How to configure a freeradius server to require NAS-IP-Address attribute?

freeradius radius-protocol
Michael picture Michael · Feb 21, 2014 · Viewed 8.9k times · Source

I want to configure a freeradius server in the way that an authentication is successful only if NAS-IP-Address attribute is not empty and equals to some specific IP (of course a user name and a password match).

How should I do it? I have tried to read the documentation without success: http://freeradius.org/rfc/attributes.html http://freeradius.org/rfc/rfc2865.html#NAS-IP-Address

Answer

Arran Cudbard-Bell picture Arran Cudbard-Bell · Feb 22, 2014

Sure, there are many ways of doing this.

authorize {
   if (!NAS-IP-Address) {
       reject
   }

   if (NAS-IP-Address != 192.168.0.2) {
      reject
   }

   if ("%{sql:SELECT count(*) FROM table WHERE User-Name = '%{User-Name}' AND IP-Address = '%{NAS-IP-Address}'" == 0) {
      reject
   }
}

In v3.0.x subnet matching is also supported, where < > are reassigned to mean the set operators (< subset of) (> superset of).

if (!(<ipv4prefix>NAS-IP-Address < 192.168.0.0/16)) {
    reject
}

NAS-IP-Address = 192.168.0.2

(0)   ? if (<ipv4prefix>NAS-IP-Address < 192.168.0.0/16) 
(0)   ? if (<ipv4prefix>NAS-IP-Address < 192.168.0.0/16)  -> TRUE

NAS-IP-Address = 192.169.0.2

(0)   ? if (<ipv4prefix>NAS-IP-Address < 192.168.0.0/16) 
(0)   ? if (<ipv4prefix>NAS-IP-Address < 192.168.0.0/16)  -> FALSE

Related questions

FreeRadius - Failed binding to authentication address

When I run the following command, I can get successfull result. root@ubuntu:/home/can# radtest user password 127.0.0.1 1812 testing123 Sending Access-Request of id 78 to 127.0.0.1 port 1812 User-Name = "user" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, …

Read More
Freeradius and PHP auth script

I'm trying to authenticate freeradius users against a PHP script, with no success. I've been trying for hours to config this right, and all the threads I found with Google are either deadlinked or obsolete... radiusd.conf prefix = /usr exec_…

Read More
OpenSSL header does not match current version when compiling

When trying to compile freeRADIUS server 2.2.3, I've gotten the following error message: checking for OpenSSL version >= 0.9.7... yes checking OpenSSL library and header version consistency... library: 90819f header: 90812f... no configure: error: in `/Users/tyrexionibus/Downloads/freeradius-server-2.2.3': configure: error: …

Read More