April 2015 - Freeradius-Users - lists.freeradius.org

Problem with freeradius and LDAP: crypt and MD5 password
by Ana Gallardo Gómez 27 May '15

27 May '15

Hello! Sorry for my english. I'm working with freeradius FreeRADIUS Version 2.1.12 Sorry to ask again about this, I have been looking for the solution, but I can't resolve my problem. I have a LDAP server with users password in crypt for PDI and PAS and in MD5 for students. The password in LDAP for an user is only available when you do bind with that user. I can see here that you can get the authentication result from the bind result http://confluence.diamond.ac.uk/display/PAAUTH/Using+LDAP+as+authentication… ¿Is this function available in freeradius 2.1.12? Meanwhile I try to do bind whit my user (PAS - crypt password in userPassword attribute in LDAP) and authenticate whith a clear text password, but I can't auth... My config: # cat /etc/freeradius/sites-enabled/rinuex_email server rinuex_email { authorize { suffix files ldapemail pap } authenticate { Auth-Type PAP { pap } } post-auth { sql_log Post-Auth-Type REJECT { sql_log } } } # cat /etc/freeradius/modules-enabled/ldap ldap ldapemail { server = "ldap.unex.es" identity = "uid=aigallardo,ou=people,dc=unex,dc=es" password = "XXXX" basedn = "ou=people,dc=unex,dc=es" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" password_attribute = userPassword ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } # dictionary_mapping = ${confdir}/ldap.attrmap.email edir_account_policy_check = no set_auth_type = yes } My log: rad_recv: Access-Request packet from host 158.49.245.14 port 50406, id=16, length=62 User-Name = "aigallardo(a)unex.es" Vendor-Specific = 0x00000000020a3035303837372b2b NAS-IP-Address = 158.49.245.14 Fri Apr 10 11:37:38 2015 : Info: server rinuex_email { Fri Apr 10 11:37:38 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/rinuex_email Fri Apr 10 11:37:38 2015 : Info: +- entering group authorize {...} Fri Apr 10 11:37:38 2015 : Info: [suffix] Looking up realm "unex.es" for User-Name = "aigallardo(a)unex.es" Fri Apr 10 11:37:38 2015 : Info: [suffix] Found realm "unex.es" Fri Apr 10 11:37:38 2015 : Info: [suffix] Adding Stripped-User-Name = "aigallardo" Fri Apr 10 11:37:38 2015 : Info: [suffix] Adding Realm = "unex.es" Fri Apr 10 11:37:38 2015 : Info: [suffix] Authentication realm is LOCAL. Fri Apr 10 11:37:38 2015 : Info: ++[suffix] returns ok Fri Apr 10 11:37:38 2015 : Info: [files] users: Matched entry DEFAULT at line 42 Fri Apr 10 11:37:38 2015 : Info: ++[files] returns ok Fri Apr 10 11:37:38 2015 : Info: [ldapemail] performing user authorization for aigallardo Fri Apr 10 11:37:38 2015 : Info: [ldapemail] expand: %{Stripped-User-Name} -> aigallardo Fri Apr 10 11:37:38 2015 : Info: [ldapemail] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=aigallardo) Fri Apr 10 11:37:38 2015 : Info: [ldapemail] expand: ou=people,dc=unex,dc=es -> ou=people,dc=unex,dc=es Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] ldap_get_conn: Checking Id: 0 Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] ldap_get_conn: Got Id: 0 Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] attempting LDAP reconnection Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] (re)connect to ldap.unex.es:389, authentication 0 Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] bind as uid=aigallardo,ou=people,dc=unex,dc=es/XXXX to ldap.unex.es:389 Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] waiting for bind result ... Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] Bind was successful Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] performing search in ou=people,dc=unex,dc=es, with filter (uid=aigallardo) Fri Apr 10 11:37:38 2015 : Info: [ldapemail] Added User-Password = {crypt}XXXXXXXXXXXX in check items Fri Apr 10 11:37:38 2015 : Info: [ldapemail] No default NMAS login sequence Fri Apr 10 11:37:38 2015 : Info: [ldapemail] looking for check items in directory... Fri Apr 10 11:37:38 2015 : Info: [ldapemail] looking for reply items in directory... Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] sn -> Nombre-Completo = "gallardo gomez" Fri Apr 10 11:37:38 2015 : Info: [ldapemail] user aigallardo authorized to use remote access Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] ldap_release_conn: Release Id: 0 Fri Apr 10 11:37:38 2015 : Info: ++[ldapemail] returns ok Fri Apr 10 11:37:38 2015 : Info: [pap] No clear-text password in the request. Not performing PAP. Fri Apr 10 11:37:38 2015 : Info: ++[pap] returns noop Fri Apr 10 11:37:38 2015 : Info: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Fri Apr 10 11:37:38 2015 : Info: !!! Replacing User-Password in config items with Cleartext-Password. !!! Fri Apr 10 11:37:38 2015 : Info: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Fri Apr 10 11:37:38 2015 : Info: !!! Please update your configuration so that the "known good" !!! Fri Apr 10 11:37:38 2015 : Info: !!! clear text password is in Cleartext-Password, and not in User-Password. !!! Fri Apr 10 11:37:38 2015 : Info: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Fri Apr 10 11:37:38 2015 : Info: WARNING: Please update your configuration, and remove 'Auth-Type = Local' Fri Apr 10 11:37:38 2015 : Info: WARNING: Use the PAP or CHAP modules instead. Fri Apr 10 11:37:38 2015 : Info: No User-Password or CHAP-Password attribute in the request. Fri Apr 10 11:37:38 2015 : Info: Cannot perform authentication. Fri Apr 10 11:37:38 2015 : Info: Failed to authenticate the user. Fri Apr 10 11:37:38 2015 : Info: } # server rinuex_email Fri Apr 10 11:37:38 2015 : Info: Using Post-Auth-Type Reject I would like to auth my users with clear-text passwords and with EAP (TTLS+PAP). What do you think that is the best option in my case? Thank you very much in advance. -- :::::::::::::::::::::::::::::::::::: :: Ana Gallardo Gómez :: ::::::::::::::::::::::::::::::::::::

3 4

Re: Publishing an EAP-TLS WPA2 Enterprise Setup Guide on the Wiki (Jasvinder S. Bahra)
by Rui Ribeiro 17 May '15

17 May '15

Hi Jasvinder, iPhone configurator has been indeed deprecated some while ago. It sort half worked in iOS 7, and it finally stopped being useful in iOS 8. At the moment, only XCode is useful for that. Apple configurator is used in a corporate setting, however last time I checked, it was only supported in a handful of countries, and not here in Portugal. Someone more used to it can comment. As for the profiles, we are generating them with cat.eduroam.org, because we are a university. However you also have available the service for free at https://802.1x-config.org for a corporate setting. Nevertheless, the profiles are essentially text files. So after generating the first, you can keep it. I also believe you can download client certificates never tried it. You just have to be aware that to download profiles or certificates you have to use the native Safari and not other browser. I also wrote a tutorial to the Portuguese federation on implementing FR 2+EAP-TTLS+AD, that I will have to update to FR 3 and make a little more presentable to distribute it widely. Feel free to contact me if you need more ideas about the Apple profiles. Regards, Rui Ribeiro -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 > Message: 2 > Date: Sat, 3 Jan 2015 10:30:37 -0000 > From: "Jasvinder S. Bahra" <bbdl21548(a)blueyonder.co.uk> > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Publishing an EAP-TLS WPA2 Enterprise Setup Guide on the > Wiki > Message-ID: <1C37CF3272EE4702B874E462A92A49A6@atlantis> > Content-Type: text/plain; format=flowed; charset="iso-8859-1"; > reply-type=original > > Everyone, > > It looks like I posted too soon. > > My guide describes how to configure windows and android clients to connect > to a WPA2 Enterprise wifi network. > > I had done some research into getting apple devices onto it, and I believed > I had all the information necessary to get ipad's, iphone's and ipod's etc > onto the network. However, when I sat down to actually do so, I hit > something of a brick wall. > > I believed all I needed to do was download a PC application from the apple > website called the iPhone Configuration Utility (or iPCU), and use it to > create a profile which configured the relevant devices wifi connection > settings. > > It seems however, that the software has been deprecated - it hasn't been > updated in years. I can find no reference to it on the apple website. It > seems to have been replaced by an application named Configurator - which is > only available for mac's. > > Does anyone know of a way to configure ipad's, iphone's and ipod's wifi > settings, without tools such as iPCU or Configurator? > > Regards, > > Jazz > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 117, Issue 5 > ************************************************ > -- Regards,

3 2

how to setup MAC based authentication with LDAP
by Thomas Stather 12 May '15

12 May '15

Hello list I am new to RADIUS and i'd like to know how to setup a mac-based authentication for my clients. Here is what i have so far: -freeradius 3.0.3 -/etc/raddb/clients.conf (setupped with the IPs of the NAS devices) Now i'm unsure how to configure the mods-enabled/ldap configuration. All the hosts are located in an OU named "hosts", the mac-address of each host has the attribute name "macAddress" within the host object (i.e cn=testdevice). My virtual server in sites-enabled/macauth looks like this: server macauth { authorize { preprocess # clean the Calling-Station-ID rewrite_calling_station_id # now authenticate against LDAP ldap if (!ok) { reject } else { # accept update control { Auth-Type := Accept } } } authenticate { Auth-Type LDAP { ldap } } # Pre-accounting. Decide which accounting type to use. preacct { preprocess # Ensure that we have a semi-unique identifier for every # request, and many NAS boxes are broken. acct_unique } # Accounting. Log the accounting data. accounting { # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # filter attributes from the accounting response attr_filter.accounting_response } # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { radutmp } } Can somebody help please? Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

8 23

multiple fields from rlm_mysql?
by Jorge Pereira 04 May '15

04 May '15

Hi, I would like to know if have some way to do the below example in a single query. something like a tuple/foreach or otherwise way. my current solution is: My-AVP-A = "%{sql: SELECT field_a FROM tb_my WHERE field_a = '%{Value_A}'}" My-AVP-B = "%{sql: SELECT field_b FROM tb_my WHERE field_b = '%{Value_B}'}" My-AVP-C = "%{sql: SELECT field_c FROM tb_my WHERE field_c = '%{Value_C}'}" My-AVP-D = "%{sql: SELECT field_d FROM tb_my WHERE field_d = '%{Value_D}'}" the problem it's because i would like to avoid multiple queries. -- Jorge Pereira

3 5

reading hosts from NAS table not working on 2.2.6?
by Alexander Silveröhrt 03 May '15

03 May '15

Hello, Anyone knows what could be wrong? We are trying to move from an older version to a newer version (2.2.6.) But can't get hosts reading from NAS table to work..And it has always been working. After recompiling and installing...Now hosts from the NAS table is read but not working anymore.. Debug at server start says it is reading all the hosts from database nas table but all requests gets rejected anyway. #############Radius debug . . . . Thu Apr 30 12:16:57 2015 : Info: rlm_sql (sql-smartedge-bng): Attempting to connect rlm_sql_mysql #49 Thu Apr 30 12:16:57 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #49 Thu Apr 30 12:16:57 2015 : Info: rlm_sql (sql-smartedge-bng): Connected new DB handle, #49 Thu Apr 30 12:16:57 2015 : Debug: rlm_sql (sql-smartedge-bng): Processing generate_sql_clients Thu Apr 30 12:16:57 2015 : Debug: rlm_sql (sql-smartedge-bng) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas_smartedge Thu Apr 30 12:16:57 2015 : Debug: rlm_sql (sql-smartedge-bng): Reserving sql socket id: 49 TThu Apr 30 13:09:46 2015 : Debug: rlm_sql (sql-smartedge-bng): Read entry nasname=10.173.5.11,shortname=labb0,secret=redback Thu Apr 30 13:09:46 2015 : Debug: rlm_sql (sql-smartedge-bng): Adding client 10.173.5.11 (labb0, server=smartedge-bng) to clients list . . . . . Thu Apr 30 12:16:57 2015 : Debug: rlm_sql (sql-smartedge-bng): Released sql socket id: 49 When sending a test from the local server echo "User-Name = 'alex_smartedge', NAS-Identifier = 'labb0', NAS-IP-Address = '10.173.5.11'" | radclient -x -s -c 1 -r 1 -t 3 10.173.5.11:1812 auth redback Thu Apr 30 12:48:50 2015 : Error: Ignoring request to authentication address 10.173.5.11 port 1812 from unknown client 10.173.5.11 port 60611 Thu Apr 30 12:48:50 2015 : Info: Ready to process requests. If i add local server to client.conf instead then it works client labb0{ ipaddr = 10.173.5.11 netmask = 32 secret = redback require_message_authenticator = no nastype = other virtual_server = smartedge-bng #coa_server = coa } echo "User-Name = 'alex_smartedge', NAS-Identifier = 'labb0', NAS-IP-Address = '10.173.5.11'" | radclient -x -s -c 1 -r 1 -t 3 10.173.5.11:1812 auth redback Sending Access-Request of id 168 to 10.173.5.11 port 1812 User-Name = "alex_smartedge" NAS-Identifier = "labb0" NAS-IP-Address = 10.173.5.11 rad_recv: Access-Accept packet from host 10.173.5.11 port 1812, id=168, length=115 DHCP-Max-Leases = 1 Qos-Policing-Profile-Name = "default_qos_policing_policy" Qos-Metering-Profile-Name = "default_qos_metering_policy" Context-Name = "BASIC" Total approved auths: 1 Total denied auths: 0 Total lost auths: 0 #############Radius debug rad_recv: Access-Request packet from host 10.173.5.11 port 60305, id=168, length=49 User-Name = "alex_smartedge" NAS-Identifier = "labb0" NAS-IP-Address = 192.168.6.5 Thu Apr 30 13:03:33 2015 : Info: server smartedge-bng { Thu Apr 30 13:03:33 2015 : Info: # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/smartedge-bng Any clues on what could be wrong? I can't see anything weird in the test conf? server smartedge-bng { authorize { bla... bla... sql-smartedge-bng preprocess perl-smartedge-bng } authenticate { bla... bla... perl-smartedge-bng } accounting { bla... bla... sql-smartedge-bng perl-smartedge-bng } } ### sql.conf ### ##default sql { bla... bla... readclients = yes nas_table = "nas" $INCLUDE sql/${database}/dialup.conf } sql sql-smartedge-bng { bla... bla... readclients = yes nas_table = "nas_smartedge" $INCLUDE sql/${database}/dialup-smartedge-bng.conf } sql server2 { bla.. bla.. $INCLUDE sql/${database}/server2.conf } sql server3 { bla.. bla.. $INCLUDE sql/${database}/server3.conf } etc. etc. ********* DISCLAIMER ********* This message and any attachment are confidential and may be privileged or otherwise protected from disclosure and may include proprietary information. If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system. If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person

3 14

3.0.3 Segmentation fault (core dumped)
by Mohamed Lrhazi 01 May '15

01 May '15

Hello, Running 3.0.3... from ppa:freeradius/stable-3.0 /usr/sbin/freeradius -v freeradius: FreeRADIUS Version 3.0.3, for host x86_64-pc-linux-gnu, built on May 20 2014 at 11:59:21 Am running four instances (in docker containers) on two VMs... behind a load balancer. After running for a couple hundred hours, instances start hitting seg faults... restarting the instances gets them going again for few hundred hours... How would you debug this in production settings? should I upgrade to newer version first? Thanks, Mohamed.

7 10

FR 3.0.7 RADIUS Client Schema error
by Ben Humpert 30 Apr '15

30 Apr '15

Hi, in the schema file the entry for require message authenticator is listed as olcAttributeTypes: ( 1.3.6.1.4.1.11344.1.100.2.6 NAME 'radiusClientRequireMa' SINGLE-VALUE DESC 'Require Message Authenticator' EQUALITY booleanMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.7' ) thus one has to enter TRUE or FALSE in LDAP - everything else (I tried it with true, Yes, yes, YES and 1) throws an LDAP error. But now, with TRUE FR won't start anymore. Below is the debug log .... Thu Apr 30 16:34:04 2015 : Debug: client radiusClientIdentifier=127.0.0.1,ou=RADIUS,ou=Services,dc=example,dc=com { Thu Apr 30 16:34:04 2015 : Debug: ipaddr = 127.0.0.1 Thu Apr 30 16:34:04 2015 : Debug: require_message_authenticator = no Thu Apr 30 16:34:04 2015 : Debug: secret = "testing123" Thu Apr 30 16:34:04 2015 : Debug: nas_type = "other" Thu Apr 30 16:34:04 2015 : Debug: limit { Thu Apr 30 16:34:04 2015 : Debug: max_connections = 16 Thu Apr 30 16:34:04 2015 : Debug: lifetime = 0 Thu Apr 30 16:34:04 2015 : Debug: idle_timeout = 30 Thu Apr 30 16:34:04 2015 : Debug: } Thu Apr 30 16:34:04 2015 : Debug: } Thu Apr 30 16:34:04 2015 : Debug: Adding client 127.0.0.1/32 (127.0.0.1) to prefix tree 32 Thu Apr 30 16:34:04 2015 : Debug: rlm_ldap (ldap): Client "radiusClientIdentifier=127.0.0.1,ou=RADIUS,ou=Services,dc=example,dc=com" added Thu Apr 30 16:34:04 2015 : Debug: client radiusClientIdentifier=192.168.0.20,ou=RADIUS,ou=Services,dc=example,dc=com { Thu Apr 30 16:34:04 2015 : Debug: ipaddr = 192.168.0.20 Thu Apr 30 16:34:04 2015 : Error: unknown[0]: Invalid value "TRUE" for boolean variable require_message_authenticator Thu Apr 30 16:34:04 2015 : Debug: } Thu Apr 30 16:34:04 2015 : Error: unknown[0]: Error parsing client section Thu Apr 30 16:34:04 2015 : Debug: rlm_ldap (ldap): Released connection (4) Thu Apr 30 16:34:04 2015 : Error: /etc/freeradius/mods-enabled/ldap[1]: Error loading clients Thu Apr 30 16:34:04 2015 : Error: /etc/freeradius/mods-enabled/ldap[1]: Instantiation failed for module "ldap" Thu Apr 30 16:34:04 2015 : Debug: rlm_ldap (ldap): Removing connection pool Thu Apr 30 16:34:04 2015 : Info: rlm_ldap (ldap): Closing connection (4) Thu Apr 30 16:34:04 2015 : Debug: rlm_ldap: Closing libldap handle 0x26578c0 Thu Apr 30 16:34:04 2015 : Info: rlm_ldap (ldap): Closing connection (3) Thu Apr 30 16:34:04 2015 : Debug: rlm_ldap: Closing libldap handle 0x2656d40 Thu Apr 30 16:34:04 2015 : Info: rlm_ldap (ldap): Closing connection (2) Thu Apr 30 16:34:04 2015 : Debug: rlm_ldap: Closing libldap handle 0x26460a0 Thu Apr 30 16:34:04 2015 : Info: rlm_ldap (ldap): Closing connection (1) Thu Apr 30 16:34:04 2015 : Debug: rlm_ldap: Closing libldap handle 0x26454b0 Thu Apr 30 16:34:04 2015 : Info: rlm_ldap (ldap): Closing connection (0) Thu Apr 30 16:34:04 2015 : Debug: rlm_ldap: Closing libldap handle 0x26278e0 I know FR wants yes / no but those are not boolean so I guess the schema is not correct - or do you plan to update FR to accept TRUE / FALSE instead of yes / no? Thanks

4 9

dynamic expansion will not be dynamically expanded in ldap configuration
by Angel L. Mateo 30 Apr '15

30 Apr '15

Hello, I'm trying to configure ldap module for freeradius. For group membership I have this configuration: membership_filter = "(&(uid=%{User-Name})(objectClass=posixAccount))" but whenever I start freeradius, I get the error /etc/freeradius/mods-enabled/ldap[176]: Found dynamic expansion in string which will not be dynamically expanded where the membership_filter option is at line 176 of the ldap file. And when I user logins, there is no group search in the ldap, only a search to find the user. What am I doing wrong? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

6 20

Re: Freeradius 3.0.8 Can't create UNIX socket and Too many open files
by Rui Ribeiro 29 Apr '15

29 Apr '15

Hi Ales, You do not modify startup scripts, you raise your limits in /etc/security/limits.conf like this * soft nofile 10240 * soft nproc 10240 But then, you only do that in high-load web servers or in email servers. I do not understand why you would need to do that in a FreeRadius server. Regards > Message: 5 > Date: Tue, 28 Apr 2015 16:06:00 +0200 > From: Aleš Rygl <ales(a)rygl.net> > To: <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius 3.0.8 Can't create UNIX socket and Too many > open files > Message-ID: <3d7a8a13084d661d6a5fbe5d1aabf703(a)rygl.net> > Content-Type: text/plain; charset=UTF-8 > > > > Hello Alan, > > you were right of course. Would it make sense to > modify Debian startup script to raise the default value of 2048? > > > Regards > > Ales > > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

5 8

Semantics of !~ operator
by Gerald Vogt 29 Apr '15

29 Apr '15

Hi! I don't quite understand the semantics of !~. So far I though it would be the negated result of =~, i.e. if (a =~ b) is true (a !~ b) is false and v.v. But that doesn't seem to be the case. If I add this in the beginning of the users file (extract starting at line no. 6) DEFAULT Reply-Message += "Realm is %{Realm}", Fall-Through = Yes DEFAULT Realm =~ example.com|NULL Reply-Message += "Internal User", Fall-Through = Yes DEFAULT Realm !~ example.com|NULL Reply-Message += "External User", Fall-Through = Yes it works correctly for a user name test or test(a)example.com: (106) files : users: Matched entry DEFAULT at line 6 (106) files : EXPAND Realm is %{Realm} (106) files : --> Realm is example.com (106) files : users: Matched entry DEFAULT at line 10 ... (106) Reply: Reply-Message = 'Realm is example.com' Reply-Message = 'Internal User' (140) files : users: Matched entry DEFAULT at line 6 (140) files : EXPAND Realm is %{Realm} (140) files : --> Realm is NULL (140) files : users: Matched entry DEFAULT at line 10 ... Reply-Message = 'Realm is NULL' Reply-Message = 'Internal User' But it never gets the !~ (line 47 is a later rule in the users file): (191) files : users: Matched entry DEFAULT at line 6 (191) files : EXPAND Realm is %{Realm} (191) files : --> Realm is DEFAULT (191) files : users: Matched entry DEFAULT at line 47 ... So it seems the !~ never matches. That is kind of unexpected and doesn't make sense to me. Is that a bug or am I missing something? Thanks, Gerald

6 35