Re: Capturing Access-Reject data in the radpostauth table

2010-04-30 Thread Alan DeKok
Aaron Paetznick wrote: > Huh. Then it should be working but it isn't. > > radiusd -X says: > ... > ++[pap] returns noop > No authenticate method (Auth-Type) configuration found for the request: > Rejecting the user > Failed to authenticate the user. > Login incorrect: [username/badpass] (from cli

Re: Capturing Access-Reject data in the radpostauth table

2010-04-29 Thread Aaron Paetznick
Huh. Then it should be working but it isn't. radiusd -X says: ... ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [username/badpass] (from client somenas port 0 cli somecallinginf

Re: Capturing Access-Reject data in the radpostauth table

2010-04-28 Thread Alan DeKok
Aaron Paetznick wrote: > I'm sorry, your explanation wasn't clear to me. How can I expose > Module-Failure-Message to or reference Module-Failure-Message within > rlm_sql? > > This, also, didn't work for me: > > post-auth { > ... > Post-Auth-Type REJECT { > update rep

Re: Capturing Access-Reject data in the radpostauth table

2010-04-28 Thread Aaron Paetznick
I'm sorry, your explanation wasn't clear to me. How can I expose Module-Failure-Message to or reference Module-Failure-Message within rlm_sql? This, also, didn't work for me: post-auth { ... Post-Auth-Type REJECT { update reply { Reply-M

Re: Capturing Access-Reject data in the radpostauth table

2010-04-28 Thread Alan DeKok
Aaron Paetznick wrote: > On 4/28/2010 3:23 PM, Alan DeKok wrote: >> >>Uh... did you update your schema to have a "message" colummn? > > Yes, I have extended my radpostauth table with columns to hold the > message and the nasipaddress. It is working perfectly if I use > '%{reply:Reply-Message}

Re: Capturing Access-Reject data in the radpostauth table

2010-04-28 Thread Aaron Paetznick
On 4/28/2010 3:23 PM, Alan DeKok wrote: Uh... did you update your schema to have a "message" colummn? Yes, I have extended my radpostauth table with columns to hold the message and the nasipaddress. It is working perfectly if I use '%{reply:Reply-Message}', but it is always empty if I us

Re: Capturing Access-Reject data in the radpostauth table

2010-04-28 Thread Alan DeKok
Aaron Paetznick wrote: > Huh. Here's my complete SQL query: > > postauth_query = "INSERT INTO ${postauth_table} \ > (username, pass, reply, authdate, message, > nasipaddress) \ > VALUES ( \ > '%{User-Name}', \ >

Re: Capturing Access-Reject data in the radpostauth table

2010-04-28 Thread Aaron Paetznick
Huh. Here's my complete SQL query: postauth_query = "INSERT INTO ${postauth_table} \ (username, pass, reply, authdate, message, nasipaddress) \ VALUES ( \ '%{User-Name}', \ '%{%{User

Re: Capturing Access-Reject data in the radpostauth table

2010-04-28 Thread Alan DeKok
Aaron Paetznick wrote: > %{Module-Failure-Message} seems to be empty for me. Is there a > scope/prefix I should try? Hmm... it *should* be there along with the packet attributes. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Capturing Access-Reject data in the radpostauth table

2010-04-28 Thread Aaron Paetznick
%{Module-Failure-Message} seems to be empty for me. Is there a scope/prefix I should try? --Aaron On 4/28/2010 9:37 AM, Alan DeKok wrote: Aaron Paetznick wrote: I'd consider capturing the whole thing, but I'd be happy with just the "rlm_pap: CLEAR TEXT password check failed" part. Do I h

Re: Capturing Access-Reject data in the radpostauth table

2010-04-28 Thread Alan DeKok
Aaron Paetznick wrote: > I'd consider capturing the whole thing, but I'd be happy with just the > "rlm_pap: CLEAR TEXT password check failed" part. Do I have access to > that level of info from within rlm_sql? Look at Module-Failure-Message. It's populated by the PAP module with the various re

Capturing Access-Reject data in the radpostauth table

2010-04-27 Thread Aaron Paetznick
I've added a column to my radpostauth table and started collecting %{reply:Reply-Message} for each Access-Reject packet. This is moderately useful, but it's not really what I want to do. My intention is to capture some useful information as to why the user was rejected. Ideally, I'd like to