Re: Setting different IDLE-TIMEOUTS based on IP Address
If your NAS can take such a value then it can be assigned. Either via eg users file and huntgroup or via eg unlang if(%{NAS-Ip-Address} == "192.168.1.1") { update reply { Attribute = XYZ } } ..'man unlang' for more info alan
Alan, Interesting… So I man’ed unlang and then did some more reading on huntgroups and the users file. If at all possible I think we would opt for a combo of the huntgroups/users file approach. I am still not clear as to how we would do this though…. Could you please speak to the interrelationship between the clients file and the huntgroups file? For examples this is what we have in our clients config file now (with our internal IP’s changed for obfuscation’s sake): client 10.99.3.0/24 { secret = XXXXXXX shortname = MSP 7345’s } client 10.3.99.0/24 { secret = XXXXXX shortname = SNJ 7000 Switches } These are the two different equipment types we would like to have different IDLE-TIMEOUTs for. My first question is that every huntgroups file example I have seen on the Net uses a per NAS definition: raleigh NAS-IP-Address == 192.168.1.101 raleigh NAS-IP-Address == 192.168.1.102 raleigh NAS-IP-Address == 192.168.1.103 premium NAS-IP-Address == 192.168.1.101, NAS-Port-Id == 0-4 Group = premium, Group = staff I would rather not have to define 254 different entries in our huntgroups file (254 hosts in a Class C obviously). Can I use a netmask somehow in the huntgroups file? In pseudo parlance this is what I am trying to accomplish in huntgroups: MSP 7345’s NAS-IP-Address == 10.99.3.0/24 IDLE-TIMEOUT = 1800 SNJ 7000 NAS-IP-Address == 10.3.99.0/24 IDLE-TIMEOUT = 60 Thanks! -jg From: Alan Buxey [mailto:A.L.M.Buxey@lboro.ac.uk] Sent: Tuesday, April 16, 2013 10:45 AM To: John Giordano; freeradius-users@lists.freeradius.org Subject: Re: Setting different IDLE-TIMEOUTS based on IP Address If your NAS can take such a value then it can be assigned. Either via eg users file and huntgroup or via eg unlang if(%{NAS-Ip-Address} == "192.168.1.1") { update reply { Attribute = XYZ } } ..'man unlang' for more info alan
John Giordano wrote:
Could you please speak to the interrelationship between the clients file and the huntgroups file?
The clients.conf file defines IP, secret, "type", etc. for the NASes. The huntgroups file allows you to put clients into logical groups.
These are the two different equipment types we would like to have different IDLE-TIMEOUTs for.
So key off of the equipment type, not the IP.
I would rather not have to define 254 different entries in our huntgroups file (254 hosts in a Class C obviously). Can I use a netmask somehow in the huntgroups file?
Not really. The syntax of the huntgroups file is pretty limited.
In pseudo parlance this is what I am trying to accomplish in huntgroups:
MSP 7345’s NAS-IP-Address == 10.99.3.0/24
Yeah... that won't work. You can use "unlang", though: if ((NAS-IP-Address >= 10.99.3.0) && \ (NAS-IP-Address <= 10.99.3.255)) { update reply { Idle-Timeout := 1800 } } That's pretty straightforward. Alan DeKok.
Hi, On Tue, Apr 16, 2013 at 02:05:45PM -0500, John Giordano wrote:
So I man’ed unlang and then did some more reading on huntgroups and the users file. If at all possible I think we would opt for a combo of the huntgroups/users file approach. I am still not clear as to how we would do this though….
Could you please speak to the interrelationship between the clients file and the huntgroups file?
The clients file lists clients (NASes) that can talk the the server. The huntgroups file (read by the preprocess module, not the files module as in the comments at the top of the file) is used to match incoming request attributes to set the Huntgroup-Name attribute, which can be further used to set other attributes in the reply (for example, in the users file, or by using unlang). The users file (read by the files module) can match on request attributes to set reply attributes. The standard lookup is for User-Name; this can be changed, or a DEFAULT entry can be used to match anything else.
My first question is that every huntgroups file example I have seen on the Net uses a per NAS definition:
raleigh NAS-IP-Address == 192.168.1.101 raleigh NAS-IP-Address == 192.168.1.102 raleigh NAS-IP-Address == 192.168.1.103 premium NAS-IP-Address == 192.168.1.101, NAS-Port-Id == 0-4 Group = premium, Group = staff
I would rather not have to define 254 different entries in our huntgroups file (254 hosts in a Class C obviously). Can I use a netmask somehow in the huntgroups file?
It's a check list, so you should be able to use any standard check operator - so try regex, for example: huntgroups: foo NAS-IP-Address =~ /^10\.2\.3\./ bar NAS-IP-Address =~ /^10\.4\.9\./ users: (add these at the *top* of the file) DEFAULT Huntgroup-Name == foo Idle-Timeout := 600 Fall-Through := yes DEFAULT Huntgroup-Name == bar Idle-Timeout := 1200 Fall-Through := yes
In pseudo parlance this is what I am trying to accomplish in huntgroups:
MSP 7345’s NAS-IP-Address == 10.99.3.0/24 IDLE-TIMEOUT = 1800
SNJ 7000 NAS-IP-Address == 10.3.99.0/24 IDLE-TIMEOUT = 60
Note that Client-IP-Address is sometimes better than NAS-IP-Address (it can't be spoofed, which may be the case if you process proxied requests from RADIUS servers out of your own control), but Client-IP-Address can *not* be used in the huntgroups file as it only looks at the incoming request attributes, of which Client-IP-Address is not. If this is a concern there are ways of getting around it. One is to use unlang instead of the huntgroups file, as Alan suggested. Note the above splits the config over two locations. If you want to keep it all in one place, use unlang like Alan said. If it doesn't look tidy, put it in the policy.conf file and then call the policy name instead. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Good morning, Thanks to everyone for their interesting suggestions. The one that I found the most intuitive was to define some logical groups for our NAS's in huntgroups and then reference those in the users file. Something is missing though as IDLE-TIMEOUT is not being handed out as I would expect it to be (as per the setting in the huntgroups files). Perhaps somebody can help us get across the finish line here. So in huntgroups I have: ### RADIUS HUNTGROUP TEST - jg ### MSP7345 NAS-IP-Address =~ /^10\.99\.3\./ SNJ7000 NAS-IP-Address =~ /^10\.3\.99\./ LAB7000 NAS-IP-Address =~ /^192\.168\.0./ ----------------- Then in the users file right at the top I added: ### Testing FreeRADIUS IDLE-TIMEOUT Tweak -jg ### DEFAULT Huntgroup-Name == SNJ7000 Idle-Timeout := 1, Fall-Through := yes DEFAULT Huntgroup-Name == MSP7345 Idle-Timeout := 1800, Fall-Through := yes DEFAULT Huntgroup-Name == LAB7000 Idle-Timeout := 1, Fall-Through := yes -------------- I wasn't timing out so I then stopped radiusd and kicked it into debug mode with a radiusd -X STDOUT shows that I am being handed the IDLE-TIMEOUT of 1800 even though I am coming from the LAB Node with IP of 192.168.0.15 The user (me) does have an IDLE-TIMEOUT set in my user section of 1800 but I thought the above lines would set it and because the IDLE-TIMEOUT in my user section is using the = operator. Here is my User Section: XXXX Cleartext-Password := "XXXXXXX" Idle-Timeout = 1800, Tellabs-UAP-CLI := "A8", Callback-Id := "Admin", Reply-Message += "superuser", Reply-Message += "Administrator" ---------------- Here are the debug logs. If anybody has any insights I sure would appreciate it! Thanks, Jg <SNIP> Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.15 port 65496, id=182, length=80 User-Name = "XXXX" User-Password = "XXXX" Service-Type = Login-User NAS-Identifier = "dot5" Called-Station-Id = "BTI:7000" NAS-Port = 0 NAS-IP-Address = 192.168.0.15 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{NAS-IP-Address} -> 192.168.0.15 [preprocess] expand: %{NAS-IP-Address} -> 192.168.0.15 <--------------- Does this mean that the huntgroups file is being checked? Perhaps a regex thing? [preprocess] expand: %{NAS-IP-Address} -> 192.168.0.15 ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "xxxxx", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry xxxx at line 23 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "xxxx" [pap] Using clear text password "xxxx" [pap] User authenticated successfully ++[pap] returns ok Login OK: [xxxxxx] (from client Seattle port 0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 182 to 192.168.0.15 port 65496 Idle-Timeout = 1800 Tellabs-UAP-CLI := "A8" Callback-Id := "Admin" Reply-Message += "superuser" Reply-Message += "Administrator" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 182 with timestamp +41 Ready to process requests. </SNIP> -----Original Message----- From: freeradius-users-bounces+john.giordano=ttmi.us@lists.freeradius.org [mailto:freeradius-users-bounces+john.giordano=ttmi.us@lists.freeradius.org] On Behalf Of Matthew Newton Sent: Tuesday, April 16, 2013 1:47 PM To: FreeRadius users mailing list Subject: Re: Setting different IDLE-TIMEOUTS based on IP Address Hi, On Tue, Apr 16, 2013 at 02:05:45PM -0500, John Giordano wrote:
So I man’ed unlang and then did some more reading on huntgroups and the users file. If at all possible I think we would opt for a combo of the huntgroups/users file approach. I am still not clear as to how we would do this though….
Could you please speak to the interrelationship between the clients file and the huntgroups file?
The clients file lists clients (NASes) that can talk the the server. The huntgroups file (read by the preprocess module, not the files module as in the comments at the top of the file) is used to match incoming request attributes to set the Huntgroup-Name attribute, which can be further used to set other attributes in the reply (for example, in the users file, or by using unlang). The users file (read by the files module) can match on request attributes to set reply attributes. The standard lookup is for User-Name; this can be changed, or a DEFAULT entry can be used to match anything else.
My first question is that every huntgroups file example I have seen on the Net uses a per NAS definition:
raleigh NAS-IP-Address == 192.168.1.101 raleigh NAS-IP-Address == 192.168.1.102 raleigh NAS-IP-Address == 192.168.1.103 premium NAS-IP-Address == 192.168.1.101, NAS-Port-Id == 0-4 Group = premium, Group = staff
I would rather not have to define 254 different entries in our huntgroups file (254 hosts in a Class C obviously). Can I use a netmask somehow in the huntgroups file?
It's a check list, so you should be able to use any standard check operator - so try regex, for example: huntgroups: foo NAS-IP-Address =~ /^10\.2\.3\./ bar NAS-IP-Address =~ /^10\.4\.9\./ users: (add these at the *top* of the file) DEFAULT Huntgroup-Name == foo Idle-Timeout := 600 Fall-Through := yes DEFAULT Huntgroup-Name == bar Idle-Timeout := 1200 Fall-Through := yes
In pseudo parlance this is what I am trying to accomplish in huntgroups:
MSP 7345’s NAS-IP-Address == 10.99.3.0/24 IDLE-TIMEOUT = 1800
SNJ 7000 NAS-IP-Address == 10.3.99.0/24 IDLE-TIMEOUT = 60
Note that Client-IP-Address is sometimes better than NAS-IP-Address (it can't be spoofed, which may be the case if you process proxied requests from RADIUS servers out of your own control), but Client-IP-Address can *not* be used in the huntgroups file as it only looks at the incoming request attributes, of which Client-IP-Address is not. If this is a concern there are ways of getting around it. One is to use unlang instead of the huntgroups file, as Alan suggested. Note the above splits the config over two locations. If you want to keep it all in one place, use unlang like Alan said. If it doesn't look tidy, put it in the policy.conf file and then call the policy name instead. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
STDOUT shows that I am being handed the IDLE-TIMEOUT of 1800 even though I am coming from the LAB Node with IP of 192.168.0.15 The user (me) does have an IDLE-TIMEOUT set in my user section of 1800 but I thought the above lines would set it and because the IDLE-TIMEOUT in my user section is using the = operator.
yes...AFTER the huntgroup stuff you've added..as you say, you added that new stuff at the top of the users file... what comes later overrides alan
Ok... I feel as though I am trying to solve a riddle here. I thought that may be the case but! I removed the IDLE-TIMEOUT entry from my user stanza and the NAS then rejected me.... I think that was because no IDLE-TIMEOUT was being sent at all from the server to the client.... ?! -----Original Message----- From: freeradius-users-bounces+john.giordano=ttmi.us@lists.freeradius.org [mailto:freeradius-users-bounces+john.giordano=ttmi.us@lists.freeradius.org] On Behalf Of A.L.M.Buxey@lboro.ac.uk Sent: Wednesday, April 17, 2013 10:49 AM To: FreeRadius users mailing list Subject: Re: Setting different IDLE-TIMEOUTS based on IP Address Hi,
STDOUT shows that I am being handed the IDLE-TIMEOUT of 1800 even though I am coming from the LAB Node with IP of 192.168.0.15 The user (me) does have an IDLE-TIMEOUT set in my user section of 1800 but I thought the above lines would set it and because the IDLE-TIMEOUT in my user section is using the = operator.
yes...AFTER the huntgroup stuff you've added..as you say, you added that new stuff at the top of the users file... what comes later overrides alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
More pieces to the puzzle... so I have been staring at the output from radiusd -X. I don't see the huntgroups config file being loaded... is this, perhaps, part of the problem? The permissions on the disk look good to me. [root@gofish raddb]# radiusd -X FreeRADIUS Version 2.1.12, for host x86_64-unknown-linux-gnu, built on Jul 18 2012 at 16:53:37 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { -----Original Message----- From: freeradius-users-bounces+john.giordano=ttmi.us@lists.freeradius.org [mailto:freeradius-users-bounces+john.giordano=ttmi.us@lists.freeradius.org] On Behalf Of John Giordano Sent: Wednesday, April 17, 2013 11:02 AM To: 'FreeRadius users mailing list' Subject: RE: Setting different IDLE-TIMEOUTS based on IP Address Ok... I feel as though I am trying to solve a riddle here. I thought that may be the case but! I removed the IDLE-TIMEOUT entry from my user stanza and the NAS then rejected me.... I think that was because no IDLE-TIMEOUT was being sent at all from the server to the client.... ?! -----Original Message----- From: freeradius-users-bounces+john.giordano=ttmi.us@lists.freeradius.org [mailto:freeradius-users-bounces+john.giordano=ttmi.us@lists.freeradius.org] On Behalf Of A.L.M.Buxey@lboro.ac.uk Sent: Wednesday, April 17, 2013 10:49 AM To: FreeRadius users mailing list Subject: Re: Setting different IDLE-TIMEOUTS based on IP Address Hi,
STDOUT shows that I am being handed the IDLE-TIMEOUT of 1800 even though I am coming from the LAB Node with IP of 192.168.0.15 The user (me) does have an IDLE-TIMEOUT set in my user section of 1800 but I thought the above lines would set it and because the IDLE-TIMEOUT in my user section is using the = operator.
yes...AFTER the huntgroup stuff you've added..as you say, you added that new stuff at the top of the users file... what comes later overrides alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 17 Apr 2013, at 14:38, John Giordano <john.giordano@ttmi.us> wrote:
More pieces to the puzzle... so I have been staring at the output from radiusd -X.
I don't see the huntgroups config file being loaded... is this, perhaps, part of the problem? The permissions on the disk look good to me.
'huntgroups' is not a module, nor is it a config file. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
Hi, On Wed, Apr 17, 2013 at 12:32:32PM -0500, John Giordano wrote:
So in huntgroups I have:
### RADIUS HUNTGROUP TEST - jg ###
MSP7345 NAS-IP-Address =~ /^10\.99\.3\./ SNJ7000 NAS-IP-Address =~ /^10\.3\.99\./ LAB7000 NAS-IP-Address =~ /^192\.168\.0./
Testing it here, I'm not convinced that =~ is working in the huntgroups file, which slightly surprises me. To test, what happens if you temporarily add this instead LAB7000 NAS-IP-Address == 192.168.0.15 ? If you put the following after the 'preprocess' line in sites-enabled/default, you should get the Huntgroup-Name expand and display in the debug output... is it being set? if ("%{Huntgroup-Name}") { }
+- entering group authorize {...} [preprocess] expand: %{NAS-IP-Address} -> 192.168.0.15 [preprocess] expand: %{NAS-IP-Address} -> 192.168.0.15 <--------------- Does this mean that the huntgroups file is being checked? Perhaps a regex thing? [preprocess] expand: %{NAS-IP-Address} -> 192.168.0.15 ++[preprocess] returns ok
huntgroups is definitely being read (it's read by preprocess), but the lines might not be being matched. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi, On Wed, Apr 17, 2013 at 08:38:36PM +0100, Matthew Newton wrote:
On Wed, Apr 17, 2013 at 12:32:32PM -0500, John Giordano wrote:
So in huntgroups I have:
### RADIUS HUNTGROUP TEST - jg ###
MSP7345 NAS-IP-Address =~ /^10\.99\.3\./ SNJ7000 NAS-IP-Address =~ /^10\.3\.99\./ LAB7000 NAS-IP-Address =~ /^192\.168\.0./
Testing it here, I'm not convinced that =~ is working in the huntgroups file, which slightly surprises me.
OK, this is rather inconsistent behaviour compared to unlang, but after digging in the code, the syntax you want is this: MSP7345 NAS-IP-Address =~ ^10\.99\.3\. SNJ7000 NAS-IP-Address =~ ^10\.3\.99\. LAB7000 NAS-IP-Address =~ ^192\.168\.0. i.e. don't put the usual /'s around the regex. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi all, We are very appreciative of the community's support of FreeRADIUS. So Michael, I did add the line to sites-enabled/default as u suggested And now the debug output is showing: ++[preprocess] returns ok ++? if ("%{Huntgroup-Name}") expand: %{Huntgroup-Name} -> LAB7000 ? Evaluating ("%{Huntgroup-Name}") -> TRUE ++? if ("%{Huntgroup-Name}") -> TRUE ++- entering if ("%{Huntgroup-Name}") {...} +++- if ("%{Huntgroup-Name}") returns notfound ++- group authorize returns notfound When I use the regexp of LAB 7000 == 192.168.0.15 AND!!! The right IDLE-TIMEOUT is being handed out! Woohoo! Thanks to everyone's help on this list. I will do some more testing and report back when we tweak the regexp to make it match the whole /24. -jg -----Original Message----- From: freeradius-users-bounces+john.giordano=ttmi.us@lists.freeradius.org [mailto:freeradius-users-bounces+john.giordano=ttmi.us@lists.freeradius.org] On Behalf Of Matthew Newton Sent: Wednesday, April 17, 2013 1:24 PM To: FreeRadius users mailing list Subject: Re: Setting different IDLE-TIMEOUTS based on IP Address Hi, On Wed, Apr 17, 2013 at 08:38:36PM +0100, Matthew Newton wrote:
On Wed, Apr 17, 2013 at 12:32:32PM -0500, John Giordano wrote:
So in huntgroups I have:
### RADIUS HUNTGROUP TEST - jg ###
MSP7345 NAS-IP-Address =~ /^10\.99\.3\./ SNJ7000 NAS-IP-Address =~ /^10\.3\.99\./ LAB7000 NAS-IP-Address =~ /^192\.168\.0./
Testing it here, I'm not convinced that =~ is working in the huntgroups file, which slightly surprises me.
OK, this is rather inconsistent behaviour compared to unlang, but after digging in the code, the syntax you want is this: MSP7345 NAS-IP-Address =~ ^10\.99\.3\. SNJ7000 NAS-IP-Address =~ ^10\.3\.99\. LAB7000 NAS-IP-Address =~ ^192\.168\.0. i.e. don't put the usual /'s around the regex. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Yeehaw! And *Matthew* (sorry about getting your name wrong in the last email): The new REGEXP is working as such: Login OK: [xxxxxx] (from client Seattle port 0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 134 to 192.168.0.15 port 65460 Idle-Timeout = 7 Tellabs-UAP-CLI := "A8" Callback-Id := "Admin" Reply-Message += "superuser" Reply-Message += "Administrator" Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 134 with timestamp +14 Ready to process requests. So I am thankful I can avoid putting a whole bunch of entries in huntgroups... either manually or through a Perl script. :) Cheers! -jg -----Original Message----- From: freeradius-users-bounces+john.giordano=ttmi.us@lists.freeradius.org [mailto:freeradius-users-bounces+john.giordano=ttmi.us@lists.freeradius.org] On Behalf Of John Giordano Sent: Wednesday, April 17, 2013 1:47 PM To: FreeRadius users mailing list Subject: RE: Setting different IDLE-TIMEOUTS based on IP Address Hi all, We are very appreciative of the community's support of FreeRADIUS. So Michael, I did add the line to sites-enabled/default as u suggested And now the debug output is showing: ++[preprocess] returns ok ++? if ("%{Huntgroup-Name}") expand: %{Huntgroup-Name} -> LAB7000 ? Evaluating ("%{Huntgroup-Name}") -> TRUE ++? if ("%{Huntgroup-Name}") -> TRUE ++- entering if ("%{Huntgroup-Name}") {...} +++- if ("%{Huntgroup-Name}") returns notfound ++- group authorize returns notfound When I use the regexp of LAB 7000 == 192.168.0.15 AND!!! The right IDLE-TIMEOUT is being handed out! Woohoo! Thanks to everyone's help on this list. I will do some more testing and report back when we tweak the regexp to make it match the whole /24. -jg -----Original Message----- From: freeradius-users-bounces+john.giordano=ttmi.us@lists.freeradius.org [mailto:freeradius-users-bounces+john.giordano=ttmi.us@lists.freeradius.org] On Behalf Of Matthew Newton Sent: Wednesday, April 17, 2013 1:24 PM To: FreeRadius users mailing list Subject: Re: Setting different IDLE-TIMEOUTS based on IP Address Hi, On Wed, Apr 17, 2013 at 08:38:36PM +0100, Matthew Newton wrote:
On Wed, Apr 17, 2013 at 12:32:32PM -0500, John Giordano wrote:
So in huntgroups I have:
### RADIUS HUNTGROUP TEST - jg ###
MSP7345 NAS-IP-Address =~ /^10\.99\.3\./ SNJ7000 NAS-IP-Address =~ /^10\.3\.99\./ LAB7000 NAS-IP-Address =~ /^192\.168\.0./
Testing it here, I'm not convinced that =~ is working in the huntgroups file, which slightly surprises me.
OK, this is rather inconsistent behaviour compared to unlang, but after digging in the code, the syntax you want is this: MSP7345 NAS-IP-Address =~ ^10\.99\.3\. SNJ7000 NAS-IP-Address =~ ^10\.3\.99\. LAB7000 NAS-IP-Address =~ ^192\.168\.0. i.e. don't put the usual /'s around the regex. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, Apr 17, 2013 at 03:58:12PM -0500, John Giordano wrote:
Yeehaw!
And *Matthew* (sorry about getting your name wrong in the last email):
np
The new REGEXP is working as such:
Great. Don't forget to strip the debugging if() out of sites-enabled/default Matthew
Login OK: [xxxxxx] (from client Seattle port 0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 134 to 192.168.0.15 port 65460 Idle-Timeout = 7 Tellabs-UAP-CLI := "A8" Callback-Id := "Admin" Reply-Message += "superuser" Reply-Message += "Administrator" Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 134 with timestamp +14 Ready to process requests.
So I am thankful I can avoid putting a whole bunch of entries in huntgroups... either manually or through a Perl script. :)
Cheers!
-jg
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi,
For examples this is what we have in our clients config file now (with our internal IP's changed for obfuscation's sake):
client 10.99.3.0/24 { secret = XXXXXXX shortname = MSP 7345's }
client 10.3.99.0/24 { secret = XXXXXX shortname = SNJ 7000 Switches }
I'd use "%{client:shortname}" eg if ("%{client:shortname}" == "MSP 7345's") { update reply { Idle-Timeout = 1800 } } yes. you can do that sort of thing. :-) alan
On Tue, Apr 16, 2013 at 10:39:18PM +0100, A.L.M.Buxey@lboro.ac.uk wrote:
client 10.3.99.0/24 { secret = XXXXXX shortname = SNJ 7000 Switches }
I'd use "%{client:shortname}" eg
if ("%{client:shortname}" == "MSP 7345's") { update reply { Idle-Timeout = 1800 } }
yes. you can do that sort of thing. :-)
Actually, taking that one step further... make up a new value in the clients.conf file: client 10.3.99.0/24 { secret = XXX shortname = My switches myidlevalue = 600 } ... then just do this in authorize: update reply { Idle-Timeout := "%{client:myidlevalue}" } (may want an if{} around it if myidlevalue isn't defined for all clients) :) Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
participants (6)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan Buxey
-
Alan DeKok -
Arran Cudbard-Bell -
John Giordano -
Matthew Newton