I need to be able to proxy accounting requests that arrive with no User-Name attribute. Is that possible? I haven't been able to make it work. Maybe I could insert a dummy User-Name pre-proxy and remove it post-proxy? Also, I notice that when running in -X mode, the accounting-response is not relayed to the original client. Works fine when not in -X mode. Here's a debug of a scenario where an accounting-request was proxied correctly; yet, the accounting-response is not relayed to the client by the proxy server: rad_recv: Accounting-Request packet from host 152.2.199.26 port 32823, id=155, length=86 User-Name = "jcc" NAS-Port = 5060 Sip-Src-IP = 152.2.199.26 Acct-Status-Type = Start Sip-Transport-Proto = TLS Acct-Session-Id = "accounting-session-1-id" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 4 rlm_acct_unique: WARNING: Attribute Client-IP-Address was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing 'NAS-Port = 5060,,NAS-IP-Address = 152.2.199.26,Acct-Session-Id = "accounting-session-1-id",User-Name = "jcc"' rlm_acct_unique: Acct-Unique-Session-ID = "7910d35136b9eb7a". rlm_realm: No '@' in User-Name = "jcc", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Proxying request from user jcc to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy accounting request to realm "NULL" modcall: group preacct returns noop for request 4 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 4 radius_xlat: '/usr/local/var/log/radius/radacct/152.2.199.26/detail-20061114' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/152.2.199.26/detail-20061114 radius_xlat: 'Tue Nov 14 12:15:11 2006' rlm_detail: Freeradius-Proxied-To set to 152.23.129.213 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'jcc' modcall: group accounting returns ok for request 4 Sending Accounting-Request of id 227 to 152.23.129.213 port 1815 User-Name = "jcc" NAS-Port = 5060 Sip-Src-IP = 152.2.199.26 Acct-Status-Type = Start Sip-Transport-Proto = TLS Acct-Session-Id = "accounting-session-1-id" NAS-IP-Address = 152.2.199.26 Proxy-State = 0x313535 --- Walking the entire request list --- Cleaning up request 4 ID 155 with timestamp 4559f99f Nothing to do. Sleeping until we see a request. rad_recv: Accounting-Response packet from host 152.23.129.213 port 1815, id=227, length=25 No outstanding request was found for proxy reply from home server 152.23.129.213 port 1815 - ID 227 Nothing to do. Sleeping until we see a request. root@rtc306:/usr/local/etc/raddb# radiusd -v radiusd: FreeRADIUS Version 2.0.0-pre0, for host i686-pc-linux-gnu, built on Sep 6 2006 at 16:44:16 Thanks. -jc
Justin Church <jcc@unc.edu> wrote:
I need to be able to proxy accounting requests that arrive with no User-Name attribute. Is that possible? I haven't been able to make it work. Maybe I could insert a dummy User-Name pre-proxy and remove it post-proxy?
No. Just set Proxy-To-Realm = "realm".
Also, I notice that when running in -X mode, the accounting-response is not relayed to the original client. Works fine when not in -X mode.
Weird. Hmm... it may be cleaning up the request too aggressively. I'll take a look at it. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Alan DeKok wrote:
Justin Church <jcc@unc.edu> wrote:
I need to be able to proxy accounting requests that arrive with no User-Name attribute. Is that possible? I haven't been able to make it work. Maybe I could insert a dummy User-Name pre-proxy and remove it post-proxy?
No. Just set Proxy-To-Realm = "realm".
Not exactly sure where to set this. I've tried acct_users with no luck: rad_recv: Accounting-Request packet from host 152.2.199.26 port 32833, id=10, length=81 NAS-Port = 5060 Sip-Src-IP = 152.2.199.26 Acct-Status-Type = Start Sip-Transport-Proto = TLS Acct-Session-Id = "accounting-session-1-id" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 rlm_acct_unique: WARNING: Attribute Client-IP-Address was not found in request, unique ID MAY be inconsistent rlm_acct_unique: WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing 'NAS-Port = 5060,,NAS-IP-Address = 152.2.199.26,Acct-Session-Id = "accounting-session-1-id",' rlm_acct_unique: Acct-Unique-Session-ID = "2c2e557e174a1b62". --> rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall: group preacct returns noop for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/152.2.199.26/detail-20061114' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/152.2.199.26/detail-20061114 radius_xlat: 'Tue Nov 14 14:30:25 2006' radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: '' modcall: group accounting returns ok for request 0 Sending Accounting-Response of id 10 to 152.2.199.26 port 32833 Finished request 0 Going to the next request --- Walking the entire request list --- Cleaning up request 0 ID 10 with timestamp 455a1951 Nothing to do. Sleeping until we see a request. proxy.conf realm NULL { type = radius accthost = 152.23.129.213:1815 secret = <removed> nostrip } acct_users DEFAULT Proxy-To-Realm = "NULL" Thanks. -jc
Also, I notice that when running in -X mode, the accounting-response is not relayed to the original client. Works fine when not in -X mode.
Weird.
Hmm... it may be cleaning up the request too aggressively. I'll take a look at it.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Nevermind. I was using the wrong operator. Needed: DEFAULT Proxy-To-Realm := "NULL" Thanks. -jc Justin Church wrote:
Alan DeKok wrote:
Justin Church <jcc@unc.edu> wrote:
I need to be able to proxy accounting requests that arrive with no User-Name attribute. Is that possible? I haven't been able to make it work. Maybe I could insert a dummy User-Name pre-proxy and remove it post-proxy?
No. Just set Proxy-To-Realm = "realm".
Not exactly sure where to set this. I've tried acct_users with no luck:
rad_recv: Accounting-Request packet from host 152.2.199.26 port 32833, id=10, length=81 NAS-Port = 5060 Sip-Src-IP = 152.2.199.26 Acct-Status-Type = Start Sip-Transport-Proto = TLS Acct-Session-Id = "accounting-session-1-id" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 rlm_acct_unique: WARNING: Attribute Client-IP-Address was not found in request, unique ID MAY be inconsistent rlm_acct_unique: WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing 'NAS-Port = 5060,,NAS-IP-Address = 152.2.199.26,Acct-Session-Id = "accounting-session-1-id",' rlm_acct_unique: Acct-Unique-Session-ID = "2c2e557e174a1b62". --> rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall: group preacct returns noop for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/152.2.199.26/detail-20061114' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/152.2.199.26/detail-20061114 radius_xlat: 'Tue Nov 14 14:30:25 2006' radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: '' modcall: group accounting returns ok for request 0 Sending Accounting-Response of id 10 to 152.2.199.26 port 32833 Finished request 0 Going to the next request --- Walking the entire request list --- Cleaning up request 0 ID 10 with timestamp 455a1951 Nothing to do. Sleeping until we see a request.
proxy.conf
realm NULL { type = radius accthost = 152.23.129.213:1815 secret = <removed> nostrip }
acct_users
DEFAULT Proxy-To-Realm = "NULL"
Thanks.
-jc
Also, I notice that when running in -X mode, the accounting-response is not relayed to the original client. Works fine when not in -X mode.
Weird.
Hmm... it may be cleaning up the request too aggressively. I'll take a look at it.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Justin Church <jcc@unc.edu> wrote:
Not exactly sure where to set this. I've tried acct_users with no luck:
The debug log shows that the "files" module isn't even being called. So... you edited radiusd.conf to tell it to NOT look at "acct_users". Don't do that. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
participants (2)
-
Alan DeKok -
Justin Church