log message when logintime returns userlock?
HI list, I just set up the 'logintime' module. It works great - no problem there. I wanted to add one last thing - log when the user tries to login outside of allowed timeframe. It seemed easy to do: If the 'logintime' module returns 'userlock', I will just call the linelog module. post-auth { ... logintime if (userlock) { log_locked_by_logintime } ... } But this does not do what I expected. After logintime returns 'userlock', nothing else following in post-auth section is called. Snippet from debug: (9) } # policy assign_vlan = noop (9) logintime: Checking Login-Time (9) [logintime] = userlock (9) } # if (1) = userlock (9) } # post-auth = userlock (9) Using Post-Auth-Type Reject Technically it's inside of the if (1) {} condition, I have tried to move it outside of it, but the behavior was the same. Is this expected? Is there some trick how I can call the linelog in case of userlock? Due to the length of it, I have put full debug log here: https://up.jvi.cz/log_logintime.log Josef
On 16/05/2022 15:11, Josef Vybíhal wrote:
post-auth { ... logintime if (userlock) { log_locked_by_logintime } ... }
But this does not do what I expected. After logintime returns 'userlock', nothing else following in post-auth section is called. Snippet from debug:
(9) } # policy assign_vlan = noop (9) logintime: Checking Login-Time (9) [logintime] = userlock (9) } # if (1) = userlock (9) } # post-auth = userlock (9) Using Post-Auth-Type Reject
Default behaviour for userlock os "reject". See https://wiki.freeradius.org/config/Fail%20over
Is this expected? Is there some trick how I can call the linelog in case of userlock?
The module return priority for userlock needs to be changed if you want to catch it. Try: logintime { userlock = 1 } if (userlock) { ... } There are examples on the wiki page above. -- Matthew
Thanks Matthew for pointing me in the right direction. I was close, I have tried logintime { userlock = return } after my post to the list. Now I know why that did not work. logintime { userlock = 1 } if (userlock) { log_locked_by_logintime reject } This works as I wished. J. On Mon, May 16, 2022 at 5:34 PM Matthew Newton <mcn@freeradius.org> wrote:
Default behaviour for userlock os "reject". See
https://wiki.freeradius.org/config/Fail%20over
Is this expected? Is there some trick how I can call the linelog in case of userlock?
The module return priority for userlock needs to be changed if you want to catch it. Try:
logintime { userlock = 1 } if (userlock) { ... }
There are examples on the wiki page above.
-- Matthew - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Josef Vybíhal -
Matthew Newton