add attribute when proxying
Hello, I have setup made according to robust proxy accounting guide. Now I need freeradius to add Tmp-String-1 attribute to each Access-Request sent to proxy. I tried using policy conf and ulang in robust-proxy-accounting config, but request sent to proxy is still unmodified One of log examples (just for curiosity i'm trying update both - proxy-request and request: (0) server home.mycompany.com { (0) # Executing section pre-proxy from file /etc/freeradius/sites-enabled/robust-proxy-accounting (0) pre-proxy { (0) policy add-attribute { (0) update request { (0) Tmp-String-1 := 1111111 (0) } # update request = noop (0) update proxy-request { (0) Tmp-String-1 := 1111111 (0) } # update proxy-request = noop (0) } # policy add-attribute = noop (0) policy debug_proxy_request { (0) if ("%{debug_attr:proxy-request:}" == '') { (0) Attributes matching "proxy-request:" (0) &proxy-request:User-Name = username (0) &proxy-request:User-Password = password (0) &proxy-request:NAS-Identifier = nasid (0) &proxy-request:Framed-Protocol = PPP (0) &proxy-request:Service-Type = Framed-User (0) &proxy-request:Event-Timestamp = Jun 29 2017 13:51:01 UTC (0) &proxy-request:NAS-IP-Address = 185.7.90.32 (0) &proxy-request:Message-Authenticator := 0x00 (0) &proxy-request:Proxy-State = 0x313636 (0) &proxy-request:Tmp-String-1 := 1111111 (0) EXPAND %{debug_attr:proxy-request:} (0) --> (0) if ("%{debug_attr:proxy-request:}" == '') -> TRUE (0) if ("%{debug_attr:proxy-request:}" == '') { (0) [noop] = noop (0) } # if ("%{debug_attr:proxy-request:}" == '') = noop (0) } # policy debug_proxy_request = noop (0) } # pre-proxy = noop (0) } (0) Proxying request to home server 138.7.90.9 port 1812 timeout 30.000000 (0) Sent Access-Request Id 19 from 0.0.0.0:30848 to 138.7.90.9:1812 length 101 (0) User-Name = "username" (0) User-Password = "password" (0) NAS-Identifier = "nasid" (0) Framed-Protocol = PPP (0) Service-Type = Framed-User (0) Event-Timestamp = "Jun 29 2017 13:51:01 UTC" (0) NAS-IP-Address = 185.7.90.32 (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x313636 Waking up in 0.3 seconds. As you see proxied request is unchaged, while debug output above states attribute was added. For example if in same way I modify existing attribute - this will work fine, i.e Framed-Protocol will be sent to proxy with value I set. update proxy-request { Framed-Protocol := 11111 } But I need new attr added, and now I'm completely out of ideas how to achieve this. Already read lots of mailing archives, unlang doc and etc - still do not understand how attribute can be added. So if someone has any idea - please point me to correct doc/direction. freeradius 3.0.12 -- Denis
On Jun 29, 2017, at 10:34 AM, denis <den.zinevich@gmail.com> wrote:
I have setup made according to robust proxy accounting guide. Now I need freeradius to add Tmp-String-1 attribute to each Access-Request sent to proxy.
No. The "Tmp-" variables are internal to the server, and *cannot* be sent in a packet. You need to use a standard attribute, or a Vendor-Specific one. And, the home server has to already understand the attribute you're sending. You can't just invent an attribute, send it to the home server, and expect the home server to do something with it. Instead of asking why your solution doesn't work, you should describe the problem. There is usually another solution which works better. i.e. What data are you sending to the home server? Why? What will the home server do with that data? Alan DeKok.
Thanks for info, as it usually happens in life - figured out just after asking. Attributes 1000-1199 are never sent, was not obvious though... Just for experiment I picked random (and unused in my case) +/- suitable attr from rfc list - Connect-Info, and it worked fine. I know that I can't invent attr, it must be in dictionary, this is clear from docs. It took time to understand why Tmp-String is not sent. Business case itself if: I have lots of servers configured exactly same way, they run vpn daemons, which in turn use radius. each of that servers has property - "premium" which defines if client can or can't connect to specific server So my idea is to pass 1/0 flag in any suitable attribute, and home/main freeradius server in turn will pass that to script which performs auth, this way main server will know to which one user is connecting.
On Jun 29, 2017, at 11:33 AM, denis <den.zinevich@gmail.com> wrote:
Thanks for info, as it usually happens in life - figured out just after asking. Attributes 1000-1199 are never sent, was not obvious though...
Those limitations are part of the RADIUS protocol, not FreeRADIUS. The general idea is to send attributes the other end understands, in which case the attributes are already defined.
Just for experiment I picked random (and unused in my case) +/- suitable attr from rfc list - Connect-Info, and it worked fine. I know that I can't invent attr, it must be in dictionary, this is clear from docs. It took time to understand why Tmp-String is not sent.
If it works for you...
Business case itself if: I have lots of servers configured exactly same way, they run vpn daemons, which in turn use radius. each of that servers has property - "premium" which defines if client can or can't connect to specific server So my idea is to pass 1/0 flag in any suitable attribute, and home/main freeradius server in turn will pass that to script which performs auth, this way main server will know to which one user is connecting.
If it's a site-local attribute, you can create vendor-specific attributes. That's what those are for. Alan DeKok.
participants (2)
-
Alan DeKok -
denis