Пытаюсь решить следующую задачку.
Есть mikrotik с поднятым pptp сервером и стоит проверка через радиус.
Необходимо чтобы любой пользователь с любым паролем проходил проверку на Радиус сервере.
Пытался реализовать через rlm_perl, но вылазит ошибка rlm_perl: ERROR: Failed to create pair Event-Timestamp = ▒?о▒? 17 2011 10:33:02 MSK
на стадии accounting через перл скрипт.
use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK
);
use Data::Dumper;
# This is hash wich hold original request from radius
my %RAD_REQUEST;
# In this hash you add values that will be returned to NAS.
my %RAD_REPLY;
#This is for check items
my %RAD_CHECK;
use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */
use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */
use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */
use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */
use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */
use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */
use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */
use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */
use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */
use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */
sub authorize {
# For debugging purposes only
# &log_request_attributes;
# Here's where your authorization code comes
# You can call another function from here:
#&test_call;
return RLM_MODULE_OK;
}
sub authenticate {
# For debugging purposes only
&log_request_attributes;
if ($RAD_REQUEST{'User-Name'} =~ /^no/i) {
# Reject user and tell him why
$RAD_REPLY{'Reply-Message'} = "Denied access by rlm_perl function";
return RLM_MODULE_REJECT;
} else {
# Accept user and set some attribute
$RAD_REPLY{'Packet-Type'} = "Access-Accept";
$RAD_REPLY{'Framed-IP-Address'} = "10.225.245.125";
$RAD_REPLY{'Framed-Protocol'} = "ppp";
return RLM_MODULE_OK;
}
}
sub accounting {
return RLM_MODULE_OK;
}
FreeRadius -x
rad_recv: Accounting-Request packet from host 172.27.65.70 port 49361, id=108, length=183
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 38
NAS-Port-Type = Virtual
User-Name = "test"
Calling-Station-Id = "172.27.65.210"
Called-Station-Id = "172.27.65.70"
Acct-Session-Id = "81800020"
Framed-IP-Address = 0.0.0.0
Acct-Authentic = RADIUS
Event-Timestamp = "Ноя 17 2011 10:33:02 MSK"
Acct-Session-Time = 0
Acct-Input-Octets = 0
Acct-Input-Gigawords = 0
Acct-Input-Packets = 0
Acct-Output-Octets = 10
Acct-Output-Gigawords = 0
Acct-Output-Packets = 1
Acct-Status-Type = Stop
Acct-Terminate-Cause = User-Request
NAS-Identifier = "MikroTik"
NAS-IP-Address = 172.27.65.70
Acct-Delay-Time = 0
# Executing section preacct from file /etc/freeradius/radiusd.conf
+- entering group preacct {...}
++[preprocess] returns ok
# Executing section accounting from file /etc/freeradius/radiusd.conf
+- entering group accounting {...}
[acct_unique] Hashing 'NAS-Port = 38,Client-IP-Address = 172.27.65.70,NAS-IP-Address = 172.27.65.70,Acct-Session-Id = "81800020",User-Name = "test"'
[acct_unique] Acct-Unique-Session-ID = "307a9a7007fe51de".
++[acct_unique] returns ok
rlm_perl: Added pair Acct-Input-Octets = 0
rlm_perl: Added pair NAS-Port-Type = Virtual
rlm_perl: Added pair Acct-Session-Id = 81800020
rlm_perl: Added pair Acct-Output-Gigawords = 0
rlm_perl: Added pair Service-Type = Framed-User
rlm_perl: Added pair Acct-Unique-Session-Id = 307a9a7007fe51de
rlm_perl: Added pair Called-Station-Id = 172.27.65.70
rlm_perl: Added pair Acct-Authentic = RADIUS
rlm_perl: Added pair Acct-Status-Type = Stop
rlm_perl: Added pair Acct-Output-Packets = 1
rlm_perl: Added pair NAS-IP-Address = 172.27.65.70
rlm_perl: Added pair Acct-Output-Octets = 10
rlm_perl: Added pair Acct-Terminate-Cause = User-Request
rlm_perl: Added pair Acct-Session-Time = 0
rlm_perl: Added pair Calling-Station-Id = 172.27.65.210
rlm_perl: Added pair Framed-Protocol = PPP
rlm_perl: Added pair User-Name = test
rlm_perl: Added pair NAS-Identifier = MikroTik
rlm_perl: ERROR: Failed to create pair Event-Timestamp = ▒?о▒? 17 2011 10:33:02 MSK
rlm_perl: Added pair Acct-Input-Gigawords = 0
rlm_perl: Added pair Framed-IP-Address = 0.0.0.0
rlm_perl: Added pair Acct-Input-Packets = 0
rlm_perl: Added pair NAS-Port = 38
rlm_perl: Added pair Acct-Delay-Time = 0
++[perl] returns ok
[detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/172.27.65.70/detail-20111117
[detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/172.27.65.70/detail-20111117
[detail] expand: %t -> Thu Nov 17 10:34:22 2011
++[detail] returns ok
Sending Accounting-Response of id 108 to 172.27.65.70 port 49361
Finished request 2.
Cleaning up request 2 ID 108 with timestamp +6
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 106 with timestamp +6
Ready to process requests.
Пример отсюда http://wiki.freeradius.org/Rlm_perl
Может можно без Rlm_perl поставленную задачу - опыта работы с этим модулем никакого.
