Hello again! Sorry, maybe I should take 'pseudo' out of the subject line... Firstly, MY BAD. I forgot to post that I'm on CentOS 4, and therefore limited to whatever syntax applies to "freeradius-1.0.1-3.RHEL4.5" Hopefully what I want to do is so 'basic' it doesn't change.... :) Secondly, anyone noticed that the basic MAN pages are hard to find on the website? I happened to click the link to 'modular' on the home page and found a link to man pages at the bottom of that page. So at least now I can see the full list of manuals and start to RTFM. :) On Thu, 4 Jun 2009, A.L.M.Buxey@lboro.ac.uk wrote:

...

I'm thinking: Session-Timeout := %{exec:timecalc} pretty much....

Actually, I can't find a good working example from which to lift the exact syntax. Is the above correct? Should I use back ticks? I really don't want hand-holding, but sometimes a good working sample is worth a thousand posts. :)

.... you need to set this via the update reply style as recently posted several times this past month to the list

(nod) Found the posts... thanks...

post-auth section - thats where you should set any return details

(nod) Good point. Thanks. Said I was newb. :)

...

Hmmm. While I'm here, if I set Session-Timeout to ZERO, what will happen? ;-) it should mean there is no session timeout (ie infinite session)

(smack forehead) Didn't think of that. But I can set a timeout of one second and that will do the job of dropping someone who is out of time. Probably better that way so that they don't get a message that their userid and password are invalid. Or is there a reply item that a Cisco AS5400 would pass on to the dialing (probably) Windows PPP and have it display a meaningful "you are out of time" message to the user during auth? (Dare I dream? LOL) Thanks. - Charles

Okay, I'm banging my head up against the expected proverbial wall. Please remember I'm stuck with old 1.x version..... on Centos I'm trying to get a script to execute and set the 'Session-Timeout' value. I've defined the script thusly: exec timecalc { wait = yes program = "/usr/local/etc/radius_timecalc %{User-Name}..." input_pairs = request output_pairs = reply # packet_type = Access-Accept } (I've tried it with and without the packet_type....) I've tried placing just "timecalc" into the post-auth and alternately the auth sections. I don't get any errors, but the script does not run... (I have the script touch a file to prove it runs, and it doesn't happen). I tried using the sytax: update reply { timecalc } And also tried: update reply { Session-Time := "200" } and got 'rcode' errors under post-auth and 'syntax' errors in auth. I might have mised a magic combination. Anyone care to tell me the exact syntax for making this script run on an access-accept? - Charles

On 06/11/2009 04:42 PM, Charles Gregory wrote:

Okay, I'm banging my head up against the expected proverbial wall. Please remember I'm stuck with old 1.x version..... on Centos

No you're not stuck with an old 1.x. See: http://wiki.freeradius.org/Red_Hat_FAQ -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

Charles Gregory wrote:

But CentOS is supposedly still a 'supported' OS, so I think it's fair to ask simple 'how to' questions for that environment.

Centos supports their OS. This list answers questions about FreeRADIUS. And the 1.x versions are *not* supported by us. When people ask questions about them, they get told to upgrade to 2.1. The 1.x versions are over two years old. Everything is easier and better in 2.1. Alan DeKok.

Charles Gregory wrote:

Why do you LET RedHat use the old version if it is so unsupported?

There appears to be a fundamental misconception in that sentence: We don't control RedHat. So... RedHat does whatever the heck makes them happy. And it makes them happy to keep their customers happy. And their customers are happy using versions of software that are supported by RedHat. And Redhat doesn't want to upgrade their software every 6 months. As a result, the software shipped by RedHat (and therefore CentOS), is often years out of date. Why does this happen? The people who PAY REDHAT for support want it this way. And I can understand why. The people who DO NOT PAY for support are out of luck. If you want to leverage (for free) the work that RedHat has done to create a stable system, then you use software that is out of date. If you want to leverage (for free) the work that we have done to create an up to date version of FreeRADIUS, then you don't have a version "blessed" by RedHat. There is a simple fix: pay someone for support. See the "support" link on http://freeradius.org for support specific to FreeRADIUS. Or, ask RedHat for a support contract for the entire OS and packages.

Quite right. CentOS supports their OS, not the component packages. So I cannto ask *them* a FreeRADIUS question. They tell me to come HERE.

Exactly. They build CentOS and can *for free*, answer questions about their work. We build FreeRADIUS, and can *for free* answer questions about it. But the free answers might not always be what you want to hear.

Now, in the spirit of the sarcasm with which your comment was offered, I reply, gee, I think I *am* on the wrong list.

Yes. You want *guaranteed* support for an older version of the server. The only question now is, do you want to pay for it, or do you want it for free?

I am looking for a FreeRADIUS *USERS* forum. Obivously, with FreeRADIUS 1.x in wide deployment in RHEL and CentOS there HAS to be a 'community' of 1.x users, or at the least a community of FreeRADIUS users who, even if they have migrated to later versions themselves, still *remember* the basic syntax of a version of FreeRADIUS that they must have been using *very* recently (for anyone getting a decent life-expectancy out of servers and OS's, three years is 'recent'). I had thought that *this* forum would have many people like this.

Sure. Anyone using 1.x is able to subscribe to this list, and to answer questions about it. There is no one stopping them from supporting you *for free*. But sadly, there doesn't seem to be a great crush of people supporting 1.x. Maybe you would be willing to stay on this list and help others?

So, at the risk of sounding like a whiner, why the *HECK* am I stuck with something "not easier and better" in a CURRENT release?

Because that's what you chose to install. We can't help that. Alan DeKok.

John Dennis wrote:

Let's clarify something, calling CentOS a "supported" OS is a little misleading.

The CentOS people answer questions about CentOS on the CentOS mailing list. That is the limit of their support. Similarly, the FreeRADIUS people answer questions about FreeRADIUS on the freeradius-users list. For readers who didn't already know: that's the limit of *free* support for Open Source projects. Getting more requires paying for support contract with a company who is willing to support whatever software that the customer has chosen to install. Alan DeKok.

Charles Gregory wrote:

On Fri, 12 Jun 2009, Alan DeKok wrote:

...

The CentOS people answer questions about CentOS on the CentOS mailing list. That is the limit of their support. Similarly, the FreeRADIUS people answer questions about FreeRADIUS on the freeradius-users list.

What do you mean by "people"?

The people on this list. Whoever they are.

What *I* mean is not just the developers and volunteers, whose time is often quite precious, but the many USERS who have the package installed on many different systems. THAT is the strength of open source.

Which is what I said, too. See my other messages.

All of *us* banding together. I don't just come to these groups asking questions. I answer them. You better believe that if I 'work it out for myself' I will be coming back to this list with a howto and examples for any other 1.x user who runs into the same situation that I have.

Sure. We'll wait. Alan DeKok.

On Fri, 12 Jun 2009, Ivan Kalik wrote:

Work what out?

Finally got my 1.x Session-Time script working (as an exec module). The really strange thing is that it is working *exactly* as I first thought I should be doing it!!! (see below) I can only guess that somewhere along the way I had a linux permissions issue with scripts or files, and thosee got fixed while I was changing things and testing.... Here's how it works for me: I define the exec instance named 'timecalc'.... (I've line-wrapped the program line that belongs all on one line) exec timecalc { wait = yes program = "/usr/local/etc/radius_timecalc %{NAS-IP-Address}:#%{NAS-Port}:%{Service-Type}:%{User-Name}: %{Framed-IP-Address}:%{Connect-Info}:%{Calling-Station-ID}: %{Called-Station-ID}" input_pairs = request output_pairs = reply } Note that the 'packet_type:' has NOT been specified. That may have been one of the things blocking execution.... I then coded the command to execute it in post-auth.... post-auth { timecalc } The 'timecalc' perl script prints "Session-Time := 200\n" to standard output. And I made sure the script was group-executable by the radius user. Yes, that simple. Could have sworn I tried that combo already. WHAT DID NOT WORK: I did try to follow the oft-quoted (almost shoved down my throat) example, right from the comments within the config file.... postauth { Session-Timeout := `%{exec:/usr/local/etc/timecalc %{User-Name}}` } .... but I kept getting this: ERROR: Cannot find a configuration entry for module "Session-Timeout". So I'm not sure why this syntax is offered up as "what to use". At the very least, perhaps the instruction is missing on WHERE to put that code. I would think a module should somehow be called in the appropriate section of the config file, as I've finally done it, but maybe the above syntax belongs somewhere else, like in the users file? And sorry, but that thread about 'refresh variable after exec module' did not actually contain any clear syntax examples. It appears *his* solution was to use 'wait-program-exec', which, according to what I read, is a really old/deprecated way of doing things. And I *knew* that I could do what I wanted to do. It was just figuring the syntax and getting it right.... :) So there you have it. And I thank the people who were doing there best to help me out, but really, if someone had just posted "try this" and the two sections of code at the top of this post, I would have *known* that was what was *supposed* to work, and would have looked for whatever permission bug was obviously the true culprit. As John rightly points out, the exec engine hasn't changed in a long time, so version level made no difference. It was just a matter of getting things right. I hope this summary benefits others with CentOS or FreeRADIUS 1.0.x... - Charles

Well, keeping in mind that this is now a philosphical discussion... On Fri, 12 Jun 2009, Alan DeKok wrote:

Charles Gregory wrote:

...

I did try to follow the oft-quoted (almost shoved down my throat) example, right from the comments within the config file.... postauth { Session-Timeout := `%{exec:/usr/local/etc/timecalc %{User-Name}}` } No... that won't work. The examples given to you weren't like that.

Well, firstly, no one *gave* me 'examples', they said just to look in my radiusd.conf, and secondly, yes, it's exactly 'like that': # put 'exec' into the 'instantiate' section. You can then # do dynamic translation of attributes like: # # Attribute-Name = `%{exec:/path/to/program args}` # # The value of the attribute will be replaced with the output Notice the complete lack of instruction as to WHERE I would use that syntax.... Both in the comments AND from you, I might add....

No. The 2.x documentation describes how it's used, and where it's used.

What part of "I'm using 1.x" did you not get? If nothing else, this statement proves that you were wrong to tell me to look in my 1.x config files for the documentation which you now say is only in the 2.x files.

Even in 1.x, the radiusd.conf file contained an example module "echo" that did this.

And it's 'example' of usage was: # This is a more general example of the execute module. # This one is called "echo". # # Attribute-Name = `%{echo:/path/to/program args}` # # If you wish to execute an external program in more than So there again is this "usage" that gives no hint of WHERE it is used. Certainly not in the sections of radiusd.conf where the newbie (me) would expect commands to go. You know, a post-auth command in the post-auth section..... I get the feeling that this comment is a holdover from some earlier version of FR where the *only* place one could assign attributes was in the user file, or something like that, so there was no 'need' to define where syntax like that was used.... (shrug)

While the documentation isn't perfect, a lot of this *is* documented. And a lot of the unhelpful answers on this list are instructing people to read the documentation.

And so, hopefully after posting all this garbage yet again, and quoting, I hope sufficiently, you can see that I *did* read all the comments in the config file, and what you THINK is there really is not there. - Charles

On Fri, 12 Jun 2009, Ivan Kalik wrote:

Nothing to give. You already have it in scripts/exec-program-wait.

I do not have a directory named 'scripts'. And the only reference to 'exec-program-wait' is in the comments of 'experimental.conf' as something that a 'perl' rlm can 'replace'. I'm really thinking that CentOS screwed up some documentation....

...

# Attribute-Name = `%{exec:/path/to/program args}` Notice the complete lack of instruction as to WHERE I would use that syntax....

Well, you don't have to be a genius to figure out where does something like Attribute = value goes.

Well, whatever I needed to be, I'm not. (weak grin) Does executable syntax belong in the users file? Or is there some other place in the radiusd.conf that is obvious to you but not to me?

... simply listing module name in the configuration (like you have "discovered") also works - just like with any other module.

(nod) As I said, something *else* was preventing it from functioning the first time I tried it... (sigh)

Go and read the example script included with the server and then come back and eat your words.

WHAT ##### "EXAMPLE SCRIPT"? And if someone finally tells me where it is (in vers. 1.x) then why should I eat my words for getting the thing I kept ASKING for? You know, I won't call this whole thing *your* fault if it turns out that CentOS put in a crippled installation missing examples.... But it ain't mine either.... - Charles

On Sat, 13 Jun 2009, Ivan Kalik wrote:

...

..... I'm really thinking that CentOS screwed up some documentation.... Could be. They might have packaged server core without examples. ...... If you want you can download and unpack your version tarball from the freeradius site....

Just because I am tenacious, I did this, and lo and behold, there is that 'scripts' directory you mentioned.... (sigh)

If you are planning on working with certificates you can download the current version and use routines in raddb/certs to create certificates.

Thanks but my needs are really, really basic. Just a custom timer program that I needed to integrate with radius to send that Session-Timeout. So all's well that ends well. :) - Charles

On Sat, 13 Jun 2009, Alan DeKok wrote:

No... I had NO IDEA what you were trying to do.

I had gotten the impression that you don't read posts thoroughly, and this only reinforces that perception. My very first post said: I've been cruising the archives and pages and don't quite see what I am looking for. I am hoping someone can point me to a nice simple HOWTO or MAN page for specifying an 'exec' script in radiusd.conf that will set the Session-Timeout and return it to the NAS. I'm thinking: Session-Timeout := %{exec:timecalc} It clearly conveys my intention and my first attempt at code. So with (dwindling) respect, if you can't get the IDEA from that then you really are a serious waste of time. Tell you what. You write me off as another stubborn stupid individual who cannot see the 'common sense' in using the latest version of software, and I will write you off as someone who cannot appreciate that people who installed a piece of software when it was NEW would like to keep using that software as long as it fulfills the needs of the system in a stable secure fashion. I apologize for my ignorance, but not for sticking with something that works. - Charles

On Sat, 13 Jun 2009, Alan DeKok wrote:

and yet you're frustrated that I'm explaining the *reasons* behind my opinions.

No, I'm offended that you can say things like you have "NO IDEA" when clearly anyone who read my first post would know what I was asking. It's one step short of outright *lying* to win your arguments. Oh, I did spot your name all over the docs. Not withstanding this quirk for bad argument, there's no denying the software itself does an excellent job. Now that I know how to do what I want to do, it is working wonderfully. Thanks for that, at least. - Charles

On Sun, 14 Jun 2009, Alan DeKok wrote:

Charles Gregory wrote:

...

No, I'm offended that you can say things like you have "NO IDEA" when clearly anyone who read my first post would know what I was asking. Yes, but you were given 5-6 options for solving the problem.

Five or six huh? Quote them. Paraphrase them. And don't just lamely say "check the archives" because I did that when I double-checked that you 'had no idea'. I've been up and down this thread a few times now. And there is NO posting with clear code like the one I posted in my 'solved' post.... Just pedantic demands I upgrade, and vague "look at the docs". OH, and as a side note, I just double-checked the 'users' file and the users man page, and NEITHER of them contain the word 'exec' ANYWHERE in any context or usage. So WHERE exactly was I supposed to find the instructions to do what I wanted to do? Yes, yes, version 2.x.... But given my constraints, 'read the docs' was utterly useless. I await your QUOTE of '5 or 6' options. I'll presume one of them was to upgrade to 2.x so you can skip that one....

Is a result, I have *no* idea what you were trying to do.

Oh, so now it's a word game. You knew what I was trying to do but confused by the manner in which I was trying to do it? Didn't that clue in the big expert that someone had badly misinterpreted the documentation and was trying to do something WRONG and should have been told how to do it right? Did it occur to you that at the start of this thread I had never heard of 'wait program exec'? It's not mentioned in my users file docs. Was that ever in version 1.x? I wouldn't know.

If you were trying to solve the problem you *claimed*, the existing documentation and examples should have been sufficient.

THEY WEREN'T. That's the whole point. I was asking for MORE. Examples. A working script and config that did what I wanted. If someone asked this question now, I would post my half dozen lines from my config, saying, this is one way to do it and be DONE.

Instead, it was clear that you were trying to do nearly everything *except* follow the suggestions on this list, or the examples and documentation shipped with the server.

WHICH examples? NAME THEM. I only found ONE after John (?) pointed out I was missing a file. And even that one uses a method that is described as deprecated in the code. Look, you want to dance this dance, I'm game. But you are going to have to face the fact that (1) I'M NEW AT THIS, so don't presume I have that benefit of context. (2) The documentation in 1.x was obviously inadequate, so saying 'look in the docs' is utterly useless unless somehow you expected me to read every single doc file in HOPES of finding the one file that describes exec. Really, why weren't the docs in the radiusd.conf or users documentation? You say you wrote this stuff. How could you leave something out (and then act like it was always there and I failed to read it)? - C

On Sun, 14 Jun 2009, Alan DeKok wrote:
> Charles Gregory wrote:
>> Five or six huh? Quote them.
>  1) Read my messages.

That's rich coming from you.

> ....  The text you *deleted* pointed you to documentation for the 
> "users" file, and the SQL module.

Speaking of 'not reading' didn't you catch my comment that the users file 
and its documentation contains NOTHING about exec? So the 'option' may 
have been offered, but of course, I was talking about options that had the 
faintest chance of pointing me in the right direction.

As for SQL, it's utterly irrelvant. Writing the script is not my issue.
I just needed to find the right syntax to call it.

>  2) See the examples in the "users" file.  It contains MANY examples
>     of setting values for attributes.

Well, let's pretend for a moment that the information is actually in the 
users file or its docs, care to quote where someone said "the instructions 
for 'exec' are in the users file"? Oh, and this makes #1 and #2 the same 
advice. Repeating bad advice is not five or six OPTIONS.

>  The *hope* is that readers can put 2+2 together.  i.e. the "exec"
>  modules does NOT contain documentation about how to configure all of
>  the other modules

Actually, the flaw I've noticed is that it *partially* contains just 
that. If it had no example of usage at all, but just how to 'code' it, I 
would have then started looking for another file where it was 'used'.

>  3) buy support.

Oh ho! So sarcastic screw-me-if-I-don't-want-to-pay is an option?
Nice one. I think I'll be charitable and give you this one. But it's 
really not something I could type into a config file, is it....

>  4) upgrade to 2.x.

I said you could skip that one. But I can tell you're struggling to back 
up these ludicrous statements you keep making, so I'll forgive you.

>  5) install 1.0.x from *source* and look at the examples you were told
>     to look at.

Uh, actually, I thought of *that* one on my own after people kept 
insisting that #2 should have helped. And really, it's not another 
'option' for me to try, it was just helping me find #2. And it wasn't 
suggested I try the source until AFTER I had figured it out on my own.

>> OH, and as a side note, I just double-checked the 'users' file and the
>> users man page, and NEITHER of them contain the word 'exec' ANYWHERE in
>> any context or usage. So WHERE exactly was I supposed to find the
>> instructions to do what I wanted to do?
>  The "exec" module.

Well, let's look for the documentation for the exec module.....
root@york/data/temp/freeradius-1.0.1/doc> ls -a
.                      MACOSX                 rlm_digest
..                     Makefile               rlm_eap
00-OLD                 misc-nas               rlm_fastusers
aaa.txt                module_interface       rlm_krb5
Acct-Type              OS2                    rlm_ldap
ascend                 performance-testing    rlm_pam
Autz-Type              Post-Auth-Type         rlm_passwd
bay                    processing_users_file  rlm_python
bugs                   proxy                  rlm_sim_triplets
ChangeLog              RADIUS-LDAP.schema     rlm_sql
cisco                  RADIUS-LDAPv3.schema   rlm_sqlcounter
coding-methods.txt     RADIUS-SQL.schema      rlm_x99_token
configurable_failover  radrelay               Session-Type
CVS                    README                 Simultaneous-Use
CYGWIN                 release-method.txt     supervise-radiusd.txt
DIFFS                  rfc                    tuning_guide
duplicate-users        rlm_attr_filter        variables.txt
ldap_howto.txt         rlm_dbm

OH well.... I guess when I was asking someone to help point me in the 
right direction maybe I was just asking if someone could tell me WHICH of 
these files contains that exec module description. The README file 
contains descriptions for 'exec-program'. I suppose *that* would have 
sufficed. Though again, with the warnings about it being deprecated, I 
preferred to use the exec module.

> Did you *really* think that there was an attributed called 
> "Attribute-Name", as suggested in the comments for the exec module?

Oh yes, absolutely! I take everything I read absolutely literally 100%.
How could you think anything else? Uh, unless of course you read my 
attempted syntax in my first posting..... Oh wait you did, you're just
trying to be funny... or something....

> ....  But you *didn't* put 2+2 together, and edit the *users* file 
> examples containing Session-Timeout to use the same `%{exec:..` text.

The users file does not contain any examples of *executable* code.
Not objecting to this clever use of the file, but for an old progreammer 
conditioned to keep his data and his code separate, and an obvious 
'section' in the radiusd.conf to define modules, it didn't make sense to
be placing 'calls' to programs in among hard-coded attributes. Now should 
I have 'figured it out' from the fact that the users file contains 
conditional tests? Maybe. But keep in mind (or did I mention?) that I had 
already coded a *logging* module in radiusd.conf. I was thinking not that 
I was using an entirely different *scheme*, but only needed a minor 
correction of usage or syntax which any well-meaning individual could have 
pointed out in 2 seconds (or just said, "that looks fine, your problem is 
somewhere else".

> I've made it as clear as possible in 1.0.

Well, given the comment that I've done things in an 'unofficial' manner, 
then I won't contradict this. But if I may say so, given the way that the 
users file comments are otherwise very well self-contained, the absence of 
any examples of 'exec-program' is very misleading. I finally found the 
references to it today in the overall 'readme' in the docs directory.

If you want to accuse me fairly of anything, it would be presumption that 
the comments in the files were adequate. Yes, I should have gone hunting 
for the readme.  But then again, I think that was the substance of my 
original post. The correct answer would have been, "did you look in 
doc/README?" I would have gone 'duh' read it and perhaps had a different 
solution than the one I finally came up with. But no.... It had to be a 
generic 'read the docs.... read the docs....' (sigh)

> If you don't like the documentation there, upgrade to 2.x .

I just downloaded it and looked at it. The comments on 'exec-program' have 
been removed from the README and the rest of the documentation looks 
pretty much the same. So much for having improved it.... Though of 
course, you are so convinced of how good it is, why would you? But it 
makes the above comment a bit of a joke....

>  If you don't want to upgrade to 2.x, don't blame *me* for the 
> documentation being bad.  You're the one whose chose to *not* read the 
> documentation I wrote.

Actually, if you engage two or more brain cells at the same time, you will 
remember that I was *asking* for pointers to the correct documentation.

>> Yes, yes, version 2.x.... But
>> given my
>  ... self-imposed ...
>> constraints, 'read the docs' was utterly useless.
>  Well.. I can't help that.

No you can't. But at least when someone tells you it was useless you can 
stop telling them that you have done something 'useful' by repeatedly 
pointing him to docs that don't help.

>> I await your QUOTE of '5 or 6' options. I'll presume one of them was to
>> upgrade to 2.x so you can skip that one....
>  No.  It's an option.  The fact that *you* rejected it is *your* problem.

No, no, I was just saying you could save time by not bothering to repeat 
it. You have so many times, WE ALL GET IT. :)

>  I didn't know if you *really* wanted to solve the problem, or if you
> just wanted to find reasons to vent about how bad the software was.

My turn to say "you're kidding, right?" To give you your due, yes I'm sure 
you get lots of whiners who disagree with any number of your design 
choices and anything else they can think of. But I think when you see the 
word 'newbie' and a request for a 'howto', it's not criticizing anything. 
It just means I need more docs. Not my fault if you take away more meaning 
from the request than you put into it.

> Given the sheer level of energy you've put into *not* following
> suggestions, I'd say the answer to that is pretty clear.

Actually, you have a point there about wasted effort. I spent far more 
time trying to understand what docs were being referenced than I did 
actually continuing to work on my own.

>  Yet when you *finally* downloaded the source, you found the working
> script that you were told to use.  But it took *fighting* you before you
> were willing to take that step.

Actually, no. It took someone polite and caring who asked me if I had 
looked in a particular file and not just 'at the docs'. As soon as someone 
mentioned a specific file that I knew I had not yet seen I had at least 
some sort of answer that I could work with. YOUR problem  is you never 
named a file. You never told me WHERE to look. As soon as that script was 
named, I got the source and looked at it. Even though I had already 
figured out my own way, it seemed reasonable to pursue this and see if 
there really was something you were talking about,

But seriously, chanting 'read the docs' is worse than useless,

>  See?  Given the choice between following instructions and then solving
> the problem, *or* fighting, your first reaction was to fight, and to
> disagree with the people on this list.

(Sarcasm) Your argument is completely invalid in light of my previous 
posting on this subject. PLease read it before continuing to make these 
false assertions. (/sarcasm)

Now to *which* posting do I refer? Well, in the spirit of your 'look at 
the docs' comment, you'll just have to keep looking in places you never 
knew about to find it. Oh, sorry, it was on a different list, ina 
competely unexpected thread. But you can work it out without details like 
that. At least that's what you expect from me.

LOL

>  That seems to be clear demonstration of your goals.

I think the thing that really bugs you is that I proved that my goals were 
to get a working script/module and DID it in spite of your pathetic 
attempts to 'help', not because of them. Why don't you take this 
positively and think of it as a tribute to your excellent design that I 
was able to code it myself by simply copying what was in the file?

>> Really, why weren't the docs in the radiusd.conf or users documentation?
>> You say you wrote this stuff. How could you leave something out (and
>> then act like it was always there and I failed to read it)?
>  You got far enough to put the *correct* configuration into the *wrong*
> file.

Yeah. Far enough to know this was the case, and not have any comment in 
any config file showing its use in place. So I ASKED for a 'howto' or a 
working example. What is so hard about that?

> No documentation or example said that configuration would work.
> Many other documentation files and examples said something else would work.

And I asked people to POINT me to one of them, and I had to fight like 
crazy just to finally get someone to point me to a 'script' directory.

>  And despite your complaints, you have carefully *not* responded to
> most of my points disproving most of your complaints.

LOL I would say the same about you. Your list of '5 options' is totally 
repatitive (or perhaps redundant is the word) to the point of being a 
joke.

But having read the above, I am once more convinced that your only goal 
here is to sound superior. I've easilyt admitted I came here as an 
ignorant newbie (it's in the darn thread title, for heaven's sake), so you 
could hardly take any of this as some giant scheme to prove I am somehow 
'better' than you. I just don't see how lies and half truths help the 
situation.

> You selectively read my messages, just like you selectively read the 
> documentation.

Guilty of the latter, certainly. But the former is once again, for the 
man who gets 'no idea' from my postings, strictly your problem. Not mine.
You make this stuff up as you go. I quote my previous postings, and 
sections of documentation that are clearly lacking. I post examples and 
facts. You post hyperbole and exaggerated accusations of my incompetency.

And you know what? I don't even care if I come across as incompetent. Sure 
I am. There you go. I said it. But the fact that you could FAIL to help 
someone who knows so little only shows a complete unwillingness to be 
helpful. Makes me wonder why you bother to post at all....

Anyways.... When you come up with 5 real examples of clear code options 
that were offered to me to use in my 1.x setup without using the 
deprecated exec-program, then I might believe I overlooked something,
but well, to quote a favorite TV show, I think Satan will be skating to 
work on that day....

Thanks again for the great software.

- C

On Mon, 15 Jun 2009, A.L.M.Buxey@lboro.ac.uk wrote:

Charles, this is an unpaid community support list. you are coming across as a very angry person with no regard that the people on this list arent paid to give you informaation which is probably essential for you to actually do your work, get paid etc.

We have nothing to fear but fear itself. The thing which makes me angry is not that people choose to be unhelpful. If Mr. DeKok really thinks I'm not worth his time and just doesn't answer my posts, then I have no problem with that. I end up doing exactly what I *did* do: I worked it out on my own. What angers me is when I get accused of doing things I didn't do, or of rejecting help I didn't receive. This can be subtle. If someone says 'go read the docs' am I 'rejecting' that suggestion when I believe I've alredy read all the relevant documentation I could find? It is even more angering when you consider that the original question was to ask where there might be more docs/examples.... At any point someone could have said, "did you look in /usr/shar/docs/README. I'd feel like a dummy, but I would have gotten an important clue about one way to do this. Instead, I read the man pages, and read the comments in the config files, and I'm sorry, but they were confusing to the point of being misleading. I'm not asking that people correct docs for an old version, but please stop accusing me of failing to do my legwork or heed suggestions to read those docs when I've SAID I've done it already. Yes, makes me quite angry. :)

if you'd actually like any help/advice in the future from the community its probably best that you realise we are all humans, we too suffer from undocumented bits (and then use the WIKI or the mailing list to disemminate such information) rather than make a big hoo haa out of such a piffling little issue and personally attack people.

Actually I'm making a big 'hoo haa' out of being personally attacked with these blatantly false claims. Someone with Mr. Dekok's (now) obvious knowledge and expertise should never say "I have no idea", like I had failed to even lay out the basic intent and method I was trying to use. He made it sound like I had posted little or nothing about what I was trying to do. As near as you can get to lying about me as I think you can with a clever indirect statement. And yes, lying about me really angers me.

one day you may need to real help regarding a feature or option....

With respect, why would that be any different than now? That's my point about making the big fuss. If the people who *could* help don't reflect and refine their understanding of *how* they help, then even if I shut my mouth and was very polite, I would have no expectation of ever getting any help on anything that I could not look up myself in a man page or file. Yes, I'm well aware that I could be shooting myself in the foot by angering the people who might help me, but they *weren't* helping, so really, I lose nothing. While I might stand to gain proper understanding of how I was not helped and by extension, help not only myself but anyone else in a similar 'newbie' position in future.

I can't predict the future but i can say the future is always more promising if you can look back and say you've never burnt your bridges.

To be honest, if I wanted to burn bridges I would just unsubscribe from the group. Burn and forget. No, I'm still hanging onto the assumption that the people who argue so passionately actually *do* care, and if I can convince them that they fell short in this case, and that not all the blame is mine, then maybe that will be of lasting benefit, rather than leaving things at the status quo, where a certain percentage of people just don't get help (even though others think they are). Thanks for your thoughts Alan. I know I'm an angry argumentative person, but I always do so with the intent to make things BETTER. - Charles

On Mon, 15 Jun 2009, A.L.M.Buxey@lboro.ac.uk wrote:

one of the main issues is using a distro version of the code.

(nod) Once John mentioned a folder I just didn't have, the light came on (so to speak).... :)

...they might have been dumped into somewhere like /usr/share/doc/radiusd or somesuch.

(smile) Nope. But good thought. Strictly speaking, all the information I needed was in the various documentation files. I just made an error of presumption from the 'look' of the code and examples and comments in the 'radiusd.conf' file....

you can get v2.x for CentOS - read the WIKI - theres a repository for it too so it will get updated with new versions.

Well, if I had been unable to make the existing package work, it was certainly an option. But it's better the way I have it now. :)

as for 'marking you down as yet another stubborn user' - well I thought by singularly attacking the project leaader/manager you were wanting to be thought of like that ;-)

I hope I don't set off another round of garbage with this comment, but quite honestly, he has an attitude I've never seen in a project leader. Usually they are the ones who have had years of experience dealing with newbies and *know* the stupid 2+2=3 mistakes that people like me can make, and would be the first one to say, "hey, dummy, that goes in the users file". But instead, I got..... what I got..... I work in a similar capacity being both the developer/admin for our internet service *and* the helpdesk. And the one thing I've learned in dealing with people on the phone is how differently all sorts of people will think, and how difficult some concepts are to get across even when they seem 'simple' and 'obvious' to me. It takes some time and patience, but I've learned to recognize the signs of the user who 'thinks differently' and know those special things I need to mention to get them back 'on track', and get them thinking the right way.

seriously though, most (if not all) support will be for 2.x now - as thats what most of us run - due to wanting the features, stability and speed (yes, lots of speed!) of the new version. we all used to run 1.x and deal with common/similar issues....we now run 2.x and do the same.

If I had 'issues' (aka problems) I would quite simply upgrade. It would not be worth my time or effort to try and fight with problematic old code. But FR is *not* problematic. It was just my understanding. I needed to know *how* to do what I wanted to do. It's always been my ignorance. And I've not asked anyone to 'hand hold'. I just figured there had to be some working examples out there from the 1.x days.

.... with EAP, 2.x is almost a must (unless you want your DB etc hit far too many times).

In all honesty, I don't even know what 'EAP' is. Maybe it could handle some of what I want to do. I don't know. I have an existing perl script which until now has been functioning strictly as a stand-alone daemon handling radius log output, and sending disconnect commands directly to the NAS. Now we want to set Session-Timeout and eliminate that 'timing' aspect of the script. But all the database handling, time quota management and so on are already coded. I'm just adapting an existing script to work as a module. And I've figured out how radius handles that, so I think I'm okay. The rest of this discussion generally boils down to the helpdesk geek in me analyzing why the people with the knowledge couldn't seem to communicate that knowledge clearly to the newbie ignoramus (me). If I were genuinely lazy and hadn't read a single doc file, then maybe there would be a legitimate complaint that I should 'go read docs', but I indicated right up front that I had read docs, searched archives and so on. I was hoping someone would say "did you look in the doc/README" or something similar that would point me to the doc with the information that I needed. But it didn't happen. (sigh) But if people (particularly Mr. DeKok) are going to have this attitude that amounts to "we tried to help but you ignored us" then I think that serves no one. The next person along with the same lack of comprehension will be no better helped than I was. But if the people with the knowledge admit that their 'help' did not suit the target audience, and that it needs to be clearer and more specific, then future inquiries like mine will be met with a clearer and helpful response. That's what I hope for. That people who mean to help really do help. I have my answer. My problem is solved. I can jsut walk away. But that doesn't help the next person who falls over the same shortfall in the old docs. If nothing else, I will be here to help them if I see their post. :) - Charles

On Mon, 15 Jun 2009, Arran Cudbard-Bell wrote:

See the thing is a lot of the documentation pitfalls aren't there in 2.*, a lot of the inconsistencys aren't there in 2.*. I know, because I regularly play the dumb user and pester Alan about niggly bits of syntax and documentation.

I try to be a fair person. And I knew that one argument used against me would be that the docs had improved since version 1.x, but when I had a look I found that this 'basic' element remained essentially unchanged. Indeed the one change I spotted was that the references to 'exec-program' had disappeared! But there was nothing more about 'exec' modules. And when I checked the documentation for the latest release, neither the users file itself nor the documentation for it mentions 'exec'. So I would still have found no help there.... And the docs for freeradisud.conf remained the same..... Think of it this way. In the French language, when someone turns a light on they say "make the light OPEN". They *mean* the same thing, but they use a different word. But if you don't *know* that, you can spend a lot of time trying to figure out why someone wants to 'open' something that you just want to turn 'on'. Thus it was with my understanding of config files in FreeRADIUS. I came from a background where config files only contained constants. Nothing dynamic. I had come so far as to realize that we could 'specify' modules in the main config file, but presumed that sub files remained lists of constant specifications. There was no mention of executable code in the users file comments, so I presumed that was just the 'wrong place'. My bad? Well, yes, BUT I would expect that any expert on RADIUS would have long ago encountered this kind of thinking and recognize it for what it is. And if they really wanted to help, they'd be sure to say a few 'basic' things like "what you are looking for is in the README, not the individual files". That was all I was asking for, but instead I get this attitude like I failed to take advice.... (sigh)

I've been following this thread (mostly for its Jerry Springer'esq qualities) and I saw where you stumbled. The documentation in v1 is far from perfect, but if you'd actually read around a bit more then you'd have figured out exactly what was going on.

Actually, I *did* exactly that. My only complaint was that I had to hunt at random through files I never imagined containing what I wanted. If someone had grasped that I was 'not getting it' they could have just pointed me where I needed to go. Not saying they were obliged to do so, but I am saying they shouldn't treat their failure to do so with the attitude that they did 'enough' to help.

The *only* place in 1.* where the syntax used in the rlm_exec example exists is in the users file.

Actually, to the uninitated, that is NOT true. Within the module definitions in the radiusd.conf there are numerous 'assignements' of values to 'variables' that look remarkably similar to attribute assignments. Only once it has been *explained* would I realize that there is something special about the users file 'assignments'. And again, I point out that the syntax of assigning an executable to an attribute is *not* given as an example in the users file. If only it had been, then I would have figured it all out without this mess. But then again, I would also have been using an older technique.

But you're not a user, you're a sysadmin/developer. It's assumed that you'll have a modicum of initiative.

Certainly. I *did* find my answer on my own. (smile) This is the stumbling point. I thought I had looked in all the obvious and relevant documents. And enough of them were lacking in detail that I don't think anyone can fairly say I didn't bother to look for my answer before I posted my question. And that's why I get angry when people just say I was offered lots of options. No, not really. They were only options for someone who (and I know this happens) posts a question without having read *any* of the documentation. I had hoped my included syntax sample would have desmontrated that I had made progress. :) But really, if no one grasped that I was lacking that key concept, then how would they know to tell me where to look for what I wanted? So who is to blame there?

I don't always agree with Alans way of dealing with users on the list, but I understand why he's the way he is.

I understand it too. I just figur if he wants to be helpful, then he could try to understand how he wasn't. Yes, it is mostly *my* shortcoming, but when someone like me doesn't *know* he has a shortcoming, just saying 'read the docs' or 'upgrade to 2.x' does not fix this error. I hope my comments lend themselves to increased awareness of ignorance and better handling of it.

...

In all honesty, I don't even know what 'EAP' is. Extensible Authentication Protocol, it's the Authentication protocol used in 802.1X (WPA-Enterprise etc...).

Silly me. I had actually read that. Sorry. I tend to forget things that I think I won't be likely to use. :)

If you genuinely want to help other FreeRADIUS v1 users, then you can contact me, or any other wiki admins for an account.

Hmmmm. My first gut reaction is that I "don't know enough", but before I dismiss this idea, I have to ask what you have in mind. - Charles

hi,

Hmmmm. My first gut reaction is that I "don't know enough", but before I dismiss this idea, I have to ask what you have in mind.

I think the initial idea would be to document what/how you've used exec module to define an attribute - rlm_exec is quite bare on the wiki ;-) alan

Hi,

(grin), but of course, if I want to write for the wiki, I'm going to have to install the latest release, to be sure what I write is valid for the most current context. Fortunately I have a test box for stuff like this. :)

..but to mirror wat you've ben saying - why not support 1.x fully on the wiki - theres plenty of 1.x installs out there and 1.x users who are forced into such a situation - eg because their enforced distro/repository policy means no building from source.... it would be much beter if there was a full delineation between 1.x and 2.x docs - the web is full of older resources that dont say what version their tweaks and info is good for. if i see one more config with Auth-Type = EAP I'll scream ;-) alan

On Mon, 15 Jun 2009, A.L.M.Buxey@lboro.ac.uk wrote:

it would be much beter if there was a full delineation between 1.x and 2.x docs - the web is full of older resources that dont say what version their tweaks and info is good for.

(nod) I don't know enough about the differences between 1.x and 2.x to say whether it would be better to have two complete document trees, like the apache server, or annotated with "applies to versions x-y" the way the postfix docs do it. I get the feeling that for the most part features have been *added* to FreeRADIUS, and very little removed. But is that actually the case?

if i see one more config with Auth-Type = EAP I'll scream ;-)

Had to look that one up. First hit on google explained it all.... LOL - Charles

On Fri, 12 Jun 2009, John Dennis wrote:

BTW, the philosophy of RHEL (why it's "older"), the philosophy of Fedora (why it's bleeding edge) and CentOS is explained on the FreeRadius FAQ under Red Hat (http://wiki.freeradius.org/Red_Hat_FAQ). It's incumbent upon you when selecting an OS to install to comprehend the associated issues of that choice.

Firstly, thank you for the very thoughtful and well-worded reply. Sadly, the problem I am complaining about here is that so many people spend so much time providing answers like this one you gave, when I ALREADY HAVE THAT ANSWER. I'd already read all the FAQ's, and so on. I quoted your above paragraph because it is central to my thinking. I made a CHOICE. I was constrained by budget to 'free' software. But I could have still chosen Debian or another 'newer' OS. I CHOSE CentOS for it's *simplicity* and stability. I KNEW I was also choosing to have fewer/older features. I had (and have) the option to upgrade if it is necessary. But where possible, I try to work within the 'basic' framework of this easily understood 'basic' OS and environment, so that for potential future volunteers life will be simpler. I really believe that the problem here is my understanding of FreeRADIUS. It is NOT a 'shortcoming' of version 1.x (at least I can't imagine why it would be). All I need is a bit of advice or a pointer to a 1.x-specific FAQ/howto. So if I have any legitimate complaint against the "FreeRADIUS team" it is only that with versions so 'close together' in time, there really should either be a repository of documents applying to 1.x (similar to how Apache mainatains its separate document trees for 1.x and 2x), or in the 'main' documentation, there 'should' be those little footnotes that say "applies to 2.1 and later" in the descriptions of commands. I put 'should' in quotes, because I recognize that sometimes volunteers don't have time to do these things, and I always try not to sound like I'm 'demanding' on the time of other volunteers. But yes, John, I *knew* what I was choosing. This is one reason I get so incensed by people who clutter a group with replies that tell me I made a bad choice. Not that their opinions 'hurt' me directly, but I am concerned that people are hanging on the fringes, and perhaps have an answer to my questions, but they see an 'official-sounding' response, and maybe they think they're not "supposed" or "allowed" to answer questions about earlier versions...... Sounds silly, I know, but people are like that. :) Thank you John! - Charles

Charles Gregory wrote:

...there really should either be a repository of documents applying to 1.x (similar to how Apache mainatains its separate document trees for 1.x and 2x),

Sure. Apache has 1000 times as many installations as FreeRADIUS, and probably 1000 times as much funding, and probably 100 times as many developers. There are very, very, few Open Source projects with as good documentation as Apaches. The simple reason is that there are very, very, few projects with as much funding and as many developers.

But yes, John, I *knew* what I was choosing. This is one reason I get so incensed by people who clutter a group with replies that tell me I made a bad choice. Not that their opinions 'hurt' me directly, but I am concerned that people are hanging on the fringes, and perhaps have an answer to my questions, but they see an 'official-sounding' response, and maybe they think they're not "supposed" or "allowed" to answer questions about earlier versions...... Sounds silly, I know, but people are like that. :)

Anyone is free to ask, or answer, questions about any version of the server. As it happens, the most active people responding to messages all use recent versions of the server. And it is their professional opinion that most everyone else should, too. Alan DeKok.