Hello, Can you check if this expected in FreeRadius 3.0.21. DEFAULT Suffix == "@REALM", NAS-IP-Address == 1.1.1.1 MS-Primary-DNS-Server = 8.8.8.8, Pool-Suffix = "BC", Fall-Through = Yes DEFAULT Suffix == "@REALM" Client-DNS-Pri = 9.9.9.9, Pool-Suffix = "BC", Fall-Through = Yes When the request is coming from NAS 1.1.1.1, this is fine and FR is sending DNS 8.8.8.8 Line 10 is a default one Line 56 is the Yellow Line 80 is an other default. (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 56 (0) auth_dsl: users: Matched entry DEFAULT at line 80 When the request is coming from an other NAS, it's expected to match the second one (line 61) but that doesn't happened. (0) [suffix] = noop (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 80 Is it expected?
Hello, Any hints or ideas for this ? Thanks in advance all, De : Nicolas Breuer Envoyé : mercredi 24 novembre 2021 10:00 À : freeradius-users@lists.freeradius.org Objet : Users Files Match Hello, Can you check if this expected in FreeRadius 3.0.21. DEFAULT Suffix == "@REALM", NAS-IP-Address == 1.1.1.1 MS-Primary-DNS-Server = 8.8.8.8, Pool-Suffix = "BC", Fall-Through = Yes DEFAULT Suffix == "@REALM" Client-DNS-Pri = 9.9.9.9, Pool-Suffix = "BC", Fall-Through = Yes When the request is coming from NAS 1.1.1.1, this is fine and FR is sending DNS 8.8.8.8 Line 10 is a default one Line 56 is the Yellow Line 80 is an other default. (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 56 (0) auth_dsl: users: Matched entry DEFAULT at line 80 When the request is coming from an other NAS, it's expected to match the second one (line 61) but that doesn't happened. (0) [suffix] = noop (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 80 Is it expected?
The debug has been provided: Line 56 is the first DEFAULT with NAS-IP-Address Line 64 is the DEFAULT without NAS-IP-Address (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 56 (0) auth_dsl: users: Matched entry DEFAULT at line 80 When the request is coming from an other NAS, it's expected to match the second one (line 61) but that doesn't happened. (0) [suffix] = noop (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 80 -----Message d'origine----- De : Freeradius-Users <freeradius-users-bounces+nicolas.breuer=belcenter.biz@lists.freeradius.org> De la part de Alan DeKok Envoyé : jeudi 25 novembre 2021 17:21 À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Objet : Re: Users Files Match On Nov 25, 2021, at 11:17 AM, Nicolas Breuer <Nicolas.Breuer@belcenter.biz> wrote:
Any hints or ideas for this ?
It should work. ... what does the debug output say for the test which is failing? Alan DeKok. - List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Cnicolas.breuer%40belcenter.biz%7C8e89443bca3d4897a6bf08d9b02f8e40%7C76244800c22e467dbae3c6fda9544a51%7C0%7C0%7C637734540558978011%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=w6AJiyJnKG0cfMAU%2BgwkCahuLJOo5nvZmql2whtpYwU%3D&reserved=0
On 25/11/2021 16:27, Nicolas Breuer wrote:
The debug has been provided:
https://wiki.freeradius.org/list-help -- Matthew
More lines: (0) # Executing section authorize from file /etc/raddb/config/Belcenter_DSL.conf (0) authorize { (0) [preprocess] = ok (0) [chap] = noop (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "BELCENTER" for User-Name = "BCtest@BELCENTER" (0) suffix: Found realm "BELCENTER" (0) suffix: Adding Realm = "BELCENTER" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 80 (0) auth_dsl: users: Matched entry BCtest@BELCENTER at line 87 (0) [auth_dsl] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/raddb/config/Belcenter_DSL.conf (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/raddb/config/Belcenter_DSL.conf (0) post-auth { -----Message d'origine----- De : Freeradius-Users <freeradius-users-bounces+nicolas.breuer=belcenter.biz@lists.freeradius.org> De la part de Matthew Newton Envoyé : jeudi 25 novembre 2021 17:29 À : freeradius-users@lists.freeradius.org Objet : Re: Users Files Match On 25/11/2021 16:27, Nicolas Breuer wrote:
The debug has been provided:
https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.freeradius.org%2Flist-help&data=04%7C01%7Cnicolas.breuer%40belcenter.biz%7Cdffaf506fe8f4b11fbf308d9b030af2a%7C76244800c22e467dbae3c6fda9544a51%7C0%7C0%7C637734545988127741%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=rifK%2BouceZPnxYJJz4sMzPlGMm6k5kkGGXEZXnKGj04%3D&reserved=0 -- Matthew - List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Cnicolas.breuer%40belcenter.biz%7Cdffaf506fe8f4b11fbf308d9b030af2a%7C76244800c22e467dbae3c6fda9544a51%7C0%7C0%7C637734545988127741%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=VguBta5WqvUhHd2Ydu4j69Bcuu7ch7scPDFiSlzLTO4%3D&reserved=0
I checked again When Request is coming from 217.112.190.2 it matched. When Request is coming from 217.112.190.3 it doesn't match the first (expected) nor the second one. DEFAULT Suffix == "@BELCENTER",NAS-IP-Address == "217.112.190.2" Cisco-AVPair = "ip:vrf-id=BELCENTER", Cisco-AVPair = "ip:ip-unnumbered=Loopback22", MS-Primary-DNS-Server = 217.112.180.1, MS-Secondary-DNS-Server = 217.112.180.2, Pool-Suffix = "BC", Fall-Through = Yes DEFAULT Suffix == "@BELCENTER", NAS-IP-Address == "217.112.190.3" Client-DNS-Pri = 217.112.180.1, Client-DNS-Sec = 217.112.180.2, Pool-Suffix = "BC", Fall-Through = Yes -----Message d'origine----- De : Nicolas Breuer Envoyé : jeudi 25 novembre 2021 17:45 À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Objet : RE: Users Files Match More lines: (0) # Executing section authorize from file /etc/raddb/config/Belcenter_DSL.conf (0) authorize { (0) [preprocess] = ok (0) [chap] = noop (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "BELCENTER" for User-Name = "BCtest@BELCENTER" (0) suffix: Found realm "BELCENTER" (0) suffix: Adding Realm = "BELCENTER" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 80 (0) auth_dsl: users: Matched entry BCtest@BELCENTER at line 87 (0) [auth_dsl] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/raddb/config/Belcenter_DSL.conf (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/raddb/config/Belcenter_DSL.conf (0) post-auth { -----Message d'origine----- De : Freeradius-Users <freeradius-users-bounces+nicolas.breuer=belcenter.biz@lists.freeradius.org> De la part de Matthew Newton Envoyé : jeudi 25 novembre 2021 17:29 À : freeradius-users@lists.freeradius.org Objet : Re: Users Files Match On 25/11/2021 16:27, Nicolas Breuer wrote:
The debug has been provided:
https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.freeradius.org%2Flist-help&data=04%7C01%7Cnicolas.breuer%40belcenter.biz%7Cdffaf506fe8f4b11fbf308d9b030af2a%7C76244800c22e467dbae3c6fda9544a51%7C0%7C0%7C637734545988127741%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=rifK%2BouceZPnxYJJz4sMzPlGMm6k5kkGGXEZXnKGj04%3D&reserved=0 -- Matthew - List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Cnicolas.breuer%40belcenter.biz%7Cdffaf506fe8f4b11fbf308d9b030af2a%7C76244800c22e467dbae3c6fda9544a51%7C0%7C0%7C637734545988127741%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=VguBta5WqvUhHd2Ydu4j69Bcuu7ch7scPDFiSlzLTO4%3D&reserved=0
Hello, Can you help or I have to change my mind and set the replies in the configuration file ? We have to configure two 'sets' of replies based on the NAS-IP Address. -----Message d'origine----- De : Nicolas Breuer Envoyé : jeudi 25 novembre 2021 17:28 À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Objet : RE: Users Files Match The debug has been provided: Line 56 is the first DEFAULT with NAS-IP-Address Line 64 is the DEFAULT without NAS-IP-Address (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 56 (0) auth_dsl: users: Matched entry DEFAULT at line 80 When the request is coming from an other NAS, it's expected to match the second one (line 61) but that doesn't happened. (0) [suffix] = noop (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 80 -----Message d'origine----- De : Freeradius-Users <freeradius-users-bounces+nicolas.breuer=belcenter.biz@lists.freeradius.org> De la part de Alan DeKok Envoyé : jeudi 25 novembre 2021 17:21 À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Objet : Re: Users Files Match On Nov 25, 2021, at 11:17 AM, Nicolas Breuer <Nicolas.Breuer@belcenter.biz> wrote:
Any hints or ideas for this ?
It should work. ... what does the debug output say for the test which is failing? Alan DeKok. - List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Cnicolas.breuer%40belcenter.biz%7C8e89443bca3d4897a6bf08d9b02f8e40%7C76244800c22e467dbae3c6fda9544a51%7C0%7C0%7C637734540558978011%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=w6AJiyJnKG0cfMAU%2BgwkCahuLJOo5nvZmql2whtpYwU%3D&reserved=0
I really don’t understand why people post the same questions over and over again, while ignoring every answer they’re given. Alan DeKok.
On 09/12/2021 13:27, Nicolas Breuer wrote:
Can you help or I have to change my mind and set the replies in the configuration file ? We have to configure two 'sets' of replies based on the NAS-IP Address.
I lost interest after pointing you to a page which explicitly says post the full debug output, and specifically makes that clear and tells you how to do it, and why we want that... and you kept drip feeding tiny bits of it. Sorry. If setting the replies works with unlang then sure, do that. -- Matthew
Sorry Matthew, Please find the full debug attached. The problem is the match with our DEFAULT values in Users file: It doesn't match the correct line. (0) [suffix] = ok (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: EXPAND ^([^@]+)@(.*) (0) auth_dsl: --> ^([^@]+)@(.*) (0) auth_dsl: users: Matched entry DEFAULT at line 14 (0) auth_dsl: users: Matched entry DEFAULT at line 84 (0) auth_dsl: users: Matched entry BCtest@YYY at line 91 Thanks in advance for your ideas. -----Message d'origine----- De : Freeradius-Users <freeradius-users-bounces+nicolas.breuer=belcenter.biz@lists.freeradius.org> De la part de Matthew Newton Envoyé : jeudi 9 décembre 2021 14:35 À : freeradius-users@lists.freeradius.org Objet : Re: Users Files Match On 09/12/2021 13:27, Nicolas Breuer wrote:
Can you help or I have to change my mind and set the replies in the configuration file ? We have to configure two 'sets' of replies based on the NAS-IP Address.
I lost interest after pointing you to a page which explicitly says post the full debug output, and specifically makes that clear and tells you how to do it, and why we want that... and you kept drip feeding tiny bits of it. Sorry. If setting the replies works with unlang then sure, do that. -- Matthew - List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Cnicolas.breuer%40belcenter.biz%7C77936ca029fb429926fc08d9bb18b542%7C76244800c22e467dbae3c6fda9544a51%7C0%7C0%7C637746537063145830%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=TlFvYT3UAomS8IQRh61KiOjqDaChPLNxPd9A6bvFmEA%3D&reserved=0
On Dec 9, 2021, at 11:23 AM, Nicolas Breuer <Nicolas.Breuer@belcenter.biz> wrote:
Please find the full debug attached.
The problem is the match with our DEFAULT values in Users file: It doesn't match the correct line.
The "users" file you posted earlier doesn't match anything in the debug log. I am very sorry, but we are unable to help you here. You've spent a lot of time (a) not following instructions, and (b) editing the sample config / debug output to make it utterly useless. You're asking for help, but you're refusing to listen to any of the help you're given. You're making it as difficult as possible for us to help you. I have no idea why. So... we can't help you. You have access to the source code. Track it down yourself. If you find a bug, submit a patch. Until then, I see no more reason to answer any of your questions. You're just going to ignore any reply you see, and go do your own thing anyways. Alan DeKok.
On 09/12/2021 16:23, Nicolas Breuer wrote:
Please find the full debug attached.
The problem is the match with our DEFAULT values in Users file: It doesn't match the correct line.
OK, I've tested this as closely as I can with everything provided, and can't replicate it. DEFAULT lines match and/or fall through just as expected. There's not much more I can suggest apart from using e.g. debug_all before and after the "files" call to ensure all attributes are exactly as you expect. I suspect some attribute isn't quite as expected. -- Matthew
Hello Matthew, Thank you for the test you have done. I also tested with the last build 3.0.25 => Same behavior. I "think" I have maybe found something interesting. If I use : DEFAULT Realm == "BELCENTER", NAS-IP-Address == 217.112.190.2 Cisco-AVPair = "ip:ip-unnumbered=Loopback22", MS-Primary-DNS-Server = 217.112.180.1, MS-Secondary-DNS-Server = 217.112.180.2, Pool-Realm = "BC", Fall-Through = Yes DEFAULT Realm == "BELCENTER" Client-DNS-Pri = 217.112.180.1, Client-DNS-Sec = 217.112.180.2, Pool-Realm = "BC", Fall-Through = Yes Instead of DEFAULT Suffix It's working as expected. -----Message d'origine----- De : Freeradius-Users <freeradius-users-bounces+nicolas.breuer=belcenter.biz@lists.freeradius.org> De la part de Matthew Newton Envoyé : lundi 13 décembre 2021 13:05 À : freeradius-users@lists.freeradius.org Objet : Re: Users Files Match On 09/12/2021 16:23, Nicolas Breuer wrote:
Please find the full debug attached.
The problem is the match with our DEFAULT values in Users file: It doesn't match the correct line.
OK, I've tested this as closely as I can with everything provided, and can't replicate it. DEFAULT lines match and/or fall through just as expected. There's not much more I can suggest apart from using e.g. debug_all before and after the "files" call to ensure all attributes are exactly as you expect. I suspect some attribute isn't quite as expected. -- Matthew - List info/subscribe/unsubscribe? See https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Cnicolas.breuer%40belcenter.biz%7Cd379e48226c5434f85d208d9be30d085%7C76244800c22e467dbae3c6fda9544a51%7C0%7C0%7C637749939705581864%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=HQXnP4lHyluJgdnT%2FHpiLV2SwyW19DJFul%2Fa41WvDyA%3D&reserved=0
On 13/12/2021 12:11, Nicolas Breuer wrote:
Thank you for the test you have done. I also tested with the last build 3.0.25 => Same behavior. I "think" I have maybe found something interesting.
If I use :
DEFAULT Realm == "BELCENTER", NAS-IP-Address == 217.112.190.2 ... Instead of DEFAULT Suffix
It's working as expected.
Ah, yes, Suffix is a special internal attribute, similar to Group, LDAP-Group, etc. I actually used Realm when testing, which will be why I didn't see it. -- Matthew
participants (3)
-
Alan DeKok -
Matthew Newton -
Nicolas Breuer