Reply-message stripped from access-reject response
Hi, Using freeradius 1.1.3. Im trying to get freeradius to return a helpful reply-message in access-rejects to the NAS but the reply-message seems to get stripped from the access-reject packet. Ive configured the reply-message as below in /etc/raddb/sites-enabled/default post-auth { sql exec Post-Auth-Type REJECT { # Login failed update reply { Reply-Message = "Login Failure" } sql attr_filter.access_reject } } Using wireshark on the radius server, I can see the correct reply-message AVP as below Radius Protocol Code: Access-Reject (3) Packet identifier: 0xda (218) Length: 35 Authenticator: a6208196777dac6e68b45f647a46bc44 [This is a response to a request in frame 1] [Time from request: 1.000227000 seconds] Attribute Value Pairs AVP: l=15 t=Reply-Message(18): Login Failure Reply-Message: Login Failure However, on the receiving NAS, using wireshark, there is no reply-message AVP! Radius Protocol Code: Access-Reject (3) Packet identifier: 0xda (218) Length: 20 Authenticator: 30636716e333da33ac25c8253097b608 [This is a response to a request in frame 1] [Time from request: 1.107899000 seconds] Any ideas on what I could be doing wrong, It would be much appreciated!
sbcsgjmbbz@snkmail.com wrote:
Using freeradius 1.1.3.
Upgrade. Im trying to get freeradius to return a helpful
reply-message in access-rejects to the NAS but the reply-message seems to get stripped from the access-reject packet. Ive configured the reply-message as below in /etc/raddb/sites-enabled/default
Huh? 1.1.3 doesn't have "sites-enabled". Figure out what you're doing. You won't be able to understand anything until then.
Using wireshark on the radius server,
<sigh> I have no idea why some people are deathly opposed to running the server in debugging mode.
However, on the receiving NAS, using wireshark, there is no reply-message AVP!
The packets are from different login attempts. Alan DeKok.
On 14/05/2011 12:55, Alan DeKok aland-at-deployingradius.com
|freeradius-mailinglist| wrote:
> sbcsgjmbbz@snkmail.com wrote:
>> Using freeradius 1.1.3.
> Upgrade.
>
My apologies, I made a mistake, the version is 2.1.7
> Im trying to get freeradius to return a helpful
>> reply-message in access-rejects to the NAS but the reply-message seems
>> to get stripped from the access-reject packet. Ive configured the
>> reply-message as below in /etc/raddb/sites-enabled/default
> Huh? 1.1.3 doesn't have "sites-enabled".
>
> Figure out what you're doing. You won't be able to understand
> anything until then.
>> Using wireshark on the radius server,
> <sigh>
>
> I have no idea why some people are deathly opposed to running the
> server in debugging mode.
I'm not at all, I've run it in debugging mode and I can see the
reply-message as below. I just wanted to make sure the packets on the
wire were as expected.
Sending Access-Reject of id 184 to 10.0.2.3 port 45566
Reply-Message = "Login Failure"
>> However, on the receiving NAS, using wireshark, there is no
>> reply-message AVP!
> The packets are from different login attempts.
Im confused, the Packet identifier is the same. Can you explain how you
know this. Thanks, much appreciated!
> Alan DeKok.
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
sbcsgjmbbz@snkmail.com wrote:
Im confused, the Packet identifier is the same. Can you explain how you know this. Thanks, much appreciated!
The packets are different. Go read them. Find out what is modifying the packet *after* the RADIUS server sends the reply. Look at the *rest* of the fields of the packet. i.e. most of these kinds of problems are difficult to solve because people IGNORE information that's right in front of them. You've posted the RADIUS messages. But what about src/dst IP? Have you verified that the packets you *think* are the same actually match for src/dst IP, and src/dst port? If not, why not go check? That will show you WHY the packets are different: they're not the same packet! The src/dst IP/port will also tell you WHAT is in the middle of the RADIUS conversation. That something is the one mangling the packets. Alan DeKok.
You've posted the RADIUS messages. But what about src/dst IP? Have you verified that the packets you *think* are the same actually match for src/dst IP, and src/dst port? If not, why not go check? That will show you WHY the packets are different: they're not the same packet!
You're right again Alan, I was sniffing the wrong TUN interface (there are 13 on this server!) Indeed the reply-message is intact as expected. Problem resolved, thank you!
On 05/14/2011 11:28 AM, sbcsgjmbbz@snkmail.com wrote:
Hi,
Using freeradius 1.1.3. Im trying to get freeradius to return a helpful reply-message in access-rejects to the NAS but the reply-message seems to get stripped from the access-reject packet. Ive configured the reply-message as below in /etc/raddb/sites-enabled/default
post-auth { sql exec Post-Auth-Type REJECT { # Login failed update reply { Reply-Message = "Login Failure" } sql attr_filter.access_reject } }
Using wireshark on the radius server, I can see the correct reply-message AVP as below
Radius Protocol Code: Access-Reject (3) Packet identifier: 0xda (218) Length: 35 Authenticator: a6208196777dac6e68b45f647a46bc44 [This is a response to a request in frame 1] [Time from request: 1.000227000 seconds] Attribute Value Pairs AVP: l=15 t=Reply-Message(18): Login Failure Reply-Message: Login Failure
However, on the receiving NAS, using wireshark, there is no reply-message AVP!
What is between the radius server and NAS? Something must be, because it's modifying the packet. Do you have an intermediate proxy server?
participants (3)
-
Alan DeKok -
Phil Mayers -
sbcsgjmbbz＠snkmail.com