1

I want to configure a freeradius server in the way that an authentication is successful only if NAS-IP-Address attribute is not empty and equals to some specific IP (of course a user name and a password match).

How should I do it? I have tried to read the documentation without success: http://freeradius.org/rfc/attributes.html http://freeradius.org/rfc/rfc2865.html#NAS-IP-Address

Michael
  • 10,063
  • 18
  • 65
  • 104

1 Answers1

6

Sure, there are many ways of doing this.

authorize {
   if (!NAS-IP-Address) {
       reject
   }

   if (NAS-IP-Address != 192.168.0.2) {
      reject
   }

   if ("%{sql:SELECT count(*) FROM table WHERE User-Name = '%{User-Name}' AND IP-Address = '%{NAS-IP-Address}'" == 0) {
      reject
   }
}

In v3.0.x subnet matching is also supported, where < > are reassigned to mean the set operators (< subset of) (> superset of).

if (!(<ipv4prefix>NAS-IP-Address < 192.168.0.0/16)) {
    reject
}

NAS-IP-Address = 192.168.0.2

(0)   ? if (<ipv4prefix>NAS-IP-Address < 192.168.0.0/16) 
(0)   ? if (<ipv4prefix>NAS-IP-Address < 192.168.0.0/16)  -> TRUE

NAS-IP-Address = 192.169.0.2

(0)   ? if (<ipv4prefix>NAS-IP-Address < 192.168.0.0/16) 
(0)   ? if (<ipv4prefix>NAS-IP-Address < 192.168.0.0/16)  -> FALSE
Arran Cudbard-Bell
  • 5,912
  • 2
  • 26
  • 48
  • Thank you for the fast answer! – Michael Feb 23 '14 at 09:43
  • No problem :) Most modules have an xlat method which allow arbitrary queries. The ``%{sql:}`` example above can be extended to ``%{ldap:}`` and ``%{redis:}`` without too much issue, check for zero length '' string instead. – Arran Cudbard-Bell Feb 23 '14 at 10:19