Hi team, I have added the proxy request but I cant see if the radius executes the proxy. Here are some logs if anyone can see the issue. rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on db1 via TCP/IP, server version 5.5.59-0+deb8u1-log, protocol version 10 (0) [sql] = ok (0) [exec] = noop (0) attr_filter.accounting_response: EXPAND %{User-Name} (0) attr_filter.accounting_response: --> (0) [attr_filter.accounting_response] = noop (0) } # accounting = ok (0) Sent Accounting-Response Id 26 from 10.99.48.20:1813 to 10.1.49.21:64474 length 0 (0) Finished request (0) Cleaning up request packet ID 26 with timestamp +126 Ready to process requests (1) Received Accounting-Request Id 202 from 10.5.49.20:64384 to 10.99.48.20:1813 length 460 (1) Acct-Status-Type = Interim-Update (1) NAS-IP-Address = 10.5.49.20 (1) User-Name = "e0:cb:bc:40:11:c1" (1) Framed-IP-Address = 100.68.28.2 (1) Framed-IP-Netmask = 255.255.254.0 (1) Calling-Station-Id = "TEST-CALLINGSTATION-01" (1) NAS-Identifier = "test-nas" (1) Acct-Session-Id = "F7ED3F000000035B8553BF" (1) Acct-Session-Time = 3570714 (1) Acct-Multi-Session-Id = "F7ED3F000000055B8553BF" (1) Event-Timestamp = "Oct 9 2018 10:44:57 NZDT" (1) NAS-Port-Type = Ethernet (1) NAS-Port-Id = "2/1/10:2010.3" (1) ADSL-Agent-Circuit-Id = 0x4352f312f313a3130 (1) ADSL-Agent-Remote-Id = 0x43483638423031 (1) Alc-Subsc-ID-Str = "testuser" (1) Alc-Subsc-Prof-Str = "sub-profile-1" (1) Alc-SLA-Prof-Str = "1000/500Mb" (1) Alc-Client-Hardware-Addr = "e0:cb:bc:40:11:c1" (1) Acct-Delay-Time = 0 (1) Acct-Authentic = RADIUS (1) NAS-Port = 2107641130 (1) Acct-Input-Packets = 288139206 (1) Acct-Input-Octets = 249433347 (1) Acct-Input-Gigawords = 46 (1) Acct-Output-Packets = 174285788 (1) Acct-Output-Octets = 96339689 (1) Acct-Output-Gigawords = 9 (1) Alc-Acct-I-Inprof-Octets-64 = 0x00010000002e0ede0d03 (1) Alc-Acct-I-Outprof-Octets-64 = 0x00010000000000000000 (1) Alc-Acct-I-Inprof-Pkts-64 = 0x000100000000112ca7c6 (1) Alc-Acct-I-Outprof-Pkts-64 = 0x00010000000000000000 (1) Alc-Acct-O-Inprof-Octets-64 = 0x00010000000000007e64 (1) Alc-Acct-O-Outprof-Octets-64 = 0x00010000000905bd8885 (1) Alc-Acct-O-Inprof-Pkts-64 = 0x000100000000000000be (1) Alc-Acct-O-Outprof-Pkts-64 = 0x0001000000000a63631e (1) # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default (1) preacct { (1) [preprocess] = ok (1) policy acct_unique { (1) update request { (1) &Tmp-String-9 := "ai:" (1) } # update request = noop (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (1) EXPAND %{hex:&Class} (1) --> (1) EXPAND ^%{hex:&Tmp-String-9} (1) --> ^61693a (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (1) else { (1) update request { (1) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (1) --> e7faa9c68be528833249ff678abd1081 (1) &Acct-Unique-Session-Id := e7faa9c68be528833249ff678abd1081 (1) } # update request = noop (1) } # else = noop (1) } # policy acct_unique = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "e0:cb:bc:40:11:c1", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) [files] = noop (1) } # preacct = ok (1) # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default (1) accounting { (1) detail: EXPAND /var/log/freeradius/detail.log (1) detail: --> /var/log/freeradius/detail.log (1) detail: /var/log/freeradius/detail.log expands to /var/log/freeradius/detail.log (1) detail: EXPAND %t (1) detail: --> Tue Oct 9 10:44:57 2018 (1) [detail] = ok (1) [unix] = noop (1) radutmp: EXPAND /usr/local/var/log/radius/radutmp (1) radutmp: --> /usr/local/var/log/radius/radutmp (1) radutmp: EXPAND %{User-Name} (1) radutmp: --> e0:cb:bc:40:11:c1 (1) [radutmp] = ok (1) perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'e0:cb:bc:40:11:c1' (1) perl: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '10.5.49.20' (1) perl: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '2107641130' (1) perl: $RAD_REQUEST{'Framed-IP-Address'} = &request:Framed-IP-Address -> '100.68.28.2' (1) perl: $RAD_REQUEST{'Framed-IP-Netmask'} = &request:Framed-IP-Netmask -> '255.255.254.0' (1) perl: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> 'TEST-CALLINGSTATION-01' (1) perl: $RAD_REQUEST{'NAS-Identifier'} = &request:NAS-Identifier -> 'test-nas' (1) perl: $RAD_REQUEST{'NAS-Port-Type'} = &request:NAS-Port-Type -> 'Ethernet' (1) perl: $RAD_REQUEST{'Acct-Status-Type'} = &request:Acct-Status-Type -> 'Interim-Update' (1) perl: $RAD_REQUEST{'Acct-Delay-Time'} = &request:Acct-Delay-Time -> '0' (1) perl: $RAD_REQUEST{'Acct-Input-Octets'} = &request:Acct-Input-Octets -> '249433347' (1) perl: $RAD_REQUEST{'Acct-Output-Octets'} = &request:Acct-Output-Octets -> '96339689' (1) perl: $RAD_REQUEST{'Acct-Session-Id'} = &request:Acct-Session-Id -> 'F7ED3F000000035B8553BF' (1) perl: $RAD_REQUEST{'Acct-Authentic'} = &request:Acct-Authentic -> 'RADIUS' (1) perl: $RAD_REQUEST{'Acct-Session-Time'} = &request:Acct-Session-Time -> '3570714' (1) perl: $RAD_REQUEST{'Acct-Input-Packets'} = &request:Acct-Input-Packets -> '288139206' (1) perl: $RAD_REQUEST{'Acct-Output-Packets'} = &request:Acct-Output-Packets -> '174285788' (1) perl: $RAD_REQUEST{'Acct-Multi-Session-Id'} = &request:Acct-Multi-Session-Id -> 'F7ED3F000000055B8553BF' (1) perl: $RAD_REQUEST{'Acct-Input-Gigawords'} = &request:Acct-Input-Gigawords -> '46' (1) perl: $RAD_REQUEST{'Acct-Output-Gigawords'} = &request:Acct-Output-Gigawords -> '9' (1) perl: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'Oct 9 2018 10:44:57 NZDT' (1) perl: $RAD_REQUEST{'NAS-Port-Id'} = &request:NAS-Port-Id -> '2/1/10:2010.3' (1) perl: $RAD_REQUEST{'ADSL-Agent-Circuit-Id'} = &request:ADSL-Agent-Circuit-Id -> '0x4352f312f313a3130' (1) perl: $RAD_REQUEST{'ADSL-Agent-Remote-Id'} = &request:ADSL-Agent-Remote-Id -> '0x43483638423031' (1) perl: $RAD_REQUEST{'Alc-Subsc-ID-Str'} = &request:Alc-Subsc-ID-Str -> 'testuser' (1) perl: $RAD_REQUEST{'Alc-Subsc-Prof-Str'} = &request:Alc-Subsc-Prof-Str -> 'sub-profile-1' (1) perl: $RAD_REQUEST{'Alc-SLA-Prof-Str'} = &request:Alc-SLA-Prof-Str -> '1000/500Mb' (1) perl: $RAD_REQUEST{'Alc-Client-Hardware-Addr'} = &request:Alc-Client-Hardware-Addr -> 'e0:cb:bc:40:11:c1' (1) perl: $RAD_REQUEST{'Alc-Acct-I-Inprof-Octets-64'} = &request:Alc-Acct-I-Inprof-Octets-64 -> '0x00010000002e0ede0d03' (1) perl: $RAD_REQUEST{'Alc-Acct-I-Outprof-Octets-64'} = &request:Alc-Acct-I-Outprof-Octets-64 -> '0x00010000000000000000' (1) perl: $RAD_REQUEST{'Alc-Acct-O-Inprof-Octets-64'} = &request:Alc-Acct-O-Inprof-Octets-64 -> '0x00010000000000007e64' (1) perl: $RAD_REQUEST{'Alc-Acct-O-Outprof-Octets-64'} = &request:Alc-Acct-O-Outprof-Octets-64 -> '0x00010000000905bd8885' (1) perl: $RAD_REQUEST{'Alc-Acct-I-Inprof-Pkts-64'} = &request:Alc-Acct-I-Inprof-Pkts-64 -> '0x000100000000112ca7c6' (1) perl: $RAD_REQUEST{'Alc-Acct-I-Outprof-Pkts-64'} = &request:Alc-Acct-I-Outprof-Pkts-64 -> '0x00010000000000000000' (1) perl: $RAD_REQUEST{'Alc-Acct-O-Inprof-Pkts-64'} = &request:Alc-Acct-O-Inprof-Pkts-64 -> '0x000100000000000000be' (1) perl: $RAD_REQUEST{'Alc-Acct-O-Outprof-Pkts-64'} = &request:Alc-Acct-O-Outprof-Pkts-64 -> '0x0001000000000a63631e' (1) perl: $RAD_REQUEST{'Acct-Unique-Session-Id'} = &request:Acct-Unique-Session-Id -> 'e7faa9c68be528833249ff678abd1081' (1) perl: $RAD_REQUEST{'Tmp-String-9'} = &request:Tmp-String-9 -> 'ai:' rlm_perl: Found username testuser(test-proxy-01) from Calling-Station-Id for port based auth - TEST-CALLINGSTATION-01 (1) perl: &request:Acct-Input-Octets = $RAD_REQUEST{'Acct-Input-Octets'} -> '249433347' (1) perl: &request:Framed-IP-Address = $RAD_REQUEST{'Framed-IP-Address'} -> '100.68.28.2' (1) perl: &request:Acct-Status-Type = $RAD_REQUEST{'Acct-Status-Type'} -> 'Interim-Update' (1) perl: &request:Acct-Output-Packets = $RAD_REQUEST{'Acct-Output-Packets'} -> '174285788' (1) perl: &request:Acct-Session-Id = $RAD_REQUEST{'Acct-Session-Id'} -> 'F7ED3F000000035B8553BF' (1) perl: &request:User-Password = $RAD_REQUEST{'User-Password'} -> 'feenixforfun01' (1) perl: &request:ADSL-Agent-Circuit-Id = $RAD_REQUEST{'ADSL-Agent-Circuit-Id'} -> '0x4350432d504f4c5430322065746820312f312f30342f30312f32322f312f313a3130' (1) perl: &request:NAS-Identifier = $RAD_REQUEST{'NAS-Identifier'} -> 'test-nas' (1) perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'testuser' (1) perl: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '2107641130' *(1) perl: &request:Proxy-To-Realm = $RAD_REQUEST{'Proxy-To-Realm'} -> 'test-proxy-01'* (1) perl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '10.5.49.20' (1) perl: &request:Acct-Unique-Session-Id = $RAD_REQUEST{'Acct-Unique-Session-Id'} -> 'e7faa9c68be528833249ff678abd1081' (1) perl: &request:Alc-Acct-O-Outprof-Octets-64 = $RAD_REQUEST{'Alc-Acct-O-Outprof-Octets-64'} -> '0x00010000000905bd8885' (1) perl: &request:Acct-Authentic = $RAD_REQUEST{'Acct-Authentic'} -> 'RADIUS' (1) perl: &request:Alc-Acct-I-Inprof-Octets-64 = $RAD_REQUEST{'Alc-Acct-I-Inprof-Octets-64'} -> '0x00010000002e0ede0d03' (1) perl: &request:Alc-Acct-I-Outprof-Pkts-64 = $RAD_REQUEST{'Alc-Acct-I-Outprof-Pkts-64'} -> '0x00010000000000000000' (1) perl: &request:NAS-Port-Id = $RAD_REQUEST{'NAS-Port-Id'} -> '2/1/10:2010.3' (1) perl: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> 'TEST-CALLINGSTATION-01' (1) perl: &request:Alc-Subsc-Prof-Str = $RAD_REQUEST{'Alc-Subsc-Prof-Str'} -> 'sub-profile-1' (1) perl: &request:Alc-Acct-I-Inprof-Pkts-64 = $RAD_REQUEST{'Alc-Acct-I-Inprof-Pkts-64'} -> '0x000100000000112ca7c6' (1) perl: &request:Acct-Delay-Time = $RAD_REQUEST{'Acct-Delay-Time'} -> '0' (1) perl: &request:Acct-Multi-Session-Id = $RAD_REQUEST{'Acct-Multi-Session-Id'} -> 'F7ED3F000000055B8553BF' (1) perl: &request:NAS-Port-Type = $RAD_REQUEST{'NAS-Port-Type'} -> 'Ethernet' (1) perl: &request:Alc-Acct-I-Outprof-Octets-64 = $RAD_REQUEST{'Alc-Acct-I-Outprof-Octets-64'} -> '0x00010000000000000000' (1) perl: &request:Acct-Session-Time = $RAD_REQUEST{'Acct-Session-Time'} -> '3570714' (1) perl: &request:Alc-Acct-O-Inprof-Octets-64 = $RAD_REQUEST{'Alc-Acct-O-Inprof-Octets-64'} -> '0x00010000000000007e64' (1) perl: &request:Alc-SLA-Prof-Str = $RAD_REQUEST{'Alc-SLA-Prof-Str'} -> '1000/500Mb' (1) perl: &request:Acct-Input-Packets = $RAD_REQUEST{'Acct-Input-Packets'} -> '288139206' (1) perl: &request:Framed-IP-Netmask = $RAD_REQUEST{'Framed-IP-Netmask'} -> '255.255.254.0' (1) perl: &request:Alc-Client-Hardware-Addr = $RAD_REQUEST{'Alc-Client-Hardware-Addr'} -> 'e0:cb:bc:40:11:c1' (1) perl: &request:Acct-Output-Octets = $RAD_REQUEST{'Acct-Output-Octets'} -> '96339689' (1) perl: &request:Acct-Output-Gigawords = $RAD_REQUEST{'Acct-Output-Gigawords'} -> '9' (1) perl: &request:ADSL-Agent-Remote-Id = $RAD_REQUEST{'ADSL-Agent-Remote-Id'} -> '0x43484f52555331363336363532383638423031' (1) perl: &request:Alc-Acct-O-Inprof-Pkts-64 = $RAD_REQUEST{'Alc-Acct-O-Inprof-Pkts-64'} -> '0x000100000000000000be' (1) perl: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'Oct 9 2018 10:44:57 NZDT' (1) perl: &request:Acct-Input-Gigawords = $RAD_REQUEST{'Acct-Input-Gigawords'} -> '46' (1) perl: &request:Alc-Subsc-ID-Str = $RAD_REQUEST{'Alc-Subsc-ID-Str'} -> 'testuser' (1) perl: &request:Tmp-String-9 = $RAD_REQUEST{'Tmp-String-9'} -> 'ai:' (1) perl: &request:Alc-Acct-O-Outprof-Pkts-64 = $RAD_REQUEST{'Alc-Acct-O-Outprof-Pkts-64'} -> '0x0001000000000a63631e' (1) perl: &control:Auth-Type = $RAD_CHECK{'Auth-Type'} -> 'Accept' (1) [perl] = updated (1) sql: EXPAND %{tolower:type.%{Acct-Status-Type}.query} (1) sql: --> type.interim-update.query (1) sql: Using query template 'query' rlm_sql (sql): Closing connection (5): Hit idle_timeout, was idle for 121 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (6): Hit idle_timeout, was idle for 121 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (7), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on db1 via TCP/IP, server version 5.5.59-0+deb8u1-log, protocol version 10 rlm_sql (sql): Reserved connection (7) (1) sql: EXPAND %{User-Name} (1) sql: --> testuser (1) sql: SQL-User-Name set to 'testuser' (1) sql: EXPAND UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', actualdataratedown = '%{Actual-Data-Rate-Downstream}', actualdatarateup = '%{Actual-Data-Rate-Upstream}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' (1) sql: --> UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1539035097), acctinterval = 1539035097 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '100.68.28.2', actualdataratedown = '', actualdatarateup = '', acctsessiontime = 3570714, acctinputoctets = '46' << 32 | '249433347', acctoutputoctets = '9' << 32 | '96339689' WHERE AcctUniqueId = 'e7faa9c68be528833249ff678abd1081' (1) sql: EXPAND /var/log/freeradius/sqllog.sql (1) sql: --> /var/log/freeradius/sqllog.sql (1) sql: Executing query: UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1539035097), acctinterval = 1539035097 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '100.68.28.2', actualdataratedown = '', actualdatarateup = '', acctsessiontime = 3570714, acctinputoctets = '46' << 32 | '249433347', acctoutputoctets = '9' << 32 | '96339689' WHERE AcctUniqueId = 'e7faa9c68be528833249ff678abd1081' rlm_sql_mysql: Rows matched: 1 Changed: 1 Warnings: 2 (1) sql: SQL query returned: success (1) sql: 1 record(s) updated rlm_sql (sql): Released connection (7) Need 2 more connections to reach min connections (3) rlm_sql (sql): Opening additional connection (8), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on db1 via TCP/IP, server version 5.5.59-0+deb8u1-log, protocol version 10 (1) [sql] = ok (1) [exec] = noop (1) attr_filter.accounting_response: EXPAND %{User-Name} (1) attr_filter.accounting_response: --> testuser (1) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (1) [attr_filter.accounting_response] = updated (1) } # accounting = updated (1) Sent Accounting-Response Id 202 from 10.99.48.20:1813 to 10.5.49.20:64384 length 0 (1) Finished request (1) Cleaning up request packet ID 202 with timestamp +247 Here is my proxy.conf realm test-proxy-01 { authhost = srv1.xxxxxx.com:1812 accthost = srv1.xxxxxx.com:1813 secret = xxxxxxxx nostrip } Anyone have any documentation that can help please? THanks On Wed, Oct 3, 2018 at 8:33 PM J E H A N Z A I B <jehanzaib.kiani@gmail.com> wrote:
oh i mean $RAD_REQUEST{'Proxy-To-Realm'} = "freeradius-2.test.com";
$result = RLM_MODULE_UPDATED; return $result;
On Wed, Oct 3, 2018 at 10:35 AM J E H A N Z A I B < jehanzaib.kiani@gmail.com> wrote:
Hi Alan, Should I consider I am correct?
Thank you
On Tue, Oct 2, 2018 at 12:17 PM J E H A N Z A I B < jehanzaib.kiani@gmail.com> wrote:
Thank you Alan.
Just to sum up, we need to define a realm in proxy.conf. After that we can use it via our perl script like
$RAD_CHECK{' Proxy-To-Realm '} = " freeradius-2.test.com"; $result = RLM_MODULE_UPDATED; return $result;
The above is called for authorize , authenticate and accounting. realm freeradius-2.test.com { authhost = freeradius-2.test.com:1600 accthost = freeradius-2.test.com:1601 secret = testing123 }
Please correct me if i am wrong.
Thank you.
On Tue, Oct 2, 2018 at 4:48 AM Alan DeKok <aland@deployingradius.com> wrote:
On Oct 1, 2018, at 10:38 AM, J E H A N Z A I B < jehanzaib.kiani@gmail.com> wrote:
Thank you for your help. just to be clear so in my perl script i will
set
something $ RAD_REQUEST_PROXY {'Proxy-To-Realm '} = " freeradius-2.test.com";
No. You set it in the request list. Not the proxy list.
The documentation describes in detail what the various lists are fro,
Does this also means i have to define this realm in the proxy.conf? like realm freeradius-2.test.com { authhost = freeradius-2.test.com:1600 accthost = freeradius-2.test.com:1601 secret = testing123 }
Yes.
Is there anyway i can just set these paramters dynamically in my perl script please?
No.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Regards, Jehanzaib
-- Regards, Jehanzaib
-- Regards, Jehanzaib
-- Regards, Jehanzaib