auth-type local trouble in 2.0.1
Hello, After update from 1.1.7 to 2.0.1 on FreeBSD 6.3 (from ports), 'users' file seems not fully read... TEST User-Password == "TEST", Auth-Type := Local Exec-Program-Wait = "/home/corp/aaa/auth_test" 1.1.7 debug: Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/corp/radacct/1.1.1.1/2008/03/auth-detail-20080321' rlm_detail: /var/corp/radacct/%{Client-IP-Address}/%Y/%m/auth-detail-%Y%m%d expands to /var/corp/radacct/1.1.1.1/2008/03/auth-detail-20080321 modcall[authorize]: module "auth_log" returns ok for request 1 users: Matched entry TEST at line 218 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password 2.0.1 debug: +- entering group authorize ++[preprocess] returns ok expand: /var/corp/radacct/%{Client-IP-Address}/%Y/%m/auth-detail-%Y%m%d -> /var/corp/radacct/1.1.1.1/2008/03/auth-detail-20080321 rlm_detail: /var/corp/radacct/%{Client-IP-Address}/%Y/%m/auth-detail-%Y%m%d expands to /var/corp/radacct/1.1.1.1/2008/03/auth-detail-20080321 expand: %t -> Fri Mar 21 17:45:57 2008 ++[auth_log] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. users: Matched entry TEST at line 218 ++[files] returns ok rad_check_password: Found Auth-Type Local auth: type Local auth: No password configured for the user Login incorrect (No password configured for the user): [TEST/TEST] (from client c3640 port 0 cli 77777777) auth: Failed to validate the user. Login incorrect: [TEST/TEST] (from client c3640 port 0 cli 7777777) Sample config files readed, web and list archive searched - no one have same problem. In 2.x configs something must be added? No one use this? Can someone: "...You should first discuss it on the users list, to see if anyone can reproduce it..." please :) or this is bug, and he must be reported?... Thanks
No, it's not a bug. All the documentation suggests not to use User-Password and not to set Auth-Type. Ivan Kalik Kalik Informatika ISP Dana 21/3/2008, "Oleg Kozheltsev" <axel@dnepr.net> piše:
Hello,
After update from 1.1.7 to 2.0.1 on FreeBSD 6.3 (from ports), 'users' file seems not fully read...
TEST User-Password == "TEST", Auth-Type := Local Exec-Program-Wait = "/home/corp/aaa/auth_test"
1.1.7 debug:
Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/corp/radacct/1.1.1.1/2008/03/auth-detail-20080321' rlm_detail: /var/corp/radacct/%{Client-IP-Address}/%Y/%m/auth-detail-%Y%m%d expands to /var/corp/radacct/1.1.1.1/2008/03/auth-detail-20080321 modcall[authorize]: module "auth_log" returns ok for request 1 users: Matched entry TEST at line 218 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password
2.0.1 debug:
+- entering group authorize ++[preprocess] returns ok expand: /var/corp/radacct/%{Client-IP-Address}/%Y/%m/auth-detail-%Y%m%d -> /var/corp/radacct/1.1.1.1/2008/03/auth-detail-20080321 rlm_detail: /var/corp/radacct/%{Client-IP-Address}/%Y/%m/auth-detail-%Y%m%d expands to /var/corp/radacct/1.1.1.1/2008/03/auth-detail-20080321 expand: %t -> Fri Mar 21 17:45:57 2008 ++[auth_log] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. users: Matched entry TEST at line 218 ++[files] returns ok rad_check_password: Found Auth-Type Local auth: type Local auth: No password configured for the user Login incorrect (No password configured for the user): [TEST/TEST] (from client c3640 port 0 cli 77777777) auth: Failed to validate the user. Login incorrect: [TEST/TEST] (from client c3640 port 0 cli 7777777)
Sample config files readed, web and list archive searched - no one have same problem. In 2.x configs something must be added? No one use this? Can someone:
"...You should first discuss it on the users list, to see if anyone can reproduce it..."
please :) or this is bug, and he must be reported?... Thanks - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hello Ivan Kalik wrote:
No, it's not a bug. All the documentation suggests not to use User-Password and not to set Auth-Type.
TEST User-Password == "TEST", Auth-Type := Local Exec-Program-Wait = "/home/corp/aaa/auth_test" ok, thx (and A.L.M.Buxey@lboro.ac.uk too), with PAP module I've been authenticated. But what about Exec-Program-Wait? I know, it was deprecated a long time. In 2.x only rlm_exec left? All my scripts written for print 3 attributes in one time. Can be 'exec' use for that some way?... Thanks again.
I don't quite get what do you want to do. Check attributes via exec program? That should still work. Only use updated attributes in the script. Ivan Kalik Kalik Informatika ISP Dana 24/3/2008, "Oleg Kozheltsev" <axel@dnepr.net> piše:
Hello
No, it's not a bug. All the documentation suggests not to use User-Password and not to set Auth-Type.
TEST User-Password == "TEST", Auth-Type := Local Exec-Program-Wait = "/home/corp/aaa/auth_test" ok, thx (and A.L.M.Buxey@lboro.ac.uk too), with PAP module I've been authenticated. But what about Exec-Program-Wait? I know, it was deprecated a long time. In 2.x only rlm_exec left? All my scripts written for print 3 attributes in one time. Can be 'exec' use for that some way?... Thanks again.
Ivan Kalik wrote: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ivan Kalik wrote:
I don't quite get what do you want to do. Check attributes via exec program? That should still work. Only use updated attributes in the script.
Ivan Kalik wrote:
No, it's not a bug. All the documentation suggests not to use User-Password and not to set Auth-Type.
TEST User-Password == "TEST", Auth-Type := Local Exec-Program-Wait = "/home/corp/aaa/auth_test" ok, thx (and A.L.M.Buxey@lboro.ac.uk too), with PAP module I've been authenticated. But what about Exec-Program-Wait? I know, it was deprecated a long time. In 2.x only rlm_exec left? All my scripts written for print 3 attributes in one time. Can be 'exec' use for that some way?... Thanks again.
Resolve problem only this way: TEST Cleartext-Password := "TEST" h323-return-code = `%{auth_call:/home/corp/aaa/auth_test h323_return_code}`, h323-prompt-id = `%{auth_call:/home/corp/aaa/auth_test h323_prompt_id}`, Cisco-AVPair = `%{auth_call:/home/corp/aaa/auth_test h323_ivr_in}` And for accounting Exec-Program don't work anymore... So I create exec acc_call { program = "" } module too (with auth_call module). Now I with freeradius 2.0.1 :)
Oleg Kozheltsev wrote:
And for accounting Exec-Program don't work anymore... So I create exec acc_call { program = "" } module too (with auth_call module). Now I with freeradius 2.0.1 :)
If you list "exec" in the "post-auth" section, then Exec-Program and Exec-Program-Wait will work again for authentication requests. But generally, you should use the "unlang" feature to run programs. It's much more flexible than using Exec-Program. See "man unlang".
TEST Cleartext-Password := "TEST" h323-return-code = `%{auth_call:/home/corp/aaa/auth_test h323_return_code}`, h323-prompt-id = `%{auth_call:/home/corp/aaa/auth_test h323_prompt_id}`, Cisco-AVPair = `%{auth_call:/home/corp/aaa/auth_test h323_ivr_in}`
This will be very inefficient. What is the program doing? Alan DeKok.
Alan DeKok wrote:
Oleg Kozheltsev wrote:
And for accounting Exec-Program don't work anymore... So I create exec acc_call { program = "" } module too (with auth_call module). Now I with freeradius 2.0.1 :)
If you list "exec" in the "post-auth" section, then Exec-Program and Exec-Program-Wait will work again for authentication requests.
But generally, you should use the "unlang" feature to run programs. It's much more flexible than using Exec-Program. See "man unlang". Thanks for clear answer. Will try this
hi, ensure you have 'pap' authentication module as the last in your list, DONT set Auth-Type:= Local alan
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Ivan Kalik -
Oleg Kozheltsev