Comments inline... Phil Mayers wrote:
Paul Long wrote:
A man page (http://www.die.net/doc/linux/man/man5/users.5.html) for the users file says, "Attribute := Value ... Always matches as a check item..." So does that mean, no matter what the value is, it will always
Well, the wording might be a bit confusing.
FreeRadius works the following way:
1. All attribute-value pairs that come in are the "request" pairs 2. Internal server attribute per-request are the "config" pairs 3. Attribute-value pairs to go back to the client are the "reply" pairs
someuser User-Password := "somevalue"
...actually sets (unconditionally) the User-Password AVP in the "config" items. This password is *COMPARED* to the password supplied by the client in the "request" items. Okay, so then what is meant in the man page by "Always matches a check item?" Should it have said, "Always checks a check item?" :-) As is, it sounds like it always returns true. It's not a simple equality - a CHAP request will require a challenge/response calculation with the config password + request challenge and then an equality test of the chap response.
match the attribute? I don't see that happening. As an experiment, I have a supplicant in a WiFi phone with user name of "plong" and password of "123". With the following entry in the users file:
plong Auth-Type = Local, User-Password := "126"
...I assumed it would match even though the value is different; however,
Though I realise the terminology might be initially confusing, how did you imagine a user with a password of "123" would be matched/accepted by a password of "126". I didn't expect it to match.accept. I was just playing around with values trying to better understand the operators. I have everything working the way I want--I was just going for extra credit. :-)
it does not match, and the access request is rejected:
rlm_chap: login attempt by "plong" with CHAP password rlm_chap: Using clear text password 126 for user plong authentication. rlm_chap: Pasword check failed
To get it to match, I have to have the correct value:
plong Auth-Type = Local, User-Password := "123"
which results in this debug output:
rlm_chap: login attempt by "plong" with CHAP password rlm_chap: Using clear text password 123 for user plong authentication. rlm_chap: chap user plong authenticated succesfully
Yes...
In fact, := behaves exactly like == in this case. What's the deal? Why doesn't := "always match?" Am I misunderstanding what it means to "match?"
As per man(5) users:
Attribute := Value Always matches as a check item, and replaces in the configuration items any attribute of the same name. If no attribute of that name appears in the request, then this attribute is added. As a reply item, it has an identical meaning, but for the reply items, instead of the request items.
Basically, := is a "force set" operator. In a "check" item, it sets a check/config pair. So "Always matches a check item" just means that a check will be performed and says nothing about the outcome of that check? In a reply item, it sets/forces a reply pair.
See doc/aaa.txt - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html