Hi everybody. I'm configuring FreeRADIUS Version 2.1.1 on a Fedora 9 server. I'm trying to create different groups containing different users. The final result is to differentiate radius checks depending on which service users are trying to authenticate. For example: user1@realm1 (in radius group1) coming from NAS_IP_1 user2@realm2 (in radius group2) coming from NAS_IP_2 I want to add a check that block authentication of user2 if he tries to authenticate from NAS_IP different from NAS_IP_2 I can do it (correctly) adding NAS-Identifier attribute in radcheck table for the single user. I want extend this thing to radgroupcheck table, so that I must not add the specific attribute for each user, but it will be enough to add it only one time in radgroupcheck table, for the group the user belongs to. Now I have NAS-Identifier attribute in group table, but it is ignored and the user can connect from different NAS. Here my table situation: mysql> select * from radcheck; +----+----------+--------+--------------------+----+---------+ | id | username | realm | attribute | op | value | +----+----------+--------+--------------------+----+---------+ | 3 | user1 | realm1 | Cleartext-Password | := | passwd1 | | 4 | user2 | realm1 | Cleartext-Password | := | passwd2 | +----+----------+--------+--------------------+----+---------+ mysql> select * from radgroupcheck; +----+-----------+----------------+----+----------+ | id | groupname | attribute | op | value | +----+-----------+----------------+----+----------+ | 5 | group1 | NAS-Identifier | != | 10.0.0.1 | | 6 | group2 | NAS-Identifier | != | 10.0.1.1 | +----+-----------+----------------+----+----------+ mysql> select * from radusergroup; +----------+--------+-----------+----------+ | username | realm | groupname | priority | +----------+--------+-----------+----------+ | user1 | realm1 | group1 | 1 | | user2 | realm2 | group2 | 1 | +----------+--------+-----------+----------+ Can anyone help me to solve this problem? Thanks, Arrigo.
Now I have NAS-Identifier attribute in group table, but it is ignored and the user can connect from different NAS.
That's how sql groups work. If the group check doesn't match - group is ignored. User is not rejected. If you wan't to force this use unlang or hungroups (or users) file. Ivan Kalik Kalik Informatika ISP
tnt@kalik.net wrote:
Now I have NAS-Identifier attribute in group table, but it is ignored and the user can connect from different NAS.
That's how sql groups work. If the group check doesn't match - group is ignored. User is not rejected. If you wan't to force this use unlang or hungroups (or users) file.
I recently posted a howto explaining how to implement huntgroups in SQL using unlang in 2.x, look in the mail archives. It also illustrates how to use the SQL huntgroups to control logon access based on the NAS. Perhaps I should put this on the wiki. -- John Dennis <jdennis@redhat.com>
Hi,
I recently posted a howto explaining how to implement huntgroups in SQL using unlang in 2.x, look in the mail archives. It also illustrates how to use the SQL huntgroups to control logon access based on the NAS. Perhaps I should put this on the wiki.
certainly! things posted to this mailing list tend to lurk into the darkest depths after just a short time.... I know why! imagine joining this list then attempting to trawl through hundreds or historical messages that have been thread hijacked etc so the subject title doesnt match, the thread doesnt match etc. we just need a web-version of something like spotlight/beagle that works on the ML posts..... mmmmmm. alan
Hi. I find you tutorial and followed it. It is exactly what I need. Thanks a lot. Arrigo. -----Messaggio originale----- Da: freeradius-users-bounces+a.savio=bascom.it@lists.freeradius.org [mailto:freeradius-users-bounces+a.savio=bascom.it@lists.freeradius.org] Per conto di A.L.M.Buxey@lboro.ac.uk Inviato: lunedì 5 gennaio 2009 18.20 A: FreeRadius users mailing list Oggetto: Re: NAS-Identifier and radgroupcheck table Hi,
I recently posted a howto explaining how to implement huntgroups in SQL using unlang in 2.x, look in the mail archives. It also illustrates how to use the SQL huntgroups to control logon access based on the NAS. Perhaps I should put this on the wiki.
certainly! things posted to this mailing list tend to lurk into the darkest depths after just a short time.... I know why! imagine joining this list then attempting to trawl through hundreds or historical messages that have been thread hijacked etc so the subject title doesnt match, the thread doesnt match etc. we just need a web-version of something like spotlight/beagle that works on the ML posts..... mmmmmm. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
MMM... Not so easy... I made other tests, but I had a wrong profile on user table. I corrected the profile and I still have my problem. At the moment I can classify users belonging to a group, and all is OK. The problem is for users that don't belong to any group. They are still authenticated (I read that this is the expected behaviour). I'd like to send by default an Access-Reject reply to everybody, sending the Access-Accept only to "grouped" one. Is it possible to modofy the "default" answer of freeradius? Thanks. Arrigo -----Messaggio originale----- Da: freeradius-users-bounces+a.savio=bascom.it@lists.freeradius.org [mailto:freeradius-users-bounces+a.savio=bascom.it@lists.freeradius.org] Per conto di Arrigo Savio Inviato: mercoledì 7 gennaio 2009 11.01 A: 'FreeRadius users mailing list' Oggetto: R: NAS-Identifier and radgroupcheck table Hi. I find you tutorial and followed it. It is exactly what I need. Thanks a lot. Arrigo. -----Messaggio originale----- Da: freeradius-users-bounces+a.savio=bascom.it@lists.freeradius.org [mailto:freeradius-users-bounces+a.savio=bascom.it@lists.freeradius.org] Per conto di A.L.M.Buxey@lboro.ac.uk Inviato: lunedì 5 gennaio 2009 18.20 A: FreeRadius users mailing list Oggetto: Re: NAS-Identifier and radgroupcheck table Hi,
I recently posted a howto explaining how to implement huntgroups in SQL using unlang in 2.x, look in the mail archives. It also illustrates how to use the SQL huntgroups to control logon access based on the NAS. Perhaps I should put this on the wiki.
certainly! things posted to this mailing list tend to lurk into the darkest depths after just a short time.... I know why! imagine joining this list then attempting to trawl through hundreds or historical messages that have been thread hijacked etc so the subject title doesnt match, the thread doesnt match etc. we just need a web-version of something like spotlight/beagle that works on the ML posts..... mmmmmm. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
MMM... Not so easy...
I made other tests, but I had a wrong profile on user table. I corrected the profile and I still have my problem. At the moment I can classify users belonging to a group, and all is OK. The problem is for users that don't belong to any group. They are still authenticated (I read that this is the expected behaviour). I'd like to send by default an Access-Reject reply to everybody, sending the Access-Accept only to "grouped" one.
Put DEFAULT Auth-Type := Reject in users file. Add Auth-Type Accept with := as op in radgroupcheck for each group. Ivan Kalik Kalik Informatika ISP
I followed your suggestion, but I still have the problem. I put DEFAULT Auth-Type := Reject at the bottom of users file. I have a mysql database containing users, not file: this could be a problem? Arrigo -----Messaggio originale----- Da: freeradius-users-bounces+a.savio=bascom.it@lists.freeradius.org [mailto:freeradius-users-bounces+a.savio=bascom.it@lists.freeradius.org] Per conto di tnt@kalik.net Inviato: mercoledì 7 gennaio 2009 12.24 A: FreeRadius users mailing list Oggetto: Re: R: NAS-Identifier and radgroupcheck table
MMM... Not so easy...
I made other tests, but I had a wrong profile on user table. I corrected the profile and I still have my problem. At the moment I can classify users belonging to a group, and all is OK. The problem is for users that don't belong to any group. They are still authenticated (I read that this is the expected behaviour). I'd like to send by default an Access-Reject reply to everybody, sending the Access-Accept only to "grouped" one.
Put DEFAULT Auth-Type := Reject in users file. Add Auth-Type Accept with := as op in radgroupcheck for each group. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I followed your suggestion, but I still have the problem. I put DEFAULT Auth-Type := Reject at the bottom of users file.
It should be on the same line: DEFAULT Auth-Type := Reject And it should go to the front of the users file. Ivan Kalik Kalik Informatika ISP
You're right: putting the parameter in the first lines of the file everything is OK (and now I'm sure of that....). Thanks. Arrigo -----Messaggio originale----- Da: freeradius-users-bounces+a.savio=bascom.it@lists.freeradius.org [mailto:freeradius-users-bounces+a.savio=bascom.it@lists.freeradius.org] Per conto di tnt@kalik.net Inviato: mercoledì 7 gennaio 2009 12.52 A: FreeRadius users mailing list Oggetto: Re: R: R: NAS-Identifier and radgroupcheck table
I followed your suggestion, but I still have the problem. I put DEFAULT Auth-Type := Reject at the bottom of users file.
It should be on the same line: DEFAULT Auth-Type := Reject And it should go to the front of the users file. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
I recently posted a howto explaining how to implement huntgroups in SQL using unlang in 2.x, look in the mail archives. It also illustrates how to use the SQL huntgroups to control logon access based on the NAS. Perhaps I should put this on the wiki.
certainly! things posted to this mailing list tend to lurk into the darkest depths after just a short time.... I know why! imagine joining this list then attempting to trawl through hundreds or historical messages that have been thread hijacked etc so the subject title doesnt match, the thread doesnt match etc. we just need a web-version of something like spotlight/beagle that works on the ML posts..... mmmmmm.
I have updated the FreeRADIUS Wiki with a new howto describing how to implement huntgroups in SQL. You can find the page here: http://wiki.freeradius.org/SQL_Huntgroup_HOWTO -- John Dennis <jdennis@redhat.com>
Hi! I have 2 freeradius servers running, one at 2.0.4 version and other at 2.0.5. On 2.0.4 i can use radreply without problem, but in 2.0.5 i can`t, the freeradius server don`t read the table. The two server have the same configuration. I need help. Tks Marcelo
We cant see your debug ! Maybe mr Ivan Kalik and his crystal ball know something :) By the way, Happy new year :) Marcelo Henique Cabral Ariza wrote:
Hi!
I have 2 freeradius servers running, one at 2.0.4 version and other at 2.0.5. On 2.0.4 i can use radreply without problem, but in 2.0.5 i can`t, the freeradius server don`t read the table. The two server have the same configuration.
I need help.
Tks Marcelo - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I have 2 freeradius servers running, one at 2.0.4 version and other at 2.0.5. On 2.0.4 i can use radreply without problem, but in 2.0.5 i can`t, the freeradius server don`t read the table. The two server have the same configuration.
It obviously isn't the same. Post the debug of server startup and request processing. Ivan Kalik Kalik Informatika ISP
Hi,
Hi!
I have 2 freeradius servers running, one at 2.0.4 version and other at 2.0.5. On 2.0.4 i can use radreply without problem, but in 2.0.5 i can`t, the freeradius server don`t read the table. The two server have the same configuration.
they talking to same database? are the databases different? alan
participants (6)
-
A.L.M.Buxey＠lboro.ac.uk -
Arrigo Savio -
John Dennis -
Marcelo Henique Cabral Ariza -
Marinko Tarlac -
tnt＠kalik.net