huntgroup issue, multiple huntgroups per device

[Charles Tompkins]

So sorry!
[root at server ~]# radiusd -v
radiusd: FreeRADIUS Version 2.0.0-pre0, for host i686-pc-linux-gnu, built on
Apr 29 2006 at 19:51:21
Copyright (C) 2000-2003 The FreeRADIUS server project.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License.
For more information about these matters, see the file named COPYRIGHT.

------------
Master timed out!  Holding election...
I am declaring myself the master! 

-----Original Message-----
From: freeradius-users-bounces+crt=thig.com at lists.freeradius.org
[mailto:freeradius-users-bounces+crt=thig.com at lists.freeradius.org] On
Behalf Of Charles Tompkins
Sent: Tuesday, November 14, 2006 2:36 PM
To: 'FreeRadius users mailing list'
Subject: huntgroup issue, multiple huntgroups per device

Is it possible to have multiple huntgroups for the same NAS-IP-ADDRESS?

I am running into this issue trying to configure a vpn appliance that uses
the same freeRADIUS server to authenticate its users as well as its admins.

The huntgroups file gets checked from top to bottom, so depending which
specified group comes first, the other gets denied access.

i.e.
"../raddb/huntgroups"

vpn        NAS-IP-Address == 10.20.30.1
                Group = VPNUSERS

vpn-admin  NAS-IP-Address == 10.20.30.1
                User-Name = admin1,
                User-Name = admin2

This config keeps the admins out of the vty but lets the users vpn in.

Debug reveals:
No huntgroup access: [admin1] (from client vpn.foo.com port 6256 cli
10.10.10.10)
  modcall[authorize]: module "preprocess" returns reject for request 1
modcall: leaving group authorize (returns reject) for request 1

FYI, my users file checks for admins first then falls through to framed
users...

I would like to avoid adding another ip address to the vpn appliance if at
all possible.

Regards from sunny Florida,
-Charles Tompkins
               

------------
Master timed out!  Holding election...
I am declaring myself the master! 





CONFIDENTIAL NOTICE: This email including any attachments, contains 
confidential information belonging to the sender. It may also be 
privileged or otherwise protected by work product immunity or other 
legal rules. This information is intended only for the use of the 
individual or entity named above.  If you are not the intended 
recipient, you are hereby notified that any disclosure, copying, 
distribution or the taking of any action in reliance on the contents 
of this emailed information is strictly prohibited.  If you have 
received this email in error, please immediately notify us by 
reply email of the error and then delete this email immediately.
- 
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html




CONFIDENTIAL NOTICE: This email including any attachments, contains 
confidential information belonging to the sender. It may also be 
privileged or otherwise protected by work product immunity or other 
legal rules. This information is intended only for the use of the 
individual or entity named above.  If you are not the intended 
recipient, you are hereby notified that any disclosure, copying, 
distribution or the taking of any action in reliance on the contents 
of this emailed information is strictly prohibited.  If you have 
received this email in error, please immediately notify us by 
reply email of the error and then delete this email immediately.