Troubleshooting Information

Table 14-2: RADIUS AAA Server Warning Messages

Error Message	Meaning
Unknown Acct-Status value (accounting_status_value)	Where accounting_status_value = decimal value of the invalid attribute. An accounting packet contained an accounting status attribute with an invalid value.
Invalid Accounting Packet from (nas_name) "+ variable message"	Where nas_name = the name of the NAS sending the accounting packet, and variable_message = valid accounting packet must contain a valid session ID, accounting status, and NAS id attribute. A list of missing attributes are added to the warning message. The accounting packet is rejected by the RADIUS server.
NAS (nas_name) input packet contains attr_name (Unknown Type attr_type)	Where nas_name = name of the NAS sending the packet, attr_name = name of the attribute in question, and attr_type = decimal value of the attribute. The unknown attribute is discarded, but the RADIUS server attempts to process the packet. A common cause of the error is an incorrect dictionary for the NAS sending the packet.
Passchange: from (nas_name): Password Changing NOT Allowed	Where nas_name = name of the NAS sending the packet. The RADIUS server is configured to deny change password requests, and a change password request was received. The request is rejected.
Authenticate: nas (nas_name) user (user_name) invalid NAS, NAS port, or Caller id	Where nas_name = name of the NAS sending the packet, and user_name = user profile requested by the NAS. The user's profile contained limiting origin information the request did not fulfill. The request is rejected.
Passchange: from (nas_name) - Missing Password: user_name	Where nas_name = name of the NAS sending the packet, and user_name = user profile requested by the NAS. A change password request failed to provide a new and old password. The request is rejected.
Passchange: from (nas_name) - Missing Local Password: user_name	Where nas_name = name of the NAS sending the packet, and user_name = user profile requested by the NAS. The user profile referenced in the change password request does not contain a password attribute or has a null password value. The request is rejected.
Passchange: from (nas_name): system password change not allowed: user_name	Where nas_name = name of the NAS sending the packet, and user_name = user profile requested by the NAS. The user profile password type does not support password changes. The request is rejected.
Passchange: from (nas_name) - Bad Pwd for user_name	Where nas_name = name of the NAS sending the packet, and user_name = user profile requested by the NAS.The password provided in the change password request is incorrect. The request is rejected.
Authenticate: from (nas_name) - No User Name	Where nas_name = name of the NAS sending the packet. The authentication request from the NAS does not contain a username attribute. The request is rejected.
Authenticate: from (nas_name) - user_name failed	Where nas_name = name of the NAS sending the packet, and user_name = user profile requested by the NAS. A valid user profile wasn't found in the database for the authentication request. The request is rejected.
Unknown accounting mode (accounting_mode)	Where accounting_mode = decimal value of the accounting mode in the RADIUS server profile. The accounting mode contained in the RADIUS AAA server profile is unknown to the RADIUS server. All accounting requests are rejected.
Unknown attribute type attribute_type	Where attribute_type = decimal value of attribute type. The reply attributes contain a type unknown to the RADIUS server. The attribute is ignored.
Dictionary dictionary_name contains unsupported vendor attributes	Where dictionary_name = dictionary profile name in database. The Ascend RADIUS handler found vendor-specific dictionary attributes in the dictionary attached to the NAS. The dictionary is ignored, and all requests from the NAS in question are rejected.
dictionary (dictionary_name) Invalid attribute value (attribute_value)	Where dictionary_name = dictionary profile name in database, and attribute_value = the value of the attribute in question. A dictionary A/V pair contains a value less than 0 or greater than 255. The dictionary is ignored, and all requests that require the dictionary are rejected.
dictionary (dictionary_name) attribute (attribute_name) invalid length	Where dictionary_name = dictionary profile name in database, and attribute_name = the attribute. The dictionary contains an attribute name that exceeds the maximum allowed attribute name length. The dictionary is ignored, and all requests that require the dictionary are rejected.
Malformed enum in dictionary dictionary_name	Where dictionary_name = dictionary profile name in database. The dictionary is formatted incorrectly. The dictionary is ignored and all requests that require the dictionary are rejected.
Dictionary (dictionary_name) unknown attribute type attribute_type	Where dictionary_name = dictionary profile name in database, and attribute_type = the decimal value of the attribute type. The dictionary contains an attribute that has an unsupported type. The attribute is marked as invalid.
Dictionary dictionary_name not found in database	Where dictionary_name = dictionary profile name in database. The dictionary profile wasn't found in the database. Requests that require the dictionary are rejected.
CHAP Token - Bad Pwd Size(pwd_size): user user_name, NAS nas_name	Where pwd_size = decimal size of the CHAP1 token, nas_name = name of the NAS sending the packet, and user_name = user profile requested by the NAS. The CHAP token in the request exceeds the maximum CHAP token length. The request is rejected.
CHAP Token Attempt: user user_name, NAS (nas_name)	Where user_name = user profile requested by the NAS and nas_name = name of the NAS sending the packet. A NAS attempted to use CHAP token password expiration without token caching enabled. The request is rejected.
authChapPwd: update failed	Update of the idle value of a cached token password failed.
authChapPwd: insert failed	Insertion of a token in the password cache failed.
CHAP Unix Attempt: user user_name, NAS (nas_name)	Where user_name = user profile requested by the NAS and nas_name = name of the NAS sending the packet. A CHAP password was provided by the NAS, but the user profile requires a UNIX system password. The request is rejected.
authPapPwd: from (nas_name), user user_name: pwd too long (pwd_length)	Where user_name = user profile requested by the NAS, nas_name = name of the NAS sending the packet, and pwd_length = password length. The password provided by the NAS exceeds the maximum PAP2 password length. The length is set to the maximum PAP password length.
Unknown password type (password_type) found in profile	Where password_type = decimal value of the password type. An unsupported password type was encountered in a user profile. The password is ignored.
T+ DES password length exceeds RADIUS string length	TACACS+ DES3 password length exceeds the length supported by the RADIUS server. The password is ignored.
T+ password length exceeds RADIUS string length	TACACS+ password exceeds the maximum length of a RADIUS string attribute. The password is ignored.
Unknown results challenge_results from token card challenge	Token card challenge returned a value unknown to the RADIUS server. The challenge request fails.
unexpected PW_SKIP status from token card api	Token card library returned a "PW_SKIP" status. The token card operation fails.
unexpected token_card_status status from token card api	Where token_card_status = decimal value of the status returned from the token card library. The token card library returned an unsupported status value. The token card operation fails.
Tokencard Authenticate (nas_name), user user_name: Invalid State	Where nas_name = name of the NAS sending the packet, and user_name = user profile requested by the NAS. The NAS provided a state value unknown by the RADIUS server. The token card operation fails.
Tokencard Authenticate from (nas_name), user user_name: Invalid Request	Where nas_name = name of the NAS sending the packet, and user_name = user profile requested by the NAS. A pending token card request for the token card operation could not be located in the request queue. The token card operation fails.
Tokencard Authenticate from (nas_name), user user_name: Invalid State	Where nas_name = name of the NAS sending the packet, and user_name = user profile requested by the NAS. The state of the pending request does not match the state required by the token card request. The token card request fails.
Unable to locate library for token card library_name	Where library_name = token card shared library name. The token card shared library needed to complete the token card request could not be loaded. The token card request fails.
Zero length username not permitted	Incoming NAS request contains a zero length username. The request fails.
Non-numeric value in numeric only field	User profile contains a non-numeric value in a numeric field. The request fails.
Attribute (attribute_name) length (attribute_length) exceeds RADIUS length (RADIUS_length)	Where attribute_name = name of attribute, attribute_length = decimal length of attribute, and RADIUS_length = decimal maximum RADIUS attribute length. A user profile contains an attribute that exceeds the maximum length supported by the RADIUS server. The request fails.
setpwfile failed for `file_name'	Where file_name = file name of the UNIX password file. Function setpwfile() failed to set up the password file. The request fails.
Can't locate NAS profile (nas_name)	Where nas_name = name of the NAS sending the packet. The RADIUS server failed to retrieve the NAS profile from the database. The request fails.
Invalid type for state attribute (state_type)	Where state_type = decimal value of the state attribute. A state attribute was received from the NAS with an unknown type. The attribute is ignored.

1CHAP = Challenge Handshake Authentication Protocol. 2PAP = Password Authentication Protocol. 3DES = Data Encryption Service.

Note The RADIUS server shares code with the TACACS+ server, and errors from the shared code can cause failures (and error messages) while serving RADIUS protocol requests. The main sections of shared code are the database library, profile parser, and token card libraries.

Table 14-3: TACACS+ Error Messages and Solutions

Error Message	Meaning	Solution
Maximum number of users exceeded	Maximum users allowed as specified by the license key exceeded.	If the number of users allowed is less than what the administrator expects, check CSU.cfg; to ensure that the license key entered correctly. Also check the cs_startup.log and syslog (/var/log/csuslog). These log files will contain information about the license key (expiration date and so on). Possibly get a new license key.
Protocol - mismatched encryption Protocol - mismatched encryption keys	Secret shared between the NAS and the ACS does not match.	Find the secret for the NAS in CSU.cfg, and the secret in the NAS configuration. These secrets must match exactly. If the NAS is not listed in CSU.cfg, use the secret for the default NAS. If a default NAS is not specified, an entry with a matching secret must be added to CSU.cfg.
Authentication - Bad method for user	User is not configured for the type of NAS. For example, if the NAS is a Cisco RADIUS NAS, but the user is configured for TACACS+ only.	Check the user profile. Make sure it is configured for the type of NAS.
Authentication - Insufficient privilege	User privilege is too low.	If the user's request is being denied erroneously due to insufficient privilege, check the user's profile, and increase privilege if necessary.
Authentication - No token passcode received	User configured for token card, but no token password is received.	User did not enter a token password. Enter a token passcode during the login process.
Authentication - Account disabled	User's account is disabled due to too many failed logins.	The account can be reenabled by setting profile_status to enabled.
Authentication - Maximum sessions exceeded	User, group, or VPDN exceeds the allowed maximum number of sessions.	If the user, group, or VPDN is entitled to more sessions, change the user's, group's, or VPDN's profile to allow more sessions.
Authorization - No service specified Authorization - No protocol specified Authorization - No command specified Authorization - Failed mandatory argument Authorization - Bad argument Authorization - Failed command line Authorization - Failed command Authorization - Failed time qualification	Requested service or command is denied.	Either the service, protocol, or command is entirely or partially missing or incorrect, or it is denied by the deny/permit statements in the profile. Check the profile and make sure the deny/permit statements are correct.

Table 14-4: TACACS+ Protocol Errors

Error Message	Meaning
Protocol - Username too long Protocol - Token passcode too long Protocol - NAS name too long Protocol - NAS port name too long Protocol - NAS address too long	Length of fields exceeded the maximum allowed.
Protocol - Invalid privilege field Protocol - Session id in use Protocol - No session found Protocol - Incorrect type Protocol - Incorrect session Protocol - Incorrect sequence Protocol - Incorrect version Protocol - Bad type	Bad data in the packet header.
Protocol - Garbled message	Invalid License Key
Protocol - Read timeout Protocol - Connection closed	Network connection errors.

Table 14-5: Authentication Messages

Error Message	Meaning
Authentication - User not found	User not found in the database.
Authentication - Bad type	Bad authentication type (login, sendpass, and so on).
Authentication - No username specified	No username found in the database.
Authentication - Unexpected data Authentication - Unexpected reserved data	Bad data in the authentication packet.
Authentication - Incorrect password	Password incorrect.
Authentication - Aborted sequence	Authentication sequence aborted by the NAS.
Authentication - File handling error	Authentication encountered a file handling problem with the NAS.
Authentication - Unknown password type	Bad password type.
Authentication - User not in file	User not found in the database.
Authentication - Error in external function	An error occurred outside the AAA server.
Authentication - Bad service	Invalid service encountered in the PPP1, shell, or other component.
Authentication - Bad action	The server performed an invalid function.
Authentication - Bad password	Garbled password.
Authentication - SENDPASS successful Authentication - SENDPASS failed Authentication - LOGIN successful Authentication - ENABLE successful Authentication - CHPASS successful Authentication - SENDAUTH successful Authentication - SENDAUTH failed	Various types of authentication success/failure messages.
Authentication - Too many tries	User exceeded the allowable number of attempts to enter the correct password.
Authentication - Can't change password Authentication - Change password failed	An attempt to change a password failed.

1PPP = Point-to-Point Protocol.

Table 14-6: Authorization Messages

Message	Meaning
Authorization - Unknown user	User not found.
Authorization - Unauthorized NAS or port	The NAS or port specified in the database does not exist. Specify a valid one.
Authorization - Request authorized	Authorization successful.

Table 14-7: Messages that Can Occur During CiscoSecure Startup

Message	Meaning
seminit failed (libsec code -8187)	This is actually a Netscape FastTrack Server message. It is usually caused by incompatible permissions set for the system's /tmp directory. Make sure that the user, group, and other categories all have read, write, and execute permission (r-w-x) to the /tmp directory of the system on which the Netscape FastTrack Server is installed.

# kill -INT 'cat /etc/CiscoSecure.pid'

---

Note In this command line, the process ID of the CiscoSecure ACS software is taken from the file /etc/CiscoSecure.pid, which is created when the CiscoSecure ACS starts.

---

• Shutdown---Completely shuts down security functions on the ACS:

# /etc/rc0.d/K80CiscoSecure

./CiscoSecure [-v] [-c] [-d] [-p] [-x] -f $BASEDIR/config/CSU.cfg
 

where:

Table 14-8: Logging Options

-v	Displays the CiscoSecure ACS software version information.
-c	Instructs the CiscoSecure ACS to display its logging output on stderr. Normally, all output is logged using the syslog facility.
-p	Causes the CiscoSecure ACS to read and verify that the control file and referenced user database files are correct.
-x	CiscoSecure ACS will not divorce itself from the controlling terminal and will stay in the foreground.
-f CSU.cfg	Identifies the control file.

Note Flags in brackets are optional.

The information recorded in the syslog file (usually /var/log/csuslog) contains RADIUS accounting information. At present this information is verbose. This is done on purpose, as CiscoSecure ACS user requirements vary widely. Some users want very detailed information, while others may require very minimal information. Since it is possible to filter out unnecessary information, CiscoSecure adds all the information it has about the accounting records to the log. This allows you to customize the log to suit your individual requirements.

Events that can be logged by the CiscoSecure ACS include the following:

• Server start, restart, stop, and crash events

• Fatal internal errors

• Serious internal errors resulting in limitation of server operation

• TCP/IP connection resets

• Unexpected accounting transactions (indicating probable error recovery)

• Failed authentication and authorization requests

• Successful enable requests

• Packet-level information

The default syslog facility is LOG_LOCAL0. (See your UNIX system documentation for more information about syslog.) You can change this by changing the value of the CiscoSecure ACS software control file variable, config_system_logging_level.

To maintain a centralized database of messages, modify the configuration of syslog. This assures that the program logs all CiscoSecure ACS messages. To do this:

1. Use the UNIX touch command to create the following file: /var/log/csuslog.

After this is done, syslog can store messages there.

2. To cause all informational messages to be sent to the named file, add the following line to /etc/syslog.conf:

local0.debug     /var/log/csuslog

---

Note Spaces cannot be used between `local0.debug' and `/var/log/csuslog'. Use the Tab key to create spaces.

---

3. To cause syslog to reread its configuration file, enter the following command:

# kill -HUP `cat /etc/syslog.pid`
 

4. To shut down all security and database functions of CiscoSecure ACS, use the K80CiscoSecure command:

# /etc/rc0.d/K80CiscoSecure

5. To start all the CiscoSecure ACS security and database functions, use the S80CiscoSecure command:

# /etc/rc2.d/S80CiscoSecure