Good day Freeradius users, I am trying to use the rlm_python module to do additional actions after an user has been authenticated. To learn, I'm using the radiusd_test.py which is in the python path. I haven't found an indication that says it is impossible to do, correct me if I'm wrong off-course. I did the following ( by the way, i made sure rlm_python was compiled with the server ) : Created a python module under "modules" : python {
mod_instantiate = radiusd_test func_instantiate = instantiate
mod_authorize = radiusd_test func_authorize = authorize
mod_accounting = radiusd_test func_accounting = accounting
mod_preproxy = radiusd_test func_preproxy = preproxy
mod_postproxy = radiusd_test func_postproxy = postproxy
mod_postauth = radiusd_test func_postauth = postauth
mod_detach = radiusd_test func_detach = detach }
Added "python" in the site-enabled/default "post-auth" section Now, in the radiusd -X log, I can see the following : Module: Instantiating python
python_init done python { mod_instantiate = "radiusd_test" func_instantiate = "instantiate" mod_authorize = "radiusd_test" func_authorize = "authorize" mod_accounting = "radiusd_test" func_accounting = "accounting" mod_detach = "radiusd_test" func_detach = "detach" } *** instantiate ***
*Ok, i'm missing the postauth, why ?* The radiusd_test.py file has a postauth function which I think should be linked by my python modules declaration. Finnaly, in the log, I have the following : /usr/local/etc/raddb/sites-enabled/default[422]: "python" modules aren't
allowed in 'post-auth' sections -- they have no such method. /usr/local/etc/raddb/sites-enabled/default[380]: Errors parsing post-auth section.
Is this caused because I can't use python modules in post-auth sections, or I can't use THAT python module because it is missing the post-auth method ? Feel free to point me in the right documentation section that I MUST have missed. -- Philippe-Alexandre Lemelin
phil lemelin wrote:
/usr/local/etc/raddb/sites-enabled/default[422]: "python" modules aren't allowed in 'post-auth' sections -- they have no such method. /usr/local/etc/raddb/sites-enabled/default[380]: Errors parsing post-auth section.
Is this caused because I can't use python modules in post-auth sections, or I can't use THAT python module because it is missing the post-auth method ?
It's because you're using an old version of the server. i.e. 1.x, not 2.x.
Feel free to point me in the right documentation section that I MUST have missed.
Feel free to submit documentation for a recent version of the server. The reason many responses here say "this IS documented" is because the common issues *are* documented. The uncommon issues often aren't. Alan DeKok.
Alan Buxey wrote:
Hi,
It's because you're using an old version of the server. i.e. 1.x, not 2.x.
sites-enabled/default etc in 1.1.x? I cant recall seeing that config :-)
The post-auth section has been in rlm_python for a long time. Whether it's 1.x, or 2.0.x, or a 8 month-old version of 2.1.x, is less relevant. Alan DeKok.
Hi,
Created a python module under "modules" :
so long as you are using FR 2.1.x then you shouldnt need to do that - just simply edit experimental.conf to make sure the python stuff is active and then edit radiusd.conf to make sure that experimental.conf is included (you did compile FR with experimental modules enabled?) then you should be able to call python in the postauth section alan
Gents, so long as you are using FR 2.1.x then you shouldnt
need to do that - just simply edit experimental.conf to make sure the python stuff is active and then edit radiusd.conf to make sure that experimental.conf is included (you did compile FR with experimental modules enabled?)
then you should be able to call python in the postauth section
I'm running FR 2.1.4. My configure was :
./configure --with-experimental-modules
I deleted my python under modules. I did, in the radiusd.conf file :
$INCLUDE experimental.conf
I can see the following line in the log :
including configuration file /usr/local/etc/raddb/experimental.conf
And I left it has it was, so in it, I have :
python { mod_instantiate = radiusd_test func_instantiate = instantiate
mod_authorize = radiusd_test func_authorize = authorize
mod_accounting = radiusd_test func_accounting = accounting
mod_preproxy = radiusd_test func_preproxy = preproxy
mod_postproxy = radiusd_test func_postproxy = postproxy
mod_postauth = radiusd_test func_postauth = postauth
mod_detach = radiusd_test func_detach = detach }
Now, I restarted the server and I have the following. Note that to make sure I was in the right section, I added the following lines in the "post-auth" section of the "site-enabled/default" file : The echo_NAS_Info is a test I made copying the echo module under the "modules" folder
echo_NAS_Info python
The result : Module: Checking post-auth {...} for more modules to load
Module: Instantiating echo_NAS_Info exec echo_NAS_Info { wait = yes program = "/bin/echo %{User-Name}, %{NAS-IP-Address}, %{NAS-Port} " input_pairs = "request" output_pairs = "reply" shell_escape = yes } /usr/local/etc/raddb/sites-enabled/default[422]: Failed to find module "python". /usr/local/etc/raddb/sites-enabled/default[380]: Errors parsing post-auth section. }
Now it looks like I have a configuration error and not a python module error. Do I have to add more than I replaced python with example in the default file and I have the same result for "example" I verified my /usr/local/lib/ and I have the : rlm_example* files rlm_python* files Seeing that echo_NAS_Info loads, i suspect there is something else that has to be done in order to activate de experimental modules/config. When you say, simply edit experimental.conf, should I change something in it, or by default it should be ok ? The only thing I did is modifiy the radiusd.conf file to add the include line. The python section of the experimental.conf file is uncommented by default. -- Philippe-Alexandre Lemelin
Hi,
I'm running FR 2.1.4.
hmm, i've had a quick skim through the code and it looks like pre 2.1.7 didnt have some of the hooks etc needed to be run in that section - why play with older version - give 2.1.7 a go...if you're compiling from source you may as well run the latest /best version alan
Alan, Thank you for you time. I downloaded, compiled and installed the 2.1.7 version. I replaced my /usr/local/raddb folder by the 2.1.7 raddb folder and used that to make sure my config didnt conflict. I only modified radiusd.conf to add experimental.conf and added "python" in the post-auth section of site-enabled/default [root@someserver freeradius-server-2.1.7]# /usr/local/sbin/radiusd -X
FreeRADIUS Version 2.1.7, for host x86_64-unknown-linux-gnu, built on Oct 21 2009 at 15:24:29
--*snip*--
including configuration file /usr/local/etc/raddb/experimental.conf
--*snip*--
Module: Checking post-auth {...} for more modules to load Module: Instantiating echo_NAS_Info exec echo_NAS_Info { wait = yes program = "/bin/echo %{User-Name}, %{NAS-IP-Address}, %{NAS-Port} " input_pairs = "request" output_pairs = "reply" shell_escape = yes } /usr/local/etc/raddb/sites-enabled/default[423]: Failed to find module "python". /usr/local/etc/raddb/sites-enabled/default[380]: Errors parsing post-auth section.
Is there anything else I should do ? -- Philippe-Alexandre Lemelin
I went back to creating a python module in the modules folder and the post-auth is now working. There is something missing in the experimental.conf to have it work with that method. I prefer creating a python module anyway. Looks like there is a bug in 2.1.4 and rlm_python where the post-auth cannot work. The key for me here was to update to 2.1.7 Thank you. On Wed, Oct 21, 2009 at 3:37 PM, phil lemelin <phil.lemelin@gmail.com>wrote:
Alan,
Thank you for you time. I downloaded, compiled and installed the 2.1.7 version. I replaced my /usr/local/raddb folder by the 2.1.7 raddb folder and used that to make sure my config didnt conflict. I only modified radiusd.conf to add experimental.conf and added "python" in the post-auth section of site-enabled/default
[root@someserver freeradius-server-2.1.7]# /usr/local/sbin/radiusd -X
FreeRADIUS Version 2.1.7, for host x86_64-unknown-linux-gnu, built on Oct 21 2009 at 15:24:29
--*snip*--
including configuration file /usr/local/etc/raddb/experimental.conf
--*snip*--
Module: Checking post-auth {...} for more modules to load Module: Instantiating echo_NAS_Info exec echo_NAS_Info { wait = yes program = "/bin/echo %{User-Name}, %{NAS-IP-Address}, %{NAS-Port} " input_pairs = "request" output_pairs = "reply" shell_escape = yes } /usr/local/etc/raddb/sites-enabled/default[423]: Failed to find module "python". /usr/local/etc/raddb/sites-enabled/default[380]: Errors parsing post-auth section.
Is there anything else I should do ?
-- Philippe-Alexandre Lemelin
-- Philippe-Alexandre Lemelin
participants (3)
-
Alan Buxey -
Alan DeKok -
phil lemelin