Hello list, I need some help on some unlang portion (if this is the right solution). Here is context: I need to do 802.1x on Ethernet switch for dynamic VLAN assignment for PCs . The problem is I have some phones connected between the PC and the switch. I don't want the users to login 802.1X with the phones so I have set them up to do MAC address user name and password without annoying the user over CHAP. Using users files works perfectly for my phones, as the ldap back end is for PC users. However, I have 300 phones that can be replaced if they are broken and I don't want to store all the info by hand in the users file. I tried to put this in the users file: if ( "%{User-Name}" =~ "00030BCA[0-9A-F]+" ) { "%{Cleartext-Password}" == "%{User-Name}" } Put it doesn't work because CHAP cannot find the user and his clear text password. So I guess I have put it in the wrong section AND/OR have done something wrong with my if but I can't find a way of checking as radius seems not to bother about it. I also tried to put it in the authentication section without success. I have read this http://wiki.freeradius.org/Mac-Auth but it seems too advanced for what I want to do as I don't need to rewrite anything. This guided me to try and put the script somewhere else. Thanks for your precious help. Best Regards, Matt
Ivan Kalik a écrit :
I tried to put this in the users file:
Unlang goes into virtual server configuration, not users file.
if ( "%{User-Name}" =~ "00030BCA[0-9A-F]+" ) {
update control { Cleartext-Password == "%{User-Name}"
}
}
Ivan Kalik Kalik Informatika ISP
Thank you very much for the precious help and prompt reply!!! It's working very well! Just in case someone needs the info, I have put it in site-available/default file, at the beginning of the authorise section after preprocess. Here is the exact synthax: if ( "%{User-Name}" =~ /00030BCA[0-9A-F]+/i ) { update control { Cleartext-Password = "%{User-Name}" } } else { noop } Furthermore, I would like to suggest or edit parts of this page http://freeradius.org/radiusd/man/unlang.html , so that we have a detailed list of where and how we can use unlang. For example: "Unlang can be used in the following configuration files: Virtual-servers --> i.e: default ---> authorise, post-auth XXXXX ----> file YYY ---> section m,n" What do you think? Best regards, Matt
Please ask here for Wiki account. Then you'll be able to create pages and add content. best regards Marinko Matthieu Lazaro wrote:
Furthermore, I would like to suggest or edit parts of this page http://freeradius.org/radiusd/man/unlang.html , so that we have a detailed list of where and how we can use unlang. For example: "Unlang can be used in the following configuration files: Virtual-servers --> i.e: default ---> authorise, post-auth XXXXX ----> file YYY ---> section m,n"
What do you think?
Best regards,
Matt - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Matthieu Lazaro wrote:
Furthermore, I would like to suggest or edit parts of this page http://freeradius.org/radiusd/man/unlang.html , so that we have a detailed list of where and how we can use unlang.
$ man unlang That text is already in 2.1.6. The web page wasn't updated. Alan DeKok.
participants (4)
-
Alan DeKok -
Ivan Kalik -
Marinko Tarlac -
Matthieu Lazaro