How to proxy only any type of requests
Hi folks, I a newbie freeradius user and I have a new problem. I have a switch that send auth request to a FreeRadius. I need that if the auth request if for a windows user (for example user NTCETEMMSA\guillem) resend the request to a windows nps server, but, if the auth request is a MAC address (for example 00-24-54-3E-04-5A/NOPASSWORD), the FR use the users file for auth this. The problem is that the FR always auth only with users file or always auth only with the windows nps server. This is my proxy.conf server: realm LOCAL { } realm NULL { type=LOCAL nostrip } realm DEFAULT { type = radius authhost = 192.168.120.4 accthost = 192.168.120.4 nostrip secret = J3q0fHat } And my users fils: "00-24-54-3E-04-5A" Auth-Type := "Local", User-Password = "NOPASSWORD" tunnel-type = 13, tunnel-medium-type = 6, tunnel-private-group-ID = 910, Filter-Id = "Enterasys:version1:policy=Admon" Anybody can help me please? Thanks a lot for your help. Toni
Hi,
I a newbie freeradius user and I have a new problem. I have a switch that send auth request to a FreeRadius. I need that if the auth request if for a windows user (for example user NTCETEMMSA\guillem) resend the request to a windows nps server, but, if the auth request is a MAC address (for example 00-24-54-3E-04-5A/NOPASSWORD), the FR use the users file for auth this.
The problem is that the FR always auth only with users file or always auth only with the windows nps server.
you just need to deal with the REALM component...many ways to do this...but I would personally use unlang... eg in your virtual-server configuration, in authorize, put if("%{User-Name}" =~ /\\/i) { update control { Proxy-To-Realm := 'nps' } } then, add 'nps' to your proxy.conf file as you have DEFAULT you could also add another check for if its MAC if you want belt-and-braces (check for the correct MAC format and then sent to local or null realm.)
This is my proxy.conf server:
realm LOCAL { }
realm NULL { type=LOCAL nostrip
you dont need those 2 entriess....remove LOCAL and remove nostrip
And my users fils:
"00-24-54-3E-04-5A" Auth-Type := "Local", User-Password = "NOPASSWORD" ^^^^^^^^^^^^^^^^^^^^^
you dont need Auth-Type. the server has intelligence. you certainly dont want User-Password. it should read Cleartext-Password := "NOPASSWORD" alan
Thanks a LOT Alan for your answer. The radius works very well. It auths the MAC's locally and resend the windows domains users query to a Windows NPS Server. Toni 2011/11/14 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>
Hi,
I a newbie freeradius user and I have a new problem. I have a switch that send auth request to a FreeRadius. I need that if the auth request if for a windows user (for example user NTCETEMMSA\guillem) resend the request to a windows nps server, but, if the auth request is a MAC address (for example 00-24-54-3E-04-5A/NOPASSWORD), the FR use the users file for auth this.
The problem is that the FR always auth only with users file or always auth only with the windows nps server.
you just need to deal with the REALM component...many ways to do this...but I would personally use unlang... eg in your virtual-server configuration, in authorize, put
if("%{User-Name}" =~ /\\/i) { update control { Proxy-To-Realm := 'nps' } }
then, add 'nps' to your proxy.conf file as you have DEFAULT
you could also add another check for if its MAC if you want belt-and-braces (check for the correct MAC format and then sent to local or null realm.)
This is my proxy.conf server:
realm LOCAL { }
realm NULL { type=LOCAL nostrip
you dont need those 2 entriess....remove LOCAL and remove nostrip
And my users fils:
"00-24-54-3E-04-5A" Auth-Type := "Local", User-Password = "NOPASSWORD" ^^^^^^^^^^^^^^^^^^^^^
you dont need Auth-Type. the server has intelligence.
you certainly dont want User-Password. it should read
Cleartext-Password := "NOPASSWORD"
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan Buxey -
IT Support