Hi there, It seems this only affects replies from the Home Server going to my NAS. " # attr_filter - filters the attributes received in replies from # proxied servers, to make sure we send back to our RADIUS client # only allowed attributes. attr_filter { attrsfile = ${confdir}/attrs } " I want to filter extra attributes sent from the NAS to the Home Server basically. Thanks, Mike Ivan Kalik wrote:

It does tend to filter attributes when you use attribute filter ;-)

http://freeradius.org/radiusd/man/rlm_attr_filter.html

http://wiki.freeradius.org/Attrs

Ivan Kalik Kalik Informatika ISP

Dana 7/7/2008, "Michael da Silva Pereira" <michael@tradepage.co.za> piše:

...

Hi All,

I am wondering if anybody has done this, I'm sure it's actually very easy to do, But I'm just not able to get it done :(

I need to filter requests coming from my NAS going to my radius server being forwarded to a clients radius server. Now I am able to modify and update attributes, even add using preproxy_users. but how on earth do I drop the attribute completely?

Currently in preproxy_users: DEFAULT Realm == "testrealm.com" NAS-IP-Address := 196.3.121.32, User-Name =* ANY, User-Password =* ANY

Other server still recieves: 3GPP2-Correlation-Id Calling-Station-Id Framed-Protocol User-Name User-Password Service-Type NAS-IP-Address NAS-Identifier Proxy-State User-Password Client-IP-Address

Kind regards, Michael da silva Pereira - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Ok this is for anybody else out there having the same question I have regarding this. There is no clear way to separate between which requests (from or to home servers/post-proxy or pre-proxy). So I tried this with success: Add this to the radiusd.conf, I added this under the "attr_filter {" line, which is part of the "Modules" section in the config file. attr_filter preproxy_attrfilter { attrsfile = ${confdir}/preproxy_attrfilter } Then under the pre-proxy section before the "files" line add a line "preproxy_attrfilter", Or before any custom auth stuff you have in there. (example:) pre-proxy { preproxy_attrfilter files pre_proxy_log } Then add the filters into the file preproxy_attrfilter in /etc/freeradius or whatever your config directory is called. example: REALM-HERE.com NAS-IP-Address := xx.xx.xx.xx, User-Name =* ANY, User-Password =* ANY, Calling-Station-Id =* ANY Thanks, Mike Ivan Kalik wrote:

Because the example is for one in post-proxy section. Try reading again:

http://freeradius.org/radiusd/man/rlm_attr_filter.html

Ivan Kalik Kalik Informatika ISP

Dana 7/7/2008, "Michael da Silva Pereira" <michael@tradepage.co.za> piše:

...

Hi there,

It seems this only affects replies from the Home Server going to my NAS. " # attr_filter - filters the attributes received in replies from # proxied servers, to make sure we send back to our RADIUS client # only allowed attributes. attr_filter { attrsfile = ${confdir}/attrs } "

I want to filter extra attributes sent from the NAS to the Home Server basically.

Thanks, Mike

Ivan Kalik wrote:

...

It does tend to filter attributes when you use attribute filter ;-)

http://freeradius.org/radiusd/man/rlm_attr_filter.html

http://wiki.freeradius.org/Attrs

Ivan Kalik Kalik Informatika ISP

Dana 7/7/2008, "Michael da Silva Pereira" <michael@tradepage.co.za> piše:

...

Hi All,

I am wondering if anybody has done this, I'm sure it's actually very easy to do, But I'm just not able to get it done :(

I need to filter requests coming from my NAS going to my radius server being forwarded to a clients radius server. Now I am able to modify and update attributes, even add using preproxy_users. but how on earth do I drop the attribute completely?

Currently in preproxy_users: DEFAULT Realm == "testrealm.com" NAS-IP-Address := 196.3.121.32, User-Name =* ANY, User-Password =* ANY

Other server still recieves: 3GPP2-Correlation-Id Calling-Station-Id Framed-Protocol User-Name User-Password Service-Type NAS-IP-Address NAS-Identifier Proxy-State User-Password Client-IP-Address

Kind regards, Michael da silva Pereira - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/usershtml

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

It is interesting you say that this stuff is already included, I do not see it in the prepackage version which comes with Ubuntu (hardy). http://packages.ubuntu.com/hardy/i386/freeradius/filelist But I think this is something the maintainers for Ubuntu must update / incorporate Checking the docs on non-ubuntu packages I see the sample files, erf. Alan DeKok wrote:

Michael da Silva Pereira wrote:

...

There is no clear way to separate between which requests (from or to home servers/post-proxy or pre-proxy).

Huh? What do you mean by that?

The pre-proxy section is processed before the request is sent to the home server. The post-proxy section is processed when the reply is received from the home server.

This is documented.

...

So I tried this with success:

Add this to the radiusd.conf, I added this under the "attr_filter {" line, which is part of the "Modules" section in the config file. attr_filter preproxy_attrfilter { attrsfile = ${confdir}/preproxy_attrfilter }

There's already a sample pre-proxy configuration for the attrfilter module. Why is it necessary to create another one?

...

Then under the pre-proxy section before the "files" line add a line "preproxy_attrfilter", Or before any custom auth stuff you have in there. (example:) pre-proxy { preproxy_attrfilter

There's already a sample pre-proxy configuration for the attrfilter module in the "pre-proxy" section. Why is it necessary to create another one?

...

Then add the filters into the file preproxy_attrfilter in /etc/freeradius or whatever your config directory is called.

There's already a file raddb/attrs.preproxy. Why is it necessary to create another one?

Is there something about the existing documentation that isn't sufficient?

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Yes it does :( Looks like the new Hardy is still coming out with 1.1.7 :( Upgrade time :/ Thanks for the help Mike Alan DeKok wrote:

Michael da Silva Pereira wrote:

...

It is interesting you say that this stuff is already included, I do not see it in the prepackage version which comes with Ubuntu (hardy).

http://packages.ubuntu.com/hardy/i386/freeradius/filelist

That's version 1.1.7. Version 2.0 has been out for over 6 months. Ubuntu settled on 1.1.7 because it was the last version available when they froze the feature set last November.

If 8.10 still uses 1.1.7, I'll be most upset.

You *really* should upgrade.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html