Hi, There don't seem to be many examples relating to using perl to access remote databases…. in fact there don't seem to be many perl examples at all. Got example.pl configured a wee bit and running on test server but could do with a better db related example. Unfortunately my perl skills aren't ts good as they could be. In post-auth I want to extract the nas-ip address and calling station-id of the client device open a db connection and perform a query that'll let me decide what vlan-id to send back in the access-accept packet write radius attributes into the access-accept reply Anyone got some form of template I could use for the above? Rgds Alex
Hi,
There don't seem to be many examples relating to using perl to access remote databases…. in fact there don't seem to be many perl examples at all.
thats because its a PERL issue not a FreeRADIUS one :-)
In post-auth I want to
extract the nas-ip address and calling station-id of the client device open a db connection and perform a query that'll let me decide what vlan-id to send back in the access-accept packet write radius attributes into the access-accept reply
you need to use DBI PERL to open the connection and then create the query. for the query you can use values straight from the FreeRADIUS PERL hook - or assign them to variables and use those variables, then run the query and look at the results. of course, you will need to verify that the connection was okay, that the query was okay and that the results are okay.
Anyone got some form of template I could use for the above?
each case requires new code....but a quick Google will show you how to do the DB query stuff...I can provide you some templte for assigning variables alan
On 8 Apr 2013, at 13:32, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
There don't seem to be many examples relating to using perl to access remote databases…. in fact there don't seem to be many perl examples at all.
thats because its a PERL issue not a FreeRADIUS one :-)
:-)) but its perl being used within Freeradius (he says batting the ball over then)
In post-auth I want to
extract the nas-ip address and calling station-id of the client device open a db connection and perform a query that'll let me decide what vlan-id to send back in the access-accept packet write radius attributes into the access-accept reply
you need to use DBI PERL to open the connection and then create the query. for the query you can use values straight from the FreeRADIUS PERL hook - or assign them to variables and use those variables, then run the query and look at the results. of course, you will need to verify that the connection was okay, that the query was okay and that the results are okay.
o.k. can do much of that. \
Anyone got some form of template I could use for the above?
each case requires new code....but a quick Google will show you how to do the DB query stuff...I can provide you some templte for assigning variables That would be great if you could Rgds Alex
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Magic! many thanks, got all the bits I needed One question though, Why auth and not post-auth? I'm working on the basis that the stuff I do doesn't have anything to do with the actual auth process, in post-auth I'm doing things like setting session-timeouts. vlan assignments etc. based upon whether it's an access-request or an access-reject. Is there something wrong with that logic? Rgds alex On 8 Apr 2013, at 14:10, Alex Sharaz <alex.sharaz@york.ac.uk> wrote:
On 8 Apr 2013, at 13:32, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
There don't seem to be many examples relating to using perl to access remote databases…. in fact there don't seem to be many perl examples at all.
thats because its a PERL issue not a FreeRADIUS one :-)
:-))
but its perl being used within Freeradius (he says batting the ball over the net )
In post-auth I want to
extract the nas-ip address and calling station-id of the client device open a db connection and perform a query that'll let me decide what vlan-id to send back in the access-accept packet write radius attributes into the access-accept reply
you need to use DBI PERL to open the connection and then create the query. for the query you can use values straight from the FreeRADIUS PERL hook - or assign them to variables and use those variables, then run the query and look at the results. of course, you will need to verify that the connection was okay, that the query was okay and that the results are okay.
o.k. can do much of that. \
Anyone got some form of template I could use for the above?
each case requires new code....but a quick Google will show you how to do the DB query stuff...I can provide you some templte for assigning variables That would be great if you could Rgds Alex
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
Why auth and not post-auth? I'm working on the basis that the stuff I do doesn't have anything to do with the actual auth process, in post-auth I'm doing things like setting session-timeouts. vlan assignments etc. based upon whether it's an access-request or an access-reject.
Is there something wrong with that logic?
no. post-auth in the inner-tunnel is where we do it. alan
That's fine then, that's where I'm doing this A On 8 Apr 2013, at 15:49, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
Why auth and not post-auth? I'm working on the basis that the stuff I do doesn't have anything to do with the actual auth process, in post-auth I'm doing things like setting session-timeouts. vlan assignments etc. based upon whether it's an access-request or an access-reject.
Is there something wrong with that logic?
no. post-auth in the inner-tunnel is where we do it.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Since i was just in the making of some hooks using DBI I took some time to copy paste something that could be something towards the thing you wanted? This is just an example so don't take it to serious.. I also don't think you should do it as post_auth hook but a authorize hook so Don't forget to add module = /etc/freeradius/myscript.pl and uncomment #func_authorize = authorize ANDS/OR #func_post_auth = post_auth in modules/perl And add perl and sql tp your default vi sites-enabled/default authorize { preprocess perl ## <--- auth_log sql ## <--- expiration logintime } ## Example myscript.pl script ## #!/usr/bin/perl use strict; use warnings; use diagnostics; use DBI; use Data::Dumper; ### Radius HASH Tables ### our (%RAD_REQUEST, %RAD_REPLY, %RAD_CHECK); use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ sub authorize{ ################################ ### DB Connection variables ### ################################ our ($driver) = "mysql"; our ($user) = "dbuser"; our ($pw) = "mypassword"; our ($database) = "radius"; our ($host) = "localhost:3306"; our $dsn = "DBI:$driver:$database:$host"; ## For good manners you should add something here that only makes the db connect if code eq "Access-Request" or something something... our $dbh = DBI->connect ($dsn, $user, $pw, { RaiseError => 1 }); our $sth; ### Other variables ### my $NAS_IP_ADDRESS = $RAD_REQUEST{'NAS-IP-Address'}; my $CALLING_STATION_ID = $RAD_REQUEST{'Calling-Station-Id'}; my $NAS_PORT_ID = $RAD_REQUEST{'NAS-Port-Id'}; my $USER_NAME = $RAD_REQUEST{'User-Name'}; my $MAC = $RAD_REQUEST{'some-Client-Hardware-Addr'}; my $VENDOR_ID = $RAD_REQUEST{'some-DHCP-Vendor-Class-Id'}; if (!$VENDOR_ID) { $RAD_REQUEST{'some-DHCP-Vendor-Class-Id'} = "NO_VENDOR_ID"; } ### ETC ETC... $sth = $dbh->prepare("SELECT vlan FROM my_vlan_table WHERE NAS_IP_ADDRESS = '$NAS_IP_ADDRESS' AND CALLING_STATION_ID = '$CALLING_STATION_ID'"); ## <-- Or something. $sth->execute (); my $VLAN = $sth->fetchrow_array(); $sth->finish (); if (!$VLAN) { ### SOmething something ### Or maybe a default account.. $RAD_REQUEST{'User-Name'} = "my_default_user_account"; $RAD_REPLY{'Auth-Type'} = "Accept"; $RAD_REPLY{'User-Name'} = "$USER_NAME"; $RAD_REPLY{'needed-reply-attribute-Subsc-ID-Str'} = "$MAC"; $RAD_REPLY{'needed-reply-attribute-Subsc-Prof-Str'} = "direct_access"; $RAD_REPLY{'needed-reply-attribute-SLA-Prof-Str'} = "150-BB-10-10"; ### ETC ETC... } else { $RAD_REPLY{'vlan-id-attribute-to-send-back'} = "$VLAN"; $RAD_REPLY{'Auth-Type'} = "Accept"; $RAD_REPLY{'User-Name'} = "$USER_NAME"; $RAD_REPLY{'needed-reply-attribute-Subsc-ID-Str'} = "$MAC"; $RAD_REPLY{'needed-reply-attribute-Subsc-Prof-Str'} = "direct_access"; $RAD_REPLY{'needed-reply-attribute-SLA-Prof-Str'} = "150-BB-10-10"; } $dbh->disconnect (); return RLM_MODULE_OK; } -----Ursprungligt meddelande----- Från: freeradius-users-bounces+alexander.silverohrt=itux.se@lists.freeradius.org [mailto:freeradius-users-bounces+alexander.silverohrt=itux.se@lists.freeradius.org] För Alex Sharaz Skickat: den 8 april 2013 13:37 Till: FreeRadius users mailing list Ämne: perl examples Hi, There don't seem to be many examples relating to using perl to access remote databases.... in fact there don't seem to be many perl examples at all. Got example.pl configured a wee bit and running on test server but could do with a better db related example. Unfortunately my perl skills aren't ts good as they could be. In post-auth I want to extract the nas-ip address and calling station-id of the client device open a db connection and perform a query that'll let me decide what vlan-id to send back in the access-accept packet write radius attributes into the access-accept reply Anyone got some form of template I could use for the above? Rgds Alex - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ********* DISCLAIMER ********* This message and any attachment are confidential and may be privileged or otherwise protected from disclosure and may include proprietary information. If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system. If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person
Hi,
In post-auth I want to
extract the nas-ip address and calling station-id of the client device open a db connection and perform a query that'll let me decide what vlan-id to send back in the access-accept packet write radius attributes into the access-accept reply
one more comment...for somethign so 'trivial' I would seriously consider using unlang to do this anyway eg update reply { Tunnel-Private-Group-ID ="%{sql:SELECT vlan from authtable where NAS='%{NAS-IP-Address}' and csi='%{Calling-Station-Id}'}" Tunnel-Medium-Type = IEEE-802 Tunnel-Type = VLAN } ..or such... alan
On 8 Apr 2013, at 14:24, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
In post-auth I want to
extract the nas-ip address and calling station-id of the client device open a db connection and perform a query that'll let me decide what vlan-id to send back in the access-accept packet write radius attributes into the access-accept reply
one more comment...for somethign so 'trivial' I would seriously consider using unlang to do this anyway eg
update reply { Tunnel-Private-Group-ID ="%{sql:SELECT vlan from authtable where NAS='%{NAS-IP-Address}' and csi='%{Calling-Station-Id}'}" Tunnel-Medium-Type = IEEE-802 Tunnel-Type = VLAN }
..or such…
looks neat, but getting the vlan associated with the switch and the calling station id isn't that simple. but I'll have a look anyway Rgds Alex
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 08/04/13 14:47, Alex Sharaz wrote:
On 8 Apr 2013, at 14:24, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
In post-auth I want to
extract the nas-ip address and calling station-id of the client device open a db connection and perform a query that'll let me decide what vlan-id to send back in the access-accept packet write radius attributes into the access-accept reply
one more comment...for somethign so 'trivial' I would seriously consider using unlang to do this anyway eg
update reply { Tunnel-Private-Group-ID ="%{sql:SELECT vlan from authtable where NAS='%{NAS-IP-Address}' and csi='%{Calling-Station-Id}'}" Tunnel-Medium-Type = IEEE-802 Tunnel-Type = VLAN }
..or such…
looks neat, but getting the vlan associated with the switch and the calling station id isn't that simple. but I'll have a look anyway
FWIW we use "unlang" and a simple stored procedure that returns a little blob: vlan,something,somemore ...which we split using a regexp in the next unlang statemenr. This is also a handy place to check for an empty xlat result (which indicates failure of the SQL lookup) and do logging, and possibly set "Do-Not-Respond" to allow the other RADIUS server a chance to succeed the auth.
ok. This looks easier Thx A On 8 Apr 2013, at 15:18, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 08/04/13 14:47, Alex Sharaz wrote:
On 8 Apr 2013, at 14:24, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
In post-auth I want to
extract the nas-ip address and calling station-id of the client device open a db connection and perform a query that'll let me decide what vlan-id to send back in the access-accept packet write radius attributes into the access-accept reply
one more comment...for somethign so 'trivial' I would seriously consider using unlang to do this anyway eg
update reply { Tunnel-Private-Group-ID ="%{sql:SELECT vlan from authtable where NAS='%{NAS-IP-Address}' and csi='%{Calling-Station-Id}'}" Tunnel-Medium-Type = IEEE-802 Tunnel-Type = VLAN }
..or such…
looks neat, but getting the vlan associated with the switch and the calling station id isn't that simple. but I'll have a look anyway
FWIW we use "unlang" and a simple stored procedure that returns a little blob:
vlan,something,somemore
...which we split using a regexp in the next unlang statemenr. This is also a handy place to check for an empty xlat result (which indicates failure of the SQL lookup) and do logging, and possibly set "Do-Not-Respond" to allow the other RADIUS server a chance to succeed the auth. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alex Sharaz -
Alexander Silveröhrt -
Phil Mayers