Hello everyone,

i know this might be considered a bizarre situation but well... i was just wondering if it's possible to do such a thing.

 

I'm in a situation now where i can successfully retrieve group membership of users in the active directory LDAP tree using rlm_ldap, and check them against files.

 

so if i have a user with "memberOf" attribute set to groupA

and i set in the raddb/users the following entry:

 

DEFAULTLdap-Group == "groupA", Auth-Type := Reject

Reply-Message = "Not Allowed."

 

i successfully deny access to that user.

 

Since i'm already using MySQL for storing accounting informations i was really interested in being able to use the same backend (mysql) also for performing checks against groups.

 

If i perform checks against usernames using the table radcheck they work properly (users retrieved from the LDAP backend), i've tried setting a radcheck like the following:

userA Max-Daily-Session := 7200

 

and after 2 hours the user is unable to authenticate to the NAS because the time allowed has expired.

 

 

But i cant seem to be able to do the same thing with the groups.

 

i've configured sites-enabled/default like this:

 

authorize {

preprocess

auth_log

chap

mschap

digest

suffix

eap {

ok = return

}

files

ldap

sql

expiration

logintime

pap

dailycounter

}

 

authenticate {

Auth-Type PAP {

pap

}

 

Auth-Type CHAP {

chap

}

 

Auth-Type MS-CHAP {

mschap

}

 

digest

unix

 

Auth-Type LDAP {

ldap

}

 

eap

}

 

preacct {

preprocess

acct_unique

suffix

files

}

 

accounting {

detail

sql

}

 

session {

radutmp

}

 

 

post-auth {

ldap

exec

Post-Auth-Type REJECT {

# log failed authentications in SQL, too.

attr_filter.access_reject

}

}

 

pre-proxy {

}

 

post-proxy {

eap

}

 

radiusd.conf like this

prefix = /usr

exec_prefix = /usr

sysconfdir = /etc

localstatedir = /var

sbindir = ${exec_prefix}/sbin

logdir = /var/log/freeradius

raddbdir = /etc/freeradius

radacctdir = ${logdir}/radacct

 

name = freeradius

 

confdir = ${raddbdir}

run_dir = ${localstatedir}/run/${name}

 

db_dir = ${raddbdir}

 

libdir = /usr/lib/freeradius

 

pidfile = ${run_dir}/${name}.pid

 

user = freerad

group = freerad

 

max_request_time = 30

 

cleanup_delay = 5

 

max_requests = 1024

 

listen {

type = auth

ipaddr = *

port = 0

}

 

listen {

ipaddr = *

port = 0

type = acct

}

 

hostname_lookups = no

 

allow_core_dumps = no

 

regular_expressions= yes

extended_expressions= yes

 

log {

destination = files

file = ${logdir}/radius.log

syslog_facility = daemon

stripped_names = no

auth = no

auth_badpass = no

auth_goodpass = no

}

 

checkrad = ${sbindir}/checkrad

 

security {

max_attributes = 200

reject_delay = 1

status_server = yes

}

 

proxy_requests  = yes

$INCLUDE proxy.conf

 

$INCLUDE clients.conf

 

thread pool {

start_servers = 5

max_servers = 32

min_spare_servers = 3

max_spare_servers = 10

max_requests_per_server = 0

}

 

modules {

$INCLUDE ${confdir}/modules/

$INCLUDE eap.conf

$INCLUDE sql.conf

$INCLUDE sql/mysql/counter.conf

}

 

instantiate {

exec

expr

expiration

logintime

}

 

and sql.conf

 

sql {

        database = "mysql"

        driver = "rlm_sql_${database}"

        server = "localhost"

        #port = 3306

        login = "radius"

        password = "<removed>"

        radius_db = "radius"

        acct_table1 = "radacct"

        acct_table2 = "radacct"

        postauth_table = "radpostauth"

        authcheck_table = "radcheck"

        authreply_table = "radreply"

        groupcheck_table = "radgroupcheck"

        groupreply_table = "radgroupreply"

        usergroup_table = "radusergroup"

        deletestalesessions = yes

        sqltrace = no

        sqltracefile = ${logdir}/sqltrace.sql

        num_sql_socks = 5

        connect_failure_retry_delay = 60

        lifetime = 0

        max_queries = 0

        nas_table = "nas"

        $INCLUDE sql/${database}/dialup.conf

        $INCLUDE sql/${database}/counter.conf

}

 

any help is really welcome.

thanks and sorry if i couldn't explain myself properly please correct me.

 

----
Caselle da 1GB, trasmetti allegati fino a 3GB e in piu' IMAP, POP3 e SMTP autenticato? GRATIS solo con Email.it

Sponsor:
SUPERMARIO: Acquista Peluche e T-shirt Originali su mistercupido.com
Clicca qui