FreeRadius radrelay and proxying the Realm attribute to the home_server
Hi List I have a working radrelay configuration running on FreeRADIUS Version 2.1.10 for debian linux (squeeze/sid). It successfully duplicates radius accounting packets from the detail file to the remote server. However, I see that the "Realm" Attribute, while logged in the detail file of the local system, is not written to the radrelay detail file and proxied to my remote server. For easing my particular process of radius accounting/billing, I'd like to have this attribute written to the radrelay detail file in addition to that of the local server. How would I accomplish this ? Here's what a typical accounting packet looks like on my local server's detail file (the proxy-ing server): --- Fri Dec 16 13:16:00 2011 User-Name = "morpork@ankh.morpork.org" Service-Type = Framed-User NAS-IP-Address = 199.55.541.8 NAS-Identifier = "199.55.541.8" NAS-Port = 1234 NAS-Port-Type = Async Acct-Session-Id = "00001234" Acct-Status-Type = Start Called-Station-Id = "123456789" Calling-Station-Id = "987654321" Acct-Delay-Time = 0 Acct-Unique-Session-Id = "ee50b494e1ff4c15" Realm = "ankh.morpork.org" Timestamp = 1324034160 Request-Authenticator = Verified --- And here's how it typically shows up on my remote_home server's detail file after being radrelay'ed: --- Fri Dec 16 13:15:59 2011 User-Name = "morpork@ankh.morpork.org" Service-Type = Framed-User NAS-IP-Address = 199.55.541.8 NAS-Identifier = "199.55.541.8" NAS-Port = 1234 NAS-Port-Type = Async Acct-Session-Id = "00001234" Acct-Status-Type = Start Called-Station-Id = "123456789" Calling-Station-Id = "987654321" Acct-Delay-Time = 0 Proxy-State = 0x3435323833 Acct-Unique-Session-Id = "a1affd962a445d0c" Timestamp = 1324034159 Request-Authenticator = Verified --- I'd like to write (or otherwise shoehorn :P ) in the "Realm" attribute to the radrelay detail file. What would be the simplest way to do this? Note that my server handles multiple realms. Many thanks in advance, Arch Mangle
Hi, On Fri, Dec 16, 2011 at 03:52:39PM +0200, Arch Mangle wrote:
I have a working radrelay configuration running on FreeRADIUS Version 2.1.10 for debian linux (squeeze/sid). It successfully duplicates radius accounting packets from the detail file to the remote server. However, I see that the "Realm" Attribute, while logged in the detail file of the local system, is not written to the radrelay detail file and proxied to my remote server.
Realm appears in dictionary.freeradius.internal as an internal attribute, i.e. one that doesn't go out on the wire.
For easing my particular process of radius accounting/billing, I'd like to have this attribute written to the radrelay detail file in addition to that of the local server. How would I accomplish this ?
I did it by adding my own attribute to the local dictionary file (e.g. /etc/freeradius/dictionary). I added a new vendor (using our IANA enterprise number) with a new attribute: VENDOR Leicester 3385 BEGIN-VENDOR Leicester ... ATTRIBUTE UoL-Log-Realm 4 string ... END-VENDOR Leicester (Use your own vendor/attribute names/numbers.) Then in preacct I do: update request { UoL-Log-Realm := "%{Realm}" } Remember that you'll need the dictionary set on both servers, and that it will arrive in the relayed packet as your named attribute, not as 'Realm'. (Of course, there may be a better way to do it, but that works for us.) Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi Matthew Thanks for your response. This turns out to be exactly the configuration I needed! I've tested it successfully on a failover pair of servers each replicating accounting packets to each other using radrelay. Many thanks! Arch On Fri, Dec 16, 2011 at 6:17 PM, Matthew Newton <mcn4@leicester.ac.uk>wrote:
Hi,
On Fri, Dec 16, 2011 at 03:52:39PM +0200, Arch Mangle wrote:
I have a working radrelay configuration running on FreeRADIUS Version 2.1.10 for debian linux (squeeze/sid). It successfully duplicates radius accounting packets from the detail file to the remote server. However, I see that the "Realm" Attribute, while logged in the detail file of the local system, is not written to the radrelay detail file and proxied to my remote server.
Realm appears in dictionary.freeradius.internal as an internal attribute, i.e. one that doesn't go out on the wire.
For easing my particular process of radius accounting/billing, I'd like to have this attribute written to the radrelay detail file in addition to that of the local server. How would I accomplish this ?
I did it by adding my own attribute to the local dictionary file (e.g. /etc/freeradius/dictionary). I added a new vendor (using our IANA enterprise number) with a new attribute:
VENDOR Leicester 3385 BEGIN-VENDOR Leicester ... ATTRIBUTE UoL-Log-Realm 4 string ... END-VENDOR Leicester
(Use your own vendor/attribute names/numbers.)
Then in preacct I do:
update request { UoL-Log-Realm := "%{Realm}" }
Remember that you'll need the dictionary set on both servers, and that it will arrive in the relayed packet as your named attribute, not as 'Realm'.
(Of course, there may be a better way to do it, but that works for us.)
Cheers,
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Arch Mangle -
Matthew Newton