Re: Start FreeRadius 4.0 with rlm_tacacs failed due to segV error

whatever the auth success or fail, seems the tacacs module always report
ok, so back to caller side, seems radius can't decide the auth fail or not
Debug : (1.0)          tacacs - }
Debug : (1.0)          tacacs - Authentication-Type = PAP
Debug : (1.0)          tacacs - Action = LOGIN
Debug : (1.0)          tacacs - Authentication-Service = LOGIN
Debug : (1.0)        *tacacs - Received Authentication-Fail *ID 3 length 18
reply packet on connection proto tcp local 0.0.0.0 port 0 remote
10.76.89.50 port 49
Debug : (1.0)          tacacs - Packet {
Debug : (1.0)            tacacs - Version-Major = Plus
Debug : (1.0)            tacacs - Version-Minor = 1
Debug : (1.0)            tacacs - Packet-Type = Authentication
Debug : (1.0)            tacacs - Sequence-Number = 2
Debug : (1.0)            tacacs - Flags = None
Debug : (1.0)            tacacs - Session-Id = 401966282
Debug : (1.0)            tacacs - Length = 6
Debug : (1.0)          tacacs - }
Debug : (1.0)          tacacs - Packet-Body-Type = Reply
Debug : (1.0)          tacacs - *Authentication-Status = Fail*
Debug : (1.0)          tacacs - Authentication-Flags = 0
Debug : (1.0)          tacacs - Server-Message = ""
Debug : (1.0)          tacacs - Data = 0x
Error : tacacs - Connection proto tcp local 0.0.0.0 port 0 remote
10.76.89.50 port 49 failed: No additional error information
Debug : tacacs - [1] - Signalled to reconnect from CONNECTED state
Debug : tacacs - [1] - Connection changed state CONNECTED -> FAILED
Debug : tacacs - [1] - Connection changed state FAILED -> CLOSED
Info  : tacacs - [1] Trunk connection changed state ACTIVE -> CLOSED
Debug : tacacs - Connection closed - proto tcp local 0.0.0.0 port 0 remote
10.76.89.50 port 49
Debug : tacacs - [1] - Delaying reconnection by 1s
Debug : (1.0)        tacacs - tacacs - Resuming execution
Debug : (1.0)        *tacacs (ok)*

*I also tried to get the tacacs attributes in the caller side, but not help
because the connection was closed by remote side*

On Sun, Apr 27, 2025 at 9:51 AM bryan xiang <[email protected]> wrote:

> Yes, I am checking the examples and find one like below:
>
>         recv Access-Request {
>              subrequest @tacacs::Authentication-Start {
>                 User-Name := parent.request.User-Name
>                 #User-Password := parent.request.User-Password
>                 Data := parent.request.User-Password
>                 Packet.Version-Major := 0xC   # or "Plus" if using VALUE
> mapping
>                 Packet.Version-Minor := 0x1
>                 Packet.Packet-Type := "Authentication"
>                 Packet.Sequence-Number := 1
>                 Packet.Flags := "None"
>                 Packet.Session-Id := parent.request.Acct-Session-Id
>                 Packet.Length := 0
>                 Authentication-Type := "PAP"
>                 Action := "Login"
>                 Authentication-Service := "Login"
>                 tacacs
>                 }
>
>
> *                if (ok) {                        control.Auth-Type :=
> "Accept"                }*
>        }
>
> but even the auth fail in tacacs module, the tacacs module still return
> ok, so the module can catch the auth fail and reply module not ok right?
> Debug : (1.0)          tacacs - Packet {
> Debug : (1.0)            tacacs - Version-Major = Plus
> Debug : (1.0)            tacacs - Version-Minor = 1
> Debug : (1.0)            tacacs - Packet-Type = Authentication
> Debug : (1.0)            tacacs - Sequence-Number = 2
> Debug : (1.0)            tacacs - Flags = None
> Debug : (1.0)            tacacs - Session-Id = 2035888093
> Debug : (1.0)            tacacs - Length = 6
> Debug : (1.0)          tacacs - }
> Debug : (1.0)          tacacs - Packet-Body-Type = Reply
> Debug : (1.0)          tacacs - Authentication-Status = Fail
> Debug : (1.0)          tacacs - Authentication-Flags = 0
> Debug : (1.0)          tacacs - Server-Message = ""
> Debug : (1.0)          tacacs - Data = 0x
> Debug : (1.0)        tacacs - tacacs - Resuming execution
> Debug : (1.0)        *tacacs (ok)*
> Debug : (1)        subrequest @tacacs::Authentication-Start - Resuming
> execution
> Debug : (1)      } # subrequest @tacacs:*:Authentication-Start (ok)*
> Debug : (1)      if (ok)  {
> Debug : (1)        | ok
> Debug : (1)        | %expr.rcode()
> Debug : (1)        | --> true
> Debug : (1)        control.Auth-Type := Accept
> Debug : (1)      } # if (ok)  (noop)
> Debug : (1)    } # recv Access-Request (ok)
> Debug : (1)    default (ok)
> Debug : (1)  } # default (ok)
> Debug : (1)  Done request
>
> On Sat, Apr 26, 2025 at 11:25 PM Alan DeKok <[email protected]>
> wrote:
>
>> On Apr 26, 2025, at 11:23 AM, bryan xiang <[email protected]> wrote:
>> > If I hardcode at the end of the Access-Request, it could pass, but how
>> Can
>> > I add condition to check if tacacs return ok or not and then do the
>> > Auth-Type?
>>
>>   The "default" virtual server has examples of setting Auth-Type.
>>
>>   Alan DeKok.
>>
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
>>
>
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html