Antw: Re: Additional NDS error messages missing in FR3 ?
Hi Arran! No, I'm not running FR 2 with -X... There is no debug enabled in the LDAP-Module in FR2 (so it defaults to 0x0000 - says the documentation). """ You know there are multiple instances of Module-Failure-Message right? Are you checking all of them.""" I don't know what you exactly mean with "multiple instances of Module-Failure-Message".... But if you mean fail, userlock, reeject, ...., than it's not there.... I have a customized msg_badpass in FR2 with: %{Module-Failure-Message} and %{reply:Reply-Message} In FR2 it is in Module-Failure for ldap, e.g. [ldap] Bind as user failed and in Reply-Message you can find: NDS error: failed authentication (-669). Or [ldap] some dn bind to some ldap server failed Server is unwilling to perform in Module-Failure and NDS error: login lockout (-197) in Reply-Message... Sorry, my last post was a bit misleading, because the detailed NDS-Error wasn't in Module-Failure, but in Reply-Message..... I checked it with FR3 with debug_reply after ldap.authenticate (called in Post-Auth for edir-policy-checking and some intruder-triggering) and it's not in the reply .... If you run with -X, it looks like this (intruder)... Tue Oct 2 15:24:19 2018 : Debug: (10) ldap: Waiting for bind result... Tue Oct 2 15:24:22 2018 : ERROR: (10) ldap: Bind credentials incorrect: Invalid credentials Tue Oct 2 15:24:22 2018 : ERROR: (10) ldap: Server said: NDS error: failed authentication (-669). Tue Oct 2 15:24:22 2018 : Debug: rlm_ldap (ldap): Released connection (1) I only want to access this ERROR-Message somehow... it does not have to be in Module-Failure-Message... In the FR2-Code I think it's for example here: https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_... https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_... https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_... I'm not quite sure were it is in FR3, perhaps it's starting here (with case error 53) (is it in extra?): https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/modules/rlm_... Sorry, not much of a C programmer myself... Ciao Anja
Arran Cudbard-Bell <a.cudbardb@freeradius.org> 29.09.2018 15:06 >>>
On Sep 27, 2018, at 4:45 PM, Anja Ruckdaeschel <Anja.Ruckdaeschel@rz.uni-regensburg.de> wrote:
Hi there!
With FR2 you could acesss the NDS error messages, e.g.
NDS error: no additional information available (-338) NDS error: failed authentication (-669) NDS error: login lockout (-197) ... and log them.
In FR3 I still can see them with ldap_debug = 0xFFFF
All I get e.g. with Module-Failure-Message is
Bind was not permitted: Server was unwilling to perform which is the LDAP Error Code 53, which is okay, but I'd really like to log the additional messages, because it's really useful...
I went through the Novell code in v2.0.x and there's no where obvious where additional messages are being printed. It's not clear exactly how you're getting logging output from the server. Are you running with -X? You know there are multiple instances of Module-Failure-Message right? Are you checking all of them. -Arran - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Oct 2, 2018, at 10:44 AM, Anja Ruckdaeschel <Anja.Ruckdaeschel@rz.uni-regensburg.de> wrote:
I don't know what you exactly mean with "multiple instances of Module-Failure-Message".... But if you mean fail, userlock, reeject, ...., than it's not there....
That's mainly in v3.
I have a customized msg_badpass in FR2 with: %{Module-Failure-Message} and %{reply:Reply-Message}
In FR2 it is in Module-Failure for ldap, e.g. [ldap] Bind as user failed and in Reply-Message you can find: NDS error: failed authentication (-669).
Yeah, that was wrong. Reply-Message shouldn't be overloaded like that.
I checked it with FR3 with debug_reply after ldap.authenticate (called in Post-Auth for edir-policy-checking and some intruder-triggering) and it's not in the reply .... If you run with -X, it looks like this (intruder)...
Tue Oct 2 15:24:19 2018 : Debug: (10) ldap: Waiting for bind result... Tue Oct 2 15:24:22 2018 : ERROR: (10) ldap: Bind credentials incorrect: Invalid credentials Tue Oct 2 15:24:22 2018 : ERROR: (10) ldap: Server said: NDS error: failed authentication (-669). Tue Oct 2 15:24:22 2018 : Debug: rlm_ldap (ldap): Released connection (1)
I only want to access this ERROR-Message somehow... it does not have to be in Module-Failure-Message...
OK, the error should be in the Module-Failure-Message attribute.
In the FR2-Code I think it's for example here: https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_... https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_... https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_...
I'm not quite sure were it is in FR3, perhaps it's starting here (with case error 53) (is it in extra?): https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/modules/rlm_...
We'll take a look at adding that back in. Alan DeKok.
Hi Alan and Arran, that sounds great. Thank you very much and have a nice day. Ciao Anja Sent from Nine ________________________________ Von: Alan DeKok <aland@deployingradius.com> Gesendet: Dienstag, 2. Oktober 2018 19:47 An: Betreff: Re: Antw: Re: Additional NDS error messages missing in FR3 ?
"Alan DeKok" <aland@deployingradius.com> 10/02/2018 19:47 >>> On Oct 2, 2018, at 10:44 AM, Anja Ruckdaeschel <Anja.Ruckdaeschel@rz.uni-regensburg.de> wrote: I don't know what you exactly mean with "multiple instances of Module-Failure-Message".... But if you mean fail, userlock, reeject, ...., than it's not there....
That's mainly in v3.
I have a customized msg_badpass in FR2 with: %{Module-Failure-Message} and %{reply:Reply-Message}
In FR2 it is in Module-Failure for ldap, e.g. [ldap] Bind as user failed and in Reply-Message you can find: NDS error: failed authentication (-669).
Yeah, that was wrong. Reply-Message shouldn't be overloaded like that.
I checked it with FR3 with debug_reply after ldap.authenticate (called in Post-Auth for edir-policy-checking and some intruder-triggering) and it's not in the reply .... If you run with -X, it looks like this (intruder)...
Tue Oct 2 15:24:19 2018 : Debug: (10) ldap: Waiting for bind result... Tue Oct 2 15:24:22 2018 : ERROR: (10) ldap: Bind credentials incorrect: Invalid credentials Tue Oct 2 15:24:22 2018 : ERROR: (10) ldap: Server said: NDS error: failed authentication (-669). Tue Oct 2 15:24:22 2018 : Debug: rlm_ldap (ldap): Released connection (1)
I only want to access this ERROR-Message somehow... it does not have to be in Module-Failure-Message...
OK, the error should be in the Module-Failure-Message attribute.
In the FR2-Code I think it's for example here: https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_... https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_... https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_...
I'm not quite sure were it is in FR3, perhaps it's starting here (with case error 53) (is it in extra?): https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/modules/rlm_...
We'll take a look at adding that back in. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I have a customized msg_badpass in FR2 with: %{Module-Failure-Message} and %{reply:Reply-Message}
In FR2 it is in Module-Failure for ldap, e.g. [ldap] Bind as user failed and in Reply-Message you can find: NDS error: failed authentication (-669).
Yeah, that was wrong. Reply-Message shouldn't be overloaded like that.
Yeah.
I checked it with FR3 with debug_reply after ldap.authenticate (called in Post-Auth for edir-policy-checking and some intruder-triggering) and it's not in the reply .... If you run with -X, it looks like this (intruder)...
Tue Oct 2 15:24:19 2018 : Debug: (10) ldap: Waiting for bind result... Tue Oct 2 15:24:22 2018 : ERROR: (10) ldap: Bind credentials incorrect: Invalid credentials Tue Oct 2 15:24:22 2018 : ERROR: (10) ldap: Server said: NDS error: failed authentication (-669).
OK, so the error message *IS* available in v3 OP just isn't accessing it.
Tue Oct 2 15:24:22 2018 : Debug: rlm_ldap (ldap): Released connection (1)
I only want to access this ERROR-Message somehow... it does not have to be in Module-Failure-Message...
OK, the error should be in the Module-Failure-Message attribute.
It is. The OP just isn't accessing the different Module-Failure-Messages. There's no code issue here, there's nothing that needs to be fixed on our side. OP use &Module-Failure-Message[0], &Module-Failure-Message[1], &Module-Failure-Message[2], etc... to get the different messages. IIRC "%{Module-Failure-Message[*]}" will get you a concatenation of all the values. i.e. update reply { Reply-Message := "%{Module-Failure-Message[*]}" } The Module-Failure-Message attributes in v3 form an error stack, with any call to REDEBUG or RERROR pushing additional messages onto the top of the stack. This lets you get the complete progression of errors.
In the FR2-Code I think it's for example here: https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_... https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_... https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_...
I'm not quite sure were it is in FR3, perhaps it's starting here (with case error 53) (is it in extra?): https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/modules/rlm_...
We'll take a look at adding that back in.
It's already included in v3 and v4. The error handling and code already deals with this. -Arran
Hi Arran, I'm so sorry, I wasn't aware this is a stack. You are of cause right and the NDS Error message is in there and I can access it. And my own debugging also only expanded Module-Failure-Message, so I didn't see it. Shame on me. It works fine now. Thank you very much again and have a nice day! Ciao Anja Sent from Nine ________________________________ Von: Arran Cudbard-Bell <a.cudbardb@freeradius.org> Gesendet: Mittwoch, 3. Oktober 2018 08:49 An: Betreff: Re: Antw: Re: Additional NDS error messages missing in FR3 ?
"Arran Cudbard-Bell" <a.cudbardb@freeradius.org> 10/03/2018 08:49 >>>
I have a customized msg_badpass in FR2 with: %{Module-Failure-Message} and %{reply:Reply-Message}
In FR2 it is in Module-Failure for ldap, e.g. [ldap] Bind as user failed and in Reply-Message you can find: NDS error: failed authentication (-669).
Yeah, that was wrong. Reply-Message shouldn't be overloaded like that.
Yeah.
I checked it with FR3 with debug_reply after ldap.authenticate (called in Post-Auth for edir-policy-checking and some intruder-triggering) and it's not in the reply .... If you run with -X, it looks like this (intruder)...
Tue Oct 2 15:24:19 2018 : Debug: (10) ldap: Waiting for bind result... Tue Oct 2 15:24:22 2018 : ERROR: (10) ldap: Bind credentials incorrect: Invalid credentials Tue Oct 2 15:24:22 2018 : ERROR: (10) ldap: Server said: NDS error: failed authentication (-669).
OK, so the error message *IS* available in v3 OP just isn't accessing it.
Tue Oct 2 15:24:22 2018 : Debug: rlm_ldap (ldap): Released connection (1)
I only want to access this ERROR-Message somehow... it does not have to be in Module-Failure-Message...
OK, the error should be in the Module-Failure-Message attribute.
It is. The OP just isn't accessing the different Module-Failure-Messages. There's no code issue here, there's nothing that needs to be fixed on our side. OP use &Module-Failure-Message[0], &Module-Failure-Message[1], &Module-Failure-Message[2], etc... to get the different messages. IIRC "%{Module-Failure-Message[*]}" will get you a concatenation of all the values. i.e. update reply { Reply-Message := "%{Module-Failure-Message[*]}" } The Module-Failure-Message attributes in v3 form an error stack, with any call to REDEBUG or RERROR pushing additional messages onto the top of the stack. This lets you get the complete progression of errors.
In the FR2-Code I think it's for example here: https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_... https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_... https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_...
I'm not quite sure were it is in FR3, perhaps it's starting here (with case error 53) (is it in extra?): https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/modules/rlm_...
We'll take a look at adding that back in.
It's already included in v3 and v4. The error handling and code already deals with this. -Arran - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi Arran, Unfortunately, I'm still having trouble to access all of the error messages..... Examples with ldap.authenticate and ldap_debug in ldap-Module in post-auth: An expired Account: res_errno: 53, res_error: <NDS error: log account expired (-220)>, res_matched: <> ldap_free_request (origid 6, msgid 6) ldap_parse_result ldap_msgfree (0) ldap: ERROR: Bind was not permitted: Server was unwilling to perform rlm_ldap (ldap): Released connection (0) An Account with Intruder Lockout: res_errno: 53, res_error: <NDS error: login lockout (-197)>, res_matched: <> ldap_free_request (origid 7, msgid 7) ldap_parse_result ldap_msgfree (22) ldap: ERROR: Bind was not permitted: Server was unwilling to perform rlm_ldap (ldap): Released connection (7) ---------------------------------------------------------------------------------------- A bad password: res_errno: 49, res_error: <NDS error: failed authentication (-669)>, res_matched: <> ldap_free_request (origid 10, msgid 10) ldap_parse_result ldap_msgfree ldap_err2string (3) ldap: ERROR: Bind credentials incorrect: Invalid credentials (3) ldap: ERROR: Server said: NDS error: failed authentication (-669). rlm_ldap (ldap): Released connection (0) An expired password with no grace logins left: res_errno: 49, res_error: <NDS error: bad password (-222)>, res_matched: <> ldap_free_request (origid 6, msgid 6) ldap_parse_result ldap_msgfree ldap_err2string (0) ldap: ERROR: Bind credentials incorrect: Invalid credentials (0) ldap: ERROR: Server said: NDS error: bad password (-222). rlm_ldap (ldap): Released connection (0) A Station Restriction for the User: res_errno: 80, res_error: <NDS error: bad station number (-253)>, res_matched: <> ldap_free_request (origid 10, msgid 10) ldap_parse_result ldap_msgfree ldap_err2string (3) ldap: ERROR: Bind with XXXX to ldap://xxxxx failed: Other (e.g., implementation specific) error (3) ldap: ERROR: Server said: NDS error: bad station number (-253). rlm_ldap (ldap): Released connection (0) So, if res_errno for example is 49 (LDAP_INVALID_CREDENTIALS) or 80 (LDAP_OTHER) you can access res_error with Module-Failure-Message. If res_errno is 53 (LDAP_PROC_NOT_PERMTTED) you cannot access res_error with Module-Failure-Message..... I only can test it with 49, 53 and 80, so I'm not sure if there is more of that kind.... Ciao Anja
"Anja Ruckdaeschel" <Anja.Ruckdaeschel@rz.uni-regensburg.de> 03.10.2018 11:32 >>> Hi Arran,
I'm so sorry, I wasn't aware this is a stack. You are of cause right and the NDS Error message is in there and I can access it. And my own debugging also only expanded Module-Failure-Message, so I didn't see it. Shame on me. It works fine now. Thank you very much again and have a nice day! Ciao Anja Sent from Nine ________________________________ Von: Arran Cudbard-Bell <a.cudbardb@freeradius.org> Gesendet: Mittwoch, 3. Oktober 2018 08:49 An: Betreff: Re: Antw: Re: Additional NDS error messages missing in FR3 ?
"Arran Cudbard-Bell" <a.cudbardb@freeradius.org> 10/03/2018 08:49 >>>
I have a customized msg_badpass in FR2 with: %{Module-Failure-Message} and %{reply:Reply-Message}
In FR2 it is in Module-Failure for ldap, e.g. [ldap] Bind as user failed and in Reply-Message you can find: NDS error: failed authentication (-669).
Yeah, that was wrong. Reply-Message shouldn't be overloaded like that.
Yeah.
I checked it with FR3 with debug_reply after ldap.authenticate (called in Post-Auth for edir-policy-checking and some intruder-triggering) and it's not in the reply .... If you run with -X, it looks like this (intruder)...
Tue Oct 2 15:24:19 2018 : Debug: (10) ldap: Waiting for bind result... Tue Oct 2 15:24:22 2018 : ERROR: (10) ldap: Bind credentials incorrect: Invalid credentials Tue Oct 2 15:24:22 2018 : ERROR: (10) ldap: Server said: NDS error: failed authentication (-669).
OK, so the error message *IS* available in v3 OP just isn't accessing it.
Tue Oct 2 15:24:22 2018 : Debug: rlm_ldap (ldap): Released connection (1)
I only want to access this ERROR-Message somehow... it does not have to be in Module-Failure-Message...
OK, the error should be in the Module-Failure-Message attribute.
It is. The OP just isn't accessing the different Module-Failure-Messages. There's no code issue here, there's nothing that needs to be fixed on our side. OP use &Module-Failure-Message[0], &Module-Failure-Message[1], &Module-Failure-Message[2], etc... to get the different messages. IIRC "%{Module-Failure-Message[*]}" will get you a concatenation of all the values. i.e. update reply { Reply-Message := "%{Module-Failure-Message[*]}" } The Module-Failure-Message attributes in v3 form an error stack, with any call to REDEBUG or RERROR pushing additional messages onto the top of the stack. This lets you get the complete progression of errors.
In the FR2-Code I think it's for example here: https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_... https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_... https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm_...
I'm not quite sure were it is in FR3, perhaps it's starting here (with case error 53) (is it in extra?): https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/modules/rlm_...
We'll take a look at adding that back in.
It's already included in v3 and v4. The error handling and code already deals with this. -Arran - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Anja Ruckdaeschel -
Arran Cudbard-Bell