which user is using this IP? (Ethernet, no dial-up)
[Apparently the usenet gateway is not bidirectional, so I re-post here, sorry] Hello, AFAIK, there's nothing in the RADIUS protocol allowing you to ask a RADIUS server which user is currently using a given IP address... or am I missing something? The only thing you can do is FreeRADIUS-specific like issuing the "radwho" command which shows you a list of currently logged users, their IP addresses and other informations. Another option is querying the FreeRADIUS database (MySQL/whatever...), which is actually what some front-ends do (like DaloRADIUS...). Do you know a more robust/standard/portable solution to get these info? To clarify my question I will explain why I need this. I'm configuring DansGuardian web content filtering (http://dansguardian.org) which has the possibility to configure several "filter groups" each with different filtering rules. I would like to match filter groups by RADIUS login but since this is not implemented I'm willing to contribute some code to the project, and here I need to clarify some technical details. The programmatic counterpart of running radwho should be reading /var/log/freeradius/radutmp, which is simply the serialization of a C struct, as I read here: http://goo.gl/Rq1c7 http://goo.gl/BSvAn http://goo.gl/erLtw Would be this one the correct approach? Any suggestion? Thanks! Guido De Rosa P.S. the matching thread in the DG mailing list is: http://tech.groups.yahoo.com/group/dansguardian/message/24488
On 04/11/10 15:31, Guido De Rosa wrote:
[Apparently the usenet gateway is not bidirectional, so I re-post here, sorry]
Hello,
AFAIK, there's nothing in the RADIUS protocol allowing you to ask a RADIUS server which user is currently using a given IP address... or am I missing something? The only thing you can do is
The radius server only knows what the NAS tells it.
FreeRADIUS-specific like issuing the "radwho" command which shows you a list of currently logged users, their IP addresses and other informations. Another option is querying the FreeRADIUS database (MySQL/whatever...), which is actually what some front-ends do (like DaloRADIUS...).
Do you know a more robust/standard/portable solution to get these info?
If your NAS supplies the IP information in the radius requests, use FreeRadius and the SQL module; there are many variations on how to do this. The most common is the NAS sending Framed-IP-Address in accounting packets, and rlm_sql logging the session. If your NAS doesn't supply the IP information in the radius requests, FreeRadius can't help you.
2010/11/4 Phil Mayers <p.mayers@imperial.ac.uk>:
FreeRADIUS-specific like issuing the "radwho" command which shows you a list of currently logged users, their IP addresses and other informations. Another option is querying the FreeRADIUS database (MySQL/whatever...), which is actually what some front-ends do (like DaloRADIUS...).
Do you know a more robust/standard/portable solution to get these info?
If your NAS supplies the IP information in the radius requests, use FreeRadius and the SQL module; there are many variations on how to do this. The most common is the NAS sending Framed-IP-Address in accounting packets,
My NAS is CoovaChilli (http://coova.org/CoovaChilli) and, yes, it sends Framed-IP-Address to the RADIUS server.
and rlm_sql logging the session.
I thought about radutmp because of its simplicity, and it would not require additional dependency on a mysql-client libary, but I understand that the mysql solution is far more scalable... Thanks, Guido
Guido De Rosa wrote:
AFAIK, there's nothing in the RADIUS protocol allowing you to ask a RADIUS server which user is currently using a given IP address... or am I missing something?
No. Use a database for this kind of query.
I'm configuring DansGuardian web content filtering (http://dansguardian.org) which has the possibility to configure several "filter groups" each with different filtering rules. I would like to match filter groups by RADIUS login
What does that mean? Alan DeKok.
2010/11/4 Alan DeKok <aland@deployingradius.com>:
Guido De Rosa wrote:
I'm configuring DansGuardian web content filtering (http://dansguardian.org) which has the possibility to configure several "filter groups" each with different filtering rules. I would like to match filter groups by RADIUS login
What does that mean?
DansGuardian has the ability to filter web content in a different way for different users: http://goo.gl/bVm0V And as you see in the table http://goo.gl/yJWmQ there is number of methods to identify a user; I simply thought that a RADIUS identification would be a nice feature to have. Cheers, Guido
participants (3)
-
Alan DeKok -
Guido De Rosa -
Phil Mayers