Freeradius proxy support
Hi, I'm new to Freeradius. I would like to get some pointers and documentation details about setting up Freeradius as proxy. Our requirement is to have a Radius proxy and modify the Access Accept response based on certain criteria. Few questions regarding Freeradius proxy support. Does Freeradius proxy has support for a plugin probably in Java to snoop the Radius request calls? Does Freeradius proxy setup has option to specify which Radius server to pickup based on some attribute value in Access Request? Our requirement is to have multiple Radius Servers for certain groups. This group information will be available in one of the VSA in Access Request. Any help will be really helpful. Thanks, Ila.
Ilavajuthy Palanisamy wrote:
I'm new to Freeradius. I would like to get some pointers and documentation details about setting up Freeradius as proxy.
raddb/proxy.conf.
Our requirement is to have a Radius proxy and modify the Access Accept response based on certain criteria.
raddb/sites-available/default. Look for the "post-proxy" section.
Few questions regarding Freeradius proxy support. Does Freeradius proxy has support for a plugin probably in Java to snoop the Radius request calls?
No. If you want to snoop on radius packets, use pcap. If you want to look at what the server is doing, use "radiusd -X". If you want to modify the servers behavior, use "unlang".
Does Freeradius proxy setup has option to specify which Radius server to pickup based on some attribute value in Access Request?
Yes. See raddb/proxy.conf
Our requirement is to have multiple Radius Servers for certain groups. This group information will be available in one of the VSA in Access Request.
That will work. Alan DeKok.
Hi Alan, I have set it up Freeradius as proxy with JRadius plugin. I'm using JRadius to modify the Access_Accept packets. With my setup I'm able to receive the radius packets through JRadius plugin during post-auth. In JRadius I have a handler to modify the Access_Accept and it is working fine. Now I need a help in setting up various sets of Radius servers in proxy.conf based on some VSA value in Access_Request. The requirement is to redirect the requests to appropriate Radius servers based on the VSA value. What I can understand from the proxy.conf is to define various home_servers and home_server pool linked to a realm. Now I'm not sure how to link the VSA value in Access_Request to these home_servers. Could you please provide some example to achieve my above requirement. Thanks, Ila. On Fri, Mar 21, 2014 at 5:53 AM, Alan DeKok <aland@deployingradius.com>wrote:
Ilavajuthy Palanisamy wrote:
I'm new to Freeradius. I would like to get some pointers and documentation details about setting up Freeradius as proxy.
raddb/proxy.conf.
Our requirement is to have a Radius proxy and modify the Access Accept response based on certain criteria.
raddb/sites-available/default. Look for the "post-proxy" section.
Few questions regarding Freeradius proxy support. Does Freeradius proxy has support for a plugin probably in Java to snoop the Radius request calls?
No. If you want to snoop on radius packets, use pcap. If you want to look at what the server is doing, use "radiusd -X". If you want to modify the servers behavior, use "unlang".
Does Freeradius proxy setup has option to specify which Radius server to pickup based on some attribute value in Access Request?
Yes. See raddb/proxy.conf
Our requirement is to have multiple Radius Servers for certain groups. This group information will be available in one of the VSA in Access Request.
That will work.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ilavajuthy Palanisamy wrote:
Now I need a help in setting up various sets of Radius servers in proxy.conf based on some VSA value in Access_Request. The requirement is to redirect the requests to appropriate Radius servers based on the VSA value.
You can manually force proxying via the Proxy-To-Realm attribute. In "unlang": update control { Proxy-To-Realm := "realm-name" } Alan DeKok.
Hi Alan, I have set the below configuration in proxy.conf and it is not working. I need help in fixing it. home_server ssid_700 { type = auth ipaddr = 16.108.158.172 port = 1812 secret = testing123 require_message_authenticator = yes response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 coa { # Initial retransmit interval: 1..5 irt = 2 # Maximum Retransmit Timeout: 1..30 (0 == no maximum) mrt = 16 # Maximum Retransmit Count: 1..20 (0 == retransmit forever) mrc = 5 # Maximum Retransmit Duration: 5..60 mrd = 30 } } home_server_pool ssid_700_pool { type = fail-over home_server = ssid_700 } realm ssid_700_realm { auth_pool = ssid_700_pool nostrip } if ( Colubris-AVPair == "ssid=uww_700" ) { update control { Proxy-To_Realm := "ssid_700_realm" } } #realm NULL { # authhost = radius.company.com:1600 # accthost = radius.company.com:1601 # secret = testing123 #} # # This realm is for ALL OTHER requests. # #realm DEFAULT { # authhost = radius.company.com:1600 # accthost = radius.company.com:1601 # secret = testing123 #} With the above configuration, it is not entering the if condition (unlang). Below is the debug log. It say there is no @ with the user and looking up realm NULL. I have commented out the realm NULL and realm DEFAULT. rad_recv: Access-Request packet from host 16.108.159.73 port 56904, id=180, length=233 Acct-Session-Id = "084a02e6" NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "t" Calling-Station-Id = "38-AA-3C-8B-23-2D" Called-Station-Id = "D8-9D-67-41-59-20" EAP-Message = 0x020100060319 State = 0x07f1ce5e07f0caa193a06ec11ba58fe2 NAS-Identifier = "SG3413P2DH" NAS-IP-Address = 16.108.159.73 Framed-MTU = 1496 Connect-Info = "IEEE802.1X" Framed-Protocol = PPP Service-Type = Framed-User Colubris-AVPair = "ssid=uww_700" Colubris-AVPair = "group=Default Group" Colubris-AVPair = "vsc-unique-id=3" Message-Authenticator = 0xd653b1d0f1fa3ea4dcb3f01de9eb2c5b # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "t", looking up realm NULL [suffix] No such realm "NULL" What configuration change that i have to do to make it working? I need to have a home server pool for each of the ssid. I need to do below kind of setup; if ( Colubris-AVPair == "ssid=uww_700" ) { //use home_server_pool = ssid_700_pool } if ( Colubris-AVPair == "ssid=uww_800" ) { //use home_server_pool = ssid_800_pool } Also need to know where the unlang (the if condition) needs to be specified? Does it needs to be specified inside any block? Thanks, Ila. On Mon, Apr 7, 2014 at 2:05 PM, Alan DeKok <aland@deployingradius.com>wrote:
Ilavajuthy Palanisamy wrote:
Now I need a help in setting up various sets of Radius servers in proxy.conf based on some VSA value in Access_Request. The requirement is to redirect the requests to appropriate Radius servers based on the VSA value.
You can manually force proxying via the Proxy-To-Realm attribute. In "unlang":
update control { Proxy-To-Realm := "realm-name" }
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mon, Apr 14, 2014 at 10:02:20PM -0700, Ilavajuthy Palanisamy wrote:
rad_recv: Access-Request packet from host 16.108.159.73 port 56904, id=180, length=233
...
Colubris-AVPair = "ssid=uww_700" Colubris-AVPair = "group=Default Group" Colubris-AVPair = "vsc-unique-id=3" ... ++[digest] = noop [suffix] No '@' in User-Name = "t", looking up realm NULL [suffix] No such realm "NULL" ...
What's the rest of the debug output (i.e. the important bit)? You're not using the suffix module now, so the output from it is irrelevant.
What configuration change that i have to do to make it working? I need to have a home server pool for each of the ssid. I need to do below kind of setup;
My guess is the problem is because there are multiple Colubris-AVPair attributes, but without the debug output it's hard to tell.
Also need to know where the unlang (the if condition) needs to be specified? Does it needs to be specified inside any block?
In the authorize section, probably after (or instead of) the 'suffix' line. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi Matthew, As suggested by you, I added the unlang section in sites-available/default under authorize section and corrected the spelling in Proxy-To-Realm (thanks to Josip Almasi). With this change it is picking up the correct radius server based on ssid. Thanks for your input. Thanks, Ila. On Tue, Apr 15, 2014 at 2:57 AM, Matthew Newton <mcn4@leicester.ac.uk>wrote:
On Mon, Apr 14, 2014 at 10:02:20PM -0700, Ilavajuthy Palanisamy wrote:
rad_recv: Access-Request packet from host 16.108.159.73 port 56904,
id=180,
length=233 ... Colubris-AVPair = "ssid=uww_700" Colubris-AVPair = "group=Default Group" Colubris-AVPair = "vsc-unique-id=3" ... ++[digest] = noop [suffix] No '@' in User-Name = "t", looking up realm NULL [suffix] No such realm "NULL" ...
What's the rest of the debug output (i.e. the important bit)?
You're not using the suffix module now, so the output from it is irrelevant.
What configuration change that i have to do to make it working? I need to have a home server pool for each of the ssid. I need to do below kind of setup;
My guess is the problem is because there are multiple Colubris-AVPair attributes, but without the debug output it's hard to tell.
Also need to know where the unlang (the if condition) needs to be specified? Does it needs to be specified inside any block?
In the authorize section, probably after (or instead of) the 'suffix' line.
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 04/15/2014 07:02 AM, Ilavajuthy Palanisamy wrote:
Hi Alan,
I have set the below configuration in proxy.conf and it is not working. I need help in fixing it. ... if ( Colubris-AVPair == "ssid=uww_700" ) { update control { Proxy-To_Realm := "ssid_700_realm" } }
Proxy-To-Realm :) Regards...
Hi Josip, Thanks for pointing out the spelling. I corrected it and and based on suggestion from Matthew, I was able to setup my proxy server. Thanks, Ila. On Tue, Apr 15, 2014 at 3:54 AM, Josip Almasi <joe@vrspace.org> wrote:
On 04/15/2014 07:02 AM, Ilavajuthy Palanisamy wrote:
Hi Alan,
I have set the below configuration in proxy.conf and it is not working. I need help in fixing it.
...
if ( Colubris-AVPair == "ssid=uww_700" ) {
update control { Proxy-To_Realm := "ssid_700_realm" } }
Proxy-To-Realm :)
Regards...
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
participants (4)
-
Alan DeKok -
Ilavajuthy Palanisamy -
Josip Almasi -
Matthew Newton