What would be ideal, would be to have a PPP (PAP/CHAP) login if PPP is
detected... and a telnet/rlogin if PPP is NOT auto-detected. While using
ONE username authenticated from the /etc/password file. No prefixed
letters or whatever required.
Why is this so hard? It's not. I hacked the source for the earlier
radius to do just that. And was told this would be an implementation.
What radius SHOULD be able to do, without having to hack the source code
again, would be:
o User "foo" calls in...
o since the ts initially contacts the radiusd with info about the pending
login, etc...
User-Name = "foo"
Password = "K\036\304\022\037\325\261\015G2+\016\272\200Ec"
Client-Id = 206.97.77.194
Client-Port-Id = 1
NAS-Port-Type = Async
(And depending on login detected:)
User-Service-Type = Framed-User
Framed-Protocol = PPP
o Then RADIUS users file would ONLY have TWO entries, acting on the
detected service type:
DEFAULT1 Password = "UNIX", User-Service-Type = Login-User
User-Service-Type = Login-User,
Login-Service = Rlogin
DEFAULT2 Password = "UNIX", User-Service-Type = Framed-User
User-Service-Type = Framed-User,
Framed-Address = 255.255.255.254,
Framed-MTU = 1500
Framed-Protocol = PPP
o And bingo. PPP authenticated with PAP/CHAP or rlogin.
Instead, I have my old version of radius (1.16) taking care of this by
this wild radius hack of mine (I'm no C programmer). This hack falsifies
what radius finds in it's users database if they login as Framed User
(asterisked debugging info is mine):
radrecv: Request from host ce614c02 code=1, id=68, length=76
* RESETTING global variable 'forge_radius' back to = 0.
User-Name = "foo"
Password = "\219\220\3q3j\3l2\25T\03N\275\322"
Client-Id = 206.97.76.2
Client-Port-Id = 0
NAS-Port-Type = Async
User-Service-Type = Framed-User
Framed-Protocol = PPP
* Framed-Protocol = PPP sent from Terminal Server
** Setting gvariable 'forge_radius' = 1 (auth->code = 1)
Sending Ack of id 68 to ce614c02 (pm1.Newc.kiva.net)
* CHECKING FOR user FILE ENTRIES TO FORGE...(forge_radius=1)
* Found attribute 'User-Service-Type(6) = Login-User(1)'
** Switching it to 'User-Service-Type(6) = Framed-User(2)'
User-Service-Type = Framed-User
Framed-Address = 255.255.255.254
Framed-MTU = 1500
* Found attribute 'Login-Service(15) = Rlogin(1)'
** Switching it to 'Framed-Protocol(7) = PPP(1)'
Framed-Protocol = PPP
radrecv: Request from host ce614c02 code=4, id=69, length=92
* RESETTING global variable 'forge_radius' back to = 0.
Acct-Session-Id = "5D000017"
User-Name = "foo"
Client-Id = 206.97.76.2
Client-Port-Id = 0
NAS-Port-Type = Async
Acct-Status-Type = Start
Acct-Authentic = RADIUS
User-Service-Type = Framed-User
Framed-Protocol = PPP
Framed-Address = 206.97.76.26
Acct-Delay-Time = 0
Sending Accounting Ack of id 69 to ce614c02 (ts.kiva.net)
And away we go. The convenience of auto-PPP / telnet & rlogin without
different usernames, users entries, or prefixed or suffixed letters.
--IMAGINE the possibilities you could have with this this added feature:
<--"users" file--> DEFAULT1 Password = "UNIX", User-Service-Type=Login-User User-Service-Type = Login-User, Login-Service = Rlogin
DEFAULT2 Password = "UNIX", User-Service-Type=Framed-User, Prefix="S" User-Service-Type = Framed-User, Framed-Address = 255.255.255.254, Framed-MTU = 1500, Framed-Protocol = SLIP, Framed-Compression = None
DEFAULT3 Password = "UNIX", User-Service-Type=Framed-User, Prefix="C" User-Service-Type = Framed-User, Framed-Address = 255.255.255.254, Framed-MTU = 1500, Framed-Protocol = SLIP, Framed-Compression = Van-Jacobsen-TCP-IP
DEFAULT4 Password = "UNIX", User-Service-Type=Framed-User User-Service-Type = Framed-User, Framed-Address = 255.255.255.254, Framed-MTU = 1500, Framed-Protocol = PPP, Framed-Compression = Van-Jacobsen-TCP-IP <--end "users" file-->
Which results in:
A user calls in... if user = login, then rlogin to server. if user = framed, if username Prefix = "S", start SLIP. if username Prefix = "C", start CSLIP. else start PPP.
p.s. I posted my radius 1.16 hack to portmaster-users last April, but no one responded. The hack is still located at ftp.kiva.net in the /pub/linux/livingston/radius directory.
Thanks for listening,
-- Jeff A. Blaize Senior System Administrator, Kiva Networking jblaize@kiva.net (previously InterSource.COM)