1

I'm new to RADIUS and I have just set up a very basic FreeRADIUS server for 802.1x (WPA). I use EAP, MySQL as backend with daloRADIUS as webGUI (for user management, mainly).

I got two WiFi networks, one private network and a guest network. Now I want to specify users per NAS. So there are certain users that are only allowed to use the guest network and not the private network.

How do I do that? Is that even possible with FreeRADIUS? Because I can't seem to find any information about it. Is it maybe something weird, am I using RADIUS in a wrong manner?

Improve this question
2

3 Answers 3

Reset to default
1

Got it! The problem was that the NAS-Identifier attribute didn't get copied to the tunneled request by EAP. Setting "copy_request_to_tunnel" to "yes" fixed it :)

Now I can use the NAS-Identifier attribute as a check in the radcheck table.

Improve this answer
0

On way is to setup different virutal servers and point each NAS to a different server. You can setup the users and then assign the users to different virtual servers. Actually you should assign them to different groups and then assign each group to different virtual servers. See documenation for virtual servers

You could also use hunt groups. Here you have one server but assign each NAS to a different hunt group. Then you assign users/user groups to each hunt group.

If you don't want to do this yourself, there are some some radius as a service companies you might consider. Cloudessa uses FreeRadius on the backend and supports two factor authenication using Google Autenicator. No Wires Security is another company that does radius as a service.

Improve this answer
6
  • Virtual servers is a way, but doubt if it's the right way. It seems unnatural for me to need two separate servers for such a simple goal. (Or am I wrong?) I don't really understand hunt groups. How do I assign users to a hunt group, for example?
    – Compizfox
    Jul 30, 2013 at 18:12
  • Note that virutal servers are different listeners listening on different IP addresses or ports on the same machine. The concept is different from seperate virtual machines using VMWare or Hyper-V. For hunt groups you look in the radgroupcheck table. See example in link under heading "Combining with SQL authorisation"
    – kheld
    Jul 30, 2013 at 18:22
  • Nevermind, I think I already understand. Users are grouped in usergroups (table radusergroup), NASes are grouped in huntgroups (table radhuntgroup). The table radgroupcheck checks whether the users' usergroup is allowed to use a huntgroup. Right?
    – Compizfox
    Jul 30, 2013 at 18:26
  • I still can't get it to work. The issue is kinda the same as in this thread: freeradius.1045715.n5.nabble.com/…
    – Compizfox
    Jul 30, 2013 at 20:10
  • So I tried another suggestion in that thread, to just add a NAS-Identifier check in radchecks. I don't know if I did something wrong, but I can't authenticate at all now. pastebin.com/MBFinPrY
    – Compizfox
    Jul 30, 2013 at 20:14
-1

he echo un pequeno tuto

https://github.com/abdiasriver/notas-wisp/blob/main/Limitar-usuario-a-un-NAS-freeradius.md

Lo he creado en github, pero lo reposteo aqui abajo por si es borrado

Limitar usuario a un solo NAS o mikrotik

  • Busca en tu servidor el archivo que contenga copy_request_to_tunnel
grep -rl "copy_request_to_tunnel" /etc

por ejemplo eso se encuentra en :

nano /etc/freeradius/3.0/mods-available/eap
  • Edita el archivo y donde encuentres:
copy_request_to_tunnel = no

Cambialo a yes.

copy_request_to_tunnel = yes

Tambien cambia lo que diga

use_tunneled_reply = no

igualmente a yes

use_tunneled_reply = yes
  • Ahora ve a tu daloradius IP/daloradius y agrega a tu usuario este atributo.

Suponiendo que tu mikrotik tiene el identity Rb01 en /system identity print entonces tu NAS-identifier sera Rb01 Agrega el atributo NAS-Identifier al daloradius:

Atribbute: NAS-Identifier Value: Rb01 Op: == Target: Check

  • Ahora reinicia el servidor freeradius y testea tu usuario en varios NAS ,observaras que solamente te deja conectarte al especificado.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .