Am I missing something here or have there been changes to the behavior of passwd and unlang since 2.0.2? If you could please have a look at the configuration (migrated from 2.0.2, where it was working) and output below. The username for the request is Mac284-1. This username is NOT in the passwd-file, which explains the "Failed retrieving values required to evaluate condition" part. But then why is notfound -> FALSE? Should´nt notfound be true and the request thus be rejected? /etc/raddb/sites-enabled/default: authorize { ... maclist if (notfound) { reject } if ( mac-add !~ /%{Calling-Station-ID}/i) { reject } ... } /etc/raddb/mods-available/passwd: passwd maclist { filename = /etc/raddb/maclist format = "*User-Name:~mac-add" } /etc/raddb/maclist: Macxxx:00236C94ED49 And the output: Fri Feb 10 19:10:31 2017 : Debug: (5) suffix: No '@' in User-Name = "Mac284-1", looking up realm NULL Fri Feb 10 19:10:31 2017 : Debug: (5) suffix: No such realm "NULL" Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: returned from suffix (rlm_realm) Fri Feb 10 19:10:31 2017 : Debug: (5) [suffix] = noop Fri Feb 10 19:10:31 2017 : Debug: (5) if (Called-Station-ID =~ /:test$/) { Fri Feb 10 19:10:31 2017 : Debug: No matches Fri Feb 10 19:10:31 2017 : Debug: Adding 1 matches Fri Feb 10 19:10:31 2017 : Debug: (5) if (Called-Station-ID =~ /:test$/) -> TRUE Fri Feb 10 19:10:31 2017 : Debug: (5) if (Called-Station-ID =~ /:test$/) { Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: calling eap (rlm_eap) Fri Feb 10 19:10:31 2017 : Debug: (5) eap: Peer sent EAP Response (code 2) ID 6 length 1276 Fri Feb 10 19:10:31 2017 : Debug: (5) eap: No EAP Start, assuming it's an on-going EAP conversation Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: returned from eap (rlm_eap) Fri Feb 10 19:10:31 2017 : Debug: (5) [eap] = updated Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: calling files (rlm_files) Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: returned from files (rlm_files) Fri Feb 10 19:10:31 2017 : Debug: (5) [files] = noop Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: calling maclist (rlm_passwd) Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: returned from maclist (rlm_passwd) Fri Feb 10 19:10:31 2017 : Debug: (5) [maclist] = ok Fri Feb 10 19:10:31 2017 : Debug: (5) if (notfound) { Fri Feb 10 19:10:31 2017 : Debug: (5) if (notfound) -> FALSE Fri Feb 10 19:10:31 2017 : Debug: (5) if ( mac-add !~ /%{Calling-Station-ID}/i) { Fri Feb 10 19:10:31 2017 : ERROR: (5) Failed retrieving values required to evaluate condition
On 10 Feb 2017, at 17:22, macservo via Freeradius-Users <Freeradius-Users@lists.freeradius.org> wrote:
Am I missing something here or have there been changes to the behavior of passwd and unlang since 2.0.2?
Between 2.0 and what? This will be in 3.0.13; perhaps that's the cause: https://github.com/FreeRADIUS/freeradius-server/commit/7d21f129475ec592f243b... Regards, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
Hi Adam,
Between 2.0 and what? 3.0.12
This will be in 3.0.13; perhaps that's the cause:
Certainly looks promising. Thx for the hint 2017-02-10 19:09 GMT+01:00 Adam Bishop <Adam.Bishop@jisc.ac.uk>:
On 10 Feb 2017, at 17:22, macservo via Freeradius-Users <Freeradius-Users@lists.freeradius.org> wrote:
Am I missing something here or have there been changes to the behavior of passwd and unlang since 2.0.2?
Between 2.0 and what?
This will be in 3.0.13; perhaps that's the cause: https://github.com/FreeRADIUS/freeradius-server/commit/7d21f129475ec592f243b...
Regards,
Adam Bishop
gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460
jisc.ac.uk
Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hello Adam, 2017-02-10 19:09 GMT+01:00 Adam Bishop <Adam.Bishop@jisc.ac.uk>:
This will be in 3.0.13; perhaps that's the cause: https://github.com/FreeRADIUS/freeradius-server/commit/7d21f129475ec592f243b...
Confirmed. The description of the change is pretty clear: "return RLM_MODULE_NOTFOUND if nothing was found" After using the passwd-module of 3.0.13, the configuration works as expected. Thank you very much.
participants (2)
-
Adam Bishop -
macservo