Hi, I'm trying to migrate our old livingston radius (from around '96) user-file to a newly installed freeradius 1.1.7 server. Our general setup is, that dialing in with user should rlogin the user to a shell-server. If the username is prefixed by a P, a PPP-Session should be started. Reading the docs, this setup should be pretty straight-forward, using the hints file. Unfortunately, it does not really work as expected. The hints file contains the following lines, which seem to at least somewhat work as the P is stripped and authentication succeeds. DEFAULT Prefix == "P", Strip-User-Name = Yes Hint = "PPP", Service-Type = Framed-User, Framed-Protocol = PPP The users file has users configured with the following structure: user Password == "whatever" Service-Type = Login-User, Login-IP-Host = 192.168.1.1, Login-Service = Rlogin, Port-Limit = 2, Filter-Id = "dialin", Framed-IP-Address = 192.168.2.123 My understanding of the documentation (http://freeradius.org/radiusd/man/users.html) is, that the Service-Type should _not_ be set to Login-User when authenticating as Puser as it has been previously set as configured in the hints file. Unfortunately, this seems to be incorrect. [root@phoenix raddb]# radtest Puser whatever localhost 0 testing123 Sending Access-Request of id 214 to 127.0.0.1 port 1812 User-Name = "Puser" User-Password = "whatever" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=214, length=59 Service-Type = Login-User Login-IP-Host = 192.168.1.1 Login-Service = Rlogin Port-Limit = 2 Filter-Id = "dialin" Framed-IP-Address = 192.168.2.123 Any suggestions how to correctly get the Service-Type set to Framed-User when authenticating as Puser? thx, andreas
Andreas Thienemann wrote:
The hints file contains the following lines, which seem to at least somewhat work as the P is stripped and authentication succeeds.
Note that this updates the *request*, not the *reply*.
user Password == "whatever"
Please use: Cleartext-Password := ...
My understanding of the documentation (http://freeradius.org/radiusd/man/users.html) is, that the Service-Type should _not_ be set to Login-User when authenticating as Puser as it has been previously set as configured in the hints file.
No. The "hints" file updates the request. You still need to set it in the reply in the "users" file.
Any suggestions how to correctly get the Service-Type set to Framed-User when authenticating as Puser?
Set it in the "users" file. Alan DeKok.
On Sat, 12 Jan 2008, Alan DeKok wrote:
The hints file contains the following lines, which seem to at least somewhat work as the P is stripped and authentication succeeds.
Note that this updates the *request*, not the *reply*.
Ahh. Okay. Thanks, this helps understanding the problem somewhat. And in fact, it seems to work after some major refactoring of the users file.
user Password == "whatever"
Please use: Cleartext-Password := ...
About the := operator, is it only needed for Cleartext-Password? What about Crypt-Password? There it seems to work with "==" as well as with ":=". regards, andreas
participants (2)
-
Alan DeKok -
Andreas Thienemann