Hi,
I am using FreeRadius v2.2.0 on CentOS 6.4 x86_64.
I am trying to adapt Plain Mac-Auth as described at:
http://wiki.freeradius.org/guide/Mac-Auth to work work from LDAP.
(Note: The server is also used for eduroam and is going to be used for
802.1x too.)
My setup follows below.
The questions:
--------------
1. Should I also define the value:
# access_attr
...for correct results?
2. Can I test this using radtest (since I am not using user/password for
this query)?
3. Any other suggestions?
--------------
The setup:
ldap ldap_macauth {
server = "localhost"
identity = "uid=binduser,ou=System,dc=example,dc=com"
password = "bindpasswd"
basedn = "ou=Nodes,dc=example,dc=com"
filter = "(macAddress=%{Calling-Station-Id})"
start_tls = no
dictionary_mapping = ${raddbdir}/ldap.attrmap
ldap_connections_number = 2
timeout = 4
timelimit = 3
net_timeout = 1
}
and I have a test entry:
dn: cn=hostABC,ou=Nodes,dc=example,dc=com
cn: hostABC
macAddress: 00:24:8b:3c:d1:db
objectClass: device
objectClass: ieee802Device
objectClass: top
ou: tech
owner: uid=johndoe,ou=people,dc=example,dc=com
l: Main Site
I have preferred to set:
rewrite_calling_station_id {
if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i){
update request {
Calling-Station-Id :=
"%{tolower:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}}"
}
}
else {
noop
}
}
and in sites-enabled/default:
authorize {
preprocess
chap
mschap
digest
suffix
eap {
ok = return
}
files
ldap_macauth
if (!ok) {
reject
}
else {
# accept
update control {
Auth-Type := Accept
}
}
expiration
logintime
pap
}
Thanks and regards,
Nick
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
