FreeRADIUS accounting to multiple destinations
Hi to all, I'm using two fortigate instances in gcp for redundancy. Because of google restrictions I can't use them in HA mode so load-balancing does the trick for me. I have identical access policies on fortigates based on user group. User group is delivered to fortigates by RSSO (RADIUS SSO) by sending to them accounting packets. I use two FreeRADIUS 3.0.15 servers on Ubuntu 16.04 I have 3 LDAP modules for 3 LDAP servers in redundant-load-balance mode User can be in several groups so I edited /etc/freeradius/mods-config/files/pre-proxy to reflect group needed for me to assign access to user in Reply-Message attribute: DEFAULT ldap01-LDAP-Group == "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" Reply-Message := hr DEFAULT ldap02-LDAP-Group == "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" Reply-Message := hr DEFAULT ldap03-LDAP-Group == "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" Reply-Message := hr proxy.conf contains two pools with one server in it (fortigates which receive accounting packets) and two realms: home_server fortigate-vm01 { type = acct ipaddr = 10.10.15.192 ... } home_server fortigate-vm02 { type = acct ipaddr = 10.10.0.59 ... } home_server_pool fortigate-vm02 { home_server = fortigate-vm02 } home_server_pool fortinet-vms { home_server = fortigate-vm01 } realm DEFAULT { acct_pool = fortinet-vms } realm fortigate02 { acct_pool = fortigate-vm02 And I've enabled replicate module in server configuration: /etc/freeradius/sites-enabled/default: ... preacct { ... files *#(this enables sending reply with group name in Reply-Message attribute)* ... } accounting { ... replicate update control { Replicate-To-Realm := fortigate02 *#(this copies my accounting to second fortigate)* } ... } Finally, my problem. The problem is that I see accounting copy on second fortigate, *but without groups*. I realize that I replicate accounting to new realm and my pre-proxy file will not work for it so that't why I included in pre-proxy second file with that realm: /etc/freeradius/mods-config/files/pre-proxy: $INCLUDE /etc/freeradius/mods-config/files/pre-proxy.fortigate02 /etc/freeradius/mods-config/files/pre-proxy.fortigate02: fortigate02 ldap01-LDAP-Group == "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" Reply-Message := hr fortigate02 ldap02-LDAP-Group == "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" Reply-Message := hr fortigate02 ldap03-LDAP-Group == "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" Reply-Message := hr And this should work (I think). Or not? Tell me please, is my idea right for things I want to do? Should I use replicate module in accounting (as it's said in module description) or in preacct (besause i do group filtering and group attribute assigning in it)? Thanks. Best regards, Alex Morozenko
On Jul 24, 2018, at 8:42 AM, Алексей Морозенко <alexmorozenko@gmail.com> wrote:
I'm using two fortigate instances in gcp for redundancy. Because of google restrictions I can't use them in HA mode so load-balancing does the trick for me. I have identical access policies on fortigates based on user group. User group is delivered to fortigates by RSSO (RADIUS SSO) by sending to them accounting packets. I use two FreeRADIUS 3.0.15 servers on Ubuntu 16.04 I have 3 LDAP modules for 3 LDAP servers in redundant-load-balance mode User can be in several groups so I edited /etc/freeradius/mods-config/files/pre-proxy to reflect group needed for me to assign access to user in Reply-Message attribute: ... preacct { ... files *#(this enables sending reply with group name in Reply-Message attribute)*
Note that it adds attributes to the *reply*.
accounting { ... replicate update control { Replicate-To-Realm := fortigate02 *#(this copies my accounting to second fortunate)*
That replicates the *request* to the home server. Since the request isn't the reply, the request doesn't contain the attributes you added. You have to add the attributes to the *request* in order for them to be proxied (or replicated) to a home server.
Finally, my problem. The problem is that I see accounting copy on second fortigate, *but without groups*.
Yes. That's what you configured it to do.
I realize that I replicate accounting to new realm and my pre-proxy file will not work for it so that't why I included in pre-proxy second file with that realm:
The "replicate" module doesn't run the "pre-proxy" section. The documentation and debug output makes this clear.
And this should work (I think). Or not? Tell me please, is my idea right for things I want to do?
Do you want the replicated request to contain attributes? Then add the attributes to the request. Alan DeKok.
24 июля 2018 г., в 17:35, Alan DeKok <aland@deployingradius.com> написал(а):
On Jul 24, 2018, at 8:42 AM, Алексей Морозенко <alexmorozenko@gmail.com> wrote:
I'm using two fortigate instances in gcp for redundancy. Because of google restrictions I can't use them in HA mode so load-balancing does the trick for me. I have identical access policies on fortigates based on user group. User group is delivered to fortigates by RSSO (RADIUS SSO) by sending to them accounting packets. I use two FreeRADIUS 3.0.15 servers on Ubuntu 16.04 I have 3 LDAP modules for 3 LDAP servers in redundant-load-balance mode User can be in several groups so I edited /etc/freeradius/mods-config/files/pre-proxy to reflect group needed for me to assign access to user in Reply-Message attribute: ... preacct { ... files *#(this enables sending reply with group name in Reply-Message attribute)*
Note that it adds attributes to the *reply*.
I'm incorrect telling «reply», I mean after successfull authorization NAS sends accounting request to my RADIUS and then RADIUS proxies that request to FG-1 and FG-2 Doesn't matter what's it's name, by using files in preacct (pre-proxy) I insert additional attribute «Reply-Message» containing group name in accounting REQUEST from NAS. And further this modified accounting request being proxied to forti according realms. Am I right?
accounting { ... replicate update control { Replicate-To-Realm := fortigate02 *#(this copies my accounting to second fortunate)*
That replicates the *request* to the home server.
Since the request isn't the reply, the request doesn't contain the attributes you added.
You have to add the attributes to the *request* in order for them to be proxied (or replicated) to a home server.
Now it's clear for me. I should add replicate module and update control in accounting section
Finally, my problem. The problem is that I see accounting copy on second fortigate, *but without groups*.
Yes. That's what you configured it to do.
I realize that I replicate accounting to new realm and my pre-proxy file will not work for it so that't why I included in pre-proxy second file with that realm:
The "replicate" module doesn't run the "pre-proxy" section. The documentation and debug output makes this clear.
Too much debug, production system, second forti appeared unexpectedly, i didn't see that ( Will try viewing it at non-business time
And this should work (I think). Or not? Tell me please, is my idea right for things I want to do?
Do you want the replicated request to contain attributes? Then add the attributes to the request.
Wait. Do you mean I should use /etc/freeradius/mods-config/files/accounting for that?
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 24, 2018, at 12:49 PM, Алексей Морозенко <alexmorozenko@gmail.com> wrote:
I'm incorrect telling «reply», I mean after successfull authorization NAS sends accounting request to my RADIUS and then RADIUS proxies that request to FG-1 and FG-2
OK.
Doesn't matter what's it's name, by using files in preacct (pre-proxy) I insert additional attribute «Reply-Message» containing group name in accounting REQUEST from NAS. And further this modified accounting request being proxied to forti according realms. Am I right?
Yes. But only for PROXIED packets. The "pre-proxy" section doesn't change the *original* packet. And the "replicate" module only sends copies of the ORIGINAL packet. So you have to edit the original packet before calling replicate. Alan DeKok.
I think it should be very simple preacct { ... files # /etc/freeradius/mods-config/files/accounting searches for LDAP group (DEFAULT ldap01-LDAP-Group == "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan", Filter-Id := accounting) and adds Filter-Id # attribute containing group name to the request (I've changed attribute name to avoid misunderstanding. Of course, i've enabled rfc2865 dictionary). Is it the right way to modify original packet? replicate # enable replication module update { control:Replicate-To-Realm := fortigate02 # replicate modified accounting request to FG-2 } } But it seems to be non-working : (14) Received Accounting-Request Id 22 from 10.0.5.71:64245 to 10.132.15.206:1813 length 218 (14) Acct-Status-Type = Start (14) NAS-IP-Address = 10.0.5.71 (14) User-Name = "alex" (14) NAS-Port = 0 (14) NAS-Port-Type = Wireless-802.11 (14) Calling-Station-Id = "a8667f23c53e" (14) Called-Station-Id = "3817c3c13fa8" (14) Framed-IP-Address = 10.0.20.210 (14) Acct-Multi-Session-Id = "A8667F23C53E-1532621349" (14) Acct-Session-Id = "3817C393FA90-A8667F23C53E-5B5A3C05-C1D30" (14) Acct-Delay-Time = 0 (14) Aruba-Essid-Name = "team" (14) Aruba-Location-Id = "Floor1-Main" (14) Aruba-User-Vlan = 20 (14) Aruba-Device-Type = "OS X" (14) Acct-Authentic = RADIUS (14) # Executing section preacct from file /etc/freeradius/sites-enabled/default (14) preacct { (14) [preprocess] = ok (14) policy acct_unique { (14) update request { (14) &Tmp-String-9 := "ai:" (14) } # update request = noop (14) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (14) EXPAND %{hex:&Class} (14) --> (14) EXPAND ^%{hex:&Tmp-String-9} (14) --> ^61693a (14) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (14) else { (14) update request { (14) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (14) --> 910afd2bf35840c31321ab5e1da2ca47 (14) &Acct-Unique-Session-Id := 910afd2bf35840c31321ab5e1da2ca47 (14) } # update request = noop (14) } # else = noop (14) } # policy acct_unique = noop (14) suffix: Checking for suffix after "@" (14) suffix: No '@' in User-Name = "alex", looking up realm NULL (14) suffix: Found realm "DEFAULT" (14) suffix: Adding Stripped-User-Name = "alex" (14) suffix: Adding Realm = "DEFAULT" (14) suffix: Proxying request from user alex to realm DEFAULT (14) suffix: Preparing to proxy accounting request to realm "DEFAULT" (14) [suffix] = updated (14) files: Searching for user in group "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap01): Reserved connection (1) (14) files: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (14) files: --> (uid=alex) (14) files: Performing search in "cn=users,cn=accounts,dc=office,dc=lan" with filter "(uid=alex)", scope "sub" (14) files: Waiting for search result... (14) files: User object found at DN "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap01): Released connection (1) (14) files: User is not a member of "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap02): Reserved connection (4) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap02): Released connection (4) (14) files: User is not a member of "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap03): Reserved connection (4) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap03): Released connection (4) (14) files: User is not a member of "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap01): Reserved connection (6) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap01): Released connection (6) (14) files: User is not a member of "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap02): Reserved connection (5) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap02): Released connection (5) (14) files: User is not a member of "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap03): Reserved connection (5) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap03): Released connection (5) (14) files: User is not a member of "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap01): Reserved connection (7) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap01): Released connection (7) (14) files: User is not a member of "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap02): Reserved connection (3) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap02): Released connection (3) (14) files: User is not a member of "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap03): Reserved connection (3) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap03): Released connection (3) (14) files: User is not a member of "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap01): Reserved connection (5) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap01): Released connection (5) (14) files: User is not a member of "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap02): Reserved connection (0) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap02): Released connection (0) (14) files: User is not a member of "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap03): Reserved connection (0) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap03): Released connection (0) (14) files: User is not a member of "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap03): Reserved connection (5) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=dmp,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap03): Released connection (5) (14) files: User is not a member of "cn=dmp,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap01): Reserved connection (2) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: User found in group object "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap01): Released connection (2) (14) files: acct_users: Matched entry DEFAULT at line 156 (14) [files] = ok (14) } # preacct = updated (14) # Executing section accounting from file /etc/freeradius/sites-enabled/default (14) accounting { (14) detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (14) detail: --> /var/log/freeradius/radacct/10.0.5.71/detail-20180726 (14) detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.0.5.71/detail-20180726 (14) detail: EXPAND %t (14) detail: --> Thu Jul 26 21:24:21 2018 (14) [detail] = ok (14) [replicate] = noop (14) update { (14) control:Replicate-To-Realm := fortigate02 (14) } # update = noop (14) [unix] = ok (14) [exec] = noop (14) attr_filter.accounting_response: EXPAND %{User-Name} (14) attr_filter.accounting_response: --> alex (14) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (14) [attr_filter.accounting_response] = updated (14) } # accounting = updated (14) Starting proxy to home server 10.132.15.192 port 1813 (14) Proxying request to home server 10.132.15.192 port 1813 timeout 30.000000 (14) Sent Accounting-Request Id 148 from 0.0.0.0:42612 to 10.132.15.192:1813 length 228 (14) Acct-Status-Type = Start (14) NAS-IP-Address = 10.0.5.71 (14) User-Name = "alex" (14) NAS-Port = 0 (14) NAS-Port-Type = Wireless-802.11 (14) Calling-Station-Id = "a8667f23c53e" (14) Called-Station-Id = "3817c3c13fa8" (14) Framed-IP-Address = 10.0.20.210 (14) Acct-Multi-Session-Id = "A8667F23C53E-1532621349" (14) Acct-Session-Id = "3817C393FA90-A8667F23C53E-5B5A3C05-C1D30" (14) Acct-Delay-Time = 0 (14) Aruba-Essid-Name = "team" (14) Aruba-Location-Id = "Floor1-Main" (14) Aruba-User-Vlan = 20 (14) Aruba-Device-Type = "OS X" (14) Acct-Authentic = RADIUS (14) Event-Timestamp = "Jul 26 2018 21:24:21 UTC" (14) Proxy-State = 0x3232 Waking up in 0.2 seconds. (14) Clearing existing &reply: attributes (14) Received Accounting-Response Id 148 from 10.132.15.192:1813 to 10.132.15.206:42612 length 24 (14) Proxy-State = 0x3232 (14) # Executing section post-proxy from file /etc/freeradius/sites-enabled/default (14) post-proxy { (14) eap: No pre-existing handler found (14) [eap] = noop (14) } # post-proxy = noop (14) Sent Accounting-Response Id 22 from 10.132.15.206:1813 to 10.0.5.71:64245 length 0 (14) Finished request (14) Cleaning up request packet ID 22 with timestamp +54 Waking up in 4.4 seconds. As I can see, original packet is modified : (14) files: acct_users: Matched entry DEFAULT at line 156 (14) [files] = ok (14) } # preacct = updated ) But not replicated : (14) [replicate] = noop (14) update { (14) control:Replicate-To-Realm := fortigate02 (14) } # update = noop Tell me please what could be a reason? I cannot figure it out -- Best regards, Alex Morozenko вт, 24 лип. 2018 о 20:00 Alan DeKok <aland@deployingradius.com> пише:
On Jul 24, 2018, at 12:49 PM, Алексей Морозенко <alexmorozenko@gmail.com> wrote:
I'm incorrect telling «reply», I mean after successfull authorization
NAS sends accounting request to my RADIUS and then RADIUS proxies that request to FG-1 and FG-2
OK.
Doesn't matter what's it's name, by using files in preacct (pre-proxy) I insert additional attribute «Reply-Message» containing group name in accounting REQUEST from NAS. And further this modified accounting request being proxied to forti according realms. Am I right?
Yes. But only for PROXIED packets. The "pre-proxy" section doesn't change the *original* packet.
And the "replicate" module only sends copies of the ORIGINAL packet.
So you have to edit the original packet before calling replicate.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I did the next thing First, I've changed order in preacct in a such way: preacct { ... files update { control:Replicate-To-Realm := fortigate02 # replicate modified accounting request to FG-2 } replicate } and replicate worked (Now I can see message: replicate: Replicating list 'request' to Realm 'fortigate02') But still without groups. Then I've decided to try add group check in preprocess (hints) And it's working! But I cannot understand why. Could you please explain me? -- Best regards, Alex Morozenko пт, 27 лип. 2018 о 11:36 Алексей Морозенко <alexmorozenko@gmail.com> пише:
I think it should be very simple
preacct { ... files # /etc/freeradius/mods-config/files/accounting searches for LDAP group (DEFAULT ldap01-LDAP-Group == "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan", Filter-Id := accounting) and adds Filter-Id # attribute containing group name to the request (I've changed attribute name to avoid misunderstanding. Of course, i've enabled rfc2865 dictionary). Is it the right way to modify original packet?
replicate # enable replication module
update { control:Replicate-To-Realm := fortigate02 # replicate modified accounting request to FG-2 } }
But it seems to be non-working :
(14) Received Accounting-Request Id 22 from 10.0.5.71:64245 to 10.132.15.206:1813 length 218 (14) Acct-Status-Type = Start (14) NAS-IP-Address = 10.0.5.71 (14) User-Name = "alex" (14) NAS-Port = 0 (14) NAS-Port-Type = Wireless-802.11 (14) Calling-Station-Id = "a8667f23c53e" (14) Called-Station-Id = "3817c3c13fa8" (14) Framed-IP-Address = 10.0.20.210 (14) Acct-Multi-Session-Id = "A8667F23C53E-1532621349" (14) Acct-Session-Id = "3817C393FA90-A8667F23C53E-5B5A3C05-C1D30" (14) Acct-Delay-Time = 0 (14) Aruba-Essid-Name = "team" (14) Aruba-Location-Id = "Floor1-Main" (14) Aruba-User-Vlan = 20 (14) Aruba-Device-Type = "OS X" (14) Acct-Authentic = RADIUS (14) # Executing section preacct from file /etc/freeradius/sites-enabled/default (14) preacct { (14) [preprocess] = ok (14) policy acct_unique { (14) update request { (14) &Tmp-String-9 := "ai:" (14) } # update request = noop (14) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (14) EXPAND %{hex:&Class} (14) --> (14) EXPAND ^%{hex:&Tmp-String-9} (14) --> ^61693a (14) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (14) else { (14) update request { (14) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (14) --> 910afd2bf35840c31321ab5e1da2ca47 (14) &Acct-Unique-Session-Id := 910afd2bf35840c31321ab5e1da2ca47 (14) } # update request = noop (14) } # else = noop (14) } # policy acct_unique = noop (14) suffix: Checking for suffix after "@" (14) suffix: No '@' in User-Name = "alex", looking up realm NULL (14) suffix: Found realm "DEFAULT" (14) suffix: Adding Stripped-User-Name = "alex" (14) suffix: Adding Realm = "DEFAULT" (14) suffix: Proxying request from user alex to realm DEFAULT (14) suffix: Preparing to proxy accounting request to realm "DEFAULT" (14) [suffix] = updated (14) files: Searching for user in group "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap01): Reserved connection (1) (14) files: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (14) files: --> (uid=alex) (14) files: Performing search in "cn=users,cn=accounts,dc=office,dc=lan" with filter "(uid=alex)", scope "sub" (14) files: Waiting for search result... (14) files: User object found at DN "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap01): Released connection (1) (14) files: User is not a member of "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap02): Reserved connection (4) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap02): Released connection (4) (14) files: User is not a member of "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap03): Reserved connection (4) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap03): Released connection (4) (14) files: User is not a member of "cn=accounting,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap01): Reserved connection (6) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap01): Released connection (6) (14) files: User is not a member of "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap02): Reserved connection (5) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap02): Released connection (5) (14) files: User is not a member of "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap03): Reserved connection (5) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap03): Released connection (5) (14) files: User is not a member of "cn=ads,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap01): Reserved connection (7) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap01): Released connection (7) (14) files: User is not a member of "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap02): Reserved connection (3) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap02): Released connection (3) (14) files: User is not a member of "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap03): Reserved connection (3) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap03): Released connection (3) (14) files: User is not a member of "cn=designers,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap01): Reserved connection (5) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap01): Released connection (5) (14) files: User is not a member of "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap02): Reserved connection (0) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap02): Released connection (0) (14) files: User is not a member of "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap03): Reserved connection (0) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap03): Released connection (0) (14) files: User is not a member of "cn=devops,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap03): Reserved connection (5) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=dmp,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: Search returned no results (14) files: Checking user object's memberOf attributes (14) files: Performing unfiltered search in "uid=alex,cn=users,cn=accounts,dc=office,dc=lan", scope "base" (14) files: Waiting for search result... (14) files: Processing memberOf value "cn=ipausers,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=gsuite,cn=groups,cn=accounts,dc=office,dc=lan" as a DN (14) files: Processing memberOf value "cn=nextcloud-security,cn=groups,cn=accounts,dc=office,dc=lan" as a DN rlm_ldap (ldap03): Released connection (5) (14) files: User is not a member of "cn=dmp,cn=groups,cn=accounts,dc=office,dc=lan" (14) files: Searching for user in group "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap01): Reserved connection (2) (14) files: Using user DN from request "uid=alex,cn=users,cn=accounts,dc=office,dc=lan" (14) files: Checking for user in group objects (14) files: EXPAND (&(objectClass=ipausergroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (14) files: --> (&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex))) (14) files: Performing search in "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" with filter "(&(objectClass=ipausergroup)(|(member=uid\3dalex\2ccn\3dusers\2ccn\3daccounts\2cdc\3doffice\2cdc\3dnms)(memberUid=alex)))", scope "sub" (14) files: Waiting for search result... (14) files: User found in group object "cn=hr,cn=groups,cn=accounts,dc=office,dc=lan" rlm_ldap (ldap01): Released connection (2) (14) files: acct_users: Matched entry DEFAULT at line 156 (14) [files] = ok (14) } # preacct = updated (14) # Executing section accounting from file /etc/freeradius/sites-enabled/default (14) accounting { (14) detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (14) detail: --> /var/log/freeradius/radacct/10.0.5.71/detail-20180726 (14) detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.0.5.71/detail-20180726 (14) detail: EXPAND %t (14) detail: --> Thu Jul 26 21:24:21 2018 (14) [detail] = ok (14) [replicate] = noop (14) update { (14) control:Replicate-To-Realm := fortigate02 (14) } # update = noop (14) [unix] = ok (14) [exec] = noop (14) attr_filter.accounting_response: EXPAND %{User-Name} (14) attr_filter.accounting_response: --> alex (14) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (14) [attr_filter.accounting_response] = updated (14) } # accounting = updated (14) Starting proxy to home server 10.132.15.192 port 1813 (14) Proxying request to home server 10.132.15.192 port 1813 timeout 30.000000 (14) Sent Accounting-Request Id 148 from 0.0.0.0:42612 to 10.132.15.192:1813 length 228 (14) Acct-Status-Type = Start (14) NAS-IP-Address = 10.0.5.71 (14) User-Name = "alex" (14) NAS-Port = 0 (14) NAS-Port-Type = Wireless-802.11 (14) Calling-Station-Id = "a8667f23c53e" (14) Called-Station-Id = "3817c3c13fa8" (14) Framed-IP-Address = 10.0.20.210 (14) Acct-Multi-Session-Id = "A8667F23C53E-1532621349" (14) Acct-Session-Id = "3817C393FA90-A8667F23C53E-5B5A3C05-C1D30" (14) Acct-Delay-Time = 0 (14) Aruba-Essid-Name = "team" (14) Aruba-Location-Id = "Floor1-Main" (14) Aruba-User-Vlan = 20 (14) Aruba-Device-Type = "OS X" (14) Acct-Authentic = RADIUS (14) Event-Timestamp = "Jul 26 2018 21:24:21 UTC" (14) Proxy-State = 0x3232 Waking up in 0.2 seconds. (14) Clearing existing &reply: attributes (14) Received Accounting-Response Id 148 from 10.132.15.192:1813 to 10.132.15.206:42612 length 24 (14) Proxy-State = 0x3232 (14) # Executing section post-proxy from file /etc/freeradius/sites-enabled/default (14) post-proxy { (14) eap: No pre-existing handler found (14) [eap] = noop (14) } # post-proxy = noop (14) Sent Accounting-Response Id 22 from 10.132.15.206:1813 to 10.0.5.71:64245 length 0 (14) Finished request (14) Cleaning up request packet ID 22 with timestamp +54 Waking up in 4.4 seconds.
As I can see, original packet is modified : (14) files: acct_users: Matched entry DEFAULT at line 156 (14) [files] = ok (14) } # preacct = updated ) But not replicated : (14) [replicate] = noop (14) update { (14) control:Replicate-To-Realm := fortigate02 (14) } # update = noop
Tell me please what could be a reason? I cannot figure it out
-- Best regards, Alex Morozenko
вт, 24 лип. 2018 о 20:00 Alan DeKok <aland@deployingradius.com> пише:
On Jul 24, 2018, at 12:49 PM, Алексей Морозенко <alexmorozenko@gmail.com> wrote:
I'm incorrect telling «reply», I mean after successfull authorization
NAS sends accounting request to my RADIUS and then RADIUS proxies that request to FG-1 and FG-2
OK.
Doesn't matter what's it's name, by using files in preacct (pre-proxy) I insert additional attribute «Reply-Message» containing group name in accounting REQUEST from NAS. And further this modified accounting request being proxied to forti according realms. Am I right?
Yes. But only for PROXIED packets. The "pre-proxy" section doesn't change the *original* packet.
And the "replicate" module only sends copies of the ORIGINAL packet.
So you have to edit the original packet before calling replicate.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 27, 2018, at 4:43 AM, Алексей Морозенко <alexmorozenko@gmail.com> wrote:
I did the next thing First, I've changed order in preacct in a such way:
preacct { ... files
Which adds reply attributes. Not request attributes. The documentation for the "files" module makes this clear.
and replicate worked (Now I can see message: replicate: Replicating list 'request' to Realm 'fortigate02')
But still without groups.
Because you have to add request attributes, as I said previously.
Then I've decided to try add group check in preprocess (hints) And it's working!
Because the preprocess module adds request attributes. As the documentation makes clear.
But I cannot understand why. Could you please explain me?
The server contains extensive documentation for the modules you're using. Instead of randomly configuring modules, it would help to read the documentation. The explanations are all there. Alan DeKok.
27 июля 2018 г., в 14:56, Alan DeKok <aland@deployingradius.com <mailto:aland@deployingradius.com>> написал(а):
On Jul 27, 2018, at 4:43 AM, Алексей Морозенко <alexmorozenko@gmail.com <mailto:alexmorozenko@gmail.com>> wrote:
I did the next thing First, I've changed order in preacct in a such way:
preacct { ... files
Which adds reply attributes. Not request attributes.
The documentation for the "files" module makes this clear.
https://freeradius.org/radiusd/man/rlm_attr_filter.html <https://freeradius.org/radiusd/man/rlm_attr_filter.html> In 2.0.1 and earlier versions, the "accounting" section filtered the Accounting-Request, even though it was documented as filtering the response. This issue has been fixed in version 2.0.2 and later versions. The "preacct" section may now be used to filter Accounting-Request packets. The "accounting" section now filters Accounting-Response packets. It’s easy to misunderstand.
and replicate worked (Now I can see message: replicate: Replicating list 'request' to Realm 'fortigate02')
But still without groups.
Because you have to add request attributes, as I said previously.
Then I've decided to try add group check in preprocess (hints) And it's working!
Because the preprocess module adds request attributes. As the documentation makes clear.
But not right way for me)
But I cannot understand why. Could you please explain me?
The server contains extensive documentation for the modules you're using. Instead of randomly configuring modules, it would help to read the documentation.
The explanations are all there.
Alan DeKok.
It wasn't randomly but it's still unclear where is request and where is reply for first-time reading. Thanks for help! FreeRADIUS manuals taught me that every word in it is important. Instead of P.S.: Could you please give me an advice if I could make group match more elegant? I have 3 LDAP servers and ~30 groups so FreeRADIUS must go through all the options till first match on all of them. I think this affects client connection time and want to improve it.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <http://www.freeradius.org/list/users.html>
On Jul 27, 2018, at 9:35 AM, Алексей Морозенко <alexmorozenko@gmail.com> wrote:
The documentation for the "files" module makes this clear.
https://freeradius.org/radiusd/man/rlm_attr_filter.html <https://freeradius.org/radiusd/man/rlm_attr_filter.html>
You do realize that "attr_filter" != "files", right? You're *not* looking at the documentation for the "files" module.
In 2.0.1 and earlier versions, the "accounting" section filtered the Accounting-Request, even though it was documented as filtering the response. This issue has been fixed in version 2.0.2 and later versions. The "preacct" section may now be used to filter Accounting-Request packets. The "accounting" section now filters Accounting-Response packets. It’s easy to misunderstand.
Only if you read the wrong documentation.
It wasn't randomly but it's still unclear where is request and where is reply for first-time reading.
$ man unlang The request is the incoming packet. The reply is... the reply.
Thanks for help! FreeRADIUS manuals taught me that every word in it is important.
Instead of P.S.: Could you please give me an advice if I could make group match more elegant? I have 3 LDAP servers and ~30 groups so FreeRADIUS must go through all the options till first match on all of them. I think this affects client connection time and want to improve it.
The first thing is to do less group checking. If you're using PEAP, do the group checking for the inner-tunnel. That will help a lot. Alan DeKok.
participants (2)
-
Alan DeKok -
Алексей Морозенко