AW: Devices in more than one huntgroup

31 Aug 2011

      ...
Thanks for the answer!
But there are several problems for me:
- i have no access to ldap, new groups are not as easy to implement as in small environments
- i already have more than 20 DEFAULT-entries for different huntgroup/ldap-group combinations
 and splitting nexus to nexus_RO and nexus_RW means adding additional 5 entries minimum
 I´m searching for a more scalable solution. If the next team should get access to different
 devices, and then the third team to a third group of devices, or other rights...
Hi,

In this thread i found a hint for my config:

http://freeradius.1045715.n5.nabble.com/huntgroups-question-td2756193.html

"The huntgroups are a bit of a hack for backwards compatibility going
back almost a decade. For 2000 machines, I would suggest using
rlm_passwd. See the "man rlm_passwd" page for an example of setting up
groups based on User-Name. The same method can be used to set up groups
based on Client-IP-Address. You then have groups controlled by a flat
text file, which is pretty easy to manage."

passwd groups_local {
        filename = /etc/raddb/groups_local
        format = "~My-Device-Group:*NAS-IP-Address"
        hashsize = 50
        ignorenislike = no
        allowmultiplekeys = no
        delimiter = ":"
}

Groups_local:
readonly:127.0.0.1

Groups_local is called in section "authorize" just after "preprocess".

I always got "returs notfound". If i add User-Name to the config, it´s working.
But i didn´t want to check the username, i just want to add an other flag (My-Device-Group)
additional to huntgroups.

So, how should it work?

Thanks!

Jan

[root@vm-test raddb]# radiusd -X
FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License v2.
Starting - reading configuration files ...
including configuration file /etc/raddb/radiusd.conf
including configuration file /etc/raddb/clients.conf
including files in directory /etc/raddb/modules/
including configuration file /etc/raddb/modules/linelog
including configuration file /etc/raddb/modules/sqlcounter_expire_on_login
including configuration file /etc/raddb/modules/sql_log
including configuration file /etc/raddb/modules/logintime
including configuration file /etc/raddb/modules/unix
including configuration file /etc/raddb/modules/ippool
including configuration file /etc/raddb/modules/expiration
including configuration file /etc/raddb/modules/chap
including configuration file /etc/raddb/modules/detail.log
including configuration file /etc/raddb/modules/checkval
including configuration file /etc/raddb/modules/attr_rewrite
including configuration file /etc/raddb/modules/mac2vlan
including configuration file /etc/raddb/modules/detail
including configuration file /etc/raddb/modules/pap
including configuration file /etc/raddb/modules/acct_unique
including configuration file /etc/raddb/modules/perl
including configuration file /etc/raddb/modules/ldap
including configuration file /etc/raddb/modules/realm
including configuration file /etc/raddb/modules/detail.example.com
including configuration file /etc/raddb/modules/digest
including configuration file /etc/raddb/modules/radutmp
including configuration file /etc/raddb/modules/pam
including configuration file /etc/raddb/modules/passwd
including configuration file /etc/raddb/modules/inner-eap
including configuration file /etc/raddb/modules/policy
including configuration file /etc/raddb/modules/counter
including configuration file /etc/raddb/modules/always
including configuration file /etc/raddb/modules/smbpasswd
including configuration file /etc/raddb/modules/echo
including configuration file /etc/raddb/modules/mac2ip
including configuration file /etc/raddb/modules/exec
including configuration file /etc/raddb/modules/cui
including configuration file /etc/raddb/modules/otp
including configuration file /etc/raddb/modules/etc_group
including configuration file /etc/raddb/modules/files
including configuration file /etc/raddb/modules/smsotp
including configuration file /etc/raddb/modules/attr_filter
including configuration file /etc/raddb/modules/mschap
including configuration file /etc/raddb/modules/expr
including configuration file /etc/raddb/modules/sradutmp
including configuration file /etc/raddb/modules/wimax
including configuration file /etc/raddb/modules/preprocess
including files in directory /etc/raddb/sites-enabled/
including configuration file /etc/raddb/sites-enabled/default
group = radiusd
user = radiusd
including dictionary file /etc/raddb/dictionary
main {
        prefix = "/usr"
        localstatedir = "/var"
        logdir = "/var/log/radius"
        libdir = "/usr/lib/freeradius"
        radacctdir = "/var/log/radius/radacct"
        hostname_lookups = no
        max_request_time = 30
        cleanup_delay = 5
        max_requests = 1024
        allow_core_dumps = no
        pidfile = "/var/run/radiusd/radiusd.pid"
        checkrad = "/usr/sbin/checkrad"
        debug_level = 0
        proxy_requests = no
 log {
        stripped_names = no
        auth = yes
        auth_badpass = no
        auth_goodpass = no
 }
 security {
        max_attributes = 200
        reject_delay = 1
        status_server = yes
 }
}
radiusd: #### Loading Realms and Home Servers ####
radiusd: #### Loading Clients ####
 client localhost {
        ipaddr = 127.0.0.1
        require_message_authenticator = no
        secret = "testing123"
        nastype = "other"
 }
radiusd: #### Instantiating modules ####
 instantiate {
 Module: Linked to module rlm_exec
 Module: Instantiating exec
  exec {
        wait = no
        input_pairs = "request"
        shell_escape = yes
  }
 Module: Linked to module rlm_expr
 Module: Instantiating expr
 }
radiusd: #### Loading Virtual Servers ####
server {
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Linked to module rlm_pap
 Module: Instantiating pap
  pap {
        encryption_scheme = "auto"
        auto_header = no
  }
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_preprocess
 Module: Instantiating preprocess
  preprocess {
        huntgroups = "/etc/raddb/huntgroups"
        hints = "/etc/raddb/hints"
        with_ascend_hack = no
        ascend_channels_per_line = 23
        with_ntdomain_hack = no
        with_specialix_jetstream_hack = no
        with_cisco_vsa_hack = no
        with_alvarion_vsa_hack = no
  }
 Module: Linked to module rlm_passwd
 Module: Instantiating groups_local
  passwd groups_local {
        filename = "/etc/raddb/groups_local"
        format = "~My-Device-Group:*NAS-IP-Address"
        delimiter = ":"
        ignorenislike = no
        ignoreempty = no
        allowmultiplekeys = no
        hashsize = 50
  }
rlm_passwd: nfields: 2 keyfield 1(NAS-IP-Address) listable: no
 Module: Linked to module rlm_files
 Module: Instantiating files
  files {
        usersfile = "/etc/raddb/users"
        acctusersfile = "/etc/raddb/acct_users"
        preproxy_usersfile = "/etc/raddb/preproxy_users"
        compat = "no"
  }
 Module: Checking preacct {...} for more modules to load
 Module: Linked to module rlm_acct_unique
 Module: Instantiating acct_unique
  acct_unique {
        key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
  }
 Module: Checking accounting {...} for more modules to load
 Module: Linked to module rlm_detail
 Module: Instantiating detail
  detail {
        detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
        header = "%t"
        detailperm = 384
        dirperm = 493
        locking = no
        log_packet_header = no
  }
 Module: Linked to module rlm_attr_filter
 Module: Instantiating attr_filter.accounting_response
  attr_filter attr_filter.accounting_response {
        attrsfile = "/etc/raddb/attrs.accounting_response"
        key = "%{User-Name}"
  }
 Module: Checking session {...} for more modules to load
 Module: Linked to module rlm_radutmp
 Module: Instantiating radutmp
  radutmp {
        filename = "/var/log/radius/radutmp"
        username = "%{User-Name}"
        case_sensitive = yes
        check_with_nas = yes
        perm = 384
        callerid = yes
  }
 Module: Checking pre-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 Module: Instantiating attr_filter.access_reject
  attr_filter attr_filter.access_reject {
        attrsfile = "/etc/raddb/attrs.access_reject"
        key = "%{User-Name}"
  }
 } # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
        type = "auth"
        ipaddr = *
        port = 0
}
listen {
        type = "acct"
        ipaddr = *
        port = 0
}
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1 port 48047, id=120, length=56
        User-Name = "test"
        User-Password = "test"
        NAS-IP-Address = 127.0.0.1
        NAS-Port = 10
+- entering group authorize {...}
++[preprocess] returns ok
++[groups_local] returns notfound
[files] users: Matched entry test at line 4
++[files] returns ok
++[pap] returns updated
Found Auth-Type = PAP
+- entering group PAP {...}
[pap] login attempt with password "test"
[pap] Using clear text password "test"
[pap] User authenticated successfully
++[pap] returns ok
Login OK: [test] (from client localhost port 10)
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 120 to 127.0.0.1 port 48047
        Reply-Message = "Login OK"
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 120 with timestamp +1
Ready to process requests.

AW: Devices in more than one huntgroup

Jan.Weiss＠t-systems.com