Hi all,
I’m currently working on a fresh FreeRadius 2.x install, in order to separate Radius auth for Administrators (Firewall, Routeurs & Switchs administration) and Customers access (VPN SSL / IPSec).
My first try was to rewrite all the config into virtual servers (previously, all was written into radiusd.conf
L).
So what I did :
[root@server /etc/raddb]$ ll sites-enabled/
total 0
lrwxrwxrwx. 1 root root 33 Mar 19 12:01 administrator -> /etc/raddb/sites-available/administrator
lrwxrwxrwx. 1 root root 43 Mar 26 18:16 customer -> /etc/raddb/sites-available/coreye_customers
This is my two VS :
server administrator {
# Authenticate / Authorize listener
listen {
ipaddr = *
port = 1600
type = auth
}
# Accounting listener
listen {
ipaddr = *
port = 1601
type = acct
}
[…]
server customer {
# Authenticate / Authorize listener
listen {
ipaddr = *
port = 1602
type = auth
}
# Accounting listener
listen {
ipaddr = *
port = 1603
type = acct
}
[…]
And in order to proxy, I want to forward using proxy depending realm (proxy.conf)
realm ".*customer$" {
virtual_server = customer
}
realm ".*admin$" {
virtual_server = administrator
}
realm NULL {
virtual_server = administrator
}
But when logging into Radius, it works for VS Administrator (login admin or user@admin), but if I try using login@customer, it’s never proxy to virtual server customer.
I tried different methods always shown in the mailing list, but no way, it’s never working …
Proxy to realm into authorize section :
if (Realm == customer) {
update control {
Proxy-To-Realm := customer
}
}
Not working … The request is always managed by administrator vs.
Always played using dynamic clients example and FreeRADIUS-Client-Virtual-Server = "customer", but not working again.
I suspect the problem located in my NAS MySQL table, where “server” column is forced to virtual server “administrator”
Is anything I missed to do ? What’s the best solution to do this kind of configuration when nas are stored in MySQL DB, and some of the nas clients could be used by different virtual servers ? What the is the best way
to have a single radius IP server, and two different virtual servers with two different set of rules ?
Thanks in advance for your help !
Fabien VINCENT