Multiple Services - Single Login
Hi, I am curious to understand the best means of providing multiple service authentications, such as PPPoE, Dialup, VPN, etc, via one login and password. I have seen it done before by NAS-IP-Address but it would quite cumbersome in our network. I was fooling around with the "NAS-Port-Type" but am having mixed results. Is there a better way to determine the type of service? Thanks, -- Nick Huanca
I am curious to understand the best means of providing multiple service authentications, such as PPPoE, Dialup, VPN, etc, via one login and password. I have seen it done before by NAS-IP-Address but it would quite cumbersome in our network. I was fooling around with the "NAS-Port-Type" but am having mixed results. Is there a better way to determine the type of service?
The only other thing that might distingush between those options would be Calling-Station-Id. For PPPoE it should be mac address, for VPN IP address and for dial phone number. Ivan Kalik Kalik Informatika ISP
Thanks Ivan, I am a little concerned with that as we have about 20 NASes and a national Dialup plan (unknown amount of NASs). Can you assign multiple groups to a user where in each group it will look for the "NAS-Port-Type?" If I can at least distinguish between Async and Ethernet then I can work around the VPN stuff. Thanks, On Mon, Jun 29, 2009 at 6:00 PM, Ivan Kalik <tnt@kalik.net> wrote:
I am curious to understand the best means of providing multiple service authentications, such as PPPoE, Dialup, VPN, etc, via one login and password. I have seen it done before by NAS-IP-Address but it would quite cumbersome in our network. I was fooling around with the "NAS-Port-Type" but am having mixed results. Is there a better way to determine the type of service?
The only other thing that might distingush between those options would be Calling-Station-Id. For PPPoE it should be mac address, for VPN IP address and for dial phone number.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Nick Huanca Inside Plant Manager GAW High-Speed Internet 1300 Putney Rd Brattleboro, VT 05301 [offices] (877) 220-2873 [direct] (802) 246-1192 x214 [mobile] (802) 380-7339 www.gaw.com --- PRIVACY AND CONFIDENTIALITY NOTICE: This communication and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential, proprietary and/or legally privileged or protected information. If you believe you have received this communication in error, please immediately reply to the sender and delete this message. Any use, disclosure, retransmission, distribution, copying, or taking of any action based on this information by any person or entity other than the intended recipient is strictly prohibited and may be unlawful. Because e-mail can be altered electronically, the integrity of this communication cannot be guaranteed.
Nick Huanca wrote:
I am curious to understand the best means of providing multiple service authentications, such as PPPoE, Dialup, VPN, etc, via one login and password. I have seen it done before by NAS-IP-Address but it would quite cumbersome in our network. I was fooling around with the "NAS-Port-Type" but am having mixed results. Is there a better way to determine the type of service?
The NAS *should* put something useful into the packet. If it doesn't, you're left with looking at the *entire* packet, and trying to figure out which packets are for which service. Usually a combination of NAS IP address, NAS port, and Service-Type should do the trick. Alan DeKok.
I have gotten it down to NAS-Port-Type but when I add multiple port types (i.e. two groups to a user). It gives me a SQL cannot find the user error in the log. On Tue, Jun 30, 2009 at 11:34 AM, Alan DeKok <aland@deployingradius.com>wrote:
Nick Huanca wrote:
I am curious to understand the best means of providing multiple service authentications, such as PPPoE, Dialup, VPN, etc, via one login and password. I have seen it done before by NAS-IP-Address but it would quite cumbersome in our network. I was fooling around with the "NAS-Port-Type" but am having mixed results. Is there a better way to determine the type of service?
The NAS *should* put something useful into the packet. If it doesn't, you're left with looking at the *entire* packet, and trying to figure out which packets are for which service.
Usually a combination of NAS IP address, NAS port, and Service-Type should do the trick.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Nick Huanca Inside Plant Manager GAW High-Speed Internet 1300 Putney Rd Brattleboro, VT 05301 [offices] (877) 220-2873 [direct] (802) 246-1192 x214 [mobile] (802) 380-7339 www.gaw.com --- PRIVACY AND CONFIDENTIALITY NOTICE: This communication and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential, proprietary and/or legally privileged or protected information. If you believe you have received this communication in error, please immediately reply to the sender and delete this message. Any use, disclosure, retransmission, distribution, copying, or taking of any action based on this information by any person or entity other than the intended recipient is strictly prohibited and may be unlawful. Because e-mail can be altered electronically, the integrity of this communication cannot be guaranteed.
Nick Huanca wrote:
I have gotten it down to NAS-Port-Type but when I add multiple port types (i.e. two groups to a user). It gives me a SQL cannot find the user error in the log.
Perhaps you could try running the server in debugging mode as suggest in the FAQ, README, INSTALL, "man" page, and daily on this list. Alan DeKok.
I have gotten it down to NAS-Port-Type but when I add multiple port types (i.e. two groups to a user). It gives me a SQL cannot find the user error in the log.
That shouldn't happen in 2.x. If you put user specific information (like password) into radcheck/radreply and NAS specific info into radgroupcheck/radgroupreply user should get authenticated and proper attributes returned. Post the debug. Ivan Kalik Kalik Informatika ISP
Ok thanks, I'll create a small lab and test these out. Just wondering if there was a quick answer out there. Thanks for all your time guys, On Tue, Jun 30, 2009 at 11:53 AM, Ivan Kalik <tnt@kalik.net> wrote:
I have gotten it down to NAS-Port-Type but when I add multiple port types (i.e. two groups to a user). It gives me a SQL cannot find the user error in the log.
That shouldn't happen in 2.x. If you put user specific information (like password) into radcheck/radreply and NAS specific info into radgroupcheck/radgroupreply user should get authenticated and proper attributes returned. Post the debug.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Nick Huanca
participants (4)
-
Alan DeKok -
Ivan Kalik -
Nick Huanca -
Nick Huanca