FreeRADIUS Authorization Question
Hi List Greetings How do we authorize users using FreeRADIUS such as way that ClientA can only use VOIP service, ClientB mail only, ClientC internet only and so on ? Do we do by using some attributes ? or possible in unlang only ? i do not have logical diagram in my mind, how would i achieve that, using port numbers of services ? Could someone help me to understand ? --THKS --RM
Russell Mike wrote:
How do we authorize users using FreeRADIUS such as way that ClientA can only use VOIP service, ClientB mail only, ClientC internet only and so on ?
How do you tell those users apart? See the debug output.
Do we do by using some attributes ? or possible in unlang only ?
Everything in RADIUS is attributes.
i do not have logical diagram in my mind, how would i achieve that, using port numbers of services ?
I have no idea. Look at the debug output to see what's different between the packets. Then, write rules to look for those differences, and enforce different policies. Alan DeKok.
Thanks Alan i barely understand anything from your response. Anyways, Let me ask my last question. Is it doable ? Thanks --RM On Tue, Nov 11, 2014 at 2:01 PM, Alan DeKok <aland@deployingradius.com> wrote:
Russell Mike wrote:
How do we authorize users using FreeRADIUS such as way that ClientA can only use VOIP service, ClientB mail only, ClientC internet only and so on ?
How do you tell those users apart? See the debug output.
Do we do by using some attributes ? or possible in unlang only ?
Everything in RADIUS is attributes.
i do not have logical diagram in my mind, how would i achieve that, using port numbers of services ?
I have no idea. Look at the debug output to see what's different between the packets. Then, write rules to look for those differences, and enforce different policies.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Russell Mike wrote:
i barely understand anything from your response.
RADIUS uses attributes for everything. If you don't know what attributes are, you should find out. Now.
Anyways, Let me ask my last question. Is it doable ?
It should be doable. But I don't know how. *You* know how. Because you have access to the debugging output from your server. Read it. Really. Read it. If you don't know how to even *begin* creating rules, I have to ask how you expect to create them, or to put them into production. Alan DeKok.
participants (2)
-
Alan DeKok -
Russell Mike