topic Re: RADIUS can not authenticate using telnet/ssh in Network Access Control

RADIUS can not authenticate using telnet/ssh

kamrannaseem — Mon, 11 Mar 2019 03:35:51 GMT

Hi,

I have TekRadius server running, when i try to login to my cisco 2960 switch through consol it's working fine but when i try to login through telnet/ssh it doest not let me in.

any help will be much appriciated.

Kind regards,

RADIUS can not authenticate using telnet/ssh

Jatin Katyal — Fri, 28 Jun 2013 14:28:01 GMT

Can you post the running config from the 2960? Also, check if you're getting any error message on the radius server.

Jatin Katyal
- Do rate helpful posts -

RADIUS can not authenticate using telnet/ssh

kamrannaseem — Fri, 28 Jun 2013 14:33:54 GMT

Hi Jatin,

username test privilege 15 secret 5 $1$HwE9$.kxhsf7I5gIuBnw3xT67A1

aaa new-model

aaa authentication login default group radius

aaa authentication login VTY group radius local

aaa authentication login localauth local

aaa authentication login ssh group radius

aaa authentication ppp default if-needed group radius local

aaa authorization exec default group radius local

aaa authorization exec VTY group radius local

aaa authorization network default group radius local

aaa accounting exec default start-stop group radius

aaa session-id common

clock timezone gmt 0

clock summer-time BST recurring last Sun Mar 1:00 last Sun Oct 1:00

system mtu routing 1500

ip subnet-zero

no ip domain-lookup

ip ssh version 2

ip rcmd rcp-enable

ip rcmd remote-username RMEUser

line con 0

password 7 107A0C0A111E1C0C

line vty 0 3

access-class 1 in

authorization exec VTY

line vty 4

access-class 1 in

authorization exec VTY

transport input telnet ssh

line vty 5 15

access-class 1 in

authorization exec VTY

end

Many thanks.

RADIUS can not authenticate using telnet/ssh

Jatin Katyal — Fri, 28 Jun 2013 14:48:56 GMT

I think telnet/ssh is not enabled under line vty 0 3. Please add the below listed command there.

line vty 0 3

transport input telnet ssh

Jatin Katyal
- Do rate helpful posts -

RADIUS can not authenticate using telnet/ssh

kamrannaseem — Fri, 28 Jun 2013 15:30:16 GMT

Hi jatin,

no luck same issue.

regards,

kamran.

RADIUS can not authenticate using telnet/ssh

Jatin Katyal — Fri, 28 Jun 2013 15:39:14 GMT

can you run the following debugs:

debug aaa authen

debug radius

debug aaa autho

Jatin Katyal
- Do rate helpful posts -

RADIUS can not authenticate using telnet/ssh

kamrannaseem — Fri, 28 Jun 2013 15:54:52 GMT

Hi Jatin,

Username:

1d06h: AAA/AUTHEN/ABORT: (840134049) because Login timed out.

1d06h: AAA/MEMORY: free_user_quiet (0x1C74914) user='NULL' ruser='NULL' port='tty0' rem_addr='async' authen_type=1 servic e=1 priv=1

1d06h: AAA: parse name=tty0 idb type=-1 tty=-1

1d06h: AAA: name=tty0 flags=0x11 type=4 shelf=0 slot=0 adapter=0 port=0 channel=0

1d06h: AAA/MEMORY: create_user (0x1BB5588) user='NULL' ruser='NULL' ds0=0 port='tty0' rem_addr='async' authen_type=ASCII service=LOGIN priv=1 initial_task_id='0', vrf= (id=0)

1d06h: AAA/AUTHEN/START (195888831): port='tty0' list='' action=LOGIN service=LOGIN

1d06h: AAA/AUTHEN/START (195888831): using "default" list

1d06h: AAA/AUTHEN/START (195888831): Method=radius (radius)

1d06h: AAA/AUTHEN (195888831): status = GETUSER

% Username: timeout expired!

% Authentication failed.

1d06h: RADIUS: Pick NAS IP for u=0x1C74914 tableid=0 cfg_addr=0.0.0.0
1d06h: RADIUS: ustruct sharecount=2
1d06h: Radius: radius_port_info() success=1 radius_nas_port=1
1d06h: RADIUS: added cisco VSA 2 len 4 "tty0"
1d06h: RADIUS: added cisco VSA 1 len 19 "disc-cause-ext=1020"
1d06h: RADIUS: added cisco VSA 1 len 20 "connect-progress=101"
1d06h: RADIUS: added cisco VSA 1 len 14 "nas-rx-speed=0"
1d06h: RADIUS: added cisco VSA 1 len 14 "nas-tx-speed=0"
1d06h: RADIUS: No secret to encode request (rctx

User Access Verification

Username: :0x1BB50B4)
1d06h: RADIUS: Unable to encrypt (rctx:0x1BB50B4)
1d06h: RADIUS(00000000): Send Accounting-Request to 128.1.15.92:1813 id 1646/92, len 201
1d06h: RADIUS: authenticator 99 4E FD 5D C5 26 71 C8 - BA D0 5D 45 C5 72 27 30
1d06h: RADIUS: NAS-IP-Address      [4]   6   128.1.17.214
1d06h: RADIUS: NAS-Port            [5]   6   0
1d06h: RADIUS: Vendor, Cisco       [26] 12
1d06h: RADIUS:   cisco-nas-port     [2]   6   "tty0"
1d06h: RADIUS: NAS-Port-Type       [61] 6   Async                     [0]
1d06h: RADIUS: User-Name           [1]   6   "test"
1d06h: RADIUS: Acct-Status-Type    [40] 6   Stop                      [2]
1d06h: RADIUS: Acct-Authentic      [45] 6   RADIUS                    [1]
1d06h: RADIUS: Service-Type        [6]   6   NAS Prompt                [7]
1d06h: RADIUS: Acct-Session-Id     [44] 10 "0000002E"
1d06h: RADIUS: Acct-Terminate-Cause[49] 6   user-request              [1]
1d06h: RADIUS: Acct-Session-Time   [46] 6   42
1d06h: RADIUS: Vendor, Cisco       [26] 27
1d06h: RADIUS:   Cisco AVpair       [1]   21 "disc-cause-ext=1020"
1d06h: RADIUS: Vendor, Cisco       [26] 28
1d06h: RADIUS:   Cisco AVpair       [1]   22 "connect-progress=101"
1d06h: RADIUS: Vendor, Cisco       [26] 22
1d06h: RADIUS:   Cisco AVpair       [1]   16 "nas-rx-speed=0"
1d06h: RADIUS: Vendor, Cisco       [26] 22
1d06h: RADIUS:   Cisco AVpair       [1]   16 "nas-tx-speed=0"
1d06h: RADIUS: Acct-Delay-Time     [41] 6   0
1d06h: RADIUS: Received from id 1646/92 128.1.15.92:1813, Accounting-response, len 20
1d06h: RADIUS: authenticator 24 C3 FD 3B F1 F3 A6 76 - 0D B7 99 E8 55 52 4C 68

1d06h: AAA/MEMORY: free_user (0x1BAF6EC) user='1d06h: AAA/MEMORY: free_user (0x1BB8770) user='aa' ruser='NULL' port='tty0' rem_addr='async' authen_type=ASCII service=LOGIN priv=1' ruser='NULL' port='tty0' rem_addr='async' authen_type=ASCII service=LOGIN priv=1

1d06h: AAA: parse name=tty0 idb type=-1 tty=-1

1d06h: AAA: name=tty0 flags=0x11 type=4 shelf=0 slot=0 adapter=0 port=0 channel=0

1d06h: AAA/MEMORY: create_user (0x1BAF3A4) user='NULL' ruser='NULL' ds0=0 port='tty0' rem_addr='async' authen_type=ASCII service=LOGIN priv=1 initial_task_id='0', vrf= (id=0)

Many thanks

RADIUS can not authenticate using telnet/ssh

Jatin Katyal — Fri, 28 Jun 2013 16:05:45 GMT

could you please increase the radius-server timeout to some where 10 seconds and try again.

Jatin Katyal
- Do rate helpful posts -

RADIUS can not authenticate using telnet/ssh

kamrannaseem — Fri, 28 Jun 2013 16:37:27 GMT

Hi Jatin

where i can change the time ?

regards.

RADIUS can not authenticate using telnet/ssh

Jatin Katyal — Sat, 29 Jun 2013 14:00:42 GMT

Looking again at the debugs, I come across

1d06h: RADIUS: No secret to encode request (rctx

User Access Verification

Username: :0x1BB50B4)

1d06h: RADIUS: Unable to encrypt (rctx:0x1BB50B4)

The above debugs shows that there is no shared secret configured on the 2960 to encrypt or encode the radius-request. This is how you can configure the key on the 2960. The same key should be defined on the radius server as well.

radius-server host 1.1.1.1 key

Jatin Katyal
- Do rate helpful posts -

RADIUS can not authenticate using telnet/ssh

kamrannaseem — Mon, 01 Jul 2013 08:13:37 GMT

Hi Jatin,

Hope you had a good weekend !!

I had it configured, but i have done it again though... but i dont understand why it puts 7 after the word key ?

many thanks.

Re: RADIUS can not authenticate using telnet/ssh

Jatin Katyal — Mon, 01 Jul 2013 12:54:08 GMT

http://www.cisco.com/en/US/docs/ios-xml/ios/security/m1/sec-cr-r1.html#wp7224581170

encryption-key

Specifies the encryption key.

Valid values for encryption-key are:

0—Specifies that an unencrypted key follows.
7—Specifies that a hidden key follows.
String specifying the unencrypted (clear-text) server key.

~BR
Jatin Katyal

**Do rate helpful posts**

RADIUS can not authenticate using telnet/ssh

kamrannaseem — Mon, 01 Jul 2013 13:00:24 GMT

Hi Jatin,

I have done it again but no luck....

any other sugestions ?

many thanks.

RADIUS can not authenticate using telnet/ssh

Jatin Katyal — Mon, 01 Jul 2013 13:02:43 GMT

can you post the debugs again.

~BR
Jatin Katyal

**Do rate helpful posts**

RADIUS can not authenticate using telnet/ssh

kamrannaseem — Mon, 01 Jul 2013 13:13:13 GMT

Hi Jatin,

following are the debug lines from aaa autho:

2d02h: AAA: parse name=tty0 idb type=-1 tty=-1

2d02h: AAA: name=tty0 flags=0x11 type=4 shelf=0 slot=0 adapter=0 port=0 channel= 0

2d02h: AAA/MEMORY: create_user (0x1ABAD30) user='NULL' ruser='NULL' ds0=0 port=' tty0' rem_addr='async' authen_type=ASCII service=LOGIN priv=1 initial_task_id='0 ', vrf= (id=0)eem

Password:

2d02h: AAA/MEMORY: free_user (0x1BA2F74) user='NULL' ruser='NULL' port='tty0' rem_addr='async' authen_type=ASCII service=ENABLE priv=15

many thanks

RADIUS can not authenticate using telnet/ssh

Jatin Katyal — Mon, 01 Jul 2013 13:18:26 GMT

could you please run all the debugs:

debug aaa authen

debug aaa autho

debug radius

~BR
Jatin Katyal

**Do rate helpful posts**

RADIUS can not authenticate using telnet/ssh

kamrannaseem — Mon, 01 Jul 2013 13:46:13 GMT

2d02h: AAA: parse name=tty0 idb type=-1 tty=-1

2d02h: AAA: name=tty0 flags=0x11 type=4 shelf=0 slot=0 adapter=0 port=0 channel=0

2d02h: AAA/MEMORY: create_user (0x1A97430) user='NULL' ruser='NULL' ds0=0 port='tty0' rem_addr='async' authen_type=ASCII service=LOGIN priv=1 initial_task_id='0', vrf= (id=0)

2d02h: AAA/AUTHEN/START (3482636447): port='tty0' list='' action=LOGIN service=LOGIN

2d02h: AAA/AUTHEN/START (3482636447): using "default" list

2d02h: AAA/AUTHEN/START (3482636447): Method=radius (radeemius)

2d02h: AAA/AUTHEN (3482636447): status = GETUSER

Username:
2d02h: AAA/AUTHEN/ABORT: (3482636447) because Login timed out.
2d02h: AAA/MEMORY: free_user_quiet (0x1A97430) user='NULL' ruser='NULL' port='tt                    y0' rem_addr='async' authen_type=1 service=1 priv=1
2d02h: AAA: parse name=tty0 idb type=-1 tty=-1
2d02h: AAA: name=tty0 flags=0x11 type=4 shelf=0 slot=0 adapter=0 port=0 channel=                    0
2d02h: AAA/MEMORY: create_user (0x1A97430) user='NULL' ruser='NULL' ds0=0 port='                    tty0' rem_addr='async' authen_type=ASCII service=LOGIN priv=1 initial_task_id='0                    ', vrf= (id=0)
2d02h: AAA/AUTHEN/START (3364608519): port='tty0' list='' action=LOGIN service=L                    OGIN
2d02h: AAA/AUTHEN/START (3364608519): using "default" list
2d02h: AAA/AUTHEN/START (3364608519): Method=radius (radius)
2d02h: AAA/AUTHEN (3364608519): status = GETUSER
Username: k
2d02h: AAA/AUTHEN/CONT (3364608519): continue_login (user='(undef)')
2d02h: AAA/AUTHEN (3364608519): status = GETUSER
2d02h: AAA/AUTHEN (3364608519): Method=radius (radius)
2d02h: AAA/AUTHEN (3364608519): status = GETUSERnaseem
Password:
2d02h: AAA/AUTHEN/CONT (3364608519): continue_login (user='')
2d02h: AAA/AUTHEN (3364608519): status = GETUSER
2d02h: AAA/AUTHEN (3364608519): Method=radius (radius)
2d02h: AAA/AUTHEN (3364608519): status = GETPASS

2d02h: AAA/AUTHEN/CONT (3364608519): continue_login (user='knaseem')
2d02h: AAA/AUTHEN (3364608519): status = GETPASS
2d02h: AAA/AUTHEN (3364608519): Method=radius (radius)
Test-Switch>
2d02h: AAA/AUTHEN (3364608519): status = PASS
Test-Switch>

2d02h: AAA: parse name=tty0 idb type=-1 tty=-1
2d02h: AAA: name=tty0 flags=0x11 type=4 shelf=0 slot=0 adapter=0 port=0 channel=0
2d02h: AAA/MEMORY: create_user (0x1AA6A78) user='NULL' ruser='NULL' ds0=0 port='tty0' rem_addr='async' authen_type=ASCII service=LOGIN priv=1 initial_task_id='0', vrf= (id=0

Username: knaseem
Password:
Test-Switch>
2d02h: AAA/AUTHOR: authenticated console user is permitted

2d02h: RADIUS: Pick NAS IP for u=0x1AA6A78 tableid=0 cfg_addr=0.0.0.0

2d02h: RADIUS: ustruct sharecount=1

2d02h: Radius: radius_port_info() success=1 radius_nas_port=1

2d02h: RADIUS: added cisco VSA 2 len 4 "tty0"

2d02h: RADIUS(00000000): Send Access-Request to 128.1.15.92:1812 id 1645/75, len 77

2d02h: RADIUS: authenticator 45 0C 64 CE B8 DE C9 94 - D0 1F 2A 9C 61 F5 3B D8

2d02h: RADIUS: NAS-IP-Address [4] 6 128.1.17.214

2d02h: RADIUS: NAS-Port [5] 6 0

2d02h: RADIUS: Vendor, Cisco [26] 12

2d02h: RADIUS: cisco-nas-port [2] 6 "tty0"

2d02h: RADIUS: NAS-Port-Type [61] 6 Async [0]

2d02h: RADIUS: User-Name [1] 9 "knaseem"

2d02h: RADIUS: User-Password [2] 18 *

2d02h: RADIUS: Received from id 1645/75 128.1.15.92:1812, Access-Accept, len 45

2d02h: RADIUS: authenticator 18 8C 79 BC F6 DF 99 25 - 6B EA 79 E1 DA 87 AB CA

2d02h: RADIUS: Vendor, Cisco [26] 25

2d02h: RADIUS: Cisco AVpair [1] 19 "shell:priv-lvl=15"

2d02h: RADIUS: saved authorization data for user 1AA6A78 at 1BB3620

2d02h: RADIUS: Pick NAS IP for u=0x1AA6A78 tableid=0 cfg_addr=0.0.0.0

2d02h: RADIUS: ustruct sharecount=3

2d02h: Radius: radius_port_info() success=1 radius_nas_port=1

2d02h: RADIUS: added cisco VSA 2 len 4 "tty0"

2d02h: RADIUS: No secret to encode request (rctx:0x1C9FFC0)

2d02h: RADIUS: Unable to encrypt (rctx:0x1C9FFC0)

2d02h: RADIUS(00000000): Send Accounting-Request to 128.1.15.92:1813 id 1646/57, len 93

2d02h: RADIUS: authenticator 91 B9 7F 48 8A A4 90 E0 - 68 80 F2 B5 CE 93 AB ED

2d02h: RADIUS: NAS-IP-Address [4] 6 128.1.17.214

2d02h: RADIUS: NAS-Port [5] 6 0

2d02h: RADIUS: Vendor, Cisco [26] 12

2d02h: RADIUS: cisco-nas-port [2] 6 "tty0"

2d02h: RADIUS: NAS-Port-Type [61] 6 Async [0]

2d02h: RADIUS: User-Name [1] 9 "knaseem"

2d02h: RADIUS: Acct-Status-Type [40] 6 Start [1]

2d02h: RADIUS: Acct-Authentic [45] 6 RADIUS [1]

2d02h: RADIUS: Service-Type [6] 6 NAS Prompt [7]

2d02h: RADIUS: Acct-Session-Id [44] 10 "0000001D"

2d02h: RADIUS: Acct-Delay-Time [41] 6 0

2d02h: RADIUS: Received from id 1646/57 128.1.15.92:1813, Accounting-response, len 20

2d02h: RADIUS: authenticator 5B C7 86 EF B5 64 6B D4 - 9F B7 CC 34 91 AE 0F 91

RADIUS can not authenticate using telnet/ssh

kamrannaseem — Mon, 01 Jul 2013 17:16:42 GMT

Thanks Jatin issue has been resolved.

Just got one more question. How would i track logging user activities through radius ?

many thanks.

RADIUS can not authenticate using telnet/ssh

Jatin Katyal — Mon, 01 Jul 2013 17:35:06 GMT

You may configure radius accounting. It will only gives you info about user login and logoff. The logged in user activities can not be seen because radius doesn't support command accounting, that can only be done via tacacs.

~BR
Jatin Katyal

**Do rate helpful posts**

Hi Kamran, May I know how do

MOHD SYAFIQ — Wed, 21 Jan 2015 03:53:55 GMT

Hi Kamran,

May I know how do you solve the issue? I currently facing the same issue as yours.