Paul Long wrote:
A man page (http://www.die.net/doc/linux/man/man5/users.5.html) for the
users file says, "Attribute := Value ... Always matches as a check
item..." So does that mean, no matter what the value is, it will always
Well, the wording might be a bit confusing.
FreeRadius works the following way:
1. All attribute-value pairs that come in are the "request" pairs
2. Internal server attribute per-request are the "config" pairs
3. Attribute-value pairs to go back to the client are the "reply" pairs
someuser User-Password := "somevalue"
...actually sets (unconditionally) the User-Password AVP in the "config"
items. This password is *COMPARED* to the password supplied by the
client in the "request" items. It's not a simple equality - a CHAP
request will require a challenge/response calculation with the config
password + request challenge and then an equality test of the chap response.
match the attribute? I don't see that happening. As an experiment, I
have a supplicant in a WiFi phone with user name of "plong" and password
of "123". With the following entry in the users file:
plong Auth-Type = Local, User-Password := "126"
...I assumed it would match even though the value is different; however,
Though I realise the terminology might be initially confusing, how did
you imagine a user with a password of "123" would be matched/accepted by
a password of "126".
it does not match, and the access request is rejected:
rlm_chap: login attempt by "plong" with CHAP password
rlm_chap: Using clear text password 126 for user plong authentication.
rlm_chap: Pasword check failed
To get it to match, I have to have the correct value:
plong Auth-Type = Local, User-Password := "123"
which results in this debug output:
rlm_chap: login attempt by "plong" with CHAP password
rlm_chap: Using clear text password 123 for user plong authentication.
rlm_chap: chap user plong authenticated succesfully
Yes...
In fact, := behaves exactly like == in this case. What's the deal? Why
doesn't := "always match?" Am I misunderstanding what it means to "match?"
As per man(5) users:
Attribute := Value
Always matches as a check item, and replaces in the
configuration items any attribute of the same name. If no attribute of
that name appears in the request, then this attribute is added. As a
reply item, it has an identical meaning, but for the reply items,
instead of the request items.
Basically, := is a "force set" operator. In a "check" item, it sets a
check/config pair. In a reply item, it sets/forces a reply pair.
See doc/aaa.txt
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
