Hi, I'm experimenting with using freeradius 2.0.4 to authenticate administrative access to network equipment. If I deploy it then I'll end up with well over a hundred clients, so I'd like to describe the entire address range in a single 'client' block. I also want to have a syslogged record of each login attempt, which I can do, but I can't figure out how to log the client's IP address without having to specify every client individually in freeradius's config. As it is, I just get Login OK: [username] (from client big-netblock port 0) Is there a way around this without having to maintain a huge list of clients? Thanks - Ian -- Ian Chard, Senior Unix and Network Gorilla | E: ian.chard@sers.ox.ac.uk Systems and Electronic Resources Service | T: 80587 / (01865) 280587 Oxford University Library Services | F: (01865) 242287
Hi,
I'm experimenting with using freeradius 2.0.4 to authenticate administrative access to network equipment. If I deploy it then I'll end up with well over a hundred clients, so I'd like to describe the entire address range in a single 'client' block.
okay - just a big range will help you
I also want to have a syslogged record of each login attempt, which I can do, but I can't figure out how to log the client's IP address without having to specify every client individually in freeradius's config. As it is, I just get
Login OK: [username] (from client big-netblock port 0)
Is there a way around this without having to maintain a huge list of clients?
the single line log can be chaged to give more details...but the detail logs give more information - like explicit NAS-IP-Address etc - so if you want more detail, use the detail module....not the linelog. alternatively, use SQL to hold the clients and have each one defined... you can then use dynamic_clients so new entries can be added on the fly without server rebooting alan
On 25/08/09 09:50, Alan Buxey wrote:
[Ian Chard wrote:]
I also want to have a syslogged record of each login attempt, which I can do, but I can't figure out how to log the client's IP address without having to specify every client individually in freeradius's config. As it is, I just get
Login OK: [username] (from client big-netblock port 0)
Is there a way around this without having to maintain a huge list of clients?
the single line log can be chaged to give more details...but the detail logs give more information - like explicit NAS-IP-Address etc - so if you want more detail, use the detail module....not the linelog.
I'm more inclined to use the linelog because I want the messages to end up on my syslog server along with all my other auth events. Can the linelog be changed without recompiling freeradius?
alternatively, use SQL to hold the clients and have each one defined... you can then use dynamic_clients so new entries can be added on the fly without server rebooting
If modifying the linelog isn't possible then I like the sound of this. Is there some documentation on the dynamic_clients option? I can't seem to find any reference to it on freeradius.org. - Ian -- Ian Chard, Senior Unix and Network Gorilla | E: ian.chard@sers.ox.ac.uk Systems and Electronic Resources Service | T: 80587 / (01865) 280587 Oxford University Library Services | F: (01865) 242287
Hi,
If modifying the linelog isn't possible then I like the sound of this. Is there some documentation on the dynamic_clients option? I can't seem to find any reference to it on freeradius.org.
$site_config/raddb/sites-available/dynamic-clients (one of many cases where the feature is new but well documented in the config/code than the website or WIKI) as for linelog, edit modules/linelog for your requirements and then put a call to that module where you need it (eg postauth) alan
On 25/08/09 10:39, Alan Buxey wrote:
Hi,
If modifying the linelog isn't possible then I like the sound of this. Is there some documentation on the dynamic_clients option? I can't seem to find any reference to it on freeradius.org.
$site_config/raddb/sites-available/dynamic-clients
(one of many cases where the feature is new but well documented in the config/code than the website or WIKI)
Ahh gotcha. Looks like I'll have to upgrade (I'm using the Debian lenny stock freeradius 2.0.4, which I believe doesn't have dynamic-clients).
as for linelog, edit modules/linelog for your requirements and then put a call to that module where you need it (eg postauth)
Ditto I think! Many thanks for your help - Ian -- Ian Chard, Senior Unix and Network Gorilla | E: ian.chard@sers.ox.ac.uk Systems and Electronic Resources Service | T: 80587 / (01865) 280587 Oxford University Library Services | F: (01865) 242287
Ian Chard wrote:
I also want to have a syslogged record of each login attempt, which I can do, but I can't figure out how to log the client's IP address without having to specify every client individually in freeradius's config. As it is, I just get
Login OK: [username] (from client big-netblock port 0)
Is there a way around this without having to maintain a huge list of clients?
In 2.1.7, the "Login OK" messages can be customized. You will be able to include a "Packet-Src-IP-Address" in the log message. Alan DeKok.
participants (3)
-
Alan Buxey -
Alan DeKok -
Ian Chard