More detailed login failures on linelog
I have been playing around with linelog in order to send all the status via rsyslog to a remote machine and it has been working pretty well. What I still don't manage to get is how to have more detailed authentication failure messages in order to troubleshoot what went wrong. I'm currently using %{Module-Failure-Message}, but i only get stuff like "EAP module failure" instead of something more useful like "username is not found in ldap" or "Password incorrect" How can I do this? Thanks!
On Feb 19, 2019, at 6:11 AM, R3DNano <r3dnano@gmail.com> wrote:
I have been playing around with linelog in order to send all the status via rsyslog to a remote machine and it has been working pretty well. What I still don't manage to get is how to have more detailed authentication failure messages in order to troubleshoot what went wrong. I'm currently using %{Module-Failure-Message}, but i only get stuff like "EAP module failure" instead of something more useful like "username is not found in ldap" or "Password incorrect" How can I do this?
"not found in LDAP" isn't an authentication failure. "Password incorrect" is, and is likely available in the inner-tunnel virtual server. You can add Module-Failure-Message yourself via "unlang", or patch the source to add it in some modules. Otherwise, the server produces the messages it produces. And it only produces Module-Failure-Message for a few modules. Alan DeKok.
I tried with this in the inner-tunnel server post-auth section: Post-Auth-Type REJECT { # log failed authentications in SQL, too. -sql attr_filter.access_reject # # Let the outer session know which module failed, and why. # update outer.session-state { &Module-Failure-Message := &request:Module-Failure-Message } update outer.session-state { &User-Name := &User-Name } } Regardless, it does show me the output of the eap module, instead of the pap module which is the one that has that detail I need "password does not match "known good" password" The other option you mention is ulang: Where? in the pap module? and finally you mention patching the code, which is a bit out of my league :) Cheers On Tue, Feb 19, 2019 at 1:33 PM Alan DeKok <aland@deployingradius.com> wrote:
On Feb 19, 2019, at 6:11 AM, R3DNano <r3dnano@gmail.com> wrote:
I have been playing around with linelog in order to send all the status
via
rsyslog to a remote machine and it has been working pretty well. What I still don't manage to get is how to have more detailed authentication failure messages in order to troubleshoot what went wrong. I'm currently using %{Module-Failure-Message}, but i only get stuff like "EAP module failure" instead of something more useful like "username is not found in ldap" or "Password incorrect" How can I do this?
"not found in LDAP" isn't an authentication failure. "Password incorrect" is, and is likely available in the inner-tunnel virtual server.
You can add Module-Failure-Message yourself via "unlang", or patch the source to add it in some modules.
Otherwise, the server produces the messages it produces. And it only produces Module-Failure-Message for a few modules.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Feb 20, 2019, at 3:24 AM, R3DNano <r3dnano@gmail.com> wrote:
Regardless, it does show me the output of the eap module, instead of the pap module which is the one that has that detail I need "password does not match "known good" password"
Because there may be multiple Module-Failure-Message attributes.
The other option you mention is ulang: Where? in the pap module?
You can use "unlang" to create Module-Failure-Message attributes yourself... Alan DeKok.
How can I see which are those multiple Module-Failure-Message attributes you mention? Are they in the doc or do I have to dive in the source code? On Wed, 20 Feb 2019, 13:19 Alan DeKok, <aland@deployingradius.com> wrote:
On Feb 20, 2019, at 3:24 AM, R3DNano <r3dnano@gmail.com> wrote:
Regardless, it does show me the output of the eap module, instead of the pap module which is the one that has that detail I need "password does not match "known good" password"
Because there may be multiple Module-Failure-Message attributes.
The other option you mention is ulang: Where? in the pap module?
You can use "unlang" to create Module-Failure-Message attributes yourself...
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
R3DNano