Hello. Is it possible to copy user entries from a server to another? I have a user that connects to a "foreign" Radius server (AAAF). The AAAF detects his realm and forwards the request to the realm's appropriate Radius server (AAAH). The AAAH authenticates the user and returns the result. What I'd like to do: copy the user entry to the AAAF (username, password, check items, reply items) so that the AAAF can later authenticate the user without having to forward the request. Is this possible? Furthermore, how could I keep the user's data, seeing how unlang doesn't support creating new variables? Any advice is welcome.
On Tue, Jun 28, 2011 at 3:55 PM, Tiberiu Breana <tiberiu.breana@gmail.com> wrote:
Hello.
Is it possible to copy user entries from a server to another? I have a user that connects to a "foreign" Radius server (AAAF). The AAAF detects his realm and forwards the request to the realm's appropriate Radius server (AAAH). The AAAH authenticates the user and returns the result.
What I'd like to do: copy the user entry to the AAAF (username, password, check items, reply items) so that the AAAF can later authenticate the user without having to forward the request. Is this possible? Furthermore, how could I keep the user's data, seeing how unlang doesn't support creating new variables?
Not recommended. How will you know if (for example) the user change his password later? AAAF will always reject it later even if the password is actually correct. That being said, you MIGHT be able to work around that by: (1) forcing PAP (2) logging user passwords for succesfull auth (see radiusd.conf) (3) parse the log (a simple "awk" or something should work) (4) insert manually to db the "forcing PAP" part is necessary cause if the client uses MSCHAP you won't be able to see the cleartext password. As an alternative to (2) - (4), unlang supports arbitrary SELECT query (something like %{sql:.. , see http://freeradius.org/radiusd/man/unlang.html). But since you need to do an INSERT (insert user password to db), you need to work around that. See http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg51742.h... for example. -- Fajar -- Fajar
Tiberiu Breana wrote:
What I'd like to do: copy the user entry to the AAAF (username, password, check items, reply items) so that the AAAF can later authenticate the user without having to forward the request.
Sure. Copy the user database. If you can't copy the user database, it's pretty much impossible.
Is this possible? Furthermore, how could I keep the user's data, seeing how unlang doesn't support creating new variables?
I have no idea what that means. Alan DeKok.
On 28 June 2011 13:09, Alan DeKok <aland@deployingradius.com> wrote:
Is this possible? Furthermore, how could I keep the user's data, seeing how unlang doesn't support creating new variables?
I have no idea what that means.
Alan DeKok.
I'm not using databases at the moment, just the plain "users" files. I was wondering if it was possible to keep some received attributes on the server (without using databases), but now it seems impossible. Thanks for your answers, I'll try configuring some databases, then.
Hi,
I'm not using databases at the moment, just the plain "users" files. I was wondering if it was possible to keep some received attributes on the server (without using databases), but now it seems impossible.
you can log the received attributes in many ways - the 'detail' module will happily do this for you with little config.... you can use perl/python/ruby etc to log whatever you want to a file if you need to. alan
Tiberiu Breana wrote:
I'm not using databases at the moment, just the plain "users" files. I was wondering if it was possible to keep some received attributes on the server (without using databases), but now it seems impossible.
Thanks for your answers, I'll try configuring some databases, then.
No. I meant you need to copy the information from the remote machine. I have no idea if it uses databases, files, or anything else. You need to copy that information to your local system. Databases aren't magic. Configuring a database won't help, unless you know what to do with it. Alan DeKok.
participants (4)
-
Alan Buxey -
Alan DeKok -
Fajar A. Nugraha -
Tiberiu Breana