tnt@kalik.net wrote:
Remove those entries in users file. They are bypassing password checking. If you want to accept only some ldap groups use unlang. Something like:
if(Ldap-Group == something || Ldap-Group == something_else) { ok } else { update control { Auth-Type := Reject } }
Yeah.. that may be a problem. Does freeradius 1.1.3 support unlang? This is a RHEL 5.3 install... I'm not aware of a trustable source for 2.x RPMs ...
Example is the default group membership query in raddb/modules/ldap.
I *think* that's what I have already.
Yes. Auth-Type LDAP needs to be set. If you force Auth-Type Accept in users file this will never be used.
Hrm... ok, understood.. So I need to figure out how to require the vpn group and reject if it isn't there...
Ivan Kalik Kalik Informatika ISP
-- --------------------------- Jason Frisvold xenophage0@gmail.com --------------------------- "I love deadlines. I like the whooshing sound they make as they fly by." - Douglas Adams