Hello All,
OK, I am somewhat abandoning trying to use LDAP as I thought RADIUS might
be easier.
I'm trying to use JumpCloud's Radius-as-a-Service. If I tell my AP to use
their RADIUS server directly, authentication works. However, I'd like to
use PacketFence as a go-between to use dynamic VLANs and the quarantine
functionality.
I'm testing with PacketFence-ZEN 7.4.0
However, PacketFence's RADIUS debug logs says my username and password is
incorrect, even though it works if I bypass PacketFence. So somehow I'm
not getting PacketFence to proxy the authentication request correctly.
Unfortunately, as I can't directly manage the inner-workings of the
service, I can't confirm how the passwords are encrypted, but since a
direct access point connection works fine, I have a hard time believe that
PacketFence can't authenticate against it. Here're my configurations, and
the debug output...
proxy.conf.inc:
%%eduroam%%
%%config%%
home_server jumpcloud {
type = auth
ipaddr = 104.154.91.253
port = 1812
secret = mysupersecretsecret
require_message_authenticator = yes
}
home_server_pool bfacademy {
type = fail-over
home_server = jumpcloud
}
realm bfacademy.de {
auth_pool = bfacademy
strip
}
packetfence-tunnel:
authorize {
if ( outer.EAP-Type == TTLS) {
update request {
&EAP-Type := TTLS
}
}
filter_username
mschap
suffix
ntdomain
%%multi_domain%%
%%redis_ntlm_cache_fetch%%
### NOTE: I've tried with the "update control" section commented out, set
to LOCAL,
### and set like this. Same result regardless.
update control {
# &Proxy-To-Realm := LOCAL
Proxy-to-Realm := "bfacademy.de"
}
eap {
ok = return
}
rewrite_called_station_id
packetfence-local-auth
pap
}
authenticate {
Auth-Type PAP {
pap
}
Auth-Type CHAP {
chap
}
Auth-Type MS-CHAP {
packetfence # increment the StatsD counter
if(PacketFence-Domain) {
chrooted_mschap
}
else {
mschap
}
if(&control:NT-Password && &control:NT-Password != "") {
mschap_local {
reject = 2
}
if (reject || fail) {
packetfence-mschap-authenticate
}
}
else {
packetfence-mschap-authenticate
}
}
eap
}
My RADIUS debug output:
[root@PacketFence-ZEN pf]# cat debuglog.log
(0) Thu Apr 19 13:52:36 2018: Debug: Received Access-Request Id 48 from
172.20.242.102:46157 to 172.20.242.98:1812 length 203
(0) Thu Apr 19 13:52:36 2018: Debug: User-Name = "[email protected]
"
(0) Thu Apr 19 13:52:36 2018: Debug: NAS-IP-Address = 172.20.242.102
(0) Thu Apr 19 13:52:36 2018: Debug: NAS-Identifier = "788a208cc8e2"
(0) Thu Apr 19 13:52:36 2018: Debug: NAS-Port = 0
(0) Thu Apr 19 13:52:36 2018: Debug: Called-Station-Id =
"78-8A-20-8D-C8-E2:Beta-BFA"
(0) Thu Apr 19 13:52:36 2018: Debug: Calling-Station-Id =
"A8-7C-01-A2-60-6F"
(0) Thu Apr 19 13:52:36 2018: Debug: Framed-MTU = 1400
(0) Thu Apr 19 13:52:36 2018: Debug: NAS-Port-Type = Wireless-802.11
(0) Thu Apr 19 13:52:36 2018: Debug: Connect-Info = "CONNECT 0Mbps
802.11b"
(0) Thu Apr 19 13:52:36 2018: Debug: EAP-Message =
0x02d4001d016a6f73682e6e617468616e40626661636164656d792e6465
(0) Thu Apr 19 13:52:36 2018: Debug: Message-Authenticator =
0xdf7fa16da736e74d7c4a2b520b9b3e48
(0) Thu Apr 19 13:52:36 2018: Debug: # Executing section authorize from
file /usr/local/pf/raddb/sites-enabled/packetfence
(0) Thu Apr 19 13:52:36 2018: Debug: authorize {
(0) Thu Apr 19 13:52:36 2018: Debug: update {
(0) Thu Apr 19 13:52:36 2018: Debug: EXPAND %{Packet-Src-IP-Address}
(0) Thu Apr 19 13:52:36 2018: Debug: --> 172.20.242.102
(0) Thu Apr 19 13:52:36 2018: Debug: EXPAND %l
(0) Thu Apr 19 13:52:36 2018: Debug: --> 1524138756
(0) Thu Apr 19 13:52:36 2018: Debug: } # update = noop
(0) Thu Apr 19 13:52:36 2018: Debug: policy rewrite_calling_station_id {
(0) Thu Apr 19 13:52:36 2018: Debug: if (&Calling-Station-Id &&
(&Calling-Station-Id =~
/^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i))
{
(0) Thu Apr 19 13:52:36 2018: Debug: if (&Calling-Station-Id &&
(&Calling-Station-Id =~
/^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i))
-> TRUE
(0) Thu Apr 19 13:52:36 2018: Debug: if (&Calling-Station-Id &&
(&Calling-Station-Id =~
/^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i))
{
(0) Thu Apr 19 13:52:36 2018: Debug: update request {
(0) Thu Apr 19 13:52:36 2018: Debug: EXPAND
%{tolower:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}}
(0) Thu Apr 19 13:52:36 2018: Debug: --> a8:7c:01:a2:60:6f
(0) Thu Apr 19 13:52:36 2018: Debug: } # update request = noop
(0) Thu Apr 19 13:52:36 2018: Debug: [updated] = updated
(0) Thu Apr 19 13:52:36 2018: Debug: } # if (&Calling-Station-Id &&
(&Calling-Station-Id =~
/^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i))
= updated
(0) Thu Apr 19 13:52:36 2018: Debug: ... skipping else: Preceding
"if" was taken
(0) Thu Apr 19 13:52:36 2018: Debug: } # policy
rewrite_calling_station_id = updated
(0) Thu Apr 19 13:52:36 2018: Debug: policy rewrite_called_station_id {
(0) Thu Apr 19 13:52:36 2018: Debug: if ((&Called-Station-Id) &&
(&Called-Station-Id =~
/^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i))
{
(0) Thu Apr 19 13:52:36 2018: Debug: if ((&Called-Station-Id) &&
(&Called-Station-Id =~
/^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i))
-> TRUE
(0) Thu Apr 19 13:52:36 2018: Debug: if ((&Called-Station-Id) &&
(&Called-Station-Id =~
/^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i))
{
(0) Thu Apr 19 13:52:36 2018: Debug: update request {
(0) Thu Apr 19 13:52:36 2018: Debug: EXPAND
%{tolower:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}}
(0) Thu Apr 19 13:52:36 2018: Debug: --> 78:8a:20:8d:c8:e2
(0) Thu Apr 19 13:52:36 2018: Debug: } # update request = noop
(0) Thu Apr 19 13:52:36 2018: Debug: if ("%{8}") {
(0) Thu Apr 19 13:52:36 2018: Debug: EXPAND %{8}
(0) Thu Apr 19 13:52:36 2018: Debug: --> Beta-BFA
(0) Thu Apr 19 13:52:36 2018: Debug: if ("%{8}") -> TRUE
(0) Thu Apr 19 13:52:36 2018: Debug: if ("%{8}") {
(0) Thu Apr 19 13:52:36 2018: Debug: update request {
(0) Thu Apr 19 13:52:36 2018: Debug: EXPAND
%{Called-Station-Id}:%{8}
(0) Thu Apr 19 13:52:36 2018: Debug: -->
78:8a:20:8d:c8:e2:Beta-BFA
(0) Thu Apr 19 13:52:36 2018: Debug: EXPAND %{8}
(0) Thu Apr 19 13:52:36 2018: Debug: --> Beta-BFA
(0) Thu Apr 19 13:52:36 2018: Debug: } # update request = noop
(0) Thu Apr 19 13:52:36 2018: Debug: } # if ("%{8}") = noop
(0) Thu Apr 19 13:52:36 2018: Debug: ... skipping elsif: Preceding
"if" was taken
(0) Thu Apr 19 13:52:36 2018: Debug: ... skipping elsif: Preceding
"if" was taken
(0) Thu Apr 19 13:52:36 2018: Debug: ... skipping elsif: Preceding
"if" was taken
(0) Thu Apr 19 13:52:36 2018: Debug: [updated] = updated
(0) Thu Apr 19 13:52:36 2018: Debug: } # if ((&Called-Station-Id) &&
(&Called-Station-Id =~
/^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i))
= updated
(0) Thu Apr 19 13:52:36 2018: Debug: ... skipping else: Preceding
"if" was taken
(0) Thu Apr 19 13:52:36 2018: Debug: } # policy
rewrite_called_station_id = updated
(0) Thu Apr 19 13:52:36 2018: Debug: policy filter_username {
(0) Thu Apr 19 13:52:36 2018: Debug: if (&User-Name) {
(0) Thu Apr 19 13:52:36 2018: Debug: if (&User-Name) -> TRUE
(0) Thu Apr 19 13:52:36 2018: Debug: if (&User-Name) {
(0) Thu Apr 19 13:52:36 2018: Debug: if (&User-Name =~ / /) {
(0) Thu Apr 19 13:52:36 2018: Debug: if (&User-Name =~ / /) ->
FALSE
(0) Thu Apr 19 13:52:36 2018: Debug: if (&User-Name =~ /@[^@]*@/ ) {
(0) Thu Apr 19 13:52:36 2018: Debug: if (&User-Name =~ /@[^@]*@/ )
-> FALSE
(0) Thu Apr 19 13:52:36 2018: Debug: if (&User-Name =~ /\.\./ ) {
(0) Thu Apr 19 13:52:36 2018: Debug: if (&User-Name =~ /\.\./ ) ->
FALSE
(0) Thu Apr 19 13:52:36 2018: Debug: if ((&User-Name =~ /@/) &&
(&User-Name !~ /@(.+)\.(.+)$/)) {
(0) Thu Apr 19 13:52:36 2018: Debug: if ((&User-Name =~ /@/) &&
(&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE
(0) Thu Apr 19 13:52:36 2018: Debug: if (&User-Name =~ /\.$/) {
(0) Thu Apr 19 13:52:36 2018: Debug: if (&User-Name =~ /\.$/) ->
FALSE
(0) Thu Apr 19 13:52:36 2018: Debug: if (&User-Name =~ /@\./) {
(0) Thu Apr 19 13:52:36 2018: Debug: if (&User-Name =~ /@\./) ->
FALSE
(0) Thu Apr 19 13:52:36 2018: Debug: } # if (&User-Name) = updated
(0) Thu Apr 19 13:52:36 2018: Debug: } # policy filter_username =
updated
(0) Thu Apr 19 13:52:36 2018: Debug: policy filter_password {
(0) Thu Apr 19 13:52:36 2018: Debug: if (&User-Password &&
(&User-Password != "%{string:User-Password}")) {
(0) Thu Apr 19 13:52:36 2018: Debug: if (&User-Password &&
(&User-Password != "%{string:User-Password}")) -> FALSE
(0) Thu Apr 19 13:52:36 2018: Debug: } # policy filter_password =
updated
(0) Thu Apr 19 13:52:36 2018: Debug: [preprocess] = ok
(0) Thu Apr 19 13:52:36 2018: Debug: suffix: Checking for suffix after "@"
(0) Thu Apr 19 13:52:36 2018: Debug: suffix: Looking up realm "bfacademy.de"
for User-Name = "[email protected]"
(0) Thu Apr 19 13:52:36 2018: Debug: suffix: Found realm "bfacademy.de"
(0) Thu Apr 19 13:52:36 2018: Debug: suffix: Adding Stripped-User-Name =
"josh.nathan"
(0) Thu Apr 19 13:52:36 2018: Debug: suffix: Adding Realm = "bfacademy.de"
(0) Thu Apr 19 13:52:36 2018: Debug: suffix: Proxying request from user
josh.nathan to realm bfacademy.de
(0) Thu Apr 19 13:52:36 2018: Debug: suffix: Preparing to proxy
authentication request to realm "bfacademy.de"
(0) Thu Apr 19 13:52:36 2018: Debug: [suffix] = updated
(0) Thu Apr 19 13:52:36 2018: Debug: ntdomain: Request already has
destination realm set. Ignoring
(0) Thu Apr 19 13:52:36 2018: Debug: [ntdomain] = noop
(0) Thu Apr 19 13:52:36 2018: Debug: eap: Request is supposed to be proxied
to Realm bfacademy.de. Not doing EAP.
(0) Thu Apr 19 13:52:36 2018: Debug: [eap] = noop
(0) Thu Apr 19 13:52:36 2018: Debug: if ( !EAP-Message ) {
(0) Thu Apr 19 13:52:36 2018: Debug: if ( !EAP-Message ) -> FALSE
(0) Thu Apr 19 13:52:36 2018: Debug: policy packetfence-eap-mac-policy {
(0) Thu Apr 19 13:52:36 2018: Debug: if ( &EAP-Type ) {
(0) Thu Apr 19 13:52:36 2018: Debug: if ( &EAP-Type ) -> TRUE
(0) Thu Apr 19 13:52:36 2018: Debug: if ( &EAP-Type ) {
(0) Thu Apr 19 13:52:36 2018: Debug: if (&Calling-Station-Id &&
(&Calling-Station-Id =~
/^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i))
{
(0) Thu Apr 19 13:52:36 2018: Debug: if (&Calling-Station-Id &&
(&Calling-Station-Id =~
/^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i))
-> TRUE
(0) Thu Apr 19 13:52:36 2018: Debug: if (&Calling-Station-Id &&
(&Calling-Station-Id =~
/^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i))
{
(0) Thu Apr 19 13:52:36 2018: Debug: update {
(0) Thu Apr 19 13:52:36 2018: Debug: EXPAND
%{tolower:%{1}%{2}%{3}%{4}%{5}%{6}}
(0) Thu Apr 19 13:52:36 2018: Debug: --> a87c01a2606f
(0) Thu Apr 19 13:52:36 2018: Debug: } # update = noop
(0) Thu Apr 19 13:52:36 2018: Debug: if ( &Tmp-String-1 ==
"%{tolower:%{User-Name}}" ) {
(0) Thu Apr 19 13:52:36 2018: Debug: EXPAND
%{tolower:%{User-Name}}
(0) Thu Apr 19 13:52:36 2018: Debug: -->
[email protected]
(0) Thu Apr 19 13:52:36 2018: Debug: if ( &Tmp-String-1 ==
"%{tolower:%{User-Name}}" ) -> FALSE
(0) Thu Apr 19 13:52:36 2018: Debug: } # if (&Calling-Station-Id &&
(&Calling-Station-Id =~
/^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i))
= noop
(0) Thu Apr 19 13:52:36 2018: Debug: } # if ( &EAP-Type ) = noop
(0) Thu Apr 19 13:52:36 2018: Debug: [noop] = noop
(0) Thu Apr 19 13:52:36 2018: Debug: } # policy
packetfence-eap-mac-policy = noop
(0) Thu Apr 19 13:52:36 2018: WARNING: pap:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(0) Thu Apr 19 13:52:36 2018: WARNING: pap: !!! Ignoring
control:User-Password. Update your !!!
(0) Thu Apr 19 13:52:36 2018: WARNING: pap: !!! configuration so that the
"known good" clear text !!!
(0) Thu Apr 19 13:52:36 2018: WARNING: pap: !!! password is in
Cleartext-Password and NOT in !!!
(0) Thu Apr 19 13:52:36 2018: WARNING: pap: !!! User-Password.
!!!
(0) Thu Apr 19 13:52:36 2018: WARNING: pap:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(0) Thu Apr 19 13:52:36 2018: Debug: [pap] = noop
(0) Thu Apr 19 13:52:36 2018: Debug: } # authorize = updated
(0) Thu Apr 19 13:52:36 2018: Debug: Starting proxy to home server
104.154.91.253 port 1812
(0) Thu Apr 19 13:52:36 2018: Debug: Sent Access-Request Id 104 from
0.0.0.0:53248 to 104.154.91.253:1812 length 200
(0) Thu Apr 19 13:52:36 2018: Debug: User-Name = "josh.nathan"
(0) Thu Apr 19 13:52:36 2018: Debug: NAS-IP-Address = 172.20.242.102
(0) Thu Apr 19 13:52:36 2018: Debug: NAS-Identifier = "788a208cc8e2"
(0) Thu Apr 19 13:52:36 2018: Debug: NAS-Port = 0
(0) Thu Apr 19 13:52:36 2018: Debug: Calling-Station-Id :=
"a8:7c:01:a2:60:6f"
(0) Thu Apr 19 13:52:36 2018: Debug: Framed-MTU = 1400
(0) Thu Apr 19 13:52:36 2018: Debug: NAS-Port-Type = Wireless-802.11
(0) Thu Apr 19 13:52:36 2018: Debug: Connect-Info = "CONNECT 0Mbps
802.11b"
(0) Thu Apr 19 13:52:36 2018: Debug: EAP-Message =
0x02d4001d016a6f73682e6e617468616e40626661636164656d792e6465
(0) Thu Apr 19 13:52:36 2018: Debug: Message-Authenticator =
0xdf7fa16da736e74d7c4a2b520b9b3e48
(0) Thu Apr 19 13:52:36 2018: Debug: Called-Station-Id :=
"78:8a:20:8d:c8:e2:Beta-BFA"
(0) Thu Apr 19 13:52:36 2018: Debug: Event-Timestamp = "Apr 19 2018
13:52:36 CEST"
(0) Thu Apr 19 13:52:36 2018: Debug: Proxy-State = 0x3438
(0) Thu Apr 19 13:52:36 2018: Debug: Expecting proxy response no later than
9.668338 seconds from now
(0) Thu Apr 19 13:52:37 2018: Debug: Clearing existing &reply: attributes
(0) Thu Apr 19 13:52:37 2018: Debug: Received Access-Reject Id 104 from
104.154.91.253:1812 to 172.20.242.98:53248 length 24
(0) Thu Apr 19 13:52:37 2018: Debug: Proxy-State = 0x3438
(0) Thu Apr 19 13:52:37 2018: Debug: # Executing section post-proxy from
file /usr/local/pf/raddb/sites-enabled/packetfence
(0) Thu Apr 19 13:52:37 2018: Debug: post-proxy {
(0) Thu Apr 19 13:52:37 2018: Debug: eap: No pre-existing handler found
(0) Thu Apr 19 13:52:37 2018: Debug: [eap] = noop
(0) Thu Apr 19 13:52:37 2018: Debug: } # post-proxy = noop
(0) Thu Apr 19 13:52:37 2018: Debug: Using Post-Auth-Type Reject
(0) Thu Apr 19 13:52:37 2018: Debug: # Executing group from file
/usr/local/pf/raddb/sites-enabled/packetfence
(0) Thu Apr 19 13:52:37 2018: Debug: Post-Auth-Type REJECT {
(0) Thu Apr 19 13:52:37 2018: Debug: update {
(0) Thu Apr 19 13:52:37 2018: Debug: } # update = noop
(0) Thu Apr 19 13:52:37 2018: Debug: if (! EAP-Type || (EAP-Type !=
TTLS && EAP-Type != PEAP) ) {
(0) Thu Apr 19 13:52:37 2018: Debug: if (! EAP-Type || (EAP-Type !=
TTLS && EAP-Type != PEAP) ) -> TRUE
(0) Thu Apr 19 13:52:37 2018: Debug: if (! EAP-Type || (EAP-Type !=
TTLS && EAP-Type != PEAP) ) {
(0) Thu Apr 19 13:52:37 2018: Debug: policy
packetfence-audit-log-reject {
(0) Thu Apr 19 13:52:37 2018: Debug: if (&User-Name != "dummy") {
(0) Thu Apr 19 13:52:37 2018: Debug: if (&User-Name != "dummy") ->
TRUE
(0) Thu Apr 19 13:52:37 2018: Debug: if (&User-Name != "dummy") {
(0) Thu Apr 19 13:52:37 2018: Debug: policy request-timing {
(0) Thu Apr 19 13:52:37 2018: Debug: if
(control:PacketFence-Request-Time != 0) {
(0) Thu Apr 19 13:52:37 2018: Debug: if
(control:PacketFence-Request-Time != 0) -> FALSE
(0) Thu Apr 19 13:52:37 2018: Debug: } # policy request-timing =
noop
(0) Thu Apr 19 13:52:37 2018: Debug: sql_reject: EXPAND type.reject.query
(0) Thu Apr 19 13:52:37 2018: Debug: sql_reject: --> type.reject.query
(0) Thu Apr 19 13:52:37 2018: Debug: sql_reject: Using query template
'query'
(0) Thu Apr 19 13:52:37 2018: Debug: sql_reject: EXPAND %{User-Name}
(0) Thu Apr 19 13:52:37 2018: Debug: sql_reject: -->
[email protected]
(0) Thu Apr 19 13:52:37 2018: Debug: sql_reject: SQL-User-Name set to '
[email protected]'
(0) Thu Apr 19 13:52:37 2018: Debug: sql_reject: EXPAND INSERT INTO
radius_audit_log ( mac, ip, computer_name, user_name,
stripped_user_name, realm, event_type, switch_id,
switch_mac, switch_ip_address, radius_source_ip_address,
called_station_id, calling_station_id, nas_port_type, ssid,
nas_port_id, ifindex, nas_port, connection_type,
nas_ip_address, nas_identifier, auth_status, reason,
auth_type, eap_type, role, node_status, profile,
source, auto_reg, is_phone, pf_domain, uuid,
radius_request, radius_reply, request_time)
VALUES ( '%{request:Calling-Station-Id}',
'%{request:Framed-IP-Address}',
'%{%{control:PacketFence-Computer-Name}:-N/A}', '%{request:User-Name}',
'%{request:Stripped-User-Name}', '%{request:Realm}',
'Radius-Access-Request',
'%{%{control:PacketFence-Switch-Id}:-N/A}',
'%{%{control:PacketFence-Switch-Mac}:-N/A}',
'%{%{control:PacketFence-Switch-Ip-Address}:-N/A}',
'%{Packet-Src-IP-Address}', '%{request:Called-Station-Id}',
'%{request:Calling-Station-Id}', '%{request:NAS-Port-Type}',
'%{request:Called-Station-SSID}', '%{request:NAS-Port-Id}',
'%{%{control:PacketFence-IfIndex}:-N/A}', '%{request:NAS-Port}',
'%{%{control:PacketFence-Connection-Type}:-N/A}',
'%{request:NAS-IP-Address}', '%{request:NAS-Identifier}', 'Reject',
'%{request:Module-Failure-Message}', '%{control:Auth-Type}',
'%{request:EAP-Type}',
'%{%{control:PacketFence-Role}:-N/A}',
'%{%{control:PacketFence-Status}:-N/A}',
'%{%{control:PacketFence-Profile}:-N/A}',
'%{%{control:PacketFence-Source}:-N/A}',
'%{%{control:PacketFence-AutoReg}:-0}',
'%{%{control:PacketFence-IsPhone}:-0}',
'%{request:PacketFence-Domain}', '',
'%{pairs:&request:[*]}','%{pairs:&reply:[*]}',
'%{%{control:PacketFence-Request-Time}:-N/A}')
(0) Thu Apr 19 13:52:37 2018: Debug: sql_reject: --> INSERT INTO
radius_audit_log ( mac, ip, computer_name, user_name,
stripped_user_name, realm, event_type, switch_id,
switch_mac, switch_ip_address, radius_source_ip_address,
called_station_id, calling_station_id, nas_port_type, ssid,
nas_port_id, ifindex, nas_port, connection_type,
nas_ip_address, nas_identifier, auth_status, reason,
auth_type, eap_type, role, node_status, profile,
source, auto_reg, is_phone, pf_domain, uuid,
radius_request, radius_reply, request_time)
VALUES ( 'a8:7c:01:a2:60:6f', '', 'N/A', '
[email protected]', 'josh.nathan', 'bfacademy.de',
'Radius-Access-Request', 'N/A', 'N/A', 'N/A',
'172.20.242.102', '78:8a:20:8d:c8:e2:Beta-BFA', 'a8:7c:01:a2:60:6f',
'Wireless-802.11', 'Beta-BFA', '', 'N/A', '0',
'N/A', '172.20.242.102', '788a208cc8e2', 'Reject',
'', '', 'Identity', 'N/A', 'N/A', 'N/A',
'N/A', '0', '0', '', '', 'User-Name =3D =
[email protected]=22=2C NAS-IP-Address =3D 172.20.242.102=2C
NAS-Identifier =3D =22788a208cc8e2=22=2C NAS-Port =3D 0=2C
Calling-Station-Id =3D =22a8:7c:01:a2:60:6f=22=2C Framed-MTU =3D 1400=2C
NAS-Port-Type =3D Wireless-802.11=2C Connect-Info =3D =22CONNECT 0Mbps
802.11b=22=2C EAP-Message =3D
0x02d4001d016a6f73682e6e617468616e40626661636164656d792e6465=2C
Message-Authenticator =3D 0xdf7fa16da736e74d7c4a2b520b9b3e48=2C
FreeRADIUS-Client-IP-Address =3D 172.20.242.102=2C Called-Station-Id =3D
=2278:8a:20:8d:c8:e2:Beta-BFA=22=2C Called-Station-SSID =3D
=22Beta-BFA=22=2C Event-Timestamp =3D =22Apr 19 2018 13:52:36 CEST=22=2C
Stripped-User-Name =3D =22josh.nathan=22=2C Realm =3D =22bfacademy.de=22=2C
EAP-Type =3D Identity=2C Tmp-String-1 =3D =22a87c01a2606f=22=2C Realm =3D =
22bfacademy.de=22=2C User-Password =3D =22=2A=2A=2A=2A=2A=2A=22=2C
SQL-User-Name =3D [email protected]=22','', '0')
(0) Thu Apr 19 13:52:37 2018: Debug: sql_reject: Executing query: INSERT
INTO radius_audit_log ( mac, ip, computer_name, user_name,
stripped_user_name, realm, event_type,
switch_id, switch_mac, switch_ip_address,
radius_source_ip_address, called_station_id, calling_station_id,
nas_port_type, ssid, nas_port_id, ifindex, nas_port,
connection_type, nas_ip_address, nas_identifier,
auth_status, reason, auth_type, eap_type,
role, node_status, profile, source, auto_reg, is_phone,
pf_domain, uuid, radius_request, radius_reply,
request_time) VALUES ( 'a8:7c:01:a2:60:6f', '',
'N/A', '[email protected]', 'josh.nathan', '
bfacademy.de', 'Radius-Access-Request', 'N/A', 'N/A',
'N/A', '172.20.242.102', '78:8a:20:8d:c8:e2:Beta-BFA',
'a8:7c:01:a2:60:6f', 'Wireless-802.11', 'Beta-BFA', '',
'N/A', '0', 'N/A', '172.20.242.102',
'788a208cc8e2', 'Reject', '', '', 'Identity',
'N/A', 'N/A', 'N/A', 'N/A', '0', '0', '',
'', 'User-Name =3D [email protected]=22=2C NAS-IP-Address =3D
172.20.242.102=2C NAS-Identifier =3D =22788a208cc8e2=22=2C NAS-Port =3D
0=2C Calling-Station-Id =3D =22a8:7c:01:a2:60:6f=22=2C Framed-MTU =3D
1400=2C NAS-Port-Type =3D Wireless-802.11=2C Connect-Info =3D =22CONNECT
0Mbps 802.11b=22=2C EAP-Message =3D
0x02d4001d016a6f73682e6e617468616e40626661636164656d792e6465=2C
Message-Authenticator =3D 0xdf7fa16da736e74d7c4a2b520b9b3e48=2C
FreeRADIUS-Client-IP-Address =3D 172.20.242.102=2C Called-Station-Id =3D
=2278:8a:20:8d:c8:e2:Beta-BFA=22=2C Called-Station-SSID =3D
=22Beta-BFA=22=2C Event-Timestamp =3D =22Apr 19 2018 13:52:36 CEST=22=2C
Stripped-User-Name =3D =22josh.nathan=22=2C Realm =3D =22bfacademy.de=22=2C
EAP-Type =3D Identity=2C Tmp-String-1 =3D =22a87c01a2606f=22=2C Realm =3D =
22bfacademy.de=22=2C User-Password =3D =22=2A=2A=2A=2A=2A=2A=22=2C
SQL-User-Name =3D [email protected]=22','', '0')
(0) Thu Apr 19 13:52:37 2018: Debug: sql_reject: SQL query returned: success
(0) Thu Apr 19 13:52:37 2018: Debug: sql_reject: 1 record(s) updated
(0) Thu Apr 19 13:52:37 2018: Debug: [sql_reject] = ok
(0) Thu Apr 19 13:52:37 2018: Debug: } # if (&User-Name !=
"dummy") = ok
(0) Thu Apr 19 13:52:37 2018: Debug: } # policy
packetfence-audit-log-reject = ok
(0) Thu Apr 19 13:52:37 2018: Debug: } # if (! EAP-Type || (EAP-Type !=
TTLS && EAP-Type != PEAP) ) = ok
(0) Thu Apr 19 13:52:37 2018: Debug: attr_filter.access_reject: EXPAND
%{User-Name}
(0) Thu Apr 19 13:52:37 2018: Debug: attr_filter.access_reject: -->
[email protected]
(0) Thu Apr 19 13:52:37 2018: Debug: attr_filter.access_reject: Matched
entry DEFAULT at line 11
(0) Thu Apr 19 13:52:37 2018: Debug: [attr_filter.access_reject] =
updated
(0) Thu Apr 19 13:52:37 2018: Debug: attr_filter.packetfence_post_auth:
EXPAND %{User-Name}
(0) Thu Apr 19 13:52:37 2018: Debug: attr_filter.packetfence_post_auth:
--> [email protected]
(0) Thu Apr 19 13:52:37 2018: Debug: attr_filter.packetfence_post_auth:
Matched entry DEFAULT at line 10
(0) Thu Apr 19 13:52:37 2018: Debug:
[attr_filter.packetfence_post_auth] = updated
(0) Thu Apr 19 13:52:37 2018: Debug: eap: Request was previously rejected,
inserting EAP-Failure
(0) Thu Apr 19 13:52:37 2018: Debug: eap: Sending EAP Failure (code 4) ID
212 length 4
(0) Thu Apr 19 13:52:37 2018: Debug: [eap] = updated
(0) Thu Apr 19 13:52:37 2018: Debug: policy remove_reply_message_if_eap
{
(0) Thu Apr 19 13:52:37 2018: Debug: if (&reply:EAP-Message &&
&reply:Reply-Message) {
(0) Thu Apr 19 13:52:37 2018: Debug: if (&reply:EAP-Message &&
&reply:Reply-Message) -> FALSE
(0) Thu Apr 19 13:52:37 2018: Debug: else {
(0) Thu Apr 19 13:52:37 2018: Debug: [noop] = noop
(0) Thu Apr 19 13:52:37 2018: Debug: } # else = noop
(0) Thu Apr 19 13:52:37 2018: Debug: } # policy
remove_reply_message_if_eap = noop
(0) Thu Apr 19 13:52:37 2018: Debug: linelog: EXPAND
messages.%{%{reply:Packet-Type}:-default}
(0) Thu Apr 19 13:52:37 2018: Debug: linelog: --> messages.Access-Reject
(0) Thu Apr 19 13:52:37 2018: Debug: linelog: EXPAND
[mac:%{Calling-Station-Id}] Rejected user: %{User-Name}
(0) Thu Apr 19 13:52:37 2018: Debug: linelog: -->
[mac:a8:7c:01:a2:60:6f] Rejected user: [email protected]
(0) Thu Apr 19 13:52:37 2018: Debug: [linelog] = ok
(0) Thu Apr 19 13:52:37 2018: Debug: } # Post-Auth-Type REJECT = updated
(0) Thu Apr 19 13:52:37 2018: Debug: Delaying response for 1.000000 seconds
(0) Thu Apr 19 13:52:38 2018: Debug: Sending delayed response
(0) Thu Apr 19 13:52:38 2018: Debug: Sent Access-Reject Id 48 from
172.20.242.98:1812 to 172.20.242.102:46157 length 44
(0) Thu Apr 19 13:52:38 2018: Debug: EAP-Message = 0x04d40004
(0) Thu Apr 19 13:52:38 2018: Debug: Message-Authenticator =
0x00000000000000000000000000000000
(0) Thu Apr 19 13:52:42 2018: Debug: Cleaning up request packet ID 48 with
timestamp +62
[root@PacketFence-ZEN pf]#
Joshua Nathan
*IT Supervisor*
Black Forest Academy
p: +49 (0) 7626 9161 630 m: +49 (0) 152 3452 0056
a:
w: Hammersteiner Straße 50, 79400 Kandern
bfacademy.de
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
