Hi guys
Here's something I've been worrying about for a while. As we were
braintorming a while ago, some of us figured this could be a bug/feature
instead of a programming issue. We managed to trim down the code to the
following testing lines. Our doubt is if should be this the correct
behaviour for
Radiator. ..
AuthBySQL gets the user reply attributes and then a PostAuthHook is called
which simply denies the access to the user. Even so it denies the access,
all the attributes which were stored by the AuthBySQL query are still sent
back to the NAS...
I used to work with a similar setup, using AuthByLDAP instead of AuthBySQL
and I don't remember seeing this happen anywhere...
Any help?
>>> this is the authentication only radius configuration file
LogDir /export/home/bter/logs
DbDir /export/home/bter/cfg
PidFile %L/authentication.pid
LogFile %L/debug_auth.log
Trace 4
AuthPort 1645
AcctPort
DictionaryFile /usr/local/etc/dictionary
RewriteUsername s/[^a-zA-Z0-9.\$\-\@\_]//gx
<Client DEFAULT>
Secret blashfoni
DupInterval 0
</Client>
<AuthBy SQL>
Identifier authdre
# Adjust DBSource, DBUsername, DBAuth to suit your DB
DBSource dbi:mysql:radius
DBUsername radius
DBAuth radrad
# Let the user in if they have any time left, set
# the Session-timeout to the time left
AuthSelect select PASSWORD,LNSATTR from SUBSCRIBERS where
USERNAME=%0
AuthColumnDef 0,User-Password,check
AuthColumnDef 1,GENERIC, reply
</AuthBy>
<Handler Service-Type="Outbound-User">
AuthBy authdre
PostAuthHook file:"%D/PostVPDN.hook"
</Handler>
<Handler User-Name=/\@/>
AuthBy authdre
PostAuthHook file:"%D/PostVPDN.hook"
</Handler>
>>> now this is PostVPDN.hook
sub
my $r = ${$_[0]}; #this is the request object
my $rp = ${$_[1]}; #this is the response object
my $result = ${$_[2]}; #this is the status of the authentication so far
my $stype = $r->get_attr('Service-Type');
my $code = $r->code;
if ($code eq 'Access-Request')
${$_[2]} = $main::REJECT ;
${$_[1]}->change_attr('Reply-Message' , 'no way, jose');
return;
}
}
>>> this is the "radpwtst -secret blashfoni -user bruno@testedre -password
bruno -noacct -trace" output
sending Access-Request...
Packet dump:
*** Sending to 127.0.0.1 port 1645 ....
Code: Access-Request
Identifier: 87
Authentic: 1234567890123456
Attributes:
User-Name = "bruno@testedre"
Service-Type = Framed-User
NAS-IP-Address = 203.63.154.1
NAS-Port = 1234
Called-Station-Id = "123456789"
Calling-Station-Id = "987654321"
NAS-Port-Type = Async
User-Password = "<224>8C<211><128><182><224>:=<198>I]"
Packet dump:
*** Received from 127.0.0.1 port 1645 ....
Code: Access-Reject
Identifier: 87
Authentic: <187><136><241>'<1>,<194><215>4<<9><199>= <22>S
Attributes:
cisco-avpair = "ip:addr-pool=ltwo"
cisco-avpair = "service=ppp"
Service-Type = Framed-User
Framed-Protocol = PPP
Reply-Message = "no way, jose"
Reply-Message = "Request Denied"
Rejected: no way, jose
>>> and this is the radius debug log:
Thu Jun 6 18:36:39 2002: DEBUG: Packet dump:
*** Received from 127.0.0.1 port 45573 ....
Code: Access-Request
Identifier: 129
Authentic: 1234567890123456
Attributes:
User-Name = "bruno@testedre"
Service-Type = Framed-User
NAS-IP-Address = 203.63.154.1
NAS-Port = 1234
Called-Station-Id = "123456789"
Calling-Station-Id = "987654321"
NAS-Port-Type = Async
User-Password = "<224>8C<211><128><182><224>:=<198>I]"
Thu Jun 6 18:36:39 2002: DEBUG: Rewrote user name to bruno@testedre
Thu Jun 6 18:36:39 2002: DEBUG: Handling request with Handler
'User-Name=/\@/'
Thu Jun 6 18:36:39 2002: DEBUG: Deleting session for bruno@testedre,
203.63.154.1, 1234
Thu Jun 6 18:36:39 2002: DEBUG: Handling with Radius::AuthSQL
Thu Jun 6 18:36:39 2002: DEBUG: Handling with Radius::AuthSQL: authdre
Thu Jun 6 18:36:39 2002: DEBUG: Query is: select PASSWORD,LNSATTR from
SUBSCRIBERS where USERNAME='bruno@testedre'
Thu Jun 6 18:36:39 2002: DEBUG: Radius::AuthSQL looks for match with
bruno@testedre
Thu Jun 6 18:36:39 2002: DEBUG: Radius::AuthSQL ACCEPT:
Thu Jun 6 18:36:39 2002: INFO: Access rejected for bruno@testedre:
Thu Jun 6 18:36:39 2002: DEBUG: Packet dump:
*** Sending to 127.0.0.1 port 45573 ....
Code: Access-Reject
Identifier: 129
Authentic: 1234567890123456
Attributes:
cisco-avpair = "ip:addr-pool=ltwo"
cisco-avpair = "service=ppp"
Service-Type = Framed-User
Framed-Protocol = PPP
Reply-Message = "nepias"
Reply-Message = "Request Denied"
===
Archive at http://www.open.com.au/archives/radiator/
Announcements on [EMAIL PROTECTED]
To unsubscribe, email '[EMAIL PROTECTED]' with
'unsubscribe radiator' in the body of the message.
