Reject user by Calling-Station-Id
Hi, I'm using MySQL to store all configs. I want to reject some comuters by their MAC address (Calling-Station-Id) Ex: one user keeps creating new userrnames to avoid administratice actions, so I got bored playing tom and jerry with him and I just want to bun his MAC address regardless of what udername he/she whould use. I hope that is doable. Could some one point me in right direction here? Thanks a lot!
I'm using MySQL to store all configs. I want to reject some comuters by their MAC address (Calling-Station-Id) Ex: one user keeps creating new userrnames to avoid administratice actions, so I got bored playing tom and jerry with him and I just want to bun his MAC address regardless of what udername he/she whould use. I hope that is doable. Could some one point me in right direction here?
DEFAULT Calling-Station-Id == whatever, Auth-Type := Reject Ivan Kalik Kalik Informatika ISP
Hi i just tried to add following (as adviced) into my radcheck table in MySQL: UserName: DEFAULT Attribute: Calling-Station-Id op: == Value: 00:0b:6a:xx:xx:xx, Auth-Type := Reject And it did not work guessI just can not add value with operator in it, but still how can i reject user based on their mac address with MySQL only setup. I would assume if i do the same in users tabe on the server then it should work? But I prefere MySQL managment Please help me out Thanks a lot! On Tue, Jan 20, 2009 at 8:34 PM, <tnt@kalik.net> wrote:
I'm using MySQL to store all configs. I want to reject some comuters by their MAC address (Calling-Station-Id) Ex: one user keeps creating new userrnames to avoid administratice actions, so I got bored playing tom and jerry with him and I just want to bun his MAC address regardless of what udername he/she whould use. I hope that is doable. Could some one point me in right direction here?
DEFAULT Calling-Station-Id == whatever, Auth-Type := Reject
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi i just tried to add following (as adviced) into my radcheck table in MySQL:
UserName: DEFAULT Attribute: Calling-Station-Id op: == Value: 00:0b:6a:xx:xx:xx, Auth-Type := Reject
And it did not work guessI just can not add value with operator in it, but still how can i reject user based on their mac address with MySQL only setup. I would assume if i do the same in users tabe on the server then it should work? But I prefere MySQL managment
OK, use groups then. For group ban put: Calling-Station-Id == 00:0b:6a:xx:xx:xx and Auth-Type := Reject in radgroupcheck table you can also add Reply-Message = Oh, no, you won't! in radgroupreply (I see you are asking about reply message for rejected users as well) add all users to group ban with low priority. Ivan Kalik Kalik Informatika ISP
Tried that... now i'm getting all users rejected regardless of mac address in the given group :( How do i set priorities? I though priorities only apply to radreply. Do I have to set fall through? Or maybe i did something wrong? On Fri, Jan 30, 2009 at 5:45 PM, <tnt@kalik.net> wrote:
Hi i just tried to add following (as adviced) into my radcheck table in MySQL:
UserName: DEFAULT Attribute: Calling-Station-Id op: == Value: 00:0b:6a:xx:xx:xx, Auth-Type := Reject
And it did not work guessI just can not add value with operator in it, but still how can i reject user based on their mac address with MySQL only setup. I would assume if i do the same in users tabe on the server then it should work? But I prefere MySQL managment
OK, use groups then. For group ban put:
Calling-Station-Id == 00:0b:6a:xx:xx:xx and Auth-Type := Reject in radgroupcheck table
you can also add Reply-Message = Oh, no, you won't! in radgroupreply (I see you are asking about reply message for rejected users as well)
add all users to group ban with low priority.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Tried that... now i'm getting all users rejected regardless of mac address in the given group :(
That shouldn't happen. Post the debug.
How do i set priorities?
You have priority field in radusergroup table.
I though priorities only apply to radreply.
There are no priorities in radreply.
Do I have to set fall through?
No. Ivan Kalik Kalik Informatika ISP
I guess its different in newer version of radius but in my 1.5 the only table that has PRIO is radgroupreply and there is table radusergroup instead there is a group called usergroup. I'm getting fustrated. :( On Fri, Jan 30, 2009 at 7:32 PM, <tnt@kalik.net> wrote:
Tried that... now i'm getting all users rejected regardless of mac address in the given group :(
That shouldn't happen. Post the debug.
How do i set priorities?
You have priority field in radusergroup table.
I though priorities only apply to radreply.
There are no priorities in radreply.
Do I have to set fall through?
No.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ah, sql groups don't work properly in 1.x. Upgrade. Ivan Kalik Kalik Informatika ISP Dana 31/1/2009, "Alex M" <freeradius@lrcommunications.net> piše:
I guess its different in newer version of radius but in my 1.5 the only table that has PRIO is radgroupreply
and there is table radusergroup instead there is a group called usergroup.
I'm getting fustrated. :(
On Fri, Jan 30, 2009 at 7:32 PM, <tnt@kalik.net> wrote:
Tried that... now i'm getting all users rejected regardless of mac address in the given group :(
That shouldn't happen. Post the debug.
How do i set priorities?
You have priority field in radusergroup table.
I though priorities only apply to radreply.
There are no priorities in radreply.
Do I have to set fall through?
No.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
damn, upgrade will be painfull for me :( I guess I will try to use other means to block missbehaving users. At least we got only 3 people who try to free ride. thanks for help 2009/1/31 <tnt@kalik.net>
Ah, sql groups don't work properly in 1.x. Upgrade.
Ivan Kalik Kalik Informatika ISP
Dana 31/1/2009, "Alex M" <freeradius@lrcommunications.net> piše:
I guess its different in newer version of radius but in my 1.5 the only table that has PRIO is radgroupreply
and there is table radusergroup instead there is a group called usergroup.
I'm getting fustrated. :(
On Fri, Jan 30, 2009 at 7:32 PM, <tnt@kalik.net> wrote:
Tried that... now i'm getting all users rejected regardless of mac address in the given group :(
That shouldn't happen. Post the debug.
How do i set priorities?
You have priority field in radusergroup table.
I though priorities only apply to radreply.
There are no priorities in radreply.
Do I have to set fall through?
No.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Here is a trick from the old days: Create a huntgroup like: blocked Calling-Station-Id == whatever SQL-Group == "suspend" Where suspend is the group with Auth-Type := Reject in it. That will blok him if he is in suspend group or not (only the message in radius.log will be different). It means using huntgroups file and restart for each change to it but if it's only 3 users ... Ivan Kalik Kalik Informatika ISP Dana 31/1/2009, "Alex M" <freeradius@lrcommunications.net> piše:
damn, upgrade will be painfull for me :( I guess I will try to use other means to block missbehaving users. At least we got only 3 people who try to free ride.
thanks for help
2009/1/31 <tnt@kalik.net>
Ah, sql groups don't work properly in 1.x. Upgrade.
Ivan Kalik Kalik Informatika ISP
Dana 31/1/2009, "Alex M" <freeradius@lrcommunications.net> piše:
I guess its different in newer version of radius but in my 1.5 the only table that has PRIO is radgroupreply
and there is table radusergroup instead there is a group called usergroup.
I'm getting fustrated. :(
On Fri, Jan 30, 2009 at 7:32 PM, <tnt@kalik.net> wrote:
Tried that... now i'm getting all users rejected regardless of mac address in the given group :(
That shouldn't happen. Post the debug.
How do i set priorities?
You have priority field in radusergroup table.
I though priorities only apply to radreply.
There are no priorities in radreply.
Do I have to set fall through?
No.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
yey thats seam to work, but still getting one problem. So the comp gets bloket regardless of username, but the Reply-message from the bloked table is not being displayed. So I have "bloked" huntgroup name and I have SQL group: Deny_Trial that sends Reply-Message + Reject for all its members (which works fine if i assign user to that group) Here is my debug: rad_recv: Access-Request packet from host xxx.147.xxx.xxx:60365, id=125, length=138 NAS-IP-Address = xxx.147.xxx.xxx NAS-Identifier = "domain.com" User-Name = "alexus" User-Password = "xxxxxxxx" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 1 Framed-IP-Address = 192.168.1.244 Called-Station-Id = "00:0d:b9:xx:xx:xx" Calling-Station-Id = "00:0b:6a:xx:xx:xx" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 rlm_sql (sql): - sql_groupcmp radius_xlat: 'alexus' rlm_sql (sql): sql_set_user escaped user --> 'alexus' radius_xlat: 'SELECT GroupName FROM usergroup WHERE UserName='alexus'' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT GroupName FROM usergroup WHERE UserName='alexus' rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): - sql_groupcmp finished: User does not belong in group Deny_Trial No huntgroup access: [alexus] (from client home_segment port 1 cli 00:0b:6a:xx:xx:xx) modcall[authorize]: module "preprocess" returns reject for request 2 modcall: leaving group authorize (returns reject) for request 2 Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 125 to xxx.147.xxx.xxx port 60365 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 125 with timestamp 498cd334 Nothing to do. Sleeping until we see a request. 2009/1/31 <tnt@kalik.net>
Here is a trick from the old days:
Create a huntgroup like:
blocked Calling-Station-Id == whatever SQL-Group == "suspend"
Where suspend is the group with Auth-Type := Reject in it. That will blok him if he is in suspend group or not (only the message in radius.log will be different). It means using huntgroups file and restart for each change to it but if it's only 3 users ...
Ivan Kalik Kalik Informatika ISP
Dana 31/1/2009, "Alex M" <freeradius@lrcommunications.net> piše:
damn, upgrade will be painfull for me :( I guess I will try to use other means to block missbehaving users. At least we got only 3 people who try to free ride.
thanks for help
2009/1/31 <tnt@kalik.net>
Ah, sql groups don't work properly in 1.x. Upgrade.
Ivan Kalik Kalik Informatika ISP
Dana 31/1/2009, "Alex M" <freeradius@lrcommunications.net> piše:
I guess its different in newer version of radius but in my 1.5 the only table that has PRIO is radgroupreply
and there is table radusergroup instead there is a group called usergroup.
I'm getting fustrated. :(
On Fri, Jan 30, 2009 at 7:32 PM, <tnt@kalik.net> wrote:
Tried that... now i'm getting all users rejected regardless of mac address in the given group :(
That shouldn't happen. Post the debug.
How do i set priorities?
You have priority field in radusergroup table.
I though priorities only apply to radreply.
There are no priorities in radreply.
Do I have to set fall through?
No.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
yey thats seam to work, but still getting one problem. So the comp gets bloket regardless of username, but the Reply-message from the bloked table is not being displayed. So I have "bloked" huntgroup name and I have SQL group: Deny_Trial that sends Reply-Message + Reject for all its members (which works fine if i assign user to that group)
I am afraid that sql group is just a gimick. As you have noticed user doesn't have to be a member of it to get rejected. It doesn't even have to exist. It's a trick to get something done, not a proper policy. You can send replies for individual macs: DEFAULT Calling-Station-Id == whatever Reply-Message = "Naughty boy" Ivan Kalik Kalik Informatika ISP
ok well i guess i will do manuall replys for each user :( So freeRadius 2.x have taken care of my problem and I actually can use SQL to controll everything? On Fri, Feb 6, 2009 at 8:07 PM, <tnt@kalik.net> wrote:
yey thats seam to work, but still getting one problem. So the comp gets bloket regardless of username, but the Reply-message from the bloked table is not being displayed. So I have "bloked" huntgroup name and I have SQL group: Deny_Trial that sends Reply-Message + Reject for all its members (which works fine if i assign user to that group)
I am afraid that sql group is just a gimick. As you have noticed user doesn't have to be a member of it to get rejected. It doesn't even have to exist. It's a trick to get something done, not a proper policy.
You can send replies for individual macs:
DEFAULT Calling-Station-Id == whatever Reply-Message = "Naughty boy"
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
ok well i guess i will do manuall replys for each user :(
So freeRadius 2.x have taken care of my problem and I actually can use SQL to controll everything?
Read man unlang on freeradius site and you will see how much more you can do in 2.x. Ivan Kalik Kalik Informatika ISP
will do here is the thing... i did all that was sujested and tested on my comps and gor rejections if my username belong to SQL Group that has reject reply or i was able to block myyslef by mac address. Well I just looked at the log and I see that 2 users that bloked by both mac and username, managed to sneak to the network. I personally cant imagine how that happaned... whats more that i cant imagine is how to debug that. Any recomendations? tnx! On Sat, Feb 7, 2009 at 10:05 AM, <tnt@kalik.net> wrote:
ok well i guess i will do manuall replys for each user :(
So freeRadius 2.x have taken care of my problem and I actually can use SQL to controll everything?
Read man unlang on freeradius site and you will see how much more you can do in 2.x.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alex M -
tnt＠kalik.net