Grouping different kinds of clients and returning different attributes
I'm new to FreeRadius, so please understand that my understanding of the vocabulary and structures are limited. I've read through the documentation and I'm trying to do something that may be obvious to some. I'm trying to configure FreeRadius to do administrator authentication from a series of switches, routers, and firewalls. Some are Cisco IOS, some HP Procurve, and some Juniper. I've got it working so that all are properly authenticating. The back-end authentication is LDAP. The problem is that there are roughly 250 units on various IP addresses across the WAN. I'd like to redirect them all to the same RADIUS server. The problem is that although I have some 250 client definitions in clients.conf, I'd rather avoid using 250 definitions in users. I'm trying to find a way to categorize the RADIUS clients into Cisco, HP, etc. What I was trying to do was to give each client a name: client Cisco_IOS.host-10.1.2.3 { ipaddr = 10.1.2.3 secret = supersecret } client HP_Procurve.host-10.3.2.1 { ipaddr = 10.3.2.1 secret = alsoverysecret } And then build something to refer to them in the users file along the lines of: DEFAULT Client-Shortname =~ "Cisco_IOS.*", User-Name := "someadmin", Cleartext-Password := "goodpassword" Service-Type = NAS-Prompt-User DEFAULT Client-Shortname =~ "HP_Procurve.*", User-Name := "anotheradmin", Cleartext-Password := "greatpassword" Service-Type = 6 of maybe DEFAULT Client-Shortname =~ "Somethingelse.*", Auth-Type := Pam (or LDAP) Service-Type = (something else), Other-attributes = XXXXXXX I'm having some problems, so I'm either missing something, or I'm going down an entirely wrong path. I got the "Client-Shortname" from the Run-time variables page in the Wiki, but I suspect it isn't evaluating like I think it ought to. Thank you for your time. -- View this message in context: http://www.nabble.com/Grouping-different-kinds-of-clients-and-returning-diff... Sent from the FreeRadius - User mailing list archive at Nabble.com.
David Bailey wrote:
The problem is that although I have some 250 client definitions in clients.conf, I'd rather avoid using 250 definitions in users.
I'm trying to find a way to categorize the RADIUS clients into Cisco, HP, etc.
You could use groups. See "man rlm_passwd" for examples. You can create groups based on any criteria. Then, just do group checking.
What I was trying to do was to give each client a name:
client Cisco_IOS.host-10.1.2.3 { ipaddr = 10.1.2.3 secret = supersecret }
client HP_Procurve.host-10.3.2.1 { ipaddr = 10.3.2.1 secret = alsoverysecret }
One undocumented feature is that you can put *anything* into the configuration, so long as it is the correct format: client a { ipaddr = 10.1.2.3 secret = foo vendor = cisco } FreeRADIUS will load the "vendor" entry, but it won't do anything with it. You can then create rules bases on that,
And then build something to refer to them in the users file along the lines of:
Don't use the "users" file. See "man unlang" for a better wy.
DEFAULT Client-Shortname =~ "Cisco_IOS.*", User-Name := "someadmin", Cleartext-Password := "goodpassword" Service-Type = NAS-Prompt-User
Don't use ":=" for User-Name. See "man users" for why.
I'm having some problems, so I'm either missing something, or I'm going down an entirely wrong path. I got the "Client-Shortname" from the Run-time variables page in the Wiki, but I suspect it isn't evaluating like I think it ought to.
Try unlang: authorize { ... if ("%{client:vendor}" == "cisco") { ... } ... } This says: look up the current client (for this request), and find the "vendor' entry. If that is "cisco", then do... something. It's a lot clearer to understand than the "users" file. Alan DeKok.
Alan DeKok-2 wrote:
Try unlang:
authorize { ...
if ("%{client:vendor}" == "cisco") { ... } ... }
This says: look up the current client (for this request), and find the "vendor' entry. If that is "cisco", then do... something.
It's a lot clearer to understand than the "users" file.
Do you have a complete example showing something similar that I could refer to?
From the documentation, it appears that the users file is the only place to specify attributes to be passed back to the RADIUS client. I am not certain what to specify in your example if statement. Am I adding an attribute here? Where is it compared? The documentation appears unclear to me, but I may have missed where it discusses these things.
Thank you for your assistance. -- View this message in context: http://www.nabble.com/Grouping-different-kinds-of-clients-and-returning-diff... Sent from the FreeRadius - User mailing list archive at Nabble.com.
David Bailey wrote:
Do you have a complete example showing something similar that I could refer to?
Like the example in my message? See also "man unlang".
From the documentation, it appears that the users file is the only place to specify attributes to be passed back to the RADIUS client.
Nonsense. 2.x provides a number of methods to specify attributes. "users" file, "unlang" configuration language, Perl scripts, Python scripts, etc.
I am not certain what to specify in your example if statement. Am I adding an attribute here? Where is it compared? The documentation appears unclear to me, but I may have missed where it discusses these things.
$ man unlang If you don't have it, upgrade to a version that does. Alan DeKok.
participants (2)
-
Alan DeKok -
David Bailey