Using multiple auth methods, ports

[Geoff Silver]

Phil Mayers wrote:
> Geoff Silver wrote:
>> a Packet-Src-Port attribute in the freeradius.internal dictionary, but I 
>
> I assume you mean Packet-Dst-Port, but yes that would be the way to do 
> it.
Yeah.
>
> Looking at it, it appears this is in CVS head but not in my tarball of 
> 1.1.0. doc/variables.txt in a CVS checkout lists Packet-Dst-Port as 
> supported and it's in the xlat_packet function.
Okay, I'll take a look at my 1.1.0 and check out the CVS tree as well 
when I get back into the office and see.  The only place I noticed it in 
1.1.0 was in the dictionary.

> What I can't figure out is how you might do this:
>
> DEFAULT %{request:Packet-Dst-Port}==1234, Autz-Type := "cert"
>
> ...i.e. have an expansion on the left hand side. I'm not sure you can, 
> but the code is quite big and I've only scanned it.
>
> What you can do (in CVS head) is use the following in the hints file 
> (which is actually quite appropriate):
Cool.  I'll give that a shot.

> DEFAULT User-Name =~ "^(.*)$"
>         Hint = "%{request:Packet-Dst-Port}"
>
> ...the have the "users" file read:
>
> DEFAULT Hint=="THEDESTPORT", Auth-Type := Accept
>
>
> ...and of course, add a 2nd listen section to the "radiusd.conf":
>
> listen {
>   ipaddr = *
>   port = THEDESTPORT
>   type = auth
> }

Does that work?  I *thought* I tried that and found that it only 
listened on the first port (but I may be entirely mistaken).  Again, 
I'll try when I get back in the office on Tuesday, if I don't have an 
opportunity to hop on our vpn and try it earlier.  I'll let you know how 
it goes.
> You can get more complex if you need to using Autz-Type based on the 
> hint, or whatever.
>
> Hope that helps.
> - List info/subscribe/unsubscribe? See 
> http://www.freeradius.org/list/users.html
Thanks!