Hi, I'm using a linux box as the NAS. PPP connections come in and get fed to radiusclient which in turn contacts a FreeRADIUS 1.1.3 server. Some of the PPP connections are dynamic, most are static. I did set up ippool properly in FreeRADIUS, but it dishes out only 2 IP addresses. Doing some searching around, I discovered this is because the Nas-Port is always 0 (as evidenced by the radius log files). So it will only send those two addresses out because it "thinks" the same user is logging on each time? Is there a way to tell the pppd-radius plugin, or, radiusclient to use a different "NAS Port" when it sends the RADIUS authentication requests? The pppd-radius man page says I can use "map-to-ifname" or "map-to-ttyname" (I'm using PPP v2.4.4b1). However, looking at the source code for pppd-radius, in radius.c it appears the NAS Port is hardcoded as zero. Would it then, be up to radiusclient to send the NAS Port? It appears to only have facility for setting NAS Port from the tty, and that's not an option for me. Has anyone else had this similar problem? I need to get FreeRADIUS to actually dish out more than the same 2 IP addresses. Regards, Tom
Tom Murphy wrote:
Doing some searching around, I discovered this is because the Nas-Port is always 0 (as evidenced by the radius log files). So it will only send those two addresses out because it "thinks" the same user is logging on each time?
Yes.
Is there a way to tell the pppd-radius plugin, or, radiusclient to use a different "NAS Port" when it sends the RADIUS authentication requests?
See the client documentation & source. If it isn't clear how to do it, it probably can't be done.
Has anyone else had this similar problem? I need to get FreeRADIUS to actually dish out more than the same 2 IP addresses.
Then make the client send out different NAS-Port values. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Tom Murphy wrote:
Hi,
I'm using a linux box as the NAS. PPP connections come in and get fed to radiusclient which in turn contacts a FreeRADIUS 1.1.3 server. Some of the PPP connections are dynamic, most are static. I did set up ippool properly in FreeRADIUS, but it dishes out only 2 IP addresses. Doing some searching around, I discovered this is because the Nas-Port is always 0 (as evidenced by the radius log files). So it will only send those two addresses out because it "thinks" the same user is logging on each time?
Certainly if the NAS-Port isn't being set correctly, ippool won't work.
Is there a way to tell the pppd-radius plugin, or, radiusclient to use a different "NAS Port" when it sends the RADIUS authentication requests? The pppd-radius man page says I can use "map-to-ifname" or "map-to-ttyname" (I'm using PPP v2.4.4b1). However, looking at the source code for pppd-radius, in radius.c it appears the NAS Port is hardcoded as zero. Would it then, be up to radiusclient to send the
The code I'm looking at (both the 2.4.3 and CVS) does not do anything of the sort. The "radius_chap_verify" and "radius_pap_auth" functions both set: rstate.client_port = get_client_port(portnumap ? devnam : ifname); ...and that function either strips the digits off interface formatted names such as "pppXYZ" and returns that or calls rc_map2id which is a radiusclient function that reads /etc/radiusclient/port-id-map but only for TTYs. I run a couple of multi-hundred-client servers off ppp-2.4.3 with the bundled radius plugin, and it works just fine. I didn't have to change the defaults.
NAS Port? It appears to only have facility for setting NAS Port from the tty, and that's not an option for me.
Why? It seems the problem lies with your local installation. I'm not sure how you troubleshoot it further - are you sure you're using a recent ppp?
Hi Phil, On 06/12/06, Phil Mayers wrote:
Certainly if the NAS-Port isn't being set correctly, ippool won't work.
Yeah it doesn't seem to like that the NAS-Port is always zero.
Is there a way to tell the pppd-radius plugin, or, radiusclient to use a different "NAS Port" when it sends the RADIUS authentication requests? The pppd-radius man page says I can use "map-to-ifname" or "map-to-ttyname" (I'm using PPP v2.4.4b1). However, looking at the source code for pppd-radius, in radius.c it appears the NAS Port is hardcoded as zero. Would it then, be up to radiusclient to send the
The code I'm looking at (both the 2.4.3 and CVS) does not do anything of the sort. The "radius_chap_verify" and "radius_pap_auth" functions both set:
rstate.client_port = get_client_port(portnumap ? devnam : ifname);
...and that function either strips the digits off interface formatted names such as "pppXYZ" and returns that or calls rc_map2id which is a radiusclient function that reads /etc/radiusclient/port-id-map but only for TTYs.
I put in some debugging code there to spit out the ifname and devname. For some reason, they are both blank. I'm using openl2tpd and that may be messing up the reporting of the ppp interface, but, my question is this: At the time the RADIUS authentication is being run, is pppd supposed to know which ppp interface it's going to use? (i.e. ppp3) When I added some debugging code to the plugin to spit out the ifname and devname variables, they were both blank. (I was using error() to have it go out to the syslog.) If pppd is indeed supposed to know what ppp interface it's going to use at the time the pppd-radius plugin makes its authentication request, then I know to go back to the openl2tpd developers and find out what's going on with that. However, I can find no evidence that the pppd-radius plugin knows what device name or interface is used because I also get: rc_map2id: can't find tty /dev/ in map database (what get_client_port() calls when it can't find an interface) This is what I'm trying to get to the bottom of.
I run a couple of multi-hundred-client servers off ppp-2.4.3 with the bundled radius plugin, and it works just fine. I didn't have to change the defaults.
NAS Port? It appears to only have facility for setting NAS Port from the tty, and that's not an option for me.
Why?
openl2tpd uses some odd device naming for its connections, but somehow they're not being passed in to pppd. They're in the form of "l2tpX-Y", however pppd-radius plugin doesn't seem to see any of the devices or interfaces. They are all blank when pppd-radius is doing its authentication. Eventually though main.c from pppd will report: "Using interface ppp3..." or whichever it uses, but that's only until after the RADIUS authentication is made and accepted and the user is granted access.
It seems the problem lies with your local installation. I'm not sure how you troubleshoot it further - are you sure you're using a recent ppp?
I'm using PPP 2.4.4b1, and Openl2tpd 0.13. I've been pursuing this with the developers of Openl2tpd as well, but this blank device/interface thing has got me really stumped. Regards, Tom
Tom Murphy wrote:
I put in some debugging code there to spit out the ifname and devname. For some reason, they are both blank. I'm using openl2tpd and that may
Hmm
be messing up the reporting of the ppp interface, but, my question is this:
At the time the RADIUS authentication is being run, is pppd supposed to know which ppp interface it's going to use? (i.e. ppp3) When I
As far as I know, once LCP is up the unit is assigned, and ifname set. You'll definitely have to take this up with the openl2tp / ppp developers.
participants (3)
-
Alan DeKok -
Phil Mayers -
Tom Murphy