eduroam howto log failure mschapv2
I have been using a freeradius following the guides at: https://wiki.freeradius.org/guide/eduroam and https://wiki.freeradius.org/guide/eduroam-logging since quite some time, without a glitch. Sometimes we are missing the logs of failed attempts in particular in the wrong password case. We suppose that some clients prompt users to re-insert password a few times after password failure: if the user gives up and interrupts the flow, nothing is logged on the server side. We can quite simulate this issue if we modify the test script at: https://wiki.freeradius.org/guide/eduroam#testing_test-files_eapol_test-peap... and replace the line: phase2="auth=MSCHAPV2 mschapv2_retry=0" with: phase2="auth=MSCHAPV2" If you try the modified test script with a wrong password the failure is not logged. Can you help me to make the help desk happy by collecting also those logs? Can you suggest me a strategy? Do I need to log the connect packet (does it include the username?)? Is it possible to get failure log from mschap? Can you share details? Thank you, Francesco
Fix the samba parts to this and you should be good. Read : https://wiki.samba.org/index.php/Authenticating_Freeradius_against_Active_Di... Might help. Greetz, Louis
-----Oorspronkelijk bericht----- Van: Freeradius-Users [mailto:freeradius-users-bounces+belle=bazuin.nl@lists.freerad ius.org] Namens Francesco Malvezzi via Freeradius-Users Verzonden: vrijdag 28 mei 2021 9:26 Aan: freeradius-users@lists.freeradius.org CC: Francesco Malvezzi Onderwerp: eduroam howto log failure mschapv2
I have been using a freeradius following the guides at: https://wiki.freeradius.org/guide/eduroam and https://wiki.freeradius.org/guide/eduroam-logging since quite some time, without a glitch.
Sometimes we are missing the logs of failed attempts in particular in the wrong password case.
We suppose that some clients prompt users to re-insert password a few times after password failure: if the user gives up and interrupts the flow, nothing is logged on the server side.
We can quite simulate this issue if we modify the test script at: https://wiki.freeradius.org/guide/eduroam#testing_test-files_e apol_test-peap-mschapv2-conf
and replace the line: phase2="auth=MSCHAPV2 mschapv2_retry=0"
with: phase2="auth=MSCHAPV2"
If you try the modified test script with a wrong password the failure is not logged.
Can you help me to make the help desk happy by collecting also those logs?
Can you suggest me a strategy? Do I need to log the connect packet (does it include the username?)? Is it possible to get failure log from mschap? Can you share details?
Thank you,
Francesco - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On May 28, 2021, at 3:26 AM, Francesco Malvezzi via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
We suppose that some clients prompt users to re-insert password a few times after password failure: if the user gives up and interrupts the flow, nothing is logged on the server side.
i.e. if the server doesn't receive any packets, it doesn't log anything. Yes, this is what happens.
Can you help me to make the help desk happy by collecting also those logs?
It's difficult to get logs from "nothing happened".
Can you suggest me a strategy? Do I need to log the connect packet
If you want
(does it include the username?)?
What does the debug output say?
Is it possible to get failure log from mschap? Can you share details?
The debug output and the Module-Failure-Message attribute contain all the information you need. But there *won't* be any debug output for "the client never sent me a packet". That's a lot harder to do. Alan DeKok.
participants (3)
-
Alan DeKok -
Francesco Malvezzi -
L.P.H. van Belle