Chillispot certainly does! M0n0wall almost ;) Don't know about nocat J. ________________________________ Van: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Alex M Verzonden: woensdag 2 november 2005 19:19 Aan: 'FreeRadius users mailing list' Onderwerp: RE: 802.1x Ok, will call Dlink to see if that have something (the hotspot itself has that functionality internally though) Also do you know if opensources such as NoCAT and ChillBox support such features? ________________________________ From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Jeff Reilly Sent: Wednesday, November 02, 2005 1:08 PM To: FreeRadius users mailing list Subject: RE: 802.1x AV = ATTRIBUTE VALUE <? D-Link what? D-Link makes lots of stuff... generally great price... but not the most feature rich products. To get the features you desire you'll likely need a higher-end box. I'm not a big proponent of "pitching" specific products in this forum. Suffice it to say there are vendors that will (or attempt) to provide CoS / filtering on Wireless... jmr -------- Original Message -------- Subject: RE: 802.1x From: "Alex M" <alexm@lrcommunications.net> Date: Wed, November 02, 2005 10:04 am To: "'FreeRadius users mailing list'" <freeradius-users@lists.freeradius.org> Ok I got it By the way what is AV pair? And how do you get NAS related attributes to control bandwidth from vendors? Like if im using D-Link how could I get attributes from them? Thanks! ________________________________ From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Jeff Reilly Sent: Wednesday, November 02, 2005 11:53 AM To: FreeRadius users mailing list Subject: RE: 802.1x Alex, Features such as 'bandwidth and port blocking" (if any) are allocated/configured on the _NAS_ (in this case a NAS port) via AV pair/s provided by RADIUS... the '802.1x Supplicant" (Client/Endpoint) in simple terms... provides a secure/standard conduit which facilitates the communication of credentials (from the Supplicant to the Authenticator). The '802.1x Authenticator" (or NAS) _MAY_ provision/enforce Authorization for the specific endpoint in the context of a user or group... The management & granularity of this functionality verifies greatly by switch vendor as a result providing this functionality across a multi-vendor environment... in a large scale deployment... is often too complex to seriously consider.<?<? jmr -------- Original Message -------- Subject: RE: 802.1x From: "Alex M" <alexm@lrcommunications.net> Date: Wed, November 02, 2005 9:10 am To: "'FreeRadius users mailing list'" <freeradius-users@lists.freeradius.org> Now im totally lost... Can u give me an example what 802.1x does? -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, November 02, 2005 11:04 AM To: FreeRadius users mailing list Subject: Re: 802.1x "Alex M" <alexm@lrcommunications.net> wrote: > So then such features as bandwidth and port blocking could be controlled via > 802.1x? No. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi Guys, I want to get some idea about how to manipulate attributes before we respond to NAS. For example, before I send Access-Accept packet to the NAS, I want to add two additional attributes (let's say S and T) to NAS-1 and add X, Y, and Z to NAS-2. In short, I want to add some attributes differently based on the NAS IP or Client IP. How can I do that? Thanks, Kevin
kevin wrote:
I want to get some idea about how to manipulate attributes before we respond to NAS.
For example, before I send Access-Accept packet to the NAS, I want to add two additional attributes (let's say S and T) to NAS-1 and add X, Y, and Z to NAS-2. In short, I want to add some attributes differently based on the NAS IP or Client IP. How can I do that?
In the "users" file: DEFAULT NAS-IP-Address == 10.0.0.1 Attribute-S := Value-S, Attribute-T := Value-T DEFAULT NAS-IP-Address == 10.0.0.2 Attribute-X := Value-X, Attribute-Y := Value-Y, Attribute-Z := Value-Z -- Nicolas Baradakis
But, I want to use rlm_rewrite_attr or rewrite_filter. Look at my comments below. Nicolas Baradakis wrote:
kevin wrote:
I want to get some idea about how to manipulate attributes before we respond to NAS.
For example, before I send Access-Accept packet to the NAS, I want to add two additional attributes (let's say S and T) to NAS-1 and add X, Y, and Z to NAS-2. In short, I want to add some attributes differently based on the NAS IP or Client IP. How can I do that?
In the "users" file:
DEFAULT NAS-IP-Address == 10.0.0.1 Attribute-S := Value-S, Attribute-T := Value-T
DEFAULT NAS-IP-Address == 10.0.0.2 Attribute-X := Value-X, Attribute-Y := Value-Y, Attribute-Z := Value-Z
What I want to do is something like if (Calling-Station-ID == 5045551234) then add some filters to the DEFAULT reply attributes. It seems that rewrite_filter cannot add some attributes to DEFAULT and rewrite_attr cannot check any condition. Does anybody know how to do it? Kevin
kevin <kevinsmbox@earthlink.net> wrote:
What I want to do is something like if (Calling-Station-ID == 5045551234) then add some filters to the DEFAULT reply attributes.
The "users" file can do this. Use it.
It seems that rewrite_filter cannot add some attributes to DEFAULT and rewrite_attr cannot check any condition. Does anybody know how to do it?
I would like to be able to use a hammer to wash my windows, but it's not the best tool for the job. Alan DeKok.
Alan DeKok wrote:
kevin <kevinsmbox@earthlink.net> wrote:
What I want to do is something like if (Calling-Station-ID == 5045551234) then add some filters to the DEFAULT reply attributes.
The "users" file can do this. Use it.
I want to do it in post-auth and post-proxy which cannot be done by "users". I thought that's why we use rewrite_filter/attr. No?
It seems that rewrite_filter cannot add some attributes to DEFAULT and rewrite_attr cannot check any condition. Does anybody know how to do it?
I would like to be able to use a hammer to wash my windows, but it's not the best tool for the job.
Alan DeKok.
:-)
kevin wrote:
Alan DeKok wrote:
kevin <kevinsmbox@earthlink.net> wrote:
What I want to do is something like if (Calling-Station-ID == 5045551234) then add some filters to the DEFAULT reply attributes.
The "users" file can do this. Use it.
I want to do it in post-auth and post-proxy which cannot be done by "users". I thought that's why we use rewrite_filter/attr. No?
Sorry for typo. It should be rlm_attr_filter and attr_rewrite.
It seems that rewrite_filter cannot add some attributes to DEFAULT and rewrite_attr cannot check any condition. Does anybody know how to do it?
I would like to be able to use a hammer to wash my windows, but it's not the best tool for the job.
Alan DeKok.
:-)
kevin <kevinsmbox@earthlink.net> wrote:
I want to do it in post-auth and post-proxy which cannot be done by "users". I thought that's why we use rewrite_filter/attr. No?
You can put the checks in the "authorize" section, and it will work. Alan DeKok.
The reason that I want to put it to post-auth is that it should be done only for authenticated users. That's why I cannot use "users". Kevin Alan DeKok wrote:
kevin <kevinsmbox@earthlink.net> wrote:
I want to do it in post-auth and post-proxy which cannot be done by "users". I thought that's why we use rewrite_filter/attr. No?
You can put the checks in the "authorize" section, and it will work.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
kevin <kevinsmbox@earthlink.net> wrote:
The reason that I want to put it to post-auth is that it should be done only for authenticated users. That's why I cannot use "users".
If the user is rejected, all attributes are stripped from the response. You *can* use "users". Everyone else does. Alan DeKok.
Well, I want to return different attributes for -password-mismatched users -authenticated but Calling-Station-Id is in my-block-list -authenticated and Calling-Station-Id is not in my-block-list. I cannot use "users". Kevin Alan DeKok wrote:
kevin <kevinsmbox@earthlink.net> wrote:
The reason that I want to put it to post-auth is that it should be done only for authenticated users. That's why I cannot use "users".
If the user is rejected, all attributes are stripped from the response.
You *can* use "users". Everyone else does.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
kevin <kevinsmbox@earthlink.net> wrote:
Well, I want to return different attributes for -password-mismatched users -authenticated but Calling-Station-Id is in my-block-list -authenticated and Calling-Station-Id is not in my-block-list.
<sigh> I want people to state their requirements up front, rather than playing "twenty questions". Go read the documentation. Failing that, write your own module. Alan DeKok.
I already started to write it. Thanks, Kevin, Alan DeKok wrote:
kevin <kevinsmbox@earthlink.net> wrote:
Well, I want to return different attributes for -password-mismatched users -authenticated but Calling-Station-Id is in my-block-list -authenticated and Calling-Station-Id is not in my-block-list.
<sigh>
I want people to state their requirements up front, rather than playing "twenty questions".
Go read the documentation. Failing that, write your own module.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
Jonathan De Graeve -
kevin -
Nicolas Baradakis