Greetings, we're migrating over from xtradius (yet another cistron derivative) to FreeRadius, and so far, basic authentication seem to work, but onto the huntgroups we're running into a big of a snag. We're using FreeRadius 1.1.2 on Debian w/2.6.12 Kernel, and MySQL 5.0.22 installed FreeRadius stuff via training wheels (apt-get install freeradius freeradius-mysql freeradius-dialupadmin) What we're trying to do is send spacific attributes based on the NAS sending the request... for example: huntgroups file: tc1 NAS-IP-Address = 1.2.3.4 GP NAS-IP-Address = 1.2.3.5 for tc1, which only has 48 lines, we used to assign an IP based on port: users file: DEFAULT Service-Type = Framed-User, Huntgroup-Name = "tc1" Framed-IP-Address = 1.2.3.100+, Framed-IP-Netmask = 255.255.255.255, Fall-Through = Yes #(and for the GP, which is actually globalpop): DEFAULT Service-Type = Framed-User, Huntgroup-Name = "GP" Ascend-Data-Filter = "ip in forward tcp est", Ascend-Data-Filter = "ip in forward dstip 1.2.3.25/32 0", Ascend-Data-Filter = "ip in drop tcp dstport = 25", Ascend-Data-Filter = "ip in forward 0", Fall-Through = Yes so, in theory, a request coming in via a GP nas, should get all those silly Ascend-Data-Filter attributes, and the tc1 box should not, but instead have an IP based on 1.2.3.100 plus the port number. in the authorize section in radiusd.conf, there is an entry for "files" which does indeed point to the users file in the files section. Also turned on "compat=yes" but no luck there. huntgroups is in the preprocess area, and preprocess is in authorize. Am I missing something somewhere? This whole chain of events gets rather confusing. Before (with xtradius) everything was done in the users file, which just fired off an external app which I wrote, that manually checks the database to see if username/password exists.. but freeradius is a little more detailed. - - - Jon
jfr@e4x.net wrote:
What we're trying to do is send spacific attributes based on the NAS sending the request... for example: huntgroups file: tc1 NAS-IP-Address = 1.2.3.4
The operators should be updated. See "man 5 users".
in the authorize section in radiusd.conf, there is an entry for "files" which does indeed point to the users file in the files section. Also turned on "compat=yes" but no luck there. huntgroups is in the preprocess area, and preprocess is in authorize.
Am I missing something somewhere?
What does debugging mode say?
This whole chain of events gets rather confusing. Before (with xtradius) everything was done in the users file, which just fired off an external app which I wrote, that manually checks the database to see if username/password exists.. but freeradius is a little more detailed.
It still has the "users" file, with almost the same format. It still has the ability to fire off an external app. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
huntgroups file: tc1 NAS-IP-Address = 1.2.3.4
The operators should be updated. See "man 5 users".
changed huntgroups to "tc1 NAS-IP-Address == 1.2.3.4" (also updated users file to use ==) does not match. (debug mode does not say the exact string trying to be matched, would be nice if I knew it was a problem in users file or huntgroups). If I use ":=" in huntgroups file, then EVERYTHING matches for the tc1 entry in users file, and debug mode verifies that with the "Matched entry" notice. So it might be a matter of getting the operators correct, however, I'm using == in both places as shown in all the example files that I see, even taking a close look at "alphen" which is one of the examples in the huntgroup file distributed with freeradius. From the man page, it would seem that, as in C, "=" can be used to assign a value (like in huntgroups if dealing with just 1 group name to IP address), "+=" for multiple NAS IPs per group, and "==" for comparative as in the users file looking up to see if the group matches the Huntgroup-Name. However, if this was the case, it would seem like it should work.
What does debugging mode say?
a whole lot of stuff, except what I'd want it to give debugging on.. as in what is trying to match what, and how exactly its matching. Everything else looks clean; at least no syntax errors anywhere.
It still has the "users" file, with almost the same format. It still has the ability to fire off an external app.
Hmm.. I'll keep that in mind as a last resort. But I believe all the functionality (plus more) is in freeradius, without running my own external mess, which didnt quite handle anything aside from PAP. So, as you first mentioned, it does appear to be an operator problem.. possibly in more than once sense of the word. - - - Jon
participants (2)
-
Alan DeKok -
jfr＠e4x.net