connection to the Safeword host is lost
>>>>>>  and Radiator waits 10 seconds before retrying.
>>>>>>
>>>>>>  You can try altering the Timeout parameter in the AuthBy  
>>>>>> SAFEWORD
>>>>>>  clause to something more aggressive than 10 seconds.
>>>>>>
>>>>>>  regards
>>>>>>
>>>>>>  Hugh
>>>>>>
>>>>>>
>>>>>>  On 30 Jun 2008, at 22:59, Johan Frid wrote:
>>>>>>
>>>>>>>   I'm having problem with AuthBy Safeword. I'm getting ERR:  
>>>>>>> AuthBy
>>>>>>>   SAFEWORD
>>>>>>>   read error, disconnecting. That causing clients to time  
>>>>>>> out. Any
>>>>>>>   idea what
>>>>>>>   the problem could be? cant find anything in Safewods log file
>>>>>>>   that indicates that the problem is in Safeword.
>>>>>>>
>>>>>>>   //Johan Frid
>>>>>>>   TeliaSonera
>>>>>>>
>>>>>>>   ------------------Debug level 4 ------------------
>>>>>>>   Thu Jun 26 14:46:07 2008: DEBUG: Packet dump:
>>>>>>>   *** Received from 192.168.0.199 port 1104 ....
>>>>>>>   Code:       Access-Request
>>>>>>>   Identifier: 25
>>>>>>>   Authentic:        1214477169
>>>>>>>   Attributes:
>>>>>>>           User-Name = "STUDENT2"
>>>>>>>           User-Password = <241>8<246><222>w<213>CB
>>>>>>>   <172><177>SDn<243><168>
>>>>>>>
>>>>>>>   Thu Jun 26 14:46:07 2008: DEBUG: Handling request with Handler
>>>>>>>   'Realm=DEFAULT'
>>>>>>>   Thu Jun 26 14:46:07 2008: DEBUG: Rewrote user name to student2
>>>>>>>   Thu Jun 26 14:46:07 2008: DEBUG:  Deleting session for  
>>>>>>> STUDENT2,
>>>>>>>   192.168.0.199,
>>>>>>>   Thu Jun 26 14:46:07 2008: DEBUG: Handling with
>>>>>>  Radius::AuthSAFEWORD :
>>>>>>>   Thu Jun 26 14:46:07 2008: DEBUG: Radius::AuthSAFEWORD looks  
>>>>>>> for
>>>>>>>   match with
>>>>>>>   student2 [STUDENT2]
>>>>>>>   Thu Jun 26 14:46:07 2008: ERR: AuthBy SAFEWORD read error,
>>>>>>>   disconnecting:
>>>>>>>   Thu Jun 26 14:46:07 2008: DEBUG: AuthBy SAFEWORD connecting to
>>>>>>>   192.168.0.205:5031
>>>>>>>   Thu Jun 26 14:46:17 2008: DEBUG: Radius::AuthSAFEWORD  
>>>>>>> ACCEPT: :
>>>>>>>   student2
>>>>>>>   [STUDENT2]
>>>>>>>   Thu Jun 26 14:46:17 2008: DEBUG: AuthBy SAFEWORD result:  
>>>>>>> ACCEPT,
>>>>>>>   Thu Jun 26 14:46:17 2008: DEBUG: Access accepted for student2
>>>>>>>   Thu Jun 26 14:46:17 2008: DEBUG: Packet dump:
>>>>>>>   *** Sending to 192.168.0.199 port 1104 ....
>>>>>>>   Code:       Access-Accept
>>>>>>>   Identifier: 25
>>>>>>>   Authentic:        1214477169
>>>>>>>   Attributes:
>>>>>>>           Service-Type = Administrative-User
>>>>>>>           cisco-avpair = "shell:priv-lvl=15"
>>>>>>>           Juniper-Local-User-Name = "remote1"
>>>>>>>           RB-TTY-Level-Start = 15
>>>>>>>           RB-TTY-Level-Max = 15
>>>>>>>           Unisphere-Init-CLI-Access-Level = "1"
>>>>>>>           Unisphere-Alt-CLI-Access-Level = "10"
>>>>>>>           Login-Service = 0
>>>>>>>           Huawei-Exec-Privilege = 3
>>>>>>>   ------------------End Debug level 4 -------------------
>>>>>>>
>>>>>>>   config file I'm using
>>>>>>>   ------------------safeword.cfg------------------
>>>>>>>
>>>>>>>   Foreground
>>>>>>>   LogStdout
>>>>>>>   LogDir    /var/log/radius
>>>>>>>   DbDir
>>>>>>>   Trace         4
>>>>>>>   AuthPort    1645
>>>>>>>   AcctPort    1646
>>>>>>>   DictionaryFile /etc/radiusradiator/dictionary/dictionary
>>>>>>>   <Client DEFAULT>
>>>>>>>
>>>>>>>   Secret    mysecret
>>>>>>>
>>>>>>>   DupInterval 0
>>>>>>>   </Client>
>>>>>>>
>>>>>>>   <Realm DEFAULT>
>>>>>>>       # This one translates all uppercase chars to lowercase
>>>>>>>       RewriteUsername    tr/A-Z/a-z/
>>>>>>>
>>>>>>>       <AuthBy SAFEWORD>
>>>>>>>           # The name or address of the host where the SafeWord
>>>>>>>           # PremierAccess server runs
>>>>>>>           # Defaults to localhost.
>>>>>>>           # Set this to the address of the SafeWord  
>>>>>>> PremierAccess
>>>>>>>           server #Host localhost
>>>>>>>           Host 192.168.0.205
>>>>>>>
>>>>>>>           # Port to connet to on Host.
>>>>>>>           # Defaults to 5031, the default SafeWord EASSP2 port
>>>>>>>           Port 5031
>>>>>>>
>>>>>>>           # You can specify which EAP types can be used
>>>>>>>           # One-Time-Password and Generic-Token are supported
>>>>>>>           EAPType One-Time-Password,Generic-Token
>>>>>>>
>>>>>>>           #AgentName
>>>>>>>           AgentName secore
>>>>>>>
>>>>>>>           # You can make different types of reply depending  
>>>>>>> on the
>>>>>>>           group # of the authenticated user, if there are
>>>>>>>           ActionData groups # sent back by SafeWord server
>>>>>>>
>>>>>>>           GroupReply RO,\
>>>>>>>           Service-Type = Administrative-User,\
>>>>>>>           cisco-avpair = "shell:priv-lvl=1",\
>>>>>>>           Juniper-Local-User-Name = "remote2",\
>>>>>>>           RB-TTY-Level-Start = 5,\
>>>>>>>           RB-TTY-Level-Max = 5
>>>>>>>
>>>>>>>           GroupReply RW,\
>>>>>>>           Service-Type = Administrative-User,\
>>>>>>>           cisco-avpair = "shell:priv-lvl=15",\
>>>>>>>           Juniper-Local-User-Name = "remote1",\
>>>>>>>                 RB-TTY-Level-Start = 15,\
>>>>>>>                  RB-TTY-Level-Max = 15
>>>>>>>       </AuthBy>
>>>>>>>
>>>>>>>   </Realm>
>>>>>>>
>>>>>>>   ------------------End safeword.cfg------------------
>>>>>>>
>>>>>>>   _______________________________________________
>>>>>>>   radiator mailing list
>>>>>>>   radiator at open.com.au
>>>>>>>   http://www.open.com.au/mailman/listinfo/radiator
>>>>>>
>>>>>>
>>>>>>
>>>>>>  NB:
>>>>>>
>>>>>>  Have you read the reference manual ("doc/ref.html")?
>>>>>>  Have you searched the mailing list archive (www.open.com.au/ 
>>>>>> archiv
>>>> es/
>>>>>>  radiator)?
>>>>>>  Have you had a quick look on Google (www.google.com)?
>>>>>>  Have you included a copy of your configuration file (no  
>>>>>> secrets),
>>>>>>  together with a trace 4 debug showing what is happening?
>>>>>>  Have you checked the RadiusExpert wiki:
>>>>>>  http://www.open.com.au/wiki/index.php/Main_Page
>>>>>>
>>>>>>  --
>>>>>>  Radiator: the most portable, flexible and configurable RADIUS
>>>>>>  server anywhere. Available on *NIX, *BSD, Windows, MacOS X.
>>>>>>  Includes support for reliable RADIUS transport (RadSec),
>>>>>>  and DIAMETER translation agent.
>>>>>>  -
>>>>>>  Nets: internetwork inventory and management - graphical,
>>>>>>  extensible, flexible with hardware, software, platform and
>>>>>>  database independence. -
>>>>>>  CATool: Private Certificate Authority for Unix and Unix-like
>>>> systems.
>>>>
>>>>
>>>>
>>>> NB:
>>>>
>>>> Have you read the reference manual ("doc/ref.html")?
>>>> Have you searched the mailing list archive (www.open.com.au/ 
>>>> archives/
>>>> radiator)?
>>>> Have you had a quick look on Google (www.google.com)?
>>>> Have you included a copy of your configuration file (no secrets),
>>>> together with a trace 4 debug showing what is happening?
>>>> Have you checked the RadiusExpert wiki:
>>>> http://www.open.com.au/wiki/index.php/Main_Page
>>>>
>>>> -- 
>>>> Radiator: the most portable, flexible and configurable RADIUS  
>>>> server
>>>> anywhere. Available on *NIX, *BSD, Windows, MacOS X.
>>>> Includes support for reliable RADIUS transport (RadSec),
>>>> and DIAMETER translation agent.
>>>> -
>>>> Nets: internetwork inventory and management - graphical,  
>>>> extensible,
>>>> flexible with hardware, software, platform and database  
>>>> independence.
>>>> -
>>>> CATool: Private Certificate Authority for Unix and Unix-like  
>>>> systems.
>>
>>
>>
>> NB:
>>
>> Have you read the reference manual ("doc/ref.html")?
>> Have you searched the mailing list archive (www.open.com.au/ 
>> archives/radiator)?
>> Have you had a quick look on Google (www.google.com)?
>> Have you included a copy of your configuration file (no secrets),
>> together with a trace 4 debug showing what is happening?
>> Have you checked the RadiusExpert wiki:
>> http://www.open.com.au/wiki/index.php/Main_Page
>>
>
>
> -- 
> Mounting is used for three things: climbing on a horse, linking in  
> a hard disk unit in data systems, and, well, mounting during sex.
> -- Christa Keil



NB:

Have you read the reference manual ("doc/ref.html")?
Have you searched the mailing list archive (www.open.com.au/archives/ 
radiator)?
Have you had a quick look on Google (www.google.com)?
Have you included a copy of your configuration file (no secrets),
together with a trace 4 debug showing what is happening?
Have you checked the RadiusExpert wiki:
http://www.open.com.au/wiki/index.php/Main_Page

-- 
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. Available on *NIX, *BSD, Windows, MacOS X.
Includes support for reliable RADIUS transport (RadSec),
and DIAMETER translation agent.
-
Nets: internetwork inventory and management - graphical, extensible,
flexible with hardware, software, platform and database independence.
-
CATool: Private Certificate Authority for Unix and Unix-like systems.




More information about the radiator mailing list