ipv6 address in users file
Marcin Romanowski
marcin at nicram.net
Mon Mar 30 10:19:26 CEST 2020
pon., 30 mar 2020 o 10:01 Nathan Ward <lists+freeradius at daork.net>
napisał(a):
> Hi,
>
> Is it case sensitive? Perhaps “db” and “DB” are not matching.
>
Yes, it was it. Thank you very much.
>
> Any reason your RADIUS server is trying to connect to a postgres database,
> and failing to do so? That seems like a bad configuration..
No, configuration is good.
redundant {
ikam-isg
files
}
I'm testing redundant case, when postres will be not available. This is my
LAB environment, in production radius and postgres are seperate machines
>
> > On 30/03/2020, at 8:46 PM, Marcin Romanowski <marcin at nicram.net> wrote:
> >
> > Hello,
> > I have problem with provide IPv6 from users file.
> > I use files as redundant when sql will broke.
> >
> > in file:
> >
> > 2001:db8:2:8000:: Cleartext-Password := 'cisco'
> > Cisco-Service-info = 'QU;1433600000;D;1433600000',
> > Cisco-Avpair +=
> > 'subscriber:accounting-list=FRAD_BRAS_ISG_ACCT',
> > Framed-IPv6-Prefix = '2001:db8:2:8000::/56',
> > Idle-Timeout = 10800,
> > Cisco-Avpair +=
> 'subscriber:idle-timeout-direction=inbound'
> >
> > for ipv4 I have
> > 192.168.1.12 Cleartext-Password := 'cisco'
> > Cisco-Service-info = 'QU;1433600000;D;1433600000',
> > Cisco-Avpair +=
> > 'subscriber:accounting-list=FRAD_BRAS_ISG_ACCT',
> > Cisco-Avpair += 'subscriber:keepalive=interval 10',
> > Cisco-Avpair +=
> 'subscriber:idle-timeout-direction=inbound'
> > and it works, but for ipv6 doesn't
> >
> > Debug says that radius can't find user :/
> >
> > (0) Received Access-Request Id 94 from 10.249.1.202:1645 to
> > 10.249.1.203:1912 length 152
> > (0) User-Name = "2001:DB8:2:8000::"
> > (0) User-Password = "cisco"
> > (0) Framed-IPv6-Prefix = 2001:db8:2:8000::/56
> > (0) Calling-Station-Id = "00:00:00:00:00:00"
> > (0) NAS-Port-Type = PPPoEoE
> > (0) NAS-Port = 0
> > (0) NAS-Port-Id = "0/0/0/0"
> > (0) Service-Type = Outbound-User
> > (0) NAS-IP-Address = 10.249.1.202
> > (0) Acct-Session-Id = "00001200"
> > (0) NAS-Identifier = "ASR_1"
> > (0) Event-Timestamp = "Mar 30 2020 09:39:28 CEST"
> > (0) # Executing section authorize from file
> > /etc/freeradius/3.0/sites-enabled/ikam-isg.server
> > (0) authorize {
> > (0) policy filter_username {
> > (0) if (&User-Name) {
> > (0) if (&User-Name) -> TRUE
> > (0) if (&User-Name) {
> > (0) if (&User-Name =~ / /) {
> > (0) if (&User-Name =~ / /) -> FALSE
> > (0) if (&User-Name =~ /@[^@]*@/ ) {
> > (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
> > (0) if (&User-Name =~ /\.\./ ) {
> > (0) if (&User-Name =~ /\.\./ ) -> FALSE
> > (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
> > (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
> ->
> > FALSE
> > (0) if (&User-Name =~ /\.$/) {
> > (0) if (&User-Name =~ /\.$/) -> FALSE
> > (0) if (&User-Name =~ /@\./) {
> > (0) if (&User-Name =~ /@\./) -> FALSE
> > (0) } # if (&User-Name) = notfound
> > (0) } # policy filter_username = notfound
> > (0) [preprocess] = ok
> > (0) [chap] = noop
> > (0) [mschap] = noop
> > (0) suffix: Checking for suffix after "@"
> > (0) suffix: No '@' in User-Name = "2001:DB8:2:8000::", looking up realm
> NULL
> > (0) suffix: No such realm "NULL"
> > (0) [suffix] = noop
> > (0) eap: No EAP-Message, not doing EAP
> > (0) [eap] = noop
> > (0) redundant {
> > (0) ikam-isg: EXPAND %{User-Name}
> > (0) ikam-isg: --> 2001:DB8:2:8000::
> > (0) ikam-isg: SQL-User-Name set to '2001:DB8:2:8000::'
> > rlm_sql (ikam-isg): 0 of 0 connections in use. You may need to increase
> > "spare"
> > rlm_sql (ikam-isg): Opening additional connection (0), 1 of 64 pending
> > slots used
> > rlm_sql_postgresql: Connecting using parameters: dbname=bcman
> > host=localhost user=bcman password=bcman
> > rlm_sql_postgresql: Connection failed: could not connect to server:
> > Connection refused Is the server running on host "localhost" (127.0.0.1)
> > and accepting TCP/IP connections on port 5432?
> > rlm_sql_postgresql: Socket destructor called, closing socket
> > rlm_sql (ikam-isg): Opening connection failed (0)
> >
> > *(0) [ikam-isg] = fail(0) [files] = noop*
> > (0) } # redundant = noop
> > (0) [expiration] = noop
> > (0) [logintime] = noop
> >
> > *(0) pap: WARNING: No "known good" password found for the user. Not
> > setting Auth-Type(0) pap: WARNING: Authentication will fail unless a
> "known
> > good" password is available*
> > (0) [pap] = noop
> > (0) } # authorize = ok
> >
> > *(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type =
> > Reject(0) Failed to authenticate the user*
> > (0) Using Post-Auth-Type Reject
> > (0) # Executing group from file
> > /etc/freeradius/3.0/sites-enabled/ikam-isg.server
> > (0) Post-Auth-Type REJECT {
> > (0) attr_filter.access_reject: EXPAND %{User-Name}
> > (0) attr_filter.access_reject: --> 2001:DB8:2:8000::
> > (0) attr_filter.access_reject: Matched entry DEFAULT at line 11
> > (0) [attr_filter.access_reject] = updated
> > (0) [eap] = noop
> > (0) policy remove_reply_message_if_eap {
> > (0) if (&reply:EAP-Message && &reply:Reply-Message) {
> > (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
> > (0) else {
> > (0) [noop] = noop
> > (0) } # else = noop
> > (0) } # policy remove_reply_message_if_eap = noop
> > (0) } # Post-Auth-Type REJECT = updated
> > (0) Delaying response for 1.000000 seconds
> > Waking up in 0.6 seconds.
> > Waking up in 0.3 seconds.
> > (0) Sending delayed response
> > (0) Sent Access-Reject Id 94 from 10.249.1.203:1912 to 10.249.1.202:1645
> > length 20
> > Waking up in 3.9 seconds.
> > (0) Cleaning up request packet ID 94 with timestamp +6
> >
> > FreeRADIUS Version 3.0.16
> >
> > Where I'm doing mistake?
> >
> > Best regards
> > Marcin
> > -
> > List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
--
Marcin Romanowski / nicraM
More information about the Freeradius-Users
mailing list