То, что я пытаюсь выполнить с помощью Freeradius, - это определить различные группы поиска, указать группу поиска для каждого пользователя и разрешить им проходить аутентификацию только в том случае, если они приходят из Wi-Fi в правильной группе поиска.Сейчас я хочу использовать конфигурационные файлы, никаких sql.
. У меня есть настроенная и запущенная установка, без проверки группы поиска я могу войти в систему независимо от того, к какому NAS подключен.Когда я пытаюсь ограничить пользователя определенной Huntgroup, вход в систему не удается.До сих пор в файлах конфигурации было следующее:
#################################
clients.conf:
client test-radio-1 {
ipaddr = 10.2.3.4/32
secret = verysecret
}
client live-radio-1 {
ipaddr = 10.3.4.5/32
secret = verysecret
}
#################################
huntgroups:
testgroup NAS-IP-Address == 10.2.3.4
livegroup NAS-IP-Address == 10.3.4.5
#################################
users:
wifitest Cleartext-Password := "wifitest", Huntgroup-Name == testgroup
DEFAULT Auth-Type := Reject
#################################
Debug:
(0) Received Access-Request Id 165 from 10.2.3.4:18016 to 10.42.23.1:1812 length 138
(0) User-Name = "wifitest"
(0) NAS-IP-Address = 192.168.1.254
(0) NAS-Identifier = "RalinkAP0"
(0) NAS-Port = 0
(0) Called-Station-Id = "60-03-47-34-D2-EE"
(0) Calling-Station-Id = "08-E6-89-F2-CD-0A"
(0) Framed-MTU = 1400
(0) NAS-Port-Type = Wireless-802.11
(0) EAP-Message = 0x0201000d017769666974657374
(0) Message-Authenticator = 0x0ff102e0915ae64fe86b1252d8d9f041
(0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
(0) authorize {
(0) policy filter_username {
(0) if (&User-Name) {
(0) if (&User-Name) -> TRUE
(0) if (&User-Name) {
(0) if (&User-Name =~ / /) {
(0) if (&User-Name =~ / /) -> FALSE
(0) if (&User-Name =~ /@[^@]*@/ ) {
(0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(0) if (&User-Name =~ /\.\./ ) {
(0) if (&User-Name =~ /\.\./ ) -> FALSE
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE
(0) if (&User-Name =~ /\.$/) {
(0) if (&User-Name =~ /\.$/) -> FALSE
(0) if (&User-Name =~ /@\./) {
(0) if (&User-Name =~ /@\./) -> FALSE
(0) } # if (&User-Name) = notfound
(0) } # policy filter_username = notfound
(0) [preprocess] = ok
(0) [chap] = noop
(0) [mschap] = noop
(0) [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "wifitest", looking up realm NULL
(0) suffix: No such realm "NULL"
(0) [suffix] = noop
(0) eap: Peer sent EAP Response (code 2) ID 1 length 13
(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize
(0) [eap] = ok
(0) } # authorize = ok
(0) Found Auth-Type = eap
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0) authenticate {
(0) eap: Peer sent packet with method EAP Identity (1)
(0) eap: Calling submodule eap_md5 to process data
(0) eap_md5: Issuing MD5 Challenge
(0) eap: Sending EAP Request (code 1) ID 2 length 22
(0) eap: EAP session adding &reply:State = 0xc974984ec9769cfb
(0) [eap] = handled
(0) } # authenticate = handled
(0) Using Post-Auth-Type Challenge
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0) Challenge { ... } # empty sub-section is ignored
(0) Sent Access-Challenge Id 165 from 10.42.23.1:1812 to 10.2.3.4:18016 length 0
(0) EAP-Message = 0x0102001604108d1219306e42fcae1eba62d78a829492
(0) Message-Authenticator = 0x00000000000000000000000000000000
(0) State = 0xc974984ec9769cfb6b161f0fbcf28b50
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Access-Request Id 166 from 10.2.3.4:18016 to 10.42.23.1:1812 length 151
(1) User-Name = "wifitest"
(1) NAS-IP-Address = 192.168.1.254
(1) NAS-Identifier = "RalinkAP0"
(1) NAS-Port = 0
(1) Called-Station-Id = "60-03-47-34-D2-EE"
(1) Calling-Station-Id = "08-E6-89-F2-CD-0A"
(1) Framed-MTU = 1400
(1) NAS-Port-Type = Wireless-802.11
(1) EAP-Message = 0x020200080319152b
(1) State = 0xc974984ec9769cfb6b161f0fbcf28b50
(1) Message-Authenticator = 0xabfba419fe980dea00738a3108d91fe9
(1) session-state: No cached attributes
(1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
(1) authorize {
(1) policy filter_username {
(1) if (&User-Name) {
(1) if (&User-Name) -> TRUE
(1) if (&User-Name) {
(1) if (&User-Name =~ / /) {
(1) if (&User-Name =~ / /) -> FALSE
(1) if (&User-Name =~ /@[^@]*@/ ) {
(1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(1) if (&User-Name =~ /\.\./ ) {
(1) if (&User-Name =~ /\.\./ ) -> FALSE
(1) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(1) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE
(1) if (&User-Name =~ /\.$/) {
(1) if (&User-Name =~ /\.$/) -> FALSE
(1) if (&User-Name =~ /@\./) {
(1) if (&User-Name =~ /@\./) -> FALSE
(1) } # if (&User-Name) = notfound
(1) } # policy filter_username = notfound
(1) [preprocess] = ok
(1) [chap] = noop
(1) [mschap] = noop
(1) [digest] = noop
(1) suffix: Checking for suffix after "@"
(1) suffix: No '@' in User-Name = "wifitest", looking up realm NULL
(1) suffix: No such realm "NULL"
(1) [suffix] = noop
(1) eap: Peer sent EAP Response (code 2) ID 2 length 8
(1) eap: No EAP Start, assuming it's an on-going EAP conversation
(1) [eap] = updated
(1) files: users: Matched entry DEFAULT at line 223
(1) [files] = ok
(1) [expiration] = noop
(1) [logintime] = noop
(1) pap: WARNING: Auth-Type already set. Not setting to PAP
(1) [pap] = noop
(1) } # authorize = updated
(1) Found Auth-Type = Reject
(1) Auth-Type = Reject, rejecting user
(1) Failed to authenticate the user
(1) Using Post-Auth-Type Reject
(1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(1) Post-Auth-Type REJECT {
(1) attr_filter.access_reject: EXPAND %{User-Name}
(1) attr_filter.access_reject: --> wifitest
(1) attr_filter.access_reject: Matched entry DEFAULT at line 11
(1) [attr_filter.access_reject] = updated
(1) eap: Expiring EAP session with state 0xc974984ec9769cfb
(1) eap: Finished EAP session with state 0xc974984ec9769cfb
(1) eap: Previous EAP request found for state 0xc974984ec9769cfb, released from the list
(1) eap: Request was previously rejected, inserting EAP-Failure
(1) eap: Sending EAP Failure (code 4) ID 2 length 4
(1) [eap] = updated
(1) policy remove_reply_message_if_eap {
(1) if (&reply:EAP-Message && &reply:Reply-Message) {
(1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(1) else {
(1) [noop] = noop
(1) } # else = noop
(1) } # policy remove_reply_message_if_eap = noop
(1) } # Post-Auth-Type REJECT = updated
(1) Login incorrect: [wifitest] (from client test-radios port 0 cli 08-E6-89-F2-CD-0A)
То, что я ожидаю, это возможность аутентификации.Однако я не могу.Я думаю, что у меня есть проблема с синтаксисом в файле пользователей, но я не могу понять, как это сделать хорошо.