Update_Control and Update_Reply in Post-Auth-Type = Reject
Aurélio de Souza Ribeiro Neto
netolistas at mpc.com.br
Mon Feb 8 15:26:47 CET 2021
Hello List,
I want to Update_Control and Update_Reply for rejected users (not
in my database).
My Users are coming from PAP Authentication method.
If the users are not in my Database, I want to give an IP from a
specific Pool to this users.
I did this in my default file in Post-Auth-Type REJECT session but
this settings are not Working
Post-Auth-Type REJECT {
# log failed authentications in SQL, too.
# -sql
attr_filter.access_reject
# Insert EAP-Failure message if the request was
# rejected by policy instead of because of an
# authentication failure
# eap
# Remove reply message if the response contains an
EAP-Message
remove_reply_message_if_eap
update control {
Pool-Name := "mkt_pool"
}
update reply {
Mikrotik-Rate-Limit := "2M/2M"
Framed-IP-Address !* ANY
}
}
Take a Look in my DEBUG output:
Ready to process requests
(0) Received Access-Request Id 71 from 172.17.200.2:33183 to
XXX.XXX.XXX.XXX:1812 length 148
(0) Service-Type = Framed-User
(0) Framed-Protocol = PPP
(0) NAS-Port = 15729152
(0) NAS-Port-Type = Ethernet
(0) User-Name = "testepppoe2"
(0) Calling-Station-Id = "D8:77:8B:65:C5:B4"
(0) Called-Station-Id = "CE - POP ENCOL 11"
(0) NAS-Port-Id = "ether11"
(0) Acct-Session-Id = "81a00200"
(0) User-Password = "testeppp"
(0) NAS-Identifier = "CE-ENCOL"
(0) NAS-IP-Address = 172.17.200.2
(0) # Executing section authorize from file
/etc/freeradius/sites-enabled/default
(0) authorize {
(0) policy filter_username {
(0) if (&User-Name) {
(0) if (&User-Name) -> TRUE
(0) if (&User-Name) {
(0) if (&User-Name =~ / /) {
(0) if (&User-Name =~ / /) -> FALSE
(0) if (&User-Name =~ /@[^@]*@/ ) {
(0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(0) if (&User-Name =~ /\.\./ ) {
(0) if (&User-Name =~ /\.\./ ) -> FALSE
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
-> FALSE
(0) if (&User-Name =~ /\.$/) {
(0) if (&User-Name =~ /\.$/) -> FALSE
(0) if (&User-Name =~ /@\./) {
(0) if (&User-Name =~ /@\./) -> FALSE
(0) } # if (&User-Name) = notfound
(0) } # policy filter_username = notfound
(0) [preprocess] = ok
(0) [chap] = noop
(0) [mschap] = noop
(0) files: users: Matched entry DEFAULT at line 167
(0) [files] = ok
(0) sql: EXPAND %{User-Name}
(0) sql: --> testepppoe2
(0) sql: SQL-User-Name set to 'testepppoe2'
rlm_sql (sql): Closing connection (1): Hit idle_timeout, was idle for 77
seconds
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing connection (2): Hit idle_timeout, was idle for 77
seconds
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing connection (3): Hit idle_timeout, was idle for 76
seconds
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing connection (4): Hit idle_timeout, was idle for 76
seconds
rlm_sql (sql): You probably need to lower "min"
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing connection (0): Hit idle_timeout, was idle for 76
seconds
rlm_sql (sql): You probably need to lower "min"
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing connection (5): Hit idle_timeout, was idle for 76
seconds
rlm_sql (sql): You probably need to lower "min"
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare"
rlm_sql (sql): Opening additional connection (6), 1 of 32 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'mpc_freeradius' on
mysql.mpc.com.br via TCP/IP, server version 5.7.32-0ubuntu0.16.04.1-log,
protocol version 10
rlm_sql (sql): Reserved connection (6)
(0) sql: EXPAND SELECT DISTINCT (R.id), R.username, R.attribute,
R.value, R.op FROM
mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist
M WHERE R.username = BINARY
'%{SQL-User-Name}' AND M.usuario_login
= BINARY '%{SQL-User-Name}' AND
N.nasname = '%{Nas-IP-Address}' AND
N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login =
BINARY '%{SQL-User-Name}' AND plano_id NOT IN (6,8,9,793) AND gateway_id
= ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname =
'%{Nas-IP-Address}' ) ORDER BY
ID) UNION
ALL SELECT DISTINCT (R.id), R.username,
R.attribute, R.value, R.op FROM
mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist
M WHERE R.username = BINARY
'%{SQL-User-Name}' AND M.usuario_login
= BINARY '%{SQL-User-Name}' AND
M.grupocliente = 'ALL-POPS'
(0) sql: --> SELECT DISTINCT (R.id), R.username, R.attribute,
R.value, R.op FROM
mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist
M WHERE R.username = BINARY
'testepppoe2' AND M.usuario_login =
BINARY 'testepppoe2' AND N.nasname =
'172.17.200.2' AND N.gw_id = (SELECT
gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY
'testepppoe2' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT
gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.200.2'
) ORDER BY
ID) UNION
ALL SELECT DISTINCT (R.id), R.username,
R.attribute, R.value, R.op FROM
mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist
M WHERE R.username = BINARY
'testepppoe2' AND M.usuario_login =
BINARY 'testepppoe2' AND M.grupocliente
= 'ALL-POPS'
(0) sql: Executing select query: SELECT DISTINCT (R.id), R.username,
R.attribute, R.value, R.op FROM
mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist
M WHERE R.username = BINARY
'testepppoe2' AND M.usuario_login =
BINARY 'testepppoe2' AND N.nasname =
'172.17.200.2' AND N.gw_id = (SELECT
gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY
'testepppoe2' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT
gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.200.2'
) ORDER BY
ID) UNION
ALL SELECT DISTINCT (R.id), R.username,
R.attribute, R.value, R.op FROM
mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist
M WHERE R.username = BINARY
'testepppoe2' AND M.usuario_login =
BINARY 'testepppoe2' AND M.grupocliente
= 'ALL-POPS'
(0) sql: WARNING: User not found in radcheck table.
rlm_sql (sql): 1 of 1 connections in use. You may need to increase "spare"
rlm_sql (sql): Opening additional connection (7), 1 of 31 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'mpc_freeradius' on
mysql.mpc.com.br via TCP/IP, server version 5.7.32-0ubuntu0.16.04.1-log,
protocol version 10
rlm_sql (sql): Reserved connection (7)
rlm_sql (sql): Released connection (7)
Need 1 more connections to reach min connections (3)
rlm_sql (sql): Opening additional connection (8), 1 of 30 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'mpc_freeradius' on
mysql.mpc.com.br via TCP/IP, server version 5.7.32-0ubuntu0.16.04.1-log,
protocol version 10
(0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username =
'%{SQL-User-Name}' ORDER BY priority
(0) sql: --> SELECT groupname FROM radusergroup WHERE username =
'testepppoe2' ORDER BY priority
(0) sql: Executing select query: SELECT groupname FROM radusergroup
WHERE username = 'testepppoe2' ORDER BY priority
(0) sql: User not found in any groups
rlm_sql (sql): Released connection (6)
(0) [sql] = notfound
(0) [expiration] = noop
(0) [logintime] = noop
(0) pap: WARNING: No "known good" password found for the user. Not
setting Auth-Type
(0) pap: WARNING: Authentication will fail unless a "known good"
password is available
(0) [pap] = noop
(0) } # authorize = ok
(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type =
Reject
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
(0) # Executing group from file /etc/freeradius/sites-enabled/default
(0) Post-Auth-Type REJECT {
(0) attr_filter.access_reject: EXPAND %{User-Name}
(0) attr_filter.access_reject: --> testepppoe2
(0) attr_filter.access_reject: Matched entry DEFAULT at line 11
(0) [attr_filter.access_reject] = updated
(0) policy remove_reply_message_if_eap {
(0) if (&reply:EAP-Message && &reply:Reply-Message) {
(0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(0) else {
(0) [noop] = noop
(0) } # else = noop
(0) } # policy remove_reply_message_if_eap = noop
(0) update control {
(0) Pool-Name := "mkt_pool"
(0) } # update control = noop
(0) update reply {
(0) Mikrotik-Rate-Limit := "2M/2M"
(0) Framed-IP-Address !* ANY
(0) } # update reply = noop
(0) } # Post-Auth-Type REJECT = updated
(0) Login incorrect (No Auth-Type found: rejecting the user via
Post-Auth-Type = Reject): [testepppoe2/testeppp] (from client
ce-pop-encol port 15729152 cli D8:77:8B:65:C5:B4)
(0) Delaying response for 1.000000 seconds
Waking up in 0.5 seconds.
Waking up in 0.4 seconds.
(0) Sending delayed response
(0) Sent Access-Reject Id 71 from XXX.XXX.XXX.XXX:1812 to
172.17.200.2:33183 length 33
(0) Mikrotik-Rate-Limit := "2M/2M"
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 71 with timestamp +76
Ready to process requests
How can I solve this?
Thanks
Aurélio
More information about the Freeradius-Users
mailing list