David Bailey wrote:
The problem is that although I have some 250 client definitions in clients.conf, I'd rather avoid using 250 definitions in users.
I'm trying to find a way to categorize the RADIUS clients into Cisco, HP, etc.
You could use groups. See "man rlm_passwd" for examples. You can create groups based on any criteria. Then, just do group checking.
What I was trying to do was to give each client a name:
client Cisco_IOS.host-10.1.2.3 { ipaddr = 10.1.2.3 secret = supersecret }
client HP_Procurve.host-10.3.2.1 { ipaddr = 10.3.2.1 secret = alsoverysecret }
One undocumented feature is that you can put *anything* into the configuration, so long as it is the correct format: client a { ipaddr = 10.1.2.3 secret = foo vendor = cisco } FreeRADIUS will load the "vendor" entry, but it won't do anything with it. You can then create rules bases on that,
And then build something to refer to them in the users file along the lines of:
Don't use the "users" file. See "man unlang" for a better wy.
DEFAULT Client-Shortname =~ "Cisco_IOS.*", User-Name := "someadmin", Cleartext-Password := "goodpassword" Service-Type = NAS-Prompt-User
Don't use ":=" for User-Name. See "man users" for why.
I'm having some problems, so I'm either missing something, or I'm going down an entirely wrong path. I got the "Client-Shortname" from the Run-time variables page in the Wiki, but I suspect it isn't evaluating like I think it ought to.
Try unlang: authorize { ... if ("%{client:vendor}" == "cisco") { ... } ... } This says: look up the current client (for this request), and find the "vendor' entry. If that is "cisco", then do... something. It's a lot clearer to understand than the "users" file. Alan DeKok.