Hi good people, I have a question in regards to proxying my Auth & Accounting logs but not for all. I can use proxy module but looks like that only works for realm but I wanted to proxy only some of the user's record. I am already using rlm_perl module for custom stuff. Is there anyway I can add the proxy thing in my perl script? Thank you. -- Regards, Jehanzaib
On Sep 30, 2018, at 9:59 PM, J E H A N Z A I B <jehanzaib.kiani@gmail.com> wrote:
I have a question in regards to proxying my Auth & Accounting logs but not for all. I can use proxy module but looks like that only works for realm
What does that mean? The realm module is there only for realm proxying. You can proxy on any reason whatsoever.
but I wanted to proxy only some of the user's record. I am already using rlm_perl module for custom stuff. Is there anyway I can add the proxy thing in my perl script?
Set Proxy-To-Realm = "realm", and it will proxy the packet to that realm. That's all the realm module does. Alan DeKok.
Thanks Alan. Looks like i am failed to explain my requirements. Let me put in this way. I wanted to send the Auth & Accouting request to another radius server. I pick the user the user in the rlm_perl script and that specific user should the requests to external radius server. Can you please suggest how this can be done using my perl script please? Thank you On Tue, Oct 2, 2018 at 12:15 AM Alan DeKok <aland@deployingradius.com> wrote:
On Sep 30, 2018, at 9:59 PM, J E H A N Z A I B <jehanzaib.kiani@gmail.com> wrote:
I have a question in regards to proxying my Auth & Accounting logs but not for all. I can use proxy module but looks like that only works for realm
What does that mean?
The realm module is there only for realm proxying. You can proxy on any reason whatsoever.
but I wanted to proxy only some of the user's record. I am already using rlm_perl module for custom stuff. Is there anyway I can add the proxy thing in my perl script?
Set Proxy-To-Realm = "realm", and it will proxy the packet to that realm.
That's all the realm module does.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Regards, Jehanzaib
On Oct 1, 2018, at 9:53 AM, J E H A N Z A I B <jehanzaib.kiani@gmail.com> wrote:
Thanks Alan. Looks like i am failed to explain my requirements. Let me put in this way. I wanted to send the Auth & Accouting request to another radius server. I pick the user the user in the rlm_perl script and that specific user should the requests to external radius server.
Yes... that was clear.
Can you please suggest how this can be done using my perl script please?
As I said:
Set Proxy-To-Realm = "realm", and it will proxy the packet to that realm.
That's all you need to do. Alan DeKok.
Thank you for your help. just to be clear so in my perl script i will set something $ RAD_REQUEST_PROXY {'Proxy-To-Realm '} = " freeradius-2.test.com"; Does this also means i have to define this realm in the proxy.conf? like realm freeradius-2.test.com { authhost = freeradius-2.test.com:1600 accthost = freeradius-2.test.com:1601 secret = testing123 } Is there anyway i can just set these paramters dynamically in my perl script please? Thank you On Tue, Oct 2, 2018 at 3:09 AM Alan DeKok <aland@deployingradius.com> wrote:
On Oct 1, 2018, at 9:53 AM, J E H A N Z A I B <jehanzaib.kiani@gmail.com> wrote:
Thanks Alan. Looks like i am failed to explain my requirements. Let me
put
in this way. I wanted to send the Auth & Accouting request to another radius server. I pick the user the user in the rlm_perl script and that specific user should the requests to external radius server.
Yes... that was clear.
Can you please suggest how this can be done using my perl script please?
As I said:
Set Proxy-To-Realm = "realm", and it will proxy the packet to that realm.
That's all you need to do.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Regards, Jehanzaib
On Oct 1, 2018, at 10:38 AM, J E H A N Z A I B <jehanzaib.kiani@gmail.com> wrote:
Thank you for your help. just to be clear so in my perl script i will set something $ RAD_REQUEST_PROXY {'Proxy-To-Realm '} = " freeradius-2.test.com";
No. You set it in the request list. Not the proxy list. The documentation describes in detail what the various lists are fro,
Does this also means i have to define this realm in the proxy.conf? like realm freeradius-2.test.com { authhost = freeradius-2.test.com:1600 accthost = freeradius-2.test.com:1601 secret = testing123 }
Yes.
Is there anyway i can just set these paramters dynamically in my perl script please?
No. Alan DeKok.
Thank you Alan. Just to sum up, we need to define a realm in proxy.conf. After that we can use it via our perl script like $RAD_CHECK{' Proxy-To-Realm '} = " freeradius-2.test.com"; $result = RLM_MODULE_UPDATED; return $result; The above is called for authorize , authenticate and accounting. realm freeradius-2.test.com { authhost = freeradius-2.test.com:1600 accthost = freeradius-2.test.com:1601 secret = testing123 } Please correct me if i am wrong. Thank you. On Tue, Oct 2, 2018 at 4:48 AM Alan DeKok <aland@deployingradius.com> wrote:
On Oct 1, 2018, at 10:38 AM, J E H A N Z A I B <jehanzaib.kiani@gmail.com> wrote:
Thank you for your help. just to be clear so in my perl script i will set something $ RAD_REQUEST_PROXY {'Proxy-To-Realm '} = " freeradius-2.test.com";
No. You set it in the request list. Not the proxy list.
The documentation describes in detail what the various lists are fro,
Does this also means i have to define this realm in the proxy.conf? like realm freeradius-2.test.com { authhost = freeradius-2.test.com:1600 accthost = freeradius-2.test.com:1601 secret = testing123 }
Yes.
Is there anyway i can just set these paramters dynamically in my perl script please?
No.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Regards, Jehanzaib
Hi Alan, Should I consider I am correct? Thank you On Tue, Oct 2, 2018 at 12:17 PM J E H A N Z A I B <jehanzaib.kiani@gmail.com> wrote:
Thank you Alan.
Just to sum up, we need to define a realm in proxy.conf. After that we can use it via our perl script like
$RAD_CHECK{' Proxy-To-Realm '} = " freeradius-2.test.com"; $result = RLM_MODULE_UPDATED; return $result;
The above is called for authorize , authenticate and accounting. realm freeradius-2.test.com { authhost = freeradius-2.test.com:1600 accthost = freeradius-2.test.com:1601 secret = testing123 }
Please correct me if i am wrong.
Thank you.
On Tue, Oct 2, 2018 at 4:48 AM Alan DeKok <aland@deployingradius.com> wrote:
On Oct 1, 2018, at 10:38 AM, J E H A N Z A I B <jehanzaib.kiani@gmail.com> wrote:
Thank you for your help. just to be clear so in my perl script i will
set
something $ RAD_REQUEST_PROXY {'Proxy-To-Realm '} = " freeradius-2.test.com";
No. You set it in the request list. Not the proxy list.
The documentation describes in detail what the various lists are fro,
Does this also means i have to define this realm in the proxy.conf? like realm freeradius-2.test.com { authhost = freeradius-2.test.com:1600 accthost = freeradius-2.test.com:1601 secret = testing123 }
Yes.
Is there anyway i can just set these paramters dynamically in my perl script please?
No.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Regards, Jehanzaib
-- Regards, Jehanzaib
oh i mean $RAD_REQUEST{'Proxy-To-Realm'} = "freeradius-2.test.com"; $result = RLM_MODULE_UPDATED; return $result; On Wed, Oct 3, 2018 at 10:35 AM J E H A N Z A I B <jehanzaib.kiani@gmail.com> wrote:
Hi Alan, Should I consider I am correct?
Thank you
On Tue, Oct 2, 2018 at 12:17 PM J E H A N Z A I B < jehanzaib.kiani@gmail.com> wrote:
Thank you Alan.
Just to sum up, we need to define a realm in proxy.conf. After that we can use it via our perl script like
$RAD_CHECK{' Proxy-To-Realm '} = " freeradius-2.test.com"; $result = RLM_MODULE_UPDATED; return $result;
The above is called for authorize , authenticate and accounting. realm freeradius-2.test.com { authhost = freeradius-2.test.com:1600 accthost = freeradius-2.test.com:1601 secret = testing123 }
Please correct me if i am wrong.
Thank you.
On Tue, Oct 2, 2018 at 4:48 AM Alan DeKok <aland@deployingradius.com> wrote:
On Oct 1, 2018, at 10:38 AM, J E H A N Z A I B < jehanzaib.kiani@gmail.com> wrote:
Thank you for your help. just to be clear so in my perl script i will
set
something $ RAD_REQUEST_PROXY {'Proxy-To-Realm '} = " freeradius-2.test.com";
No. You set it in the request list. Not the proxy list.
The documentation describes in detail what the various lists are fro,
Does this also means i have to define this realm in the proxy.conf? like realm freeradius-2.test.com { authhost = freeradius-2.test.com:1600 accthost = freeradius-2.test.com:1601 secret = testing123 }
Yes.
Is there anyway i can just set these paramters dynamically in my perl script please?
No.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Regards, Jehanzaib
-- Regards, Jehanzaib
-- Regards, Jehanzaib
Hi team, I have added the proxy request but I cant see if the radius executes the proxy. Here are some logs if anyone can see the issue. rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on db1 via TCP/IP, server version 5.5.59-0+deb8u1-log, protocol version 10 (0) [sql] = ok (0) [exec] = noop (0) attr_filter.accounting_response: EXPAND %{User-Name} (0) attr_filter.accounting_response: --> (0) [attr_filter.accounting_response] = noop (0) } # accounting = ok (0) Sent Accounting-Response Id 26 from 10.99.48.20:1813 to 10.1.49.21:64474 length 0 (0) Finished request (0) Cleaning up request packet ID 26 with timestamp +126 Ready to process requests (1) Received Accounting-Request Id 202 from 10.5.49.20:64384 to 10.99.48.20:1813 length 460 (1) Acct-Status-Type = Interim-Update (1) NAS-IP-Address = 10.5.49.20 (1) User-Name = "e0:cb:bc:40:11:c1" (1) Framed-IP-Address = 100.68.28.2 (1) Framed-IP-Netmask = 255.255.254.0 (1) Calling-Station-Id = "TEST-CALLINGSTATION-01" (1) NAS-Identifier = "test-nas" (1) Acct-Session-Id = "F7ED3F000000035B8553BF" (1) Acct-Session-Time = 3570714 (1) Acct-Multi-Session-Id = "F7ED3F000000055B8553BF" (1) Event-Timestamp = "Oct 9 2018 10:44:57 NZDT" (1) NAS-Port-Type = Ethernet (1) NAS-Port-Id = "2/1/10:2010.3" (1) ADSL-Agent-Circuit-Id = 0x4352f312f313a3130 (1) ADSL-Agent-Remote-Id = 0x43483638423031 (1) Alc-Subsc-ID-Str = "testuser" (1) Alc-Subsc-Prof-Str = "sub-profile-1" (1) Alc-SLA-Prof-Str = "1000/500Mb" (1) Alc-Client-Hardware-Addr = "e0:cb:bc:40:11:c1" (1) Acct-Delay-Time = 0 (1) Acct-Authentic = RADIUS (1) NAS-Port = 2107641130 (1) Acct-Input-Packets = 288139206 (1) Acct-Input-Octets = 249433347 (1) Acct-Input-Gigawords = 46 (1) Acct-Output-Packets = 174285788 (1) Acct-Output-Octets = 96339689 (1) Acct-Output-Gigawords = 9 (1) Alc-Acct-I-Inprof-Octets-64 = 0x00010000002e0ede0d03 (1) Alc-Acct-I-Outprof-Octets-64 = 0x00010000000000000000 (1) Alc-Acct-I-Inprof-Pkts-64 = 0x000100000000112ca7c6 (1) Alc-Acct-I-Outprof-Pkts-64 = 0x00010000000000000000 (1) Alc-Acct-O-Inprof-Octets-64 = 0x00010000000000007e64 (1) Alc-Acct-O-Outprof-Octets-64 = 0x00010000000905bd8885 (1) Alc-Acct-O-Inprof-Pkts-64 = 0x000100000000000000be (1) Alc-Acct-O-Outprof-Pkts-64 = 0x0001000000000a63631e (1) # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default (1) preacct { (1) [preprocess] = ok (1) policy acct_unique { (1) update request { (1) &Tmp-String-9 := "ai:" (1) } # update request = noop (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (1) EXPAND %{hex:&Class} (1) --> (1) EXPAND ^%{hex:&Tmp-String-9} (1) --> ^61693a (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (1) else { (1) update request { (1) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (1) --> e7faa9c68be528833249ff678abd1081 (1) &Acct-Unique-Session-Id := e7faa9c68be528833249ff678abd1081 (1) } # update request = noop (1) } # else = noop (1) } # policy acct_unique = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "e0:cb:bc:40:11:c1", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) [files] = noop (1) } # preacct = ok (1) # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default (1) accounting { (1) detail: EXPAND /var/log/freeradius/detail.log (1) detail: --> /var/log/freeradius/detail.log (1) detail: /var/log/freeradius/detail.log expands to /var/log/freeradius/detail.log (1) detail: EXPAND %t (1) detail: --> Tue Oct 9 10:44:57 2018 (1) [detail] = ok (1) [unix] = noop (1) radutmp: EXPAND /usr/local/var/log/radius/radutmp (1) radutmp: --> /usr/local/var/log/radius/radutmp (1) radutmp: EXPAND %{User-Name} (1) radutmp: --> e0:cb:bc:40:11:c1 (1) [radutmp] = ok (1) perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'e0:cb:bc:40:11:c1' (1) perl: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '10.5.49.20' (1) perl: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '2107641130' (1) perl: $RAD_REQUEST{'Framed-IP-Address'} = &request:Framed-IP-Address -> '100.68.28.2' (1) perl: $RAD_REQUEST{'Framed-IP-Netmask'} = &request:Framed-IP-Netmask -> '255.255.254.0' (1) perl: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> 'TEST-CALLINGSTATION-01' (1) perl: $RAD_REQUEST{'NAS-Identifier'} = &request:NAS-Identifier -> 'test-nas' (1) perl: $RAD_REQUEST{'NAS-Port-Type'} = &request:NAS-Port-Type -> 'Ethernet' (1) perl: $RAD_REQUEST{'Acct-Status-Type'} = &request:Acct-Status-Type -> 'Interim-Update' (1) perl: $RAD_REQUEST{'Acct-Delay-Time'} = &request:Acct-Delay-Time -> '0' (1) perl: $RAD_REQUEST{'Acct-Input-Octets'} = &request:Acct-Input-Octets -> '249433347' (1) perl: $RAD_REQUEST{'Acct-Output-Octets'} = &request:Acct-Output-Octets -> '96339689' (1) perl: $RAD_REQUEST{'Acct-Session-Id'} = &request:Acct-Session-Id -> 'F7ED3F000000035B8553BF' (1) perl: $RAD_REQUEST{'Acct-Authentic'} = &request:Acct-Authentic -> 'RADIUS' (1) perl: $RAD_REQUEST{'Acct-Session-Time'} = &request:Acct-Session-Time -> '3570714' (1) perl: $RAD_REQUEST{'Acct-Input-Packets'} = &request:Acct-Input-Packets -> '288139206' (1) perl: $RAD_REQUEST{'Acct-Output-Packets'} = &request:Acct-Output-Packets -> '174285788' (1) perl: $RAD_REQUEST{'Acct-Multi-Session-Id'} = &request:Acct-Multi-Session-Id -> 'F7ED3F000000055B8553BF' (1) perl: $RAD_REQUEST{'Acct-Input-Gigawords'} = &request:Acct-Input-Gigawords -> '46' (1) perl: $RAD_REQUEST{'Acct-Output-Gigawords'} = &request:Acct-Output-Gigawords -> '9' (1) perl: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'Oct 9 2018 10:44:57 NZDT' (1) perl: $RAD_REQUEST{'NAS-Port-Id'} = &request:NAS-Port-Id -> '2/1/10:2010.3' (1) perl: $RAD_REQUEST{'ADSL-Agent-Circuit-Id'} = &request:ADSL-Agent-Circuit-Id -> '0x4352f312f313a3130' (1) perl: $RAD_REQUEST{'ADSL-Agent-Remote-Id'} = &request:ADSL-Agent-Remote-Id -> '0x43483638423031' (1) perl: $RAD_REQUEST{'Alc-Subsc-ID-Str'} = &request:Alc-Subsc-ID-Str -> 'testuser' (1) perl: $RAD_REQUEST{'Alc-Subsc-Prof-Str'} = &request:Alc-Subsc-Prof-Str -> 'sub-profile-1' (1) perl: $RAD_REQUEST{'Alc-SLA-Prof-Str'} = &request:Alc-SLA-Prof-Str -> '1000/500Mb' (1) perl: $RAD_REQUEST{'Alc-Client-Hardware-Addr'} = &request:Alc-Client-Hardware-Addr -> 'e0:cb:bc:40:11:c1' (1) perl: $RAD_REQUEST{'Alc-Acct-I-Inprof-Octets-64'} = &request:Alc-Acct-I-Inprof-Octets-64 -> '0x00010000002e0ede0d03' (1) perl: $RAD_REQUEST{'Alc-Acct-I-Outprof-Octets-64'} = &request:Alc-Acct-I-Outprof-Octets-64 -> '0x00010000000000000000' (1) perl: $RAD_REQUEST{'Alc-Acct-O-Inprof-Octets-64'} = &request:Alc-Acct-O-Inprof-Octets-64 -> '0x00010000000000007e64' (1) perl: $RAD_REQUEST{'Alc-Acct-O-Outprof-Octets-64'} = &request:Alc-Acct-O-Outprof-Octets-64 -> '0x00010000000905bd8885' (1) perl: $RAD_REQUEST{'Alc-Acct-I-Inprof-Pkts-64'} = &request:Alc-Acct-I-Inprof-Pkts-64 -> '0x000100000000112ca7c6' (1) perl: $RAD_REQUEST{'Alc-Acct-I-Outprof-Pkts-64'} = &request:Alc-Acct-I-Outprof-Pkts-64 -> '0x00010000000000000000' (1) perl: $RAD_REQUEST{'Alc-Acct-O-Inprof-Pkts-64'} = &request:Alc-Acct-O-Inprof-Pkts-64 -> '0x000100000000000000be' (1) perl: $RAD_REQUEST{'Alc-Acct-O-Outprof-Pkts-64'} = &request:Alc-Acct-O-Outprof-Pkts-64 -> '0x0001000000000a63631e' (1) perl: $RAD_REQUEST{'Acct-Unique-Session-Id'} = &request:Acct-Unique-Session-Id -> 'e7faa9c68be528833249ff678abd1081' (1) perl: $RAD_REQUEST{'Tmp-String-9'} = &request:Tmp-String-9 -> 'ai:' rlm_perl: Found username testuser(test-proxy-01) from Calling-Station-Id for port based auth - TEST-CALLINGSTATION-01 (1) perl: &request:Acct-Input-Octets = $RAD_REQUEST{'Acct-Input-Octets'} -> '249433347' (1) perl: &request:Framed-IP-Address = $RAD_REQUEST{'Framed-IP-Address'} -> '100.68.28.2' (1) perl: &request:Acct-Status-Type = $RAD_REQUEST{'Acct-Status-Type'} -> 'Interim-Update' (1) perl: &request:Acct-Output-Packets = $RAD_REQUEST{'Acct-Output-Packets'} -> '174285788' (1) perl: &request:Acct-Session-Id = $RAD_REQUEST{'Acct-Session-Id'} -> 'F7ED3F000000035B8553BF' (1) perl: &request:User-Password = $RAD_REQUEST{'User-Password'} -> 'feenixforfun01' (1) perl: &request:ADSL-Agent-Circuit-Id = $RAD_REQUEST{'ADSL-Agent-Circuit-Id'} -> '0x4350432d504f4c5430322065746820312f312f30342f30312f32322f312f313a3130' (1) perl: &request:NAS-Identifier = $RAD_REQUEST{'NAS-Identifier'} -> 'test-nas' (1) perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'testuser' (1) perl: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '2107641130' *(1) perl: &request:Proxy-To-Realm = $RAD_REQUEST{'Proxy-To-Realm'} -> 'test-proxy-01'* (1) perl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '10.5.49.20' (1) perl: &request:Acct-Unique-Session-Id = $RAD_REQUEST{'Acct-Unique-Session-Id'} -> 'e7faa9c68be528833249ff678abd1081' (1) perl: &request:Alc-Acct-O-Outprof-Octets-64 = $RAD_REQUEST{'Alc-Acct-O-Outprof-Octets-64'} -> '0x00010000000905bd8885' (1) perl: &request:Acct-Authentic = $RAD_REQUEST{'Acct-Authentic'} -> 'RADIUS' (1) perl: &request:Alc-Acct-I-Inprof-Octets-64 = $RAD_REQUEST{'Alc-Acct-I-Inprof-Octets-64'} -> '0x00010000002e0ede0d03' (1) perl: &request:Alc-Acct-I-Outprof-Pkts-64 = $RAD_REQUEST{'Alc-Acct-I-Outprof-Pkts-64'} -> '0x00010000000000000000' (1) perl: &request:NAS-Port-Id = $RAD_REQUEST{'NAS-Port-Id'} -> '2/1/10:2010.3' (1) perl: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> 'TEST-CALLINGSTATION-01' (1) perl: &request:Alc-Subsc-Prof-Str = $RAD_REQUEST{'Alc-Subsc-Prof-Str'} -> 'sub-profile-1' (1) perl: &request:Alc-Acct-I-Inprof-Pkts-64 = $RAD_REQUEST{'Alc-Acct-I-Inprof-Pkts-64'} -> '0x000100000000112ca7c6' (1) perl: &request:Acct-Delay-Time = $RAD_REQUEST{'Acct-Delay-Time'} -> '0' (1) perl: &request:Acct-Multi-Session-Id = $RAD_REQUEST{'Acct-Multi-Session-Id'} -> 'F7ED3F000000055B8553BF' (1) perl: &request:NAS-Port-Type = $RAD_REQUEST{'NAS-Port-Type'} -> 'Ethernet' (1) perl: &request:Alc-Acct-I-Outprof-Octets-64 = $RAD_REQUEST{'Alc-Acct-I-Outprof-Octets-64'} -> '0x00010000000000000000' (1) perl: &request:Acct-Session-Time = $RAD_REQUEST{'Acct-Session-Time'} -> '3570714' (1) perl: &request:Alc-Acct-O-Inprof-Octets-64 = $RAD_REQUEST{'Alc-Acct-O-Inprof-Octets-64'} -> '0x00010000000000007e64' (1) perl: &request:Alc-SLA-Prof-Str = $RAD_REQUEST{'Alc-SLA-Prof-Str'} -> '1000/500Mb' (1) perl: &request:Acct-Input-Packets = $RAD_REQUEST{'Acct-Input-Packets'} -> '288139206' (1) perl: &request:Framed-IP-Netmask = $RAD_REQUEST{'Framed-IP-Netmask'} -> '255.255.254.0' (1) perl: &request:Alc-Client-Hardware-Addr = $RAD_REQUEST{'Alc-Client-Hardware-Addr'} -> 'e0:cb:bc:40:11:c1' (1) perl: &request:Acct-Output-Octets = $RAD_REQUEST{'Acct-Output-Octets'} -> '96339689' (1) perl: &request:Acct-Output-Gigawords = $RAD_REQUEST{'Acct-Output-Gigawords'} -> '9' (1) perl: &request:ADSL-Agent-Remote-Id = $RAD_REQUEST{'ADSL-Agent-Remote-Id'} -> '0x43484f52555331363336363532383638423031' (1) perl: &request:Alc-Acct-O-Inprof-Pkts-64 = $RAD_REQUEST{'Alc-Acct-O-Inprof-Pkts-64'} -> '0x000100000000000000be' (1) perl: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'Oct 9 2018 10:44:57 NZDT' (1) perl: &request:Acct-Input-Gigawords = $RAD_REQUEST{'Acct-Input-Gigawords'} -> '46' (1) perl: &request:Alc-Subsc-ID-Str = $RAD_REQUEST{'Alc-Subsc-ID-Str'} -> 'testuser' (1) perl: &request:Tmp-String-9 = $RAD_REQUEST{'Tmp-String-9'} -> 'ai:' (1) perl: &request:Alc-Acct-O-Outprof-Pkts-64 = $RAD_REQUEST{'Alc-Acct-O-Outprof-Pkts-64'} -> '0x0001000000000a63631e' (1) perl: &control:Auth-Type = $RAD_CHECK{'Auth-Type'} -> 'Accept' (1) [perl] = updated (1) sql: EXPAND %{tolower:type.%{Acct-Status-Type}.query} (1) sql: --> type.interim-update.query (1) sql: Using query template 'query' rlm_sql (sql): Closing connection (5): Hit idle_timeout, was idle for 121 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (6): Hit idle_timeout, was idle for 121 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (7), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on db1 via TCP/IP, server version 5.5.59-0+deb8u1-log, protocol version 10 rlm_sql (sql): Reserved connection (7) (1) sql: EXPAND %{User-Name} (1) sql: --> testuser (1) sql: SQL-User-Name set to 'testuser' (1) sql: EXPAND UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', actualdataratedown = '%{Actual-Data-Rate-Downstream}', actualdatarateup = '%{Actual-Data-Rate-Upstream}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' (1) sql: --> UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1539035097), acctinterval = 1539035097 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '100.68.28.2', actualdataratedown = '', actualdatarateup = '', acctsessiontime = 3570714, acctinputoctets = '46' << 32 | '249433347', acctoutputoctets = '9' << 32 | '96339689' WHERE AcctUniqueId = 'e7faa9c68be528833249ff678abd1081' (1) sql: EXPAND /var/log/freeradius/sqllog.sql (1) sql: --> /var/log/freeradius/sqllog.sql (1) sql: Executing query: UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1539035097), acctinterval = 1539035097 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '100.68.28.2', actualdataratedown = '', actualdatarateup = '', acctsessiontime = 3570714, acctinputoctets = '46' << 32 | '249433347', acctoutputoctets = '9' << 32 | '96339689' WHERE AcctUniqueId = 'e7faa9c68be528833249ff678abd1081' rlm_sql_mysql: Rows matched: 1 Changed: 1 Warnings: 2 (1) sql: SQL query returned: success (1) sql: 1 record(s) updated rlm_sql (sql): Released connection (7) Need 2 more connections to reach min connections (3) rlm_sql (sql): Opening additional connection (8), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on db1 via TCP/IP, server version 5.5.59-0+deb8u1-log, protocol version 10 (1) [sql] = ok (1) [exec] = noop (1) attr_filter.accounting_response: EXPAND %{User-Name} (1) attr_filter.accounting_response: --> testuser (1) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (1) [attr_filter.accounting_response] = updated (1) } # accounting = updated (1) Sent Accounting-Response Id 202 from 10.99.48.20:1813 to 10.5.49.20:64384 length 0 (1) Finished request (1) Cleaning up request packet ID 202 with timestamp +247 Here is my proxy.conf realm test-proxy-01 { authhost = srv1.xxxxxx.com:1812 accthost = srv1.xxxxxx.com:1813 secret = xxxxxxxx nostrip } Anyone have any documentation that can help please? THanks On Wed, Oct 3, 2018 at 8:33 PM J E H A N Z A I B <jehanzaib.kiani@gmail.com> wrote:
oh i mean $RAD_REQUEST{'Proxy-To-Realm'} = "freeradius-2.test.com";
$result = RLM_MODULE_UPDATED; return $result;
On Wed, Oct 3, 2018 at 10:35 AM J E H A N Z A I B < jehanzaib.kiani@gmail.com> wrote:
Hi Alan, Should I consider I am correct?
Thank you
On Tue, Oct 2, 2018 at 12:17 PM J E H A N Z A I B < jehanzaib.kiani@gmail.com> wrote:
Thank you Alan.
Just to sum up, we need to define a realm in proxy.conf. After that we can use it via our perl script like
$RAD_CHECK{' Proxy-To-Realm '} = " freeradius-2.test.com"; $result = RLM_MODULE_UPDATED; return $result;
The above is called for authorize , authenticate and accounting. realm freeradius-2.test.com { authhost = freeradius-2.test.com:1600 accthost = freeradius-2.test.com:1601 secret = testing123 }
Please correct me if i am wrong.
Thank you.
On Tue, Oct 2, 2018 at 4:48 AM Alan DeKok <aland@deployingradius.com> wrote:
On Oct 1, 2018, at 10:38 AM, J E H A N Z A I B < jehanzaib.kiani@gmail.com> wrote:
Thank you for your help. just to be clear so in my perl script i will
set
something $ RAD_REQUEST_PROXY {'Proxy-To-Realm '} = " freeradius-2.test.com";
No. You set it in the request list. Not the proxy list.
The documentation describes in detail what the various lists are fro,
Does this also means i have to define this realm in the proxy.conf? like realm freeradius-2.test.com { authhost = freeradius-2.test.com:1600 accthost = freeradius-2.test.com:1601 secret = testing123 }
Yes.
Is there anyway i can just set these paramters dynamically in my perl script please?
No.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Regards, Jehanzaib
-- Regards, Jehanzaib
-- Regards, Jehanzaib
-- Regards, Jehanzaib
Thanks Alan. I have added perl in the preacct as you suggested but I can not see it is proxied yet. Here is my /usr/local/etc/raddb/mods-enabled/perl perl { filename="${confdir}/scripts/script.pl" func_authenticate = authenticate func_authorize = authorize func_preacct = preacct func_accounting = accounting func_post_auth = post_auth func_xlat = xlat func_detach = detach } and in my script.pl I have sub authorize { return mytestfunc(); } sub authenticate { return mytestfunc(); } sub preacct { return mytestfunc(); } sub accounting { return mytestfunc(); } sub pre_proxy { return RLM_MODULE_OK; #return mytestfunc(); } sub post_proxy { return RLM_MODULE_OK; } sub post_auth { return RLM_MODULE_OK; } in /usr/local/etc/raddb/sites-enabled/default I have preacct { preprocess acct_unique suffix files perl } authorize { filter_username preprocess auth_log chap mschap digest eap { ok = return } files perl sql -ldap expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap digest eap Auth-Type Perl { perl } } accounting { detail unix radutmp perl sql exec attr_filter.accounting_response } session { # sql } pre-proxy { } post-proxy { eap } On Wed, Oct 10, 2018 at 4:49 AM Alan DeKok <aland@deployingradius.com> wrote:
On Oct 8, 2018, at 5:59 PM, J E H A N Z A I B <jehanzaib.kiani@gmail.com> wrote:
I have added the proxy request but I cant see if the radius executes the proxy. Here are some logs if anyone can see the issue.
Run the Perl script in the "preacct" section.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Regards, Jehanzaib
participants (2)
-
Alan DeKok -
J E H A N Z A I B