User-Name in the Accounting log is being stripped
Hello, I am proxying non-local requests to an offshore server for authentication. Authentication process is successful but the reply log shows that User-Name is being stripped for some offshore users. I configured my detail reply_log file with the following: header = "%{Packet-Src-IP-Address} Returned from %{home_server:ipaddr} for User %{User-Name} - %t" The reply log captured shows the records below: The User-Name in the header for the reply_log shows the complete user-name whereas the user-name in the reply log record is being stripped for some reasons. As a result of this, the accounting log is showing the "stripped" user-name instead of the complete user name. Extract of reply log below: 10.255.252.248 Returned from roaming0.ja.net for User user@domain.com - Tue Apr 15 10:49:59 2014 Packet-Type = Access-Accept Tunnel-Private-Group-Id:0 = "222" User-Name = user@domain.<mailto:user@domain.> Extract of accounting log below: 10.255.252.248 - Tue Apr 15 10:50:36 2014 User-Name = "user@domain." NAS-Port = 13 NAS-IP-Address = 10.255.252.248 Framed-IP-Address = 172.21.30.255 NAS-Identifier = "XXX_WLC5" Airespace-Wlan-Id = 4 Acct-Session-Id = "534d00ec/ac:22:0b:a2:a2:b8/6564" NAS-Port-Type = Wireless-802.11 Cisco-AVPair = "audit-session-id=0afffcf800002060534d0098" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "222" Event-Timestamp = "Apr 15 2014 10:50:36 BST" Acct-Status-Type = Start Calling-Station-Id = "172.21.30.255" Called-Station-Id = "10.255.252.248" Acct-Unique-Session-Id = "948506c37df9d95c" Timestamp = 1397555436 Clement
Clement Ogedengbe wrote:
I configured my detail reply_log file with the following:
header = "%{Packet-Src-IP-Address} Returned from %{home_server:ipaddr} for User %{User-Name} - %t"
OK.
The reply log captured shows the records below: The User-Name in the header for the reply_log shows the complete user-name whereas the user-name in the reply log record is being stripped for some reasons. As a result of this, the accounting log is showing the “stripped” user-name instead of the complete user name.
This is why we say to read the debug output. It would tell you what's going on. In this case, you've edited the "reply_log" version of the detail module to add the header. You have NOT edited the "detail" module which is used by the accounting section. Do that, and the problem will be fixed. Alan DeKok.
Thanks. I am actually not using the detail file. I am using a customized "detail" section "accounting_log" defined in detail.log file. My detail.log file has the following sections: detail auth_log { detailfile = ${radacctdir}/%Y%m%d/request-detail-%H:00 header = "%{Packet-Src-IP-Address} - %t" log_packet_header = yes detailperm = 0600 suppress { User-Password } } detail reply_log { detailfile = ${radacctdir}/%Y%m%d/reply-detail header = "%{Packet-Src-IP-Address} Returned from %{home_server:ipaddr} for User %{User-Name} - %t" detailperm = 0600 } detail accounting_log { detailfile = ${radacctdir}/%Y%m%d/accounting-detail header = "%{Packet-Src-IP-Address} - %t" detailperm = 0600 } Below is extract of the accounting section in sites-enabled/default file accounting { # detail accounting_log radutmp attr_filter.accounting_response } Below is extract from reply_log for a particular user 10.255.252.248 Returned from roaming0.ja.net for User xxxxx@live.ucl.ac.uk - Tue Apr 15 10:49:59 2014 Packet-Type = Access-Accept Tunnel-Private-Group-Id:0 = "222" User-Name = "xxxxx@live.">>>>>>>>> "The user-name here is not the same as the one in the header." Below is extract from accounting-detail for the same user 10.255.252.248 - Tue Apr 15 10:50:36 2014 User-Name = "xxxxx@live." NAS-Port = 13 NAS-IP-Address = 10.255.252.248 Framed-IP-Address = 172.21.30.255 Many Thanks Clement -----Original Message----- From: freeradius-users-bounces+c.ogedengbe=worc.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+c.ogedengbe=worc.ac.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 15 April 2014 14:00 To: FreeRadius users mailing list Subject: Re: User-Name in the Accounting log is being stripped Clement Ogedengbe wrote:
I configured my detail reply_log file with the following:
header = "%{Packet-Src-IP-Address} Returned from %{home_server:ipaddr} for User %{User-Name} - %t"
OK.
The reply log captured shows the records below: The User-Name in the header for the reply_log shows the complete user-name whereas the user-name in the reply log record is being stripped for some reasons. As a result of this, the accounting log is showing the “stripped” user-name instead of the complete user name.
This is why we say to read the debug output. It would tell you what's going on. In this case, you've edited the "reply_log" version of the detail module to add the header. You have NOT edited the "detail" module which is used by the accounting section. Do that, and the problem will be fixed. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ----- No virus found in this message. Checked by AVG - www.avg.com Version: 2014.0.4569 / Virus Database: 3882/7340 - Release Date: 04/13/14
Clement Ogedengbe wrote:
I am actually not using the detail file. I am using a customized "detail" section "accounting_log" defined in detail.log file. My detail.log file has the following sections:
It would have been nice to say that in the first message.
detail accounting_log { detailfile = ${radacctdir}/%Y%m%d/accounting-detail header = "%{Packet-Src-IP-Address} - %t"
Which doesn't have the same header as the reply log.
Below is extract from reply_log for a particular user ... Below is extract from accounting-detail for the same user ...
Which you already posted. There's no need to post it again. So the problem is that the "header" for the accounting data doesn't match the header for the reply_log. Right? And this is a surprise... why? You edited the header for the reply_log module. You didn't edit the header for the accounting_log module. Alan DeKok.
Thanks. I will edit the header for the accounting_log module, but can you please clarify as you can see from the reply_log itself (ignoring the accounting log for now) that the user-name in the header (xxxxx@live.ucl.ac.uk) is not the same as the user-name in the details (xxxxx@live.) - Below is extract from reply_log for a particular user 10.255.252.248 Returned from roaming0.ja.net for User xxxxx@live.ucl.ac.uk - Tue Apr 15 10:49:59 2014 Packet-Type = Access-Accept Tunnel-Private-Group-Id:0 = "222" User-Name = "xxxxx@live.">>>>>>>>> "The user-name here is not the same as the one in the header." Many Thanks -----Original Message----- From: freeradius-users-bounces+c.ogedengbe=worc.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+c.ogedengbe=worc.ac.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 15 April 2014 15:44 To: FreeRadius users mailing list Subject: Re: User-Name in the Accounting log is being stripped Clement Ogedengbe wrote:
I am actually not using the detail file. I am using a customized "detail" section "accounting_log" defined in detail.log file. My detail.log file has the following sections:
It would have been nice to say that in the first message.
detail accounting_log { detailfile = ${radacctdir}/%Y%m%d/accounting-detail header = "%{Packet-Src-IP-Address} - %t"
Which doesn't have the same header as the reply log.
Below is extract from reply_log for a particular user ... Below is extract from accounting-detail for the same user ...
Which you already posted. There's no need to post it again. So the problem is that the "header" for the accounting data doesn't match the header for the reply_log. Right? And this is a surprise... why? You edited the header for the reply_log module. You didn't edit the header for the accounting_log module. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ----- No virus found in this message. Checked by AVG - www.avg.com Version: 2014.0.4569 / Virus Database: 3882/7340 - Release Date: 04/13/14
Clement Ogedengbe wrote:
Thanks. I will edit the header for the accounting_log module, but can you please clarify as you can see from the reply_log itself (ignoring the accounting log for now) that the user-name in the header (xxxxx@live.ucl.ac.uk) is not the same as the user-name in the details (xxxxx@live.) -
Below is extract from reply_log for a particular user 10.255.252.248 Returned from roaming0.ja.net for User xxxxx@live.ucl.ac.uk - Tue Apr 15 10:49:59 2014 Packet-Type = Access-Accept Tunnel-Private-Group-Id:0 = "222" User-Name = "xxxxx@live.">>>>>>>>> "The user-name here is not the same as the one in the header."
That is the REPLY packet from the PROXY. If you want to use that name in the detail file, edit the "header" to use it. See "man unlang" for instructions on how to refer to attributes in the proxy reply. If you think that the User-Name in the reply from the proxy is "wrong", blame the home server. it's sending the reply. Alan DeKok.
participants (2)
-
Alan DeKok -
Clement Ogedengbe