<font face="tahoma,sans-serif">Hi Russel,<br><br>So we have LDAP auth here. At this time it works fine. But now we want to added 2 auth, so for example like we want to check the valid user id / password from LDAP and also the MAC address listed from the user attribute in the LDAP.<br>
<br>The ldap attribute mapped properly : <br>checkItem Called-Station-Id radiusCalledStationId<br>checkItem Calling-Station-Id radiusCallingStationId<br><br><br>so the goal is to make sure that the user is only login from his / her company device that associated with their user profile in LDAP. I already make sure that the user have the attribute </font><font face="tahoma,sans-serif"><font face="tahoma,sans-serif">radiusCallingStationId</font> set correctly.<br>
<br>Thanks<br>Danny<br></font><br><div class="gmail_quote">On Wed, Mar 13, 2013 at 7:08 PM, Russell Mike <span dir="ltr"><<a href="mailto:radius.sir@gmail.com" target="_blank">radius.sir@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><font face="comic sans ms, sans-serif">Hi Dan, </font><div><font face="comic sans ms, sans-serif">What Reject ? And MAC address listed where? Are you working around MAC authentication? FR MAC auth is working for me, I use CoovaChilli as NAS. </font></div>
<div><font face="comic sans ms, sans-serif"><br></font></div><div><font face="comic sans ms, sans-serif">0.) </font><span style="font-family:'comic sans ms',sans-serif">MAc address would exist as user in MySQL DB or file</span></div>
<div><font face="comic sans ms, sans-serif">1.) Configure NAS to send MAC-Addr as username to Freeradius </font></div><div><font face="comic sans ms, sans-serif">2.) </font><span style="font-family:'comic sans ms',sans-serif">And do the following at Freeradius side. </span></div>
<div><span style="font-family:'comic sans ms',sans-serif;font-size:x-small;white-space:pre-wrap">username="<mac address>";attribute="Auth-</span><span style="font-family:'comic sans ms',sans-serif;font-size:x-small;white-space:pre-wrap">Type";op=":=";value="Accept"</span><br>
</div><div><font face="comic sans ms, sans-serif"><br></font></div><div><font face="comic sans ms, sans-serif">Thanks / Regards</font></div><div><span class="HOEnZb"><font color="#888888"><font face="comic sans ms, sans-serif">RM --<br>
</font></font></span><div><div class="h5"><div class="gmail_extra">
<br><br><div class="gmail_quote">On Wed, Mar 13, 2013 at 10:49 AM, Danny Kurniawan <span dir="ltr"><<a href="mailto:danny.kurniawan@fairchildsemi.com" target="_blank">danny.kurniawan@fairchildsemi.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><font face="tahoma,sans-serif">Hi Russel,<br><br>Thanks for that. However it seems the check-name cant even populated. as you can see from my log file.<br>
<br>+- entering group authorize {...}<br>++[preprocess] returns ok<br>
rlm_checkval: Item Name: Calling-Station-Id, Value: A0-88-B4-0F-C3-D8<div><br>rlm_checkval: <b>Could not find attribute named </b></div></font><font face="tahoma,sans-serif"><b><font face="tahoma,sans-serif">Calling-Station-Id</font> in check pairs</b><br>
++[checkval] returns notfound<br>[auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/<a href="http://172.21.118.231/auth-detail-20130313" target="_blank">172.21.118.231/auth-detail-20130313</a><br>
[auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/<a href="http://172.21.118.231/auth-detail-20130313" target="_blank">172.21.118.231/auth-detail-20130313</a><br>
[auth_log] expand: %t -> Wed Mar 13 17:47:09 2013<br>
<br><br>I check the ldap.attrmap and its correctly mapped to the LDAP attribute.<br><br>So how to make sure that Radius reject the request when the MAC address is not listed.. thats what i want to achieve<br><br>Thanks<br>
Danny<br><br></font><div><div><br><div class="gmail_quote">On Wed, Mar 13, 2013 at 4:51 PM, Russell Mike <span dir="ltr"><<a href="mailto:radius.sir@gmail.com" target="_blank">radius.sir@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr"><font face="comic sans ms, sans-serif">checkval can helpful when you need to apply NAS-identifier & Calling-Station-Id - FR attributes.</font><div><font face="comic sans ms, sans-serif"><br></font></div>
<div><div><font face="comic sans ms, sans-serif">checkval calledstationid {</font></div><div><font face="comic sans ms, sans-serif"> item-name = Called-Station-Id</font></div><div><font face="comic sans ms, sans-serif"> check-name = Called-Station-Id</font></div>
<div><font face="comic sans ms, sans-serif"> data-type = string</font></div><div><font face="comic sans ms, sans-serif"> notfound-reject = no</font></div><div><font face="comic sans ms, sans-serif">}</font></div>
<div><font face="comic sans ms, sans-serif"><br></font></div><div><font face="comic sans ms, sans-serif"><br></font></div><div><font face="comic sans ms, sans-serif">checkval nasidentifier {</font></div><div><font face="comic sans ms, sans-serif"> item-name = NAS-Identifier</font></div>
<div><font face="comic sans ms, sans-serif"> check-name = NAS-Identifier</font></div><div><font face="comic sans ms, sans-serif"> data-type = string</font></div><div><font face="comic sans ms, sans-serif"> notfound-reject = no</font></div>
<div><font face="comic sans ms, sans-serif">}</font></div><div><font face="comic sans ms, sans-serif"><br></font></div><div><font face="comic sans ms, sans-serif"><br></font></div><div><font face="comic sans ms, sans-serif">Thanks / Regards</font></div>
<div><font face="comic sans ms, sans-serif">RM --</font></div><div><br></div><div class="gmail_extra"><br><br><div class="gmail_quote"><div><div>On Wed, Mar 13, 2013 at 7:53 AM, Danny Kurniawan <span dir="ltr"><<a href="mailto:danny.kurniawan@fairchildsemi.com" target="_blank">danny.kurniawan@fairchildsemi.com</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div><font face="tahoma,sans-serif">Hi All.<br>
<br>I found this error when enabled checkval<br>
<br>rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs<br>++[checkval] returns notfound<br>++[expiration] returns noop<br>
<br>What is the meaning of that error?<br><br>Thanks in advance<span><font color="#888888"><br clear="all"></font></span></font><span><font color="#888888"><br>-- <br><div><font face="tahoma, sans-serif">Best Regards,</font></div>
<div><font face="tahoma, sans-serif">Danny</font></div>
</font></span><br></div></div>-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br></div></div></div>
<br>-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br><br clear="all"><br></div></div><span><font color="#888888">-- <br>
<div><font face="tahoma, sans-serif">Best Regards,</font></div>
<div><font face="tahoma, sans-serif">Danny</font></div>
</font></span><br>-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br></div></div></div></div></div>
<br>-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br><br clear="all"><br>-- <br><div><font face="tahoma, sans-serif">Best Regards,</font></div>
<div><font face="tahoma, sans-serif">Danny</font></div>