Authentications types by usernames
Hi All, I'm using Freeradius 2.1, Users that connects to the my network by wireless clients at 2.4GHz get authenticated by username and password, but there also CPE that connect at 5GHz and authenticate thelmselves by username and EAP to give access to wired lan users ( not supplicant ). Is it possible to deny usernames used by cpe on the 2.4GHz net? Can i force username used on cpe only to pass the EAP auth too? if yes..how? it'a matter of policy.conf? Thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentications-types-by-usernames-t... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 29 Sep 2011, at 14:43, andreapepa wrote:
Hi All, I'm using Freeradius 2.1, Users that connects to the my network by wireless clients at 2.4GHz get authenticated by username and password, but there also CPE that connect at 5GHz and authenticate thelmselves by username and EAP to give access to wired lan users ( not supplicant ).
Is it possible to deny usernames used by cpe on the 2.4GHz net? Can i force username used on cpe only to pass the EAP auth too? if yes..how? it'a matter of policy.conf?
Possibly, can you run the server in debugging mode and paste the output of a 5ghz authentication and a 2.4ghz authentication. The Connect-Info attribute may contain the required information if its included. Arran Cudbard-Bell a.cudbardb@freeradius.org Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ !
http://freeradius.1045715.n5.nabble.com/file/n4853189/connection5g.log connection5g.log http://freeradius.1045715.n5.nabble.com/file/n4853189/connection24.log connection24.log These are the logs, i cant see anty connect-info attribute....have to add as a reply atttribute or in the nas config? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentications-types-by-usernames-t... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 29 Sep 2011, at 15:56, andreapepa wrote:
http://freeradius.1045715.n5.nabble.com/file/n4853189/connection5g.log connection5g.log http://freeradius.1045715.n5.nabble.com/file/n4853189/connection24.log connection24.log
These are the logs, i cant see anty connect-info attribute....have to add as a reply atttribute or in the nas config?
The 2.4ghz log is incomplete. Only shows the Accounting-Request which will contain different attributes. The 5.0ghz one did however include this... which means the RADIUS server can determine the SSID the user connected on Called-Station-Id = "00-80-48-60-66-D9:WiNET-TR5G506106" if(Called-Station-Id =~ /:([^:]*)^/){ switch "%{1}" { case 'my-2.4ghz-ssid' { if(User-Name != '2.4ghzuser'){ reject } } case 'my-5.0ghz-ssid' { if(User-Name != '5.0ghzuser'){ reject } } } } If your NAS is not sending Connect-Info by default, you may be able to configure it to send it, but its unlikely. Your best course of action is to map different SSIDs to different radios. If you wanted to use the same SSID, you will need to build a database of 'Called-Station-ID' values, it is likely they will be different for clients connecting to the 2.4ghz radio and the 5.0ghz radio. -Arran Arran Cudbard-Bell a.cudbardb@freeradius.org Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ !
On Thu, Sep 29, 2011 at 8:56 PM, andreapepa <andrea.pepa@trentinonetwork.it> wrote:
http://freeradius.1045715.n5.nabble.com/file/n4853189/connection5g.log connection5g.log http://freeradius.1045715.n5.nabble.com/file/n4853189/connection24.log connection24.log
These are the logs, i cant see anty connect-info attribute....have to add as a reply atttribute or in the nas config?
Connect-Info is sent by NAS, so you should set it in NAS config. I believe the general idea was that if you have some radius attribute that differentiates your two types of user, you can write custom rules on whether to accept/reject them. A quick glance shows your 2.4 GHz log has "NAS-Port-Type = Wireless-802.11" while your 5 GHz log has "Service-Type = Framed-User" in access-request packet. Is that always the case? -- Fajar
On 29 Sep 2011, at 16:19, Fajar A. Nugraha wrote:
On Thu, Sep 29, 2011 at 8:56 PM, andreapepa <andrea.pepa@trentinonetwork.it> wrote:
http://freeradius.1045715.n5.nabble.com/file/n4853189/connection5g.log connection5g.log http://freeradius.1045715.n5.nabble.com/file/n4853189/connection24.log connection24.log
These are the logs, i cant see anty connect-info attribute....have to add as a reply atttribute or in the nas config?
Connect-Info is sent by NAS, so you should set it in NAS config.
I believe the general idea was that if you have some radius attribute that differentiates your two types of user, you can write custom rules on whether to accept/reject them. A quick glance shows your 2.4 GHz log has "NAS-Port-Type = Wireless-802.11" while your 5 GHz log has "Service-Type = Framed-User" in access-request packet. Is that always the case?
Sorry the information is complete... but... are these two different NAS? They're sending very different sets of attributes... Arran Cudbard-Bell a.cudbardb@freeradius.org Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ !
Yes there two kind of mikrotik nas, one is a cpe to connect users lan by 5GHz wireless bridge and the ohter is a classical access point to give access to wireless clients. I've inserted this at the end of policy section in policy.conf but seems not to be read: i can still get authenticated with user usercpe01 on a 2.4GHz access-point that has Called-Station-Id = hotspot1 if(Called-Station-Id =~ /:([^:]*)^/){ switch "%{1}" { case 'hotspot1' { if(User-Name = 'usercpe01'){ reject } } case 'WiNET-TR5G' { if(User-Name != 'usercpe01'){ reject } } } } -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentications-types-by-usernames-t... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On 29 Sep 2011, at 18:23, andreapepa wrote:
Yes there two kind of mikrotik nas, one is a cpe to connect users lan by 5GHz wireless bridge and the ohter is a classical access point to give access to wireless clients.
I've inserted this at the end of policy section in policy.conf but seems not to be read:
Yes you need to call it in the server config. sites-available/default authorize { ... autz_by_frequency } policy.conf policy { autz_by_frequency { if(Called-Station-Id =~ /:WiNET-TR5G^/ && User-Name != 'usercpe01'){ reject } } } Arran Cudbard-Bell a.cudbardb@freeradius.org Betelwiki, Betelwiki, Betelwiki.... http://wiki.freeradius.org/ !
Hi Fajar could be... but i cannot control all the types of authentication that can happens to be configured, i'm looking for some default value that cannot be changed by users -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentications-types-by-usernames-t... Sent from the FreeRadius - User mailing list archive at Nabble.com.
participants (3)
-
andreapepa -
Arran Cudbard-Bell -
Fajar A. Nugraha