Re: Issues with building Freeradius on CentOS 6.5: need rlm_cache
Ok, so now that I have this working...rlm_cache is loading just fine, but I think I may be making an error (based on what I want to achieve anyway). I've taken information from the article http://wiki.freeradius.org/modules/Rlm_cache#Two-call-caching, and i see the cache working, but is it in the wrong place? My hope was that if the user doesn't exist in sql (which "tester" doesn't) then forward. When you get a response, cache these attributes (user account, authZ privileges, etc) back into the sql database. I don't see any updates to the radcheck table, but I'm not 100% sure if that's where it should go. Sorry for being slow here...can anyone help, or do I have this wrong? I'm probably missing something easy here or just getting the formatting wrong. output (i can give more if necessary): [sql] User tester not found +++[sql] = notfound ++} # if (notfound) = notfound ++update control { ++} # update control = noop [cache] expand: %{User-Name} -> tester [cache] expand: reply:Reply-Message -> reply:Reply-Message [cache] expand: Cache last updated at %t -> Cache last updated at Fri Jun 13 16:41:10 2014 [cache] expand: ssssssssssssssssssssssssssssssss -> ssssssssssssssssssssssssssssssss [cache] expand: %{randstr:ssssssssssssssssssssssssssssssss} -> gcEKJNqJQcCe4J4qSRlEciZ7DYDhJW7e rlm_cache: Adding entry for "tester", with TTL of 10 ++[cache] = updated +} # group authorize = updated WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 182 to 192.168.1.35 port 1812 User-Name = "tester" User-Password = "suckit" NAS-IP-Address = 192.168.1.136 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313133 Proxying request 0 to home server 192.168.1.35 port 1812 Sending Access-Request of id 182 to 192.168.1.35 port 1812 User-Name = "tester" User-Password = "suckit" NAS-IP-Address = 192.168.1.136 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313133 Going to the next request Waking up in 0.9 seconds. Waking up in 19.0 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 42674, id=113, length=76 Sending duplicate proxied request to home server 192.168.1.35 port 1812 - ID: 182 Sending Access-Request of id 182 to 192.168.1.35 port 1812 User-Name = "tester" User-Password = "suckit" NAS-IP-Address = 192.168.1.136 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313133 Waking up in 14.9 seconds. rad_recv: Access-Accept packet from host 192.168.1.35 port 1812, id=182, length=25 Proxy-State = 0x313133 The config under authorize section: ############ CUSTOM AUTHORIZE STATEMENTS ############ if (!notfound) { update control { Proxy-To-Realm := "DARTH_RSA" } } ############ CUSTOM CACHING REQUIREMENTS ############ update control { Cache-Status-Only = 'yes' } cache if (notfound) { sql } update control { Cache-Status-Only := 'no' } cache ############ CUSTOM AUTHORIZE STATEMENTS ############ On Thu, Jun 12, 2014 at 11:50 PM, Brandon Jozsa <bjozsa@gmail.com> wrote:
Hello,
I've been trying to work through the issues and by searching high and low for solutions before turning to this users list. I'm sorry if this is a stupid question (I've seen worse though, so maybe I shouldn't feel bad).
I have a very high need to use the rlm_cache module with Freeradius on CentOS 6.5. I'm trying to first us the statement:
----- snipped -----
authorize { if (!notfound) { update control { Proxy-To-Realm := "SOME_REALM" } } ----- snipped -----
which works GREAT alone...but I also want to use the cache function like so:
----- snipped ----- update control { Cache-Status-Only = 'yes' } cache if (notfound) { sql } update control { Cache-Status-Only := 'no' } cache
----- snipped -----
which doesn't work (obviously) because rlm_cache isn't included with 2.1.12, or so it seems anyway.
My hope is (it is a hope anyway) that I can collect authN/authZ replies from an upstream radius server and cache them locally; thus building a mysql database of users access/privileges and let this run on an environment before cutting completely over to our new Freeradius setup. Again, I'm hoping it can work like this...getting rid of RSA and using LinOTP or MOTP would be so nice; it would be more flexible and user friendly, but I really need to collect authN and authZ in order to rebuild our massive user-base.
My issue...CentOS, which is our "approved platform" (I'm rolling my eyes and giving air quotes), doesn't have a newer version of Freeradius other than 2.1.12. I think the rlm_cache modules are only included in 3.0.0 and higher, is that right?
So, I started looking on how to build from source...and I found one; great news I thought!! Enter: http://confluence.diamond.ac.uk/display/PAAUTH/FreeRADIUS+specs+and+sources+.... I thought this would save the day, but there are broken links for 3.0.0 and I am running into major issues; it just doesn't seem to work at all. I also tried to build it out, take the rlm_cache.so lib over to my 2.1.12 installation, but Freeradius barfed all over that little trick.
What are my options here? I could really use some help. Any ideas?
-- Brandon
-- Brandon
On 14 Jun 2014, at 19:53, Brandon Jozsa <bjozsa@gmail.com> wrote:
Ok, so now that I have this working...rlm_cache is loading just fine, but I think I may be making an error (based on what I want to achieve anyway). I've taken information from the article http://wiki.freeradius.org/modules/Rlm_cache#Two-call-caching, and i see the cache working, but is it in the wrong place?
Yes. The second call should go in Post-Proxy. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 14 Jun 2014, at 20:13, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 14 Jun 2014, at 19:53, Brandon Jozsa <bjozsa@gmail.com> wrote:
Ok, so now that I have this working...rlm_cache is loading just fine, but I think I may be making an error (based on what I want to achieve anyway). I've taken information from the article http://wiki.freeradius.org/modules/Rlm_cache#Two-call-caching, and i see the cache working, but is it in the wrong place?
Yes. The second call should go in Post-Proxy.
authorize { sql if (notfound) { update control { Cache-Status-Only = 'yes' } cache update control { Cache-Status-Only !* ANY } # Not found - Proxy request if (!notfound) { update control { Proxy-To-Realm := <realm> } } # Found - Merge proxy response else { cache } } } post-proxy { cache } Or 3rd call... v3.0.4 is simpler. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Ok, I made that adjustment (thank you a lot, that makes more sense actually to put in post-proxy), but for some reason, I'm still not seeing any write entries to the database. Am I missing something? I see cache working, correctly I think...but no updates to the database (timestamps are the same on radcheck). rlm_sql (sql): Released sql socket id: 4 [sql] User tester not found ++[sql] = notfound ++? if (notfound) ? Evaluating (notfound) -> TRUE ++? if (notfound) -> TRUE ++if (notfound) { +++update control { +++} # update control = noop [cache] expand: %{User-Name} -> tester +++[cache] = notfound +++update control { +++} # update control = noop +++? if (!notfound) ? Evaluating !(notfound) -> TRUE +++? if (!notfound) -> TRUE +++if (!notfound) { ++++update control { ++++} # update control = noop +++} # if (!notfound) = noop +++ ... skipping else for request 0: Preceding "if" was taken ++} # if (notfound) = noop +} # group authorize = ok WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 95 to 192.168.1.35 port 1812 User-Name = "tester" User-Password = "suckit" NAS-IP-Address = 192.168.1.136 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313331 Proxying request 0 to home server 192.168.1.35 port 1812 Sending Access-Request of id 95 to 192.168.1.35 port 1812 User-Name = "tester" User-Password = "suckit" NAS-IP-Address = 192.168.1.136 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313331 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 192.168.1.35 port 1812, id=95, length=25 Proxy-State = 0x313331 # Executing section post-proxy from file /etc/raddb/sites-enabled/default +group post-proxy { [eap] No pre-existing handler found ++[eap] = noop [cache] expand: %{User-Name} -> tester [cache] expand: reply:Reply-Message -> reply:Reply-Message [cache] expand: Cache last updated at %t -> Cache last updated at Fri Jun 13 18:58:10 2014 [cache] expand: ssssssssssssssssssssssssssssssss -> ssssssssssssssssssssssssssssssss [cache] expand: %{randstr:ssssssssssssssssssssssssssssssss} -> IwEpAi6ylyNZ8zQoYOtW2xjHN.h52sgi rlm_cache: Adding entry for "tester", with TTL of 10 ++[cache] = updated +} # group post-proxy = updated Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /etc/raddb/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 131 to 127.0.0.1 port 48539 Reply-Message += "reply:Reply-Message" Reply-Message += "Cache last updated at Fri Jun 13 18:58:10 2014" Class := 0x49774570416936796c794e5a387a516f594f745732786a484e2e683532736769 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 131 with timestamp +40 Ready to process requests. On Sat, Jun 14, 2014 at 3:23 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 14 Jun 2014, at 20:13, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 14 Jun 2014, at 19:53, Brandon Jozsa <bjozsa@gmail.com> wrote:
Ok, so now that I have this working...rlm_cache is loading just fine,
but I think I may be making an error (based on what I want to achieve anyway). I've taken information from the article http://wiki.freeradius.org/modules/Rlm_cache#Two-call-caching, and i see the cache working, but is it in the wrong place?
Yes. The second call should go in Post-Proxy.
authorize { sql if (notfound) { update control { Cache-Status-Only = 'yes' } cache update control { Cache-Status-Only !* ANY }
# Not found - Proxy request if (!notfound) { update control { Proxy-To-Realm := <realm> } } # Found - Merge proxy response else { cache } } }
post-proxy { cache }
Or 3rd call... v3.0.4 is simpler.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Brandon
On 14 Jun 2014, at 21:08, Brandon Jozsa <bjozsa@gmail.com> wrote:
Ok, I made that adjustment (thank you a lot, that makes more sense actually to put in post-proxy), but for some reason, I'm still not seeing any write entries to the database. Am I missing something? I see cache working, correctly I think...but no updates to the database (timestamps are the same on radcheck).
Sorry, that should have been: # Not found - Proxy request if (notfound) { update control { Proxy-To-Realm := <realm> } }
I get a reject now. I'll have to really dive into this...something just isn't clicking correctly. On Sun, Jun 15, 2014 at 2:13 AM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 14 Jun 2014, at 21:08, Brandon Jozsa <bjozsa@gmail.com> wrote:
Ok, I made that adjustment (thank you a lot, that makes more sense actually to put in post-proxy), but for some reason, I'm still not seeing any write entries to the database. Am I missing something? I see cache working, correctly I think...but no updates to the database (timestamps are the same on radcheck).
Sorry, that should have been:
# Not found - Proxy request if (notfound) { update control { Proxy-To-Realm := <realm> } }
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Brandon
Ok, so here is the configuration. I feel horrible for trying keeping this thread alive (everyone has helped a lot and I'm very thankful for the responses). I get a reject when trying the unlang suggestion. Most of it makes sense, but I'm not sure what I'm missing. If you need/want more debug, I can definitely provide. If I'm being slow, I sincerely apologize. authorize { preprocess auth_log chap mschap digest suffix eap { ok = return } files expiration logintime pap sql if (notfound) { update control { Cache-Status-Only = 'yes' } cache update control { Cache-Status-Only !* ANY } if (!notfound) { update control { Proxy-To-Realm := <realm> } } else { cache } } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp sql exec } session { radutmp sql } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { cache } On Sun, Jun 15, 2014 at 9:27 AM, Brandon Jozsa <bjozsa@gmail.com> wrote:
I get a reject now. I'll have to really dive into this...something just isn't clicking correctly.
On Sun, Jun 15, 2014 at 2:13 AM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 14 Jun 2014, at 21:08, Brandon Jozsa <bjozsa@gmail.com> wrote:
Ok, I made that adjustment (thank you a lot, that makes more sense actually to put in post-proxy), but for some reason, I'm still not seeing any write entries to the database. Am I missing something? I see cache working, correctly I think...but no updates to the database (timestamps are the same on radcheck).
Sorry, that should have been:
# Not found - Proxy request if (notfound) { update control { Proxy-To-Realm := <realm> } }
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Brandon
-- Brandon
On 15 Jun 2014, at 17:32, Brandon Jozsa <bjozsa@gmail.com> wrote:
Ok, so here is the configuration. I feel horrible for trying keeping this thread alive (everyone has helped a lot and I'm very thankful for the responses). I get a reject when trying the unlang suggestion. Most of it makes sense, but I'm not sure what I'm missing. If you need/want more debug, I can definitely provide. If I'm being slow, I sincerely apologize.
debug would help... and what's the configuration of the cache module itself? -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Crap, default? (I'm ducking now). I looked at: http://wiki.freeradius.org/modules/Rlm_cache but besides what is written in the module itself, I haven't touched a lot. I would like to default to writing everything to the MySQL database (authN, authZ attributes, etc); really anything that can possibly collected, that is what I need in order to correctly set policies, forklift the new solution into production and migrate off of the current RSA solution [eventually]. cache { key = "%{User-Name}" ttl = 10 epoch = 0 add_stats = no update { reply:Reply-Message += reply:Reply-Message reply:Reply-Message += "Cache last updated at %t" reply:Class := "%{randstr:ssssssssssssssssssssssssssssssss}" } } On Sun, Jun 15, 2014 at 1:22 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 15 Jun 2014, at 17:32, Brandon Jozsa <bjozsa@gmail.com> wrote:
Ok, so here is the configuration. I feel horrible for trying keeping this thread alive (everyone has helped a lot and I'm very thankful for the responses). I get a reject when trying the unlang suggestion. Most of it makes sense, but I'm not sure what I'm missing. If you need/want more debug, I can definitely provide. If I'm being slow, I sincerely apologize.
debug would help... and what's the configuration of the cache module itself?
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Brandon
really anything that can possibly collected, that is what I need in order to correctly set policies, forklift the new solution into production and migrate off of the current RSA solution [eventually].
You need to specify individual attributes in the v2.x.x version, you can't just cache entire lists. You can in v3.x.x, it's been supported since 3.0.0. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Hmm...ok, so 3.0.x sounds interesting. I will have to test. For the 2.x versions, is there a list of attributes that can be used or is there a logic that I can reference? I tried finding more information on the Freeradius website, but I must me blindly missing it. I really hate asking stupid questions. I've used Freeradius for years, and this is my first round of questions...so not too bad...until I hit the caching requirements. BTW, thank you 1000 times over for your patience and guidance. On Sun, Jun 15, 2014 at 3:17 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
really anything that can possibly collected, that is what I need in order to correctly set policies, forklift the new solution into production and migrate off of the current RSA solution [eventually].
You need to specify individual attributes in the v2.x.x version, you can't just cache entire lists. You can in v3.x.x, it's been supported since 3.0.0.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Brandon
Brandon Jozsa wrote:
Hmm...ok, so 3.0.x sounds interesting. I will have to test. For the 2.x versions, is there a list of attributes that can be used or is there a logic that I can reference?
$ man unlang The syntax to reference attributes is documented. For the rest, if an attribute appears in the debug output, you can reference it. Alan DeKok.
yeah, that I get. unlang is for the overall freeradius logic for configuration files, but I thought that unlang couldn't be used in the modules? just to be clear, do i need to change the configuration in the cache module or in my default policy configuration? i was taking it that the policy suggestion would work if the cache module was written differently. i hate beating this to death...so i really apologize for dragging this out. i'm just trying to look for a quick way to capture everything being returned back from a proxy request, and write it to the local mysql db. the cache module logic is new to me, and i'm not sure why i'm not getting entries back into the sql database when using rlm_cache. On Sun, Jun 15, 2014 at 8:31 PM, Alan DeKok <aland@deployingradius.com> wrote:
Brandon Jozsa wrote:
Hmm...ok, so 3.0.x sounds interesting. I will have to test. For the 2.x versions, is there a list of attributes that can be used or is there a logic that I can reference?
$ man unlang
The syntax to reference attributes is documented. For the rest, if an attribute appears in the debug output, you can reference it.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Brandon
On 16 Jun 2014, at 04:33, Brandon Jozsa <bjozsa@gmail.com> wrote:
yeah, that I get. unlang is for the overall freeradius logic for configuration files,
To make things simpler for users, we re-used the format of the update section for anything map like in the modules, then you don't have to learn multiple forms of attribute reference syntax. Maybe we could rename it to 'map' to differentiate it, but you're the first person who's had trouble understanding the concept in the 8 months since the release of v3.0.x (where this format is used in more modules) i'm inclined not to.
but I thought that unlang couldn't be used in the modules?
Alan is saying it uses the same format as an 'update' section in the policy, language. Thought using the same section name might hint that... Is anyone else having trouble with understanding update blocks in rlm_cache, rlm_ldap, rlm_couchbase? any suggestions to make them easier to use?
just to be clear, do i need to change the configuration in the cache module or
The cache module, you need to configure it to store the attributes you want put back into the request when it's called again later.
in my default policy configuration? i was taking it that the policy suggestion would work if the cache module was written differently. i hate beating this to death...so i really apologize for dragging this out. i'm just trying to look for a quick way to capture everything being returned back from a proxy request, and write it to the local mysql db. the cache module logic is new to me, and i'm not sure why i'm not getting entries back into the sql database when using rlm_cache.
I'm not sure how you think caching responses from the proxy server is going to insert missing attributes into your SQL directory... You'd need to use SQL xlat for that. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
I'm using v.2.2.5, not 3.0.x; I have no complaints with 3.0 at all. I definitely want to move towards it, I just fear that it will break too many things if I implement it on CentOS 6.5 right now. But, I'll look at http://wiki.freeradius.org/guide/Red-Hat-FAQ and build out from source, and/or try the updated .rpm's listed above. This is all my misunderstanding entirely, and respectfully I apologize. I was thinking since Freeradius already had the hooks in the * database, the cache module would use those hooks to create any unrecognized attributes/tables, but as I'm writing this I'm practically laughing at myself. It's great it thought, but it would be a massive addition and it would require a lot of time to develop. This is basically what I'm after, so I'll have to get to it...there's a lot more work to be done. At a personal level, I'm going to run into a lot of new territory when trying to get this to work. Thanks for all the guidance this far, and sorry for the confusion (on my part). On Mon, Jun 16, 2014 at 3:52 AM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 16 Jun 2014, at 04:33, Brandon Jozsa <bjozsa@gmail.com> wrote:
yeah, that I get. unlang is for the overall freeradius logic for configuration files,
To make things simpler for users, we re-used the format of the update section for anything map like in the modules, then you don't have to learn multiple forms of attribute reference syntax.
Maybe we could rename it to 'map' to differentiate it, but you're the first person who's had trouble understanding the concept in the 8 months since the release of v3.0.x (where this format is used in more modules) i'm inclined not to.
but I thought that unlang couldn't be used in the modules?
Alan is saying it uses the same format as an 'update' section in the policy, language. Thought using the same section name might hint that...
Is anyone else having trouble with understanding update blocks in rlm_cache, rlm_ldap, rlm_couchbase? any suggestions to make them easier to use?
just to be clear, do i need to change the configuration in the cache module or
The cache module, you need to configure it to store the attributes you want put back into the request when it's called again later.
in my default policy configuration? i was taking it that the policy suggestion would work if the cache module was written differently. i hate beating this to death...so i really apologize for dragging this out. i'm just trying to look for a quick way to capture everything being returned back from a proxy request, and write it to the local mysql db. the cache module logic is new to me, and i'm not sure why i'm not getting entries back into the sql database when using rlm_cache.
I'm not sure how you think caching responses from the proxy server is going to insert missing attributes into your SQL directory...
You'd need to use SQL xlat for that.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Brandon
On 16 Jun 2014, at 14:23, Brandon Jozsa <bjozsa@gmail.com> wrote:
I'm using v.2.2.5, not 3.0.x; I have no complaints with 3.0 at all.
I know. I was saying the update {} style was adopted for most maps in v3.0.x.
I definitely want to move towards it, I just fear that it will break too many things if I implement it on CentOS 6.5 right now. But, I'll look at http://wiki.freeradius.org/guide/Red-Hat-FAQ and build out from source, and/or try the updated .rpm's listed above.
This is all my misunderstanding entirely, and respectfully I apologize. I was thinking since Freeradius already had the hooks in the * database, the cache module would use those hooks to create any unrecognized attributes/tables, but as I'm writing this I'm practically laughing at myself.
Ah. No, that's not what the Cache module does. It uses an in memory tree to cache sets of attributes against a configurable key.
It's great it thought, but it would be a massive addition and it would require a lot of time to develop. This is basically what I'm after, so I'll have to get to it...there's a lot more work to be done.
It's just a bunch of inserts, but i'm not sure how you're hoping to gather info from the *response* of the RSA server. I'd doubt it would include any useful information. If you're looking to populate the user db with passcodes then that's fine, just add some logic in post-proxy to detect when it's a passcode request (as opposed to pin code), and insert rows into radcheck... -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On Mon, Jun 16, 2014 at 9:37 AM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
On 16 Jun 2014, at 14:23, Brandon Jozsa <bjozsa@gmail.com> wrote:
I'm using v.2.2.5, not 3.0.x; I have no complaints with 3.0 at all.
I know. I was saying the update {} style was adopted for most maps in v3.0.x.
makes better sense now, and i see what you're saying. coffee is starting to do it's magic.
I definitely want to move towards it, I just fear that it will break too many things if I implement it on CentOS 6.5 right now. But, I'll look at http://wiki.freeradius.org/guide/Red-Hat-FAQ and build out from source, and/or try the updated .rpm's listed above.
This is all my misunderstanding entirely, and respectfully I apologize. I was thinking since Freeradius already had the hooks in the * database, the cache module would use those hooks to create any unrecognized attributes/tables, but as I'm writing this I'm practically laughing at myself.
Ah. No, that's not what the Cache module does. It uses an in memory tree to cache sets of attributes against a configurable key.
And this definitely makes sense by what I'm seeing in the debug. I see this information pass and the cache module picking it up (thank you for making this information useful and readable).
It's great it thought, but it would be a massive addition and it would require a lot of time to develop. This is basically what I'm after, so I'll have to get to it...there's a lot more work to be done.
It's just a bunch of inserts, but i'm not sure how you're hoping to gather info from the *response* of the RSA server. I'd doubt it would include any useful information.
If you're looking to populate the user db with passcodes then that's fine, just add some logic in post-proxy to detect when it's a passcode request (as opposed to pin code), and insert rows into radcheck...
Well, that's the thing. I'm not trying to capture any user authN. You're right, that's not going to do very much good. What I am trying to do is capture and build a authZ table. The RSA server is ready to die. I need to pull authZ attributes and somehow capture/record them per user/device. I don't know of a good way to do this, but the hope was to forklift the solution into place and then just say "heck with the authN", rebuild that part using OTP or some other solution, and retain the authZ backend attributes. Big task? haha! :) I don't even know if it entirely makes sense, but it does in my mind. But if this can be done, I want to write a step-by-step article (online) so that others can do the same once I'm able to figure this out. Am I going to a road to no-where?
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Brandon
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Brandon Jozsa