Ignoring failed module in post-auth
Hello list I am using freeradius server as the authenicator for our WPA2 wifi network. We are using loggining of result for every authentication request from clients to sql database through sql module in post auth section. but in case that the central mysql server (for many radius servers) is unreachable, the loggining of request was failed and the module executions returns with "++[sql] returns fail" and also whole autentication procedure fails with REJCT even if the user was successufully authenticated inside the "authenticate" section. and my question is: how is possible to make change in radiusd configuration, that in case of mysql server unreachability the user reqested access will be authenicated even of failing sql module. sql logging is the only used module in post-auth section. thanks for help -- Ing. Michal Bruncko, PhD., CCNP Linux systems and network administrator Coupled school of business and services Ruzomberok Slovak Republic
Hi,
but in case that the central mysql server (for many radius servers) is unreachable, the loggining of request was failed and the module executions returns with "++[sql] returns fail" and also whole autentication procedure fails with REJCT even if the user was successufully authenticated inside the "authenticate" section.
man unlang ok the module succeeded updated the module updated the request fail the module failed and then doc/configurable_failover you want something like post-auth { sql_log { fail = return } }
Hi Alan, thank you for reply. But I am afraid that your example is not working. According "doc/configurable_failover": "The normal configuration is "fail = return", which means "if the detail module fails, stop processing the accounting section". ..so "fail = return" is the default.. If I configure post-auth section like this: post-auth { sql { fail = return } } user autentication with unreachable mysql server will always ends with: "++[sql] returns fail Using Post-Auth-Type Reject" I have not mentioned in my first email about looking to unlang. I have looked on it, but either I dont understand or there is not that combination of "code = value" that fills for this needs (I would not sting the truth). thanks for any next hint for this michal On 10. 1. 2012 0:31, Alan Buxey wrote:
Hi,
but in case that the central mysql server (for many radius servers) is unreachable, the loggining of request was failed and the module executions returns with "++[sql] returns fail" and also whole autentication procedure fails with REJCT even if the user was successufully authenticated inside the "authenticate" section.
man unlang
ok the module succeeded updated the module updated the request fail the module failed
and then doc/configurable_failover
you want something like
post-auth {
sql_log { fail = return }
}
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Ing. Michal Bruncko, PhD., CCNP Linux systems and network administrator Coupled school of business and services Ruzomberok Slovak Republic
Hello Alan, your hint gives syntax error: "/etc/raddb/sites-enabled/default[476]: Unknown action 'ok'. /etc/raddb/sites-enabled/default[461]: Errors parsing post-auth section." post-auth { sql { fail = ok } } from the man unlang I assume, that "ok" keyword should be placed only on the left side of statement "code = value". thanks michal On 10. 1. 2012 16:52, Alan DeKok wrote:
Michal Bruncko wrote:
I have not mentioned in my first email about looking to unlang. I have looked on it, but either I dont understand or there is not that combination of "code = value" that fills for this needs (I would not sting the truth).
sql { fail = ok }
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Ing. Michal Bruncko, PhD., CCNP Linux systems and network administrator Coupled school of business and services Ruzomberok Slovak Republic
On 01/10/2012 06:40 PM, Michal Bruncko wrote:
Hello Alan,
your hint gives syntax error: "/etc/raddb/sites-enabled/default[476]: Unknown action 'ok'. /etc/raddb/sites-enabled/default[461]: Errors parsing post-auth section."
post-auth { sql { fail = ok } }
from the man unlang I assume, that "ok" keyword should be placed only on the left side of statement "code = value".
Maybe try: post-auth { redundant { sql ok } }
Hi Phil, perfect! this is working, as expected :) sql module fails, but ok is used :) many thanks! michal On 10. 1. 2012 20:51, Phil Mayers wrote:
On 01/10/2012 06:40 PM, Michal Bruncko wrote:
Hello Alan,
your hint gives syntax error: "/etc/raddb/sites-enabled/default[476]: Unknown action 'ok'. /etc/raddb/sites-enabled/default[461]: Errors parsing post-auth section."
post-auth { sql { fail = ok } }
from the man unlang I assume, that "ok" keyword should be placed only on the left side of statement "code = value".
Maybe try:
post-auth { redundant { sql ok } } - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Ing. Michal Bruncko, PhD., CCNP Linux systems and network administrator Coupled school of business and services Ruzomberok Slovak Republic
participants (4)
-
Alan Buxey -
Alan DeKok -
Michal Bruncko -
Phil Mayers