Need information on checking for SSID during group verification
Hi , I'm using free-radius on my debian linux. Free radius is contacting external WINDOWS AD server for authentication. The topology is to authenticate Mobile unites[MU] connecting to wireless network. The MU's are authenticated along with group verification. During group verification I'm able to configure Login-Time also as one of the check. Along with this I need to verify the SSID via which MU's are connecting. Please guide me what changes/add I need to do in config file of Radius. Below is my user file content: */root # more /etc/raddb/users* *DEFAULT Realm != "NULL"* *anonymous Auth-Type := EAP* * Fall-Through = No* *Anonymous Auth-Type := EAP* * Fall-Through = No* *#Access Policy for Guest Users....* *# primary ldap group policy configuration* *# Policy for the groups* *DEFAULT ldap_primary-Ldap-Group == "adarsha_radius_group_1", Login-Time := "Any0600-2359"* * Symbol-User-Group = "adarsha_radius_group_1",* * Symbol-Allowed-ESSID += "adarsha_wlan"* *DEFAULT ldap_primary-Ldap-Group == "adarsha_radius_group", Login-Time := "Any0600-2359"* * Symbol-User-Group = "adarsha_radius_group",* * Symbol-Allowed-ESSID += "adhi_2"* *DEFAULT ldap_primary-Ldap-Group == "adarsha_radius_group_2", Login-Time := "Any0000-2359"* * Symbol-User-Group = "adarsha_radius_group_2",* *DEFAULT Auth-Type := Reject* I need to use Symbol-Allowed-ESSID as one of the parameter for group verification. Currently its only group and login time: *ldap_primary-Ldap-Group == "adarsha_radius_group_1", Login-Time := "Any0600-2359"* Please guide me Thanks, Adarsha
On Sep 3, 2015, at 6:33 AM, Adarsha S <s.adarsha@gmail.com> wrote:
Along with this I need to verify the SSID via which MU's are connecting.
Please guide me what changes/add I need to do in config file of Radius.
a) read the debug output as suggested in the FAQ, "man" page, web pages, and daily on this list. b) figure out which attribute contains the SSID. It will probably be Called-Station-Id c) write "unlang" rules to match the SSID. Alan DeKok.
Thanks for the response Alan. I was able to figure out for verifiying single SSID's But when there are multiple SSID's , I was not able to modify the file with Logical OR operators. Thanks, Adarsha On Thu, Sep 3, 2015 at 6:32 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Sep 3, 2015, at 6:33 AM, Adarsha S <s.adarsha@gmail.com> wrote:
Along with this I need to verify the SSID via which MU's are connecting.
Please guide me what changes/add I need to do in config file of Radius.
a) read the debug output as suggested in the FAQ, "man" page, web pages, and daily on this list.
b) figure out which attribute contains the SSID. It will probably be Called-Station-Id
c) write "unlang" rules to match the SSID.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sep 18, 2015, at 5:53 AM, Adarsha S <s.adarsha@gmail.com> wrote:
Thanks for the response Alan.
I was able to figure out for verifiying single SSID's But when there are multiple SSID's , I was not able to modify the file with Logical OR operators.
You don't modify the file with logical OR operators. The group file contains which users belong to which SSIDs. Then, you write the logical OR operators in "unlang". Alan DeKok.
Hi Alan, In the group file I've only username and group name. File dint contain SSID. Please guide me further. Thanks, Adarsha On Fri, Sep 18, 2015 at 4:59 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Sep 18, 2015, at 5:53 AM, Adarsha S <s.adarsha@gmail.com> wrote:
Thanks for the response Alan.
I was able to figure out for verifiying single SSID's But when there are multiple SSID's , I was not able to modify the file with Logical OR operators.
You don't modify the file with logical OR operators. The group file contains which users belong to which SSIDs.
Then, you write the logical OR operators in "unlang".
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Adarsha S -
Alan DeKok