Additional Restrictions for users
I currently have my RADIUS servers setup to handle authentication for my various NAS's to grant users access to network resources. I would like to use the same servers to handle authentication for SSH for various routers. This all works, but I'm having a hard time getting the RADIUS server to only accept requests from users of the "ssh" group. I obviously don't want john.doe accessing my core routers. What is the best way to go about this? I was trying to use unlang to query my database but can't seem to get the syntax right. contents of sites-enabled/default: ...authorize { preprocess if (Service-Type == "Login-User") if ( %{group_membership_query} == "ssh") { update reply { ok-to-continue } } else { update reply { Auth-Type := Reject } }.... The group_membership_query would reference this: group_membership_query = "SELECT groupname \ FROM ${usergroup_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY priority" Any help/suggestions would be much appreciated. Sincerely, William Burnett burnett.w@gmail.com
William Burnett wrote:
What is the best way to go about this? I was trying to use unlang to query my database but can't seem to get the syntax right.
The "sql" module queries databases. ...
if ( %{group_membership_query} == "ssh") {
This won't do what you want. Instead, use if (SQL-Group == "ssh") { This is documented in raddb/sql.conf. Alan DeKok.
Alan, Thanks that helped I've got the conditions to match. However I've setup multiple groups: ssh-admin ssh-read ssh-write and want to use a regexp to match anything containing ssh-* to allow those users to authenticate instead of multiple lines matching each value. Can I use regex matching with SQL-Group ? The following seems to be evaluated as "ssh.*" and not anything containing "ssh......" if (!SQL-Group =~ /ssh.*/ && (Service-Type == "Login-User")) { .....reject.... } Sincerely, William Burnett burnett.w@gmail.com On Sat, Sep 25, 2010 at 12:09 AM, Alan DeKok <aland@deployingradius.com> wrote:
William Burnett wrote:
What is the best way to go about this? I was trying to use unlang to query my database but can't seem to get the syntax right.
The "sql" module queries databases.
...
if ( %{group_membership_query} == "ssh") {
This won't do what you want. Instead, use
if (SQL-Group == "ssh") {
This is documented in raddb/sql.conf.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
William Burnett <burnett.w@gmail.com> wrote:
Thanks that helped I've got the conditions to match. However I've setup multiple groups:
ssh-admin ssh-read ssh-write
and want to use a regexp to match anything containing ssh-* to allow those users to authenticate instead of multiple lines matching each value. Can I use regex matching with SQL-Group ?
The following seems to be evaluated as "ssh.*" and not anything containing "ssh......"
if (!SQL-Group =~ /ssh.*/ && (Service-Type == "Login-User")) { .....reject.... }
Does not work like that. You will need to construct a SQL xlat statement that does the check for you, so: ---- if ("%{sql:SELECT ....}" ....) { ---- or however SQL modules function, I'm an LDAP man myself. Cheers -- Alexander Clouter .sigmonster says: Are you a turtle?
Alright, Glad I asked, I've been trying different variations for half an hour. I ended up just created an if - elsif statement since I only had three static groups, but thought the regexp model would be less taxing than processing each if statement. if (Service-Type == "Login-User") { if (SQL-Group == "ssh-admin") { update control { Auth-Type := "Accept" } } elsif (SQL-Group == "ssh-write") { update control { Auth-Type := "Accept" } } elsif (SQL-Group == "ssh-read") { update control { Auth-Type := "Accept" } } else { update control { Auth-Type := "Reject" } } } Thanks again for the pointers. Sincerely, William Burnett burnett.w@gmail.com On Mon, Sep 27, 2010 at 11:41 AM, Alexander Clouter <alex@digriz.org.uk> wrote:
William Burnett <burnett.w@gmail.com> wrote:
Thanks that helped I've got the conditions to match. However I've setup multiple groups:
ssh-admin ssh-read ssh-write
and want to use a regexp to match anything containing ssh-* to allow those users to authenticate instead of multiple lines matching each value. Can I use regex matching with SQL-Group ?
The following seems to be evaluated as "ssh.*" and not anything containing "ssh......"
if (!SQL-Group =~ /ssh.*/ && (Service-Type == "Login-User")) { .....reject.... }
Does not work like that. You will need to construct a SQL xlat statement that does the check for you, so: ---- if ("%{sql:SELECT ....}" ....) { ----
or however SQL modules function, I'm an LDAP man myself.
Cheers
-- Alexander Clouter .sigmonster says: Are you a turtle?
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
William Burnett wrote:
Thanks that helped I've got the conditions to match. However I've setup multiple groups: ... and want to use a regexp
That won't work. The current code checks for equality, not regex.
to match anything containing ssh-* to allow those users to authenticate instead of multiple lines matching each value. Can I use regex matching with SQL-Group ?
Nope. But if you patch the code, it might work. Alan DeKok.
participants (3)
-
Alan DeKok -
Alexander Clouter -
William Burnett