Freeradius proxy: rewriting response messages
Hello to all We're currently implementing a nice setup with Freeradius, using it as a proxy for a proprietary radius solution. Our goal is to use freeradius plus freeradius-openvpn-plugin as a great way to authenticate vpn users; unfortunately we can't dismiss the proprietary solution (which would be probably the smartest move), however it's only function is to verify the proxied password. For the proxy management we've installed dialupadmin on the same machine, in order to be able to add some accounting information wich can't be directly done on the proprietary solution. Till here, no problem at all, the setup works perfectly. Unfortunately we need to rewrite the response returned to freeradius by the other server, in order to change the framed-ip-address and framed-route given by the proprietary radius with the data inserted previously in our freeradius sql database (mysql) through dialupadmin. Both the proxy and the proprietary server have the same usernames in their local db. Is that a possible setup? We've already searched online without much luck. Thank you in advance.
Simone Vendemia wrote:
Unfortunately we need to rewrite the response returned to freeradius by the other server, in order to change the framed-ip-address and framed-route given by the proprietary radius with the data inserted previously in our freeradius sql database (mysql) through dialupadmin. Both the proxy and the proprietary server have the same usernames in their local db. Is that a possible setup? We've already searched online without much luck. Thank you in advance.
See the "rewrite" module in radiusd.conf. In 2.0, you can update any attribute using "unlang". post-proxy { ... if (proxy-reply:Framed-IP-Address) { update proxy-reply { Framed-IP-Address := 1.2.3.4 ... } } } Alan DeKok.
On Wed, May 7, 2008 at 10:19 PM, Alan DeKok <aland@deployingradius.com> wrote:
See the "rewrite" module in radiusd.conf.
In 2.0, you can update any attribute using "unlang".
post-proxy { ... if (proxy-reply:Framed-IP-Address) { update proxy-reply { Framed-IP-Address := 1.2.3.4 ... } } }
Alan DeKok.
Thank you for the really useful information. We're now migrating to 2.0 in order to use that feature. Could be possible to have the new Framed-IP-Address automatically selected by querying the freeradius sql database? For example, now our correct values for Framed-IP-Address and Framed-Route are located in the table radreply: mysql> select * from radreply; +----+----------+-------------------+----+-------------------------------+ | id | UserName | Attribute | op | Value | +----+----------+-------------------+----+-------------------------------+ | 19 | denisio | Framed-Route | += | 192.168.37.0/24 10.4.8.1/32 1 | | 11 | test | Framed-IP-Address | = | 10.4.8.14 | | 20 | denisio | Framed-IP-Address | = | 10.4.8.12 | | 18 | denisio | Framed-Route | += | 192.168.36.0/24 10.4.8.1/32 1 | +----+----------+-------------------+----+-------------------------------+ It would be really useful to have the route and ip address rewritten depending on the username, but trying with sql queries directly placed as an argument for "Framed-IP-Address :=" in update proxy-reply it's not really working actually :-)
Simone Vendemia wrote: Please don't CC me on messages. I *do* read the list, and I don't need to see the same message twice.
Could be possible to have the new Framed-IP-Address automatically selected by querying the freeradius sql database?
Yes.
It would be really useful to have the route and ip address rewritten depending on the username, but trying with sql queries directly placed as an argument for "Framed-IP-Address :=" in update proxy-reply it's not really working actually :-)
See the FAQ for "it doesn't work". Alan DeKok.
Read the description of unlang: http://www.freeradius.org/radiusd/man/unlang.html Ivan Kalik Kalik Informatika ISP Dana 8/5/2008, "Simone Vendemia" <metal@cuneo.linux.it> piše:
On Wed, May 7, 2008 at 10:19 PM, Alan DeKok <aland@deployingradius.com> wrote:
See the "rewrite" module in radiusd.conf.
In 2.0, you can update any attribute using "unlang".
post-proxy { ... if (proxy-reply:Framed-IP-Address) { update proxy-reply { Framed-IP-Address := 1.2.3.4 ... } } }
Alan DeKok.
Thank you for the really useful information. We're now migrating to 2.0 in order to use that feature. Could be possible to have the new Framed-IP-Address automatically selected by querying the freeradius sql database? For example, now our correct values for Framed-IP-Address and Framed-Route are located in the table radreply: mysql> select * from radreply; +----+----------+-------------------+----+-------------------------------+ | id | UserName | Attribute | op | Value | +----+----------+-------------------+----+-------------------------------+ | 19 | denisio | Framed-Route | += | 192.168.37.0/24 10.4.8.1/32 1 | | 11 | test | Framed-IP-Address | = | 10.4.8.14 | | 20 | denisio | Framed-IP-Address | = | 10.4.8.12 | | 18 | denisio | Framed-Route | += | 192.168.36.0/24 10.4.8.1/32 1 | +----+----------+-------------------+----+-------------------------------+ It would be really useful to have the route and ip address rewritten depending on the username, but trying with sql queries directly placed as an argument for "Framed-IP-Address :=" in update proxy-reply it's not really working actually :-) - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
2008/5/8 Ivan Kalik <tnt@kalik.net>:
Read the description of unlang:
The syntax i was using was broken, now everything works fine with if (proxy-reply:Framed-IP-Address) { update proxy-reply { Framed-IP-Address := "%{sql:SELECT Value FROM `radreply` WHERE UserName ='%{User-Name}' AND Attribute = 'Framed-IP-Address'}" Framed-Route := "%{sql:SELECT Value FROM `radreply` WHERE UserName ='%{User-Name}' AND Attribute = 'Framed-Route'}" } } Thank you.
participants (3)
-
Alan DeKok -
Ivan Kalik -
Simone Vendemia