external script doesn't add the attributes it prints out
Hi all, I have installed freeradius 2.14 on Freebsd using the ports. I need to use an external script, so in radiusd.conf I created in the module section : exec GETVLAN { wait = yes program = "/usr/local/etc/raddb/getVlan %{User-Name}" input-pairs = request output-pairs = reply } and I use it in the post-auth section of the inner-tunnel. (I 'm using peap/mschapv2) But the result is not what I expected... I do "echo" for assigning vlan id but the attributes are not appended to the reply. Here is a cut of the debug debug : ... [GETVLAN] expand: %{User-Name} -> nobody Exec-Program output: Tunnel-Medium-Type = 6, Tunnel-Type = 13, Tunnel-Private-Group-Id = 1 Exec-Program-Wait: value-pairs: Tunnel-Medium-Type = 6, Tunnel-Type = 13, Tunnel-Private-Group-Id = 1 Exec-Program: returned: 3 ++[GETVLAN] returns ok } # server inner-tunnel [peap] Got tunneled reply code 2 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "nobody" [peap] Got tunneled reply RADIUS code 2 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "nobody" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 8 to 192.168.3.125 port 48956 EAP-Message = 0x0109002b190017030100206a5e995dedc28425eadd6f6b92faa22efdc1a93ab3a26a000df6f49744b8b392 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1f8b9f59174286e5556aa2fa4357052a Finished request 8. Going to the next request .... Regards, G.
Hi all,
I have installed freeradius 2.14 on Freebsd using the ports. I need to use an external script, so in radiusd.conf I created in the module section : exec GETVLAN { wait = yes program = "/usr/local/etc/raddb/getVlan %{User-Name}" input-pairs = request output-pairs = reply }
and I use it in the post-auth section of the inner-tunnel. (I 'm using peap/mschapv2)
But the result is not what I expected... I do "echo" for assigning vlan id but the attributes are not appended to the reply. Here is a cut of the debug debug :
... [GETVLAN] expand: %{User-Name} -> nobody Exec-Program output: Tunnel-Medium-Type = 6, Tunnel-Type = 13, Tunnel-Private-Group-Id = 1 Exec-Program-Wait: value-pairs: Tunnel-Medium-Type = 6, Tunnel-Type = 13, Tunnel-Private-Group-Id = 1 Exec-Program: returned: 3 ++[GETVLAN] returns ok
Your script prints: value-pairs: Tunnel-Medium-Type = 6, Tunnel-Type = 13, Tunnel-Private-Group-Id = 1 It should print: Tunnel-Medium-Type = 6, Tunnel-Type = 13, Tunnel-Private-Group-Id = 1 Ivan Kalik Kalik Informatika ISP
Thanks for answering Ivan. Actually the radius debug prints my output script in one single line, but I have 3 distincts echo in my scripts. " ... echo Tunnel-Medium-Type = 6, echo Tunnel-Type =13, echo Tunnel-Private-Group-Id = 1 exit 0" So the matter might be away... I am certainly missing something... Do I need to do something more than make my script printing out the attributes to add them in the reply ? 2009/5/22 Ivan Kalik <tnt@kalik.net>:
Hi all,
I have installed freeradius 2.14 on Freebsd using the ports. I need to use an external script, so in radiusd.conf I created in the module section : exec GETVLAN { wait = yes program = "/usr/local/etc/raddb/getVlan %{User-Name}" input-pairs = request output-pairs = reply }
and I use it in the post-auth section of the inner-tunnel. (I 'm using peap/mschapv2)
But the result is not what I expected... I do "echo" for assigning vlan id but the attributes are not appended to the reply. Here is a cut of the debug debug :
... [GETVLAN] expand: %{User-Name} -> nobody Exec-Program output: Tunnel-Medium-Type = 6, Tunnel-Type = 13, Tunnel-Private-Group-Id = 1 Exec-Program-Wait: value-pairs: Tunnel-Medium-Type = 6, Tunnel-Type = 13, Tunnel-Private-Group-Id = 1 Exec-Program: returned: 3 ++[GETVLAN] returns ok
Your script prints:
value-pairs: Tunnel-Medium-Type = 6, Tunnel-Type = 13, Tunnel-Private-Group-Id = 1
It should print:
Tunnel-Medium-Type = 6, Tunnel-Type = 13, Tunnel-Private-Group-Id = 1
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
I have installed freeradius 2.14 on Freebsd using the ports. I need to use an external script, so in radiusd.conf I created in the module section : exec GETVLAN { wait = yes program = "/usr/local/etc/raddb/getVlan %{User-Name}" input-pairs = request output-pairs = reply }
and I use it in the post-auth section of the inner-tunnel. (I 'm using peap/mschapv2)
But the result is not what I expected... I do "echo" for assigning vlan id but the attributes are not appended to the reply. Here is a cut of the debug debug :
fun. this sort of issue has actually been posted twice to this list in the past week - dont use the post-auth of the inner-tunnel, use the post-auth of the outer (default site usually) - you may need to ensure that the User-Name gets passed back to the outer handler to ensure you are dealing with real user info and not just 'anonymous' etc. alan
Hello, I've tried in the outer-tunel, post-auth { GETVLAN } but it still does not add my attributes to the reply... So I have tried (still in the outer-tunel) this : post-auth { update reply { Tunnel-Medium-Type = 6 Tunnel-Type = 13 Tunnel-Private-Group-Id = `%{exec:/usr/local/etc/raddb/getVlan %{User-Name}}` } } but I got the error +- entering group post-auth {...} ++[exec] returns noop Executing /usr/local/etc/raddb/getVlan %{User-Name} expand: %{User-Name} -> anonymous2nobode result 0 expand: %{exec:/usr/local/etc/raddb/getVlan %{User-Name}} -> Exec-Program output: Exec-Program: FAILED to execute : No such file or directory Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute : No such file or directory Exec-Program: returned: 1 ++[reply] returns invalid And finally, I 've tried like that : update reply{ Tunnel-Medium-Type = 6 Tunnel-Type = 13 Tunnel-Private-Group-Id = `/usr/local/etc/raddb/getVlan %{User-Name}` } and that way works. But... I don't know an easy way to get the user-name of the inner-tunnel ? Regards, G. 2009/5/23 <A.L.M.Buxey@lboro.ac.uk>:
Hi,
I have installed freeradius 2.14 on Freebsd using the ports. I need to use an external script, so in radiusd.conf I created in the module section : exec GETVLAN { wait = yes program = "/usr/local/etc/raddb/getVlan %{User-Name}" input-pairs = request output-pairs = reply }
and I use it in the post-auth section of the inner-tunnel. (I 'm using peap/mschapv2)
But the result is not what I expected... I do "echo" for assigning vlan id but the attributes are not appended to the reply. Here is a cut of the debug debug :
fun. this sort of issue has actually been posted twice to this list in the past week - dont use the post-auth of the inner-tunnel, use the post-auth of the outer (default site usually) - you may need to ensure that the User-Name gets passed back to the outer handler to ensure you are dealing with real user info and not just 'anonymous' etc.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Ivan Kalik -
Stun Box