We are using the exec module [1]: https://networkradius.com/doc/3.0.10/raddb/mods-available/exec.html In some circumstances we will reject a user even though they have authenticated. So we send a return code of 1. But this appears in radius./log as an error. Looking at src/main/exec.c I find these lines: if ((status != 0) || (ret < 0)) { RERROR("Program returned code (%d) and output '%s'", status, answer); so I am guessing this is essentially as designed. Is that right? [1] essentially, registering new devices on the network.
On Apr 23, 2019, at 8:20 AM, Dom Latter <freeradius-users@latter.org> wrote:
We are using the exec module [1]: https://networkradius.com/doc/3.0.10/raddb/mods-available/exec.html
In some circumstances we will reject a user even though they have authenticated. So we send a return code of 1.
But this appears in radius./log as an error. Looking at src/main/exec.c I find these lines:
if ((status != 0) || (ret < 0)) { RERROR("Program returned code (%d) and output '%s'", status, answer);
so I am guessing this is essentially as designed. Is that right?
Yes. Alan DeKok.
On 23/04/2019 13:45, Alan DeKok wrote:
On Apr 23, 2019, at 8:20 AM, Dom Latter <freeradius-users@latter.org> wrote:
if ((status != 0) || (ret < 0)) { RERROR("Program returned code (%d) and output '%s'", status, answer);
so I am guessing this is essentially as designed. Is that right?
Yes.
Thanks.
On 23/04/2019 13:45, Alan DeKok wrote:
On Apr 23, 2019, at 8:20 AM, Dom Latter <freeradius-users@latter.org> wrote:
We are using the exec module [1]: https://networkradius.com/doc/3.0.10/raddb/mods-available/exec.html
In some circumstances we will reject a user even though they have authenticated. So we send a return code of 1.
But this appears in radius./log as an error. Looking at src/main/exec.c I find these lines:
if ((status != 0) || (ret < 0)) { RERROR("Program returned code (%d) and output '%s'", status, answer);
so I am guessing this is essentially as designed. Is that right?
Yes.
Unfortunately this *seems* to prevent the linelog from working. Pretty sure it used not to behave like this - originally *all* of our authentication went via the external script and we've always relied on the line log to provide diagnostic info to the tech support people.
On Apr 25, 2019, at 10:16 AM, Dom Latter <freeradius-users@latter.org> wrote:
Unfortunately this *seems* to prevent the linelog from working.
I don't know what that means. The "exec" module does one thing, and the "linelog" module does another. The two are very different, and are entirely unrelated.
Pretty sure it used not to behave like this - originally *all* of our authentication went via the external script and we've always relied on the line log to provide diagnostic info to the tech support people.
Perhaps you could describe what you're actually doing. It's impossible to fix anything when the description is "exec and linelog don't work together". Alan DeKok.
participants (2)
-
Alan DeKok -
Dom Latter