post-auth language for two requirements
I am trying to configure post-auth to require both the NAS-IP-address and a script. I don't think AND works in post-auth. At least that's my guess because it's keeps failing. That or my syntax is incorrect. Looking for suggestions or alternatives. Thanks! Example: # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { if (%{NAS-IP-Address} = 10.100.17.52) AND (`/bin/sh /etc/doscripts/get.sh %{User-Name}` =~ /foo-admin/) { update reply { Service-Type == "guest" } noop } else { reject }
On Apr 29, 2021, at 4:33 PM, Jessica Cohen <Jessica.Cohen@sentrics.net> wrote:
I am trying to configure post-auth to require both the NAS-IP-address and a script. I don't think AND works in post-auth. At least that's my guess because it's keeps failing. That or my syntax is incorrect. Looking for suggestions or alternatives. Thanks!
Example:
# Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth {
if (%{NAS-IP-Address} = 10.100.17.52) AND (`/bin/sh /etc/doscripts/get.sh %{User-Name}` =~ /foo-admin/) {
I'm not sure where you got that syntax from. See "man unlang" for what is allowed. There's nothing which says that an uppercase "AND" can be used. What you want here is: if ((NAS-IP-Address == 10.100.17.52) && (`/etc/doscripts/get.sh %{User-Name}` =~ /foo-admin) { ... Alan DeKok.
Please, next time share the error with us as described in https://wiki.freeradius.org/guide/Users-Mailing-List <https://wiki.freeradius.org/guide/Users-Mailing-List> and https://wiki.freeradius.org/guide/radiusd-X <https://wiki.freeradius.org/guide/radiusd-X> -- Jorge Pereira jpereira@freeradius.org
On 29 Apr 2021, at 17:33, Jessica Cohen <Jessica.Cohen@sentrics.net> wrote:
I am trying to configure post-auth to require both the NAS-IP-address and a script. I don't think AND works in post-auth. At least that's my guess because it's keeps failing. That or my syntax is incorrect. Looking for suggestions or alternatives. Thanks!
Example:
# Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth {
if (%{NAS-IP-Address} = 10.100.17.52) AND (`/bin/sh /etc/doscripts/get.sh %{User-Name}` =~ /foo-admin/) { update reply { Service-Type == "guest" } noop } else { reject } - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Jessica Cohen -
Jorge Pereira