<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Eric Geier wrote:
<blockquote cite="mid:000001c96071$cb948910$62bd9b30$@com" type="cite">
<pre wrap="">Thank you for the info, David.
I think the following is an example of how this could work, which I googled:
</pre>
<blockquote type="cite">
<pre wrap="">client 212.37.57.2 {
secret = "%{sql:SELECT secret FROM accesspoints WHERE id =
</pre>
</blockquote>
<pre wrap=""><!---->%{raw:NAS-Identifier}}"
</pre>
<blockquote type="cite">
<pre wrap=""> shortname = "just one of our example networks"
}
</pre>
</blockquote>
<pre wrap=""><!---->
I'm thinking I could even just have one client entry like this...but set to
allow any IP. Is that possible?
</pre>
</blockquote>
clients.conf<br>
<br>
client 0.0.0.0/0, shared secret = "open" ...<br>
<br>
Why bother doing the SQL stuff, if you're going to let anyone use your
service anyway? Think about it ... clients.conf controls which APs/NAS'
are allowed to send you stuff to process. If your intention is to open
it for anyone that can reach your service, why then do the above? The
end clients are not what will send you requests, the APs are ....... I
think you've missed the point of the IP addressing for the end clients
versus how you wish to handle the APs ...<br>
<br>
And for a service which allows or denies access for your internal
users, I wouldn't personally allow anyone from the outside world even
get close to that service.<br>
<br>
You want to understand basic networking and security considerations
before seriously contemplating this.<br>
<br>
Start looking at getting a VPN solution between your offices, or simply
just put one FreeRADIUS box in each office.<br>
<br>
Continue on this path and fairly soon someone will have found your
wireless setup and the service which allows clients to authenticate
sitting out in the open. You might as well not have anything in place
at all then...<br>
<br>
//anders<br>
<blockquote cite="mid:000001c96071$cb948910$62bd9b30$@com" type="cite">
<pre wrap="">
This would prevent me from having to track Internet IP changes among the
multiple offices and locations where these separate WPA-Enterprise networks
will be located at.
Thanks! Eric
</pre>
<blockquote type="cite">
<pre wrap="">-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org">freeradius-users-bounces+me=egeier.com@lists.freeradius.org</a>
[<a class="moz-txt-link-freetext" href="mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org">mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org</a>] On
Behalf Of wlanmac
Sent: Wednesday, December 17, 2008 8:42 AM
To: <a class="moz-txt-link-abbreviated" href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>
Subject: Re: Duplicate IPs for Radius Clients with different secrets
It's easy! Just google for rlm_raw and use it with a SQL xlat rule to
pick out the shared secret from a database. I have been doing this way
for years... in FreeRADIUS v1 and v2.
David
coova.org
</pre>
<blockquote type="cite">
<pre wrap="">Date: Wed, 17 Dec 2008 10:16:17 +0200
From: Johan Meiring <a class="moz-txt-link-rfc2396E" href="mailto:jmeiring@pcservices.co.za"><jmeiring@pcservices.co.za></a>
Subject: Re: Duplicate IPs for Radius Clients with different secrets
To: FreeRadius users mailing list
<a class="moz-txt-link-rfc2396E" href="mailto:freeradius-users@lists.freeradius.org"><freeradius-users@lists.freeradius.org></a>
Message-ID: <a class="moz-txt-link-rfc2396E" href="mailto:4948B551.6030406@pcservices.co.za"><4948B551.6030406@pcservices.co.za></a>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Eric Geier wrote:
</pre>
<blockquote type="cite">
<pre wrap="">If I understand what you said, I would only need one IP entry (the
</pre>
</blockquote>
</blockquote>
<pre wrap="">Internet
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">IP) in the config file for each location, right?
Most of these locations will be using dynamic Internet IPs; I'm not
</pre>
</blockquote>
</blockquote>
<pre wrap="">sure
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">how'd I keep the config updated. Plus this would make each
</pre>
</blockquote>
</blockquote>
<pre wrap="">location/network
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">use the same shared secret among all their APs, which I want to
</pre>
</blockquote>
</blockquote>
<pre wrap="">prevent.
</pre>
<blockquote type="cite">
<pre wrap="">
Alan,
The Nas-Identifier being available to dynamic clients will also solve
Eric's problem.
Any update on when it might be available?
Thanks!
</pre>
</blockquote>
</blockquote>
</blockquote>
<br>
</body>
</html>