same username different password on different NAS
I am just learning about freeradius now, and would like to see if I can use it to manage access and logging for users at a few hundred locations. Each remote office has between 1 and 50 users, and at first glance freeradius will do the job, but I just noticed a problem with overlapping usernames. I am not sure if I need to use virtual servers, or if there is a better / easier way. The problem is that each location may have a user with the same login name as a different location. For a simple example, each site could have a login of "manager", but the manager username at each site would probably pair up with a different password. Without using virtual servers, is there a way to link the username "manager" to the NAS name or IP of the location? I'm picturing something like the radcheck table containing an additional field for NAS such that freeradius would key off the combined of NAS address and username fields, rather than just the username field. I am not opposed to using virtual servers if that is a better idea, but I'm worried about the overhead of several hundred of them... Any ideas or pointers to docs would be appreciated. -Richard
hi, you have pretty much got the idea already - you have to pair the username with the NAS-IP-Address - in SQL with radcheck, in users file by putting the correct matching description on the first line (as per examples). alan
Sound like a configuration (a job for :> ) "realms". Each location would be a different realm, so the seemingly overlapping username "manger" would in fact be a unique "manager@realm-X". Thoughts? -craig On Wednesday, March 16, 2011, Richard Thornton <rthornt@yahoo.com> wrote:
I am just learning about freeradius now, and would like to see if I can use it to manage access and logging for users at a few hundred locations. Each remote office has between 1 and 50 users, and at first glance freeradius will do the job, but I just noticed a problem with overlapping usernames. I am not sure if I need to use virtual servers, or if there is a better / easier way.
The problem is that each location may have a user with the same login name as a different location. For a simple example, each site could have a login of "manager", but the manager username at each site would probably pair up with a different password.
Without using virtual servers, is there a way to link the username "manager" to the NAS name or IP of the location? I'm picturing something like the radcheck table containing an additional field for NAS such that freeradius would key off the combined of NAS address and username fields, rather than just the username field.
I am not opposed to using virtual servers if that is a better idea, but I'm worried about the overhead of several hundred of them... Any ideas or pointers to docs would be appreciated.
-Richard
That gives me a good place to start. Sounds so much easier to manage. Much Thanks! -Richard ________________________________ From: Craig Campbell <craig.campbell@ccraft.ca> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Sent: Wed, March 16, 2011 2:44:01 PM Subject: Re: same username different password on different NAS Sound like a configuration (a job for :> ) "realms". Each location would be a different realm, so the seemingly overlapping username "manger" would in fact be a unique "manager@realm-X". Thoughts? -craig On Wednesday, March 16, 2011, Richard Thornton <rthornt@yahoo.com> wrote:
I am just learning about freeradius now, and would like to see if I can use it to manage access and logging for users at a few hundred locations. Each remote office has between 1 and 50 users, and at first glance freeradius will do the job, but I just noticed a problem with overlapping usernames. I am not sure if I need to use virtual servers, or if there is a better / easier way.
The problem is that each location may have a user with the same login name as a different location. For a simple example, each site could have a login of "manager", but the manager username at each site would probably pair up with a different password.
Without using virtual servers, is there a way to link the username "manager" to the NAS name or IP of the location? I'm picturing something like the radcheck table containing an additional field for NAS such that freeradius would key off the combined of NAS address and username fields, rather than just the username field.
I am not opposed to using virtual servers if that is a better idea, but I'm worried about the overhead of several hundred of them... Any ideas or pointers to docs would be appreciated.
-Richard
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, Mar 16, 2011 at 01:16:22PM -0700, Richard Thornton wrote:
Without using virtual servers, is there a way to link the username "manager" to the NAS name or IP of the location?
Yep. I suggest you first map the NAS-IP-Address to a Huntgroup-Name (see the 'preprocess' module and 'huntgroups' file for one way of doing this). This allows you to control the NAS-IP-Address mappings separately. Then use a combination of (Huntgroup-Name, User-Name) when looking up the user in whatever database you're using. For example, if it's SQL you can use a query like: authorize_check_query = "SELECT id, username, attribute, value, op \ FROM ${authcheck_table} \ WHERE username = '%{SQL-User-Name}' \ AND huntgroup = '%{Huntgroup-Name}' \ ORDER BY id" HTH, Brian.
participants (4)
-
Alan Buxey -
Brian Candler -
Craig Campbell -
Richard Thornton