Defining different Service-Types for different equipment for the same user
Hi, I have to install a Radius Server that is going to authenticate and autorize users in the CLI of a mix of router brands and switches. The server will have a bunch of users that will have defined the Service-Type Administrative or NAS-Prompt. My problem is that when a user logs in to an Enterasys SSR with the Service-Type = Administrative, it goes immediately to the configure mode, and I dont want that, just the enable mode. So for a user that has Serv.Type = Administrative I would like to specifically define for the SSRs the Service-Type as NAS-Prompt (which goes to enable mode, equivalent for Administrative for CISCO that goes as well to enable mode for example). Do you know the best way to implement this? Thanks, Nuno
Nuno Cervaens <Nuno.Cervaens@cern.ch> wrote:
My problem is that when a user logs in to an Enterasys SSR with the Service-Type = Administrative, it goes immediately to the configure mode, and I dont want that, just the enable mode.
I presume this is a documented Enterasys feature. If not, file a bug with them.
So for a user that has Serv.Type = Administrative I would like to specifically define for the SSRs the Service-Type as NAS-Prompt (which goes to enable mode, equivalent for Administrative for CISCO that goes as well to enable mode for example).
I'm not sure what you mean by that. You can define what you want, but what do you want to put in what packet? Alan DeKok.
Alan DeKok wrote:
Nuno Cervaens <Nuno.Cervaens@cern.ch> wrote:
My problem is that when a user logs in to an Enterasys SSR with the Service-Type = Administrative, it goes immediately to the configure mode, and I dont want that, just the enable mode.
I presume this is a documented Enterasys feature. If not, file a bug with them.
Yes its a SSR feature, so I cannot change this.
So for a user that has Serv.Type = Administrative I would like to specifically define for the SSRs the Service-Type as NAS-Prompt (which goes to enable mode, equivalent for Administrative for CISCO that goes as well to enable mode for example).
I'm not sure what you mean by that. You can define what you want, but what do you want to put in what packet?
Here's an example for what it would be a perfect solution: userOne Crypt-Password == "$1$GYuKhumy$wUkW0ZvClTCi86kkkgJBw." Service-Type = 6 Service-Type = 7 (for the SSRs) userTwo Crypt-Password == "$1$ASD#$SDGYuKhasdcasdcasdumy$wUk." Service-Type = 7 Service-Type = 1 (for the SSRs) So, userOne would log in as Administrative in all routers and as NAS-Prompt for the SSRs, userTwo would log in as NAS-Prompt in all routers and as Login for the SSRs. The reason I want this is because for the same Service-Type I have different behaviors from the equipments.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Nuno Cervaens <Nuno.Cervaens@cern.ch> wrote:
Here's an example for what it would be a perfect solution:
userOne Crypt-Password == "$1$GYuKhumy$wUkW0ZvClTCi86kkkgJBw." Service-Type = 6 Service-Type = 7 (for the SSRs)
I don't think that will work. You're allowed ONE Service-Type in a response. You have to configure the server to send Service-Type = 6 for one NAS, and 7 for another. You will need two different entries in the "users" file. Alan DeKok.
participants (2)
-
Alan DeKok -
Nuno Cervaens