Thanks, I hadn't looked in policy.d/canonicalize. David le Roux -----Original Message----- From: Freeradius-Users <freeradius-users-bounces+david.leroux=miller.co.uk@lists.freeradius.org> On Behalf Of Alan DeKok Sent: 03 June 2022 15:52 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Authentication issues On Jun 3, 2022, at 10:43 AM, David le Roux <david.leroux@miller.co.uk> wrote:
The "invalid user" message is correct. The MAC address in the User-Name isn't found in the "authorized_macs" list. Note that it does it's lookup by exact string match. So check that the MAC address is listed, and has exactly the same format.
I've checked an the mac is certainly there in lower case.
OK, that's good.
However I notice this in the debug:
(2) update request { (2) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (2) --> 08-00-0F-82-64-F0
I can't find anywhere in the config a command to make it upper case (though several "to lower"). Do I need to make my entire list upper case or am I missing a config option?
"tolower" works instead of "toupper". Just edit the rewrite_calling_station_id policy (policy.d/canonicalize) to use "tolower" instead of "toupper" Whatever you choose, you MUST choose a consistent setup. The lookups in the "authorized_macs" list are doing an exact string match. So you need to ensure that all of the entries are all either lowercase, or all uppercase. And then use the rewrite_calling_station_id policy to mash the attribute in the packet to the matching case. Oh, and that policy is there because NAS vendors send MAC addresses in a variety of formats. 00:01:02:04:04:04, or using dashes, or just hex all mashed together. The policy re-writes that to a sane format (00-01-03-04...). Again, you have to ensure that the authorized_macs file contains this exact format. That way when you either buy a new NAS (which uses a different format), or the NAS firmware updates (and changes to a different format), you won't run into this issue again. The policy will just automagically fix things, and it will be fine. Alan DeKok. - List info/subscribe/unsubscribe? See https://gbr01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=05%7C01%7Cdavid.leroux%40miller.co.uk%7C76b48fb8011d42ee778208da4570ad3b%7Ca5609eb2409545a8bb4668573bbb0f92%7C1%7C0%7C637898647482974306%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Jqc1FI5APq9zkLVJ2RLkCiIw1s5IsTsupiehBGmE5gM%3D&reserved=0 ________________________________ Miller Homes Limited Registered in Scotland - SC255429 2 Lochside View, Edinburgh Park, Edinburgh, EH12 9DH Disclaimer: The Information in this e-mail is confidential and for use by the addressee(s) only. It may also be privileged. If you are not the intended recipient please notify us immediately on +44 (0) 870 336 5000 and delete the message from your computer: you may not copy or forward it, or use or disclose its contents to any other person. We do not accept any liability or responsibility for: (1) changes made to this email after it was sent, or (2) viruses transmitted through this email or any attachment. Miller Homes Limited <https://www.millerhomes.co.uk>