user specific settings in users file overwritten by DEFAULT settings?
I have a user specified in my users file like this: isdn Auth-Type = System Service-Type = Framed, Framed-Protocol = MPP, Framed-Routing = None, Ascend-Maximum-Time = 18000, Ascend-Idle-Limit = 900, Ascend-Assign-IP-Pool = 0, Ascend-Maximum-Channels = 2, Fall-Through = "1" Then at the bottom of the file I have: DEFAULT Auth-Type = System Fall-Through = 1 DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP, Ascend-Maximum-Time = 18000, Idle-Timeout = 900 When I authenticate as this user, I see: Thu Aug 17 13:18:26 2006 : Debug: users: Matched isdn at 21 Thu Aug 17 13:18:26 2006 : Debug: users: Matched DEFAULT at 133 Thu Aug 17 13:18:26 2006 : Debug: users: Matched DEFAULT at 135 Thu Aug 17 13:18:26 2006 : Debug: users: Matched DEFAULT at 140 Thu Aug 17 13:18:26 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 5 Thu Aug 17 13:18:26 2006 : Debug: modcall[authorize]: module "files" returns ok for request 5 Thu Aug 17 13:18:26 2006 : Debug: modcall: group authorize returns ok for request 5 Thu Aug 17 13:18:26 2006 : Debug: rad_check_password: Found Auth-Type System Thu Aug 17 13:18:26 2006 : Debug: auth: type "System" Thu Aug 17 13:18:26 2006 : Debug: Processing the authenticate section of radiusd.conf Thu Aug 17 13:18:26 2006 : Debug: modcall: entering group authenticate for request 5 Thu Aug 17 13:18:26 2006 : Debug: modsingle[authenticate]: calling unix (rlm_unix) for request 5 Thu Aug 17 13:18:26 2006 : Debug: HASH: user isdn found in hashtable bucket 59493 Thu Aug 17 13:18:26 2006 : Debug: modsingle[authenticate]: returned from unix (rlm_unix) for request 5 Thu Aug 17 13:18:26 2006 : Debug: modcall[authenticate]: module "unix" returns ok for request 5 Thu Aug 17 13:18:26 2006 : Debug: modcall: group authenticate returns ok for request 5 Thu Aug 17 13:18:26 2006 : Auth: Login OK: [isdn/8293] (from client 192.168.0.3 port 1060 cli 6143677963) Sending Access-Accept of id 2 to 192.168.0.3:7010 Service-Type = Framed-User Framed-Routing = None Ascend-Maximum-Time = 18000 Ascend-Idle-Limit = 900 Ascend-Assign-IP-Pool = 0 Ascend-Maximum-Channels = 2 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Idle-Timeout = 900 Can anyone tell me why the radius server is ignoring the isdn entry in the users file and instead returning the DEFAULT entry? Thanks, Andrew
"Drew Weaver" <drew.weaver@thenap.com> wrote:
Can anyone tell me why the radius server is ignoring the isdn entry in the users file and instead returning the DEFAULT entry?
It's not. The debug output you posted shows it IS matching the isdn entry, but that it is ALSO matching the later DEFAULT entries. So the later entries over-ride the values you set earlier. The most likely solution is for you to remove the 'Fall-Through = 1' from the isdn entry. That way it won't continue. See the "man" page. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
I'm probably wrong but didn't it used to be that the fall-through command was to tell the users file to continue processing if it didn't find a match? -Drew -----Original Message----- From: freeradius-users-bounces+drew.weaver=thenap.com@lists.freeradius.org [mailto:freeradius-users-bounces+drew.weaver=thenap.com@lists.freeradius .org] On Behalf Of Alan DeKok Sent: Thursday, August 17, 2006 1:37 PM To: FreeRadius users mailing list Subject: Re: user specific settings in users file overwritten by DEFAULTsettings? "Drew Weaver" <drew.weaver@thenap.com> wrote:
Can anyone tell me why the radius server is ignoring the isdn entry in the users file and instead returning the DEFAULT entry?
It's not. The debug output you posted shows it IS matching the isdn entry, but that it is ALSO matching the later DEFAULT entries. So the later entries over-ride the values you set earlier. The most likely solution is for you to remove the 'Fall-Through = 1' from the isdn entry. That way it won't continue. See the "man" page. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
I'm probably wrong but didn't it used to be that the fall-through command was to tell the users file to continue processing if it didn't find a match?
You're wrong. It was about continuing _even though_ it found a match. Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473
"Drew Weaver" <drew.weaver@thenap.com> wrote:
I'm probably wrong but didn't it used to be that the fall-through command was to tell the users file to continue processing if it didn't find a match?
Nope. The reply items are looked at ONLY if there's a match, so Fall-Through is looked at only if there's a match. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Hi,
Can anyone tell me why the radius server is ignoring the isdn entry in the users file and instead returning the DEFAULT entry?
All of your entries specify Fall-Through = 1 / Yes (which is the same, AFAIK). So, the entries of isdn get read, but then overwritten by the later DEFAULT matches. If you don't want that to happen, remove the Fall-Through line in the isdn user. Then processing will stop directly after isdn has matched, and its contents will be used. Greetings, Stefan Winter -- Stefan WINTER Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche - Ingénieur de recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg
participants (3)
-
Alan DeKok -
Drew Weaver -
Stefan Winter