rlm_perl not working
Hi all, As you reply yesterday to my question, I have another one which is very embarrassing : I have the following packages installed on CentOS box : freeradius2.x86_64 freeradius2-mysql.x86_64 freeradius2-ldap.x86_64 freeradius2-perl.x86_64 freeradius2-utils.x86_64 I want to make some transformations on my accounting section but this doesn't work when I put the "perl" in accounting section. Radius stop working : /usr/sbin/radiusd -X conns: 0x25e9760 Module: Checking authorize {...} for more modules to load Module: Checking accounting {...} for more modules to load /etc/raddb/radiusd.conf[267]: Failed to find module "perl". /etc/raddb/radiusd.conf[263]: Errors parsing accounting section. I've found a lot of problems looking on my Google friend, but I didn't understand with a simple : accounting { # sql # comment perl } Using the simple configuration for modules found here: http://wiki.freeradius.org/Rlm_perl Does not work . Any ideas ? Thanks in advance for your help Regards, Fabien VINCENT
Sorry, fixed, a mistake in my radiusd.conf (lost in brackets ;) De : freeradius-users-bounces+fabien.vincent=coreye.fr@lists.freeradius.org [mailto:freeradius-users-bounces+fabien.vincent=coreye.fr@lists.freeradius.o rg] De la part de Vincent, Fabien Envoyé : mardi 18 octobre 2011 15:53 À : FreeRadius users mailing list Objet : rlm_perl not working Hi all, As you reply yesterday to my question, I have another one which is very embarrassing : I have the following packages installed on CentOS box : freeradius2.x86_64 freeradius2-mysql.x86_64 freeradius2-ldap.x86_64 freeradius2-perl.x86_64 freeradius2-utils.x86_64 I want to make some transformations on my accounting section but this doesnt work when I put the perl in accounting section. Radius stop working : /usr/sbin/radiusd -X conns: 0x25e9760 Module: Checking authorize {...} for more modules to load Module: Checking accounting {...} for more modules to load /etc/raddb/radiusd.conf[267]: Failed to find module "perl". /etc/raddb/radiusd.conf[263]: Errors parsing accounting section. Ive found a lot of problems looking on my Google friend, but I didnt understand with a simple : accounting { # sql # comment perl } Using the simple configuration for modules found here: http://wiki.freeradius.org/Rlm_perl Does not work Any ideas ? Thanks in advance for your help Regards, Fabien VINCENT
Hi,
Sorry, fixed, a mistake in my radiusd.conf … (lost in brackets ;)
my concern would be that you dont need to touch radiusd.conf at all to use the rlm_perl module - hope you werent following some old document - you just need to edit the modules/perl file and then put 'perl' into the required part of your virtual server (or use a named instance if you want to call it a different name) alan
Of course ! But to simplify documentation, I've put all in one file radiusd.conf except sql requests / config Another question with Perl / Accounting : I want to made accounting on my F5 LTM / GTM. But the F5 uses something "special", because all Audit logs are forwarded to the Radius using syslog-ng. The consequence is that the Accounting-Request is coming with the following format : Ready to process requests. rad_recv: Accounting-Request packet from host 10.10.10.12 port 47931, id=4, length=235 NAS-IP-Address = 127.1.1.1 F5-Acct = "Oct 18 17:18:59 local/lb2b notice mcpd[4820]: 01070417:5: AUDIT - user radtest - transaction #40213784-2 - object 0 - modify { pool_member { pool_member_pool_name \"...... WARNING: Empty section. Using default return values. +- entering group accounting {...} Invalid Accounting Packet ++[perl] returns invalid Finished request 0. Did you know if it's normal that the accounting section reject the accounting packet and say "Invalid Accounting Packet" ... Is it due to NAS-IP-Address attribute ? And one more question, can I replace it dynamically with, for example, rlm_perl using the IP address from sender host (here 10.10.10.12 ?). Thanks in advance for your helps ! Fabien VINCENT Ingénieur Réseaux & Sécurité / ASSR Produits -----Message d'origine----- De : freeradius-users-bounces+fabien.vincent=coreye.fr@lists.freeradius.org [mailto:freeradius-users-bounces+fabien.vincent=coreye.fr@lists.freeradius.org] De la part de Alan Buxey Envoyé : mardi 18 octobre 2011 16:54 À : FreeRadius users mailing list Objet : Re: rlm_perl not working Hi,
Sorry, fixed, a mistake in my radiusd.conf … (lost in brackets ;)
my concern would be that you dont need to touch radiusd.conf at all to use the rlm_perl module - hope you werent following some old document - you just need to edit the modules/perl file and then put 'perl' into the required part of your virtual server (or use a named instance if you want to call it a different name) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Ce message a ete verifie par MailScanner.
Vincent, Fabien wrote:
Of course ! But to simplify documentation, I've put all in one file radiusd.conf except sql requests / config
That's a terrible idea. You can't get the server to work the way you want, but you're willing to completely change it's configuration? That makes no sense.
Another question with Perl / Accounting :
I want to made accounting on my F5 LTM / GTM. But the F5 uses something "special", because all Audit logs are forwarded to the Radius using syslog-ng. The consequence is that the Accounting-Request is coming with the following format :
Ready to process requests. rad_recv: Accounting-Request packet from host 10.10.10.12 port 47931, id=4, length=235 NAS-IP-Address = 127.1.1.1 F5-Acct = "Oct 18 17:18:59 local/lb2b notice mcpd[4820]: 01070417:5: AUDIT - user radtest - transaction #40213784-2 - object 0 - modify { pool_member { pool_member_pool_name \"...... WARNING: Empty section. Using default return values. +- entering group accounting {...} Invalid Accounting Packet
That message is generated by the Perl module.
++[perl] returns invalid Finished request 0.
Did you know if it's normal that the accounting section reject the accounting packet and say "Invalid Accounting Packet" ... Is it due to NAS-IP-Address attribute ?
No idea... look at the rlm_perl source.
And one more question, can I replace it dynamically with, for example, rlm_perl using the IP address from sender host (here 10.10.10.12 ?).
Yes. Alan DeKok.
Hi,
Of course ! But to simplify documentation, I've put all in one file radiusd.conf except sql requests / config
That's a terrible idea.
I was going to say the same thing. the old old server used to use a single file for config...that was actually a nasty thing. it now calls seperate modules....which all have nice notes/comments in them already. redacting that to a single flat file is horrible....even worse, it makes looking at the difference between your server config and the next release available config - eg new options etc almost impossible.
NAS-IP-Address = 127.1.1.1 F5-Acct = "Oct 18 17:18:59 local/lb2b notice mcpd[4820]: 01070417:5: AUDIT - user radtest - transaction #40213784-2 - object 0 - modify { pool_member { pool_member_pool_name \"...... WARNING: Empty section. Using default return values. +- entering group accounting {...} Invalid Accounting Packet
rlm_perl prints that out if there is no "Acct-Status-Type" attribute in the packet - ie its not really a nice valid accounting packet. this looks like auditing packets being sent... they might need to fix their code?
And one more question, can I replace it dynamically with, for example, rlm_perl using the IP address from sender host (here 10.10.10.12 ?).
replace what? the NAS-IP-Address? yes - you can swap it with eg the Packet-Src-IP-Address alan
Thanks for your replies. I want to resolve the Invalid Accounting Packet problem, so I start to write a perl function preacct like this : sub preacct { # For debugging purposes only print "start preacct ***\n"; print Dumper(%RAD_REQUEST); print "now update request ***\n"; $RAD_REQUEST{'Acct-Status-Type'} = 7; print "returning from preacct ***\n"; return RLM_MODULE_UPDATED; } And modify my preacct using perl. I entered correctly into this procedure, but I didn't know how to update NAS-IP-Address using Packet-Src-IP-Address into the perl sub. Is there somewhere some documentation to have all var in one webpage ? If someone has an example on how to update $RAD_REQUEST{'NAS-IP-Address'} using rlm_perl is welcome ;) Regards Fabien VINCENT -----Message d'origine----- De : freeradius-users-bounces+fabien.vincent=coreye.fr@lists.freeradius.org [mailto:freeradius-users-bounces+fabien.vincent=coreye.fr@lists.freeradius.o rg] De la part de Alan Buxey Envoyé : mardi 18 octobre 2011 21:31 À : FreeRadius users mailing list Objet : Re: rlm_perl not working Hi,
Of course ! But to simplify documentation, I've put all in one file radiusd.conf except sql requests / config
That's a terrible idea.
I was going to say the same thing. the old old server used to use a single file for config...that was actually a nasty thing. it now calls seperate modules....which all have nice notes/comments in them already. redacting that to a single flat file is horrible....even worse, it makes looking at the difference between your server config and the next release available config - eg new options etc almost impossible.
NAS-IP-Address = 127.1.1.1 F5-Acct = "Oct 18 17:18:59 local/lb2b notice mcpd[4820]:
01070417:5: AUDIT - user radtest - transaction #40213784-2 - object 0 - modify { pool_member { pool_member_pool_name \"......
WARNING: Empty section. Using default return values. +- entering group accounting {...} Invalid Accounting Packet
rlm_perl prints that out if there is no "Acct-Status-Type" attribute in the packet - ie its not really a nice valid accounting packet. this looks like auditing packets being sent... they might need to fix their code?
And one more question, can I replace it dynamically with, for example, rlm_perl using the IP address from sender host (here 10.10.10.12 ?).
replace what? the NAS-IP-Address? yes - you can swap it with eg the Packet-Src-IP-Address alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Ce message a ete verifie par MailScanner.
participants (3)
-
Alan Buxey -
Alan DeKok -
Vincent, Fabien