Hi All First post from a longtime reader / free radius user. We have CoovaChilli (a Wi-Fi captive portal program) tied together with FreeRadius for AAA. When an access request is sent to FreeRadius, Coova-Chill sends an attribute called Chillispot-VLAN-Id. What I’d like to do is check this attribute at the time of user login and make sure they’re allowed to be on a certain VLAN. I was thinking of having a custom check attribute in the radgroupreply table with something like Permitted-VLANS := 1,2,3,4 All I need free radius to do is ignore the check if there is not Permitted-VLANS attribute for that user or, if specified, make sure Chillispot-VLAN-Id is contained within Permitted-VLANS. We do this to stop users in certain locations from gaining access. Traditional huntgroups won’t work for us as we’re using a single NAS for all areas. Thanks in advance Stuart
Stuart Baggs wrote:
I was thinking of having a custom check attribute in the radgroupreply table with something like Permitted-VLANS := 1,2,3,4
Why? The documentation doesn't say that you can specify multiple values for an attribute.
All I need free radius to do is ignore the check if there is not Permitted-VLANS attribute for that user or, if specified, make sure Chillispot-VLAN-Id is contained within Permitted-VLANS.
That is entirely the wrong approach. You've invented some behavior, and are hoping that the server magically supports it. Instead, you need to find out what the server does, and then figure out how to configure the server to do what you want. See "man rlm_passwd" for examples of creating sets. You should be able to map a user to a set of allowed VLANs. Alan DeKok.
participants (2)
-
Alan DeKok -
Stuart Baggs