Hi, Noticed with CVS head that all attributes (including internal ones) appear to be getting proxied. Is this just a cosmetic thing ? Sending Access-Request of id 11 to 194.82.174.185 port 1812 Framed-MTU = 1480 NAS-IP-Address = 139.184.8.16 NAS-Identifier = "hp-e-its-dev8021x-sw1" User-Name = "ac221@loopback.sussex.ac.uk" Event-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "001438fb9400" Calling-Station-Id = "001b63a3a8dd" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "700" State = 0x00000000064419000000000000000000 EAP-Message = 0x0244002b19001703010020c006fdcd03d0e15b7001c3e94e1a45340325626fed36c7c97450769dc33c587f Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313035 Proxying request 60 to home server 194.82.174.185 port 1812 Sending Access-Request of id 11 to 194.82.174.185 port 1812 Framed-MTU = 1480 NAS-IP-Address = 139.184.8.16 NAS-Identifier = "hp-e-its-dev8021x-sw1" User-Name = "ac221@loopback.sussex.ac.uk" Event-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "001438fb9400" Calling-Station-Id = "001b63a3a8dd" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "700" State = 0x00000000064419000000000000000000 EAP-Message = 0x0244002b19001703010020c006fdcd03d0e15b7001c3e94e1a45340325626fed36c7c97450769dc33c587f Message-Authenticator = 0x00000000000000000000000000000000 Stripped-User-Name = "ac221@loopback.sussex.ac.uk" Realm = "jrs" EAP-Type = PEAP Called-Station-SSID = "" Packet-Src-Ip-Address-Oct1 = 139 Packet-Src-Ip-Address-Oct2 = 184 Packet-Src-Ip-Address-Oct3 = 8 Packet-Src-Ip-Address-Oct4 = 16 SS-Flags = "0100000000" NAS-Flags = "010010110000000" Supplicant-Flags = "0001000000" SQL-User-Name = "ac221@loopback.sussex.ac.uk" Realm = "jrs" Proxy-State = 0x313035 Going to the next request Thanks Arran -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
A.L.M.Buxey@lboro.ac.uk wrote:
hi,
you are still pre-proxy attr filtering?
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
No, didn't really see the point.. Internal attributes aren't meant to be proxied, and those are the only ones I really wanted filtering out. Looks like something very strange is going on with proxying accounting packets as well. rad_recv: Accounting-Request packet from host 139.184.8.16 port 1026, id=225, length=141 Acct-Session-Id = "004E00000019" Acct-Status-Type = Start Acct-Authentic = RADIUS Acct-Delay-Time = 15 NAS-Port = 1 Calling-Station-Id = "00-1B-63-A3-A8-DD" Event-Type = Framed-User NAS-IP-Address = 139.184.8.16 NAS-Identifier = "hp-e-its-dev8021x-sw1" User-Name = "ac221@loopback.sussex.ac.uk" server default-outer { +- entering group preacct ++? if ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) expand: %{User-Name} -> ac221@loopback.sussex.ac.uk ? Evaluating ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) -> TRUE ++? if ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) -> TRUE ++- entering if ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) +++? if (!"%{2}"||("%{2}" == 'sussex.ac.uk')) expand: %{2} -> loopback.sussex.ac.uk ? Evaluating "loopback.sussex.ac.uk" -> FALSE expand: %{2} -> loopback.sussex.ac.uk ? Evaluating ("%{2}" == 'sussex.ac.uk') -> FALSE +++? if (!"%{2}"||("%{2}" == 'sussex.ac.uk')) -> FALSE +++- entering else else expand: %{1}@%{2} -> ac221@loopback.sussex.ac.uk ++++[request] returns noop +++- else else returns noop ++- if ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) returns noop ++ ... skipping else for request 20: Preceding "if" was taken expand: %{Realm} -> %{2} ++- entering switch %{Realm} +++- entering case ++++[control] returns noop ++++[request] returns noop +++- case returns noop ++- switch %{Realm} returns noop ++? if ("%{Called-Station-Id}" =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) expand: %{Called-Station-Id} -> ? Evaluating ("%{Called-Station-Id}" =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> FALSE ++? if ("%{Called-Station-Id}" =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> FALSE ++? if ("%{Calling-Station-Id}" =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) expand: %{Calling-Station-Id} -> 00-1B-63-A3-A8-DD ? Evaluating ("%{Calling-Station-Id}" =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE ++? if ("%{Calling-Station-Id}" =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE ++- entering if ("%{Calling-Station-Id}" =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 001B63A3A8DD +++[request] returns noop ++- if ("%{Calling-Station-Id}" =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) returns noop ++? if ("%{NAS-Port-Id}" =~ /wl[0-9]*/) expand: %{NAS-Port-Id} -> ? Evaluating ("%{NAS-Port-Id}" =~ /wl[0-9]*/) -> FALSE ++? if ("%{NAS-Port-Id}" =~ /wl[0-9]*/) -> FALSE ++? if (("%{NAS-Port-Type}" == 'Wireless-802.11')||("%{NAS-Port-Type}" == 'Ethernet')) expand: %{NAS-Port-Type} -> ?? Evaluating ("%{NAS-Port-Type}" == 'Wireless-802.11') -> FALSE expand: %{NAS-Port-Type} -> ?? Evaluating ("%{NAS-Port-Type}" == 'Ethernet') -> FALSE ++? if (("%{NAS-Port-Type}" == 'Wireless-802.11')||("%{NAS-Port-Type}" == 'Ethernet')) -> FALSE ++? if ("%{NAS-IP-Address}" == '127.0.0.1') expand: %{NAS-IP-Address} -> 139.184.8.16 ? Evaluating ("%{NAS-IP-Address}" == '127.0.0.1') -> FALSE ++? if ("%{NAS-IP-Address}" == '127.0.0.1') -> FALSE expand: %{Client-Shortname} -> hp-e-its-dev8021x-sw1 ++[request] returns noop rlm_acct_unique: WARNING: Attribute Client-IP-Address was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing ',NAS-Port = 1,NAS-IP-Address = 139.184.8.16,Acct-Session-Id = "004E00000019",User-Name = "ac221@loopback.sussex.ac.uk"' rlm_acct_unique: Acct-Unique-Session-ID = "67d4bffd71faf76b". ++[acct_unique] returns ok +- entering group accounting expand: /var/log/radiusd/%Y%m%d/accounting-detail-%H:00 -> /var/log/radiusd/20080205/accounting-detail-12:00 rlm_detail: /var/log/radiusd/%Y%m%d/accounting-detail-%H:00 expands to /var/log/radiusd/20080205/accounting-detail-12:00 expand: %{Packet-Src-IP-Address} - %t -> 139.184.8.16 - Tue Feb 5 12:49:09 2008 ++[accounting_log] returns ok expand: %{Stripped-User-Name} -> ac221@loopback.sussex.ac.uk expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> ac221@loopback.sussex.ac.uk rlm_sql (sql): sql_set_user escaped user --> 'ac221@loopback.sussex.ac.uk' expand: %{Acct-Delay-Time} -> 15 expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasidentifier, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, calledstationssid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay ) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-Identifier}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}','%{Called-Station-SSID}','%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0') -> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasidentifier, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, calledstationssid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay ) VALUES ('004E00000019', '67d4bffd71faf76b', 'ac221@loopback.sussex.ac.uk', 'jrs', 'hp-e-its-dev8021x-sw1', '139.184.8.16', '1', '', '2008-02-05 12:49:09', '0', '0', 'RADIUS', '', '', '0', '0', '','','001B63A3A8DD', '', 'Framed-User', '', '', '15', '0') rlm_sql (sql): Reserving sql socket id: 19 rlm_sql (sql): Released sql socket id: 19 ++[sql] returns ok expand: %{User-Name} -> ac221@loopback.sussex.ac.uk attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated } # server default-outer +- entering group pre-proxy expand: /var/log/radiusd/%Y%m%d/pre-proxy-detail-%H:00 -> /var/log/radiusd/20080205/pre-proxy-detail-12:00 rlm_detail: /var/log/radiusd/%Y%m%d/pre-proxy-detail-%H:00 expands to /var/log/radiusd/20080205/pre-proxy-detail-12:00 expand: %{Packet-Src-IP-Address} - %t -> 139.184.8.16 - Tue Feb 5 12:49:09 2008 ++[pre_proxy_log] returns ok Where have all the attributes gone ?!!? Sending Accounting-Request of id 180 to 194.82.174.185 port 1813 Proxy-State = 0x323235 Proxying request 20 to home server 194.82.174.185 port 1813 Sending Accounting-Request of id 180 to 194.82.174.185 port 1813 Realm = "jrs" Proxy-State = 0x323235 Going to the next request Waking up in 0.9 seconds. Waking up in 14.0 seconds. Rejecting request 17 due to lack of any response from home server 194.82.174.185 port 1813 -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
Arran Cudbard-Bell wrote:
A.L.M.Buxey@lboro.ac.uk wrote:
hi,
you are still pre-proxy attr filtering? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
No, didn't really see the point.. Internal attributes aren't meant to be proxied, and those are the only ones I really wanted filtering out.
Looks like something very strange is going on with proxying accounting packets as well.
rad_recv: Accounting-Request packet from host 139.184.8.16 port 1026, id=225, length=141 Acct-Session-Id = "004E00000019" Acct-Status-Type = Start Acct-Authentic = RADIUS Acct-Delay-Time = 15 NAS-Port = 1 Calling-Station-Id = "00-1B-63-A3-A8-DD" Event-Type = Framed-User NAS-IP-Address = 139.184.8.16 NAS-Identifier = "hp-e-its-dev8021x-sw1" User-Name = "ac221@loopback.sussex.ac.uk" server default-outer { +- entering group preacct ++? if ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) expand: %{User-Name} -> ac221@loopback.sussex.ac.uk ? Evaluating ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) -> TRUE ++? if ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) -> TRUE ++- entering if ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) +++? if (!"%{2}"||("%{2}" == 'sussex.ac.uk')) expand: %{2} -> loopback.sussex.ac.uk ? Evaluating "loopback.sussex.ac.uk" -> FALSE expand: %{2} -> loopback.sussex.ac.uk ? Evaluating ("%{2}" == 'sussex.ac.uk') -> FALSE +++? if (!"%{2}"||("%{2}" == 'sussex.ac.uk')) -> FALSE +++- entering else else expand: %{1}@%{2} -> ac221@loopback.sussex.ac.uk ++++[request] returns noop +++- else else returns noop ++- if ("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) returns noop ++ ... skipping else for request 20: Preceding "if" was taken expand: %{Realm} -> %{2} ++- entering switch %{Realm} +++- entering case ++++[control] returns noop ++++[request] returns noop +++- case returns noop ++- switch %{Realm} returns noop ++? if ("%{Called-Station-Id}" =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i)
expand: %{Called-Station-Id} -> ? Evaluating ("%{Called-Station-Id}" =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> FALSE ++? if ("%{Called-Station-Id}" =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> FALSE ++? if ("%{Calling-Station-Id}" =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
expand: %{Calling-Station-Id} -> 00-1B-63-A3-A8-DD ? Evaluating ("%{Calling-Station-Id}" =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE ++? if ("%{Calling-Station-Id}" =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE ++- entering if ("%{Calling-Station-Id}" =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 001B63A3A8DD +++[request] returns noop ++- if ("%{Calling-Station-Id}" =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) returns noop ++? if ("%{NAS-Port-Id}" =~ /wl[0-9]*/) expand: %{NAS-Port-Id} -> ? Evaluating ("%{NAS-Port-Id}" =~ /wl[0-9]*/) -> FALSE ++? if ("%{NAS-Port-Id}" =~ /wl[0-9]*/) -> FALSE ++? if (("%{NAS-Port-Type}" == 'Wireless-802.11')||("%{NAS-Port-Type}" == 'Ethernet')) expand: %{NAS-Port-Type} -> ?? Evaluating ("%{NAS-Port-Type}" == 'Wireless-802.11') -> FALSE expand: %{NAS-Port-Type} -> ?? Evaluating ("%{NAS-Port-Type}" == 'Ethernet') -> FALSE ++? if (("%{NAS-Port-Type}" == 'Wireless-802.11')||("%{NAS-Port-Type}" == 'Ethernet')) -> FALSE ++? if ("%{NAS-IP-Address}" == '127.0.0.1') expand: %{NAS-IP-Address} -> 139.184.8.16 ? Evaluating ("%{NAS-IP-Address}" == '127.0.0.1') -> FALSE ++? if ("%{NAS-IP-Address}" == '127.0.0.1') -> FALSE expand: %{Client-Shortname} -> hp-e-its-dev8021x-sw1 ++[request] returns noop rlm_acct_unique: WARNING: Attribute Client-IP-Address was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing ',NAS-Port = 1,NAS-IP-Address = 139.184.8.16,Acct-Session-Id = "004E00000019",User-Name = "ac221@loopback.sussex.ac.uk"' rlm_acct_unique: Acct-Unique-Session-ID = "67d4bffd71faf76b". ++[acct_unique] returns ok +- entering group accounting expand: /var/log/radiusd/%Y%m%d/accounting-detail-%H:00 -> /var/log/radiusd/20080205/accounting-detail-12:00 rlm_detail: /var/log/radiusd/%Y%m%d/accounting-detail-%H:00 expands to /var/log/radiusd/20080205/accounting-detail-12:00 expand: %{Packet-Src-IP-Address} - %t -> 139.184.8.16 - Tue Feb 5 12:49:09 2008 ++[accounting_log] returns ok expand: %{Stripped-User-Name} -> ac221@loopback.sussex.ac.uk expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> ac221@loopback.sussex.ac.uk rlm_sql (sql): sql_set_user escaped user --> 'ac221@loopback.sussex.ac.uk' expand: %{Acct-Delay-Time} -> 15 expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasidentifier, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, calledstationssid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay ) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-Identifier}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}','%{Called-Station-SSID}','%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0') -> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasidentifier, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, calledstationssid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay ) VALUES ('004E00000019', '67d4bffd71faf76b', 'ac221@loopback.sussex.ac.uk', 'jrs', 'hp-e-its-dev8021x-sw1', '139.184.8.16', '1', '', '2008-02-05 12:49:09', '0', '0', 'RADIUS', '', '', '0', '0', '','','001B63A3A8DD', '', 'Framed-User', '', '', '15', '0') rlm_sql (sql): Reserving sql socket id: 19 rlm_sql (sql): Released sql socket id: 19 ++[sql] returns ok expand: %{User-Name} -> ac221@loopback.sussex.ac.uk attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated } # server default-outer +- entering group pre-proxy expand: /var/log/radiusd/%Y%m%d/pre-proxy-detail-%H:00 -> /var/log/radiusd/20080205/pre-proxy-detail-12:00 rlm_detail: /var/log/radiusd/%Y%m%d/pre-proxy-detail-%H:00 expands to /var/log/radiusd/20080205/pre-proxy-detail-12:00 expand: %{Packet-Src-IP-Address} - %t -> 139.184.8.16 - Tue Feb 5 12:49:09 2008 ++[pre_proxy_log] returns ok
Where have all the attributes gone ?!!?
Sending Accounting-Request of id 180 to 194.82.174.185 port 1813 Proxy-State = 0x323235 Proxying request 20 to home server 194.82.174.185 port 1813 Sending Accounting-Request of id 180 to 194.82.174.185 port 1813 Realm = "jrs" Proxy-State = 0x323235 Going to the next request Waking up in 0.9 seconds. Waking up in 14.0 seconds. Rejecting request 17 due to lack of any response from home server 194.82.174.185 port 1813
Never mind ... ++[sql] returns ok expand: %{User-Name} -> ac221@loopback.sussex.ac.uk attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated *sigh* -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
Never mind ...
++[sql] returns ok expand: %{User-Name} -> ac221@loopback.sussex.ac.uk attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated
*sigh*
All works now. Might be any idea to replace accounting { ... # Filter attributes from the accounting response. attr_filter.accounting_response } With accounting { ... # Filter attributes from the accounting response. if(!"%{control:Proxy-To-Realm}"){ attr_filter.accounting_response } } In the default config, or create a Post-Acct section for the filter to live in. Else all proxied accounting requests will have their attributes stripped out. Still getting internal attributes displayed... Sending Accounting-Request of id 206 to 194.82.174.185 port 1813 Acct-Session-Id = "004E0000001B" Acct-Status-Type = Start Acct-Authentic = RADIUS Acct-Delay-Time = 0 NAS-Port = 1 Calling-Station-Id = "001B63A3A8DD" Event-Type = Framed-User NAS-IP-Address = 139.184.8.16 NAS-Identifier = "hp-e-its-dev8021x-sw1" User-Name = "ac221@loopback.sussex.ac.uk" Stripped-User-Name = "ac221@loopback.sussex.ac.uk" Realm = "jrs" Acct-Unique-Session-Id = "98c00d277000c63a" SQL-User-Name = "ac221@loopback.sussex.ac.uk" Realm = "jrs" Proxy-State = 0x323532 -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
Alan DeKok wrote:
Arran Cudbard-Bell wrote:
Might be any idea to replace accounting {
...
# Filter attributes from the accounting response. if(!"%{control:Proxy-To-Realm}"){ attr_filter.accounting_response
I'll look into it...
Still getting internal attributes displayed...
Fixed.
Yep confirmed. Sending Accounting-Request of id 108 to 194.82.174.185 port 1813 Acct-Session-Id = "004E0000002C" Acct-Status-Type = Start Acct-Authentic = RADIUS Acct-Delay-Time = 0 NAS-Port = 1 Calling-Station-Id = "001B63A3A8DD" Service-Type = Framed-User NAS-IP-Address = 139.184.8.16 NAS-Identifier = "hp-e-its-dev8021x-sw1" User-Name = "ac221@loopback.sussex.ac.uk" Proxy-State = 0x313931 Proxying request 9 to home server 194.82.174.185 port 1813 Sending Accounting-Request of id 108 to 194.82.174.185 port 1813 Acct-Session-Id = "004E0000002C" Acct-Status-Type = Start Acct-Authentic = RADIUS Acct-Delay-Time = 0 NAS-Port = 1 Calling-Station-Id = "001B63A3A8DD" Service-Type = Framed-User NAS-IP-Address = 139.184.8.16 NAS-Identifier = "hp-e-its-dev8021x-sw1" User-Name = "ac221@loopback.sussex.ac.uk" Proxy-State = 0x313931 Going to the next request Thanks :) Small cosmetic one Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/filters/attrs.access_reject" key = "%{User-Name}" } [/etc/raddb/filters/attrs.access_reject]:11 WARNING! Check item "Event-Type" found in filter list for realm "DEFAULT". } } Thats not a 'Check-Item' thats a user defined internal attribute.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
Arran Cudbard-Bell wrote:
Noticed with CVS head that all attributes (including internal ones) appear to be getting proxied. Is this just a cosmetic thing ?
It's just a cosmetic thing. The internal attributes are being printed, but not sent. I don't see why it's happening, though. The code in src/lib/radius.c doesn't print internal attributes in debugging mode... Does this happen in 2.0.1? Alan DeKok.
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Arran Cudbard-Bell