Nope. That's how it is supposed to work. 

	The point of authpf is for the user to say "this IP
is me" - if that IP could perhaps not be him, well, this
is not an application for authpf. I.E. if your users
are coming in from a NAT, you should rethink what you
are doing. 

	-Bob


* Chris Youb <chris.youb@gmail.com> [2007-06-25 15:15]:
quoted text
> When multiple users with the same source IP want access through the firewall
> authpf grants access to the newly authenticating user and kicks off the
> previous user.  Is there a way to turn off this behaviour so both users
> maintain authpf tables?
> 
> Works:
> 1a. user1@192.168.0.1 -> authpf -> maintains logon
> 1b. user2@192.168.0.2 -> authpf -> logs on
> 
> Doesn't Work:
> 2a. user1@192.168.0.1 -> authpf -> gets kicked off
> 2b. user2@192.168.0.1 -> authpf -> logs on 
> 
> 
> Real-life example:
> 
> Step #1 xuser authenticates from IP_1; xuser has access to firewall
> firewall# pfctl -s Anchors -v
>  authpf
>  authpf/bfisher(25933)
>  authpf/xuser(1308)
>  authpf/rarthur(15647)
>  authpf/schatterjee(31961)
> 
> Step #2 cyoub authenticates from IP_2; both xuser and cyoub have access to
> firewall
> firewall# pfctl -s Anchors -v
>  authpf
>  authpf/bfisher(25933)
>  authpf/cyoub(2104)
>  authpf/xuser(1308)
>  authpf/rarthur(15647)
>  authpf/schatterjee(31961)
> 
> Step #3 cyoub authenticates from IP_1; ONLY cyoub has access to firewall as
> he was the last to login.  xuser is kicked off???
> firewall# pfctl -s Anchors -v
>  authpf
>  authpf/bfisher(25933)
>  authpf/cyoub(27921)
>  authpf/rarthur(15647)
>  authpf/schatterjee(31961)
> 
> firewall# pfctl -a "authpf/cyoub(27921)" -s rules
> pass in quick on bge0 inet from 10.0.1.47 to 172.16.0.0/22 flags S/SA keep
> state
> pass in quick on bge0 inet from 10.0.1.47 to 172.16.4.0/22 flags S/SA keep
> state
> pass in quick on bge0 inet from 10.0.1.47 to 172.16.8.0/22 flags S/SA keep
> state
> pass in quick on bge0 inet from 10.0.1.47 to 172.16.12.0/22 flags S/SA keep
> state
> pass in quick on bge0 inet from 10.0.1.47 to 172.16.20.0/22 flags S/SA keep
> state
> pass in quick on bge0 inet from 10.0.1.47 to 172.16.20.0/22 flags S/SA keep
> state
> pass in quick on bge0 inet from 10.0.1.47 to 172.16.80.0/22 flags S/SA keep
> state
> pass in quick on bge0 inet from 10.0.1.47 to 172.16.48.0/22 flags S/SA keep
> state
> pass in quick on bge0 inet from 10.0.1.47 to 172.16.4.0/22 flags S/SA keep
> state
> pass in quick on bge0 inet from 10.0.1.47 to 172.16.28.0/22 flags S/SA keep
> state
> -- 
> View this message in context: http://www.nabble.com/authpf-allows-only-one-user-from-the-same-source-ip--kicks-off-p...
> Sent from the openbsd user - misc mailing list archive at Nabble.com.
> 

-- 
#!/usr/bin/perl
if ((not 0 && not 1) !=  (! 0 && ! 1)) {
   print "Larry and Tom must smoke some really primo stuff...\n"; 
}