mac authentication, log rejected device in radius.log
Hello All I have freeradius set up with eap and mac authentication, all is well thanks to the excellent documentation and this list. I have one question, I would like to log a message in radius.log when a device is rejected based on its mac address. I would like to put a message saying that the device was unauthorised and the Calling-Station-Id into the radius.log logfile. Is that possible. authorized_macs if (!OK) { reject and write reason for rejection into radius.log } Currently the log entry is the same for a mistyped password and a rejected mac address. Thanks and best regards, Bertalan Voros
Bertalan Voros wrote:
I have one question, I would like to log a message in radius.log when a device is rejected based on its mac address. I would like to put a message saying that the device was unauthorised and the Calling-Station-Id into the radius.log logfile.
See the radiusd.conf, the "log" subsection. There are limited possibilities for customizing the log messages. Alan DeKok.
On 10/18/2013 11:00 AM, Alan DeKok wrote:
Bertalan Voros wrote:
I have one question, I would like to log a message in radius.log when a device is rejected based on its mac address. I would like to put a message saying that the device was unauthorised and the Calling-Station-Id into the radius.log logfile. See the radiusd.conf, the "log" subsection. There are limited possibilities for customizing the log messages.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html I use a modified module for syslog based off "exec" for this type of thing (on a UNIX system):
exec syslog-portauth { wait = no program = "/usr/bin/logger -p local3.info -t portauth switch %{NAS-IP-Address} port %{NAS-Port-Id} %{NAS-Port} - User %{sql_start2: select determineUserFromMac('%{User-Name}')} on MAC %{User-Name} assigned to %{reply:Tunnel-Private-Group-Id}" input_pairs = request packet_type = Access-Accept shell_escape = no } Granted, you might need to execute this on an Access-Reject but you can log anything you want with that. I even grab some values from my database (MySQL functions actually) to include in the log line. - JohnD
On Fri, Oct 18, 2013 at 11:23:54AM -0400, John Douglass wrote:
I use a modified module for syslog based off "exec" for this type of thing (on a UNIX system):
exec syslog-portauth { wait = no
program = "/usr/bin/logger -p local3.info -t portauth switch %{NAS-IP-Address} port %{NAS-Port-Id} %{NAS-Port} - User %{sql_start2: select determineUserFromMac('%{User-Name}')} on MAC %{User-Name} assigned to %{reply:Tunnel-Private-Group-Id}" ...
You should be able to do that with linelog, which will save forking a new process each time. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
participants (4)
-
Alan DeKok -
Bertalan Voros -
John Douglass -
Matthew Newton