linelog best practice

cedric delaunay cedric.delaunay at univ-rennes1.fr
Wed Feb 1 15:39:03 CET 2017


Hi all,
Thanks Stefan for the proposition, I finally upgraded from packetfence 
version as Alan suggested in another post 
(http://lists.freeradius.org/pipermail/freeradius-users/2017-January/086387.html)
System admin added a new repo allowing only freeradius* packages

I'm now running 3.0.13 successfully.
Before It started I had to customise my conf files and particularly 
disable filter_username module in authorise sections.
Do someone ever has reject because of an unreal reason ? It looks like a 
bug or am I wrong ?
here is radius -X details :


eady to process requests
(1) Received Access-Request Id 48 from 129.20.3.1:32770 to 129.20.128.215:2012 length 267
(1)   User-Name = "XXXXXXX at univ-rennes1.fr"
(1)   Calling-Station-Id = "xx:xx:xx:xx:xx:xx"
(1)   Called-Station-Id = "zz:zz:zz:zz:zz:zz:eduroam2"
(1)   NAS-Port = 13
(1)   Cisco-AVPair = "audit-session-id=81140301004ea5905891e58f"
(1)   NAS-IP-Address = 129.20.3.1
(1)   NAS-Identifier = "cs5508-00-12d-1"
(1)   Airespace-Wlan-Id = 9
(1)   Service-Type = Framed-User
(1)   Framed-MTU = 1300
(1)   NAS-Port-Type = Wireless-802.11
(1)   Tunnel-Type:0 = VLAN
(1)   Tunnel-Medium-Type:0 = IEEE-802
(1)   Tunnel-Private-Group-Id:0 = "410"
(1)   EAP-Message = 0x0202001d016364656c61756e6140756e69762d72656e6e6573312e6672
(1)   Message-Authenticator = 0x1132d719171132f5a5c236cf9c4f3de1
(1) # Executing section authorize from file /etc/raddb//sites-enabled/eduroam
(1)   authorize {
(1)     policy filter_username {
(1)       if (&User-Name) {
(1)       if (&User-Name)  -> TRUE
(1)       if (&User-Name)  {
(1)         if (&User-Name =~ / /) {
(1)         if (&User-Name =~ / /)  -> FALSE
(1)         if (&User-Name =~ /@[^@]*@/ ) {
(1)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(1)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(1)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(1)         if (&User-Name =~ /\.$/)  {
(1)         if (&User-Name =~ /\.$/)   -> TRUE
(1)         if (&User-Name =~ /\.$/)   {
(1)           update request {
(1)             &Module-Failure-Message += 'Rejected: Realm ends with a dot'
(1)           } # update request = noop
(1)           [reject] = reject
(1)         } # if (&User-Name =~ /\.$/)   = reject
(1)       } # if (&User-Name)  = reject
(1)     } # policy filter_username = reject
(1)   } # authorize = reject
(1) Invalid user (Rejected: Realm ends with a dot): [XXXXXXX at univ-rennes1.fr] (from client Controleur1 port 13 cli xx:xx:xx:xx:xx:xx)

.......

Received Access-Request Id 47 from 129.20.3.1:32770 to 129.20.128.215:2012 length 267
(2)   User-Name = "XXXXXXX at univ-rennes1.fr"
(2)   Calling-Station-Id = "xx:xx:xx:xx:xx:xx"
(2)   Called-Station-Id = "zz:zz:zz:zz:zz:zz:eduroam2"
(2)   NAS-Port = 13
(2)   Cisco-AVPair = "audit-session-id=81140301004ea2255891e39d"
(2)   NAS-IP-Address = 129.20.3.1
(2)   NAS-Identifier = "cs5508-00-12d-1"
(2)   Airespace-Wlan-Id = 9
(2)   Service-Type = Framed-User
(2)   Framed-MTU = 1300
(2)   NAS-Port-Type = Wireless-802.11
(2)   Tunnel-Type:0 = VLAN
(2)   Tunnel-Medium-Type:0 = IEEE-802
(2)   Tunnel-Private-Group-Id:0 = "410"
(2)   EAP-Message = 0x0201001d016364656c61756e6140756e69762d72656e6e6573312e6672
(2)   Message-Authenticator = 0x6e2d0c853052c1e6c24554832e2986c2
(2) # Executing section authorize from file /etc/raddb//sites-enabled/eduroam
(2)   authorize {
(2)     policy filter_username {
(2)       if (&User-Name) {
(2)       if (&User-Name)  -> TRUE
(2)       if (&User-Name)  {
(2)         if (&User-Name =~ / /) {
(2)         if (&User-Name =~ / /)  -> FALSE
(2)         if (&User-Name =~ /@[^@]*@/ ) {
(2)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(2)         if (&User-Name =~ /\.\./ ) {
(2)         if (&User-Name =~ /\.\./ )  -> TRUE
(2)         if (&User-Name =~ /\.\./ )  {
(2)           update request {
(2)             &Module-Failure-Message += 'Rejected: User-Name contains multiple ..s'
(2)           } # update request = noop
(2)           [reject] = reject
(2)         } # if (&User-Name =~ /\.\./ )  = reject
(2)       } # if (&User-Name)  = reject
(2)     } # policy filter_username = reject
(2)   } # authorize = reject
(2) Invalid user (Rejected: User-Name contains multiple ..s): [XXXXXXX at univ-rennes1.fr] (from client Controleur1 port 13 cli xx:xx:xx:xx:xx:xx)
(2) Using Post-Auth-Type Reject
(2) # Executing group from file /etc/raddb//sites-enabled/eduroam
(2)   Post-Auth-Type REJECT {
(2) attr_filter.access_reject: EXPAND %{User-Name}
(2) attr_filter.access_reject:    --> XXXXXXX at univ-rennes1.fr
(2) attr_filter.access_reject: Matched entry DEFAULT at line 11
(2)     [attr_filter.access_reject] = updated

Anyway, I disable the module and it work.
I'll now look at Module-Failure-Message

Cedric


Le 25/01/2017 à 10:56, Stefan Paetow a écrit :
>> I would like switch from 2.x to 3.x as soon as possible so I can't wait for 3.0.13 release on my centos ;(
> If you are ok with getting a CentOS version of FR that's *not* from the official repo, you can get one from the Moonshot repository[1][2]. Granted, it comes with additional build functionality (dynamic realm lookup with Moonshot technology), but at least you won't have to hang around with 2.x anymore.
>
> [1] http://repository.project-moonshot.org/rpms/centos6/RPMS/x86_64/
> [2] Instructions: https://wiki.moonshot.ja.net/display/TEM/_SystemPrep_RHEL6 (or _SystemPrep_RHEL7)
>
> We expect to release a 3.0.13 once Alan releases it.
>
> :-)
>
> Stefan Paetow
> Moonshot Industry & Research Liaison Coordinator
>
> t: +44 (0)1235 822 125
> gpg: 0x3FCE5142
> xmpp: stefanp at jabber.dev.ja.net
> skype: stefan.paetow.janet
>
> jisc.ac.uk
>
> Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
>
>
>
>
>
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html


-- 
Cédric Delaunay			Direction des Systèmes d'Informations
Equipe Réseau & Telephonie	263, Avenue du Général Leclerc
Tel: 02 23 23 71 59		CS 74205 - 35042 Rennes Cedex

Pour toute demande utiliser l'aide et assistance via l'ENT à l'adresse
http://ent.univ-rennes1.fr

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3610 bytes
Desc: Signature cryptographique S/MIME
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20170201/3e639c5d/attachment-0001.bin>


More information about the Freeradius-Users mailing list