Freeradius + External PHP script

X.x - x.X mayday64 at
Sat Feb 6 23:18:11 CET 2010

Hello everyone :)

I'm having some problems with Freeradius, which I'm sure some folks here will know how to solve. :)

Version: 2.0.4 (debian custom build to support SSL)

Objective: Upon receiving a request with a username & password (from NAS), Freeradius should invoke an external script (PHP in this case). Script should look-up the username/password, and based on some internal logic return an Access-Accept or Access-Reject. In case of a Access-Accept, script should also provide some VLAN information. Prefered method is EAP/TTLS.

I haven't been able to find much info on this subject (maybe I'm looking in wrong place?). This is what I have so far (only the important parts):

exec php {
  wait = yes
  program = "/usr/bin/php -f myscript.php"
  input_pairs = request
  output_pairs = reply

authenticate {
  Auth-Type TEST {

DEFAULT    Auth-Type := TEST

*myscript.php* (simplified version)
  $user = getenv("USER_NAME");
  $password = getenv("USER_PASSWORD");
  if ($user == "test" && $password == "test") {
     echo "Access-Accept";
     echo "Tunnel-Type = 13,"
     echo "Tunnel-Medium-Type = 6,"
     echo "Tunnel-Private-Group-Id = 1"
     echo "Access-Reject";

The echo-part in myscript.php is obviously wrongly implemented, so please help..

With the above mentioned, invoking the script works, but always returns Access-Accepted packet (testing with radtest utility).
Hotmail: Free, trusted and rich email service.

More information about the Freeradius-Users mailing list