Accounting Cisco VSA attributes
Hi I'm using FreeRadius (0.9.3) with our Cisco wireless APs, and I'd like to save the SSID as part of the accounting record. It comes in as a Cisco-AVPair, as in the log below, so I've turned on cisco_vsa_hack. Because the attribute comes in as Cisco-AVPair = "ssid=name" I'm expecting to get a new attribute named "ssid". However, the preprocess module returns "noop" and the database field ends up blank, so I've got something wrong somewhere. I'd appreciate any assistance. I added this line to "dictionary.cisco" (99 wasn't used elsewhere): ATTRIBUTE ssid 99 string Cisco This is my accounting config: # Pre-accounting. Look for proxy realm in order of realms, then # acct_users file, then preprocess (hints file). preacct { acct_username preprocess suffix files } # Accounting. accounting { sql } And here's the log ("..." where edited): Script started on Thu Mar 09 12:32:16 2006 ccuh# /usr/local/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = yes Module: Instantiated preprocess (preprocess) Module: Loaded SQL ... sql: accounting_start_query = "INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, SSID) values('', '%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', '%{ssid}')" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime = 0" ... rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 ... Listening on IP address *, ports 1812/udp and 1813/udp. Ready to process requests. rad_recv: Accounting-Request packet from host 172.25.5.2:21654, id=108, length=332 Acct-Session-Id = "00025FB0" Called-Station-Id = "000d.6548.7960" Calling-Station-Id = "000f.6678.bd74" Cisco-AVPair = "ssid=wolfradiolan" Cisco-AVPair = "nas-location=unspecified" Cisco-AVPair = "vlan-id=37" Cisco-AVPair = "auth-algo-type=mac-address" Cisco-AVPair = "connect-progress=Call Up" Acct-Session-Time = 4273 Acct-Input-Octets = 2494074 Acct-Output-Octets = 25941153 Acct-Input-Packets = 18889 Acct-Output-Packets = 23258 Acct-Terminate-Cause = Lost-Carrier Cisco-AVPair = "disc-cause-ext=No Reason" User-Name = "000f6678bd74" Acct-Status-Type = Stop NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "403" NAS-Port = 403 Service-Type = Framed-User NAS-IP-Address = 172.25.5.2 Acct-Delay-Time = 0 modcall: entering group preacct for request 0 radius_xlat: '\.' rlm_attr_rewrite: No match found for attribute User-Name with value '000f6678bd74' modcall[preacct]: module "acct_username" returns ok for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_realm: No '@' in User-Name = "000f6678bd74", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 0 modcall[preacct]: module "files" returns noop for request 0 modcall: group preacct returns ok for request 0 modcall: entering group accounting for request 0 radius_xlat: '000f6678bd74' rlm_sql (sql): sql_set_user escaped user --> '000f6678bd74' radius_xlat: 'UPDATE radacct SET AcctStopTime = '2006-03-09 12:32:20', AcctSessionTime = '4273', AcctInputOctets = '2494074', AcctOutputOctets = '25941153', AcctTerminateCause = 'Lost-Carrier', AcctStopDelay = '0', ConnectInfo_stop = '' WHERE AcctSessionId = '00025FB0' AND UserName = '000f6678bd74' AND NASIPAddress = '172.25.5.2' AND AcctStopTime = 0' rlm_sql (sql): Reserving sql socket id: 31 rlm_sql (sql): Released sql socket id: 31 modcall[accounting]: module "sql" returns ok for request 0 modcall: group accounting returns ok for request 0 Sending Accounting-Response of id 108 to 172.25.5.2:21654 Finished request 0 ---------------------------------------- Max Caines IT Services, University of Wolverhampton Wolverhampton, West Midlands WV1 1SB Tel: 01902 322245 Fax: 01902 322699
"Caines, Max" <Max.Caines@wlv.ac.uk> wrote:
I'm using FreeRadius (0.9.3)
Oh dear, you *really* should upgrade. See http://www.freeradius.org/security.html. As for the rest of your message, I recall issues with cisco_vsa_hack in older versions of the server. Maybe a newer version works better. Alan DeKok.
participants (2)
-
Alan DeKok -
Caines, Max