Re: Local Auth if Proxy Auth fails ---OR--- Proxy Auth if Local Auth fails
Hello! Is it possuble to use another Auth-mechanism if primary Auth failed? The below is what I meant: 1) NAS -> FreeRADIUS: User/Password 2) FreeRADIUS - Does User exist in Local DB? 3) If "yes" - Access-Acept! 4) If "no" - Are any Proxies configured? FreeRADIUS -> Proxy: User/Password 5) Proxy answers, FreeRADIUS translates the answer further to NAS. Kind regards, Ellad Yatsko
Яцко Эллад Геннадьевич (ngs) wrote:
1) NAS -> FreeRADIUS: User/Password 2) FreeRADIUS - Does User exist in Local DB?
authorize { ... ldap if (!notfound) { update control { Proxy-To-Realm := "realm" } } ... } And set up the realm with home server, etc.
3) If "yes" - Access-Acept! 4) If "no" - Are any Proxies configured? FreeRADIUS -> Proxy: User/Password 5) Proxy answers, FreeRADIUS translates the answer further to NAS.
All of the rest happens automatically. Alan DeKok.
Dear Alan! I am beginner in RADIUS. I guessed you talked about "sites-available/default" because Cisco does not use any realms when sends its packets to the RADIUS. I think it's needed "expanding of my task boundaries" :-) I want to make Cisco devices authenticate users when ther enter the device via telnet/ssh. It would be three-stage procedure: - Windows DC if IAS (Microsoft RADIUS) is accessible; - if no - RADIUS local DB if it is accessible; - if no - Cisco's local DB (NAS local authentication). So If I correctly understood I need to use "authenticate" section. But what is further I don't clearly imagine. I guess when Access-Request is incoming, RADIUS in accordance with suggested scheme must change realm of request and continue process packet with new conditions, is it right? I must define new realm, for example "ias", and I must define home-server for it, do I? Kind regards, Ellad
authorize { ... ldap if (!notfound) { update control { Proxy-To-Realm := "realm" } } ... } And set up the realm with home server, etc.
3) If "yes" - Access-Acept! 4) If "no" - Are any Proxies configured? FreeRADIUS -> Proxy: User/Password 5) Proxy answers, FreeRADIUS translates the answer further to NAS.
Яцко Эллад Геннадьевич (ngs) wrote:
I am beginner in RADIUS. I guessed you talked about "sites-available/default" because Cisco does not use any realms when sends its packets to the RADIUS.
I talked about realms because I wanted to talk about realms.
I think it's needed "expanding of my task boundaries" :-) I want to make Cisco devices authenticate users when ther enter the device via telnet/ssh. It would be three-stage procedure: - Windows DC if IAS (Microsoft RADIUS) is accessible; - if no - RADIUS local DB if it is accessible; - if no - Cisco's local DB (NAS local authentication).
So If I correctly understood I need to use "authenticate" section.
No. My example was correct.
But what is further I don't clearly imagine. I guess when Access-Request is incoming, RADIUS in accordance with suggested scheme must change realm of request and continue process packet with new conditions, is it right?
No. My example was correct.
I must define new realm, for example "ias", and I must define home-server for it, do I?
That's the only thing you got right. Alan DeKok.
Are we in a bad mood?
Date: Tue, 11 Oct 2011 08:46:28 +0200 From: aland@deployingradius.com To: freeradius-users@lists.freeradius.org Subject: Re: Local Auth if Proxy Auth fails ---OR--- Proxy Auth if Local Auth fails
Яцко Эллад Геннадьевич (ngs) wrote:
I am beginner in RADIUS. I guessed you talked about "sites-available/default" because Cisco does not use any realms when sends its packets to the RADIUS.
I talked about realms because I wanted to talk about realms.
I think it's needed "expanding of my task boundaries" :-) I want to make Cisco devices authenticate users when ther enter the device via telnet/ssh. It would be three-stage procedure: - Windows DC if IAS (Microsoft RADIUS) is accessible; - if no - RADIUS local DB if it is accessible; - if no - Cisco's local DB (NAS local authentication).
So If I correctly understood I need to use "authenticate" section.
No. My example was correct.
But what is further I don't clearly imagine. I guess when Access-Request is incoming, RADIUS in accordance with suggested scheme must change realm of request and continue process packet with new conditions, is it right?
No. My example was correct.
I must define new realm, for example "ias", and I must define home-server for it, do I?
That's the only thing you got right.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Am I ?! :-) I've just asked some questions.. Maybe stupid (I repeat again I am beginner in RADIUS).. And I still out of knowledge what "to-do"... Or more exactly: how does it work?... Kind regards, Ellad Yatsko
Are we in a bad mood?
Яцко Эллад Геннадьевич (ngs) wrote:
I've just asked some questions.. Maybe stupid (I repeat again I am beginner in RADIUS).. And I still out of knowledge what "to-do"... Or more exactly: how does it work?...
My original answer explained what to do. Follow instructions, or don't ask questions. Alan DeKok.
Dear Alan! I ask you to be more indulgent, I didn't want to anger you. :-) Would you explain how will it work? I really need to understand what is happening, cause I want to do any thing sensibly. Suppose I have perform all your recommendations. Cisco sends Access-Acepts to RADIUS, It receives a packet and... What is further? How does RADIUS proceed it? Or simply point me to some articles with examples somewhere in Internet. Kind regards, Ellad Yatsko
My original answer explained what to do. Follow instructions, or don't ask questions.
Яцко Эллад Геннадьевич (ngs) wrote:
Would you explain how will it work? I really need to understand what is happening, cause I want to do any thing sensibly.
My original message explained what was going on.
Suppose I have perform all your recommendations. Cisco sends Access-Acepts to RADIUS, It receives a packet and... What is further? How does RADIUS proceed it?
See the "doc" directory for documentation on how the server works. I'm not going to cut & paste it here.
Or simply point me to some articles with examples somewhere in Internet.
See the Wiki. Use google. This isn't hard. Alan DeKok.
Sergio NNX wrote:
Are we in a bad mood?
Do you want to solve your problem? If so, read the answers on this list, and follow the instructions. If not, unsubscribe, as you're wasting everyones time. And yes, it *is* rude to ask questions, and then argue with the answers. Alan DeKok.
participants (3)
-
"Яцко Эллад Генна дьевич (ngs)" -
Alan DeKok -
Sergio NNX