Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I installed openvpn and freeradius from yum and I installed the radiusplugin_v2.1a_beta1.tar.gz but I am having connection issues with the error:

XML-RPC: ConnectionRefusedError: 10061: No connection could be made because the target machine actively refused it..

I added the following to the database(mysql)

mysql> INSERT INTO radcheck VALUES (1,'jpeterson','Password','==','netopia1');
mysql> INSERT INTO radreply VALUES (1,'jpeterson','Trapeze-VLAN-Name',':=','corp');
mysql> INSERT INTO radreply VALUES (2,'jpeterson','Session-Timeout',':=','300');

trying to use the user jpeterson and password netopia1

I've been looking at /var/log/messages and /var/log/radius/radius.log but I am not seeing much.

/etc/openvpn/server.conf

port 1194 #- port
proto udp #- protocol
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
reneg-sec 0
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
#plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login #- Comment this line if you are using FreeRADIUS
plugin /etc/openvpn/plugins/radiusplugin.so /etc/openvpn/radiusplugin.cnf #- Uncomment this line if you are using FreeRADIUS
client-cert-not-required
username-as-common-name
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status 1194.log
verb 4 

This is the radiusplugin.cnf

# The NAS identifier which is sent to the RADIUS server
NAS-Identifier=OpenVpn

# The service type which is sent to the RADIUS server
Service-Type=5

# The framed protocol which is sent to the RADIUS server
Framed-Protocol=1

# The NAS port type which is sent to the RADIUS server
NAS-Port-Type=5

# The NAS IP address which is sent to the RADIUS server
NAS-IP-Address=127.0.0.1

# Path to the OpenVPN configfile. The plugin searches there for
# client-config-dir PATH   (searches for the path)
# status FILE                      (searches for the file, version must be 1)
# client-cert-not-required (if the option is used or not)
# username-as-common-name  (if the option is used or not)

#OpenVPNConfig=/etc/openvpn/radiusvpn.conf
OpenVPNConfig=/etc/openvpn/server.conf


# Support for topology option in OpenVPN 2.1
# If you don't specify anything, option "net30" (default in OpenVPN) is used.
# You can only use one of the options at the same time.
# If you use topology option "subnet", fill in the right netmask, e.g. from OpenVPN option "--server NETWORK NETMASK"
subnet=255.255.255.0
# If you use topology option "p2p", fill in the right network, e.g. from OpenVPN option "--server NETWORK NETMASK"
# p2p=10.8.0.1


# Allows the plugin to overwrite the client config in client config file directory,
# default is true
overwriteccfiles=true

# Allows the plugin to use auth control files if OpenVPN (>= 2.1 rc8) provides them.
# default is false
# useauthcontrolfile=false

# Only the accouting functionality is used, if no user name to forwarded to the plugin, the common name of certificate is used
# as user name for radius accounting.
# default is false
# accountingonly=false


# If the accounting is non essential, nonfatalaccounting can be set to true.
# If set to true all errors during the accounting procedure are ignored, which can be
# - radius accounting can fail
# - FramedRouted (if configured) maybe not configured correctly
# - errors during vendor specific attributes script execution are ignored
# But if set to true the performance is increased because OpenVPN does not block during the accounting procedure.
# default is false
nonfatalaccounting=false

# Path to a script for vendor specific attributes.
# Leave it out if you don't use an own script.
# vsascript=/root/workspace/radiusplugin_v2.0.5_beta/vsascript.pl

# Path to the pipe for communication with the vsascript.
# Leave it out if you don't use an own script.
# vsanamedpipe=/tmp/vsapipe

# A radius server definition, there could be more than one.
# The priority of the server depends on the order in this file. The first one has the highest priority.
server
{
        # The UDP port for radius accounting.
        acctport=1813
        # The UDP port for radius authentication.
        authport=1812
        # The name or ip address of the radius server.
        name=127.0.0.1
        # How many times should the plugin send the if there is no response?
        retry=1
        # How long should the plugin wait for a response?
        wait=1
        # The shared secret.
        sharedsecret=sekr3tz
}

EDIT: I have had openvpn working when using PAM.


EDIT:

Now when I use my phone or the old vpn connection hat has the server.crt file I get this on the console:

[root@vpn ~]# Mon Jan  7 23:03:54 2013 RADIUS-PLUGIN: Got no response from radius server.
Mon Jan  7 23:03:54 2013 Error: RADIUS-PLUGIN: BACKGROUND  AUTH: Auth failed!.


[root@vpn ~]# Mon Jan  7 23:05:23 2013 RADIUS-PLUGIN: Got no response from radius server.
Mon Jan  7 23:05:23 2013 Error: RADIUS-PLUGIN: BACKGROUND  AUTH: Auth failed!.

After some research I found this but not sure what it means:

"Got no response from radius server" means that the plugin does not receive any packet from the RADIUS server.

Can you check that your RADIUS server responses to an ACCESS-REQUEST RADIUS packet with an ACCESS_REJECT packet, which includes a response message? Does the server response in the interval which is configured in the plugin configuration file?

And do I also need to have a cert file to login even if I use FreeRadius?

share|improve this question

i think its necessary to have certification authority but its not necessary to have private key with .key and .crt file when you using active directory s such as LDAP and other authorization tools such as radius

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.