Hi everyone. I'm using FreeRADIUS Version 2.1.1, I use it to control the access to a routers networks. I want to permit certain users to get access to some routers and deny access to another routers. Like group the users per routers, I read some documentation, but i can't make it work. Thanks in advance. _________________________________________________________________ Hotmail: Free, trusted and rich email service. https://signup.live.com/signup.aspx?id=60969
On 03/05/2010 11:31 AM, Siryx XL wrote:
Hi everyone.
I'm using FreeRADIUS Version 2.1.1, I use it to control the access to a routers networks.
I want to permit certain users to get access to some routers and deny access to another routers. Like group the users per routers, I read some documentation, but i can't make it work.
Have you tried using huntgroups? -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
On Sat, Mar 6, 2010 at 5:42 AM, John Dennis <jdennis@redhat.com> wrote:
On 03/05/2010 11:31 AM, Siryx XL wrote:
Hi everyone.
I'm using FreeRADIUS Version 2.1.1, I use it to control the access to a routers networks.
I want to permit certain users to get access to some routers and deny access to another routers. Like group the users per routers, I read some documentation, but i can't make it work.
Have you tried using huntgroups?
Me I always use huntgroups + ldap as that way the groups are managed in your LDAP directory. http://lists.freeradius.org/mailman/htdig/freeradius-users/2009-November/msg...
I tried the huntgroups but it didn't work. I use this guide http://wiki.freeradius.org/SQL_Huntgroup_HOWTO because i'm using MySQL to store all my users, huntgroups, etc. I create the huntgroup table, associate the nasipaddres to a group, create the radgroupchek, and associate my user with the group; but my user still got the privilege to connect to all the routers in the network. Something is missing? thanks for the help. Date: Sat, 6 Mar 2010 07:20:27 +1300 Subject: Re: Users Groups From: plambrechtsen@gmail.com To: freeradius-users@lists.freeradius.org On Sat, Mar 6, 2010 at 5:42 AM, John Dennis <jdennis@redhat.com> wrote: On 03/05/2010 11:31 AM, Siryx XL wrote: Hi everyone. I'm using FreeRADIUS Version 2.1.1, I use it to control the access to a routers networks. I want to permit certain users to get access to some routers and deny access to another routers. Like group the users per routers, I read some documentation, but i can't make it work. Have you tried using huntgroups? Me I always use huntgroups + ldap as that way the groups are managed in your LDAP directory. http://lists.freeradius.org/mailman/htdig/freeradius-users/2009-November/msg... _________________________________________________________________ Hotmail: Powerful Free email with security by Microsoft. https://signup.live.com/signup.aspx?id=60969
Did you perform step #3 in the How-To? radiusd.conf: update request { Huntgroup-Name := "%{sql:select groupname from radhuntgroup where nasipaddress=\"%{NAS-IP-Address}\"}" } On Wed, Mar 10, 2010 at 12:53 PM, Siryx XL <djsiryx@hotmail.com> wrote:
I tried the huntgroups but it didn't work.
I use this guide http://wiki.freeradius.org/SQL_Huntgroup_HOWTO because i'm using MySQL to store all my users, huntgroups, etc.
I create the huntgroup table, associate the nasipaddres to a group, create the radgroupchek, and associate my user with the group; but my user still got the privilege to connect to all the routers in the network.
Something is missing? thanks for the help.
________________________________ Date: Sat, 6 Mar 2010 07:20:27 +1300 Subject: Re: Users Groups From: plambrechtsen@gmail.com To: freeradius-users@lists.freeradius.org
On Sat, Mar 6, 2010 at 5:42 AM, John Dennis <jdennis@redhat.com> wrote:
On 03/05/2010 11:31 AM, Siryx XL wrote:
Hi everyone.
I'm using FreeRADIUS Version 2.1.1, I use it to control the access to a routers networks.
I want to permit certain users to get access to some routers and deny access to another routers. Like group the users per routers, I read some documentation, but i can't make it work.
Have you tried using huntgroups?
Me I always use huntgroups + ldap as that way the groups are managed in your LDAP directory.
http://lists.freeradius.org/mailman/htdig/freeradius-users/2009-November/msg...
________________________________ Hotmail: Powerful Free email with security by Microsoft. Get it now. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Yes... i did it. When I run freeradius in debug mode (radiusd -X) I see that the nasipaddress make a match with radhuntgroup, but nothing happen after that, just the default process of authentication.
Date: Wed, 10 Mar 2010 14:58:08 -0800 Subject: Re: Users Groups From: lists@beatmixed.com To: freeradius-users@lists.freeradius.org
Did you perform step #3 in the How-To?
radiusd.conf:
update request { Huntgroup-Name := "%{sql:select groupname from radhuntgroup where nasipaddress=\"%{NAS-IP-Address}\"}" }
On Wed, Mar 10, 2010 at 12:53 PM, Siryx XL <djsiryx@hotmail.com> wrote:
I tried the huntgroups but it didn't work.
I use this guide http://wiki.freeradius.org/SQL_Huntgroup_HOWTO because i'm using MySQL to store all my users, huntgroups, etc.
I create the huntgroup table, associate the nasipaddres to a group, create the radgroupchek, and associate my user with the group; but my user still got the privilege to connect to all the routers in the network.
Something is missing? thanks for the help.
________________________________ Date: Sat, 6 Mar 2010 07:20:27 +1300 Subject: Re: Users Groups From: plambrechtsen@gmail.com To: freeradius-users@lists.freeradius.org
On Sat, Mar 6, 2010 at 5:42 AM, John Dennis <jdennis@redhat.com> wrote:
On 03/05/2010 11:31 AM, Siryx XL wrote:
Hi everyone.
I'm using FreeRADIUS Version 2.1.1, I use it to control the access to a routers networks.
I want to permit certain users to get access to some routers and deny access to another routers. Like group the users per routers, I read some documentation, but i can't make it work.
Have you tried using huntgroups?
Me I always use huntgroups + ldap as that way the groups are managed in your LDAP directory.
http://lists.freeradius.org/mailman/htdig/freeradius-users/2009-November/msg...
________________________________ Hotmail: Powerful Free email with security by Microsoft. Get it now. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
_________________________________________________________________ Hotmail: Free, trusted and rich email service. https://signup.live.com/signup.aspx?id=60969
Can you clarify this statement: "but my user still got the privilege to connect to all the routers in the network" Do you send a specific RADIUS attribute, like a VSA? Or are you making this statement based upon receiving an Access-Accept? -M On Thu, Mar 11, 2010 at 5:16 AM, Siryx XL <djsiryx@hotmail.com> wrote:
Yes... i did it.
When I run freeradius in debug mode (radiusd -X) I see that the nasipaddress make a match with radhuntgroup, but nothing happen after that, just the default process of authentication.
Date: Wed, 10 Mar 2010 14:58:08 -0800 Subject: Re: Users Groups From: lists@beatmixed.com To: freeradius-users@lists.freeradius.org
Did you perform step #3 in the How-To?
radiusd.conf:
update request { Huntgroup-Name := "%{sql:select groupname from radhuntgroup where nasipaddress=\"%{NAS-IP-Address}\"}" }
On Wed, Mar 10, 2010 at 12:53 PM, Siryx XL <djsiryx@hotmail.com> wrote:
I tried the huntgroups but it didn't work.
I use this guide http://wiki.freeradius.org/SQL_Huntgroup_HOWTO because i'm using MySQL to store all my users, huntgroups, etc.
I create the huntgroup table, associate the nasipaddres to a group, create the radgroupchek, and associate my user with the group; but my user still got the privilege to connect to all the routers in the network.
Something is missing? thanks for the help.
________________________________ Date: Sat, 6 Mar 2010 07:20:27 +1300 Subject: Re: Users Groups From: plambrechtsen@gmail.com To: freeradius-users@lists.freeradius.org
On Sat, Mar 6, 2010 at 5:42 AM, John Dennis <jdennis@redhat.com> wrote:
On 03/05/2010 11:31 AM, Siryx XL wrote:
Hi everyone.
I'm using FreeRADIUS Version 2.1.1, I use it to control the access to a routers networks.
I want to permit certain users to get access to some routers and deny access to another routers. Like group the users per routers, I read some documentation, but i can't make it work.
Have you tried using huntgroups?
Me I always use huntgroups + ldap as that way the groups are managed in your LDAP directory.
http://lists.freeradius.org/mailman/htdig/freeradius-users/2009-November/msg...
________________________________ Hotmail: Powerful Free email with security by Microsoft. Get it now. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
________________________________ Hotmail: Free, trusted and rich email service. Get it now. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
My statement is based upon an Access-Acept, i'm not sending any attibutte already. Thanks.
Date: Thu, 11 Mar 2010 10:59:04 -0800 Subject: Re: Users Groups From: lists@beatmixed.com To: freeradius-users@lists.freeradius.org
Can you clarify this statement:
"but my user still got the privilege to connect to all the routers in the network"
Do you send a specific RADIUS attribute, like a VSA? Or are you making this statement based upon receiving an Access-Accept?
-M
On Thu, Mar 11, 2010 at 5:16 AM, Siryx XL <djsiryx@hotmail.com> wrote:
Yes... i did it.
When I run freeradius in debug mode (radiusd -X) I see that the nasipaddress make a match with radhuntgroup, but nothing happen after that, just the default process of authentication.
Date: Wed, 10 Mar 2010 14:58:08 -0800 Subject: Re: Users Groups From: lists@beatmixed.com To: freeradius-users@lists.freeradius.org
Did you perform step #3 in the How-To?
radiusd.conf:
update request { Huntgroup-Name := "%{sql:select groupname from radhuntgroup where nasipaddress=\"%{NAS-IP-Address}\"}" }
On Wed, Mar 10, 2010 at 12:53 PM, Siryx XL <djsiryx@hotmail.com> wrote:
I tried the huntgroups but it didn't work.
I use this guide http://wiki.freeradius.org/SQL_Huntgroup_HOWTO because i'm using MySQL to store all my users, huntgroups, etc.
I create the huntgroup table, associate the nasipaddres to a group, create the radgroupchek, and associate my user with the group; but my user still got the privilege to connect to all the routers in the network.
Something is missing? thanks for the help.
________________________________ Date: Sat, 6 Mar 2010 07:20:27 +1300 Subject: Re: Users Groups From: plambrechtsen@gmail.com To: freeradius-users@lists.freeradius.org
On Sat, Mar 6, 2010 at 5:42 AM, John Dennis <jdennis@redhat.com> wrote:
On 03/05/2010 11:31 AM, Siryx XL wrote:
Hi everyone.
I'm using FreeRADIUS Version 2.1.1, I use it to control the access to a routers networks.
I want to permit certain users to get access to some routers and deny access to another routers. Like group the users per routers, I read some documentation, but i can't make it work.
Have you tried using huntgroups?
Me I always use huntgroups + ldap as that way the groups are managed in your LDAP directory.
http://lists.freeradius.org/mailman/htdig/freeradius-users/2009-November/msg...
________________________________ Hotmail: Powerful Free email with security by Microsoft. Get it now. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
________________________________ Hotmail: Free, trusted and rich email service. Get it now. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
_________________________________________________________________ Hotmail: Free, trusted and rich email service. https://signup.live.com/signup.aspx?id=60969
I'm not all that versed in FR so there is probably a better way to do this, but maybe use virtual servers? Some routers use one virtual server with one set of access rules, another set of routers use a different virtual server with it's own access rules. As noted - you can probably do it with unlang or other built in conditional operators, or even a perl script. ________________________________ From: freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.or g] On Behalf Of Siryx XL Sent: Friday, March 05, 2010 10:31 AM To: freeradius-users@lists.freeradius.org Subject: Users Groups Hi everyone. I'm using FreeRADIUS Version 2.1.1, I use it to control the access to a routers networks. I want to permit certain users to get access to some routers and deny access to another routers. Like group the users per routers, I read some documentation, but i can't make it work. Thanks in advance. ________________________________ Hotmail: Free, trusted and rich email service. Get it now. <https://signup.live.com/signup.aspx?id=60969> <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
participants (5)
-
Gary Gatten -
John Dennis -
Matt Hite -
Peter Lambrechtsen -
Siryx XL