Freeradius 错误（pap：错误：密码不能为空）

Question

This is a situation where we linked DHCP between Freeradius and Mikrotik Router.

The data is stored in mysql and works fine.

However, due to the nature of the Mikrotik Router, the User-Password is sent empty .

(0)   User-Name = "00:0C:29:55:D0:C4"
(0)   NAS-Port-Type = Ethernet
(0)   NAS-Port = 2197815782
(0)   Service-Type = Framed-User
(0)   Calling-Station-Id = "ff:bc:9a:4a:2d:0:2:0:0:ab:11:c0:56:c7:e1:e8:28:59:1c"
(0)   Called-Station-Id = "defconf"
(0)   User-Password = ""              # <--- Here
(0)   NAS-Identifier = "MikroTik"
(0)   NAS-IP-Address = 192.168.88.1

I found a way to solve this problem and found that there are the following methods.

However, eventually, the PAP receives an error message stating that the empty password cannot be authenticated, and authentication fails.

authorize {
        update request {
                User-Password = "%{User-Name}"
        }

It seems to be updating, but the message (1) pap: ERROR: Password must not be empty is printed.

Is there a way? Thank you in advance for your reply.

Full Log

(0) Received Access-Request Id 53 from 192.168.88.1:51985 to 192.168.88.10:1812 length 154
(0)   User-Name = "00:0C:29:55:D0:C4"
(0)   NAS-Port-Type = Ethernet
(0)   NAS-Port = 2197815782
(0)   Service-Type = Framed-User
(0)   Calling-Station-Id = "ff:bc:9a:4a:2d:0:2:0:0:ab:11:c0:56:c7:e1:e8:28:59:1c"
(0)   Called-Station-Id = "defconf"
(0)   User-Password = ""
(0)   NAS-Identifier = "MikroTik"
(0)   NAS-IP-Address = 192.168.88.1
(0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
(0)   authorize {
(0)     update request {
(0)       EXPAND %{User-Name}
(0)          --> 00:0C:29:55:D0:C4
(0)       User-Password = 00:0C:29:55:D0:C4
(0)     } # update request = noop
(0) sql: EXPAND %{User-Name}
(0) sql:    --> 00:0C:29:55:D0:C4
(0) sql: SQL-User-Name set to '00:0C:29:55:D0:C4'
rlm_sql (sql): Reserved connection (1)
(0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
(0) sql:    --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00:0C:29:55:D0:C4' ORDER BY id
(0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00:0C:29:55:D0:C4' ORDER BY id
(0) sql: User found in radcheck table
(0) sql: Conditional check items matched, merging assignment check items
(0) sql:   Cleartext-Password := "00:0C:29:55:D0:C4"
(0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id
(0) sql:    --> SELECT id, username, attribute, value, op FROM radreply WHERE username = '00:0C:29:55:D0:C4' ORDER BY id
(0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '00:0C:29:55:D0:C4' ORDER BY id
(0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
(0) sql:    --> SELECT groupname FROM radusergroup WHERE username = '00:0C:29:55:D0:C4' ORDER BY priority
(0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = '00:0C:29:55:D0:C4' ORDER BY priority
(0) sql: User not found in any groups
rlm_sql (sql): Released connection (1)
Need more connections to reach 10 spares
rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radius' on 192.168.5.238 via TCP/IP, server version 5.5.5-10.6.7-MariaDB-2ubuntu1.1, protocol version 10
(0)     [sql] = ok
(0) sql: EXPAND %{User-Name}
(0) sql:    --> 00:0C:29:55:D0:C4
(0) sql: SQL-User-Name set to '00:0C:29:55:D0:C4'
rlm_sql (sql): Reserved connection (2)
(0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
(0) sql:    --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00:0C:29:55:D0:C4' ORDER BY id
(0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00:0C:29:55:D0:C4' ORDER BY id
(0) sql: User found in radcheck table
(0) sql: Conditional check items matched, merging assignment check items
(0) sql:   Cleartext-Password := "00:0C:29:55:D0:C4"
(0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id
(0) sql:    --> SELECT id, username, attribute, value, op FROM radreply WHERE username = '00:0C:29:55:D0:C4' ORDER BY id
(0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '00:0C:29:55:D0:C4' ORDER BY id
(0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
(0) sql:    --> SELECT groupname FROM radusergroup WHERE username = '00:0C:29:55:D0:C4' ORDER BY priority
(0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = '00:0C:29:55:D0:C4' ORDER BY priority
(0) sql: User not found in any groups
rlm_sql (sql): Released connection (2)
(0)     [sql] = ok
(0)     policy filter_username {
(0)       if (&User-Name) {
(0)       if (&User-Name)  -> TRUE
(0)       if (&User-Name)  {
(0)         if (&User-Name =~ / /) {
(0)         if (&User-Name =~ / /)  -> FALSE
(0)         if (&User-Name =~ /@[^@]*@/ ) {
(0)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(0)         if (&User-Name =~ /\.\./ ) {
(0)         if (&User-Name =~ /\.\./ )  -> FALSE
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(0)         if (&User-Name =~ /\.$/)  {
(0)         if (&User-Name =~ /\.$/)   -> FALSE
(0)         if (&User-Name =~ /@\./)  {
(0)         if (&User-Name =~ /@\./)   -> FALSE
(0)       } # if (&User-Name)  = ok
(0)     } # policy filter_username = ok
(0)     [preprocess] = ok
(0)     [chap] = noop
(0)     [mschap] = noop
(0)     [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "00:0C:29:55:D0:C4", looking up realm NULL
(0) suffix: No such realm "NULL"
(0)     [suffix] = noop
(0) eap: No EAP-Message, not doing EAP
(0)     [eap] = noop
(0)     [files] = noop
(0)     [expiration] = noop
(0)     [logintime] = noop
(0)     [pap] = updated
(0)   } # authorize = updated
(0) Found Auth-Type = PAP
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0)   Auth-Type PAP {
(0) pap: ERROR: Password must not be empty
(0)     [pap] = invalid
(0)   } # Auth-Type PAP = invalid
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0)   Post-Auth-Type REJECT {
(0) sql: EXPAND .query
(0) sql:    --> .query
(0) sql: Using query template 'query'
rlm_sql (sql): Reserved connection (3)
(0) sql: EXPAND %{User-Name}
(0) sql:    --> 00:0C:29:55:D0:C4
(0) sql: SQL-User-Name set to '00:0C:29:55:D0:C4'
(0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' )
(0) sql:    --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '00:0C:29:55:D0:C4', '', 'Access-Reject', '2022-07-26 17:27:35.827521' )
(0) sql: EXPAND /var/log/freeradius/sqllog.sql
(0) sql:    --> /var/log/freeradius/sqllog.sql
(0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '00:0C:29:55:D0:C4', '', 'Access-Reject', '2022-07-26 17:27:35.827521' )
(0) sql: SQL query returned: success
(0) sql: 1 record(s) updated
rlm_sql (sql): Released connection (3)
(0)     [sql] = ok
(0) attr_filter.access_reject: EXPAND %{User-Name}
(0) attr_filter.access_reject:    --> 00:0C:29:55:D0:C4
(0) attr_filter.access_reject: Matched entry DEFAULT at line 11
(0)     [attr_filter.access_reject] = updated
(0)     [eap] = noop
(0)     policy remove_reply_message_if_eap {
(0)       if (&reply:EAP-Message && &reply:Reply-Message) {
(0)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(0)       else {
(0)         [noop] = noop
(0)       } # else = noop
(0)     } # policy remove_reply_message_if_eap = noop
(0)   } # Post-Auth-Type REJECT = updated
(0) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
(0) (0) Discarding duplicate request from client Mikrotik_Test port 51985 - ID: 53 due to delayed response
Waking up in 0.6 seconds.
(0) (0) Discarding duplicate request from client Mikrotik_Test port 51985 - ID: 53 due to delayed response
Waking up in 0.3 seconds.
(0) Sending delayed response
(0) Sent Access-Reject Id 53 from 192.168.88.10:1812 to 192.168.88.1:51985 length 20
Waking up in 3.9 seconds.

Answer 1

I have really scratched my head for teh last 2 days to sort teh problem. It turns out it has a very simple solution. Apprently, the pap configuration does not accept empty passwords. The workaround is as below
In the radcheck table, add the following
username - "Mac Address"
Attribute - "Auth-Type"
OP - ':="
value - 'Accept"