Executing an external program
Hi, I am using Freeradius version 2.2.4, I want to execute an external Java program, whenever I receive an Accounting Stop packet, I have added the below code in the "Accounting" section of /etc/raddb/sites-enabled/default accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf sql # # If you receive stop packets with zero session length, # they will NOT be logged in the database. The SQL module # will print a message (only in debugging mode), and will # return "noop". # # You can ignore these packets by uncommenting the following # three lines. Otherwise, the server will not respond to the # accounting request, and the NAS will retransmit. # # if (noop) { # ok # } # # Instead of sending the query to the SQL server, # write it into a log file. # # sql_log # Cisco VoIP specific bulk accounting # pgsql-voip # For Exec-Program and Exec-Program-Wait exec # Filter attributes from the accounting response. attr_filter.accounting_response update reply { Tmp-String-0 = "%{exec:/usr/bin/java -jar "/var/AccountingProcessor.jar" arg1 arg2 >> /home/user/capture.log}" } # # See "Autz-Type Status-Server" for how this works. # # Acct-Type Status-Server { # # } } where arg1 and arg2 will be the radius accounting stop packet attributes. i will add the IF condition for checking stop packets later Currently I am receiving error in logs, error is mentioned below ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> muhd.usman@hotmail.com attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated ERROR: Badly formatted variable: %{exec:/usr/bin/java -jar ++[reply] returns updated Sending Accounting-Response of id 14 to 192.168.6.121 port 55006 Finished request 1. Thanks in advance
On Wed, Apr 16, 2014 at 05:33:49PM +0500, Muhammad Usman wrote:
update reply { Tmp-String-0 = "%{exec:/usr/bin/java -jar "/var/AccountingProcessor.jar" arg1 arg2 >> /home/user/capture.log}" }
Firing up java on each packet is likely to kill your service.
++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> muhd.usman@hotmail.com attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated ERROR: Badly formatted variable: %{exec:/usr/bin/java -jar
You've got quoting problems. Either escape the quotes around /var/AccountingProcessor.jar, remove them, or use ' instead. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi, I have tried to put single quotes, in that case error is expand: %{exec:/usr/bin/java -jar '/var/AccountingProcessor.jar' usman test} -> ++[reply] returns updated Sending Accounting-Response of id 23 to 192.168.6.121 port 55006 Finished request 1. Cleaning up request 1 ID 23 with timestamp +11 Going to the next request Error: Unable to access jarfile '/var/AccountingProcessor.jar' On Wed, Apr 16, 2014 at 5:42 PM, Matthew Newton <mcn4@leicester.ac.uk>wrote:
On Wed, Apr 16, 2014 at 05:33:49PM +0500, Muhammad Usman wrote:
update reply { Tmp-String-0 = "%{exec:/usr/bin/java -jar "/var/AccountingProcessor.jar" arg1 arg2 >> /home/user/capture.log}" }
Firing up java on each packet is likely to kill your service.
++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> muhd.usman@hotmail.com attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated ERROR: Badly formatted variable: %{exec:/usr/bin/java -jar
You've got quoting problems. Either escape the quotes around /var/AccountingProcessor.jar, remove them, or use ' instead.
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, Apr 16, 2014 at 06:08:00PM +0500, Muhammad Usman wrote:
Error: Unable to access jarfile '/var/AccountingProcessor.jar'
Does that file exist? What are its permissions? Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
And /var/AccountingProcessor.jar is accessible by the FreeRADIUS user, yes? Check the permissions on the jar and also check that the FreeRADIUS user can launch Java. Stefan From: freeradius-users-bounces+stefan.paetow=ja.net@lists.freeradius.org [mailto:freeradius-users-bounces+stefan.paetow=ja.net@lists.freeradius.org] On Behalf Of Muhammad Usman Sent: 16 April 2014 14:08 To: FreeRadius users mailing list Subject: Re: Executing an external program Hi, I have tried to put single quotes, in that case error is expand: %{exec:/usr/bin/java -jar '/var/AccountingProcessor.jar' usman test} -> ++[reply] returns updated Sending Accounting-Response of id 23 to 192.168.6.121 port 55006 Finished request 1. Cleaning up request 1 ID 23 with timestamp +11 Going to the next request Error: Unable to access jarfile '/var/AccountingProcessor.jar' On Wed, Apr 16, 2014 at 5:42 PM, Matthew Newton <mcn4@leicester.ac.uk<mailto:mcn4@leicester.ac.uk>> wrote: On Wed, Apr 16, 2014 at 05:33:49PM +0500, Muhammad Usman wrote:
update reply { Tmp-String-0 = "%{exec:/usr/bin/java -jar "/var/AccountingProcessor.jar" arg1 arg2 >> /home/user/capture.log}" }
Firing up java on each packet is likely to kill your service.
++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> muhd.usman@hotmail.com<mailto:muhd.usman@hotmail.com> attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated ERROR: Badly formatted variable: %{exec:/usr/bin/java -jar You've got quoting problems. Either escape the quotes around /var/AccountingProcessor.jar, remove them, or use ' instead.
Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk<mailto:mcn4@le.ac.uk>> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk<mailto:ithelp@le.ac.uk>> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238
Muhammad Usman wrote:
Error: Unable to access jarfile '/var/AccountingProcessor.jar'
That error is pretty simple to understand. The radius server needs permissions to run that file. My suggestion is to place the file in the raddb/ directory. And give it the same owners and permissions as the other files in that directory. It's just easier. Alan DeKok.
Hi, Thanks for your reply. Just to make it very easy for me, i have updated the default file like this, update reply { Tmp-String-0 = "%{exec:echo hellllllloooooooooooooooooo}" } On receiving accounting packet, logs does not shows any error, but they also do not echoes the string i passed. attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Executing echo hellllllloooooooooooooooooo result 0 expand: %{exec:echo hellllllloooooooooooooooooo } -> ++[reply] returns updated Sending Accounting-Response of id 35 to 192.168.6.121 port 55006 On Wed, Apr 16, 2014 at 6:22 PM, Alan DeKok <aland@deployingradius.com>wrote:
Muhammad Usman wrote:
Error: Unable to access jarfile '/var/AccountingProcessor.jar'
That error is pretty simple to understand.
The radius server needs permissions to run that file. My suggestion is to place the file in the raddb/ directory. And give it the same owners and permissions as the other files in that directory.
It's just easier.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Dear Alan, I have tried using the full pathname as well, but it didnt work either, ideally if I am not wrong, it should display the output on screen as I am running radius in debug mode? update reply { Tmp-String-0 = "%{exec:/bin/echo hellllllloooooooooooooooooo}" Also i have checked echo command is accessible to non-root user as well. On Wed, Apr 16, 2014 at 8:50 PM, Alan DeKok <aland@deployingradius.com>wrote:
Muhammad Usman wrote:
Hi, Thanks for your reply. Just to make it very easy for me, i have updated the default file like this,
update reply { Tmp-String-0 = "%{exec:echo hellllllloooooooooooooooooo}"
You need to use the full pathname to the "echo" command.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Muhammad Usman wrote:
Dear Alan, I have tried using the full pathname as well, but it didnt work either, ideally if I am not wrong, it should display the output on screen as I am running radius in debug mode?
update reply { Tmp-String-0 = "%{exec:/bin/echo hellllllloooooooooooooooooo}"
It should be printed when using debug mode. Check that you have the "exec" program configured correctly. See raddb/modules/exec. Make sure that you have "wait = yes". Alan DeKok.
Thanks Alan, after changing the wait parameter, it is displaying the results on screen. As I have to call the external script on every accounting stop packet and donot need to see the output of program,should i keep the "wait" variable as "yes" or "no" Thanks Again.. On Wed, Apr 16, 2014 at 9:23 PM, Alan DeKok <aland@deployingradius.com>wrote:
Muhammad Usman wrote:
Dear Alan, I have tried using the full pathname as well, but it didnt work either, ideally if I am not wrong, it should display the output on screen as I am running radius in debug mode?
update reply { Tmp-String-0 = "%{exec:/bin/echo hellllllloooooooooooooooooo}"
It should be printed when using debug mode. Check that you have the "exec" program configured correctly. See raddb/modules/exec. Make sure that you have "wait = yes".
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
Matthew Newton -
Muhammad Usman -
Stefan Paetow