Andres Gomez Ruiz wrote:
> I'm using Freeradius since 6 months ago, and It works great. I'm Using
> freeradus + MySQL to store my users data in a database and authenticate
> it with an user and a password.
>
> Now I Have to attach to each user, 3 MAC-Address, so I'm editting my
> database (radcheck table)
>
> id username attribute op value
> 1 user1 User-Password := password1
Use Cleartext-Password. Not User-Password. This has been the
recommended configuration for 6 years.
> 2 user1 Calling-Station-Id =
> 00:11:22:33:44:55
And see the rlm_sql documentation. The "=" operator is probably not
what you want.
> It works great. Only user1 with password1 can access from the device
> with MAC-Addr 00:11:22:33:44:55, but I need to attach 3 MAC to each
> user, so I edit my databe:
>
>
> id username attribute op value
> 1 user1 User-Password := password1
> 2 user1 Calling-Station-Id =
> 00:11:22:33:44:55
> 3 user1 Calling-Station-Id =
> 33:44:55:66:77:88
>
>
> And, in that moment user1 can't logging never. The user1 can't logging
> from a device with MAC-Addr 00:11:22:33:44:55 or MAC-Addr
> 33:44:55:66:77:88, or anyone.
Read the rlm_sql documentation. All of the check conditions are
logically ANDed together. The above configuration says
Calling-Station-Id X AND Y. Which is never true, so it always fails.
If you want to allow multiple values of an attribute, you're better of
putting them into a different SQL table. i.e. create a table of just
username && calling-station-Id value. Then, do something like:
if ("%{sql: SELECT from... username %{Calling-Station-ID}}" == "")
reject
}
i.e. search the table for User-Name AND Calling-Station-Id value. If
an entry isn't found, then reject the user.
Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
