Hi all, At first, to the people who is working on FreeRADIUS, you're doing an awesome, awesome job! Ok, so I'm having this configuration: in sites-available/default: [...] preacct { # Echo here yields WARNING and doesn't catch Session-Timeout # echo if (Acct-Status-Type == "Start"){ acctstart } if (Acct-Status-Type == "Stop"){ acctstop } [...] where acctstart and acctstop is 2 exec modules, defined like this: exec acctstart { wait = yes program = "/accounting_start_sh.sh %{User-Name} %{reply:Session-Timeout}" input_pairs = reply output_pairs = reply shell_escape = yes } exec acctstop { wait = yes program = "/accounting_stop_sh.sh %{User-Name} input_pairs = reply output_pairs = reply shell_escape = yes } Basically, the shell script is to ssh and terminate stuff in NAS after Session-Timeout seconds have passed (Don't ask, but NAS doesn't support Session-Timeout so we need to do it this way). The problem is, when we have a run, the debug yield: [...] Sending Access-Accept of id 121 to 127.0.0.1 port 45280 Reply-Message = "Hello, test" Session-Timeout = 94 Finished request 0. Going to the next request Waking up in 4.7 seconds. rad_recv: Accounting-Request packet from host 127.0.0.1 port 45280, id=123, length=155 NAS-Identifier = "OpenVPN.localhost.localdomain" User-Name = "test" NAS-Port = 27 Service-Type = Dialout-Framed-User Framed-Protocol = PPP Acct-Status-Type = Start Framed-IP-Netmask = 255.255.248.0 Acct-Session-Id = "OpenVPN.localhost.localdomain.as0t1.1288162180.5521.27" Framed-IP-Address = 5.5.8.25 NAS-Port-Type = Virtual +- entering group preacct {...} ++? if (Acct-Status-Type == "Start") ? Evaluating (Acct-Status-Type == "Start") -> TRUE ++? if (Acct-Status-Type == "Start") -> TRUE ++- entering if (Acct-Status-Type == "Start") {...} [acctstart] WARNING! Input pairs are empty. No attributes will be passed to the script [acctstart] expand: %{User-Name} -> test [acctstart] expand: %{reply:Session-Timeout} -> expr: syntax error Exec-Program output: test is scheduled to be terminated after min(s) Exec-Program-Wait: plaintext: test is scheduled to be terminated after min(s) Exec-Program: returned: 0 [...] Note the 2 bold lines, the Session-Timeout isn't passed to the acctstart exec, leading to shellscript doesn't run correctly. My question is can I somehow pass the Session-Timeout value from the Access-Accept packet to this section of preaccounting? FYI, I'm using sql counter (the default noresetcounter) to calculate the Session-Timeout. Thanks a lot in advance, N. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Help-on-passing-parameter-to-exec-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Sorry I forgot, the version is FreeRADIUS 2.1.7 on a CentOS 5.5 distro. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Help-on-passing-parameter-to-exec-tp... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 11/03/2010 09:19 AM, nghiapt wrote:
exec acctstart { wait = yes program = "/accounting_start_sh.sh %{User-Name} %{reply:Session-Timeout}"
Accounting packets don't have any reply AVPs, so "reply:X" is always empty for accounting packets. (Sometimes you can send VSAs in Accounting replies, but it's non-standard and goes against the RFCs) Don't you want this in "post-auth"?
Thanks for your reply, The thing is, I need this particular exec to run on an Accounting Request with Type = Start, since there is 2 kind of login on the NAS: - Login on the Web UI, in this case only Access-Request is sent - Login for VPN, in this case after Authenticate is accepted, NAS sends an Accounting Start Request. I want to run exec here to distinguish the two kind of login. Can I define some kind of variable to store the Session-Timeout pass the Authenticate to the pre-acct session ? On Wed, Nov 3, 2010 at 5:02 PM, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 11/03/2010 09:19 AM, nghiapt wrote:
exec acctstart { wait = yes program = "/accounting_start_sh.sh %{User-Name} %{reply:Session-Timeout}"
Accounting packets don't have any reply AVPs, so "reply:X" is always empty for accounting packets.
(Sometimes you can send VSAs in Accounting replies, but it's non-standard and goes against the RFCs)
Don't you want this in "post-auth"?
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- *ExE Company* Phạm Trung Nghĩa - IT Executive Mobile: 0908 012 280 ; Email: nghia.pham@exe.com.vn Tel: 08.3878 5688 ; Fax: 08.3511 9550 Website: exe.com.vn | bluedesignvn.com
On 11/03/2010 10:20 AM, Nghĩa Phạm wrote:
Thanks for your reply,
The thing is, I need this particular exec to run on an Accounting Request with Type = Start, since there is 2 kind of login on the NAS: - Login on the Web UI, in this case only Access-Request is sent - Login for VPN, in this case after Authenticate is accepted, NAS sends an Accounting Start Request. I want to run exec here to distinguish the two kind of login.
Well, as I've explained - the variable you want to match is not present in accounting packets. Are you sure there isn't some variable which is different in the auth requests? Service-Type for example?
Can I define some kind of variable to store the Session-Timeout pass the Authenticate to the pre-acct session ?
You may be able to use an SQL database to store Session-Timeout in "post-auth", then retrieve it in "pre-acct", provided there is a value common between the auth and accounting packets.
Hey. Thanks for your quick reply,
Are you sure there isn't some variable which is different in the auth requests? Service-Type for example? The NAS is OpenVPN. Last I check, it only sends a username, a password, the NAS indentifier and the Service Type. They are identical though, even the Service-Type. If you or someone else have experience with FreeRADIUS and OpenVPN, can you point me to the right direction? The guy at live chat support in OpenVPN weren't very helpful. You may be able to use an SQL database to store Session-Timeout in "post-auth", then retrieve it in "pre-acct", provided there is a value common between the auth and accounting packets. Well, I am going to do that or store them in a file if there is no other choice. Would you kindly tell me if there's a easy way or do I have to write a script (Shell or Perl) to manually do this?
participants (4)
-
nghiapt -
Nghĩa Phạm
-
Pham Trung Nghia
-
Phil Mayers