On Wed, Apr 15, 2009 at 5:06 PM, Kenneth Grady
<klg@lanl.gov> wrote:
If you don't want LDAP to authenticate your mac addresses you need to
set the Auth-Type before it gets set to ldap.
You can do that a number of ways (I use #3)
1) try macs in the users file
00:1f:3a:21:62:f8 ClearText-Password := "00:1f:3a:21:62:f8"
or
DEFAULT User-Name =~
"^00:1f:3a:[a-fA-F0-9][a-fA-F0-9]:[a-fA-F0-9][a-fA-F0-9]:[a-fA-F0-9][a-fA-F0-9]$",
Auth-Type := Accept
2) or add mac addresses in your mysql database
INSERT INTO radcheck VALUES
(null,"${MAC-Address}","ClearText-Password",":=","${MAC-Address}");
or
INSERT INTO radcheck VALUES
(null,"${MAC-Address}","Auth-Type",":=","Accept");
3) a combination of put the DEFAULT and all MAC-Addresses in the mysql
database and don't have ldap set the Auth-Type
INSERT INTO radgroupcheck values (null,"DEFAULT","Auth-Type",":=","LDAP");
INSERT INTO radusergroup VALUES ("DEFAULT","DEFAULT",1);
INSERT INTO radgroupcheck values (null,"MAC","Auth-Type",":=","Accept");
#for each MAC you want to accept replace the 00: with your mac addresses
INSERT INTO radusergroup VALUES ("00:00:00:00:00:00","MAC",1);
DELETE FROM radusergroup where username ="00:00:00:00:00:00";
and in modules/ldap
ldap {
...
set_auth_type = no
}