VSA attributes sent with Access-Reject response
Contact (COEXSI)
contact at coexsi.fr
Fri May 16 23:02:36 CEST 2014
> -----Original Message-----
> From: freeradius-users-bounces+contact=coexsi.fr at lists.freeradius.org
> [mailto:freeradius-users-bounces+contact=coexsi.fr at lists.freeradius.org]
> On Behalf Of Alan DeKok
> Sent: vendredi 16 mai 2014 22:36
> To: FreeRadius users mailing list
> Subject: Re: VSA attributes sent with Access-Reject response
>
> Contact (COEXSI) wrote:
> > Yes, we had removed the "always" module as we didn't think it was for
> > production purpose.
>
> See "man radiusd". It tells you how to make changes, so that you know
> it works.
>
> > At the beginning of its configuration file, we can read it's used for
> > debugging:
> >
> > # The "always" module is here for debugging purposes. Each # instance
> > simply returns the same result, always, without # doing anything.
>
> Well, it's used.
>
> > After adding the "always" module, the configuration is parsed without
> error.
> > But, the VSA are still sent along with the EAP-MD5 Access-Challenge
> > response!
>
> If only there was some way of seeing what the server was doing.
>
Sorry, I forgot to add the technical information...
Here is an cleaned extract of the configuration:
------------------------------------------------
authorize {
preprocess
chap
mschap
eap {
ok = return
}
sql
pap
}
authenticate {
Auth-Type PAP {
pap
}
Auth-Type CHAP {
chap
}
Auth-Type MS-CHAP {
mschap
}
eap
Auth-Type eap {
eap {
handled = 1
}
if (handled && (Response-Packet-Type == Access-Challenge)) {
attr_filter.access_challenge.post-auth
handled
}
}
}
post-auth {
sql
Post-Auth-Type REJECT {
sql
attr_filter.access_reject
}
}
preacct {
preprocess
acct_unique
}
accounting {
sql
attr_filter.accounting_response
}
Here is the Access-Challenge sent with VSA:
-------------------------------------------
rad_recv: Access-Request packet from host X.X.X.X port 32771, id=141,
length=152
Acct-Session-Id = "5612ab46"
NAS-Port = 0
NAS-Port-Type = Wireless-802.11
User-Name = "test"
Calling-Station-Id = "XX-XX-XX-XX-XX-XX"
Called-Station-Id = "XX-XX-XX-XX-XX-XX"
Framed-IP-Address = X.X.X.X
EAP-Message = 0x028d00090174657374
NAS-Identifier = "test"
NAS-IP-Address = X.X.X.X
Framed-MTU = 1496
Connect-Info = "HTTPS"
Service-Type = Administrative-User
Message-Authenticator = 0x0be651342e0ab4fbfe8dbd0c99750120
Fri May 16 22:54:28 2014 : Info: server my_server {
Fri May 16 22:54:28 2014 : Info: # Executing section authorize from file
/etc/raddb/partner.conf
Fri May 16 22:54:28 2014 : Info: +group authorize {
Fri May 16 22:54:28 2014 : Info: ++[preprocess] = ok
Fri May 16 22:54:28 2014 : Info: ++[chap] = noop
Fri May 16 22:54:28 2014 : Info: ++[mschap] = noop
Fri May 16 22:54:28 2014 : Info: [eap] EAP packet type response id 141
length 9
Fri May 16 22:54:28 2014 : Info: [eap] No EAP Start, assuming it's an
on-going EAP conversation
Fri May 16 22:54:28 2014 : Info: ++[eap] = updated
Fri May 16 22:54:28 2014 : Info: [sql] expand: %{User-Name} -> test
Fri May 16 22:54:28 2014 : Info: [sql] sql_set_user escaped user --> 'test'
Fri May 16 22:54:28 2014 : Debug: Closing socket 99 as its lifetime has been
exceeded
Fri May 16 22:54:28 2014 : Info: rlm_sql (sql): Trying to (re)connect
unconnected handle 99..
Fri May 16 22:54:28 2014 : Info: rlm_sql (sql): Attempting to connect
rlm_sql_mysql #99
Fri May 16 22:54:28 2014 : Info: rlm_sql_mysql: Starting connect to MySQL
server for #99
Fri May 16 22:54:28 2014 : Info: rlm_sql (sql): Connected new DB handle, #99
Fri May 16 22:54:28 2014 : Debug: rlm_sql (sql): Reserving sql socket id: 99
Fri May 16 22:54:28 2014 : Debug: rlm_sql (sql): got socket 99 after
skipping 0 unconnected handles, tried to reconnect 1 though
Fri May 16 22:54:28 2014 : Info: [sql] expand: CALL my_stored_procedure
('%{Virtual-Server}','AUTH_REQ'
,'%{User-Name}','%{Client-IP-Address}','%{Calling-Station-Id}','%{Acct-Sessi
on-Id}','%{NAS-Identifier}','%{Called-Station-Id}','%{Framed-Protocol}','%{A
cct-Delay-Time}','%{Acct-Terminate-Cause}','%{Acct-Session-Time}','%{Acct-Ou
tput-Packets}','%{Acct-Input-Packets}','%{Cleartext-Password}','%{reply:Pack
et-Type}','%{Acct-Status-Type}') -> CALL my_stored_procedure
('my_server','AUTH_REQ'
,'test','X.X.X.X','XX-XX-XX-XX-XX-XX','5612ab46','test','XX-XX-XX-XX-XX-XX',
'','','','','','','','0','')
Fri May 16 22:54:28 2014 : Info: [sql] User found in radcheck table
Fri May 16 22:54:28 2014 : Info: [sql] expand: CALL my_stored_procedure
('%{Virtual-Server}','AUTH_REPL'
,'%{User-Name}','%{Client-IP-Address}','%{Calling-Station-Id}','%{Acct-Sessi
on-Id}','%{NAS-Identifier}','%{Called-Station-Id}','%{Framed-Protocol}','%{A
cct-Delay-Time}','%{Acct-Terminate-Cause}','%{Acct-Session-Time}','%{Acct-Ou
tput-Packets}','%{Acct-Input-Packets}','%{Cleartext-Password}','%{reply:Pack
et-Type}','%{Acct-Status-Type}') -> CALL my_stored_procedure
('my_server','AUTH_REPL'
,'test','X.X.X.X','XX-XX-XX-XX-XX-XX','5612ab46','test','XX-XX-XX-XX-XX-XX',
'','','','','','','','0','')
Fri May 16 22:54:28 2014 : Debug: rlm_sql (sql): Released sql socket id: 99
Fri May 16 22:54:28 2014 : Info: ++[sql] = ok
Fri May 16 22:54:28 2014 : Info: [pap] WARNING: Auth-Type already set. Not
setting to PAP
Fri May 16 22:54:28 2014 : Info: ++[pap] = noop
Fri May 16 22:54:28 2014 : Info: +} # group authorize = updated
Fri May 16 22:54:28 2014 : Info: Found Auth-Type = EAP
Fri May 16 22:54:28 2014 : Info: # Executing group from file
/etc/raddb/partner.conf
Fri May 16 22:54:28 2014 : Info: +group authenticate {
Fri May 16 22:54:28 2014 : Info: [eap] EAP Identity
Fri May 16 22:54:28 2014 : Info: [eap] processing type md5
Fri May 16 22:54:28 2014 : Debug: rlm_eap_md5: Issuing Challenge
Fri May 16 22:54:28 2014 : Info: ++[eap] = handled
Fri May 16 22:54:28 2014 : Info: +} # group authenticate = handled
Fri May 16 22:54:28 2014 : Info: } # server my_server
Sending Access-Challenge of id 141 to X.X.X.X port 32771
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Colubris-AVPair += "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
EAP-Message = 0x018e00160410e4221f5be6c61e8cd9c9d5f403e52706
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x4a3d8da24ab389bc6e24b0dbbc2bac25
Fri May 16 22:54:28 2014 : Info: Finished request 0.
Fri May 16 22:54:28 2014 : Debug: Going to the next request
> Alan DeKok.
> .
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
More information about the Freeradius-Users
mailing list