Again: clients.conf storage in ldap
Hello list, I have found one old discussion in freeradius maillist about storing RADIUS clients definitions in LDAP. That discussion is from date 23 Nov 2004 and is in following link: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg11425.h... I want to ask what is the status of integrating clients.conf in LDAP storage now, four years later from that discussion? This integration is interesting and makes the configuration more centralized. thanks michal -- Ing. Michal Bruncko, CCNP Linux systems and network administrator Coupled school of business and services Ruzomberok Slovak Republic
On 03/12/10 13:52, Michal Bruncko wrote:
Hello list,
I have found one old discussion in freeradius maillist about storing RADIUS clients definitions in LDAP. That discussion is from date 23 Nov 2004 and is in following link: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg11425.h...
I want to ask what is the status of integrating clients.conf in LDAP storage now, four years later from that discussion? This integration is interesting and makes the configuration more centralized.
FreeRadius 2 has support for dynamic clients; with that I guess the "ldap" module can be used to reply to the dynamic client queries with "xlat" values or (with a 2nd instance and custom ldap.attrmap) read them wholesale out of LDAP. For example: modules { ldap ldap_clients { ... ldap config dictionary_mapping = ldap.attrmap_clients base = ... filter = (radiusClientIP=%{Packet-Src-IP-Address}) } } client dynamic { ipaddr = 192.168.0.0 netmask = 16 dynamic_client = dyn_clients_ldap lifetime = 3600 } server dyn_clients_ldap { authorize { ldap_clients } } ...and in ldap.attrmap_clients: checkItem FreeRADIUS-Client-Secret radiusClientSecret checkItem FreeRADIUS-Client-IP-Address radiusClientIP checkItem FreeRADIUS-Client-Shortname cn ...obviously modify for your LDAP schema.
On 12/03/2010 08:52 AM, Michal Bruncko wrote:
Hello list,
I have found one old discussion in freeradius maillist about storing RADIUS clients definitions in LDAP. That discussion is from date 23 Nov 2004 and is in following link: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg11425.h...
I want to ask what is the status of integrating clients.conf in LDAP storage now, four years later from that discussion? This integration is interesting and makes the configuration more centralized.
I sent Alan patches for storing clients in ldap. I think I recall Alan saying the plan was to add them to the 2.2 version. -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
John Dennis wrote:
I sent Alan patches for storing clients in ldap. I think I recall Alan saying the plan was to add them to the 2.2 version.
That's on the (large) list of things to do. I like Phil's suggestion, too. Even 2.1 has the "dynamic_clients" module, so that *all* of the clients can be defined dynamically. It's just habit that most people put them into a static "clients.conf" file. Alan DeKok.
I had it setup in mysql using the ability to manually specify queries. if the ldap module has that exact same functionality, it should be absolutely possible. Unless you have frequently changing clients, or an overabundance of clients, it's not worth it. it's a nightmare to maintain On 12/3/2010 5:52 AM, Michal Bruncko wrote:
Hello list,
I have found one old discussion in freeradius maillist about storing RADIUS clients definitions in LDAP. That discussion is from date 23 Nov 2004 and is in following link: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg11425.h...
I want to ask what is the status of integrating clients.conf in LDAP storage now, four years later from that discussion? This integration is interesting and makes the configuration more centralized.
thanks
michal
participants (5)
-
Alan DeKok -
Christ Schlacta -
John Dennis -
Michal Bruncko -
Phil Mayers