user group allowed just a specific device.
Hello all. I'm running a FreeRADIUS which search user groups on the LDAP and permid or denny the access. Every think works fine but now I'm needing a new kind of restriction. There is a user group that they just can access some specific defice. So what I want is put this configuration to work. What I think: Is this configuration is possible? Is this configuration is made on user file? Today my enviroment is working but the user group has access on all device. If I put the this new group, ou users, on the same where is working they will have access to all equipament and this is not what is needed. Bast regards. -- Atenciosamente, Kalil de A. Carvalho
On Jul 26, 2017, at 9:09 AM, Kalil de A. Carvalho <kalilac@gmail.com> wrote:
I'm running a FreeRADIUS which search user groups on the LDAP and permid or denny the access. Every think works fine but now I'm needing a new kind of restriction. There is a user group that they just can access some specific defice. So what I want is put this configuration to work. What I think:
Is this configuration is possible?
Yes.
Is this configuration is made on user file?
I would suggest no.
Today my enviroment is working but the user group has access on all device. If I put the this new group, ou users, on the same where is working they will have access to all equipament and this is not what is needed.
It's simple. If you want to filter by device IP address, just do: if ((Packet-Src-IP-Address == 192.0.2.3) && (LDAP-Group == "sales")) { ... do something ... } Alan DeKok.
Hello Alan. Thanks for you replay. Let me ask another think: It is possible I change Packet-Src-IP-Address for a network range like 192.0.2.1-254 or 192.0.2.0/24? Is there any statiment for network? Best regards. On Wed, Jul 26, 2017 at 10:16 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 26, 2017, at 9:09 AM, Kalil de A. Carvalho <kalilac@gmail.com> wrote:
I'm running a FreeRADIUS which search user groups on the LDAP and permid or denny the access. Every think works fine but now I'm needing a new kind of restriction. There is a user group that they just can access some specific defice. So what I want is put this configuration to work. What I think:
Is this configuration is possible?
Yes.
Is this configuration is made on user file?
I would suggest no.
Today my enviroment is working but the user group has access on all device. If I put the this new group, ou users, on the same where is working they will have access to all equipament and this is not what is needed.
It's simple. If you want to filter by device IP address, just do:
if ((Packet-Src-IP-Address == 192.0.2.3) && (LDAP-Group == "sales")) { ... do something ... }
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
-- Atenciosamente, Kalil de A. Carvalho
Hello Alan. Thanks again for your replay. That is what I face it when I put your sugestion: /etc/raddb/sites-enabled/default[78]: Parse error in condition elsif ((Packet-Src-IP-Address < 192.168.28.0/24) && (LDAP-Group == 'AdmRedes')){ ^ Failed to parse value for attribute What am I doing wrong? On Wed, Jul 26, 2017 at 11:00 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 26, 2017, at 9:55 AM, Kalil de A. Carvalho <kalilac@gmail.com> wrote:
It is possible I change Packet-Src-IP-Address for a network range like 192.0.2.1-254 or 192.0.2.0/24? Is there any statiment for network?
Yes.
if ((Packet-Src-IP-Address < 192.168.0.0/24) ..
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
-- Atenciosamente, Kalil de A. Carvalho
On Jul 26, 2017, at 10:07 AM, Kalil de A. Carvalho <kalilac@gmail.com> wrote:
That is what I face it when I put your sugestion:
/etc/raddb/sites-enabled/default[78]: Parse error in condition elsif ((Packet-Src-IP-Address < 192.168.28.0/24) && (LDAP-Group == 'AdmRedes')){ ^ Failed to parse value for attribute
What am I doing wrong?
Ah, sorry.. you need to cast it to a network... see "man unlang" if ((<ipv4prefix>Packet-Src-IP-Address < 192.168.28.0/24) ... Alan DeKok.
Hello Allan Thanks again for your reply. I don't now why put it is not working and the out put show me this information: Cannot cast virtual attribute Packet-Src-IP-Address I looked on man ulang and did not find any think about this error. But I'm using your firt sugestion and add "or" for IP's and finished with "and" for groups. Like this every think is working fine. Thank you very mutch. Best regards. On Wed, Jul 26, 2017 at 11:09 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 26, 2017, at 10:07 AM, Kalil de A. Carvalho <kalilac@gmail.com> wrote:
That is what I face it when I put your sugestion:
/etc/raddb/sites-enabled/default[78]: Parse error in condition elsif ((Packet-Src-IP-Address < 192.168.28.0/24) && (LDAP-Group == 'AdmRedes')){ ^ Failed to parse value for attribute
What am I doing wrong?
Ah, sorry.. you need to cast it to a network... see "man unlang"
if ((<ipv4prefix>Packet-Src-IP-Address < 192.168.28.0/24) ...
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
-- Atenciosamente, Kalil de A. Carvalho
You can copy it to a temporary attribute and then evaluate that . update request { Tmp-IP-Address-0 := “%{Packet-Src-IP-Address}" } if (<ipv4prefix>Tmp-IP-Address-0 < 192.168.28.0/24) It’ll be fixed in v4 to the workaround won’t be required. -Arran
Hello All. Alan, yes my version is 3, precisely 3.0.4 Hello Arran, thanks for you advice. I will try. Best regards On Wed, Jul 26, 2017 at 1:38 PM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
You can copy it to a temporary attribute and then evaluate that .
update request { Tmp-IP-Address-0 := “%{Packet-Src-IP-Address}" } if (<ipv4prefix>Tmp-IP-Address-0 < 192.168.28.0/24)
It’ll be fixed in v4 to the workaround won’t be required.
-Arran
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
-- Atenciosamente, Kalil de A. Carvalho
You are running version 3 of the server? alan On 26 Jul 2017 2:10 pm, "Kalil de A. Carvalho" <kalilac@gmail.com> wrote:
Hello all.
I'm running a FreeRADIUS which search user groups on the LDAP and permid or denny the access. Every think works fine but now I'm needing a new kind of restriction. There is a user group that they just can access some specific defice. So what I want is put this configuration to work. What I think:
Is this configuration is possible?
Is this configuration is made on user file?
Today my enviroment is working but the user group has access on all device. If I put the this new group, ou users, on the same where is working they will have access to all equipament and this is not what is needed.
Bast regards.
-- Atenciosamente, Kalil de A. Carvalho - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
participants (4)
-
Alan Buxey -
Alan DeKok -
Arran Cudbard-Bell -
Kalil de A. Carvalho