problem regular expressions in hints file
Hello, I'm using Debian and Freeradius 2.0.4-3 I want to use the hints file to add an attribute named Intentos-Reject. I would like to use only one DEFAULT entry to match with @domain.es and with @ temp.domain.es If I use this DEFAULT entry the request don't match: #/etc/freeradius/hints DEFAULT Suffix =~ "@(temp\.)?domain.es$", Strip-User-Name = Yes Intentos-Reject = ... ###DEFAULT Suffix == "@domain.es" ### Intentos-Reject = ... ###DEFAULT Suffix == "@temp.domain.es" ### Intentos-Reject = ... If I use this other DEFAULT entry the request match but Freeradius doesn't add Stripped-User-Name and I can't authenticate: DEFAULT User-Name =~ "@(temp\.)?domain.es$", Strip-User-Name = Yes Intentos-Reject = ... ###DEFAULT Suffix == "@domain.es" ### Intentos-Reject = ... ###DEFAULT Suffix == "@temp.domain.es" ### Intentos-Reject = ... I don't know if I can use regular expressions with Suffix/Preffix atributes. Thank you very much and sorry for my english. -- ____________________ Ana Gallardo Gómez ____________________
Ana Gallardo wrote:
Hello, I'm using Debian and Freeradius 2.0.4-3
I want to use the hints file to add an attribute named Intentos-Reject. I would like to use only one DEFAULT entry to match with @domain.es and with @temp.domain.es
Don't use "hints" for that.
If I use this DEFAULT entry the request don't match:
#/etc/freeradius/hints
DEFAULT Suffix =~ "@(temp\.)?domain.es$", Strip-User-Name = Yes Intentos-Reject = ...
The Suffix attribute matches a suffix, not a regular expression. Use "unlang" for this kind of matching. See "man unlang" Alan DeKok.
Hello, I'm using Debian and Freeradius 2.0.4-3
I want to use the hints file to add an attribute named Intentos-Reject. I would like to use only one DEFAULT entry to match with @domain.es and with @temp.domain.es
Don't use "hints" for that.
Sorry, but I don't understand. I need to add an attribute to the request # /etc/freeradius/hints # The hints file. This file is used *to match* # *a request, and then add attributes to it*. This ... I use this attribute later, in users file, to reject users: # /etc/freeradius/users DEFAULT Intentos-Reject > 10, Auth-Type := Reject Reply-Message = "NUMERO DE INTENTOS FALLIDOS(%{Intentos-Reject}) EXCEDIDO" The Suffix attribute matches a suffix, not a regular expression.
OK
Use "unlang" for this kind of matching. See "man unlang"
I saw unlang, but, Where must I use unlang? In hints file? This it not OK: # /etc/freeradius/hints DEFAULT (Suffix == "@domain.es" || Suffix == "@temp.domain.es") Intentos-Reject = ... Sorry if my questions are stupid and sorry for my english. Thanks Alan ____________________ Ana Gallardo Gómez ____________________
I'm really sorry, this is stupid, I thougth "||" was "OR": # /etc/freeradius/hints DEFAULT (Suffix == "@domain.es" || Suffix == "@temp.domain.es") Intentos-Reject = ... ____________________ Ana Gallardo Gómez ____________________
Ana Gallardo wrote:
Sorry, but I don't understand. I need to add an attribute to the request
Yes. The "unlang" documentation explains how to do that.
# /etc/freeradius/hints # The hints file. This file is used *to match* # *a request, and then add attributes to it*. This ...
Thanks for quoting the documentation. Did you think we didn't know about it?
I saw unlang, but, Where must I use unlang? In hints file?
No. In the "authorize" section, before the "files" module. There are examples of this in the configuration files. Alan DeKok.
Sorry, but I don't understand. I need to add an attribute to the request
Yes. The "unlang" documentation explains how to do that.
It is truth, the "unlang" documentation explains how to do that very well :)
Thanks for quoting the documentation. Did you think we didn't know about it?
Sorry, I only wanted to justify why I put this in hints file. No. In the "authorize" section, before the "files" module. There are
examples of this in the configuration files.
OK, now it's fine. #/etc/freeradius/sites-available/default authorize { preprocess mschap suffix eap { ok = return } if ("%{Realm}" =~ /(temp\.)?domain\.es$/){ update control { Intentos-Reject = ... } } files ... } Thank you very mutch, Alan -- ____________________ Ana Gallardo Gómez ____________________
participants (2)
-
Alan DeKok -
Ana Gallardo