<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1561" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>I have freeradius serwer with PEAP auth. secrets of
nasnames and user passwords are in mysql.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Is it possible to set freeradius to send
Access-Accept only where user try to connect to specified access point? I try to
check it by sql query modified by me.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> sql: authorize_check_query = "SELECT r.id,
r.UserName, r.Attribute, r.Value,
r.op FROM radcheck
r WHERE r.Username =
'%{SQL-User-Name}'
and ('%{NAS-IP-Address}' = 'aaaaaaaaaa')"</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>When sql gets the password from sql where is no
desired value of NAS-IP-Address attribute, so I don't know how to check it by
sql.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Example, this is ONE packet of
Access-Request:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>rad_recv: Access-Request packet from host
10.10.10.123:2048, id=247,
length=261<BR> User-Name = "Adam
Nowak"<BR> NAS-IP-Address =
10.10.10.123<BR>(...)</FONT></DIV>
<DIV><FONT face=Arial size=2>rlm_sql (sql): sql_set_user escaped user -->
'Adam Nowak'<BR>radius_xlat: 'SELECT r.id, r.UserName, r.Attribute,
r.Value, r.op FROM
radcheck r WHERE
r.Username = 'Adam
Nowak' and
('10.10.10.123' = 'aaaaaaaaaa') // YOU CAN SEE NAS-IP-Address here, but Adam
Nowak is not the eap-peap login...</FONT></DIV>
<DIV><FONT face=Arial size=2>(...)</FONT></DIV>
<DIV><FONT face=Arial size=2> rlm_eap_peap: EAPTLS_OK<BR>
rlm_eap_peap: Session established. Decoding tunneled attributes.<BR>
rlm_eap_peap: Identity - wlxtbp - // THIS IS THE CORRECT LOGIN...<BR>
rlm_eap_peap: Tunneled data is valid.<BR> PEAP: Got tunneled identity of
wlxtbp<BR> PEAP: Setting default EAP type for tunneled EAP
session.<BR> PEAP: Setting User-Name to wlxtbp<BR>(...)</FONT></DIV>
<DIV><FONT face=Arial size=2>rlm_sql (sql): sql_set_user escaped user -->
'wlxtbp'<BR>radius_xlat: 'SELECT r.id, r.UserName, r.Attribute, r.Value,
r.op FROM radcheck
r WHERE r.Username =
'wlxtbp' and
('127.0.0.1' = 'aaaaaaaaaa' ) // YOU SEE 127.0.0.1 instead of desired
NAS-IP-Address here, so I can't check here from which access point the user try
to connect</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>This is the place, where freeradius gets password
from mysql and if the password is ok we can see:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> rlm_eap_peap: Received EAP-TLV
response.<BR> rlm_eap_peap: Tunneled data is valid.<BR>
rlm_eap_peap: Success<BR></FONT></DIV>
<DIV><FONT face=Arial size=2>My question is as I have written:
<DIV><FONT face=Arial size=2>Is it possible to set freeradius to send
Access-Accept only where user try to connect to specified access
point?</FONT></DIV>
<DIV>And how to do it ? :-).</DIV>
<DIV> </DIV>
<DIV>Norboro</DIV>
<DIV> </DIV></DIV></FONT></BODY></HTML>