Thanks in this solution =) Just to report, I did your suggestion in filter policy, after "# reject mixed case e.g. UseRNaMe" and its working perfectly filter_username { if (&User-Name) { # # negando autenticacao de maquina # if (&User-Name =~ /\// ) { update request { &Module-Failure-Message += 'Rejected: host authentication not allowed' } reject }
The "Group" attribute checks Unix groups. Which usually don't have spaces in their names. About this.. I understood that. (maybe not, but let's try): For user "monitoramento" command "id monitoramento" shows: ........... 16777729(domain users),..........,10001(BUILTIN\users)
And this user hit this entry in users file: DEFAULT Group == "domain users", Simultaneous-Use := 2 Idle-Timeout := 300 So, then I tried to do the same with computers... Look: root@vp2-seg-008:/var/log/freeradius# id M50880 id: ‘M50880’: no such user root@vp2-seg-008:/var/log/freeradius# But, when I put "$": root@vp2-seg-008:/var/log/freeradius# id M50880$ uid=16884786(m50880$) gid=16777731(domain computers) groups=16777731(domain computers),16884786(m50880$) root@vp2-seg-008:/var/log/freeradius# And that’s why check for group domain computers does not work: lack of "$" Thanks a lot for the help! -----Mensagem original----- De: Freeradius-Users <freeradius-users-bounces+daniel.pena=mpdft.mp.br@lists.freeradius.org> Em nome de Alan DeKok Enviada em: terça-feira, 23 de junho de 2020 20:57 Para: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Assunto: Re: How to disable machine authentication On Jun 23, 2020, at 6:22 PM, Daniel Guimaraes Pena <daniel.pena@mpdft.mp.br> wrote:
Is it possible?
Yes.
I tried in users file:
Don't "try" things. Figure out what's going on, and write rules to match that,
# # Deny access for a group of users. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #DEFAULT Group == "disabled", Auth-Type := Reject # Reply-Message = "Your account has been disabled." # DEFAULT Group == "Domain Computers", Auth-Type := Reject
The "Group" attribute checks Unix groups. Which usually don't have spaces in their names.
Reply-Message = "Autenticacao de maquinas desabilitada."
DEFAULT Group == "TodasContasEspeciais", Auth-Type := Reject Reply-Message = "Autenticacao de contas de servico desabilitada."
Domain Computers doesnt work. TodasContasEspeciais Works fine.
Maybe. The debug output isn't clear.
Logs, if needed. (Sorry for another post so soon... I solved a lot of problems but some...)
Logs are almost always needed.
(83533) Received Access-Request Id 116 from 10.34.177.220:37268 to 10.34.242.3:1812 length 296 (83533) User-Name = "host/n65144.mpdft.gov.br"
Rejecting machine authentication is simple" authorize { ... if (User-Name =~ /^host\//) { reject } ... Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html