Authenticate/Attributes based on NAS-IP-Address
Using MySQL as a backend, is there any way to configure Authentication and Attribute (replies), based on the NAS-IP-Address sent to the FreeRADIUS server? Allow requests from NAS1 to authenticate and have certain attributes for users in that group and then allow requests from NAS2 to authenticate and have different attributes. Would there be anyway to allow a user to be a part of both groups? Thanks, Nick
Alan DeKok wrote:
N White <nwtech@tele-net.net> wrote:
Using MySQL as a backend, is there any way to configure Authentication and Attribute (replies), based on the NAS-IP-Address sent to the FreeRADIUS server?
Yes. Use it as a check item, like anything else.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
__________ NOD32 1.1132 (20050607) Information __________
This message was checked by NOD32 antivirus system. http://www.eset.com
Ok, so is it possible for them to be a part of two groups? The reason I ask is that if a customer logs in through NAS1, I want them to be assigned a dynamic IP, if they are logged in from NAS2, I want them to be assigned a static IP. Is this possible? I guess two groups may not even play a role in a statically assigned IP. Thanks -Nick
N White <nwtech@tele-net.net> wrote:
Ok, so is it possible for them to be a part of two groups? The reason I ask is that if a customer logs in through NAS1, I want them to be assigned a dynamic IP, if they are logged in from NAS2, I want them to be assigned a static IP. Is this possible?
Sure, but it's not really a "group". In the "users" file, you can do: bob NAS-IP-Address == foo, Pool-Name := "foo" bob NAS-IP-Address == bar Framed-IP-Address := 1.2.3.4 Alan DeKok.
Alan DeKok wrote:
N White <nwtech@tele-net.net> wrote:
Ok, so is it possible for them to be a part of two groups? The reason I ask is that if a customer logs in through NAS1, I want them to be assigned a dynamic IP, if they are logged in from NAS2, I want them to be assigned a static IP. Is this possible?
Sure, but it's not really a "group". In the "users" file, you can do:
bob NAS-IP-Address == foo, Pool-Name := "foo"
bob NAS-IP-Address == bar Framed-IP-Address := 1.2.3.4
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
__________ NOD32 1.1132 (20050607) Information __________
This message was checked by NOD32 antivirus system. http://www.eset.com
Yeah, but I want to use MySQL, not the users file.
Alan DeKok wrote:
N White <nwtech@tele-net.net> wrote:
Yeah, but I want to use MySQL, not the users file.
I don't use MySQL, sorry.
If you want someone to give you the exact answer you're looking for, I suggest you hire a contracter.
Alan Dekok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
__________ NOD32 1.1132 (20050607) Information __________
This message was checked by NOD32 antivirus system. http://www.eset.com
Well, thanks for the input. With MySQL, 1500 users is easier to maintain. Perhaps I should just run a second FreeRADIUS server for the second NAS. It means more equipment, but whatever it takes. -Nick
On Tue, 7 Jun 2005, N White wrote:
Well, thanks for the input. With MySQL, 1500 users is easier to maintain. Perhaps I should just run a second FreeRADIUS server for the second NAS. It means more equipment, but whatever it takes.
-Nick
You don't need to do that, you can do it with SQL in one server. First, work on reading the documentation and installing the server and setting up mysql for authorization. Once you've got that down, then move on to the reply values and groups if you want them. Alan gave you a good start with the users file entries. Read man 5 users, that will tell you about the users file. You'll take that info and transfer it to sql. It would look something like this. users file only format bob NAS-IP-Address == foo, Pool-Name := "foo" bob NAS-IP-Address == bar Framed-IP-Address := 1.2.3.4 SQL Format. in the users file DEFAULT NAS-IP-Address == foo, Pool-Name := "foo" This says any user from that nas-ip will have Pool-Name set to foo. That is what ippool will use to assign ips. in radiusd.conf, in your ip_pool section be sure to include. override = no That makes it so a dynamic ip from ippool will not override one statically assigned to the user as a reply value. In sql in the radcheck table you put your users and their passwords. In radreply you put the users and their static ip. for example, insert into radcheck (username,attribute,value,op) VALUES ('bob','User-Password','bobspassword','=='); insert into radreply (username,attribute,value,op) VALUES ('bob','Framed-IP-Address','1.1.1.1',':='), ('bob','Framed-IP-Netmask','255.255.255.0',':='); That should give you a good start. Get it setup and if you run into problems post radiusd -X to the list and describe what you are trying to do. You can add groups into if you want but right now you probably won't need it. Hope that is helpful. Dusty Doris
Dustin Doris wrote:
On Tue, 7 Jun 2005, N White wrote:
Well, thanks for the input. With MySQL, 1500 users is easier to maintain. Perhaps I should just run a second FreeRADIUS server for the second NAS. It means more equipment, but whatever it takes.
-Nick
You don't need to do that, you can do it with SQL in one server. First, work on reading the documentation and installing the server and setting up mysql for authorization. Once you've got that down, then move on to the reply values and groups if you want them.
Alan gave you a good start with the users file entries. Read man 5 users, that will tell you about the users file. You'll take that info and transfer it to sql.
It would look something like this.
users file only format bob NAS-IP-Address == foo, Pool-Name := "foo"
bob NAS-IP-Address == bar Framed-IP-Address := 1.2.3.4
SQL Format.
in the users file
DEFAULT NAS-IP-Address == foo, Pool-Name := "foo"
This says any user from that nas-ip will have Pool-Name set to foo. That is what ippool will use to assign ips.
in radiusd.conf, in your ip_pool section be sure to include.
override = no
That makes it so a dynamic ip from ippool will not override one statically assigned to the user as a reply value.
In sql in the radcheck table you put your users and their passwords. In radreply you put the users and their static ip.
for example,
insert into radcheck (username,attribute,value,op) VALUES ('bob','User-Password','bobspassword','==');
insert into radreply (username,attribute,value,op) VALUES ('bob','Framed-IP-Address','1.1.1.1',':='), ('bob','Framed-IP-Netmask','255.255.255.0',':=');
That should give you a good start. Get it setup and if you run into problems post radiusd -X to the list and describe what you are trying to do.
You can add groups into if you want but right now you probably won't need it.
Hope that is helpful.
Dusty Doris
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
__________ NOD32 1.1132 (20050607) Information __________
This message was checked by NOD32 antivirus system. http://www.eset.com
Actually I already have two running FreeRADIUS servers with SQL. That isn't the hard part. The problem with your instructions is that I'm not using ippool to assign dynamic IPs, our NASes are doing that (Portmaster 2/3). I don't have a problem setting up static IPs either, as we have several Dial-Up users who need those also. The problem lies in that I want to use the RADIUS server for PPPoE authentication also. But I want to allow users who log in through PPPoE to also be able to log in regularly(Dial-Up), when their PPPoE isn't logged in. BUT, when they log in through PPPoE, I want them to be assigned a static IP, when they login via Portmasters/Dial-Up, then they don't get the static IP, they get a regular dynamic one. Basically if a user logs in through NAS1, they are assigned X attributes with dynamic IP, if they log in through NAS2, they are assigned Y attributes with a static IP. And all this needs to be done in MySQL, that way my own PHP frontend(which I intend to release GPL) can work with it. Also I think MySQL scales better. -Nick -- ------------------------ | Nick White | | Network Consultant | | http://www.edge9.net | | nwtech@tele-net.net | ------------------------
Hi all, I try to authenticate my wireless user with MAC address and EAP/TLS simultaneously. I set my Cisco 1230 AP to authenticate 'with MAC address and EAP' and my wireless client as for EAP/TLS authentication because no special setting is needed for MAC authentication. However, the wireless client only do EAP/TLS, not MAC authentication. Anything that I miss? Thanks. Thanks.
Hiya perhaps you could do it using huntgroups. Put the static attributes for the user in the radreply table, then assign each nas to a huntgroup, so say NAS-dynamic Then in radgroupreply you put the attributes for for dynamic IP assignment on the NAS-dynamic, and ensure there is an attribute to override the static settings. not 100% about the overriding of the static IP settings, but would think it possible using the assignment ( := ) operator and possibly a null value? Hope thats of some help. -- ----- Graeme Hinchliffe (BSc) Core Systems Designer Zen Internet (http://www.zen.co.uk/) Direct: 0845 058 9074 Main : 0845 058 9000 Fax : 0845 058 9005
Graeme Hinchliffe wrote:
Hiya perhaps you could do it using huntgroups.
Put the static attributes for the user in the radreply table, then assign each nas to a huntgroup, so say
NAS-dynamic
Then in radgroupreply you put the attributes for for dynamic IP assignment on the NAS-dynamic, and ensure there is an attribute to override the static settings.
not 100% about the overriding of the static IP settings, but would think it possible using the assignment ( := ) operator and possibly a null value?
Hope thats of some help.
Do I need to setup a "HuntGroups" field like Mike suggested? Ok, so in huntgroups file: Wireless NAS-IP-Address = (the IP of the Wireless NAS) Autz-Type = SQL1 (modify radiusd.conf to include this, and sql.conf like in Mike's post?) NAS-dynamic NAS-IP-Address = (ip of dialup NAS) NAS-IP-Address = (ip of isdn NAS) in radgroupreply: +-------------+--------------------+----+---------------------+-----------+ | GroupName | Attribute | op | Value | HuntGroup | +-------------+--------------------+----+---------------------+-----------+ | Wireless | Service-Type | = | Framed-User | Wireless | | Wireless | Framed-Protocol | = | PPP | Wireless | | Wireless | Framed-IP-Address | = | 255.255.255.254 | Wireless | | Wireless | Framed-IP-Netmask | = | 255.255.255.255 | Wireless | | Wireless | Framed-Compression | = | Van-Jacobson-TCP-IP | Wireless | +-------------+--------------------+----+---------------------+-----------+ All Other users would go into the Dial-Up Group, which would have a HuntGroup of NAS-dynamic? in radreply: +-----------+-------------------+-----+---------------+ | UserName | Attribute | op | Value | +-----------+-------------------+-----+---------------+ | test123 | Framed-IP-Address | := | 192.168.2.10 | +-----------+-------------------+-----+---------------+ Now in radgroupcheck do I need a NAS-IP-Address check for each group(or the wireless group?)? Thanks for everyone's help. -Nick
Hiya, Use Client-IP rather than NAS-IP as NAS-IP can be spoofed. Graeme On Wed, 2005-06-08 at 15:30 -0700, N White wrote:
Graeme Hinchliffe wrote:
Hiya perhaps you could do it using huntgroups.
Put the static attributes for the user in the radreply table, then assign each nas to a huntgroup, so say
NAS-dynamic
Then in radgroupreply you put the attributes for for dynamic IP assignment on the NAS-dynamic, and ensure there is an attribute to override the static settings.
not 100% about the overriding of the static IP settings, but would think it possible using the assignment ( := ) operator and possibly a null value?
Hope thats of some help.
Do I need to setup a "HuntGroups" field like Mike suggested? Ok, so in huntgroups file:
Wireless NAS-IP-Address = (the IP of the Wireless NAS) Autz-Type = SQL1 (modify radiusd.conf to include this, and sql.conf like in Mike's post?) NAS-dynamic NAS-IP-Address = (ip of dialup NAS) NAS-IP-Address = (ip of isdn NAS)
in radgroupreply:
+-------------+--------------------+----+---------------------+-----------+ | GroupName | Attribute | op | Value | HuntGroup | +-------------+--------------------+----+---------------------+-----------+ | Wireless | Service-Type | = | Framed-User | Wireless | | Wireless | Framed-Protocol | = | PPP | Wireless | | Wireless | Framed-IP-Address | = | 255.255.255.254 | Wireless | | Wireless | Framed-IP-Netmask | = | 255.255.255.255 | Wireless | | Wireless | Framed-Compression | = | Van-Jacobson-TCP-IP | Wireless | +-------------+--------------------+----+---------------------+-----------+ All Other users would go into the Dial-Up Group, which would have a HuntGroup of NAS-dynamic?
in radreply:
+-----------+-------------------+-----+---------------+ | UserName | Attribute | op | Value | +-----------+-------------------+-----+---------------+ | test123 | Framed-IP-Address | := | 192.168.2.10 | +-----------+-------------------+-----+---------------+
Now in radgroupcheck do I need a NAS-IP-Address check for each group(or the wireless group?)? Thanks for everyone's help.
-Nick
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html --
Graeme Hinchliffe (BSc) Core Systems Designer Zen Internet (http://www.zen.co.uk/) Direct: 0845 058 9074 Main : 0845 058 9000 Fax : 0845 058 9005
Ok, so here's what I did to solve this problem. I'm posting this just for anyone out there searching the Archives that needs something like my situation. I did a lot of reading, and a lot of re-reading, and finally the lightbulb over my head clicked on! I read Mike's previous post several times over and over, and finally understand it: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg16842.h... My goal as stated before: Basically if a user logs in through NAS1, they are assigned X attributes with *dynamic* IP, if they log in through NAS2, they are assigned Y attributes with a *static* IP. And all this needs to be done in MySQL, that way my own PHP frontend(which I intend to release GPL) can work with it. Also I think MySQL scales better. 1) Create a new field (column) in the radreply, radgroupcheck, and radgroupreply tables. You could name this column anything you want, but following Mikes earlier post, mine is set up at "HuntGroup". The name is insignificant, it is merely a reference, but you should make sure that it stays the same throughout this. 2) Modify sql.conf and change the following: authorize_group_check_query authorize_group_reply_query authorize_reply_query Make them the following: authorize_group_check_query = "SELECT ${groupcheck_table}.id,${groupcheck_table}.GroupName,${groupcheck_table}.Attribute,${groupcheck_table}.Value,${groupcheck_table}.op FROM ${groupcheck_table},${usergroup_table} WHERE ${usergroup_table}.Username = '%{SQL-User-Name}' AND ${usergroup_table}.GroupName = ${groupreply_table}.GroupName AND ${usergroup_table}.GroupName = ${groupcheck_table}.GroupName AND (${groupcheck_table}.HuntGroup = '%{request:Client-IP-Address}' OR ${groupcheck_table}.HuntGroup IS NULL) ORDER BY ${groupcheck_table}.id" authorize_group_reply_query = "SELECT ${groupreply_table}.id,${groupreply_table}.GroupName,${groupreply_table}.Attribute,${groupreply_table}.Value,${groupreply_table}.op FROM ${groupreply_table},${usergroup_table} WHERE ${usergroup_table}.Username = '%{SQL-User-Name}' AND ${usergroup_table}.GroupName = ${groupreply_table}.GroupName AND ${usergroup_table}.GroupName = ${groupreply_table}.GroupName AND (${groupreply_table}.HuntGroup = '%{request:Client-IP-Address}' OR ${groupreply_table}.HuntGroup IS NULL) ORDER BY ${groupreply_table}.id" authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM ${authreply_table} WHERE Username = '%{SQL-User-Name}' AND (${authreply_table}.HuntGroup = '%{request:Client-IP-Address}' OR ${authreply_table}.HuntGroup = '' OR ${authreply_table}.HuntGroup IS NULL) ORDER BY id" Note that where it says ".HuntGroup" this is where you would change the name depending on what you call your field in #1. Also, where it says "%{request:Client-IP-Address}" this is going to be the attribute you are checking against. Originally I had it set to "NAS-IP-Address" as I was checking the NAS to determine what to reply with.Graeme pointed out that Client-IP is more secure, as NAS-IP can be spoofed. 3) Now insert into the various tables for testing. I assume here that you already have groups set up. I have two groups, Wireless and Dial-Up. In radgroupcheck: id GroupName Attribute op Value HuntGroup 132 Wireless Auth-Type == Local 68.190.182.200 134 Dial-Up Auth-Type == Local 63.151.182.3 135 Dial-Up Auth-Type == Reject 68.190.182.200 We need the reject under Dial-Up so that it doesn't reply with Dial-Up attributes coming from that NAS(IP). Someone correct me if that is wrong, perhaps that isn't needed? In radgroupreply: 133 Wireless Service-Type := Framed-User 0 68.190.182.200 132 Wireless Framed-Compression := Stac-LZS 0 68.190.182.200 131 Wireless Framed-MTU := 1480 0 68.190.182.200 130 Wireless Framed-IP-Netmask := 255.255.255.255 0 68.190.182.200 129 Wireless Framed-IP-Address := 255.255.255.254 0 68.190.182.200 128 Wireless Framed-Protocol := PPP 0 68.190.182.200 134 Wireless Session-Timeout := 14400 0 68.190.182.200 135 Wireless Idle-Timeout := 600 0 68.190.182.200 136 Wireless Port-Limit := 2 0 68.190.182.200 In radreply: 171 testaccount Framed-IP-Address := 192.168.3.5 68.190.182.200 4) I put the user "testaccount" into both the Dial-Up and Wireless groups. Now, if I run a test (I use NTRadPing) from anything other than 68.190.182.200, it replies with the attributes for Dial-Up. If I run a test from 68.190.182.200, it replies with the attributes for Wireless, including the Static IP. Now, if I insert "testaccount2" into radreply(assuming the user is a part of Dial-Up already), with a Static IP, but nothing in "HuntGroup" and test from anything it returns the attributes only in radreply - Static IP. You could expand upon this, as it may not be complete. Feel free to correct me or make other points. -Nick Graeme Hinchliffe wrote:
Hiya, Use Client-IP rather than NAS-IP as NAS-IP can be spoofed.
Graeme
On Wed, 2005-06-08 at 15:30 -0700, N White wrote:
Graeme Hinchliffe wrote:
Hiya perhaps you could do it using huntgroups.
Put the static attributes for the user in the radreply table, then assign each nas to a huntgroup, so say
NAS-dynamic
Then in radgroupreply you put the attributes for for dynamic IP assignment on the NAS-dynamic, and ensure there is an attribute to override the static settings.
not 100% about the overriding of the static IP settings, but would think it possible using the assignment ( := ) operator and possibly a null value?
Hope thats of some help.
Do I need to setup a "HuntGroups" field like Mike suggested? Ok, so in huntgroups file:
Wireless NAS-IP-Address = (the IP of the Wireless NAS) Autz-Type = SQL1 (modify radiusd.conf to include this, and sql.conf like in Mike's post?) NAS-dynamic NAS-IP-Address = (ip of dialup NAS) NAS-IP-Address = (ip of isdn NAS)
in radgroupreply:
+-------------+--------------------+----+---------------------+-----------+ | GroupName | Attribute | op | Value | HuntGroup | +-------------+--------------------+----+---------------------+-----------+ | Wireless | Service-Type | = | Framed-User | Wireless | | Wireless | Framed-Protocol | = | PPP | Wireless | | Wireless | Framed-IP-Address | = | 255.255.255.254 | Wireless | | Wireless | Framed-IP-Netmask | = | 255.255.255.255 | Wireless | | Wireless | Framed-Compression | = | Van-Jacobson-TCP-IP | Wireless | +-------------+--------------------+----+---------------------+-----------+ All Other users would go into the Dial-Up Group, which would have a HuntGroup of NAS-dynamic?
in radreply:
+-----------+-------------------+-----+---------------+ | UserName | Attribute | op | Value | +-----------+-------------------+-----+---------------+ | test123 | Framed-IP-Address | := | 192.168.2.10 | +-----------+-------------------+-----+---------------+
Now in radgroupcheck do I need a NAS-IP-Address check for each group(or the wireless group?)? Thanks for everyone's help.
-Nick
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
__________ NOD32 1.1135 (20050609) Information __________
This message was checked by NOD32 antivirus system. http://www.eset.com
-- ------------------------ | Nick White | | Network Consultant | | http://www.edge9.net | | nwtech@tele-net.net | ------------------------
Ok i'm not sure what all detail i need to give for this post but here goes.... I have a USR Hiperarc tc1000 and a portmaster 4 we migrated from steelbelt to freeradius for auth and accounting the problem comes in here, when i use freeradius with the portmaster it works perfect fine, as expected a user gets online and goes wheerever they please the TC1000 is another story, when a user dials into this, they "can't" use microsoft stuff, you open outlook express and try to check pop3 mail ANYWHERE and it doesn't work, you try imap, it works fine, you open internet explorer you load google fine, you lod apache.org fine, you try to load any site using IIS as a server, it won't load, if you try to sign in with msn messenger it works perfectly fine, irc works fine, yahooo messenger works fine now if i switch primary and secondary back to steelbelt, thats it, just switch it back, it all magically works fine again now i dunno what kinda voodoo magic is goin on but it's confusing me accounting attributes sent back by steelbelt only differ in one respect they send a Class attribute #########steeleblt reply######## rad_recv: Access-Accept packet from host 65.111.222.4:1645, id=54, length=76 Service-Type = Framed-User Framed-Protocol = PPP Class = 0x5342522d434c20444e3d2273646775736c6572222041543d223230302200 Session-Timeout = 28800 Idle-Timeout = 1200 ########freeradius reply################ rad_recv: Access-Accept packet from host 127.0.0.1:1645, id=221, length=50 Framed-Protocol = PPP Idle-Timeout = 1200 Service-Type = Framed-User Session-Timeout = 28800 If anyone has any insight into whats causing this i'de definatly like to know Thanks, Scott
"Scott Gusler" <sdgusler@m33access.com> wrote:
now i dunno what kinda voodoo magic is goin on but it's confusing me
About the only thing I can suggest is to re-order the attributes in the FreeRADIUS config, so that they're in the same order as sent by SBR. If necessary, create a hard-coded config to do this for testing. If it works, it's worth your time to fix the rest of the config. And doing the test should take only 10 minutes. Alan DeKok.
Upon further inspection i found it was sending 2 other attributes, defaults from my users file i started testing it with radclient, using info one of the NAS's sent, radtest wasn't giving it this extra info i guess and i ended up with these 2 extra attributes Framed-MTU = 576 Framed-Compression = Van-Jacobson-TCP-IP I removed just the MTU and it still worked with the portmasters and started working perfectly find on the TC1000's too I'm not quite sure why it wasn't working with that attribute but it resolved the problem Scott ----- Original Message ----- From: "Alan DeKok" <aland@ox.org> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, June 08, 2005 1:32 PM Subject: Re: Problem with [microsoft] stuff not working
"Scott Gusler" <sdgusler@m33access.com> wrote:
now i dunno what kinda voodoo magic is goin on but it's confusing me
About the only thing I can suggest is to re-order the attributes in the FreeRADIUS config, so that they're in the same order as sent by SBR.
If necessary, create a hard-coded config to do this for testing. If it works, it's worth your time to fix the rest of the config. And doing the test should take only 10 minutes.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (6)
-
Alan DeKok -
Dustin Doris -
Graeme Hinchliffe -
Jefri bin Dahari -
N White -
Scott Gusler