Hello all, I'm running FreeRADIUS Version 2.1.5 (installed in 2009) configured to use Mac auth. Runs well indeed, but a brand new Cisco wireless controler is a bit disturbing i.e. Calling-Station mac address is not as usual. Following is my mac-authorized file : 062f68c7dcc2 Auth-type := Accept, User-Password == "062f68c7dcc2" ..... but now the stations controlled by the new Cisco appears as follows 06:2f:68:c7:dc:c2 So my first idea was to duplicate entries in the authorized file included within my conf, unfortunantely it does not run. So, is there a simple way to force radiusd to accept different mac address format ? Sorry if this is a FAQ, of course I've not changed anything within my conf since 2009 ! Any help would be appreciated. Cheers! -- François Dagorn Universite de Rennes France
Hi,
I'm running FreeRADIUS Version 2.1.5 (installed in 2009) configured to use Mac auth. Runs well indeed, but a brand new Cisco wireless controler is a bit disturbing i.e. Calling-Station mac address is not as usual. Following is my mac-authorized file :
062f68c7dcc2 Auth-type := Accept, User-Password == "062f68c7dcc2" .....
for latest versions, I'd advise that you look into the policy file(s) and look at rewrite.called_station_id if you call rewrite.called_station_id then that will alter the format but you care about user-name/password format sent - so you need to rewrite that instead. (doesnt the cisco kit let you decide what format to send it as? i love their abcd.0123.abcd format myself ;-) alan
On Mon, Jan 28, 2013 at 02:17:04PM +0100, François Dagorn wrote:
062f68c7dcc2 Auth-type := Accept, User-Password == "062f68c7dcc2" .....
but now the stations controlled by the new Cisco appears as follows
06:2f:68:c7:dc:c2
Security tab ->AAA -> RADIUS -> Authentication MAC Delimiter can be set to "No delimiter"
So my first idea was to duplicate entries in the authorized file included within my conf, unfortunantely it does not run.
So, is there a simple way to force radiusd to accept different mac address format ?
You can use unlang like the following to 'fix up' the mac addresses: if ("%{request:Called-Station-Id}" =~ /^([0-9a-fA-F]{2}):?([0-9a-fA-F]{2})[:.]?([0-9a-fA-F]{2}):?([0-9a-fA-F]{2})[:.]?([0-9a-fA-F]{2}):?([0-9a-fA-F]{2})$/) { update request { Called-Station-Id := "%{1}%{2}%{3}%{4}%{5}%{6}" } } However - if you're trying to do wireless WPA and EAP with mac based auth, it's not likely to go well...
Sorry if this is a FAQ, of course I've not changed anything within my conf since 2009 !
You should upgrade. There have been security bugs fixed in 2.2.0. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
François Dagorn wrote:
So, is there a simple way to force radiusd to accept different mac address format ?
Write a regular expression to turn one into the other. if (("%{User-Name}" == "%{User-Password}") && \ (User-Name =~ /([0-9a-f]{2}):([0-9a-f]{2}):([0-9a-f]{2}):([0-9a-f]{2}):([0-9a-f]{2}):([0-9a-f]{2}))) { update request { User-Name := "%{1}%{2}%{3}%{4}%{5}%{6]" User-Password := "%{1}%{2}%{3}%{4}%{5}%{6]" } } files ... That should work. It would also help for you to go through that, and understand exactly what it means.
Sorry if this is a FAQ, of course I've not changed anything within my conf since 2009 !
FreeRADIUS is pretty darned stable. Alan DeKok.
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
François Dagorn -
Matthew Newton