Best practices for logging in production environment?
Deployed 3.x in production the morning... and all went fine.. Thank you guys! I guess being worried of performance issues, I enabled very little logging..., just linelog, with the following config: messages { default = "Unknown packet type %{Packet-Type}" Access-Request = "%S: %{reply:Packet-Type}: u=%{User-Name} cis=%{Calling-Station-Id} cds=%{Called-Station-Id} pip=%{Packet-Src-IP-Address} nip=%{NAS-IP-Address} n=%{NAS-Identifier}" #Access-Challenge = "Sent challenge: u=%{User-Name} s=%{%{request:Calling-Station-Id}:-UnknownCSID}" } Of course, when a user is rejected, all I have is some data about where they came from, but no hints as to why we rejected them.... How do you guys log in production settings? any examples highly appreciated. Thanks a lot, Mohamed.
On Thu, Mar 26, 2015 at 05:12:11PM -0400, Mohamed Lrhazi wrote:
Of course, when a user is rejected, all I have is some data about where they came from, but no hints as to why we rejected them....
How do you guys log in production settings? any examples highly appreciated.
Add %{Module-Failure-Message} into your linelog might help? Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
No! really? this should be renamed to EasyRADIUS :) Thanks a lot, Mohamed. On Thu, Mar 26, 2015 at 5:43 PM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Thu, Mar 26, 2015 at 05:12:11PM -0400, Mohamed Lrhazi wrote:
Of course, when a user is rejected, all I have is some data about where they came from, but no hints as to why we rejected them....
How do you guys log in production settings? any examples highly appreciated.
Add %{Module-Failure-Message} into your linelog might help?
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I tested adding : %{Module-Failure-Message} for a wrong password, I get : Access-Reject: r="eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed" Which is not quite good yet :) I guess I need to learn more about logging options... Thanks a lot, Mohamed. On Thu, Mar 26, 2015 at 5:54 PM, Mohamed Lrhazi < Mohamed.Lrhazi@georgetown.edu> wrote:
No! really? this should be renamed to EasyRADIUS :)
Thanks a lot, Mohamed.
On Thu, Mar 26, 2015 at 5:43 PM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Thu, Mar 26, 2015 at 05:12:11PM -0400, Mohamed Lrhazi wrote:
Of course, when a user is rejected, all I have is some data about where they came from, but no hints as to why we rejected them....
How do you guys log in production settings? any examples highly appreciated.
Add %{Module-Failure-Message} into your linelog might help?
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I see that if run with -X, I see this log: (23) } # authenticate = invalid (23) Failed to authenticate the user. (23) Login incorrect (eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed): [ml623] (from client gu_net_141_161 port 0 cli 02-00-00-00-00-01) (23) Using Post-Auth-Type Reject (23) # Executing group from file /etc/freeradius/sites-enabled/default Is there another variable that hold the "Login incorrect" part of that message? where can I see the list of all available variables I could log? Thanks, Mohamed. On Thu, Mar 26, 2015 at 6:14 PM, Mohamed Lrhazi < Mohamed.Lrhazi@georgetown.edu> wrote:
I tested adding : %{Module-Failure-Message}
for a wrong password, I get :
Access-Reject: r="eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed"
Which is not quite good yet :) I guess I need to learn more about logging options...
Thanks a lot, Mohamed.
On Thu, Mar 26, 2015 at 5:54 PM, Mohamed Lrhazi < Mohamed.Lrhazi@georgetown.edu> wrote:
No! really? this should be renamed to EasyRADIUS :)
Thanks a lot, Mohamed.
On Thu, Mar 26, 2015 at 5:43 PM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Thu, Mar 26, 2015 at 05:12:11PM -0400, Mohamed Lrhazi wrote:
Of course, when a user is rejected, all I have is some data about where they came from, but no hints as to why we rejected them....
How do you guys log in production settings? any examples highly appreciated.
Add %{Module-Failure-Message} into your linelog might help?
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Thu, Mar 26, 2015 at 07:24:24PM -0400, Mohamed Lrhazi wrote:
I see that if run with -X, I see this log:
(23) } # authenticate = invalid (23) Failed to authenticate the user. (23) Login incorrect (eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed): [ml623] (from client gu_net_141_161 port 0 cli 02-00-00-00-00-01) (23) Using Post-Auth-Type Reject (23) # Executing group from file /etc/freeradius/sites-enabled/default
If you're logging that in the default (outer) server, try logging it from the inner-tunnel post-auth, just after you've done the actual authentication? If that comes up with what you're after, you can use unlang to copy the Module-Failure-Message to the outer request for logging there if you prefer. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Thanks Matthew. Adding it to inner-tunnel did indeed make my log: 2015-03-26 20:02:49: Access-Reject: r="mschap: MS-CHAP2-Response is incorrect" u=wire... 2015-03-26 20:02:49: Access-Reject: r="eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed" u=wire... in inner-tunel I have: post-auth { linelog #reply_log -sql Post-Auth-Type REJECT { linelog #reply_log -sql attr_filter.access_reject } } In -X, I do see: Login incorrect (mschap: MS-CHAP2-Response is incorrect): [ml623] So, ideally, I would prefer something like this in my resulting log: 2015-03-26 20:02:49: Access-Reject: r="Login incorrect (mschap: MS-CHAP2-Response is incorrect)" But this is much better than what I had started with. Thanks a lot. Mohamed. On Thu, Mar 26, 2015 at 7:42 PM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Thu, Mar 26, 2015 at 07:24:24PM -0400, Mohamed Lrhazi wrote:
I see that if run with -X, I see this log:
(23) } # authenticate = invalid (23) Failed to authenticate the user. (23) Login incorrect (eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed): [ml623] (from client gu_net_141_161 port 0 cli 02-00-00-00-00-01) (23) Using Post-Auth-Type Reject (23) # Executing group from file /etc/freeradius/sites-enabled/default
If you're logging that in the default (outer) server, try logging it from the inner-tunnel post-auth, just after you've done the actual authentication?
If that comes up with what you're after, you can use unlang to copy the Module-Failure-Message to the outer request for logging there if you prefer.
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
El 27/03/15 a las 01:12, Mohamed Lrhazi escribió:
Thanks Matthew.
Adding it to inner-tunnel did indeed make my log:
2015-03-26 20:02:49: Access-Reject: r="mschap: MS-CHAP2-Response is incorrect" u=wire... 2015-03-26 20:02:49: Access-Reject: r="eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed" u=wire...
in inner-tunel I have:
post-auth { linelog #reply_log -sql Post-Auth-Type REJECT { linelog #reply_log -sql attr_filter.access_reject } }
In -X, I do see:
Login incorrect (mschap: MS-CHAP2-Response is incorrect): [ml623]
So, ideally, I would prefer something like this in my resulting log:
2015-03-26 20:02:49: Access-Reject: r="Login incorrect (mschap: MS-CHAP2-Response is incorrect)"
You can update the Module-Failure-Message just before the linelog with something like: post-auth { Post-Auth-Type REJECT { update { Module-Failure-Message := "Login incorrect: %{Module-Failure-Message}" } } linelog ... } What I don't is if there is any variable in the response already containing the "Login incorrect" string showed with -X option.
But this is much better than what I had started with. Thanks a lot.
Mohamed.
On Thu, Mar 26, 2015 at 7:42 PM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Thu, Mar 26, 2015 at 07:24:24PM -0400, Mohamed Lrhazi wrote:
I see that if run with -X, I see this log:
(23) } # authenticate = invalid (23) Failed to authenticate the user. (23) Login incorrect (eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed): [ml623] (from client gu_net_141_161 port 0 cli 02-00-00-00-00-01) (23) Using Post-Auth-Type Reject (23) # Executing group from file /etc/freeradius/sites-enabled/default
If you're logging that in the default (outer) server, try logging it from the inner-tunnel post-auth, just after you've done the actual authentication?
If that comes up with what you're after, you can use unlang to copy the Module-Failure-Message to the outer request for logging there if you prefer.
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337
participants (3)
-
Angel L. Mateo -
Matthew Newton -
Mohamed Lrhazi