Hello everyone, we want to install one central freeradius that handles requests from multiple customers. Nearly all the handling for those customers is the same. Even the database should be the same. Just the namespace for each customer's users should be different, so that for example customer1 and customer2 can both have a joe user. We're currently using the default sql user database, but this one doesn't seem to support this directly. On the other hand, we want radiusclient1.customer1 and radiusclient2.customer1 to be handled identically. Is there a special module that could help us achieving this or what would be the best way to solve this kind of problem? We have searched around and come across a few possible ways tho we are not sure if they are good or would work at all. Anyway, those are: 1. Somehow check for the client IP using sql queries. Tho this way it might be hard if not impossible to that vpnserver1.customer1 and vpnserver2.customer2 both belong to customer1 2. Something with using realms. If it is possible with virtual servers to force customers in realms and then later check in the database for those realms to determine the customers. 3. A custom unlang or similar script that would filter the clients by our needs Kind regards, Manfred -- CosmoKey GmbH & Co. KG, Amtsgericht Bielefeld HRA 16201, vertreten durch ihre Geschäftsführerin die CosmoKey Beteiligungs GmbH, Amtsgericht Bielefeld HRB 41522, diese vertreten durch ihren Geschäftsführer Herrn Dominic Adenuga Walther-Rathenau-Str. 39 33602 Bielefeld Germany Telefon: 0151-43144121 Telefax: 0521-69983 Email: info@cosmokey.de CosmoKey GmbH & Co. KG USt-ID: DE296278210 CosmoKey GmbH USt-ID: DE296278201
On Jul 14, 2015, at 10:01 AM, Manfred Wolf <Manfred.Wolf@cosmokey.com> wrote:
we want to install one central freeradius that handles requests from multiple customers. Nearly all the handling for those customers is the same. Even the database should be the same. Just the namespace for each customer's users should be different, so that for example customer1 and customer2 can both have a joe user.
This is largely a database issue. Extend the default schema so that each user has a "customer" column. Then, add a "customer" qualifier to the FreeRADIUS queries.
We're currently using the default sql user database, but this one doesn't seem to support this directly. On the other hand, we want radiusclient1.customer1 and radiusclient2.customer1 to be handled identically. Is there a special module that could help us achieving this or what would be the best way to solve this kind of problem?
The best way to solve custom requirements is custom configurations.
We have searched around and come across a few possible ways tho we are not sure if they are good or would work at all. Anyway, those are: 1. Somehow check for the client IP using sql queries. Tho this way it might be hard if not impossible to that vpnserver1.customer1 and vpnserver2.customer2 both belong to customer1
I don't think that example makes sense. If you have multiple customers sharing one NAS, then the User-Names *must* include customer information, e.g. "user@realm". If you have a NAS belonging to only one customer, then you can group the NASes, and key off of the customer group. See the rlm_passwd module for examples of creating custom groups. Then, just select from the DB by username and customer identifier. Alan DeKok.
Hello Alan DeKok, thanks for your answers.
We're currently using the default sql user database, but this one doesn't seem to support this directly. On the other hand, we want radiusclient1.customer1 and radiusclient2.customer1 to be handled identically. Is there a special module that could help us achieving this or what would be the best way to solve this kind of problem? The best way to solve custom requirements is custom configurations. So this will mostly be configuring the radiusd.conf? We have searched around and come across a few possible ways tho we are not sure if they are good or would work at all. Anyway, those are: 1. Somehow check for the client IP using sql queries. Tho this way it might be hard if not impossible to that vpnserver1.customer1 and vpnserver2.customer2 both belong to customer1 I don't think that example makes sense. sorry, had a typo in there, it should be vpnserver2.customer1 not customer2. So we have many NASes and each NAS can have the same customers. If you have a NAS belonging to only one customer, then you can group the NASes, and key off of the customer group. See the rlm_passwd module for examples of creating custom groups. If we like to create custom groups like in the rlm_passwd, do we have to write our own rlm c module? If so, may you point me to the documentation of how to write those modules? Then, just select from the DB by username and customer identifier. This will be done in the sql module then, right?
Manfred Wolf -- CosmoKey GmbH & Co. KG, Amtsgericht Bielefeld HRA 16201, vertreten durch ihre Geschäftsführerin die CosmoKey Beteiligungs GmbH, Amtsgericht Bielefeld HRB 41522, diese vertreten durch ihren Geschäftsführer Herrn Dominic Adenuga Walther-Rathenau-Str. 39 33602 Bielefeld Germany Telefon: 0151-43144121 Telefax: 0521-69983 Email: info@cosmokey.de CosmoKey GmbH & Co. KG USt-ID: DE296278210 CosmoKey GmbH USt-ID: DE296278201
On Jul 24, 2015, at 1:29 PM, Manfred Wolf <Manfred.Wolf@cosmokey.com> wrote:
The best way to solve custom requirements is custom configurations. So this will mostly be configuring the radiusd.conf?
More than that. You have to create custom policies. This involves understanding what's in the databases, and how to query them.
If we like to create custom groups like in the rlm_passwd, do we have to write our own rlm c module? If so, may you point me to the documentation of how to write those modules?
Uh... no. Did you even bother reading the documentation I suggested? It tells you how to create custom groups *without* writing C coe.
Then, just select from the DB by username and customer identifier. This will be done in the sql module then, right?
No. You can write "select" statements and put them into unlang policies: if ("%{sql:SELECT ...}" == "foo") { ... } Alan DeKok.
ok, that brought us a step further.
If we like to create custom groups like in the rlm_passwd, do we have to write our own rlm c module? If so, may you point me to the documentation of how to write those modules? Uh... no. Did you even bother reading the documentation I suggested? It tells you how to create custom groups *without* writing C coe. I've read through the /etc/freeradius/modules/passwd file a few times again and I'm still not 100% sure, do I just have to write a new module file like /etc/freeradius/modules/myCustomersModule and fill it with for example: group_customer1 { format = "*.customer1" } group_customer2 { format = "*.customer2" } As far as I can see, this should then be accessible through an unlang script, right?
Manfred Wolf
participants (2)
-
Alan DeKok -
Manfred Wolf