DHCP + firewall

[Zdenek Pizl]

On Wednesday 08 of December 2004 15:04, Jan Satko wrote:
> > kdyz si na radius serveru zapnete accounting, budete dostavat od AP
> > message Acct-Status-Type=Start a Acct-Status-Type=Stop, na ty pak muzete
> > navazat libovolny skript, ktery bude delat to, co potrebujete.
>
> Accounting mam zapnuty.
> Ale ked vidim ako divoko to treba robit, aby script dozeral na logy
> radiusa, potom na log dhcp a robil nejake veci okolo toho, tak to je

logy radiusu prohlizet nemusite, vse potrebne dostane skript bud jako 
parametry nebo jako promenne prostredi.

cat /usr/local/freeradius/etc/raddb/acct_users:
DEFAULT Acct-Status-Type == Start
        Exec-Program = "/usr/local/bin/updatefw start"

DEFAULT Acct-Status-Type == Stop
        Exec-Program = "/usr/local/bin/updatefw stop"


cat /usr/local/bin/updatefw:
#!/bin/bash

IPT="/sbin/iptables"
ACTION=$1
MAC=`echo $ACCT_SESSION_ID | awk '{ for(i=2;i<length($1);i=i+2) print 
toupper(substr($1,i,2))}'`
MAC2=`echo $MAC | sed -e 's\ \:\g'` # | sed -r -e 's\:$\\' | sed -r -e 's\^:
\\'`

if [ "x${ACTION}x" == "xx" ]; then
  /usr/bin/logger -t "RADIUS" "UpdateFW - CANNOT continue, missing action!"
  exit 1
fi

Do whatever YOU want

exit 0

> naozaj jednoduchsie to naviazat napevno na IP-adresy a ked ich bude malo,
> tak si od RIPE vyziadam dalsie :-)))
> Vdaka za rady, spravim to takto.

P.S. - pouzivate to  na wifi WPA2 pristup? nejak jsem to v te zaplave emailu 
zrejme prehledl ...

-- 
Zdenek Pizl
Internetovy obchod s aktualizovanymi distribucemi GNU/Linuxu
http://www.Linux-CD.cz
http://www.Linux-DVD.cz