FreeRADIUS / pam_radius

This is the PAM to RADIUS authentication module. It allows any Linux, OSX or Solaris machine to become a RADIUS client for authentication and password change requests.
GNU General Public License v2.0
102 stars 90 forks source link

The "source_ip" field should also support an interface name #76

Open pprindeville opened 1 year ago

pprindeville commented 1 year ago

Many network utilities (ping, ssh, traceroute, etc) will take an interface name to signify the source address, and then query the interface for its list of addresses and use the first of the appropriate address family.

This is handy when you want to source packets from an interface with a dynamic address (such as an IPsec/GRE tunnel or a DHCP'd subnet) but don't want to be editing the configuration file on-the-fly.

pprindeville commented 1 year ago

I'm willing to write the code myself (though I can only easily test on Linux) but don't want to start the effort if it's already known that the feature won't be accepted...

alandekok commented 1 year ago

  That seems reasonable. I would suggest tho that the interface name be a separate configuration. Because there's overlap between host names and interface names. On Sep 1, 2023, at 3:44 PM, Philip Prindeville @.***> wrote: I'm willing to write the code myself (though I can only easily test on Linux) but don't want to start the effort if it's already known that the feature won't be accepted...

—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you are subscribed to this thread.Message ID: @.***>

pprindeville commented 1 year ago

Well, yes, you could name your host eth0 but how often does that happen? You could ioctl(SIOCGIFADDR) on the name first, and if that fails, do a gethostbyname() on it instead.

alandekok commented 1 year ago

It's not about how often it happens, it's about doing things clearly and correctly so that we know the software is correct.

It costs essentially nothing to add another configuration parameter. The code could look for source_interface, and if found use that. If not found, use source_ip.

This is not really any more code than looking up the interface by name, and if not found, looking the name up as a hostname.