Question setting up Virtual Servers with unique clients / users files.
Hi, I'm relatively new to FreeRADIUS, and I'm working on moving the administrative logins of our network devices (switches, routers, etc) to it. I was planning on using AD as my data source and creating groups (ex. Switches, Routers) so people could easily be assigned permissions for the various devices. I believe I have the AD/Ldap Group retrieval parts working. What I'm having issues with is creating user file rules for each group of devices. I have a few rules in the users file that look like this: DEFAULT Ldap-Group == "Switch Admins" Reply-Message = "Welcome Switch Admin!" DEFAULT Ldap-Group == "Router Admins" Reply-Message = "Welcome Router Admin!" But the issue is that if a user is a member of both groups, it stops at the first match. Is there a way to specify a specific "users" file for each entry in the "Clients" file? I'm thinking that to do this I will need to setup a virtual server for each client group, but I'm not finding much in the ways of sample configurations that let me specify the "users" file as well. Thanks, Zach
Zach Simpson wrote:
What I'm having issues with is creating user file rules for each group of devices. I have a few rules in the users file that look like this:
DEFAULT Ldap-Group == "Switch Admins" Reply-Message = "Welcome Switch Admin!" DEFAULT Ldap-Group == "Router Admins" Reply-Message = "Welcome Router Admin!"
But the issue is that if a user is a member of both groups, it stops at the first match.
You can use "Fall-Through" to have it continue processing the file. See the rest of the comments / examples in the "users" file, and "man users".
Is there a way to specify a specific "users" file for each entry in the "Clients" file? I'm thinking that to do this I will need to setup a virtual server for each client group, but I'm not finding much in the ways of sample configurations that let me specify the "users" file as well.
In the latest version of the server, see raddb/modules/files Alan DeKok.
Am 31.08.2012 19:22, schrieb Zach Simpson:
What I'm having issues with is creating user file rules for each group of devices. I have a few rules in the users file that look like this:
DEFAULT Ldap-Group == "Switch Admins" Reply-Message = "Welcome Switch Admin!" DEFAULT Ldap-Group == "Router Admins" Reply-Message = "Welcome Router Admin!"
But the issue is that if a user is a member of both groups, it stops at the first match.
Your problem as well as the solution is descriped in the top of the users file: # A special user named "DEFAULT matches on all usernames. # You can have several DEFAULT entries. All entries are processed # in the order they appear in this file. The first entry that # matches the login-request will stop processing unless you use # the Fall-Through variable. You therefore should use the following: DEFAULT Ldap-Group == "Switch Admins" Reply-Message = "Welcome Switch Admin!" Fall-Through = Yes DEFAULT Ldap-Group == "Router Admins" Reply-Message = "Welcome Router Admin!" Fall-Through = Yes Cheers, Klaus
participants (3)
-
Alan DeKok -
Klaus Klein -
Zach Simpson