Unlang authentication help
hello, I'm trying to use unlang to limit LDAP user's access to different network devices. Here is what I have so far in the site-enable/default: Auth-Type LDAP { ldap if(NAS-IP-Address == 10.1.1.1 && LDAP-Group == 'RouterAdmin') { ok } else { reject } } Right now that works if your LDAP radiusGroupName = RouterAdmin and you are trying to connect to 10.1.1.1 but i would like to add NAS-IP-Addresses and associate them with a radiusGroupName. This is were I'm having trouble. It would be nice it I could just reference a file for the IP's like: RouterAdminList = /usr/local/etc/raddbd/devices/RouterAdmin if(NAS-IP-Address == %{RouterAdminList} && LDAP-Group == 'RouterAdmin') { And have multiple lines.: if(NAS-IP-Address == %{RouterAdminList} && LDAP-Group == 'RouterAdmin') OR if(NAS-IP-Address == %{SwitchAdminList} && LDAP-Group == 'SwitchAdmin') OR if(NAS-IP-Address == %{WifiAdminList} && LDAP-Group == 'WifiAdmin') { ok } else { reject } } How would i do that? And how would list the IP address in the files? Thanks for your help, Scott
I'm trying to use unlang to limit LDAP user's access to different network devices. Here is what I have so far in the site-enable/default:
Auth-Type LDAP { ldap
if(NAS-IP-Address == 10.1.1.1 && LDAP-Group == 'RouterAdmin') { ok } else { reject } }
Right now that works if your LDAP radiusGroupName = RouterAdmin and you are trying to connect to 10.1.1.1 but i would like to add NAS-IP-Addresses and associate them with a radiusGroupName. This is were I'm having trouble. It would be nice it I could just reference a file for the IP's like:
RouterAdminList = /usr/local/etc/raddbd/devices/RouterAdmin
if(NAS-IP-Address == %{RouterAdminList} && LDAP-Group == 'RouterAdmin') {
And have multiple lines.:
if(NAS-IP-Address == %{RouterAdminList} && LDAP-Group == 'RouterAdmin') OR if(NAS-IP-Address == %{SwitchAdminList} && LDAP-Group == 'SwitchAdmin') OR if(NAS-IP-Address == %{WifiAdminList} && LDAP-Group == 'WifiAdmin') { ok } else { reject } }
How would i do that? And how would list the IP address in the files?
Use huntgroups (raddb/huntgroups). if(Huntgroup-Name == "routers" && Ldap-Group == "RouterAdmin") { ok } else { reject } Ivan Kalik Kalik Informatika ISP
I'd like our radius proxy server to allow an A/V pair, but, cannot find any examples where I can apply any regex type rules to allow a range of values. For example, I received the following from a remote radius server : Cisco-AVPair = vpdn:ip-addresses=10.10.1.4 and would want to (using attrs) allow anything that matches: Cisco-AVPair = vpdn:ip-addresses=.* Where ".*" would be anything following the "=" How might I allow this using attrs? I'm running freeradius 1.0.5 I can't upgrade to 2.x yet, so I'm looking for suggestions/feedback for 1.x
On Thu, 25 Jun 2009, Francisco wrote:
I'd like our radius proxy server to allow an A/V pair, but, cannot find any examples where I can apply any regex type rules to allow a range of values. For example, I received the following from a remote radius server : Cisco-AVPair = vpdn:ip-addresses=10.10.1.4 and would want to (using attrs) allow anything that matches: Cisco-AVPair = vpdn:ip-addresses=.* Where ".*" would be anything following the "=" How might I allow this using attrs? I'm running freeradius 1.0.5 I can't upgrade to 2.x yet, so I'm looking for suggestions/feedback for 1.x
LOL! Hi Francisco! Fancy meeting you here! ;) Did you try: Cisco-AVPair =~ "vpdn:ip-addresses=.*" ?? I found this in 'man 5 users'..... So you're on 1.x too, huh? Funny how many of us are. :) - Charles
participants (4)
-
Charles Gregory -
Francisco -
Ivan Kalik -
Scott Angus