I'm using Freeradius 2.1.10 and I have one problem updating reply. When I use EAP-TTLS-PAP, I have this configuration in inner-tunnel: post-auth { sql{ fail=1 } if (fail) { update reply { Codigo-Reject = Imposible-Contactar-Backend } reply_log reject } else{ reply_log } } and this configuraion in outer-tunnel: post-auth { ... Post-Auth-Type REJECT { update reply { Codigo-Reject = Credenciales-Erroneas } sql{ fail=1 } ... } If MySQL is down, post-auth inner-tunnel set Codigo-Reject = Imposible-Contactar-Backend Post-Auth-Type REJECT don't have to update the reply because I'm using "=" operator But, Post-Auth-Type REJECT set Codigo-Reject to Credenciales-Erroneas. Debug log: # Executing section post-auth from file /etc/freeradius/sites-enabled/ inner-tunnel +- entering group post-auth {...} [sql] expand: %{Stripped-User-Name} -> 02747632 [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> 02747632 [sql] sql_set_user escaped user --> '02747632' [sql] expand: INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('%{User-Name}'), LOWER('%i'), '%C', '%{reply:Packet-Type}', NOW(), '%{reply:Codigo-Reject}','radius') -> INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('02747632'), LOWER('66:77:99:B1:A0:2F'), 'PA', 'Access-Accept', NOW(), '','radius') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('02747632'), LOWER('66:77:99:B1:A0:2F'), 'PA', 'Access-Accept', NOW(), '','radius') rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): Ignoring unconnected handle 4.. ++[sql] returns fail ++? if (fail) ? Evaluating (fail) -> TRUE ++? if (fail) -> TRUE ++- entering if (fail) {...} +++[reply] returns fail [reply_log] expand: /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-reply-detail-%Y%m%d -> /var/log/freeradius/radacct/2012/03/23/10.253.40.43-reply-detail-20120323 [reply_log] /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/2012/03/23/10.253.40.43-reply-detail-20120323 [reply_log] expand: %t -> Fri Mar 23 11:59:41 2012 +++[reply_log] returns ok +++[reject] returns reject ++- if (fail) returns reject } # server inner-tunnel [ttls] Got tunneled reply code 3 Relaciones = "03" Nombre-Completo = "MARCOS" Codigo-Reject = Imposible-Contactar-Backend [ttls] Got tunneled Access-Reject [eapeduroam] Handler failed in EAP/ttls [eapeduroam] Failed in EAP select ++[eapeduroam] returns invalid Failed to authenticate the user. } # server eduroam Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/eduroam +- entering group REJECT {...} ++[reply] returns noop [sql] expand: %{Stripped-User-Name} -> 02747632 [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> 02747632 [sql] sql_set_user escaped user --> '02747632' [sql] expand: INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('%{User-Name}'), LOWER('%i'), '%C', '%{reply:Packet-Type}', NOW(), '%{reply:Codigo-Reject}','radius') -> INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('02747632'), LOWER('66:77:99:B1:A0:2F'), 'PA', 'Access-Reject', NOW(), 'Credenciales-Erroneas','radius') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('02747632'), LOWER('66:77:99:B1:A0:2F'), 'PA', 'Access-Reject', NOW(), 'Credenciales-Erroneas','radius') rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): Ignoring unconnected handle 4.. ++[sql] returns fail I don't know what I'm doing wrong :( I whould like to know wahta this mean: [eapeduroam] Handler failed in EAP/ttls [eapeduroam] Failed in EAP select ++[eapeduroam] returns invalid And, the last thing, can I do: # inner-tunnel post-auth { sql{ fail=1 } if (fail) { update reply { Codigo-Reject = Imposible-Contactar-Backend * Packet-Type := Access-Reject* } reply_log reject } Thank you very much and sorry for my english. :::::::::::::::::::::::::::::::::::: :: Ana Gallardo Gómez :: ::::::::::::::::::::::::::::::::::::
Hello again, I can't reolve my problem and I don't know if is a bug o a configuration error... update reply {
Codigo-Reject = Imposible-Contactar-Backend }
Operator = act like := ¿ideas? thanks very much :::::::::::::::::::::::::::::::::::: :: Ana Gallardo Gómez :: ::::::::::::::::::::::::::::::::::::
Ana Gallardo Gómez wrote:
I can't reolve my problem and I don't know if is a bug o a configuration error...
update reply { Codigo-Reject = Imposible-Contactar-Backend }
Is this only in Post-Auth-Type Reject?
Operator = act like :=
¿ideas?
What does "radiusd -Xxx" say ? Alan DeKok.
Hello and thank you for your response. Is this only in Post-Auth-Type Reject?
Yes because if I add this in authorize to test: ldap perl update reply { Codigo-Reject = Error-Dominio }
What does "radiusd -Xxx" say ?
the debug info with -Xxx is: Tue Mar 27 09:36:22 2012 : Info: # Executing section post-auth from file /etc/freeradius/sites-enabled/eduroam-inner-tunnel Tue Mar 27 09:36:22 2012 : Info: +- entering group post-auth {...} Tue Mar 27 09:36:22 2012 : Info: [sql] expand: %{Stripped-User-Name} -> 02747632 Tue Mar 27 09:36:22 2012 : Info: [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> 02747632 Tue Mar 27 09:36:22 2012 : Info: [sql] sql_set_user escaped user --> '02747632' Tue Mar 27 09:36:22 2012 : Info: [sql] expand: INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('%{User-Name}'), LOWER('%i'), '%C', '%{reply:Packet-Type}', NOW(), '%{reply:Codigo-Reject}','radius') -> INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('02747632'), LOWER('66:77:99:B1:A0:2F'), 'PA', 'Access-Accept', NOW(), 'Error-Dominio','radius') Tue Mar 27 09:36:22 2012 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('02747632'), LOWER('66:77:99:B1:A0:2F'), 'PA', 'Access-Accept', NOW(), 'Error-Dominio','radius') Tue Mar 27 09:36:22 2012 : Debug: rlm_sql (sql): Ignoring unconnected handle 1.. Tue Mar 27 09:36:22 2012 : Debug: rlm_sql (sql): Ignoring unconnected handle 0.. Tue Mar 27 09:36:22 2012 : Debug: rlm_sql (sql): Ignoring unconnected handle 4.. Tue Mar 27 09:36:22 2012 : Debug: rlm_sql (sql): Ignoring unconnected handle 3.. Tue Mar 27 09:36:22 2012 : Debug: rlm_sql (sql): Ignoring unconnected handle 2.. Tue Mar 27 09:36:22 2012 : Info: ++[sql] returns fail Tue Mar 27 09:36:22 2012 : Info: ++? if (fail) Tue Mar 27 09:36:22 2012 : Info: ? Evaluating (fail) -> TRUE Tue Mar 27 09:36:22 2012 : Info: ++? if (fail) -> TRUE Tue Mar 27 09:36:22 2012 : Info: ++- entering if (fail) {...} Tue Mar 27 09:36:22 2012 : Info: +++[reply] returns fail Tue Mar 27 09:36:22 2012 : Info: [reply_log] expand: /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-reply-detail-%Y%m%d -> /var/log/freeradius/radacct/2012/03/27/10.253.40.43-reply-detail-20120327 Tue Mar 27 09:36:22 2012 : Info: [reply_log] /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/2012/03/27/10.253.40.43-reply-detail-20120327 Tue Mar 27 09:36:22 2012 : Info: [reply_log] expand: %t -> Tue Mar 27 09:36:22 2012 Tue Mar 27 09:36:22 2012 : Info: +++[reply_log] returns ok Tue Mar 27 09:36:22 2012 : Info: +++[reject] returns reject Tue Mar 27 09:36:22 2012 : Info: ++- if (fail) returns reject } # server eduroam-inner-tunnel Tue Mar 27 09:36:22 2012 : Info: [ttls] Got tunneled reply code 3 Relaciones = "03" Nombre-Completo = "MARCOS" * Codigo-Reject = Error-Dominio* Tue Mar 27 09:36:22 2012 : Info: [ttls] Got tunneled Access-Reject Tue Mar 27 09:36:22 2012 : Info: [eapeduroam] Handler failed in EAP/ttls Tue Mar 27 09:36:22 2012 : Info: [eapeduroam] Failed in EAP select Tue Mar 27 09:36:22 2012 : Info: ++[eapeduroam] returns invalid Tue Mar 27 09:36:22 2012 : Info: Failed to authenticate the user. Tue Mar 27 09:36:22 2012 : Info: } # server eduroam Tue Mar 27 09:36:22 2012 : Info: Using Post-Auth-Type Reject Tue Mar 27 09:36:22 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/eduroam Tue Mar 27 09:36:22 2012 : Info: +- entering group REJECT {...} Tue Mar 27 09:36:22 2012 : Info: ++[reply] returns noop Tue Mar 27 09:36:22 2012 : Info: [sql] expand: %{Stripped-User-Name} -> 02747632 Tue Mar 27 09:36:22 2012 : Info: [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> 02747632 Tue Mar 27 09:36:22 2012 : Info: [sql] sql_set_user escaped user --> '02747632' Tue Mar 27 09:36:22 2012 : Info: [sql] expand: INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('%{User-Name}'), LOWER('%i'), '%C', '%{reply:Packet-Type}', NOW(), '%{reply:Codigo-Reject}','radius') -> INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('02747632'), LOWER('66:77:99:B1:A0:2F'), 'PA', 'Access-Reject', NOW(), 'Credenciales-Erroneas','radius') Tue Mar 27 09:36:22 2012 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('02747632'), LOWER('66:77:99:B1:A0:2F'), 'PA', 'Access-Reject', NOW(), 'Credenciales-Erroneas','radius') Tue Mar 27 09:36:22 2012 : Debug: rlm_sql (sql): Ignoring unconnected handle 1.. Tue Mar 27 09:36:22 2012 : Debug: rlm_sql (sql): Ignoring unconnected handle 0.. Tue Mar 27 09:36:22 2012 : Debug: rlm_sql (sql): Ignoring unconnected handle 4.. Tue Mar 27 09:36:22 2012 : Debug: rlm_sql (sql): Ignoring unconnected handle 3.. Tue Mar 27 09:36:22 2012 : Debug: rlm_sql (sql): Ignoring unconnected handle 2.. Tue Mar 27 09:36:22 2012 : Info: ++[sql] returns fail Tue Mar 27 09:36:22 2012 : Info: ++? if (fail) Tue Mar 27 09:36:22 2012 : Info: ? Evaluating (fail) -> TRUE Tue Mar 27 09:36:22 2012 : Info: ++? if (fail) -> TRUE Tue Mar 27 09:36:22 2012 : Info: ++- entering if (fail) {...} Tue Mar 27 09:36:22 2012 : Info: +++[reply] returns fail Tue Mar 27 09:36:22 2012 : Info: ++- if (fail) returns fail Tue Mar 27 09:36:22 2012 : Info: Delaying reject of request 42 for 1 seconds Tue Mar 27 09:36:22 2012 : Debug: Going to the next request Tue Mar 27 09:36:22 2012 : Debug: Waking up in 0.9 seconds. Tue Mar 27 09:36:23 2012 : Info: Sending delayed reject for request 42 Sending Access-Reject of id 163 to 10.253.40.43 port 1314 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 * Codigo-Reject = Credenciales-Erroneas* I don't know what is the mening of the messages: Tue Mar 27 09:36:22 2012 : Info: [eapeduroam] Handler failed in EAP/ttls Tue Mar 27 09:36:22 2012 : Info: [eapeduroam] Failed in EAP select Tue Mar 27 09:36:22 2012 : Info: ++[eapeduroam] returns invalid And, Can I do? # inner-tunnel post-auth { sql{ fail=1 } if (fail) { update reply { Codigo-Reject = Imposible-Contactar-Backend * Packet-Type := Access-Reject* } reply_log reject } Thank you for your time and sorry for my english :::::::::::::::::::::::::::::::::::: :: Ana Gallardo Gómez :: ::::::::::::::::::::::::::::::::::::
participants (2)
-
Alan DeKok -
Ana Gallardo Gómez