Freeradius - 未找到验证方法

Question

通过smbpasswd进行授权时，身份验证失败：

ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user

我使用的命令是：

radtest testusr test 127.0.0.1:18120 0 testing123

有人知道为什么吗？据我所知，pap应该能够解决这个问题。见下面的-X

  root@hinserv:/etc/freeradius/certs# freeradius -X
  freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Jul 26 2017 at 15:27:21
  Copyright (C) 1999-2015 The FreeRADIUS server project and contributors.
  There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
  PARTICULAR PURPOSE.
  You may redistribute copies of FreeRADIUS under the terms of the
  GNU General Public License.
  For more information about these matters, see the file named COPYRIGHT.
  Starting - reading configuration files ...
  including configuration file /etc/freeradius/radiusd.conf
  including configuration file /etc/freeradius/proxy.conf
  including configuration file /etc/freeradius/clients.conf
  including files in directory /etc/freeradius/modules/
  including configuration file /etc/freeradius/modules/redis
  including configuration file /etc/freeradius/modules/ldap
  including configuration file /etc/freeradius/modules/detail.example.com
  including configuration file /etc/freeradius/modules/counter
  including configuration file /etc/freeradius/modules/rediswho
  including configuration file /etc/freeradius/modules/checkval
  including configuration file /etc/freeradius/modules/acct_unique
  including configuration file /etc/freeradius/modules/otp
  including configuration file /etc/freeradius/modules/cui
  including configuration file /etc/freeradius/modules/inner-eap
  including configuration file /etc/freeradius/modules/detail.log
  including configuration file /etc/freeradius/modules/opendirectory
  including configuration file /etc/freeradius/modules/preprocess
  including configuration file /etc/freeradius/modules/realm
  including configuration file /etc/freeradius/modules/policy
  including configuration file /etc/freeradius/modules/mac2ip
  including configuration file /etc/freeradius/modules/etc_group
  including configuration file /etc/freeradius/modules/krb5
  including configuration file /etc/freeradius/modules/dynamic_clients
  including configuration file /etc/freeradius/modules/ntlm_auth
  including configuration file /etc/freeradius/modules/attr_rewrite
  including configuration file /etc/freeradius/modules/radrelay
  including configuration file /etc/freeradius/modules/passwd
  including configuration file /etc/freeradius/modules/perl
  including configuration file /etc/freeradius/modules/replicate
  including configuration file /etc/freeradius/modules/smbpasswd
  including configuration file /etc/freeradius/modules/dhcp_sqlippool
  including configuration file /etc/freeradius/modules/files
  including configuration file /etc/freeradius/modules/echo
  including configuration file /etc/freeradius/modules/exec
  including configuration file /etc/freeradius/modules/unix
  including configuration file /etc/freeradius/modules/pam
  including configuration file /etc/freeradius/modules/chap
  including configuration file /etc/freeradius/modules/ippool
  including configuration file /etc/freeradius/modules/radutmp
  including configuration file /etc/freeradius/modules/smsotp
  including configuration file /etc/freeradius/modules/expr
  including configuration file /etc/freeradius/modules/detail
  including configuration file /etc/freeradius/modules/wimax
  including configuration file /etc/freeradius/modules/soh
  including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login
  including configuration file /etc/freeradius/modules/mac2vlan
  including configuration file /etc/freeradius/modules/logintime
  including configuration file /etc/freeradius/modules/attr_filter
  including configuration file /etc/freeradius/modules/sradutmp
  including configuration file /etc/freeradius/modules/pap
  including configuration file /etc/freeradius/modules/sql_log
  including configuration file /etc/freeradius/modules/expiration
  including configuration file /etc/freeradius/modules/mschap
  including configuration file /etc/freeradius/modules/linelog
  including configuration file /etc/freeradius/modules/digest
  including configuration file /etc/freeradius/modules/always
  including configuration file /etc/freeradius/modules/cache
  including configuration file /etc/freeradius/eap.conf
  including configuration file /etc/freeradius/policy.conf
  including files in directory /etc/freeradius/sites-enabled/
  including configuration file /etc/freeradius/sites-enabled/inner-tunnel
  including configuration file /etc/freeradius/sites-enabled/default
  main {
    user = "freerad"
    group = "freerad"
    allow_core_dumps = no
  }
  including dictionary file /etc/freeradius/dictionary
  main {
    name = "freeradius"
    prefix = "/usr"
    localstatedir = "/var"
    sbindir = "/usr/sbin"
    logdir = "/var/log/freeradius"
    run_dir = "/var/run/freeradius"
    libdir = "/usr/lib/freeradius"
    radacctdir = "/var/log/freeradius/radacct"
    hostname_lookups = no
    max_request_time = 30
    cleanup_delay = 5
    max_requests = 1024
    pidfile = "/var/run/freeradius/freeradius.pid"
    checkrad = "/usr/sbin/checkrad"
    debug_level = 0
    proxy_requests = yes
   log {
    stripped_names = no
    auth = no
    auth_badpass = no
    auth_goodpass = no
   }
   security {
    max_attributes = 200
    reject_delay = 1
    status_server = yes
    allow_vulnerable_openssl = no
   }
  }
  radiusd: #### Loading Realms and Home Servers ####
   proxy server {
    retry_delay = 5
    retry_count = 3
    default_fallback = no
    dead_time = 120
    wake_all_if_all_dead = no
   }
   home_server localhost {
    ipaddr = 127.0.0.1
    port = 1812
    type = "auth"
    secret = "testing123"
    response_window = 20
    max_outstanding = 65536
    require_message_authenticator = yes
    zombie_period = 40
    status_check = "status-server"
    ping_interval = 30
    check_interval = 30
    num_answers_to_alive = 3
    num_pings_to_alive = 3
    revive_interval = 120
    status_check_timeout = 4
    coa {
      irt = 2
      mrt = 16
      mrc = 5
      mrd = 30
    }
   }
   home_server_pool my_auth_failover {
    type = fail-over
    home_server = localhost
   }
   realm example.com {
    auth_pool = my_auth_failover
   }
   realm LOCAL {
   }
  radiusd: #### Loading Clients ####
   client localhost {
    ipaddr = 127.0.0.1
    require_message_authenticator = no
    secret = "testing123"
    nastype = "other"
   }
  radiusd: #### Instantiating modules ####
   instantiate {
   Module: Linked to module rlm_exec
   Module: Instantiating module "exec" from file /etc/freeradius/modules/exec
    exec {
      wait = no
      input_pairs = "request"
      shell_escape = yes
      timeout = 10
    }
   Module: Linked to module rlm_expr
   Module: Instantiating module "expr" from file /etc/freeradius/modules/expr
   Module: Linked to module rlm_expiration
   Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration
    expiration {
      reply-message = "Password Has Expired  "
    }
   Module: Linked to module rlm_logintime
   Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime
    logintime {
      reply-message = "You are calling outside your allowed timespan  "
      minimum-timeout = 60
    }
   }
  radiusd: #### Loading Virtual Servers ####
  server { # from file /etc/freeradius/radiusd.conf
   modules {
    Module: Creating Auth-Type = digest
   Module: Checking authenticate {...} for more modules to load
   Module: Linked to module rlm_pap
   Module: Instantiating module "pap" from file /etc/freeradius/modules/pap
    pap {
      encryption_scheme = "auto"
      auto_header = yes
    }
   Module: Linked to module rlm_chap
   Module: Instantiating module "chap" from file /etc/freeradius/modules/chap
   Module: Linked to module rlm_mschap
   Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap
    mschap {
      use_mppe = yes
      require_encryption = no
      require_strong = no
      with_ntdomain_hack = no
      allow_retry = yes
    }
   Module: Linked to module rlm_digest
   Module: Instantiating module "digest" from file /etc/freeradius/modules/digest
   Module: Linked to module rlm_pam
   Module: Instantiating module "pam" from file /etc/freeradius/modules/pam
    pam {
      pam_auth = "radiusd"
    }
   Module: Linked to module rlm_unix
   Module: Instantiating module "unix" from file /etc/freeradius/modules/unix
    unix {
      radwtmp = "/var/log/freeradius/radwtmp"
    }
   Module: Linked to module rlm_eap
   Module: Instantiating module "eap" from file /etc/freeradius/eap.conf
    eap {
      default_eap_type = "md5"
      timer_expire = 60
      ignore_unknown_eap_types = no
      cisco_accounting_username_bug = no
      max_sessions = 1024
    }
   Module: Linked to sub-module rlm_eap_md5
   Module: Instantiating eap-md5
   Module: Linked to sub-module rlm_eap_leap
   Module: Instantiating eap-leap
   Module: Linked to sub-module rlm_eap_gtc
   Module: Instantiating eap-gtc
     gtc {
      challenge = "Password: "
      auth_type = "PAP"
     }
   Module: Linked to sub-module rlm_eap_tls
   Module: Instantiating eap-tls
     tls {
      rsa_key_exchange = no
      dh_key_exchange = yes
      rsa_key_length = 512
      dh_key_length = 512
      verify_depth = 0
      CA_path = "/etc/freeradius/certs"
      pem_file_type = yes
      private_key_file = "/etc/freeradius/certs/server.key"
      certificate_file = "/etc/freeradius/certs/server.pem"
      CA_file = "/etc/freeradius/certs/ca.pem"
      private_key_password = "whatever"
      dh_file = "/etc/freeradius/certs/dh"
      random_file = "/dev/urandom"
      fragment_size = 1024
      include_length = yes
      check_crl = no
      check_all_crl = no
      cipher_list = "DEFAULT"
      make_cert_command = "/etc/freeradius/certs/bootstrap"
      ecdh_curve = "prime256v1"
      cache {
        enable = no
        lifetime = 24
        max_entries = 255
      }
      verify {
      }
      ocsp {
        enable = no
        override_cert_url = yes
        url = "http://127.0.0.1/ocsp/"
        use_nonce = yes
        timeout = 0
        softfail = no
      }
     }
   Module: Linked to sub-module rlm_eap_ttls
   Module: Instantiating eap-ttls
     ttls {
      default_eap_type = "md5"
      copy_request_to_tunnel = no
      use_tunneled_reply = no
      virtual_server = "inner-tunnel"
      include_length = yes
     }
   Module: Linked to sub-module rlm_eap_peap
   Module: Instantiating eap-peap
     peap {
      default_eap_type = "mschapv2"
      copy_request_to_tunnel = no
      use_tunneled_reply = no
      proxy_tunneled_request_as_eap = yes
      virtual_server = "inner-tunnel"
      soh = no
     }
   Module: Linked to sub-module rlm_eap_mschapv2
   Module: Instantiating eap-mschapv2
     mschapv2 {
      with_ntdomain_hack = no
      send_error = no
     }
   Module: Checking authorize {...} for more modules to load
   Module: Linked to module rlm_preprocess
   Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess
    preprocess {
      huntgroups = "/etc/freeradius/huntgroups"
      hints = "/etc/freeradius/hints"
      with_ascend_hack = no
      ascend_channels_per_line = 23
      with_ntdomain_hack = no
      with_specialix_jetstream_hack = no
      with_cisco_vsa_hack = no
      with_alvarion_vsa_hack = no
    }
  reading pairlist file /etc/freeradius/huntgroups
  reading pairlist file /etc/freeradius/hints
   Module: Linked to module rlm_realm
   Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm
    realm suffix {
      format = "suffix"
      delimiter = "@"
      ignore_default = no
      ignore_null = no
    }
   Module: Linked to module rlm_files
   Module: Instantiating module "files" from file /etc/freeradius/modules/files
    files {
      usersfile = "/etc/freeradius/users"
      acctusersfile = "/etc/freeradius/acct_users"
      preproxy_usersfile = "/etc/freeradius/preproxy_users"
      compat = "no"
    }
  reading pairlist file /etc/freeradius/users
  reading pairlist file /etc/freeradius/acct_users
  reading pairlist file /etc/freeradius/preproxy_users
   Module: Checking preacct {...} for more modules to load
   Module: Linked to module rlm_acct_unique
   Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique
    acct_unique {
      key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port"
    }
   Module: Checking accounting {...} for more modules to load
   Module: Linked to module rlm_detail
   Module: Instantiating module "detail" from file /etc/freeradius/modules/detail
    detail {
      detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
      header = "%t"
      detailperm = 384
      dirperm = 493
      locking = no
      log_packet_header = no
      escape_filenames = no
    }
   Module: Linked to module rlm_attr_filter
   Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter
    attr_filter attr_filter.accounting_response {
      attrsfile = "/etc/freeradius/attrs.accounting_response"
      key = "%{User-Name}"
      relaxed = no
    }
  reading pairlist file /etc/freeradius/attrs.accounting_response
   Module: Checking session {...} for more modules to load
   Module: Linked to module rlm_radutmp
   Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp
    radutmp {
      filename = "/var/log/freeradius/radutmp"
      username = "%{User-Name}"
      case_sensitive = yes
      check_with_nas = yes
      perm = 384
      callerid = yes
    }
   Module: Checking post-proxy {...} for more modules to load
   Module: Checking post-auth {...} for more modules to load
   Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter
    attr_filter attr_filter.access_reject {
      attrsfile = "/etc/freeradius/attrs.access_reject"
      key = "%{User-Name}"
      relaxed = no
    }
  reading pairlist file /etc/freeradius/attrs.access_reject
   } # modules
  } # server
  server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel
   modules {
   Module: Checking authenticate {...} for more modules to load
   Module: Checking authorize {...} for more modules to load
   Module: Linked to module rlm_passwd
   Module: Instantiating module "smbpasswd" from file /etc/freeradius/modules/smbpasswd
    passwd smbpasswd {
      filename = "/etc/samba/smbpasswd"
      format = "*User-Name:uuid:LM-Password:NT-Password:SMB-Account-CTRL-TEXT::"
      delimiter = ":"
      ignorenislike = no
      ignoreempty = yes
      allowmultiplekeys = no
      hashsize = 100
    }
  rlm_passwd: nfields: 7 keyfield 0(User-Name) listable: no
   Module: Checking session {...} for more modules to load
   Module: Checking post-proxy {...} for more modules to load
   Module: Checking post-auth {...} for more modules to load
   } # modules
  } # server
  radiusd: #### Opening IP addresses and Ports ####
  listen {
    type = "auth"
    ipaddr = *
    port = 0
  }
  listen {
    type = "acct"
    ipaddr = *
    port = 0
  }
  listen {
      type = "auth"
      ipaddr = 127.0.0.1
      port = 18120
  }
   ... adding new socket proxy address * port 49016
  Listening on authentication address * port 1812
  Listening on accounting address * port 1813
  Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
  Listening on proxy address * port 1814
  Ready to process requests.
  rad_recv: Access-Request packet from host 127.0.0.1 port 44096, id=30, length=77
    User-Name = "testusr"
    User-Password = "test"
    NAS-IP-Address = 192.168.200.36
    NAS-Port = 0
    Message-Authenticator = 0xfb35b4ee44829fd799ffe2ace59661d7
  server inner-tunnel {
  # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
  +group authorize {
  ++[chap] = noop
  ++[mschap] = noop
  rlm_passwd: Unable to create uuid: 1003
  ++[smbpasswd] = ok
  [suffix] No '@' in User-Name = "testusr", looking up realm NULL
  [suffix] No such realm "NULL"
  ++[suffix] = noop
  ++update control {
  ++} # update control = noop
  [eap] No EAP-Message, not doing EAP
  ++[eap] = noop
  ++[files] = noop
  ++[expiration] = noop
  ++[logintime] = noop
  ++[pap] = noop
  +} # group authorize = ok
  ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user
  Failed to authenticate the user.
  } # server inner-tunnel
  Using Post-Auth-Type Reject
  # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
  +group REJECT {
  [attr_filter.access_reject]   expand: %{User-Name} -> testusr
  attr_filter: Matched entry DEFAULT at line 11
  ++[attr_filter.access_reject] = updated
  +} # group REJECT = updated
  Delaying reject of request 0 for 1 seconds
  Going to the next request
  Waking up in 0.9 seconds.
  Sending delayed reject for request 0
  Sending Access-Reject of id 30 to 127.0.0.1 port 44096
  Waking up in 4.9 seconds.

Answer 1

这是因为你没有提供参考密码来检查请求中的那个。

要使其正常工作，您可以将以下内容添加到授权部分：

if (User-Name == 'testusr') {
    update control {
        Cleartext-Password := 'test'
    }
}