thanks our checks this morning revealed that this is the problem. The user requests all were containing whitespaces. The ../policy.d/filter file is configured by default as follows: # reject all whitespace # e.g. "user@ site.com", or "us er", or " user", or "user " # if (&User-Name =~ / /) { update request { &Module-Failure-Message += 'Rejected: User-Name contains whitespace' } reject } But for some reason our FreeRadius 3.0.15 still does not reject these user requests but tries to forward them to the radius server (in our case SWITCH.CH) to which all default realm requests are proxied. Any idea what is going wrong and why the request is not rejected locally but still being proxied ? Thanks very much, Thorsten Am Fr., 21. Sep. 2018 um 15:44 Uhr schrieb Thorsten Fritsch < wiesentalfreunde@gmail.com>:
Hi,
we're running FreeRadius 3.0.15 and frequently see a proxy errors in the radius.log such as " "ERROR: Failing proxied request for user "dummy.user@mylocal.org", due to lack of any response from home server <remote ip> port 1812"
The problem as it seems is that for some users (by far not for all - just for a few) who provide the correct suffix @mylocal.org the radius request is still wrongly assigned to the default realm and then proxied to the remote radius server defined in the default realm instead of proxied to the local realm as show in this log:
(948091) Tue Sep 18 17:42:20 2018: Debug: suffix: Looking up realm " mylocal.org " for User-Name = "dummy.user@mylocal.org "
(948090) Tue Sep 18 17:42:20 2018: Debug: eap_peap: Peer indicated complete TLS record size will be 126 bytes
(948089) Tue Sep 18 17:42:20 2018: Debug: } # Auth-Type eap = handled
(948091) Tue Sep 18 17:42:20 2018: Debug: suffix: Found realm "~.*$"
For the other let's say 99% who are providing the very same suffix @ mylocal.org the request is correctly proxied to the local realm (inner tunnel auth processed locally):
Debug: suffix: Looking up realm "stud.unibas.ch" for User-Name = " other.user@mylocal.org"
(946065) Tue Sep 18 17:41:41 2018: Debug: suffix: Found realm "mylocal.org "
(946065) Tue Sep 18 17:41:41 2018: Debug: suffix: Adding Realm = " mylocal.org"
(946065) Tue Sep 18 17:41:41 2018: Debug: suffix: Authentication realm is LOCAL
Interestingly it's again and again the same users are wrongly assigned to the default realm. It looks like a loop but the operator of the remote
radius server informed us no requests for @mylocal.org are seen on his side.
Thanks,
T.C.