accounting and LOCAL realm (freeradius dont send Accounting-Response)
Hi! Im using FreeRadius (1.0.2, 1.0.3) for proxying only. My proxy.conf: realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } realm NULL { type = radius authhost = 192.168.1.1:1812 accthost = 192.168.1.1:1813 secret = key1 } realm provider.com { type = radius authhost = 10.1.1.1:1645 accthost = 10.1.1.1:1646 secret = key2 nostrip } I need some users, who called "555555" (any names or realms) authenticate and accounting local via start/alive/stop scripts. Authentication work perfectly: Im added to users: DEFAULT Auth-Type = Accept, Called-Station-Id == "555555", Proxy-To-Realm := LOCAL Exec-Program-Wait = "/usr/local/bin/555555-auth.pl" But accounting with similar config dont work. My acct_users: DEFAULT Proxy-To-Realm := LOCAL, Called-Station-Id == "555555" Exec-Program = /usr/local/bin/555555-acct.pl I see in logs WARNING: Cancelling proxy to Realm LOCAL, as the realm is local. But freeradius DONT send Accounting-Response to NAS and NAS continue re-sending accounting packets. In logs its look like: ... rlm_detail: Freeradius-Proxied-To set to 255.255.255.255 modcall[accounting]: module "reply_log" returns ok for request 0 modcall: group accounting returns ok for request 0 WARNING: Cancelling proxy to Realm LOCAL, as the realm is local. Finished request 0 Going to the next request ... -- /kha0s
Victor <kha0s@ukr.net> wrote:
I see in logs WARNING: Cancelling proxy to Realm LOCAL, as the realm is local. But freeradius DONT send Accounting-Response to NAS and NAS continue re-sending accounting packets.
Ok... it looks like the code in src/main/acct.c doesn't take LOCAL realms into account. The solution in the short term is to NOT set "Proxy-To-Realm = LOCAL". Alan DeKok.
Hello Alan, Tuesday, June 21, 2005, 7:49:22 PM, you wrote:
I see in logs WARNING: Cancelling proxy to Realm LOCAL, as the realm is local. But freeradius DONT send Accounting-Response to NAS and NAS continue re-sending accounting packets.
AD> Ok... it looks like the code in src/main/acct.c doesn't take LOCAL AD> realms into account. AD> The solution in the short term is to NOT set "Proxy-To-Realm = LOCAL". Ok, so how can i stop processing accounting with NULL or any other realm in my situation? I just want run start/alive/stop script with freeradius. Solution is rewrite username before "suffix" processing and append non-existent realm. But attr_rewrite can't search one attribute "Called-to" and rewrite other "username". -- Best regards, Victor mailto:kha0s@ukr.net
Victor wrote:
Ok, so how can i stop processing accounting with NULL or any other realm in my situation?
There're two workarounds: 1. Give up accounting proxying and use radrelay. 2. Remove instances of the 'realm' module in 'preacct' section and write something like this in 'acct_users' file: # Proxy this one DEFAULT User-Name =~ "foo\.net$", Acct-Type := "acct.foo", Proxy-To-Realm := "foo.net" # Handle this one locally DEFAULT User-Name =~ "bar\.com$", Acct-Type := "acct.bar" -- Nicolas Baradakis
Hello Nicolas, Wednesday, June 22, 2005, 12:01:58 PM, you wrote: NB> 2. Remove instances of the 'realm' module in 'preacct' section and NB> write something like this in 'acct_users' file: NB> # Proxy this one NB> DEFAULT User-Name =~ "foo\.net$", Acct-Type := "acct.foo", Proxy-To-Realm := "foo.net" NB> # Handle this one locally NB> DEFAULT User-Name =~ "bar\.com$", Acct-Type := "acct.bar" In this way accounting always processing local, freeradius dont try sending accounting data to "Proxy-To-Realm" value. -- Best regards, Victor mailto:kha0s@ukr.net
Ok, so how can i stop processing accounting with NULL or any other realm in my situation? I just want run start/alive/stop script with freeradius.
Edit the "accounting" section to contain only the modules you want? Alan DeKok.
Victor wrote:
Ok, so how can i stop processing accounting with NULL or any other realm in my situation?
Try to replace the file src/main/acct.c in the source tree by the file you can download there: http://www.freeradius.org/cgi-bin/cvsweb.cgi/~checkout~/radiusd/src/main/acc... Then rebuild the server and try your setup again: cancelling proxy of accounting with Proxy-To-Realm := LOCAL should work now. -- Nicolas Baradakis
participants (3)
-
Alan DeKok -
Nicolas Baradakis -
Victor