FreeRadius with perl, Unknown attribute: Acct-Session-ID
Hello, I’m trying to use FreeRadius server with perl module. I've install freeradius 3.0.13 on a clean CentOS 7 with perl module. Then enabled perl module by executing following command: ln -s /etc/raddb/mods-available/perl /etc/raddb/mods-enabled/perl Without making any further changes I've run freeradius from commandline using: radiusd -X Then I got the following error; /etc/raddb/policy.d/accounting[42]: Failed parsing expanded string: /etc/raddb/policy.d/accounting[42]: %{md5:%{1},%{Acct-Session-ID}} /etc/raddb/policy.d/accounting[42]: ^ Unknown attribute Note that; After getting error, I've also add following entry to /etc/raddb/users file. Nothing changed... DEFAULT Auth-type := perl I also add entries to file /etc/raddb/sites-available/default described at https://wiki.freeradius.org/modules/Rlm_perl Any ideas on what's wrong with my configuration? Am I missing some installation/configuration steps for perl module? Best, --fatih
On Apr 30, 2021, at 9:21 AM, Fatih Boy <fatih@encbulut.com> wrote:
I’m trying to use FreeRadius server with perl module. I've install freeradius 3.0.13
Why? 3.0.21 has been out for a year. Please use the packages available at http://networkradius.com
on a clean CentOS 7 with perl module. Then enabled perl module by executing following command: ln -s /etc/raddb/mods-available/perl /etc/raddb/mods-enabled/perl
OK.
Without making any further changes I've run freeradius from commandline using: radiusd -X Then I got the following error; /etc/raddb/policy.d/accounting[42]: Failed parsing expanded string: /etc/raddb/policy.d/accounting[42]: %{md5:%{1},%{Acct-Session-ID}} /etc/raddb/policy.d/accounting[42]: ^ Unknown attribute
If you get that error on the default install, then someone (not us) broke the packages you're using. Use 3.0.21, and/or the packages from http://networkradius.com
Note that; After getting error, I've also add following entry to /etc/raddb/users file. Nothing changed... DEFAULT Auth-type := perl
That won't change an error in an unrelated file.
I also add entries to file /etc/raddb/sites-available/default described at https://wiki.freeradius.org/modules/Rlm_perl
Any ideas on what's wrong with my configuration? Am I missing some installation/configuration steps for perl module?
What do you want to do with the Perl module? And if the server doesn't start due to an error in /etc/raddb/policy.d/accounting, then it's impossible to test the changes you made to enable Perl. Alan DeKok.
Hi Alan, Thank you for your feedback.
Why? 3.0.21 has been out for a year. Please use the packages available at http://networkradius.com
Thank you for pointing me to http://networkradius.com. For sure I'll use them.
What do you want to do with the Perl module?
In fact, I was using exec modüle to trigger an validation phone call (IVR/IVN) and wait for the response. Since validation may take some time longer than 30sec, exec command returns with timeout error and user gets rejected. Since perl module doesn't have a timeout value, I thought switching to it will some the problem. Best, -fatih
On Apr 30, 2021, at 10:52 AM, Fatih Boy <fatih@encbulut.com> wrote:
In fact, I was using exec modüle to trigger an validation phone call (IVR/IVN) and wait for the response. Since validation may take some time longer than 30sec, exec command returns with timeout error and user gets rejected.
Since perl module doesn't have a timeout value, I thought switching to it will some the problem.
No. The server still has "max_request_time". It will stop any request which takes more than 30 seconds. The solution to a crappy back-end is not to make FreeRADIUS wait longer. The solution is to fix the back-end so that it takes less time. If the back-end involves a human phone call.. then just stop doing that. Use another method. RADIUS does *not* work with 30+ second delays for authentication. This is a fundamental limitation of *everything* in RADIUS. NAS, GGSN, BNG, all RADIUS servers, etc. You cannot work around this problem by switching to Perl, or by changing max_request_time. Your solution simply will not work if it takes more than 30 seconds. Alan DeKok.
participants (2)
-
Alan DeKok -
Fatih Boy