SQL Huntgroup only work with user check, not group check
Hello, I am having trouble while trying to work with huntgroups. Maybe I misunderstand the way how huntgroups works. I read another post about this issue, but I don't really understand why force the huntgroup name in confs. I have inserted two NAS' into radhuntgroup, as follow: mysql> select * from radhuntgroup; +----+-----------+--------------+-----------+ | id | groupname | nasipaddress | nasportid | +----+-----------+--------------+-----------+ | 5 | wireless | 192.168.2.5 | NULL | | 4 | adsl | 192.168.2.6 | NULL | +----+-----------+--------------+-----------+ And associate the user 'jack' in group wireless: mysql> select * from radusergroup; +----------+-----------+----------+----+ | username | groupname | priority | id | +----------+-----------+----------+----+ | jack | wireless | 1 | 1 | +----------+-----------+----------+----+ And created the rules to the user 'jack': mysql> select * from radcheck; +----+----------+--------------------+----+----------+ | id | username | attribute | op | value | +----+----------+--------------------+----+----------+ | 5 | jack | Huntgroup-Name | == | wireless | | 4 | jack | Cleartext-Password | := | foo | +----+----------+--------------------+----+----------+ When I use 'Huntgroup-Name' into radcheck, everything works fine. But when I put the 'Huntgroup-Name' into radgroupcheck, the radius is just ignoring it. mysql> select * from radgroupcheck; +----+-----------+----------------+----+----------+ | id | groupname | attribute | op | value | +----+-----------+----------------+----+----------+ | 8 | wireless | Huntgroup-Name | == | wireless | +----+-----------+----------------+----+----------+ It only works in this way? Am I doing something wrong? Thanks -- Carlos Eduardo Tavares Terra GNU/Linux #413291 [http://counter.li.org]
I am having trouble while trying to work with huntgroups. Maybe I misunderstand the way how huntgroups works.
When I use 'Huntgroup-Name' into radcheck, everything works fine. But when I put the 'Huntgroup-Name' into radgroupcheck, the radius is just ignoring it.
Nothing wrong with huntgroups. That's how sql groups work. If they don't match they are ignored - user doesn't get rejected. Ivan Kalik Kalik Informatika ISP
On Wed, Sep 2, 2009 at 5:13 AM, Ivan Kalik<tnt@kalik.net> wrote:
I am having trouble while trying to work with huntgroups. Maybe I misunderstand the way how huntgroups works.
When I use 'Huntgroup-Name' into radcheck, everything works fine. But when I put the 'Huntgroup-Name' into radgroupcheck, the radius is just ignoring it.
Nothing wrong with huntgroups. That's how sql groups work. If they don't match they are ignored - user doesn't get rejected.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Is there anyway to reject if groupcheck fails? Thanks -- Carlos Eduardo Tavares Terra GNU/Linux #413291 [http://counter.li.org]
On Tue, Sep 01, 2009 at 09:49:20PM -0300, Carlos Eduardo Tavares Terra wrote:
+----+-----------+--------------+-----------+ | id | groupname | nasipaddress | nasportid | +----+-----------+--------------+-----------+ | 5 | wireless | 192.168.2.5 | NULL | | 4 | adsl | 192.168.2.6 | NULL | +----+-----------+--------------+-----------+
You described the huntgroups for Your hardware.
+----------+-----------+----------+----+ | username | groupname | priority | id | +----------+-----------+----------+----+ | jack | wireless | 1 | 1 | +----------+-----------+----------+----+
User jack had got the 'wireless' membership.
+----+----------+--------------------+----+----------+ | id | username | attribute | op | value | +----+----------+--------------------+----+----------+ | 5 | jack | Huntgroup-Name | == | wireless | | 4 | jack | Cleartext-Password | := | foo | +----+----------+--------------------+----+----------+ You wrote rules for authorization/athentication of jack: Jack grants access from hardware of 'wireless' huntgroup with 'foo' password.
mysql> select * from radgroupcheck; +----+-----------+----------------+----+----------+ | id | groupname | attribute | op | value | +----+-----------+----------------+----+----------+ | 8 | wireless | Huntgroup-Name | == | wireless | +----+-----------+----------------+----+----------+
But there is You wrote that You want to authorize the 'wireless' memebership for jack.
On Thu, Sep 3, 2009 at 6:30 AM, George Koulyabin<jumbo@vinf.ru> wrote:
+----+----------+--------------------+----+----------+ | id | username | attribute | op | value | +----+----------+--------------------+----+----------+ | 5 | jack | Huntgroup-Name | == | wireless | | 4 | jack | Cleartext-Password | := | foo | +----+----------+--------------------+----+----------+ You wrote rules for authorization/athentication of jack: Jack grants access from hardware of 'wireless' huntgroup with 'foo' password.
I wrote the rules for huntgroup here because the rules in groupcheck didn't work. If I take this out, just keeping the groupcheck, 'jack' will connect from any hardware. The groupcheck is ignoring the huntgroups.
mysql> select * from radgroupcheck; +----+-----------+----------------+----+----------+ | id | groupname | attribute | op | value | +----+-----------+----------------+----+----------+ | 8 | wireless | Huntgroup-Name | == | wireless | +----+-----------+----------------+----+----------+
But there is You wrote that You want to authorize the 'wireless' memebership for jack.
-- Carlos Eduardo Tavares Terra GNU/Linux #413291 [http://counter.li.org]
On Thu, Sep 3, 2009 at 6:30 AM, George Koulyabin<jumbo@vinf.ru> wrote:
+----+----------+--------------------+----+----------+ | id | username | attribute | op | value | +----+----------+--------------------+----+----------+ | 5 | jack | Huntgroup-Name | == | wireless | | 4 | jack | Cleartext-Password | := | foo | +----+----------+--------------------+----+----------+ You wrote rules for authorization/athentication of jack: Jack grants access from hardware of 'wireless' huntgroup with 'foo' password.
I wrote the rules for huntgroup here because the rules in groupcheck didn't work. If I take this out, just keeping the groupcheck, 'jack' will connect from any hardware. The groupcheck is ignoring the huntgroups.
"Didn't work"? Sql groups emulate the way DEFAULT entries in users file work. The situation there is the same - if check doesn't match, entry is skipped. They do not emulate user entries - that's what radcheck/radreply entries do. That's why entries in radcheck "worked" and those in radgroupcheck "didn't". Ivan Kalik Kalik Informatika ISP
On Thu, Sep 03, 2009 at 07:36:31AM -0300, Carlos Eduardo Tavares Terra wrote:
On Thu, Sep 3, 2009 at 6:30 AM, George Koulyabin<jumbo@vinf.ru> wrote:
I wrote the rules for huntgroup here because the rules in groupcheck didn't work. If I take this out, just keeping the groupcheck, 'jack' will connect from any hardware. The groupcheck is ignoring the huntgroups.
You must to use huntgroups for consolidation of Your hardware by identical properties. For examle, You can create huntgroup for wireless hardware and huntgroup for access-servers. Groups, sql-groups (radusergroup/radgroupcheck/radgroupreply) are intended for consolidation of users. In Your 'sql-rules' You wrote: "User has 'wireless' sql-group membership. But user has this membership when he'll connected from the hardware (member of 'wireless' huntgroup)." See FreeRADIUS documentation, file rlm_sql.
participants (3)
-
Carlos Eduardo Tavares Terra -
George Koulyabin -
Ivan Kalik