<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Arial, sans-serif" size="2">
<div>Hi,</div>
<div> </div>
<div>I have a little problem with devices in multiple huntgroups.</div>
<div>By now i kno that this is not possible (rtfm helped ;-)</div>
<div> </div>
<div>What i wanted to do is the following:</div>
<div> </div>
<div>Two Teams, but with diffenrent rights.</div>
<div> </div>
<div>Users:</div>
<div>====================</div>
<div>DEFAULT Auth-Type := LDAP, Huntgroup-Name == "nexus", LDAP-Group == "<Team-1-Group>"</div>
<div> Login-Service = Telnet,</div>
<div> Cisco-AVPair = "shell:roles*\"network-admin\" \"vdc-admin\""</div>
<div> </div>
<div>DEFAULT Auth-Type := LDAP, Huntgroup-Name == "readonly-nexus", LDAP-Group == "<Team-2-Group>"</div>
<div> Login-Service = Telnet,</div>
<div> Cisco-AVPair = "shell:roles*\"network-operator\" \"vdc-operator\""</div>
<div> </div>
<div>Huntgroups:</div>
<div>====================</div>
<div>readonly-nexus NAS-IP-Address == 192.168.11.123</div>
<div>Nexus NAS-IP-Address == 192.168.11.123</div>
<div> </div>
<div> </div>
<div>Since only the first match within the huntgroups is checked, team-2 always gets "access-reject".</div>
<div> </div>
<div> </div>
<div>For checking only the NAS-IP-Adress makes sense in our environment.</div>
<div>I already found a hint to use rlm-passwd, but i canīt get this run.</div>
<div> </div>
<div>So i tried the following:</div>
<div> </div>
<div>=======================</div>
<div>Users:</div>
<div>DEFAULT Auth-Type := LDAP, Huntgroup-Name == "nexus", <font face="Courier New, monospace">My-Device-Group</font><font face="Courier New, monospace"> "</font>Nexus-readonly", LDAP-Group == "<Team-2-Group>"</div>
<div> Login-Service = Telnet,</div>
<div> Cisco-AVPair = "shell:roles*\"network-operator\" \"vdc-operator\""</div>
<div> </div>
<div>modules/passwd:</div>
<div><font face="Courier New, monospace">passwd <font face="Arial, sans-serif">Groups_local </font>{<br>
filename = /etc/<font face="Courier New, monospace">raddb/groups_local<br>
</font>format = "My-Device-Group:*<font face="Arial, sans-serif">NAS-IP-Address</font>"<br>
hashsize = 50<br>
ignorenislike = <font face="Courier New, monospace">no<br>
</font>allowmultiplekeys = <font face="Courier New, monospace">no<br>
</font>delimiter = ":"<br>
}</font></div>
<div><font face="Courier New, monospace"> </font></div>
<div><font face="Courier New, monospace">groups_local:</font></div>
<div>Nexus-readonly:192.168.11.123</div>
<div> </div>
<div>dictionary:</div>
<div>ATTRIBUTE My-Device-Group 3000 string</div>
<div> </div>
<div>=======================</div>
<div> </div>
<div>Groups_local was placed in authorize section, after preprocess.</div>
<div> </div>
<div>Debug shows:</div>
<div> </div>
<div>Ready to process requests.</div>
<div>rad_recv: Access-Request packet from host 192.168.11.123 port 48910, id=20, length=62</div>
<div> User-Name = "test"</div>
<div> User-Password = "test"</div>
<div> NAS-Port-Type = Virtual</div>
<div> NAS-Port = 3000</div>
<div> NAS-IP-Address = 192.168.11.123</div>
<div>+- entering group authorize {...}</div>
<div>++[preprocess] returns ok</div>
<div>++[groups_local] returns notfound</div>
<div> </div>
<div>Any Idea?</div>
<div>Or is there a big bug in my config (and my mind)?</div>
<div>Thanks!</div>
<div> </div>
<div>Jan</div>
<div> </div>
<div> </div>
</font>
</body>
</html>