RADIUS Administration interface
I've added a RADIUS administration interface to the latest git tree. It's experimental (i.e. VERY), and has little authentication or authorization. It's purpose is to test the concepts, and to see if it's what users want. Server configuration: raddb/sites-available/control-socket Client: radmin You get a prompt, and not much else. Typing "help" gets you some information: radmin> help hup [module] - sends a HUP signal to the server, or optionally to one module terminate - terminates the server, and causes it to exit show <command> - do sub-command of show set <command> - do sub-command of set You can HUP the server, ask it to stop, see the configuration of a module, show the list of loaded modules. As an interesting note, you can also *change* parts of the configuration of a running system. And then hup *just* one module, rather than the whole server. And then maybe the server crashes. :) Don't use this in production. Once it's a little more developed, we'll add features like "authentication" of the users on the administration interface. And "command authorization". Alan DeKok.
seems a good idea. 2008/9/3 Alan DeKok <aland@deployingradius.com>:
I've added a RADIUS administration interface to the latest git tree. It's experimental (i.e. VERY), and has little authentication or authorization. It's purpose is to test the concepts, and to see if it's what users want.
Server configuration: raddb/sites-available/control-socket
Client: radmin
You get a prompt, and not much else. Typing "help" gets you some information:
radmin> help hup [module] - sends a HUP signal to the server, or optionally to one module terminate - terminates the server, and causes it to exit show <command> - do sub-command of show set <command> - do sub-command of set
You can HUP the server, ask it to stop, see the configuration of a module, show the list of loaded modules. As an interesting note, you can also *change* parts of the configuration of a running system. And then hup *just* one module, rather than the whole server. And then maybe the server crashes. :)
Don't use this in production. Once it's a little more developed, we'll add features like "authentication" of the users on the administration interface. And "command authorization".
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
maybe you can add a debug function/sub-command so we dont have to start the server in debug mode ( freeradius -X ) but to see the debugs on console ( radmin > debug server ). 2008/9/8 orion <meshkruaj@gmail.com>:
seems a good idea.
2008/9/3 Alan DeKok <aland@deployingradius.com>:
I've added a RADIUS administration interface to the latest git tree. It's experimental (i.e. VERY), and has little authentication or authorization. It's purpose is to test the concepts, and to see if it's what users want.
Server configuration: raddb/sites-available/control-socket
Client: radmin
You get a prompt, and not much else. Typing "help" gets you some information:
radmin> help hup [module] - sends a HUP signal to the server, or optionally to one module terminate - terminates the server, and causes it to exit show <command> - do sub-command of show set <command> - do sub-command of set
You can HUP the server, ask it to stop, see the configuration of a module, show the list of loaded modules. As an interesting note, you can also *change* parts of the configuration of a running system. And then hup *just* one module, rather than the whole server. And then maybe the server crashes. :)
Don't use this in production. Once it's a little more developed, we'll add features like "authentication" of the users on the administration interface. And "command authorization".
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi people: First of all, sorry but my english is not good. I'm newie in FreeRadius and I am in a hurry with Cisco VPN Server 3000, FreeRadius and LDAP, to permit vpn user's access. When vpn users connect (with "Cisco VPN Client"), Radius consult to LDAP if user exist. If exist, then user can connect to vpn. If not, can't connect. This works well. Now, also I should assign IP addresses according to an LDAP attribute. For example, if attribute==1 assign 10.0.0.10/24, if attribute==2 assign 10.0.0.20/24. I try to assign IP addresses with "ippool module" and filters in the "ldap module" in FreeRadius, but it doesn't work. How can I work with many ippool's according to a value of LDAP attribute? Where should I ask for the attribute value in order to assign the corresponding ippool?. Please, help me with that. My config is something like that: In the radius.conf file... ldap vpnldap1 { server = "x.x.x.x" identity = "cn=Directory Manager" password = ********** basedn = "ou=People, dc:blah, dc=cl" filter = "(&(uid=%u)(attribute=1))" authtype = ldap set_asuth_type = yes } ldap vpnldap2 { server = "x.x.x.x" identity = "cn=Directory Manager" password = ********** basedn = "ou=People, dc:blah, dc=cl" filter = "(&(uid=%u)(attribute=2))" authtype = ldap set_asuth_type = yes } .... authorize { files Autz-Type LDAPVPN1 { vpnldap1 } Autz-Type LDAPVPN2 { vpnldap2 } } .... authentication { Auth-Type LDAPVPN1 { vpnldap1 } Auth-Type LDAPVPN2 { vpnldap2 } } .... ippool vpnusers1 { range-start = 10.0.0.10 range-stop = 10.0.0.19 netmask = 255.255.255.0 cache-size = 10 session-db = ${raddbdir}/db.vpnusers1-session ip-index = ${raddbdir}/db.vpnusers1-index override = yes } .... ippool vpnusers2 { range-start = 10.0.0.20 range-stop = 10.0.0.29 netmask = 255.255.255.0 cache-size = 10 session-db = ${raddbdir}/db.vpnusers2-session ip-index = ${raddbdir}/db.vpnusers2-index override = yes } .... In the user file... (i don`t know how to configure this file to several "Ippool".... I think that here's the problem) DEFAULT NAS-IP-Address = "y.y.y.y", Auth-Type :=LDAPVPN1, AUTZ-Type :=LDAPVPN1, Pool-Name :=vpnusers1 DEFAULT NAS-IP-Address = "y.y.y.y", Auth-Type :=LDAPVPN2, AUTZ-Type :=LDAPVPN2, Pool-Name :=vpnusers2 # y.y.y.y= address of VPN Server In the ldap.attrmap... checkItem vpnusers1 attribute checkItem vpnusers2 attribute Please, help me with this config. Thank's you... Osvaldo H. Campos Molina Administrador de Red STI - Univ. de Chile
this is how we do it: radius.conf: get user's group from ldap users file: if user is member of groupA assign ip pool1 if user is member of groupB assign ip pool2 here is users file(This is not using ip pools, just limits connection duration and when they can login): DEFAULT LDAP-Group == "VPN12", Max-Daily-Session :=43200 Fall-Through = Yes DEFAULT LDAP-GROUP == "VPNSALES", Max-Daily-Session :=7200, Login-Time:="Any0730-0830,Any1630-1730" Fall-Through = Yes -----Original Message----- From: freeradius-users-bounces+p_beheshti=rasana.net@lists.freeradius.org on behalf of Osvaldo Campos M. - Administrador Red STI Sent: Tue 9/9/2008 2:36 AM To: FreeRadius users mailing list Subject: Cisco VPN Server 3000 + Radius + LDAP = heeelp!! Hi people: First of all, sorry but my english is not good. I'm newie in FreeRadius and I am in a hurry with Cisco VPN Server 3000, FreeRadius and LDAP, to permit vpn user's access. When vpn users connect (with "Cisco VPN Client"), Radius consult to LDAP if user exist. If exist, then user can connect to vpn. If not, can't connect. This works well. Now, also I should assign IP addresses according to an LDAP attribute. For example, if attribute==1 assign 10.0.0.10/24, if attribute==2 assign 10.0.0.20/24. I try to assign IP addresses with "ippool module" and filters in the "ldap module" in FreeRadius, but it doesn't work. How can I work with many ippool's according to a value of LDAP attribute? Where should I ask for the attribute value in order to assign the corresponding ippool?. Please, help me with that. My config is something like that: In the radius.conf file... ldap vpnldap1 { server = "x.x.x.x" identity = "cn=Directory Manager" password = ********** basedn = "ou=People, dc:blah, dc=cl" filter = "(&(uid=%u)(attribute=1))" authtype = ldap set_asuth_type = yes } ldap vpnldap2 { server = "x.x.x.x" identity = "cn=Directory Manager" password = ********** basedn = "ou=People, dc:blah, dc=cl" filter = "(&(uid=%u)(attribute=2))" authtype = ldap set_asuth_type = yes } .... authorize { files Autz-Type LDAPVPN1 { vpnldap1 } Autz-Type LDAPVPN2 { vpnldap2 } } .... authentication { Auth-Type LDAPVPN1 { vpnldap1 } Auth-Type LDAPVPN2 { vpnldap2 } } .... ippool vpnusers1 { range-start = 10.0.0.10 range-stop = 10.0.0.19 netmask = 255.255.255.0 cache-size = 10 session-db = ${raddbdir}/db.vpnusers1-session ip-index = ${raddbdir}/db.vpnusers1-index override = yes } .... ippool vpnusers2 { range-start = 10.0.0.20 range-stop = 10.0.0.29 netmask = 255.255.255.0 cache-size = 10 session-db = ${raddbdir}/db.vpnusers2-session ip-index = ${raddbdir}/db.vpnusers2-index override = yes } .... In the user file... (i don`t know how to configure this file to several "Ippool".... I think that here's the problem) DEFAULT NAS-IP-Address = "y.y.y.y", Auth-Type :=LDAPVPN1, AUTZ-Type :=LDAPVPN1, Pool-Name :=vpnusers1 DEFAULT NAS-IP-Address = "y.y.y.y", Auth-Type :=LDAPVPN2, AUTZ-Type :=LDAPVPN2, Pool-Name :=vpnusers2 # y.y.y.y= address of VPN Server In the ldap.attrmap... checkItem vpnusers1 attribute checkItem vpnusers2 attribute Please, help me with this config. Thank's you... Osvaldo H. Campos Molina Administrador de Red STI - Univ. de Chile - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks for your answer, but I can't use LDAP groups in this case because I haven'ts groups defined in LDAP according to LDAP "attribute". For example, I haven't a group "Sales" in LDAP with only users with the value "attribute=1". And I need to assign addresses according to the value "attribute" . Other ideas for this, please?? Thanks... Osvaldo H. Campos Molina Administrador de Red STI - Univ. de Chile Parham Beheshti escribió:
this is how we do it: radius.conf: get user's group from ldap
users file: if user is member of groupA assign ip pool1
if user is member of groupB assign ip pool2
here is users file(This is not using ip pools, just limits connection duration and when they can login): DEFAULT LDAP-Group == "VPN12", Max-Daily-Session :=43200 Fall-Through = Yes
DEFAULT LDAP-GROUP == "VPNSALES", Max-Daily-Session :=7200, Login-Time:="Any0730-0830,Any1630-1730" Fall-Through = Yes
-----Original Message----- From: freeradius-users-bounces+p_beheshti=rasana.net@lists.freeradius.org on behalf of Osvaldo Campos M. - Administrador Red STI Sent: Tue 9/9/2008 2:36 AM To: FreeRadius users mailing list Subject: Cisco VPN Server 3000 + Radius + LDAP = heeelp!!
Hi people:
First of all, sorry but my english is not good.
I'm newie in FreeRadius and I am in a hurry with Cisco VPN Server 3000, FreeRadius and LDAP, to permit vpn user's access.
When vpn users connect (with "Cisco VPN Client"), Radius consult to LDAP if user exist. If exist, then user can connect to vpn. If not, can't connect. This works well.
Now, also I should assign IP addresses according to an LDAP attribute. For example, if attribute==1 assign 10.0.0.10/24, if attribute==2 assign 10.0.0.20/24.
I try to assign IP addresses with "ippool module" and filters in the "ldap module" in FreeRadius, but it doesn't work.
How can I work with many ippool's according to a value of LDAP attribute? Where should I ask for the attribute value in order to assign the corresponding ippool?. Please, help me with that.
My config is something like that:
In the radius.conf file... ldap vpnldap1 { server = "x.x.x.x" identity = "cn=Directory Manager" password = ********** basedn = "ou=People, dc:blah, dc=cl" filter = "(&(uid=%u)(attribute=1))" authtype = ldap set_asuth_type = yes } ldap vpnldap2 { server = "x.x.x.x" identity = "cn=Directory Manager" password = ********** basedn = "ou=People, dc:blah, dc=cl" filter = "(&(uid=%u)(attribute=2))" authtype = ldap set_asuth_type = yes } .... authorize { files Autz-Type LDAPVPN1 { vpnldap1 } Autz-Type LDAPVPN2 { vpnldap2 } } .... authentication { Auth-Type LDAPVPN1 { vpnldap1 } Auth-Type LDAPVPN2 { vpnldap2 } } .... ippool vpnusers1 { range-start = 10.0.0.10 range-stop = 10.0.0.19 netmask = 255.255.255.0 cache-size = 10 session-db = ${raddbdir}/db.vpnusers1-session ip-index = ${raddbdir}/db.vpnusers1-index override = yes } .... ippool vpnusers2 { range-start = 10.0.0.20 range-stop = 10.0.0.29 netmask = 255.255.255.0 cache-size = 10 session-db = ${raddbdir}/db.vpnusers2-session ip-index = ${raddbdir}/db.vpnusers2-index override = yes } .... In the user file... (i don`t know how to configure this file to several "Ippool".... I think that here's the problem)
DEFAULT NAS-IP-Address = "y.y.y.y", Auth-Type :=LDAPVPN1, AUTZ-Type :=LDAPVPN1, Pool-Name :=vpnusers1 DEFAULT NAS-IP-Address = "y.y.y.y", Auth-Type :=LDAPVPN2, AUTZ-Type :=LDAPVPN2, Pool-Name :=vpnusers2 # y.y.y.y= address of VPN Server
In the ldap.attrmap... checkItem vpnusers1 attribute checkItem vpnusers2 attribute
Please, help me with this config.
Thank's you...
Osvaldo H. Campos Molina Administrador de Red STI - Univ. de Chile
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Add Pool-Name as check item with operator := to ldap.attrmap. Map it to something like radiusPool. Add radiusPool to user profile in ldap. Add value pool1 for radiusPool to those with attribute = 1 ... Ivan Kalik Kalik Informatika ISP Dana 9/9/2008, "Osvaldo Campos M. - Administrador Red STI" <ocampos@sti.uchile.cl> piše:
Thanks for your answer, but I can't use LDAP groups in this case because I haven'ts groups defined in LDAP according to LDAP "attribute". For example, I haven't a group "Sales" in LDAP with only users with the value "attribute=1".
And I need to assign addresses according to the value "attribute" .
Other ideas for this, please??
Thanks...
Osvaldo H. Campos Molina Administrador de Red STI - Univ. de Chile
Parham Beheshti escribió:
this is how we do it: radius.conf: get user's group from ldap
users file: if user is member of groupA assign ip pool1
if user is member of groupB assign ip pool2
here is users file(This is not using ip pools, just limits connection duration and when they can login): DEFAULT LDAP-Group == "VPN12", Max-Daily-Session :=43200 Fall-Through = Yes
DEFAULT LDAP-GROUP == "VPNSALES", Max-Daily-Session :=7200, Login-Time:="Any0730-0830,Any1630-1730" Fall-Through = Yes
-----Original Message----- From: freeradius-users-bounces+p_beheshti=rasana.net@lists.freeradius.org on behalf of Osvaldo Campos M. - Administrador Red STI Sent: Tue 9/9/2008 2:36 AM To: FreeRadius users mailing list Subject: Cisco VPN Server 3000 + Radius + LDAP = heeelp!!
Hi people:
First of all, sorry but my english is not good.
I'm newie in FreeRadius and I am in a hurry with Cisco VPN Server 3000, FreeRadius and LDAP, to permit vpn user's access.
When vpn users connect (with "Cisco VPN Client"), Radius consult to LDAP if user exist. If exist, then user can connect to vpn. If not, can't connect. This works well.
Now, also I should assign IP addresses according to an LDAP attribute. For example, if attribute==1 assign 10.0.0.10/24, if attribute==2 assign 10.0.0.20/24.
I try to assign IP addresses with "ippool module" and filters in the "ldap module" in FreeRadius, but it doesn't work.
How can I work with many ippool's according to a value of LDAP attribute? Where should I ask for the attribute value in order to assign the corresponding ippool?. Please, help me with that.
My config is something like that:
In the radius.conf file... ldap vpnldap1 { server = "x.x.x.x" identity = "cn=Directory Manager" password = ********** basedn = "ou=People, dc:blah, dc=cl" filter = "(&(uid=%u)(attribute=1))" authtype = ldap set_asuth_type = yes } ldap vpnldap2 { server = "x.x.x.x" identity = "cn=Directory Manager" password = ********** basedn = "ou=People, dc:blah, dc=cl" filter = "(&(uid=%u)(attribute=2))" authtype = ldap set_asuth_type = yes } .... authorize { files Autz-Type LDAPVPN1 { vpnldap1 } Autz-Type LDAPVPN2 { vpnldap2 } } .... authentication { Auth-Type LDAPVPN1 { vpnldap1 } Auth-Type LDAPVPN2 { vpnldap2 } } .... ippool vpnusers1 { range-start = 10.0.0.10 range-stop = 10.0.0.19 netmask = 255.255.255.0 cache-size = 10 session-db = ${raddbdir}/db.vpnusers1-session ip-index = ${raddbdir}/db.vpnusers1-index override = yes } .... ippool vpnusers2 { range-start = 10.0.0.20 range-stop = 10.0.0.29 netmask = 255.255.255.0 cache-size = 10 session-db = ${raddbdir}/db.vpnusers2-session ip-index = ${raddbdir}/db.vpnusers2-index override = yes } .... In the user file... (i don`t know how to configure this file to several "Ippool".... I think that here's the problem)
DEFAULT NAS-IP-Address = "y.y.y.y", Auth-Type :=LDAPVPN1, AUTZ-Type :=LDAPVPN1, Pool-Name :=vpnusers1 DEFAULT NAS-IP-Address = "y.y.y.y", Auth-Type :=LDAPVPN2, AUTZ-Type :=LDAPVPN2, Pool-Name :=vpnusers2 # y.y.y.y= address of VPN Server
In the ldap.attrmap... checkItem vpnusers1 attribute checkItem vpnusers2 attribute
Please, help me with this config.
Thank's you...
Osvaldo H. Campos Molina Administrador de Red STI - Univ. de Chile
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Sorry, but I don't understand very well. For that you understand our "scenario", we have an LDAP server with users that are all in oneself branch. All these users have the attribute "PostOfficeBox". We will use this attribute as the group attribute(i.e., to makes the difference between user's types). For example, if PostOfficeBox=00000001 then the user belongs to Sales, if PostOfficeBox=00000002 then the user belongs to Marketing. So, what we need is assign addresses to vpn users according to PostOfficeBox value. My config in the ldap.attrmap is something like that... (This is what you said??? Is correct???) checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem checkItem vpnusers1 PostOfficeBox #vpnusers1 and vpnusers2 are the ippools checkItem vpnusers2 PostOfficeBox #PostOfficeBox is the LDAP attribute In the user file... DEFAULT NAS-IP-Address = "y.y.y.y", Auth-Type :=LDAPVPN1, AUTZ-Type :=LDAPVPN1, Pool- Name :=vpnusers1 DEFAULT NAS-IP-Address = "y.y.y.y", Auth-Type :=LDAPVPN2, AUTZ-Type :=LDAPVPN2, Pool-Name :=vpnusers2 # y.y.y.y= address of VPN Server In the radius.conf ldap vpnldap1 { server = "x.x.x.x" identity = "cn=Directory Manager" password = ********** basedn = "ou=People, dc:blah, dc=cl" filter = "(&(uid=%u)(PostOfficeBox=00000001))" authtype = ldap set_asuth_type = yes } ldap vpnldap2 { server = "x.x.x.x" identity = "cn=Directory Manager" password = ********** basedn = "ou=People, dc:blah, dc=cl" filter = "(&(uid=%u)(PostOfficeBox=00000002))" authtype = ldap set_asuth_type = yes } .... authorize { files Autz-Type LDAPVPN1 { vpnldap1 } Autz-Type LDAPVPN2 { vpnldap2 } } .... authentication { Auth-Type LDAPVPN1 { vpnldap1 } Auth-Type LDAPVPN2 { vpnldap2 } } .... ippool vpnusers1 { range-start = 10.0.0.10 range-stop = 10.0.0.19 netmask = 255.255.255.0 cache-size = 10 session-db = ${raddbdir}/db.vpnusers1-session ip-index = ${raddbdir}/db.vpnusers1-index override = yes } .... ippool vpnusers2 { range-start = 10.0.0.20 range-stop = 10.0.0.29 netmask = 255.255.255.0 cache-size = 10 session-db = ${raddbdir}/db.vpnusers2-session ip-index = ${raddbdir}/db.vpnusers2-index override = yes } Please help me with that, because I don't know what's wrong in my config. Thanks so much. Osvaldo H. Campos Molina Administrador de Red STI - Univ. de Chile tnt@kalik.net escribió:
Add Pool-Name as check item with operator := to ldap.attrmap. Map it to something like radiusPool. Add radiusPool to user profile in ldap. Add value pool1 for radiusPool to those with attribute = 1 ...
Ivan Kalik Kalik Informatika ISP
If I understood what you need ... Using Cisco VPN Client, you can define "Groups" in the Cisco Concentrator ... Configuration -> User Management -> Groups ... and assign an "Address Pool" to each group. According the Group used in the Cisco VPN Client, the user will receive an IP addresses from a different Address Pool. Create the Group and upon that create the Address Pool Configuration -> User Management -> Groups -> Address Pools Best Regards, Leonardo Osvaldo Campos M. - Administrador Red STI wrote:
Hi people: First of all, sorry but my english is not good.
I'm newie in FreeRadius and I am in a hurry with Cisco VPN Server 3000, FreeRadius and LDAP, to permit vpn user's access. When vpn users connect (with "Cisco VPN Client"), Radius consult to LDAP if user exist. If exist, then user can connect to vpn. If not, can't connect. This works well. Now, also I should assign IP addresses according to an LDAP attribute. For example, if attribute==1 assign 10.0.0.10/24, if attribute==2 assign 10.0.0.20/24. I try to assign IP addresses with "ippool module" and filters in the "ldap module" in FreeRadius, but it doesn't work. How can I work with many ippool's according to a value of LDAP attribute? Where should I ask for the attribute value in order to assign the corresponding ippool?. Please, help me with that.
My config is something like that: In the radius.conf file... ldap vpnldap1 { server = "x.x.x.x" identity = "cn=Directory Manager" password = ********** basedn = "ou=People, dc:blah, dc=cl" filter = "(&(uid=%u)(attribute=1))" authtype = ldap set_asuth_type = yes } ldap vpnldap2 { server = "x.x.x.x" identity = "cn=Directory Manager" password = ********** basedn = "ou=People, dc:blah, dc=cl" filter = "(&(uid=%u)(attribute=2))" authtype = ldap set_asuth_type = yes } .... authorize { files Autz-Type LDAPVPN1 { vpnldap1 } Autz-Type LDAPVPN2 { vpnldap2 } } .... authentication { Auth-Type LDAPVPN1 { vpnldap1 } Auth-Type LDAPVPN2 { vpnldap2 } } .... ippool vpnusers1 { range-start = 10.0.0.10 range-stop = 10.0.0.19 netmask = 255.255.255.0 cache-size = 10 session-db = ${raddbdir}/db.vpnusers1-session ip-index = ${raddbdir}/db.vpnusers1-index override = yes } .... ippool vpnusers2 { range-start = 10.0.0.20 range-stop = 10.0.0.29 netmask = 255.255.255.0 cache-size = 10 session-db = ${raddbdir}/db.vpnusers2-session ip-index = ${raddbdir}/db.vpnusers2-index override = yes } .... In the user file... (i don`t know how to configure this file to several "Ippool".... I think that here's the problem)
DEFAULT NAS-IP-Address = "y.y.y.y", Auth-Type :=LDAPVPN1, AUTZ-Type :=LDAPVPN1, Pool-Name :=vpnusers1 DEFAULT NAS-IP-Address = "y.y.y.y", Auth-Type :=LDAPVPN2, AUTZ-Type :=LDAPVPN2, Pool-Name :=vpnusers2 # y.y.y.y= address of VPN Server
In the ldap.attrmap... checkItem vpnusers1 attribute checkItem vpnusers2 attribute
Please, help me with this config.
Thank's you...
Osvaldo H. Campos Molina Administrador de Red STI - Univ. de Chile
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi... Thanks for your answer Leonardo but, if I define the groups in the Cisco VPN Server, it will be enough with knowing the password of other defined group's to obtain an address from a group to which I don't really belong. I.e., if Sale's user know password of Development group, will can receive an Development address. For this reason it is that I should assign the address according to the value of the attribute LDAP, because this value identifies user's type and, therefore, the address that should have. Other ideas for this, please?? Osvaldo H. Campos Molina Administrador de Red STI - Univ. de Chile Leonardo Reginin escribió:
If I understood what you need ...
Using Cisco VPN Client, you can define "Groups" in the Cisco Concentrator ...
Configuration -> User Management -> Groups
... and assign an "Address Pool" to each group. According the Group used in the Cisco VPN Client, the user will receive an IP addresses from a different Address Pool.
Create the Group and upon that create the Address Pool
Configuration -> User Management -> Groups -> Address Pools
Best Regards,
Leonardo
Osvaldo Campos M. - Administrador Red STI wrote:
Hi people: First of all, sorry but my english is not good.
I'm newie in FreeRadius and I am in a hurry with Cisco VPN Server 3000, FreeRadius and LDAP, to permit vpn user's access. When vpn users connect (with "Cisco VPN Client"), Radius consult to LDAP if user exist. If exist, then user can connect to vpn. If not, can't connect. This works well. Now, also I should assign IP addresses according to an LDAP attribute. For example, if attribute==1 assign 10.0.0.10/24, if attribute==2 assign 10.0.0.20/24. I try to assign IP addresses with "ippool module" and filters in the "ldap module" in FreeRadius, but it doesn't work. How can I work with many ippool's according to a value of LDAP attribute? Where should I ask for the attribute value in order to assign the corresponding ippool?. Please, help me with that.
My config is something like that: In the radius.conf file... ldap vpnldap1 { server = "x.x.x.x" identity = "cn=Directory Manager" password = ********** basedn = "ou=People, dc:blah, dc=cl" filter = "(&(uid=%u)(attribute=1))" authtype = ldap set_asuth_type = yes } ldap vpnldap2 { server = "x.x.x.x" identity = "cn=Directory Manager" password = ********** basedn = "ou=People, dc:blah, dc=cl" filter = "(&(uid=%u)(attribute=2))" authtype = ldap set_asuth_type = yes } .... authorize { files Autz-Type LDAPVPN1 { vpnldap1 } Autz-Type LDAPVPN2 { vpnldap2 } } .... authentication { Auth-Type LDAPVPN1 { vpnldap1 } Auth-Type LDAPVPN2 { vpnldap2 } } .... ippool vpnusers1 { range-start = 10.0.0.10 range-stop = 10.0.0.19 netmask = 255.255.255.0 cache-size = 10 session-db = ${raddbdir}/db.vpnusers1-session ip-index = ${raddbdir}/db.vpnusers1-index override = yes } .... ippool vpnusers2 { range-start = 10.0.0.20 range-stop = 10.0.0.29 netmask = 255.255.255.0 cache-size = 10 session-db = ${raddbdir}/db.vpnusers2-session ip-index = ${raddbdir}/db.vpnusers2-index override = yes } .... In the user file... (i don`t know how to configure this file to several "Ippool".... I think that here's the problem)
DEFAULT NAS-IP-Address = "y.y.y.y", Auth-Type :=LDAPVPN1, AUTZ-Type :=LDAPVPN1, Pool-Name :=vpnusers1 DEFAULT NAS-IP-Address = "y.y.y.y", Auth-Type :=LDAPVPN2, AUTZ-Type :=LDAPVPN2, Pool-Name :=vpnusers2 # y.y.y.y= address of VPN Server
In the ldap.attrmap... checkItem vpnusers1 attribute checkItem vpnusers2 attribute
Please, help me with this config.
Thank's you...
Osvaldo H. Campos Molina Administrador de Red STI - Univ. de Chile
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks for your answer Leonardo but, if I define the groups in the Cisco VPN Server, it will be enough with knowing the password of other defined group's to obtain an address from a group to which I don't really belong. I.e., if Sale's user know password of Development group, will can receive an Development address.
Ahem, passwords are in user profile and have nothing to do with groups. Person who is added to the Sales group can't move to Development group by changing his password. Ivan Kalik Kalik Informatika ISP
Hi Osvalo, I had the same problems like you, but I would use a MySQL Database. First: a Cisco VPN300 know 2 different ways to authenticate a user: The Usergroup-- define standard behavior for a user and the User itself wher you can change the behaviors of the group. It's not possible to create a Group outsite of the VPN-Gateway. In that case, you can only use a group for all Users. Ronald Bruska -------- Original-Nachricht --------
Datum: Tue, 09 Sep 2008 17:19:16 -0400 Von: "Osvaldo Campos M. - Administrador Red STI" <ocampos@sti.uchile.cl> An: Leonardo Reginin <leonardo@procergs.rs.gov.br> CC: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Betreff: Re: Cisco VPN Server 3000 + Radius + LDAP = heeelp!!
Hi...
Thanks for your answer Leonardo but, if I define the groups in the Cisco VPN Server, it will be enough with knowing the password of other defined group's to obtain an address from a group to which I don't really belong. I.e., if Sale's user know password of Development group, will can receive an Development address.
For this reason it is that I should assign the address according to the value of the attribute LDAP, because this value identifies user's type and, therefore, the address that should have.
Other ideas for this, please??
Osvaldo H. Campos Molina Administrador de Red STI - Univ. de Chile
Leonardo Reginin escribió:
If I understood what you need ...
Using Cisco VPN Client, you can define "Groups" in the Cisco Concentrator ...
Configuration -> User Management -> Groups
... and assign an "Address Pool" to each group. According the Group used in the Cisco VPN Client, the user will receive an IP addresses from a different Address Pool.
Create the Group and upon that create the Address Pool
Configuration -> User Management -> Groups -> Address Pools
Best Regards,
Leonardo
Osvaldo Campos M. - Administrador Red STI wrote:
Hi people: First of all, sorry but my english is not good.
I'm newie in FreeRadius and I am in a hurry with Cisco VPN Server 3000, FreeRadius and LDAP, to permit vpn user's access. When vpn users connect (with "Cisco VPN Client"), Radius consult to LDAP if user exist. If exist, then user can connect to vpn. If not, can't connect. This works well. Now, also I should assign IP addresses according to an LDAP attribute. For example, if attribute==1 assign 10.0.0.10/24, if attribute==2 assign 10.0.0.20/24. I try to assign IP addresses with "ippool module" and filters in the "ldap module" in FreeRadius, but it doesn't work. How can I work with many ippool's according to a value of LDAP attribute? Where should I ask for the attribute value in order to assign the corresponding ippool?. Please, help me with that.
My config is something like that: In the radius.conf file... ldap vpnldap1 { server = "x.x.x.x" identity = "cn=Directory Manager" password = ********** basedn = "ou=People, dc:blah, dc=cl" filter = "(&(uid=%u)(attribute=1))" authtype = ldap set_asuth_type = yes } ldap vpnldap2 { server = "x.x.x.x" identity = "cn=Directory Manager" password = ********** basedn = "ou=People, dc:blah, dc=cl" filter = "(&(uid=%u)(attribute=2))" authtype = ldap set_asuth_type = yes } .... authorize { files Autz-Type LDAPVPN1 { vpnldap1 } Autz-Type LDAPVPN2 { vpnldap2 } } .... authentication { Auth-Type LDAPVPN1 { vpnldap1 } Auth-Type LDAPVPN2 { vpnldap2 } } .... ippool vpnusers1 { range-start = 10.0.0.10 range-stop = 10.0.0.19 netmask = 255.255.255.0 cache-size = 10 session-db = ${raddbdir}/db.vpnusers1-session ip-index = ${raddbdir}/db.vpnusers1-index override = yes } .... ippool vpnusers2 { range-start = 10.0.0.20 range-stop = 10.0.0.29 netmask = 255.255.255.0 cache-size = 10 session-db = ${raddbdir}/db.vpnusers2-session ip-index = ${raddbdir}/db.vpnusers2-index override = yes } .... In the user file... (i don`t know how to configure this file to several "Ippool".... I think that here's the problem)
DEFAULT NAS-IP-Address = "y.y.y.y", Auth-Type :=LDAPVPN1, AUTZ-Type :=LDAPVPN1, Pool-Name :=vpnusers1 DEFAULT NAS-IP-Address = "y.y.y.y", Auth-Type :=LDAPVPN2, AUTZ-Type :=LDAPVPN2, Pool-Name :=vpnusers2 # y.y.y.y= address of VPN Server
In the ldap.attrmap... checkItem vpnusers1 attribute checkItem vpnusers2 attribute
Please, help me with this config.
Thank's you...
Osvaldo H. Campos Molina Administrador de Red STI - Univ. de Chile
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (7)
-
Alan DeKok -
flusione＠gmx.de -
Leonardo Reginin -
orion -
Osvaldo Campos M. - Administrador Red STI -
Parham Beheshti -
tnt＠kalik.net