huntgroups - doku?
hello mailinglist, in my last mail I got the information to use huntgroups to handle the parameters for different NAS types, but after some research I have not found good documentation of this! Anyone knows some good recources? Here are my new configs, it looks like they are working, but I'm not sure if this is really the correct way: /etc/raddb/huntgroups: enterasys NAS-IP-Address == 141.201.43.115 enterasys NAS-IP-Address == 141.201.43.116 enterasys NAS-IP-Address == 141.201.43.117 cisco NAS-IP-Address == 141.201.43.118 cisco NAS-IP-Address == 141.201.43.119 cisco NAS-IP-Address == 141.201.43.120 one entry in /etc/raddb/users: DEFAULT LDAP-Group == "CN=adminrole,CN=users,DC=isalab,DC=local", Huntgroup-Name == "enterasys" Filter-ID == "Enterasys:version=1:mgmt=su:policy=adminrole", Reply-Message = "Welcome %{Stripped-User-Name:-%{User-Name:-None}} in the %{mschap:NT-Domain} - Domain, there are no restrictions for you in this network", Fall-Through = No DEFAULT LDAP-Group == "CN=adminrole,CN=users,DC=isalab,DC=local", Huntgroup-Name := "cisco" Cisco-AVPair == "aironet:admin-capability=write+snmp+ident+firmware+admin", Tunnel-Type:1 = 13, Tunnel-Medium-Type:1 = 6, Tunnel-Private-Group-ID:1 = 1, Reply-Message = "Welcome %{Stripped-User-Name:-%{User-Name:-None}} in the %{mschap:NT-Domain} - Domain, there are no restrictions for you in this network", Fall-Through = No is this the correct way? thanks mIke
Michael Messner wrote:
Here are my new configs, it looks like they are working, but I'm not sure if this is really the correct way:
-- snip (see previous post) --
is this the correct way?
It looks pretty right to me. Can't see any better way to do it. -- James Wakefield, Unix Administrator, Information Technology Services Division Deakin University, Geelong, Victoria 3217 Australia. Phone: 03 5227 8690 International: +61 3 5227 8690 Fax: 03 5227 8866 International: +61 3 5227 8866 E-mail: james.wakefield@deakin.edu.au Website: http://www.deakin.edu.au
thanks! James Wakefield wrote:
Michael Messner wrote:
Here are my new configs, it looks like they are working, but I'm not sure if this is really the correct way:
-- snip (see previous post) --
is this the correct way?
It looks pretty right to me. Can't see any better way to do it.
On Tuesday 19 September 2006 04:19, Michael Messner wrote:
hello mailinglist,
/etc/raddb/huntgroups:
enterasys NAS-IP-Address == 141.201.43.115 enterasys NAS-IP-Address == 141.201.43.116 enterasys NAS-IP-Address == 141.201.43.117
cisco NAS-IP-Address == 141.201.43.118 cisco NAS-IP-Address == 141.201.43.119 cisco NAS-IP-Address == 141.201.43.120
is this the correct way?
That is correct and is as the notes in huntgroups tell you. If you don't want to have to list all your IP addresses, you can also differentiate by NAS-Port-Type as a check item in users file. DEFAULT NAS-Port-Type == Ethernet, ... Filter-Id = "Enterasys:version ....", ... DEFAULT NAS-Port-Type == Wireless-802.11, ... Tunnel-Type = VLAN, ... Zoltan Ori
"Michael Messner" <michael.messner_edv@inode.at> wrote:
DEFAULT LDAP-Group == "CN=adminrole,CN=users,DC=isalab,DC=local", Huntgroup-Name := "cisco"
You can't assign the huntgroup attribute. You have to use '=='. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
hey, Alan DeKok wrote:
"Michael Messner" <michael.messner_edv@inode.at> wrote:
DEFAULT LDAP-Group == "CN=adminrole,CN=users,DC=isalab,DC=local", Huntgroup-Name := "cisco"
You can't assign the huntgroup attribute. You have to use '=='.
but it works good and I thought that if the first entry don't pass so it always use the last one with ":=" am I not right? ca mIke
participants (4)
-
Alan DeKok -
James Wakefield -
Michael Messner -
Zoltan Ori