Mac-auth checking in sites-enabled/default
I'm currently using Freeradius v2.1.9 and I'm trying to write a condition in the authorize section to use a different module depending on whether Mac-auth or someother auth is being called. In reading the wiki (http://wiki.freeradius.org/Mac-Auth) it appears that I want to check (Chap-Password == hash(User-Name)) but I'm having a problem getting the unlang syntax correct. So far, I've tried: if (Chap-Password == hash(User-Name)){ which fails with: Consecutive conditions at (User-Name)) /etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. and: if (Chap-Password == hash %{request:User-Name}) { which fails with: Consecutive conditions at %{request:User-Name}) /etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. So, it appears that I'm having a fundamental failure to understand the conditional statements in unlang. So, is the wiki old/out-of-date, just pseudo code, or is the hash function something that I need to write? My NAS doesn't send a Service-Type and the Calling-Station-Id is in a different format that I can munge to get into the same format as User-Name, but I thought the hash option would be the quickest. Thanks! Tom Leach
On 07/22/2010 11:50 PM, Tom Leach wrote:
I'm currently using Freeradius v2.1.9 and I'm trying to write a condition in the authorize section to use a different module depending on whether Mac-auth or someother auth is being called. In reading the wiki (http://wiki.freeradius.org/Mac-Auth) it appears that I want to check (Chap-Password == hash(User-Name)) but I'm having a problem getting the unlang syntax correct.
So far, I've tried: if (Chap-Password == hash(User-Name)){ which fails with: Consecutive conditions at (User-Name)) /etc/raddb/sites-enabled/default[62]: Errors parsing authorize section.
AFAIK hash() or function calls in generall aren't a feature of unlang. Maybe the wiki page is listing pseudo-code? You want something like: if (User-Name =~ /..:..:..:..:..:../) { } ...or whatever format the mac address is in I guess. If you can be more specific about what the two incoming requests you want to distinguish look like, I can be more specific in a suggestion ;o)
On Jul 23, 2010, at 1:31 AM, Phil Mayers wrote:
On 07/22/2010 11:50 PM, Tom Leach wrote:
I'm currently using Freeradius v2.1.9 and I'm trying to write a condition in the authorize section to use a different module depending on whether Mac-auth or someother auth is being called. In reading the wiki (http://wiki.freeradius.org/Mac-Auth) it appears that I want to check (Chap-Password == hash(User-Name)) but I'm having a problem getting the unlang syntax correct.
So far, I've tried: if (Chap-Password == hash(User-Name)){ which fails with: Consecutive conditions at (User-Name)) /etc/raddb/sites-enabled/default[62]: Errors parsing authorize section.
AFAIK hash() or function calls in generall aren't a feature of unlang. Maybe the wiki page is listing pseudo-code?
The wiki is listing pseudo code. The examples below the pseudo code are in unlang... -Arran
participants (3)
-
Arran Cudbard-Bell -
Phil Mayers -
Tom Leach