Freeradius 3.2.0 with dynamic clients on LDAP
Hi, I work at a company with more than 300 APs and this number only increases. To permit each AP to connect to Freeradius, I've configured a specified VLAN with DHCPv4 and I've delivered to APs. The clients.conf has looked like this: client dhcp-aps { ipaddr = 10.20.0.0/20 secret = testing123 shortname = dhcp-aps nastype = other } But I would like to store the clients configuration on a LDAP base using radiusClient scheme where the radiusClientIdentifier is the AP's MAC address. Then I intend to configure dynamic clients to allow the same created network to use Freeradius, but it will use Called-Station-ID to auth the AP on LDAP. I've googled it and found it https://sourceforge.net/p/hotcakes/wiki/YfiTechDynamicClients/ using Freeradius 2.1.12. Not 3.x though. Is it possible? -- Igor Sousa
On Sep 2, 2022, at 5:26 PM, Igor Sousa <igorvolt@gmail.com> wrote:
I work at a company with more than 300 APs and this number only increases. To permit each AP to connect to Freeradius, I've configured a specified VLAN with DHCPv4 and I've delivered to APs. The clients.conf has looked like this:
client dhcp-aps { ipaddr = 10.20.0.0/20 secret = testing123 shortname = dhcp-aps nastype = other }
That's fine.
But I would like to store the clients configuration on a LDAP base using radiusClient scheme where the radiusClientIdentifier is the AP's MAC address. Then I intend to configure dynamic clients to allow the same created network to use Freeradius, but it will use Called-Station-ID to auth the AP on LDAP.
I've googled it and found it https://sourceforge.net/p/hotcakes/wiki/YfiTechDynamicClients/ using Freeradius 2.1.12. Not 3.x though. Is it possible?
See sites-available/dynamic-clients There are examples and documentation for this. Alan DeKok.
Hi Alan, I've seen sites-available/dynamic-clients file, but this file has only an example using Packet-Src-IP-Address. As I intend to use the MAC address as CN, is the Called-Station-ID attribute available to use in dynamic-clients? -- Igor Sousa Em sex., 2 de set. de 2022 às 21:35, Alan DeKok <aland@deployingradius.com> escreveu:
On Sep 2, 2022, at 5:26 PM, Igor Sousa <igorvolt@gmail.com> wrote:
I work at a company with more than 300 APs and this number only increases. To permit each AP to connect to Freeradius, I've configured a specified VLAN with DHCPv4 and I've delivered to APs. The clients.conf has looked like this:
client dhcp-aps { ipaddr = 10.20.0.0/20 secret = testing123 shortname = dhcp-aps nastype = other }
That's fine.
But I would like to store the clients configuration on a LDAP base using radiusClient scheme where the radiusClientIdentifier is the AP's MAC address. Then I intend to configure dynamic clients to allow the same created network to use Freeradius, but it will use Called-Station-ID to auth the AP on LDAP.
I've googled it and found it https://sourceforge.net/p/hotcakes/wiki/YfiTechDynamicClients/ using Freeradius 2.1.12. Not 3.x though. Is it possible?
See sites-available/dynamic-clients
There are examples and documentation for this.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi Alan, I googled it more and I found this post https://lists.freeradius.org/pipermail/freeradius-users/2014-August/073292.h... (yeah, I know this happened 8 years ago). I've understood that the rlm_raw module is necessary to access the Called-Station-Id attribute on site-enabled/dynamic-clients ( https://lists.freeradius.org/pipermail/freeradius-users/2015-March/076430.ht... and , but you warned us to not use the rlm_raw module. I don't find this module in https://freeradius.org/modules/. Then, is it possible to access NAS MAC addresses in dynamic-clients configuration in Freeradius 3.2? -- Igor Sousa Em sáb., 3 de set. de 2022 às 16:46, Igor Sousa <igorvolt@gmail.com> escreveu:
Hi Alan,
I've seen sites-available/dynamic-clients file, but this file has only an example using Packet-Src-IP-Address. As I intend to use the MAC address as CN, is the Called-Station-ID attribute available to use in dynamic-clients?
-- Igor Sousa
Em sex., 2 de set. de 2022 às 21:35, Alan DeKok <aland@deployingradius.com> escreveu:
On Sep 2, 2022, at 5:26 PM, Igor Sousa <igorvolt@gmail.com> wrote:
I work at a company with more than 300 APs and this number only increases. To permit each AP to connect to Freeradius, I've configured a specified VLAN with DHCPv4 and I've delivered to APs. The clients.conf has looked like this:
client dhcp-aps { ipaddr = 10.20.0.0/20 secret = testing123 shortname = dhcp-aps nastype = other }
That's fine.
But I would like to store the clients configuration on a LDAP base using radiusClient scheme where the radiusClientIdentifier is the AP's MAC address. Then I intend to configure dynamic clients to allow the same created network to use Freeradius, but it will use Called-Station-ID to auth the AP on LDAP.
I've googled it and found it https://sourceforge.net/p/hotcakes/wiki/YfiTechDynamicClients/ using Freeradius 2.1.12. Not 3.x though. Is it possible?
See sites-available/dynamic-clients
There are examples and documentation for this.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sep 4, 2022, at 9:50 AM, Igor Sousa <igorvolt@gmail.com> wrote:
I googled it more and I found this post https://lists.freeradius.org/pipermail/freeradius-users/2014-August/073292.h... (yeah, I know this happened 8 years ago).
The documentation is always up to date. There's no need to google things.
I've understood that the rlm_raw module is necessary to access the Called-Station-Id attribute on site-enabled/dynamic-clients ( https://lists.freeradius.org/pipermail/freeradius-users/2015-March/076430.ht... and , but you warned us to not use the rlm_raw module. I don't find this module in https://freeradius.org/modules/.
Because it's a third-party module which isn't supported.
Then, is it possible to access NAS MAC addresses in dynamic-clients configuration in Freeradius 3.2?
No. RADIUS client are always keyed off of IP addresses. What people usually want is to key off of MAC address, and then do that on a per-packet basis. That's just not possible. If you want to key off of NAS identity instead of IP address, use radsec. (RADIUS over TLS). That's what it's for. You can verify the client certificate of the NAS. In which case you don't care about its' IP address, or its MAC address. Alan DeKok.
Alan, Thanks for your explanation. -- Igor Sousa Em seg., 5 de set. de 2022 às 19:18, Alan DeKok <aland@deployingradius.com> escreveu:
On Sep 4, 2022, at 9:50 AM, Igor Sousa <igorvolt@gmail.com> wrote:
I googled it more and I found this post
https://lists.freeradius.org/pipermail/freeradius-users/2014-August/073292.h...
(yeah, I know this happened 8 years ago).
The documentation is always up to date. There's no need to google things.
I've understood that the rlm_raw module is necessary to access the Called-Station-Id attribute on site-enabled/dynamic-clients (
https://lists.freeradius.org/pipermail/freeradius-users/2015-March/076430.ht...
and , but you warned us to not use the rlm_raw module. I don't find this module in https://freeradius.org/modules/.
Because it's a third-party module which isn't supported.
Then, is it possible to access NAS MAC addresses in dynamic-clients configuration in Freeradius 3.2?
No.
RADIUS client are always keyed off of IP addresses. What people usually want is to key off of MAC address, and then do that on a per-packet basis. That's just not possible.
If you want to key off of NAS identity instead of IP address, use radsec. (RADIUS over TLS). That's what it's for. You can verify the client certificate of the NAS. In which case you don't care about its' IP address, or its MAC address.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Igor Sousa