Distinguish RADIUS requests from NAS device
Hi there. We have a network device using FreeRADIUS 1.x for authentication. This RADIUS server in turn queries an LDAP server. We wish to distinguish between "admin" and "login" requests but are struggling to differentiate between the two. At the moment we identify the device by its NAS address but cannot distinguish which type of login request is being made - so cannot then choose which LDAP groups to query. Our only solution so far is to run separate instances of RADIUS and direct the network device to each instance per the request type it receives. Can anyone this of another way to distinguish the requests ? Thanks very much.
Hi,
Can anyone this of another way to distinguish the requests ?
Your NAS would have to send the type of request in a RADIUS attribute. See the NAS documentation if your device has such a capability, and how to configure it. Or just take a look at a request pcket if you see an attribute that tells you. If not, you are out of luck: if the requests look identical to the server, how could it distinguish them? Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473
Andrew are you looking to do different groups or are you looking to differentiate logging into say a router with standard privileges vs enabled privileges ? Andrew Hall wrote:
Hi there.
We have a network device using FreeRADIUS 1.x for authentication. This RADIUS server in turn queries an LDAP server.
We wish to distinguish between "admin" and "login" requests but are struggling to differentiate between the two.
At the moment we identify the device by its NAS address but cannot distinguish which type of login request is being made - so cannot then choose which LDAP groups to query.
Our only solution so far is to run separate instances of RADIUS and direct the network device to each instance per the request type it receives.
Can anyone this of another way to distinguish the requests ?
Thanks very much. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Andrew Hall -
Dave Rummel -
Stefan Winter