Accept via calling-station value
I have an aruba wireless network where I am trying to get free-radius to auth a device based on calling-station id. Line 35 confirms my re-writing is working, but line 46 looks like it is rejecting the match even though it is listed in the authorized_macs file. Any help would be appreciated. Thanks. Here is my config: sites-enabled/default: http://paste.debian.net/hidden/059033f6/ policy.d/macauth: http://paste.debian.net/hidden/cefd55aa/ authorized_macs: http://paste.debian.net/hidden/992be562/ radius -X output: http://paste.debian.net/hidden/8492e2fd/ -- Munroe Sollog LTS - Network Analyst x85002
On Jan 20, 2016, at 3:11 PM, Munroe Sollog <mus3@lehigh.edu> wrote:
I have an aruba wireless network where I am trying to get free-radius to auth a device based on calling-station id. Line 35 confirms my re-writing is working, but line 46 looks like it is rejecting the match even though it is listed in the authorized_macs file.
The entry in the authorized_macs file doesn't match the User-Name in the packet. Make them match, and it will work. The string "00-01-02-03-04-05" is NOT the same as "000102030405" Alan DeKok.
So I thought the authorized_macs file was comparing the calling-station-id, either way I added: # cat authorized_macs a41731f505fc Reply-Message = "Device with MAC Address %{Calling-Station-Id} authorized for network access" a4-17-31-f5-05-fc Reply-Message = "Device with MAC Address %{Calling-Station-Id} authorized for network access" Looks like the same output to me: http://paste.debian.net/hidden/6f83a72e/ On 01/20/2016 03:21 PM, Alan DeKok wrote:
On Jan 20, 2016, at 3:11 PM, Munroe Sollog <mus3@lehigh.edu> wrote:
I have an aruba wireless network where I am trying to get free-radius to auth a device based on calling-station id. Line 35 confirms my re-writing is working, but line 46 looks like it is rejecting the match even though it is listed in the authorized_macs file.
The entry in the authorized_macs file doesn't match the User-Name in the packet.
Make them match, and it will work.
The string "00-01-02-03-04-05" is NOT the same as "000102030405"
Alan DeKok.
-- Munroe Sollog LTS - Network Analyst x85002
On Jan 20, 2016, at 3:39 PM, Munroe Sollog <mus3@lehigh.edu> wrote:
So I thought the authorized_macs file was comparing the calling-station-id,
Did you configure then "files" module to do that? It looks like you didn't. And it helps to read the debug output: } # policy rewrite_calling_station_id = noop (0) if (!ok) { (0) if (!ok) -> TRUE You've put this into the "default" virtual server: rewrite_calling_station_id if (!ok) { reject } Why? That's rejecting the request when it can't re-write the Calling-Station-ID. And that's followed by: else { update control { Auth-Type := Accept } } Which accepts *all* requests if the Calling-Station-ID was re-written. And *nothing* in the "default" server says to use the "authorized_macs" file. You want the server to do check authorized_macs, but you never told it to use the authorized_macs file./ Go fix that. And read the debug output you're posting. It really is informative. Alan DeKok.
On Wed, Jan 20, 2016 at 03:11:33PM -0500, Munroe Sollog wrote:
I have an aruba wireless network where I am trying to get free-radius to auth a device based on calling-station id. Line 35 confirms my re-writing is working, but line 46 looks like it is rejecting the match even though it is listed in the authorized_macs file. Any help would be appreciated. Thanks.
You're not checking the authorized_macs file anywhere. For a start, add a new instatiation of the files module (maybe called "macauth") that reads the authorized_macs file and is keyed off Calling-Station-Id, and then call "macauth" after rewrite_calling_station_id. That should get you closer. The current if (!ok) doesn't really make any sense unless it comes after something that reads the authorized_macs file and returns ok if an entry is found. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
participants (3)
-
Alan DeKok -
Matthew Newton -
Munroe Sollog