Alan, I am also finding the documentation semi helpful. So I put: exec { program = "/path/to/program/exec-program-wait" <-- I know I need to change this wait = yes input_pairs = request output_pairs = reply } In /etc/freeradius/modules/exec. Now how do make my authentication request use exec? Thanks, Craig
Craig Smith wrote:
I am also finding the documentation semi helpful. So I put:
In 2.1.x, you can *still* use Exec-Program-Wait. So no change is necessary.
exec { program = "/path/to/program/exec-program-wait" <-- I know I need to change this
Change it to the path of the program you want to run. This should be Unix 101.
wait = yes input_pairs = request output_pairs = reply }
In /etc/freeradius/modules/exec.
Now how do make my authentication request use exec?
You read the documentation in raddb/modules/exec. Do you have a *specific* question about the documentation? I'm unwilling to re-post it here, as that is not helpful. Alan DeKok.
Alan, re: "Do you have a *specific* question about the documentation? I'm unwilling to re-post it here, as that is not helpful." Perhaps we (the craigs) are thinking about it from the wrong (old) angle? What I am missing is how to connect the entries in the users file to the specific auth program I wish to use via the 'new and improved' method? Simple fictional example, assume I have two (2) auth programs (auth1 and auth2), and two NAS devices (NAS1 and NAS2). In users I can used default entries and specify the source NAS in an entry like, Default NAS-IP-Address=="192.168.1.1", Auth-Type:=Accept, <- What goes here to replace the deprecated Exec-Program-Wait for auth1 construct? Fall-Through = No Default NAS-IP-Address=="192.168.1.2", Auth-Type:=Accept, <- What goes here to replace the deprecated Exec-Program-Wait for auth2 construct? Fall-Through = No I suspect this is a case of you knowing the system so well that you are making a trivial logic leap we are failing to see. Thanks, -craig(II) ----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Monday, March 21, 2011 12:34 PM Subject: Re: $75.00 USD Bounty
Craig Smith wrote:
I am also finding the documentation semi helpful. So I put:
In 2.1.x, you can *still* use Exec-Program-Wait. So no change is necessary.
exec { program = "/path/to/program/exec-program-wait" <-- I know I need to change this
Change it to the path of the program you want to run. This should be Unix 101.
wait = yes input_pairs = request output_pairs = reply }
In /etc/freeradius/modules/exec.
Now how do make my authentication request use exec?
You read the documentation in raddb/modules/exec.
Do you have a *specific* question about the documentation? I'm unwilling to re-post it here, as that is not helpful.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
__________ Information from ESET Smart Security, version of virus signature database 5971 (20110321) __________
The message was checked by ESET Smart Security.
__________ Information from ESET Smart Security, version of virus signature database 5971 (20110321) __________ The message was checked by ESET Smart Security. http://www.eset.com
Craig, I THINK you my want to name the exec module specifically... from memory I THINK the syntax may be something like.. exec my_personal_auth_program { program = "/path/to/program/exec-program-wait" <-- I know I need to change this wait = yes input_pairs = request output_pairs = reply } Then I suspect you need to add a call to my_personal_auth_program to the sites-enabled/default file in either the authenticate or authorize section. DISCLAIMER: This is I think where all my attempts failed, hence I am still using the deprecated method. Good luck and let me know if you solve this! Cheers, -the other craig ----- Original Message ----- From: Craig Smith To: freeradius-users@lists.freeradius.org Sent: Monday, March 21, 2011 12:27 PM Subject: Re: $75.00 USD Bounty Alan, I am also finding the documentation semi helpful. So I put: exec { program = "/path/to/program/exec-program-wait" <-- I know I need to change this wait = yes input_pairs = request output_pairs = reply } In /etc/freeradius/modules/exec. Now how do make my authentication request use exec? Thanks, Craig ------------------------------------------------------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________ Information from ESET Smart Security, version of virus signature database 5971 (20110321) __________ The message was checked by ESET Smart Security. http://www.eset.com __________ Information from ESET Smart Security, version of virus signature database 5971 (20110321) __________ The message was checked by ESET Smart Security. http://www.eset.com
Hi again, Okay, I have everything running, but I have one more question. Is there a way to adjust the timeout of the scripts being exec? I get the following error. I'm looking to make the timeout around 40 seconds. Error: Child PID 16599 is taking too much time: forcing failure and killing child. Thanks, Craig On Mon, Mar 21, 2011 at 12:27 PM, Craig Smith <craigesmith@gmail.com> wrote:
Alan,
I am also finding the documentation semi helpful. So I put:
exec { program = "/path/to/program/exec-program-wait" <-- I know I need to change this wait = yes input_pairs = request output_pairs = reply }
In /etc/freeradius/modules/exec.
Now how do make my authentication request use exec?
Thanks,
Craig
Hmmm, I don't know how to set this (source code hack?), but what in the heck are you doing that takes so long? I'd think your target should be less than 3 seconds and for SURE less than 10 seconds. I think the thread is tied to this waiting, so you're gonna severely limit your throughput and number of users you can handle. ________________________________ From: freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org] On Behalf Of Craig Smith Sent: Monday, March 21, 2011 3:52 PM To: freeradius-users@lists.freeradius.org Subject: Re: $75.00 USD Bounty Hi again, Okay, I have everything running, but I have one more question. Is there a way to adjust the timeout of the scripts being exec? I get the following error. I'm looking to make the timeout around 40 seconds. Error: Child PID 16599 is taking too much time: forcing failure and killing child. Thanks, Craig On Mon, Mar 21, 2011 at 12:27 PM, Craig Smith <craigesmith@gmail.com<mailto:craigesmith@gmail.com>> wrote: Alan, I am also finding the documentation semi helpful. So I put: exec { program = "/path/to/program/exec-program-wait" <-- I know I need to change this wait = yes input_pairs = request output_pairs = reply } In /etc/freeradius/modules/exec. Now how do make my authentication request use exec? Thanks, Craig <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
On 03/21/2011 08:51 PM, Craig Smith wrote:
Hi again,
Okay, I have everything running, but I have one more question.
Is there a way to adjust the timeout of the scripts being exec?
I get the following error. I'm looking to make the timeout around 40 seconds.
That's way, way, way too long. You should be worried if it's taking longer than about 1 second.
Again, perl is not my specialty, but spawn a background watchdog process that sleeps 40 seconds than kills the parent if it is still alive. Similarly, have the parent kill the child (watchdog) just before it exits if it completes its task. -the other craig ----- Original Message ----- From: Craig Smith To: freeradius-users@lists.freeradius.org Sent: Monday, March 21, 2011 4:51 PM Subject: Re: $75.00 USD Bounty Hi again, Okay, I have everything running, but I have one more question. Is there a way to adjust the timeout of the scripts being exec? I get the following error. I'm looking to make the timeout around 40 seconds. Error: Child PID 16599 is taking too much time: forcing failure and killing child. Thanks, Craig On Mon, Mar 21, 2011 at 12:27 PM, Craig Smith <craigesmith@gmail.com> wrote: Alan, I am also finding the documentation semi helpful. So I put: exec { program = "/path/to/program/exec-program-wait" <-- I know I need to change this wait = yes input_pairs = request output_pairs = reply } In /etc/freeradius/modules/exec. Now how do make my authentication request use exec? Thanks, Craig ------------------------------------------------------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________ Information from ESET Smart Security, version of virus signature database 5972 (20110321) __________ The message was checked by ESET Smart Security. http://www.eset.com __________ Information from ESET Smart Security, version of virus signature database 5972 (20110321) __________ The message was checked by ESET Smart Security. http://www.eset.com
participants (5)
-
Alan DeKok -
Craig Campbell -
Craig Smith -
Gary Gatten -
Phil Mayers