I currently have a FreeRADIUS setup using EAP-TTLS.
I'd like to set it up such that requests coming from localhost use PAP, but that other requests still use EAP-TTLS.
How do I select authentication method used on a per-client basis?
I currently have a FreeRADIUS setup using EAP-TTLS.
I'd like to set it up such that requests coming from localhost use PAP, but that other requests still use EAP-TTLS.
How do I select authentication method used on a per-client basis?
You can use the %{client:}
expansion to query attributes of the client where the request originated.
authorize {
if ("%{client:shortname}" == 'localhost') {
pap
} else {
eap
}
}
Adding the above snippet would result in the pap module being called if the client was configured with a shortname of 'localhost', otherwise the eap module would be called.
You can actually place arbitrary attributes in a client section and reference them with the client expansion i.e.
client my_client {
ipaddr = 127.0.0.1
foo = 'bar'
}
"%{client:foo}" # Which would expand to "bar"