Hello... I am new to freeradius and I am hoping someone can give me some help with a little project. The architecture is as follows: RADIUS SERVER -----------------freeRadius-----------------Radius client The radius client is sending Authentications and accounting requests to freeRadius. For Authentication, the freeRadius must receive the access_requests, add a couple of AVPs to it, and then send it to the RADIUS SERVER, this server will respond with either accept/reject and the freeRadius must forward that to the client. Once authentication is done, the Radius client will start sending accounting messages to freeRadius. The freeRadius must count the number of octets sent and received (information which is inside the accounting message) and once a certain number of packets are reached it should trigger and access_reject to the Radius client. I this possible with freeRadius? I would appreciate some help on this. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radius-proxy-implementation-tp436623... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On Tue, May 3, 2011 at 9:45 AM, doqb@hotmail.com <doqb@hotmail.com> wrote:
Hello...
I am new to freeradius and I am hoping someone can give me some help with a little project. The architecture is as follows:
RADIUS SERVER -----------------freeRadius-----------------Radius client
The radius client is sending Authentications and accounting requests to freeRadius.
For Authentication, the freeRadius must receive the access_requests, add a couple of AVPs to it, and then send it to the RADIUS SERVER,
It should be possible using pre_proxy section. See sites-available/default. You could also use unlang there.
this server will respond with either accept/reject and the freeRadius must forward that to the client.
Once authentication is done, the Radius client will start sending accounting messages to freeRadius. The freeRadius must count the number of octets sent and received (information which is inside the accounting message) and once a certain number of packets are reached it should trigger and access_reject to the Radius client.
I don't think this one is possible. What might be possible: - store accounting info in sql - use the information from sql to filter access-request packets in pre-proxy and post-proxy sections. You should be able to add some reply items (like Session-Timeout), or reject it when the user exceeds quota -- Fajar
Thanks for your quick reply... In order to store the accounting information, do I need to execute an external script? With my little knowledge of freeRadius at the moment, I have a vague idea on how to forward the packets, but I have no clue yet on how to do the mysql part you mentioned. Could you please elaborate a bit more. Thanks! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radius-proxy-implementation-tp436623... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On Tue, May 3, 2011 at 10:08 AM, doqb@hotmail.com <doqb@hotmail.com> wrote:
Thanks for your quick reply...
In order to store the accounting information, do I need to execute an external script?
No
With my little knowledge of freeRadius at the moment, I have a vague idea on how to forward the packets, but I have no clue yet on how to do the mysql part you mentioned.
Could you please elaborate a bit more.
Start by reading proxy.conf. You should be able to select what packets to proxy. From what you wrote, I think you only need to proxy auth packets, while processing acct packets locally. Then read sites-available/default Then read sql.conf and sql/mysql/* , as well as doc/rlm_mysql Then read http://freeradius.org/radiusd/man/unlang.html -- Fajar
Hello Fajar... After some struggle I setup a proper environment to test your suggestions. I am able to proxy the access_request to the radius server now. Using the pre-proxy I also added the AVPs that I need to send to the server. I have two questions now: 1. On the access request I see all AVPs there, but I might need to change the order in which they are presented on the packet (I am checking the packet using wireshark). Is that possible? 2. I added one particular AVP called "3GPP2-Prepaid-acct-Capability" and I set it to the value of 010600000003, but on wireshark I see every digit is padded with "3" in front: 3GPP2_Prepaid_acct_Capability: 303130363030303030303033 Is there any way to remove the padding? Regards, Diego -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radius-proxy-implementation-tp436623... Sent from the FreeRadius - User mailing list archive at Nabble.com.
doqb@hotmail.com wrote:
1. On the access request I see all AVPs there, but I might need to change the order in which they are presented on the packet (I am checking the packet using wireshark). Is that possible?
No. The specifications MANDATE that the order of attributes is unimportant.
2. I added one particular AVP called "3GPP2-Prepaid-acct-Capability" and I set it to the value of 010600000003, but on wireshark I see every digit is padded with "3" in front:
3GPP2_Prepaid_acct_Capability: 303130363030303030303033
Is there any way to remove the padding?
Youv'e set it to a *string* value. If you want to send it as raw bytes, use: 3GPP2_Prepaid_acct_Capability = 0x010600000003 See "man unlang". This is documented. Alan DeKok.
Hello... Nice!, I got the proxy part working now. The client is also sending accounting information and I can see teh accounting info on mysql (radacct table). Now, what I still need to do is to monitor the packets sent/received by users, when the amount of packets reaches a certain level I then need to make the FREERADIUS server to send another ACCESS_REQUEST to the radius server, but this time with a "service type = authorize only". Is that possible by monitoring the radacct table? Regards, Diego -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radius-proxy-implementation-tp436623... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hello... I was able to overcome a lot of stoppers but I still need some help. SERVER------------freeRadius-------------client the freeradius is proxying authentication messages to the SERVER, after authenticated, the client is doing accounting to freeRadius and packet counts are stored in mysql on the freeRadius. when a certain volumen of packets is reched, I need the freeRadius to send an Authentication request to the SERVER, is that possible? I was trying to run a radclient instance on the accounting section of the freeRadius in order to compose this message, but I cannot run the radclient in unlang for some reason. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radius-proxy-implementation-tp436623... Sent from the FreeRadius - User mailing list archive at Nabble.com.
doqb@hotmail.com wrote:
when a certain volumen of packets is reched, I need the freeRadius to send an Authentication request to the SERVER, is that possible?
Sure. Keep track of packets in a DB.
I was trying to run a radclient instance on the accounting section of the freeRadius in order to compose this message, but I cannot run the radclient in unlang for some reason.
Don't run radclient from the RADIUS server. The RADIUS server can send RADIUS packets. Hint: It's a RADIUS server. Alan DeKok.
participants (3)
-
Alan DeKok -
doqb＠hotmail.com -
Fajar A. Nugraha