Freeradius + MySQL + WiFi PEAP authorisation only to a group of users
Hello, I would like to help with this: I have Freeradius version 2.1.6 I have it running with SQL and DialupAdmin. How do I give access to wifi users who authenticate with username & pass over PEAP only to a group of users? I mean that authorised would be only users from group WIFI and not other users belonging to other group like OpenVPN. Now it authorises everybody from the radcheck table. I am very new to radius and even if I was searching the net for some time I cannot find the answer which would fir my needs. Thank you for help! Lumir
Hello, I would like to help with this: I have Freeradius version 2.1.6 I have it running with SQL and DialupAdmin. How do I give access to wifi users who authenticate with username & pass over PEAP only to a group of users? I mean that authorised would be only users from group WIFI and not other users belonging to other group like OpenVPN. Now it authorises everybody from the radcheck table. I am very new to radius and even if I was searching the net for some time I cannot find the answer which would fir my needs.
I would think something like this in your users file: DEFAULT NAS-Ip-Address == your.wifi.nas.ip, Group == WIFI DEFAULT NAS-Ip-Address == your.wifi.nas.ip, Auth-Type = Reject
I would think something like this in your users file: DEFAULT NAS-Ip-Address == your.wifi.nas.ip, Group == WIFI DEFAULT NAS-Ip-Address == your.wifi.nas.ip, Auth-Type = Reject -
Thank you for the answer but I do not use any users file - I use mysql and users are stored in radcheck table and the groups are assigned in the radusergroup. Plus the wifi are always behind a firewall and so NAT is present - so requests for both Wifi and OpenVPN authentication comes from the same IP address. Maybe I can put something inside the eap.conf to add checking of the group in sql? But how to do that?
Lumir Lindovsky wrote:
How do I give access to wifi users who authenticate with username & pass over PEAP only to a group of users?
See the FAQ. You can create a group, and limit them based on group membership. You can use SQL-Group. See doc/rlm_sql Alan DeKok.
Lumir Lindovsky wrote:
How do I give access to wifi users who authenticate with username& pass over PEAP only to a group of users? See the FAQ. You can create a group, and limit them based on group membership. You can use SQL-Group. See doc/rlm_sql
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
And could you plz give me a short example? And where to put the sql condition? In sql.conf or in eap.conf or in one of the site-enabled servers? It should be in the authorise or authenticate section? Users are stored in radcheck and users + groups associated to them are in radusergroup. I did not find any example on the net or in the config. Sorry for bothering but examples always help me most. Thank you, Lumir Lindovsky
I found the sollution some time ago. This might be helpful for beginners like me. The PEAP authentication is done using the site-enable/inner-tunnel virtual server configuration by default. So in the site-enabled/inner-tunnel in the section authorize add these: ====================== sql if (SQL-Group == "wifi") { # ok to login } else { reject } ====================== My original goal was to distinguish between wifi users and openvpn users. Openvpn users gets authenticated using the radiusplugin with username and password. I use the radius server just for wifi and openvpn so I just need the site-enabled/default config ======================== sql if (NAS-Identifier == "OpenVpn") { #Nas-identifier is set in radiusplugin.cnf if (SQL-Group == "openvpn") { } else { reject } } ========================= And one last note - PEAP is using MSCHAPv2 and so the passwords must be stored in cleartext (or nthash)! I use for administration DiapUPAdmin - very nice and easy. Hopefully this will help to somebody who was lost like me. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius-MySQL-WiFi-PEAP-authorisa... Sent from the FreeRadius - User mailing list archive at Nabble.com.
participants (4)
-
Alan DeKok -
Lumir Lindovsky -
lumirl
-
up＠3.am