Reverting Accept-Reject to Access-Accept
Hi, I am using Version 2.1.11 for broadband PPP authentication. I want to put the unauthenticated users to a default service. I have to revert the access-reject message to access-accept because once CISCO ISG get a access-reject from the AAA server it's terminating the ppp with access-reject. I tried to use Post-Auth-Type REJECT section of the configuration but its not working. Here is my config and some debug outputs. post-auth { Post-Auth-Type REJECT { ok update control { Auth-Type:=Accept } } } ....(AFTER SQL Lookup) [sql] User ccotesist06adsl not found ++[sql] returns notfound Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "test" [pap] No password configured for the user. Cannot do authentication ++[pap] returns fail Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} ++[ok] returns ok ++[control] returns ok Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 11 Deniz AYDIN Senior Network Engineer ----- Deniz AYDIN Senior Network Engineer -- View this message in context: http://freeradius.1045715.n5.nabble.com/Reverting-Accept-Reject-to-Access-Ac... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 16/09/11 16:59, denizaydin wrote:
Hi, I am using Version 2.1.11 for broadband PPP authentication. I want to put the unauthenticated users to a default service. I have to revert the access-reject message to access-accept because once CISCO ISG get a access-reject from the AAA server it's terminating the ppp with access-reject.
Don't do that. Instead, don't reject the in the first place. For example: authorize { ... sql if (notfound) { update control { Auth-Type := Accept } } }
On 16/09/2011 17:24, Phil Mayers wrote:
On 16/09/11 16:59, denizaydin wrote:
Hi, I am using Version 2.1.11 for broadband PPP authentication. I want to put the unauthenticated users to a default service. I have to revert the access-reject message to access-accept because once CISCO ISG get a access-reject from the AAA server it's terminating the ppp with access-reject.
Don't do that.
Instead, don't reject the in the first place. For example:
authorize {
...
sql if (notfound) { update control { Auth-Type := Accept } }
}
Above won't work since: https://github.com/alandekok/freeradius-server/commit/1a00da32c13fb979e11748... -James
Thanks a lot James, thats solved my problem with the version 2.1.12 authorize { .... Autz-Type PPPOE_SUBSCRIBER { sql if (notfound) { update control { Auth-Type := Accept } } } } [sql] User ccotesist06adsl not found ++[sql] returns notfound ++? if (notfound) ? Evaluating (notfound) -> TRUE ++? if (notfound) -> TRUE ++- entering if (notfound) {...} +++[control] returns notfound ++- if (notfound) returns notfound Found Auth-Type = Accept Auth-Type = Accept, accepting the user ----- Deniz AYDIN Senior Network Engineer -- View this message in context: http://freeradius.1045715.n5.nabble.com/Reverting-Accept-Reject-to-Access-Ac... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi, If I use Cleartext-Password in user configuration like Cleartext-Password := test the be love configuration is not working as sql returns ok even if the password is wrong. Autz-Type PPPOE_SUBSCRIBER { if (notfound) { update control { Auth-Type := Accept } update reply { Cisco-Account-Info := "AUNAUTH_PPP_SERVICE" } } } ++[sql_pppoe_subscriber] returns ok ++? if (notfound) ? Evaluating (notfound) -> FALSE ++? if (notfound) -> FALSE Found Auth-Type = PAP When I use User-Password in the user profile it works but gives warning for using User-Password instead of Cleartext-Password. rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 6 , fields = 5 WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. rlm_sql (sql_pppoe_subscriber): Released sql socket id: 3 [sql_pppoe_subscriber] User ccotesist06adsl not found ++[sql_pppoe_subscriber] returns notfound ++? if (notfound) ? Evaluating (notfound) -> TRUE ++? if (notfound) -> TRUE ++- entering if (notfound) {...} +++[control] returns notfound +++[reply] returns notfound ++- if (notfound) returns not found is this warning a real problem? ----- Deniz AYDIN Senior Network Engineer -- View this message in context: http://freeradius.1045715.n5.nabble.com/Reverting-Accept-Reject-to-Access-Ac... Sent from the FreeRadius - User mailing list archive at Nabble.com.
++[sql_pppoe_subscriber] returns ok ++? if (notfound) ? Evaluating (notfound) -> FALSE ++? if (notfound) -> FALSE
This is because SQL is not used for Authentication. There's a hack to make User-Password == 'password' work correctly with authentication modules, so it's not actually doing a comparison, so will always match.
Found Auth-Type = PAP
When I use User-Password in the user profile it works but gives warning for using User-Password instead of Cleartext-Password.
is this warning a real problem?
It's a real problem, you should be using Cleartext-Password := 'password' in radcheck. These types of hacks will not be supported in 3.0, it'll still warn you but won't fix it for you... Arran Cudbard-Bell a.cudbardb@freeradius.org Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ !
If I use the Cleartext-Password, the configuration in the Autz-Type section is not working. So I tried to put this config on Post-Auth-Type REJECT section but it's not working. It's seems that it is not possible to revert Access-Reject to Access-Accept in the post-auth section. Is the configuration wrong or is this how it's works. Post-Auth-Type REJECT { update control { Auth-Type := Accept } update reply { Cisco-Account-Info := "AUNAUTH_PPP_SERVICE" } } [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} ++[ok] returns ok ++[control] returns ok ++[reply] returns ok Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject ----- Deniz AYDIN Senior Network Engineer -- View this message in context: http://freeradius.1045715.n5.nabble.com/Reverting-Accept-Reject-to-Access-Ac... Sent from the FreeRadius - User mailing list archive at Nabble.com.
denizaydin wrote:
If I use the Cleartext-Password, the configuration in the Autz-Type section is not working.
So I tried to put this config on Post-Auth-Type REJECT section but it's not working. It's seems that it is not possible to revert Access-Reject to Access-Accept in the post-auth section.
It is not possible. Alan DeKok.
Is there any method that you can suggest for reverting Reject message? ----- Deniz AYDIN Senior Network Engineer -- View this message in context: http://freeradius.1045715.n5.nabble.com/Reverting-Accept-Reject-to-Access-Ac... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Sometimes rejecting users won't help. Cisco ISG or Cisco IOS can not apply a default service for rejected PPP user's (they only support for IP session). I now that this is not the desired solution. ----- Deniz AYDIN Senior Network Engineer -- View this message in context: http://freeradius.1045715.n5.nabble.com/Reverting-Accept-Reject-to-Access-Ac... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 29 Sep 2011, at 17:02, Alan DeKok wrote:
denizaydin wrote:
If I use the Cleartext-Password, the configuration in the Autz-Type section is not working.
So I tried to put this config on Post-Auth-Type REJECT section but it's not working. It's seems that it is not possible to revert Access-Reject to Access-Accept in the post-auth section.
It is not possible.
As Alan says it's not possible in Post-Auth, but you can do it earlier in authenticate. authenticate { Auth-Type PAP { pap { reject = 1 } if(reject){ update reply { Cisco-Account-Info := "AUNAUTH_PPP_SERVICE" } ok } } } -Arran Arran Cudbard-Bell a.cudbardb@freeradius.org Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ !
Thanks a lot, that works. ----- Deniz AYDIN Senior Network Engineer -- View this message in context: http://freeradius.1045715.n5.nabble.com/Reverting-Accept-Reject-to-Access-Ac... Sent from the FreeRadius - User mailing list archive at Nabble.com.
participants (5)
-
Alan DeKok -
Arran Cudbard-Bell -
denizaydin -
James J J Hooper -
Phil Mayers