freeradius（MySQL config）將自定義屬性添加到回覆項目

Question

我嘗試將自定義屬性設置爲回覆項目（我想將自定義信息添加到「訪問接受」數據包）時遇到了死衚衕。 在試圖做到這一點，我碰到這個條目：

# If you want to add entries to the dictionary file, 
# which are NOT going to be placed in a RADIUS packet, 
# add them to the 'dictionary.local' file. 
# 
# The numbers you pick should be between 3000 and 4000. 
# These attributes will NOT go into a RADIUS packet. 
# 
# If you want that, you will need to use VSAs. This means 
# requesting allocation of a Private Enterprise Code from 
# http://iana.org. We STRONGLY suggest doing that only if 
# you are a vendor of RADIUS equipment. 
# 
# See RFC 6158 for more details. 
# http://ietf.org/rfc/rfc6158.txt 

所以我理解的通常的做法應該如何。

但是我的基礎架構是分階段設置的，而且問題中的radius服務器已經放置在「裏面」了，所以我不明白爲什麼我不能在兩端設置或覆蓋未使用的屬性這是第二次內部認證步驟。

谷歌周圍我發現了幾個關於如何設置這種類型的東西與1.x版本Freeradius基於用戶文件的方法，而不是任何新版本的線程。

我建議仍然可以使用freeradius-server-3.0.10嗎？ 如果是這樣，我該如何去實施這個？

當前狀態： 我已經添加了我的屬性「教員」的字典和相應的DB，導致RADIUS服務器（映射從數據庫到目錄中，即設置一個字符串設定整數榮& MECH）。查找並評估在「radreply」（這裏：：= MECH）和「radgroupreply」（這裏+ = EI）中設置的屬性。

... 
rlm_sql (sql1): Reserved connection (5) 
(1) sql1: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' AND active > '0' AND active < '3' ORDER BY id(1) sql1: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '*username*' AND active > '0' AND active < '3' ORDER BY id 
(1) sql1: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '*username*' AND active > '0' AND active < '3'ORDER BY id 
(1) sql1: User found in radcheck table 
(1) sql1: Conditional check items matched, merging assignment check items 
(1) sql1: Cleartext-Password := "*password*" 
(1) sql1: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id 
(1) sql1: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = '*username*' ORDER BY id 
(1) sql1: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '*username*' ORDER BY id 
(1) sql1: User found in radreply table, merging reply items 
(1) sql1: faculty := MECH 
(1) sql1: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority 
(1) sql1: --> SELECT groupname FROM radusergroup WHERE username = '*username*' ORDER BY priority 
(1) sql1: Executing select query: SELECT groupname FROM radusergroup WHERE username = '*username*' ORDER BY priority 
(1) sql1: User found in the group table 
(1) sql1: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{sql1-SQL-Group}' ORDER BY id 
(1) sql1: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'vid100' ORDER BY id 
(1) sql1: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'vid100' ORDER BY id 
(1) sql1: Group "vid100": Conditional check items matched 
(1) sql1: Group "vid100": Merging assignment check items 
(1) sql1: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{sql1-SQL-Group}' ORDER BY id 
(1) sql1: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'vid100' ORDER BY id 
(1) sql1: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'vid100' ORDER BY id 
(1) sql1: Group "vid100": Merging reply items 
(1) sql1: Tunnel-Type = VLAN 
(1) sql1: Tunnel-Medium-Type = IEEE-802 
(1) sql1: Tunnel-Private-Group-Id = "100" 
(1) sql1: faculty += EI 
rlm_sql (sql1): Released connection (5) 
... 

的敏銳的觀察者也會注意到一些變化「radcheck」查詢，但這種變化是不相關的手頭的話題。 因此，服務器獲取信息，但我還沒有找到一種方法將其包括到答覆呢。

(1) Sent Access-Accept Id 81 from **IP-Radius-server**:*port* to **IP-supplicant**:*port* length 0 
(1) Tunnel-Type = VLAN 
(1) Tunnel-Medium-Type = IEEE-802 
(1) Tunnel-Private-Group-Id = "100" 
(1) Finished request 

任何幫助或指針將不勝感激:) 菲利克斯

Answer 1

您需要定義您的自定義屬性作爲VSA（供應商特定的屬性）。標準RADIUS字典中255以上的屬性不會在代理請求或回覆中編碼，這是因爲屬性字段只有1個字節寬。

如果你想正確地做到這一點，你需要爲你的組織申請一個IANA PEN（私人企業編號）http://pen.iana.org/pen/PenApplication.page（在檢查還沒有一個被分配http://www.iana.org/assignments/enterprise-numbers/enterprise-numbers後）。

然後，您可以定義自己的供應商字典，並添加自己的屬性，數字在1-255之間。

這裏是一個不錯的短單，你可以作爲一個例子使用：https://github.com/FreeRADIUS/freeradius-server/blob/v3.1.x/share/dictionary.bt

你並不需要爲您的供應商字典一個單獨的文件，你只需要到相關的行復制到raddb/dictionary。

如果您不關心正確的做法，請查看PEN分配以查找已停業的公司並使用他們的PEN。

Answer 2

給任何有類似問題的人。 我想出了一個適用於我的解決方法。

如上所述，構建自定義屬性真的很麻煩。 但是，您可以使用的是屬性18（回覆消息）以傳達信息。

我在「post-auth」部分添加了：.../raddb/sites-available/default來解決這個問題。

if (&reply:faculty && &request:NAS-IP-Address == *IP-WEBSERVER*) { 
    update reply { 
     Reply-Message += "Faculty: %{reply:faculty}" 
    } 
} 

如果既可以在radreply或radgroupreply當且僅當在懇求來通過sepcified「網絡服務器」中找到它增加了「教師」的信息。使用freeradius算子算術，你也可以加權回覆（對我來說：radreply：= radgroupreply + =）。

這適用於freeradius3.0.10。

我認爲這個線程已關閉 - Felix