Howto use rlm_python or how another way to use "rocket codes"
Hello everyone, I am trying to find a simple solution for the following problem. I have a device for which I need authentication in form of a username and pre-generated one-time-pads. The device speaks radius flawlessly, so I though the easiest setup would be a radius server. The authentication system should be as small and rugged as possible, so no fancy stuff around ist wanted. This is supposed to an access of last resort to certain systems. So it should be working even if everything else is breaking down (like active-directory and stuff like that). Finally I found out that it is possible to "program" my own authentication plugin using python for freeradius. There is only one problem: zero documentation. I found the python example "prepaid.py" somewhere on the internet, so I was able to put my own module together. But how do I tell freeradius to use this module? I am not a freeradius expert, and I went through the wiki, but again, documentation seems to be sparse on details. Thanks for any hints, Jesse -- Jesse Schlüter mail: jesse.schlueter@helix360.de
On Jun 10, 2015, at 7:26 AM, Jesse Schlüter <jesse.schlueter@helix360.de> wrote:
I have a device for which I need authentication in form of a username and pre-generated one-time-pads. The device speaks radius flawlessly, so I though the easiest setup would be a radius server.
That's the best way.
Finally I found out that it is possible to "program" my own authentication plugin using python for freeradius. There is only one problem: zero documentation.
I found the python example "prepaid.py" somewhere on the internet,
Why? The server comes with examples...
so I was able to put my own module together. But how do I tell freeradius to use this module? I am not a freeradius expert, and I went through the wiki, but again, documentation seems to be sparse on details.
In version 2, see raddb/modules/python. In version 3, raddb/mods-available/python. It contains text which tells you what to do. Then, use the module by listing "python" in raddb/sites-available/default. That process is documented, too. Alan DeKok.
Thanks for the info, I installed the freeradius from the Ubuntu packages, which is version 2.1 something. Unfortunately it did not contain a modules/python file. I created one like this: python { mod_instantiate = "radiusd_test" func_instantiate = "instantiate" mod_authorize = "radiusd_test" func_authorize = "authorize" mod_accounting = "radiusd_test" func_accounting = "accounting" mod_pre_proxy = "radiusd_test" func_pre_proxy = "pre_proxy" mod_post_proxy = "radiusd_test" func_post_proxy = "post_proxy" mod_post_auth = "radiusd_test" func_post_auth = "post_auth" mod_recv_coa = "radiusd_test" func_recv_coa = "recv_coa" mod_send_coa = "radiusd_test" func_send_coa = "send_coa" mod_detach = "radiusd_test" func_detach = "detach" } My previous one had some errors, but this one seems to work and tries to load radiusd_test but can't find it. Does the freeradius python environment has a special path on which to put modules, or the normal python environment? Thanks, Jesse 2015-06-10 14:37 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On Jun 10, 2015, at 7:26 AM, Jesse Schlüter <jesse.schlueter@helix360.de> wrote:
I have a device for which I need authentication in form of a username and pre-generated one-time-pads. The device speaks radius flawlessly, so I though the easiest setup would be a radius server.
That's the best way.
Finally I found out that it is possible to "program" my own authentication plugin using python for freeradius. There is only one problem: zero documentation.
I found the python example "prepaid.py" somewhere on the internet,
Why? The server comes with examples...
so I was able to put my own module together. But how do I tell freeradius to use this module? I am not a freeradius expert, and I went through the wiki, but again, documentation seems to be sparse on details.
In version 2, see raddb/modules/python. In version 3, raddb/mods-available/python. It contains text which tells you what to do.
Then, use the module by listing "python" in raddb/sites-available/default. That process is documented, too.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Jesse Schlüter mail: jesse.schlueter@helix360.de
On Jun 10, 2015, at 10:26 AM, Jesse Schlüter <jesse.schlueter@helix360.de> wrote:
Thanks for the info, I installed the freeradius from the Ubuntu packages, which is version 2.1 something. Unfortunately it did not contain a modules/python file.
I would suggest using 2.2.7. It's much better. And it includes a file raddb/modules/python, with documentation.
My previous one had some errors, but this one seems to work and tries to load radiusd_test but can't find it. Does the freeradius python environment has a special path on which to put modules, or the normal python environment?
It's a normal python environment. BUT the FreeRADIUS server must have read permission to the filesystem. If you're running it as a non-standard user, the permissions might need to be examined. Alan DeKok.
participants (2)
-
Alan DeKok -
Jesse Schlüter