Condition-Based Accounting Proxy
Hi Guys, Sorry for double-post. Hi All. I have installed FreeRadius as Accounting Proxy server which forwards the Accounting request to a proxy server. I Would like to achieve the following: 1. Accounting request packet received by the server 2. The server checks if the User Name in the request exists in a MySQL database 3. if the User Name exists, then the server will forward the request to the proxy server If it does not, the server WONT forward the request. I have wrote a bash script that performs the username check in the database and returns "0" if the user has been found, and "1" if the user is NOT found. I have used the Radius module rlm_exec to integrate the script into the radius system, so the current status is: the server receives the accounting request, initiates the sql_check module (which is rlm_exec that calls my bash script), and returns the correct values according to the username check. Now, I would like to configure the server that it will forward the accounting packets ONLY if the sql_check module returns a value of "0" - OK. Ive looked and searched EVERYWHERE, asked who ever I know who can help but no 1 has a clue on how to do it, and I couldnt find anything that can help me with the solution. ANY help will be highly appreciated! Debug log of an accounting request: rad_recv: Accounting-Request packet from host 172.16.0.61 port 5928, id=141, length=77 Acct-Status-Type = Start Acct-Session-Id = "0" Class = 0x37303732366636363639366336353364343136653734363935363639373237353733 Framed-IP-Address = 94.18.167.200 User-Name = "test" Wed May 4 09:45:41 2011 : Info: +- entering group preacct {...} Wed May 4 09:45:41 2011 : Info: ++[preprocess] returns ok Wed May 4 09:45:41 2011 : Info: [acct_unique] WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent Wed May 4 09:45:41 2011 : Info: [acct_unique] Hashing ',Client-IP-Address = 172.16.0.61,NAS-IP-Address = 172.16.0.61,Acct-Session-Id = "0",User-Name = "test"' Wed May 4 09:45:41 2011 : Info: [acct_unique] Acct-Unique-Session-ID = "63b27f8746199ef7". Wed May 4 09:45:41 2011 : Info: ++[acct_unique] returns ok Wed May 4 09:45:41 2011 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Wed May 4 09:45:41 2011 : Info: [suffix] Found realm "NULL" Wed May 4 09:45:41 2011 : Info: [suffix] Adding Stripped-User-Name = "test" Wed May 4 09:45:41 2011 : Info: [suffix] Adding Realm = "NULL" Wed May 4 09:45:41 2011 : Info: [suffix] Proxying request from user test to realm NULL Wed May 4 09:45:41 2011 : Info: [suffix] Preparing to proxy accounting request to realm "NULL" Wed May 4 09:45:41 2011 : Info: ++[suffix] returns updated Wed May 4 09:45:41 2011 : Info: +- entering group accounting {...} Wed May 4 09:45:41 2011 : Info: [detail] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.16.0.61/detail-20110504 Wed May 4 09:45:41 2011 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.16.0.61/detail-20110504 Wed May 4 09:45:41 2011 : Info: [detail] expand: %t -> Wed May 4 09:45:41 2011 Wed May 4 09:45:41 2011 : Info: ++[detail] returns ok Wed May 4 09:45:41 2011 : Info: [sql_check] expand: %{User-Name} -> test Wed May 4 09:45:41 2011 : Debug: Exec-Program output: user test is found in DB Wed May 4 09:45:41 2011 : Debug: Exec-Program-Wait: plaintext: user test is found in DB Wed May 4 09:45:41 2011 : Debug: Exec-Program: returned: 0 Wed May 4 09:45:41 2011 : Info: ++[sql_check] returns ok Wed May 4 09:45:41 2011 : Info: WARNING: Empty section. Using default return values. Sending Accounting-Request of id 188 to 10.100.1.148 port 1813 Acct-Status-Type = Start Acct-Session-Id = "0" Class = 0x37303732366636363639366336353364343136653734363935363639373237353733 Framed-IP-Address = 94.18.167.200 User-Name = "test" NAS-IP-Address = 172.16.0.61 Proxy-State = 0x313431 Wed May 4 09:45:41 2011 : Info: Proxying request 1 to home server 10.100.1.148 port 1813 Sending Accounting-Request of id 188 to 10.100.1.148 port 1813 Acct-Status-Type = Start Acct-Session-Id = "0" Class = 0x37303732366636363639366336353364343136653734363935363639373237353733 Framed-IP-Address = 94.18.167.200 User-Name = "test" NAS-IP-Address = 172.16.0.61 Proxy-State = 0x313431 Wed May 4 09:45:41 2011 : Debug: Going to the next request Wed May 4 09:45:41 2011 : Debug: Waking up in 0.9 seconds. rad_recv: Accounting-Response packet from host 10.100.1.148 port 1813, id=188, length=20 Wed May 4 09:45:41 2011 : Info: +- entering group post-proxy {...} Wed May 4 09:45:41 2011 : Info: [eap] No pre-existing handler found Wed May 4 09:45:41 2011 : Info: ++[eap] returns noop Sending Accounting-Response of id 141 to 172.16.0.61 port 5928 Wed May 4 09:45:41 2011 : Info: Finished request 1. Wed May 4 09:45:41 2011 : Info: Cleaning up request 1 ID 141 with timestamp +495 Wed May 4 09:45:41 2011 : Debug: Going to the next request Wed May 4 09:45:41 2011 : Info: Ready to process requests. Thanks in advance!!! Eitam. eitarad@hotmail.com -- View this message in context: http://freeradius.1045715.n5.nabble.com/Condition-Based-Accounting-Proxy-tp4... Sent from the FreeRadius - Dev mailing list archive at Nabble.com.
eitarad wrote:
I Would like to achieve the following:
1. Accounting request packet received by the server 2. The server checks if the User Name in the request exists in a MySQL database
Write an SQL "select" statement. preacct { ... if ("%{sql:SELECT ... %{User-Name} ...}") { update control { Proxy-To-Realm := "foo" } } ... } There's no need for any script. See "man unlang" for more details. Alan DeKok.
Hi Alan, Thank you SO much for your response, I have managed to do exactly what I wanted once I was introduced to the un-language :) So, Thanks again.. Now I have only 1 more question, for some reason the RADIUS server is forwarding every request to the proxy twice... Could you please help me understand why? rad_recv: Accounting-Request packet from host 172.16.0.61 port 16432, id=147, length=49 Acct-Status-Type = Start Acct-Session-Id = "0" Framed-IP-Address = 94.18.167.200 Calling-Station-Id = "12345" User-Name = "Assaf" Thu May 5 09:38:00 2011 : Info: +- entering group preacct {...} Thu May 5 09:38:00 2011 : Info: ++[preprocess] returns ok Thu May 5 09:38:00 2011 : Info: ++? if ("%{sql:SELECT * FROM dpcheck WHERE user = '%{User-Name}'}") Thu May 5 09:38:00 2011 : Info: sql_xlat Thu May 5 09:38:00 2011 : Info: expand: %{User-Name} -> Assaf Thu May 5 09:38:00 2011 : Info: sql_set_user escaped user --> 'Assaf' Thu May 5 09:38:00 2011 : Info: expand: SELECT * FROM dpcheck WHERE user = '%{User-Name}' -> SELECT * FROM dpcheck WHERE user = 'Assaf' Thu May 5 09:38:00 2011 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Thu May 5 09:38:00 2011 : Info: sql_xlat finished Thu May 5 09:38:00 2011 : Debug: rlm_sql (sql): Released sql socket id: 4 Thu May 5 09:38:00 2011 : Info: expand: %{sql:SELECT * FROM dpcheck WHERE user = '%{User-Name}'} -> assaf Thu May 5 09:38:00 2011 : Info: ? Evaluating ("%{sql:SELECT * FROM dpcheck WHERE user = '%{User-Name}'}") -> TRUE Thu May 5 09:38:00 2011 : Info: ++? if ("%{sql:SELECT * FROM dpcheck WHERE user = '%{User-Name}'}") -> TRUE Thu May 5 09:38:00 2011 : Info: ++- entering if ("%{sql:SELECT * FROM dpcheck WHERE user = '%{User-Name}'}") {...} Thu May 5 09:38:00 2011 : Info: sql_xlat Thu May 5 09:38:00 2011 : Info: expand: %{User-Name} -> Assaf Thu May 5 09:38:00 2011 : Info: sql_set_user escaped user --> 'Assaf' Thu May 5 09:38:00 2011 : Info: expand: SELECT Class FROM dpcheck WHERE User ='%{User-Name}'; -> SELECT Class FROM dpcheck WHERE User ='Assaf'; Thu May 5 09:38:00 2011 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Thu May 5 09:38:00 2011 : Info: sql_xlat finished Thu May 5 09:38:00 2011 : Debug: rlm_sql (sql): Released sql socket id: 3 Thu May 5 09:38:00 2011 : Info: expand: %{sql: SELECT Class FROM dpcheck WHERE User ='%{User-Name}';} -> profile Thu May 5 09:38:00 2011 : Info: +++[request] returns ok Thu May 5 09:38:00 2011 : Info: +++[control] returns ok Thu May 5 09:38:00 2011 : Info: ++- if ("%{sql:SELECT * FROM dpcheck WHERE user = '%{User-Name}'}") returns ok Thu May 5 09:38:00 2011 : Info: +- entering group accounting {...} Thu May 5 09:38:00 2011 : Info: [sql] expand: %{User-Name} -> Assaf Thu May 5 09:38:00 2011 : Info: [sql] sql_set_user escaped user --> 'Assaf' Thu May 5 09:38:00 2011 : Info: [sql] expand: %{Acct-Delay-Time} -> Thu May 5 09:38:00 2011 : Info: [sql] ... expanding second conditional Thu May 5 09:38:00 2011 : Info: [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', Thu May 5 09:38:00 2011 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Thu May 5 09:38:00 2011 : Debug: rlm_sql (sql): Released sql socket id: 2 Thu May 5 09:38:00 2011 : Info: ++[sql] returns ok Thu May 5 09:38:00 2011 : Info: [detail] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.16.0.61/detail-20110505 Thu May 5 09:38:00 2011 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.16.0.61/detail-20110505 Thu May 5 09:38:00 2011 : Info: [detail] expand: %t -> Thu May 5 09:38:00 2011 Thu May 5 09:38:00 2011 : Info: ++[detail] returns ok Thu May 5 09:38:00 2011 : Info: WARNING: Empty section. Using default return values. Sending Accounting-Request of id 251 to 10.100.1.148 port 1813 Acct-Status-Type = Start Acct-Session-Id = "0" Framed-IP-Address = 94.18.167.200 Calling-Station-Id = "12345" User-Name = "Assaf" NAS-IP-Address = 172.16.0.61 Class = 0x70726f66696c65 Proxy-State = 0x313437 Thu May 5 09:38:00 2011 : Info: Proxying request 2 to home server 10.100.1.148 port 1813 Sending Accounting-Request of id 251 to 10.100.1.148 port 1813 Acct-Status-Type = Start Acct-Session-Id = "0" Framed-IP-Address = 94.18.167.200 Calling-Station-Id = "12345" User-Name = "Assaf" NAS-IP-Address = 172.16.0.61 Class = 0x70726f66696c65 Proxy-State = 0x313437 Thu May 5 09:38:00 2011 : Debug: Going to the next request Thu May 5 09:38:00 2011 : Debug: Waking up in 0.9 seconds. rad_recv: Accounting-Response packet from host 10.100.1.148 port 1813, id=251, length=20 Thu May 5 09:38:00 2011 : Info: +- entering group post-proxy {...} Thu May 5 09:38:00 2011 : Info: [eap] No pre-existing handler found Thu May 5 09:38:00 2011 : Info: ++[eap] returns noop Sending Accounting-Response of id 147 to 172.16.0.61 port 16432 Thu May 5 09:38:00 2011 : Info: Finished request 2. Thu May 5 09:38:00 2011 : Info: Cleaning up request 2 ID 147 with timestamp +201 Thu May 5 09:38:00 2011 : Debug: Going to the next request Thu May 5 09:38:00 2011 : Info: Ready to process requests. Thanks alot! Eitam. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Condition-Based-Accounting-Proxy-tp4... Sent from the FreeRadius - Dev mailing list archive at Nabble.com.
participants (2)
-
Alan DeKok -
eitarad