Hi there freeradius list, I need to be able to match a client request with a specific key. I generally do this by matching IPs in the clients.conf file. Is there any way to match to a Vendor specific attribute? For instance if the request comes in from a specific vendor-id in the request I could match based on that and a specific radius secret key is used for the radius authentication session. Cheers, Noah
On Apr 13, 2017, at 3:46 PM, Noah <noah-list@enabled.com> wrote:
I need to be able to match a client request with a specific key. I generally do this by matching IPs in the clients.conf file.\
Ok...
Is there any way to match to a Vendor specific attribute? For instance if the request comes in from a specific vendor-id in the request I could match based on that and a specific radius secret key is used for the radius authentication session.
I'm not sure what that means. For FreeRADIUS, all attributes are just attributes. It doesn't matter if they're "normal" ones or VSAs. All of the attribute matching and comparison is done via standard methods. See "man unlang". if you're asking whether you can match clients based on some information... the answer is "no". Clients are matched based on IP address (or network). See raddb/clients.conf. Alan DeKok.
Hi, Thanks for your response, Alan. More below. On 4/13/17 12:59 PM, Alan DeKok wrote:
On Apr 13, 2017, at 3:46 PM, Noah <noah-list@enabled.com> wrote:
I need to be able to match a client request with a specific key. I generally do this by matching IPs in the clients.conf file.\
Ok...
Is there any way to match to a Vendor specific attribute? For instance if the request comes in from a specific vendor-id in the request I could match based on that and a specific radius secret key is used for the radius authentication session.
I'm not sure what that means.
For FreeRADIUS, all attributes are just attributes. It doesn't matter if they're "normal" ones or VSAs. All of the attribute matching and comparison is done via standard methods. See "man unlang".
if you're asking whether you can match clients based on some information... the answer is "no". Clients are matched based on IP address (or network). See raddb/clients.conf.
Alan DeKok.
Is there any way to configure matching a request to a specific secret based on the device type? Cheers, Noah
If the device has an attribute that sends that information in its request, you can create a policy that checks that attribute value and the actions you want. Regards, Kenroy On Thu, Apr 13, 2017 at 7:29 PM, Noah <noah-list@enabled.com> wrote:
Hi,
Thanks for your response, Alan. More below.
On 4/13/17 12:59 PM, Alan DeKok wrote:
On Apr 13, 2017, at 3:46 PM, Noah <noah-list@enabled.com> wrote:
I need to be able to match a client request with a specific key. I generally do this by matching IPs in the clients.conf file.\
Ok...
Is there any way to match to a Vendor specific attribute? For instance
if the request comes in from a specific vendor-id in the request I could match based on that and a specific radius secret key is used for the radius authentication session.
I'm not sure what that means.
For FreeRADIUS, all attributes are just attributes. It doesn't matter if they're "normal" ones or VSAs. All of the attribute matching and comparison is done via standard methods. See "man unlang".
if you're asking whether you can match clients based on some information... the answer is "no". Clients are matched based on IP address (or network). See raddb/clients.conf.
Alan DeKok.
Is there any way to configure matching a request to a specific secret based on the device type?
Cheers,
Noah
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html
Kenroy - are there any examples out there of this? Cheers, Noah On 4/13/17 4:35 PM, Kenroy wrote:
If the device has an attribute that sends that information in its request, you can create a policy that checks that attribute value and the actions you want.
Regards, Kenroy
On Thu, Apr 13, 2017 at 7:29 PM, Noah <noah-list@enabled.com> wrote:
Hi,
Thanks for your response, Alan. More below.
On 4/13/17 12:59 PM, Alan DeKok wrote:
On Apr 13, 2017, at 3:46 PM, Noah <noah-list@enabled.com> wrote:
I need to be able to match a client request with a specific key. I generally do this by matching IPs in the clients.conf file.\
Ok...
Is there any way to match to a Vendor specific attribute? For instance
if the request comes in from a specific vendor-id in the request I could match based on that and a specific radius secret key is used for the radius authentication session.
I'm not sure what that means.
For FreeRADIUS, all attributes are just attributes. It doesn't matter if they're "normal" ones or VSAs. All of the attribute matching and comparison is done via standard methods. See "man unlang".
if you're asking whether you can match clients based on some information... the answer is "no". Clients are matched based on IP address (or network). See raddb/clients.conf.
Alan DeKok.
Is there any way to configure matching a request to a specific secret based on the device type?
Cheers,
Noah
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi Nolan, Freeradius policy files are stored in /etc/freeradius/policy.d . You can take a look at these and read the freeradius wiki to get an idea on how to create one. Here is an example of a policy I used for a Nomadix access gateway to authenicate users on a specific VLAN. I hope this helps :) ------------------------------------------------------ halcyon { if( &request:NAS-Port == 2030 ){ update control { Auth-Type := Accept } update reply { Nomadix-Group-Bw-Policy-Id = 3 Nomadix-Group-Bw-Max-Down = 30000 Nomadix-Group-Bw-Max-Up = 30000 Nomadix-Net-VLAN = 2030 Idle-Timeout = 18000 Session-Timeout = 36000 } } } ---------------------------------------------------- On Thu, Apr 13, 2017 at 8:49 PM, Noah <noah-list@enabled.com> wrote:
Kenroy - are there any examples out there of this?
Cheers,
Noah
On 4/13/17 4:35 PM, Kenroy wrote:
If the device has an attribute that sends that information in its request, you can create a policy that checks that attribute value and the actions you want.
Regards, Kenroy
On Thu, Apr 13, 2017 at 7:29 PM, Noah <noah-list@enabled.com> wrote:
Hi,
Thanks for your response, Alan. More below.
On 4/13/17 12:59 PM, Alan DeKok wrote:
On Apr 13, 2017, at 3:46 PM, Noah <noah-list@enabled.com> wrote:
I need to be able to match a client request with a specific key. I
generally do this by matching IPs in the clients.conf file.\
Ok...
Is there any way to match to a Vendor specific attribute? For instance
if the request comes in from a specific vendor-id in the request I could match based on that and a specific radius secret key is used for the radius authentication session.
I'm not sure what that means.
For FreeRADIUS, all attributes are just attributes. It doesn't matter if they're "normal" ones or VSAs. All of the attribute matching and comparison is done via standard methods. See "man unlang".
if you're asking whether you can match clients based on some information... the answer is "no". Clients are matched based on IP address (or network). See raddb/clients.conf.
Alan DeKok.
Is there any way to configure matching a request to a specific secret
based on the device type?
Cheers,
Noah
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html
Also you have to know what your device. Get a dictionary file and get an understanding of what VSA it sends in its request. Also most systems if not all will also send "NAS-IP-Address" AVP which contains the ip address of the client. On Thu, Apr 13, 2017 at 9:00 PM, Kenroy <bennettk9999@gmail.com> wrote:
Hi Nolan,
Freeradius policy files are stored in /etc/freeradius/policy.d . You can take a look at these and read the freeradius wiki to get an idea on how to create one.
Here is an example of a policy I used for a Nomadix access gateway to authenicate users on a specific VLAN.
I hope this helps :) ------------------------------------------------------
halcyon {
if( &request:NAS-Port == 2030 ){
update control { Auth-Type := Accept
}
update reply {
Nomadix-Group-Bw-Policy-Id = 3 Nomadix-Group-Bw-Max-Down = 30000 Nomadix-Group-Bw-Max-Up = 30000 Nomadix-Net-VLAN = 2030 Idle-Timeout = 18000 Session-Timeout = 36000
}
}
} ----------------------------------------------------
On Thu, Apr 13, 2017 at 8:49 PM, Noah <noah-list@enabled.com> wrote:
Kenroy - are there any examples out there of this?
Cheers,
Noah
On 4/13/17 4:35 PM, Kenroy wrote:
If the device has an attribute that sends that information in its request, you can create a policy that checks that attribute value and the actions you want.
Regards, Kenroy
On Thu, Apr 13, 2017 at 7:29 PM, Noah <noah-list@enabled.com> wrote:
Hi,
Thanks for your response, Alan. More below.
On 4/13/17 12:59 PM, Alan DeKok wrote:
On Apr 13, 2017, at 3:46 PM, Noah <noah-list@enabled.com> wrote:
I need to be able to match a client request with a specific key. I
generally do this by matching IPs in the clients.conf file.\
Ok...
Is there any way to match to a Vendor specific attribute? For instance
if the request comes in from a specific vendor-id in the request I could match based on that and a specific radius secret key is used for the radius authentication session.
I'm not sure what that means.
For FreeRADIUS, all attributes are just attributes. It doesn't matter if they're "normal" ones or VSAs. All of the attribute matching and comparison is done via standard methods. See "man unlang".
if you're asking whether you can match clients based on some information... the answer is "no". Clients are matched based on IP address (or network). See raddb/clients.conf.
Alan DeKok.
Is there any way to configure matching a request to a specific secret
based on the device type?
Cheers,
Noah
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html
On Apr 13, 2017, at 7:29 PM, Noah <noah-list@enabled.com> wrote:
Is there any way to configure matching a request to a specific secret based on the device type?
As I said, and perhaps as you should read: clients are based on IP address. Asking the same question repeatedly won't get you a different answer. Alan DeKok.
Hey Alan - that was a different question. Stop responding to my questions. Its not helping. On 4/13/17 4:36 PM, Alan DeKok wrote:
On Apr 13, 2017, at 7:29 PM, Noah <noah-list@enabled.com> wrote:
Is there any way to configure matching a request to a specific secret based on the device type?
As I said, and perhaps as you should read: clients are based on IP address.
Asking the same question repeatedly won't get you a different answer.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Apr 13, 2017, at 8:48 PM, Noah <noah-list@enabled.com> wrote:
Hey Alan - that was a different question. Stop responding to my questions. Its not helping.
If you're going to get upset at the answers you receive here, feel free to unsubscribe. If you keep complaining, you will be unsubscribed from the list, and permanently banned. Alan DeKok.
Alan, Okay I have had enough of your abuse. I am unsubing anyways. I got the help from other more helpful folks. Thanks Kenroy. Hey thanks Cheers, Noah On 4/13/17 5:56 PM, Alan DeKok wrote:
On Apr 13, 2017, at 8:48 PM, Noah <noah-list@enabled.com> wrote:
Hey Alan - that was a different question. Stop responding to my questions. Its not helping.
If you're going to get upset at the answers you receive here, feel free to unsubscribe.
If you keep complaining, you will be unsubscribed from the list, and permanently banned.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Kenroy -
Noah