Problem writing config attributes from script
I'm trying to write an external script for authorization (rlm_exec) I want this script to pass some attributes (beyond clear text Password) in the config attributes, so that another post-auth external script can re-use this information without re-querying the database. It seems that my authorization script cannot write anything beyond Password. IT works fine when it justs output PAssword="XXXX". For instance, if it writes Post-Auth-Type= create_prepaid_account and Password = "XXX" to config attributes, the chap authentication modules does not get anything (log says clear text password not available) Relevant parts of radiusd.conf ========================================================= modules { ........ exec dump { wait = yes program = "/etc/raddb/scripts/dump %{User-Name}" input_pairs = config output_pairs = reply packet_type = Access-Request } exec authorize_prepaid_account { wait = yes program = "/etc/raddb/scripts/authorize %{User-Name}" output_pairs = config packet_type = Access-Request } exec create_prepaid_account { wait = yes program = "/etc/raddb/scripts/new %{User-Name}" input_pairs = config output_pairs = reply packet_type = Access-Request } } authorize { preprocess auth_log chap mschap authorize_prepaid_account files sql dump } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix } post-auth { reply_log create_prepaid_account } ========================================================= What am I doing wrong ? Thanks for your help. Yannick Deltroo
Ignacio DelTroo <deltroo@gmail.com> wrote:
It seems that my authorization script cannot write anything beyond Password. IT works fine when it justs output PAssword="XXXX". For instance, if it writes Post-Auth-Type= create_prepaid_account and Password = "XXX" to config attributes, the chap authentication modules does not get anything (log says clear text password not available)
It would help to show *precisely* what is going on. i.e. debug mode. Alan Dekok.
Hereafter is the debug output for an access request (freeradius 1.0.5). My external script "authorize_prepaid_account" writes this to the output Post-auth-Type := new_prepaid_account Password == test However these config attributes are not taken into account for processing by other modules. The chap authentication module does not see any password. Which is actually true, my second dump script just dump the config attributes ... there's no Post-Auth-Type or Password attribute. I guess my output format is not correct, and not parsed by freeradius. What should be the output format for config attributes ? Thanks for your help ==================================================== Starting - reading configuration files ... .... Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) ...... exec: wait = yes exec: program = "/etc/raddb/scripts/authorize %{User-Name}" exec: input_pairs = "request" exec: output_pairs = "config" exec: packet_type = "Access-Request" Module: Instantiated exec (authorize_prepaid_account) ..... exec: wait = yes exec: program = "/etc/raddb/scripts/dump %{User-Name}" exec: input_pairs = "config" exec: output_pairs = "reply" exec: packet_type = "Access-Request" Module: Instantiated exec (dump) ..... Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 172.16.0.2:2121, id=0, length=240 User-Name = "prepaid1" CHAP-Challenge = 0x4f8d8594b5f54d2ed0b4d5e2677cf6f7 CHAP-Password = 0x00427a8e6d6f41280fd0974fbbab1f4fcc NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.13 Calling-Station-Id = "00-04-23-6C-89-87" Called-Station-Id = "00-0F-66-A3-24-71" NAS-Identifier = "deltroo_1" Acct-Session-Id = "43a926ed00000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0xf7d949b9e72693fe8c1f85e47afe3131 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/172.16.0.2/auth-detail-20051221' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to .... modcall[authorize]: module "auth_log" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 radius_xlat: '/etc/raddb/scripts/authorize prepaid1' Exec-Program: /etc/raddb/scripts/authorize prepaid1 Exec-Program output: Post-Auth-Type := new_prepaid_account Password == test Exec-Program-Wait: plaintext: Post-Auth-Type := new_prepaid_account Password == test Exec-Program: returned: 0 modcall[authorize]: module "authorize_prepaid_account" returns ok for request 0 users: Matched entry DEFAULT at line 148 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'prepaid1' rlm_sql (sql): sql_set_user escaped user --> 'prepaid1' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'prepaid1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User prepaid1 not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM ..... radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM ..... rlm_sql (sql): User prepaid1 not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 radius_xlat: '/etc/raddb/scripts/dump prepaid1' Exec-Program: /etc/raddb/scripts/dump prepaid1 Exec-Program output: Reply-Message += " Dump script executed " Exec-Program-Wait: value-pairs: Reply-Message += " Dump script executed " Exec-Program: returned: 0 modcall[authorize]: module "dump" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_chap: login attempt by "prepaid1" with CHAP password rlm_chap: Could not find clear text password for user prepaid1 modcall[authenticate]: module "chap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. Login incorrect (rlm_chap: Clear text password not available): [prepaid1/<CHAP-Password>] (from client WRT54G port 0 cli 00-04-23-6C-89-87) rad_lowerpair: User-Name now 'prepaid1' rad_rmspace_pair: User-Name now 'prepaid1' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/172.16.0.2/auth-detail-20051221' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to .... modcall[authorize]: module "auth_log" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 radius_xlat: '/etc/raddb/scripts/authorize prepaid1' Exec-Program: /etc/raddb/scripts/authorize prepaid1 Exec-Program output: Post-Auth-Type := new_prepaid_account Password == test Exec-Program-Wait: plaintext: Post-Auth-Type := new_prepaid_account Password == test Exec-Program: returned: 0 modcall[authorize]: module "authorize_prepaid_account" returns ok for request 0 users: Matched entry DEFAULT at line 148 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'prepaid1' rlm_sql (sql): sql_set_user escaped user --> 'prepaid1' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'prepaid1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User prepaid1 not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM ... radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM ... rlm_sql (sql): User prepaid1 not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns notfound for request 0 radius_xlat: '/etc/raddb/scripts/dump prepaid1' Exec-Program: /etc/raddb/scripts/dump prepaid1 Exec-Program output: Reply-Message += " Dump script executed " Exec-Program-Wait: value-pairs: Reply-Message += " Dump script executed " Exec-Program: returned: 0 modcall[authorize]: module "dump" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_chap: login attempt by "prepaid1" with CHAP password rlm_chap: Could not find clear text password for user prepaid1 modcall[authenticate]: module "chap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. Login incorrect (rlm_chap: Clear text password not available): [prepaid1/<CHAP-Password>] (from client WRT54G port 0 cli 00-04-23-6C-89-87) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 172.16.0.2:2121, id=0, length=240 Sending Access-Reject of id 0 to 172.16.0.2:2121 Reply-Message += " Dump script executed " --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 43a92a36 Nothing to do. Sleeping until we see a request. ==================================================== On 12/21/05, Alan DeKok <aland@ox.org> wrote:
Ignacio DelTroo <deltroo@gmail.com> wrote:
It seems that my authorization script cannot write anything beyond Password. IT works fine when it justs output PAssword="XXXX". For instance, if it writes Post-Auth-Type= create_prepaid_account and Password = "XXX" to config attributes, the chap authentication modules does not get anything (log says clear text password not available)
It would help to show *precisely* what is going on. i.e. debug mode.
Alan Dekok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Yannick Deltroo <deltroo@gmail.com> wrote:
However these config attributes are not taken into account for processing by other modules.
Because you're putting the attributes into the reply item list, not the config item list.
Module: Instantiated exec (authorize_prepaid_account) ..... exec: wait = yes exec: program = "/etc/raddb/scripts/dump %{User-Name}" exec: input_pairs = "config" exec: output_pairs = "reply"
See? Change "output_pairs" to "config", and it should work. The documentation for rlm_exec explains this. Alan DeKok.
Alan, thanks for your help. I've read the rlm_exec documentation in the configuration file before posting on the list. As you can see, I actually run two scripts in the authorization section. The first script to run is "authorize_prepaid_account", which is correctly set to output to config, as per the documentation. Then, I run a second script called "dump", just to write environment variables to a file (to see what's going on). "dump" does not output any pairs, so whether it's set to write to reply or config should not have an impact. When I play around with what the "authorize_prepaid_account" script is doing, I can reproduce this strange behavior: 1- If "authorize_prepaid_account" only outputs Password = XXXXX, then everything works fine. I can authorize/authenticate. My dump file shows that Password = XXXX was correctly written to config attributes. 2- If I modify "authorize_prepaid_account" to output two pairs instead of just Password =, i.e. somehting like Post-Auth-Type = THIRD_SCRIPT Password = XXXXX I cannot authenticate. Chap authentication fails (see debug log below) My dump file shows that the output of "authorize_prepaid_account" was not taken into account. (No Post-Auth-Type, No password written to config => chap fails) The server is running with the exact same configuration in case 1 and case 2. I'm just commenting out lines in my script manually. Am I missing something about the correct format for a script output ? I guess, it's one pair per line ? I'm using freeradius 1.0.5 ==================================================== radius.log exec authorize_prepaid_account { wait = yes program = "/etc/raddb/scripts/authorize %{User-Name}" output_pairs = config packet_type = Access-Request } exec dump { wait = yes program = "/etc/raddb/scripts/dump %{User-Name}" input_pairs = config output_pairs = reply packet_type = Access-Request } authorize { preprocess auth_log chap mschap authorize_prepaid_account files sql dump } ========================================================= Daemon debug output exec: wait = yes exec: program = "/etc/raddb/scripts/authorize %{User-Name}" exec: input_pairs = "request" exec: output_pairs = "config" exec: packet_type = "Access-Request" ..... exec: wait = yes exec: program = "/etc/raddb/scripts/dump %{User-Name}" exec: input_pairs = "config" exec: output_pairs = "reply" exec: packet_type = "Access-Request" ...... Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_chap: login attempt by "prepaid1" with CHAP password rlm_chap: Could not find clear text password for user prepaid1 modcall[authenticate]: module "chap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. Login incorrect (rlm_chap: Clear text password not available): [prepaid1/<CHAP-Password>] (from client WRT54G port 0 cli 00-04-23-6C-89-87) ========================================================= On 12/21/05, Alan DeKok <aland@ox.org> wrote:
Yannick Deltroo <deltroo@gmail.com> wrote:
However these config attributes are not taken into account for processing by other modules.
Because you're putting the attributes into the reply item list, not the config item list.
Module: Instantiated exec (authorize_prepaid_account) ..... exec: wait = yes exec: program = "/etc/raddb/scripts/dump %{User-Name}" exec: input_pairs = "config" exec: output_pairs = "reply"
See? Change "output_pairs" to "config", and it should work.
The documentation for rlm_exec explains this.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Yannick Deltroo <deltroo@gmail.com> wrote:
of just Password =, i.e. somehting like Post-Auth-Type = THIRD_SCRIPT Password = XXXXX I cannot authenticate. Chap authentication fails (see debug log below)
Put a "," in between the two items, just like you do in the "users" file. Alan DeKok.
Does not work any better with "," or ";" or " " between the pairs. After the script is executed, the "config" environment variables do not contain the output of the script: AUTH_TYPE=CHAP PWD=/root SHLVL=1 _=/usr/bin/printenv If I only write a Password=XXX from the script, the output is taken into account. See the env variable then: PASSWORD="test" AUTH_TYPE=CHAP PWD=/root SHLVL=1 _=/usr/bin/printenv My tests show that the only pair accepted from the script is Password = XXXXX. Any other single attribute is just ignored. Could it be a problem with attributes dictionnaries ? On 12/21/05, Alan DeKok <aland@ox.org> wrote:
Yannick Deltroo <deltroo@gmail.com> wrote:
of just Password =, i.e. somehting like Post-Auth-Type = THIRD_SCRIPT Password = XXXXX I cannot authenticate. Chap authentication fails (see debug log below)
Put a "," in between the two items, just like you do in the "users" file.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I got it working. I was actually trying to write a value not compatible with the post-auth type, defined in the dictionnary. That's why the output of my script was not taken into account by freeradius. To pass parameters from my authentication script to my post-authentication script, I've defined my own new Prepaid attribute (in /etc/raddb/dictionnary) ATTRIBUTE Prepaid 3000 string The correct format for scripts outputing several attributes is to use a "," to separate the pairs. Scripts should output something like : Prepaid = "my parameters here" , Password = "test" On 12/22/05, Yannick Deltroo <deltroo@gmail.com> wrote:
Does not work any better with "," or ";" or " " between the pairs.
After the script is executed, the "config" environment variables do not contain the output of the script: AUTH_TYPE=CHAP PWD=/root SHLVL=1 _=/usr/bin/printenv
If I only write a Password=XXX from the script, the output is taken into account. See the env variable then: PASSWORD="test" AUTH_TYPE=CHAP PWD=/root SHLVL=1 _=/usr/bin/printenv
My tests show that the only pair accepted from the script is Password = XXXXX. Any other single attribute is just ignored.
Could it be a problem with attributes dictionnaries ?
On 12/21/05, Alan DeKok <aland@ox.org> wrote:
Yannick Deltroo <deltroo@gmail.com> wrote:
of just Password =, i.e. somehting like Post-Auth-Type = THIRD_SCRIPT Password = XXXXX I cannot authenticate. Chap authentication fails (see debug log below)
Put a "," in between the two items, just like you do in the "users" file.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Ignacio DelTroo -
Yannick Deltroo