freeradius and IP pools
Hi. I need to use freeradius in multiple ways. I mean: based on realm, I need to assign or not an IP address. For example: user@with_ip has to receive an IP from configured RADIPPOOL table user@without_ip has only to be authenticated (a user who log to a portal, for example). How can I make it possibile? Where can I setup this behaviuor? Thanks. Arrigo.
For example:
user@with_ip
has to receive an IP from configured RADIPPOOL table
user@without_ip
has only to be authenticated (a user who log to a portal, for example).
How can I make it possibile? Where can I setup this behaviuor?
Create those realms as local realms in proxy.conf. Put: DEFAULT Realm == with_ip, Pool-Name:= your_pool_name in users file. Ivan Kalik Kalik Informatika ISP
OK. I have in proxy.conf: realm with_ip { authhost = LOCAL accthost = LOCAL realm without_ip { authhost = LOCAL accthost = LOCAL Next I have mysql tables containing usernames: mysql> select * from radcheck; +----+----------+---------+--------------------+----+-------+ | id | username | realm | attribute | op | value | +----+----------+---------+--------------------+----+-------+ | 1 | user | with_ip | Cleartext-Password | := | ip | +----+----------+---------+--------------------+----+-------+ mysql> select * from radgroupcheck; +----+-------------+-----------+----+----------+ | id | groupname | attribute | op | value | +----+-------------+-----------+----+----------+ | 1 | withipgroup | Pool-Name | := | ip_pool | +----+-------------+-----------+----+----------+ mysql> select * from radippool; +----+-----------+-----------------+ | id | pool_name | framedipaddress | +----+-----------+-----------------+ | 1 | ip_pool | 10.0.0.1 | | 2 | ip_pool | 10.0.0.2 | +----+-----------+-----------------+ mysql> select * from radusergroup; +----------+---------+-------------+----------+ | username | realm | groupname | priority | +----------+---------+-------------+----------+ | user | with_ip | withipgroup | 1 | +----------+---------+-------------+----------+ That's good for ip-provided users and it works. But I need to understand how to configure the second user, the without-ip one. Arrigo -----Messaggio originale----- Da: freeradius-users-bounces+a.savio=bascom.it@lists.freeradius.org [mailto:freeradius-users-bounces+a.savio=bascom.it@lists.freeradius.org] Per conto di tnt@kalik.net Inviato: venerdì 12 dicembre 2008 17.02 A: FreeRadius users mailing list Oggetto: Re: freeradius and IP pools
For example:
user@with_ip
has to receive an IP from configured RADIPPOOL table
user@without_ip
has only to be authenticated (a user who log to a portal, for example).
How can I make it possibile? Where can I setup this behaviuor?
Create those realms as local realms in proxy.conf. Put: DEFAULT Realm == with_ip, Pool-Name:= your_pool_name in users file. Ivan Kalik Kalik Informatika ISP
OK. I have in proxy.conf: realm with_ip { authhost = LOCAL accthost = LOCAL
realm without_ip { authhost = LOCAL accthost = LOCAL
Next I have mysql tables containing usernames: mysql> select * from radcheck; +----+----------+---------+--------------------+----+-------+ | id | username | realm | attribute | op | value | +----+----------+---------+--------------------+----+-------+ | 1 | user | with_ip | Cleartext-Password | := | ip | +----+----------+---------+--------------------+----+-------+ mysql> select * from radgroupcheck; +----+-------------+-----------+----+----------+ | id | groupname | attribute | op | value | +----+-------------+-----------+----+----------+ | 1 | withipgroup | Pool-Name | := | ip_pool | +----+-------------+-----------+----+----------+ mysql> select * from radippool; +----+-----------+-----------------+ | id | pool_name | framedipaddress | +----+-----------+-----------------+ | 1 | ip_pool | 10.0.0.1 | | 2 | ip_pool | 10.0.0.2 | +----+-----------+-----------------+ mysql> select * from radusergroup; +----------+---------+-------------+----------+ | username | realm | groupname | priority | +----------+---------+-------------+----------+ | user | with_ip | withipgroup | 1 | +----------+---------+-------------+----------+
That's good for ip-provided users and it works. But I need to understand how to configure the second user, the without-ip one.
Make just radcheck entry for that one. Ivan Kalik Kalik Informatika ISP
-----Messaggio originale----- Da: freeradius-users-bounces+a.savio=bascom.it@lists.freeradius.org [mailto:freeradius-users-bounces+a.savio=bascom.it@lists.freeradius.org] Per conto di tnt@kalik.net Inviato: venerdì 12 dicembre 2008 18.00 A: FreeRadius users mailing list Oggetto: Re: R: freeradius and IP pools
OK. I have in proxy.conf: realm with_ip { authhost = LOCAL accthost = LOCAL
realm without_ip { authhost = LOCAL accthost = LOCAL
Next I have mysql tables containing usernames: mysql> select * from radcheck; +----+----------+---------+--------------------+----+-------+ | id | username | realm | attribute | op | value | +----+----------+---------+--------------------+----+-------+ | 1 | user | with_ip | Cleartext-Password | := | ip | +----+----------+---------+--------------------+----+-------+ mysql> select * from radgroupcheck; +----+-------------+-----------+----+----------+ | id | groupname | attribute | op | value | +----+-------------+-----------+----+----------+ | 1 | withipgroup | Pool-Name | := | ip_pool | +----+-------------+-----------+----+----------+ mysql> select * from radippool; +----+-----------+-----------------+ | id | pool_name | framedipaddress | +----+-----------+-----------------+ | 1 | ip_pool | 10.0.0.1 | | 2 | ip_pool | 10.0.0.2 | +----+-----------+-----------------+ mysql> select * from radusergroup; +----------+---------+-------------+----------+ | username | realm | groupname | priority | +----------+---------+-------------+----------+ | user | with_ip | withipgroup | 1 | +----------+---------+-------------+----------+
That's good for ip-provided users and it works. But I need to understand how to configure the second user, the without-ip one.
Make just radcheck entry for that one. Ivan Kalik Kalik Informatika ISP I configured user2 in radcheck table +----+----------+------------+--------------------+----+-------+ | id | username | realm | attribute | op | value | +----+----------+------------+--------------------+----+-------+ | 1 | user1 | with_ip | Cleartext-Password | := | ip | | 2 | user2 | without_ip | Cleartext-Password | := | noip | +----+----------+------------+--------------------+----+-------+ without group membership for this user2. In radius.log I see this message: Mon Dec 15 10:38:11 2008 : Info: No Pool-Name defined (did cli port user user2@without_ip) Tecnically the authentication works fine, I want only understand if I can avoid this message. Thanks, Arrigo.
Mon Dec 15 10:38:11 2008 : Info: No Pool-Name defined (did cli port user user2@without_ip)
Tecnically the authentication works fine, I want only understand if I can avoid this message.
Don't log it. You will need to alter the code for that. Ivan Kalik Kalik Informatika ISP
If both users are the same, it is better to configure just one user and make checks stripping the realm. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337
participants (3)
-
Angel L. Mateo -
Arrigo Savio -
tnt＠kalik.net