How to allow group login on some devices?
Hiya... I've got a freeradius setup which is consulting LDAP quite happily, providing password logins for all our users to our wireless network. Which is lovely. :D Now, I'd like to set up our switches to use radius to allow our technicians to login. And they are all members of an LDAP group. Let's call it "cn=techies,ou=groups,dc=example,dc=org". I only want this to be the case for some client devices, namely our switches. Can anyone point me towards the documentation I should have read? Sorry to be a pain. Mart -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.
Martin Whinnery wrote:
Now, I'd like to set up our switches to use radius to allow our technicians to login. And they are all members of an LDAP group. Let's call it "cn=techies,ou=groups,dc=example,dc=org". I only want this to be the case for some client devices, namely our switches.
Can anyone point me towards the documentation I should have read?
The LDAP-Group attribute will check LDAP group membership. http://wiki.freeradius.org/Rlm_ldap You can put switches (or NASes) into groups via the Huntgroup. See raddb/huntgroups. Then... combine them. In the "users" file: DEFAULT LDAP-Group == "techies", Huntgroup-Name != "some-switches", Auth-Type := Reject (all on one line) Alan DeKok.
participants (2)
-
Alan DeKok -
Martin Whinnery