Hello freeradius users! I've configured authentication and authorization via freeradius that looking in openldap for users and passwords. In radius.conf in ldap section I used filter filter = "(&(cn=%{Stripped-User-Name:-%{User-Name}})(description=%{NAS-IP-Address}))" So I only need to make description field with IP address of device to give user access to some device. But when I add new device I always have to edit clients.conf, add new IP address and secret. I do not want to use 0.0.0.0 and same secret for all devices. Is it possible to store device secrets in openldap? If yes, please, point me to right direction. And may be it's possible change way how can I give access to devices for users? I mean something like group cn=someSwitch,ou=devices,dc=domain,dc=com, and this group has field with IP address of device and something like "member: user1" or "memberUid: cn=user1,ou=users,dc=domain,dc=com". I'm a bit confused about how to implement it... Thanks in advance for advices!
c0re wrote:
Is it possible to store device secrets in openldap? If yes, please, point me to right direction.
Not really. And I think your configuration doesn't really do what you think it does. At the minimum, you should be using Packet-Src-IP-Address instead of NAS-IP-Address. See raddb/sites-available/dynamic-clients for examples of how to dynamically add clients. They can likely be read from LDAP with some customized configuration. Alan DeKok.
On Wed, Feb 2, 2011 at 3:57 PM, c0re <nr1c0re@gmail.com> wrote:
But when I add new device I always have to edit clients.conf, add new IP address and secret. I do not want to use 0.0.0.0 and same secret for all devices.
Is it possible to store device secrets in openldap? If yes, please, point me to right direction.
Try this from the list archive: http://freeradius.1045715.n5.nabble.com/HOWTO-Centralised-LDAP-Authenticatio... -- Fajar
Actually it was here http://lists.freeradius.org/pipermail/freeradius-users/2010-October/msg00058... But Peter Lambrechtsen uses Novell eDirectory, so from his howto <quote> Then create two OU's under Radius. Elements and Roles OU=Elements,OU=Radius,DC=ACME,DC=COM Elements will hold a record of every NAS in your Network. You will create Group objects based on the IP Address of the NAS and set the "Location" or "l" attribute to the NAS Huntgroup the NAS belongs to allow them to be centrally managed in LDAP. IE CN=10.1.2.3,OU=Elements,OU=Radius,DC=ACME,DC=COM With a "l" value of "CiscoRTR" for a Cisco Router that has a NAS-IP-Address or Source-IP-Address of 10.1.2.3. This will make more sense further on. </quote> But what objectClass is it with "l" attribute? When I tried to implement it I stuck with this. Any comments welcome! 2011/2/2 Fajar A. Nugraha <list@fajar.net>:
On Wed, Feb 2, 2011 at 3:57 PM, c0re <nr1c0re@gmail.com> wrote:
But when I add new device I always have to edit clients.conf, add new IP address and secret. I do not want to use 0.0.0.0 and same secret for all devices.
Is it possible to store device secrets in openldap? If yes, please, point me to right direction.
Try this from the list archive: http://freeradius.1045715.n5.nabble.com/HOWTO-Centralised-LDAP-Authenticatio...
-- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, Feb 2, 2011 at 4:53 PM, c0re <nr1c0re@gmail.com> wrote:
You will create Group objects based on the IP Address of the NAS and set the "Location" or "l" attribute to the NAS Huntgroup the NAS belongs to allow them to be centrally managed in LDAP.
But what objectClass is it with "l" attribute?
I'm guessing you can just use any available attribute, and simply adjust the LDAP query (from the original post) if you use another attribute #Set the Client-Shortname to be the Location "l" just like in the Huntgroups, but this time to the shortname. FreeRADIUS-Client-Shortname = "%{ldap:ldap:///OU=Elements,OU=Radius,DC=ACME,DC=COM?l?sub?cn=%{Packet-Src-IP-Address}}"
When I tried to implement it I stuck with this. Any comments welcome!
Ask Peter directly? -- Fajar
participants (3)
-
Alan DeKok -
c0re -
Fajar A. Nugraha