Hi, I'm trying to find a way to log EAP requests and responses on an IdP in such way that the inner and outer identity of a request end up on one line; using linelog via f_ticks I managed to get a slightly more concise logging going than the detail level in accounting messages. But I'd like to be able to correlate the two, and am struggling to do so. Is there a way to e.g. pass information from the outer processing on to the inner so I can log both from there, rather than logging both identities individually? While it's feasible to have both when there's not much authentication traffic happening trying to correlate events if there are several within the same time-frame might become impossible. Cheers, Andrej
On 27 Aug 2013, at 17:59, Andrej <andrej.groups@gmail.com> wrote:
Hi,
I'm trying to find a way to log EAP requests and responses on an IdP in such way that the inner and outer identity of a request end up on one line; using linelog via f_ticks I managed to get a slightly more concise logging going than the detail level in accounting messages. But I'd like to be able to correlate the two, and am struggling to do so.
Is there a way to e.g. pass information from the outer processing on to the inner so I can log both from there, rather than logging both identities individually? While it's feasible to have both when there's not much authentication traffic happening trying to correlate events if there are several within the same time-frame might become impossible.
Sure. Just pull in outer.User-Name in your format string, and call it from the inner server. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On 28 August 2013 05:09, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote: Hi Arran,
Is there a way to e.g. pass information from the outer processing on to the inner so I can log both from there, rather than logging both identities individually? While it's feasible to have both when there's not much authentication traffic happening trying to correlate events if there are several within the same time-frame might become impossible.
Sure. Just pull in outer.User-Name in your format string, and call it from the inner server.
Cool - I'll give that a go. Is there a comprehensive list anywhere of which kind of values is permissible in which context?
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
Cheers, Andrej
Andrej wrote:
Cool - I'll give that a go. Is there a comprehensive list anywhere of which kind of values is permissible in which context?
See the debug output. If it's in the debug output, you can use it. If it's not in the debug output, it doesn't exist. And you can't use it. You can always reference the outer tunnel from the inner one. Alan DeKok.
On 28 August 2013 09:09, Alan DeKok <aland@deployingradius.com> wrote:
See the debug output. If it's in the debug output, you can use it. If it's not in the debug output, it doesn't exist. And you can't use it.
You can always reference the outer tunnel from the inner one.
OK. So, I found a couple of *key* statements in the debug output; and running the server with -X gives me [f_ticks] expand: %{proxy-reply:Packet-Type} -> [f_ticks] ... expanding second conditional [f_ticks] expand: f_ticks.%{%{proxy-reply:Packet-Type}:-format} -> f_ticks.format WARNING: No such configuration item .f_ticks.format [f_ticks] No such entry ".f_ticks.format" ++[f_ticks] returns noop But I don't seem to be writing any output at all from the f_ticks module (whether in debug mode or not). It looks like this: linelog f_ticks { filename = ${logdir}/f-ticks format = "%{outer.User-Name}#%{User-Name}#%{Packet-Src-IP-Address}#" reference = "f_ticks.%{%{proxy-reply:Packet-Type}:-format}" f_ticks { Access-Accept = "F-TICKS/eduroam/1.0#REALM=%{Realm}#VISCOUNTRY=EU#VISINST=%{Operator-Name}#CSI=%{Calling-Station-Id}#RESULT=OK#" Access-Reject = "F-TICKS/eduroam/1.0#REALM=%{Realm}#VISCOUNTRY=EU#VISINST=%{Operator-Name}#CSI=%{Calling-Station-Id}#RESULT=FAIL#" } }
Alan DeKok.
Cheers, Andrej
participants (3)
-
Alan DeKok -
Andrej -
Arran Cudbard-Bell