According to MS-CHAP-V2 standard in case of authentication failure the Failure Packet should contain the following text in the Message field: "E=691 R=... ..." . Freeradius does send "E=691" if send_error is set to yes in mods-enabled/eap, but this may cause (as stated in the comments) some clients not to work. This is sadly the case with iOS 9.3.1 supplicants. Luckily we have a table relating MACs and OSs of the devices of our users. Is it possible via unlang to have Freeradius conditionally send "E=691" (in case authentication failure) based on a sql query? I believe this is quite tricky, but it'd really help us a lot. Thank you, Stefano
Is it possible via unlang to have Freeradius conditionally send "E=691" (in case authentication failure) based on a sql query? I believe this is quite tricky, but it'd really help us a lot. Yes, that should work. You can write a policy and store it in some file in policy.d/ which does something like
update control { &Tmp-Integer-1 := "%{sql:SELECT XXXXX FROM `XXXX` WHERE XXXX}" } (You could for example store a 0 for incompatible clients which need a rewrite of the reply message and a 1 for all other clients.) You could call this policy which contains the SQL query in the appropriate section of your virtual server and if you need to send a reject you could do something like if ( &control:Tmp-Integer-1 == 0 ) { update reply { Reply-Message := "..." } } to set the Reply-Message to something else where necessary. Christian
On Apr 28, 2016, at 6:03 AM, Stefano Zanmarchi <zanmarchi@gmail.com> wrote:
According to MS-CHAP-V2 standard in case of authentication failure the Failure Packet should contain the following text in the Message field: "E=691 R=... ..." . Freeradius does send "E=691" if send_error is set to yes in mods-enabled/eap, but this may cause (as stated in the comments) some clients not to work.
You can edit the reply in the "Post-Auth-Type Reject" section. Just set the attribute to the value you need. Alan DeKok.
Thank you all, but it's not working. Setting "send_error = yes" in mods-enabled/eap works fine: win 10 users are prompted to reenter passwords. Whereas statically setting Reply-Message in the "Post-Auth-Type Reject" isn't. I've tried the following Reply-Message := "E=691 R=1 C=f37de5ab4ddb5307091b96430c78400c V=3 M=Authentication failed" (where C=f37de5ab4ddb5307091b96430c78400c is my invention) and win 10 users are not prompted. My guess is that "send_error = yes" works fine because of the challenge ( "C=..." ) dinamically set by Freeradius. Since "send_error = yes" does the magic, is there an unlang-way to have "send_error" conditionally set to "yes" or "no", based on a sql query? Thanks again, Stefano On Thu, Apr 28, 2016 at 2:10 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Apr 28, 2016, at 6:03 AM, Stefano Zanmarchi <zanmarchi@gmail.com> wrote:
According to MS-CHAP-V2 standard in case of authentication failure the Failure Packet should contain the following text in the Message field: "E=691 R=... ..." . Freeradius does send "E=691" if send_error is set to yes in mods-enabled/eap, but this may cause (as stated in the comments) some clients not to work.
You can edit the reply in the "Post-Auth-Type Reject" section. Just set the attribute to the value you need.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On May 4, 2016, at 9:57 AM, Stefano Zanmarchi <zanmarchi@gmail.com> wrote:
Thank you all, but it's not working.
It's doing exactly what you told it to do. It's not doing what you want.
Setting "send_error = yes" in mods-enabled/eap works fine: win 10 users are prompted to reenter passwords. Whereas statically setting Reply-Message in the "Post-Auth-Type Reject" isn't. I've tried the following Reply-Message := "E=691 R=1 C=f37de5ab4ddb5307091b96430c78400c V=3 M=Authentication failed"
Please read the debug output. Is the "E=691" text supposed to be in the Reply-Message attribute? No? Then put it into the correct attribute. That one can be found by reading the debug output. Alan DeKok.
participants (3)
-
Alan DeKok -
Christian Strauf -
Stefano Zanmarchi