Hi all, Question about logging. At development time normally we use radiusd -X to have an idea which module fail and see the exact error message. What about if radius is live how should I found out if a client cannot access? Best way it will be to check a log and see what's happened or not. I've tried with sql but at radpostauth table there only id, username, pass, reply, authdate. I've expanded to see vlan assignment but ok always expand sql table and the querie takes time so I switched to module linelog for testing. At Accept now get same as at sql logging with reply vlan. Access-Accept = "%t: Accepted user: %{User-Name} MAC: %{Calling-Station-Id} VLAN: %{reply:Tunnel-Private-Group-Id}" But if reject I would like to see User-Name (computer), MAC and which module fail and why Access-Reject = "%t: Rejected user: %{User-Name} MAC: %{Calling-Station-Id} module and error message " Is there a possibility? Or how did you check afterward if a client cannot access? Gruß, Best Regards, Paul
On Tue, Nov 29, 2016 at 10:39:56AM +0000, Poltorak, Paul (CT DD DS EVO O BFD TM&ISEC 1) wrote:
Access-Reject = "%t: Rejected user: %{User-Name} MAC: %{Calling-Station-Id} module and error message " Is there a possibility?
%{Module-Failure-Message} Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
%{Module-Failure-Message}
Matthew
Looks good but if i disable the computer object in the active directory the ldap module did not respond to that linelog show only Tue Nov 29 12:02:50 2016: Rejected user: host/computer01.examle.com MAC: FF-11-22-33-22-11 Next entry is Tue Nov 29 12:02:53 2016: Rejected user: ff1122332211 MAC: FF-11-22-33-22-11 No Auth-Type found: rejecting the user via Post-Auth-Type = Reject Just to know the cisco switch Is configured to dot1x if not then go to MAB if not go to default vlan 90 So I just would like to know if ldap module fail and when eap module fail both with error messages. At debug radius -X for ldap module there is this entry is it possible to get this to linelog or sql? Debug: (3) [LDAP_1] = notfound Gruß, Best Regards, Paul
On Tue, Nov 29, 2016 at 11:23:19AM +0000, Poltorak, Paul (CT DD DS EVO O BFD TM&ISEC 1) wrote:
At debug radius -X for ldap module there is this entry is it possible to get this to linelog or sql? Debug: (3) [LDAP_1] = notfound
maybe ldap if (notfound) { linelog } ? Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
hi,
Ok and where i should type in that?
you put it where you call ldap - where the radiusd -X is currently showing the notfound (so look in debug to see which section thats in - post-auth or auth etc etc
As I know linelog have to be in " Post-Auth-Type REJECT{}" to log reject messages
it can pretty much be wherever you want it to be - depending on what you wan to log. you dont have to just call the basic contsruct... make a new linelog module called eg modulelog and call modulelog with whatever contents per line that you want..... this isnt some naff commercial software with restricted methods... alan
participants (3)
-
Alan Buxey -
Matthew Newton -
Poltorak, Paul (CT DD DS EVO O BFD TM&ISEC 1)