Hi all. We have a very broken NAS - it basically only half-understands realms. If I log in with "john@ream", it will send "john@realm" off to the RADIUS server, which authenticates just fine, but the NAS will then try to register "johnrealm" via dynamic DNS. So this is not a RADIUS issue, it's an issue with how this NAS handles dynamic DNS updates. There is no way to make the NAS behave differently, though enhancement requests and bug reports have been lodged in hopes of better behaviour in a future release of the NAS OS. So I was wondering whether there is any practical way to get the RADIUS server to do the dynamic DNS instead. I found this from 2002: http://marc.info/?l=freeradius-users&m=106947389429225&w=2 And this thread from 2004: http://lists.cistron.nl/pipermail/freeradius-devel/2004-July/007357.html ... but I see no mention of a DDNS module in the current distribution, nor in the docs (though I admit I may well have missed it, there are a lot of docs). Is there such a module? Or has anyone already implemented DDNS from within FreeRADIUS, perhaps by writing an executable script such as suggested by Alan in 2002? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer@biplane.com.au) +61-2-64957160 (h) http://www.biplane.com.au/~kauer/ +61-428-957160 (mob) GPG fingerprint: DD23 0DF3 2260 3060 7FEC 5CA8 1AF6 D9E3 CFEE 6B28
Karl Auer wrote:
We have a very broken NAS - it basically only half-understands realms. If I log in with "john@ream", it will send "john@realm" off to the RADIUS server, which authenticates just fine, but the NAS will then try to register "johnrealm" via dynamic DNS.
That's crazy. Not "fun' crazy like "Crazy, dude!", but seriously crazy, like "We find the defendant not guilty by reason of insanity". DHCP does DDNS. RADIUS doesn't.
So this is not a RADIUS issue, it's an issue with how this NAS handles dynamic DNS updates.
Why the heck would the NAS be doing DDNS updates? In what alternate reality is this useful?
There is no way to make the NAS behave differently, though enhancement requests and bug reports have been lodged in hopes of better behaviour in a future release of the NAS OS.
Or, throw it in the garbage and buy a real NAS. If that's too expensive, return it to the manufacturer as "broken and doesn't work".
So I was wondering whether there is any practical way to get the RADIUS server to do the dynamic DNS instead.
I'm not sure what you mean by that... having the RADIUS server *also* do DDNS wouldn't seem to help. Why not just run a DNS server that accepts DDNS updates? .... and then throw away all of the updates from that NAS. Alan DeKok.
On Thu, 2008-10-16 at 07:57 +0200, Alan DeKok wrote:
Karl Auer wrote:
We have a very broken NAS - it basically only half-understands realms. DHCP does DDNS. RADIUS doesn't.
NASes may..
Why the heck would the NAS be doing DDNS updates? In what alternate reality is this useful?
Here's the full scoop then: This "NAS" is a tunnel broker. When you bring up a tunnel, you get an endpoint allocated to you. The tunnel broker then registers that address against your name in an appropriate domain. If you are "fred", it will register "fred.domain" for you, with an forward record mapping the name to the allocated address. It also registers the allocated address in the appropriate reverse zone, with a reverse record mapping the address to the name.
any practical way to get the RADIUS server to do the dynamic DNS instead.
I'm not sure what you mean by that... having the RADIUS server *also* do DDNS wouldn't seem to help.
I can turn the DDNS updates from the NAS *off*, I just can't fix them so they are *right*. So I'm thinking turn off the broken functionality in the NAS, and let the RADIUS server do the updates. It has all the information it needs except the nameserver to talk to, which could be configured into this hypothetical module or script. Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer@biplane.com.au) +61-2-64957160 (h) http://www.biplane.com.au/~kauer/ +61-428-957160 (mob) GPG fingerprint: DD23 0DF3 2260 3060 7FEC 5CA8 1AF6 D9E3 CFEE 6B28
Karl Auer wrote:
DHCP does DDNS. RADIUS doesn't.
NASes may..
Based on RADIUS User-Names? This is dumb. The NAS should at *least* assign names based on a VSA. Using the User-Name is wrong.
Here's the full scoop then: This "NAS" is a tunnel broker. When you bring up a tunnel, you get an endpoint allocated to you. The tunnel broker then registers that address against your name in an appropriate domain. If you are "fred", it will register "fred.domain" for you, with an forward record mapping the name to the allocated address. It also registers the allocated address in the appropriate reverse zone, with a reverse record mapping the address to the name.
Nice... but there's no reason to *rely* on the User-Name.
So I'm thinking turn off the broken functionality in the NAS, and let the RADIUS server do the updates. It has all the information it needs except the nameserver to talk to, which could be configured into this hypothetical module or script.
Exactly. For now, it's best to write a script. Alan DeKok.
On Thu, 2008-10-16 at 12:13 +0200, Alan DeKok wrote:
Nice... but there's no reason to *rely* on the User-Name.
No - and it really shouldn't. It should allow the authenticating entity to deliver a name to register. At very least it should allow the realm to be stripped off before doing DDNS on the remainder, and ideally it should have a per-realm nameserver config. But that's all pipe dreams. It is what it is.
Exactly. For now, it's best to write a script.
Which brings us full circle to the original question: Has anyone already done this? Anyone out there have scripts that do DDNS? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer@biplane.com.au) +61-2-64957160 (h) http://www.biplane.com.au/~kauer/ +61-428-957160 (mob) GPG fingerprint: DD23 0DF3 2260 3060 7FEC 5CA8 1AF6 D9E3 CFEE 6B28
participants (2)
-
Alan DeKok -
Karl Auer