Discussion:
Post-Auth LDAP with computer names rather than usernames
Kevin Virk
2018-10-19 20:06:38 UTC
Permalink
I currently have dynamic vlans working with post-auth user authentication but my boss would like to do it based off computer name. I have searched and become a little confused as how to proceed. In the LDAP conf do I change stripped username to stripped computer name or is it more complicated than that?

________________________________
From: Freeradius-Users <freeradius-users-bounces+kevin.virk=***@lists.freeradius.org> on behalf of freeradius-users-***@lists.freeradius.org <freeradius-users-***@lists.freeradius.org>
Sent: Monday, September 3, 2018 10:19 AM
To: freeradius-***@lists.freeradius.org
Subject: Freeradius-Users Digest, Vol 161, Issue 2

Send Freeradius-Users mailing list submissions to
freeradius-***@lists.freeradius.org

To subscribe or unsubscribe via the World Wide Web, visit
http://lists.freeradius.org/mailman/listinfo/freeradius-users<http://lists.freeradius.org/mailman/listinfo/freeradius-users>
or, via email, send a message with subject or body 'help' to
freeradius-users-***@lists.freeradius.org

You can reach the person managing the list at
freeradius-users-***@lists.freeradius.org

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Freeradius-Users digest..."


Today's Topics:

1. Re: VLan affect based on ldap attribute freeradius v3
(jehan procaccia INT)
2. rlm_sql not checking radgroupreply (***@fettabernett.de)


----------------------------------------------------------------------

Message: 1
Date: Mon, 3 Sep 2018 16:04:11 +0200
From: jehan procaccia INT <***@int-evry.fr>
To: FreeRadius users mailing list
<Freeradius-***@lists.freeradius.org>
Cc: ***@deployingradius.com, Christophe GABORET
<***@tem-tsp.eu>
Subject: Re: VLan affect based on ldap attribute freeradius v3
Message-ID: <f6b5995f-5959-a196-5bb0-***@int-evry.fr>
Content-Type: text/plain; charset=utf-8

Hello sucessfull reponses below ...
On Aug 31, 2018, at 4:45 AM, jehan procaccia INT
unfortunatly it fails, User-Category attribute fetch from ldap
edupersonPrimaryAffiliation doesn't pass though different
states/modules apparently
Yes, it does. You should be able to tell what's going on by reading
the debug output. *Or* by posting the ENTIRE debug output here, and
letting someone else read it.
You're falling into a common trap. You're trying all kinds of random
things. Without really understanding what's going on, or why.
You're posting *small* bits of the debug output, in the hope that
those bits are useful.
They're not.
Post the FULL DEBUG OUTPUT.
And make sure it's for ONE USER. We're not going to read through
thousands of lines of logs about accounting packets, in order to
solve an authentication issue.
you're right, after a weekend reading thouroughly
http://networkradius.com/doc/FreeRADIUS Technical Guide.pdf<http://networkradius.com/doc/FreeRADIUS Technical Guide.pdf> and wiki
thingsget better now , althought it's not easy to get a single user
debug output from production .
fortunatly you gave me the right answer with

"use_tunneled_reply = yes"

adding that not only (which was already set) to mods-enabled/eap section:
eap { ttls {
but moreover to peap {
which is our prevalent method used, now makes the attribute correctly
flowed in the process

chapter 4.3 of the tech guide is important to understand the iteractive
/ recursive processing of the configuration sections and modules . the
debug output seems very repetitive whitout that and
https://wiki.freeradius.org/guide/radiusd-X<https://wiki.freeradius.org/guide/radiusd-X> helps a lot to .

thanks for your help , now it work fine ;-)

Regards


PS my connection as an employee (ldap) and associated vlan accordingly :

(86) prod: reply:Reply-Message := 'employee'
(86) prod: reply:User-Category += 'employee'

(86) Virtual server sending reply
(86) Reply-Message := "employee"
(86) User-Category += "employee"

(86) eap_peap: Got tunneled reply RADIUS code 2
(86) eap_peap: Reply-Message := "employee"
(86) eap_peap: User-Category += "employee"

(88) eap_peap: Using saved attributes from the original Access-Accept
(88) eap_peap: Reply-Message := "employee"
(88) eap_peap: User-Category += "employee"

(88) [eap] = ok
(88) } # authenticate = ok
(88) # Executing section post-auth from file
/etc/raddb/sites-enabled/default
(88) post-auth {
(88) update {
(88) No attributes updated
(88) } # update = noop
(88) reply_log: EXPAND
/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d
(88) reply_log: -->
/var/log/radius/radacct/10.91.10.10/reply-detail-20180903
(88) reply_log:
/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d

(88) reply_log: EXPAND %t
(88) reply_log: --> Mon Sep 3 09:24:23 2018
(88) [reply_log] = ok
(88) [exec] = noop
(88) policy remove_reply_message_if_eap {
(88) if (&reply:EAP-Message && &reply:Reply-Message) {
(88) if (&reply:EAP-Message && &reply:Reply-Message) -> TRUE
(88) if (&reply:EAP-Message && &reply:Reply-Message) {
(88) update reply {
(88) &Reply-Message !* ANY
(88) } # update reply = noop
(88) } # if (&reply:EAP-Message && &reply:Reply-Message) = noop
(88) ... skipping else: Preceding "if" was taken
(88) } # policy remove_reply_message_if_eap = noop

(88) policy debug_reply {
(88) if ("%{debug_attr:reply:}" == '') {
(88) Attributes matching "reply:"
(88) &reply:User-Category += employee
(88) &reply:Stripped-User-Name = procacci

(88) if ("%{debug_attr:reply:}" == '') -> TRUE
(88) if ("%{debug_attr:reply:}" == '') {
(88) [noop] = noop
(88) } # if ("%{debug_attr:reply:}" == '') = noop
(88) } # policy debug_reply = noop
(88) if (( &reply:User-Category == "employee") ||
(&reply:User-Category == "faculty") || (&reply:User-Category == "staff"
) || (&reply:User-Category == "researcher") || (&reply:User-Category ==
"member")) {
(88) if (( &reply:User-Category == "employee") ||
(&reply:User-Category == "faculty") || (&reply:User-Category == "staff"
) || (&reply:User-Category == "researcher") || (&reply:User-Category ==
"member")) -> TRUE
(88) if (( &reply:User-Category == "employee") ||
(&reply:User-Category == "faculty") || (&reply:User-Category == "staff"
) || (&reply:User-Category == "researcher") || (&reply:User-Category ==
"member")) {
(88) update reply {
(88) Tunnel-Private-Group-Id := 903
even with the usage of session-state (replacing "reply") it fails
1) ldap does find the attribute and associated value (here
employee)
reply:Reply-Message := 'employee' (93) prod: reply:User-Category +=
'employee'
2) eap-peap has it
(93) post-auth { (93) if (0) { (93) if (0) ->
FALSE (93) } # post-auth = noop (93) Login OK: [radu/<via
Auth-Type = eap>] (from client prod port 0 via TLS tunnel) (93) } #
server inner-tunnel (93) Virtual server sending reply (93)
Reply-Message := "employee" (93) *User-Category += "employee"*
Reply-Message := "employee" (93) eap_peap: *User-Category +=
"employee"*
Note that's all in packet 93. AND in the "inner tunnel" virtual
server.
3) eap_peap is success
(94)*eap_peap: Success*
Which is packet 94. Note that "94" is NOT THE SAME as "93".
i.e. it's a different packet. So unless you made sure to get the
attribute from packet 93 inner tunnel reply to packet 94 outer
reply... the attribute won't be in packet 94.
should I see something like &reply:User-Category above
No.
? not been present means it's already lost ?
It hasn't been lost.
All you need to do is read mods-available/eap, and set
"use_tunneled_reply = yes". And read the comments for that
configuration item. They explain what it is, why you need it, and
when you want to use it.
Alan DeKok.
- List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html<http://www.freeradius.org/list/users.html>
------------------------------

Message: 2
Date: Mon, 3 Sep 2018 19:18:59 +0200
From: ***@fettabernett.de
To: freeradius-***@lists.freeradius.org
Subject: rlm_sql not checking radgroupreply
Message-ID:
<trinity-fc960aa8-16ac-446d-81e3-a3045449cc19-***@3c-app-gmx-bs44>

Content-Type: text/plain; charset="UTF-8"

Hello,

I am using FreeRADIUS 3.0.17 in a MySQL setup that seems to not check
radgroupreply.
"radtest" gets user attributes but does not receive attributes of
associated group at all.

Complete debug output of radiusd -X:


FreeRADIUS Version 3.0.17
Copyright (C) 1999-2017 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Starting - reading configuration files ...
including dictionary file /usr/local/share/freeradius/dictionary
including dictionary file /usr/local/share/freeradius/dictionary.dhcp
including dictionary file /usr/local/share/freeradius/dictionary.vqp
including dictionary file /usr/local/etc/raddb/dictionary
including configuration file /usr/local/etc/raddb/radiusd.conf
including files in directory /usr/local/etc/raddb/mods-enabled/
including configuration file /usr/local/etc/raddb/mods-enabled/expr
including configuration file
/usr/local/etc/raddb/mods-enabled/expiration
including configuration file /usr/local/etc/raddb/mods-enabled/echo
including configuration file /usr/local/etc/raddb/mods-enabled/files
including configuration file /usr/local/etc/raddb/mods-enabled/pap
including configuration file /usr/local/etc/raddb/mods-enabled/soh
including configuration file /usr/local/etc/raddb/mods-enabled/utf8
including configuration file /usr/local/etc/raddb/mods-enabled/unix
including configuration file
/usr/local/etc/raddb/mods-enabled/cache_eap
including configuration file
/usr/local/etc/raddb/mods-enabled/detail.log
including configuration file /usr/local/etc/raddb/mods-enabled/date
including configuration file /usr/local/etc/raddb/mods-enabled/linelog
including configuration file /usr/local/etc/raddb/mods-enabled/unpack
including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp
including configuration file /usr/local/etc/raddb/mods-enabled/exec
including configuration file /usr/local/etc/raddb/mods-enabled/always
including configuration file
/usr/local/etc/raddb/mods-enabled/logintime
including configuration file /usr/local/etc/raddb/mods-enabled/mschap
including configuration file
/usr/local/etc/raddb/mods-enabled/replicate
including configuration file /usr/local/etc/raddb/mods-enabled/eap
including configuration file /usr/local/etc/raddb/mods-enabled/detail
including configuration file /usr/local/etc/raddb/mods-enabled/digest
including configuration file
/usr/local/etc/raddb/mods-enabled/preprocess
including configuration file /usr/local/etc/raddb/mods-enabled/radutmp
including configuration file /usr/local/etc/raddb/mods-enabled/chap
including configuration file
/usr/local/etc/raddb/mods-enabled/attr_filter
including configuration file /usr/local/etc/raddb/mods-enabled/sql
including configuration file
/usr/local/etc/raddb/mods-config/sql/main/sqlite/queries.conf
including configuration file /usr/local/etc/raddb/mods-enabled/realm
including files in directory /usr/local/etc/raddb/policy.d/
including configuration file /usr/local/etc/raddb/policy.d/filter
including configuration file
/usr/local/etc/raddb/policy.d/moonshot-targeted-ids
including configuration file /usr/local/etc/raddb/policy.d/abfab-tr
including configuration file
/usr/local/etc/raddb/policy.d/canonicalization
including configuration file /usr/local/etc/raddb/policy.d/control
including configuration file /usr/local/etc/raddb/policy.d/debug
including configuration file
/usr/local/etc/raddb/policy.d/operator-name
including configuration file /usr/local/etc/raddb/policy.d/eap
including configuration file /usr/local/etc/raddb/policy.d/cui
including configuration file /usr/local/etc/raddb/policy.d/dhcp
including configuration file /usr/local/etc/raddb/policy.d/accounting
including files in directory /usr/local/etc/raddb/sites-enabled/
including configuration file /usr/local/etc/raddb/sites-enabled/default
including configuration file
/usr/local/etc/raddb/sites-enabled/inner-tunnel
main {
security {
allow_core_dumps = no
}
name = "radiusd"
prefix = "/usr/local"
localstatedir = "/usr/local/var"
logdir = "/usr/local/var/log/radius"
run_dir = "/usr/local/var/run/radiusd"
}
main {
name = "radiusd"
prefix = "/usr/local"
localstatedir = "/usr/local/var"
sbindir = "/usr/local/sbin"
logdir = "/usr/local/var/log/radius"
run_dir = "/usr/local/var/run/radiusd"
libdir = "/usr/local/lib"
radacctdir = "/usr/local/var/log/radius/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 16384
pidfile = "/usr/local/var/run/radiusd/radiusd.pid"
checkrad = "/usr/local/sbin/checkrad"
debug_level = 0
proxy_requests = yes
log {
stripped_names = no
auth = no
auth_badpass = no
auth_goodpass = no
colourise = yes
msg_denied = "You are already logged in - access denied"
}
resources {
}
security {
max_attributes = 200
reject_delay = 1.000000
status_server = yes
allow_vulnerable_openssl = "no"
}
}
radiusd: #### Loading Realms and Home Servers ####
radiusd: #### Loading Clients ####
Debugger not attached
# Creating Auth-Type = mschap
# Creating Auth-Type = digest
# Creating Auth-Type = eap
# Creating Auth-Type = PAP
# Creating Auth-Type = CHAP
# Creating Auth-Type = MS-CHAP
radiusd: #### Instantiating modules ####
modules {
# Loaded module rlm_expr
# Loading module "expr" from file
/usr/local/etc/raddb/mods-enabled/expr
expr {
safe_characters =
"#@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
/"
}
# Loaded module rlm_expiration
# Loading module "expiration" from file
/usr/local/etc/raddb/mods-enabled/expiration
# Loaded module rlm_exec
# Loading module "echo" from file
/usr/local/etc/raddb/mods-enabled/echo
exec echo {
wait = yes
program = "/bin/echo %{User-Name}"
input_pairs = "request"
output_pairs = "reply"
shell_escape = yes
}
# Loaded module rlm_files
# Loading module "files" from file
/usr/local/etc/raddb/mods-enabled/files
files {
filename = "/usr/local/etc/raddb/mods-config/files/authorize"
acctusersfile =
"/usr/local/etc/raddb/mods-config/files/accounting"
preproxy_usersfile =
"/usr/local/etc/raddb/mods-config/files/pre-proxy"
}
# Loaded module rlm_pap
# Loading module "pap" from file
/usr/local/etc/raddb/mods-enabled/pap
pap {
normalise = yes
}
# Loaded module rlm_soh
# Loading module "soh" from file
/usr/local/etc/raddb/mods-enabled/soh
soh {
dhcp = yes
}
# Loaded module rlm_utf8
# Loading module "utf8" from file
/usr/local/etc/raddb/mods-enabled/utf8
# Loaded module rlm_unix
# Loading module "unix" from file
/usr/local/etc/raddb/mods-enabled/unix
unix {
radwtmp = "/usr/local/var/log/radius/radwtmp"
}
Creating attribute Unix-Group
# Loaded module rlm_cache
# Loading module "cache_eap" from file
/usr/local/etc/raddb/mods-enabled/cache_eap
cache cache_eap {
driver = "rlm_cache_rbtree"
key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
ttl = 15
max_entries = 0
epoch = 0
add_stats = no
}
# Loaded module rlm_detail
# Loading module "auth_log" from file
/usr/local/etc/raddb/mods-enabled/detail.log
detail auth_log {
filename =
"/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet
-Src-IPv6-Address}}/auth-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "reply_log" from file
/usr/local/etc/raddb/mods-enabled/detail.log
detail reply_log {
filename =
"/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet
-Src-IPv6-Address}}/reply-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "pre_proxy_log" from file
/usr/local/etc/raddb/mods-enabled/detail.log
detail pre_proxy_log {
filename =
"/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet
-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "post_proxy_log" from file
/usr/local/etc/raddb/mods-enabled/detail.log
detail post_proxy_log {
filename =
"/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet
-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loaded module rlm_date
# Loading module "date" from file
/usr/local/etc/raddb/mods-enabled/date
date {
format = "%b %e %Y %H:%M:%S %Z"
utc = no
}
# Loaded module rlm_linelog
# Loading module "linelog" from file
/usr/local/etc/raddb/mods-enabled/linelog
linelog {
filename = "/usr/local/var/log/radius/linelog"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = "This is a log message for %{User-Name}"
reference = "messages.%{%{reply:Packet-Type}:-default}"
}
# Loading module "log_accounting" from file
/usr/local/etc/raddb/mods-enabled/linelog
linelog log_accounting {
filename = "/usr/local/var/log/radius/linelog-accounting"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference =
"Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
}
# Loaded module rlm_unpack
# Loading module "unpack" from file
/usr/local/etc/raddb/mods-enabled/unpack
# Loaded module rlm_radutmp
# Loading module "sradutmp" from file
/usr/local/etc/raddb/mods-enabled/sradutmp
radutmp sradutmp {
filename = "/usr/local/var/log/radius/sradutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
permissions = 420
caller_id = no
}
# Loading module "exec" from file
/usr/local/etc/raddb/mods-enabled/exec
exec {
wait = no
input_pairs = "request"
shell_escape = yes
timeout = 10
}
# Loaded module rlm_always
# Loading module "reject" from file
/usr/local/etc/raddb/mods-enabled/always
always reject {
rcode = "reject"
simulcount = 0
mpp = no
}
# Loading module "fail" from file
/usr/local/etc/raddb/mods-enabled/always
always fail {
rcode = "fail"
simulcount = 0
mpp = no
}
# Loading module "ok" from file
/usr/local/etc/raddb/mods-enabled/always
always ok {
rcode = "ok"
simulcount = 0
mpp = no
}
# Loading module "handled" from file
/usr/local/etc/raddb/mods-enabled/always
always handled {
rcode = "handled"
simulcount = 0
mpp = no
}
# Loading module "invalid" from file
/usr/local/etc/raddb/mods-enabled/always
always invalid {
rcode = "invalid"
simulcount = 0
mpp = no
}
# Loading module "userlock" from file
/usr/local/etc/raddb/mods-enabled/always
always userlock {
rcode = "userlock"
simulcount = 0
mpp = no
}
# Loading module "notfound" from file
/usr/local/etc/raddb/mods-enabled/always
always notfound {
rcode = "notfound"
simulcount = 0
mpp = no
}
# Loading module "noop" from file
/usr/local/etc/raddb/mods-enabled/always
always noop {
rcode = "noop"
simulcount = 0
mpp = no
}
# Loading module "updated" from file
/usr/local/etc/raddb/mods-enabled/always
always updated {
rcode = "updated"
simulcount = 0
mpp = no
}
# Loaded module rlm_logintime
# Loading module "logintime" from file
/usr/local/etc/raddb/mods-enabled/logintime
logintime {
minimum_timeout = 60
}
# Loaded module rlm_mschap
# Loading module "mschap" from file
/usr/local/etc/raddb/mods-enabled/mschap
mschap {
use_mppe = yes
require_encryption = no
require_strong = no
with_ntdomain_hack = yes
passchange {
}
allow_retry = yes
winbind_retry_with_normalised_username = no
}
# Loaded module rlm_replicate
# Loading module "replicate" from file
/usr/local/etc/raddb/mods-enabled/replicate
# Loaded module rlm_eap
# Loading module "eap" from file
/usr/local/etc/raddb/mods-enabled/eap
eap {
default_eap_type = "md5"
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
max_sessions = 16384
}
# Loading module "detail" from file
/usr/local/etc/raddb/mods-enabled/detail
detail {
filename =
"/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet
-Src-IPv6-Address}}/detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loaded module rlm_digest
# Loading module "digest" from file
/usr/local/etc/raddb/mods-enabled/digest
# Loaded module rlm_preprocess
# Loading module "preprocess" from file
/usr/local/etc/raddb/mods-enabled/preprocess
preprocess {
huntgroups =
"/usr/local/etc/raddb/mods-config/preprocess/huntgroups"
hints = "/usr/local/etc/raddb/mods-config/preprocess/hints"
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
with_alvarion_vsa_hack = no
}
# Loading module "radutmp" from file
/usr/local/etc/raddb/mods-enabled/radutmp
radutmp {
filename = "/usr/local/var/log/radius/radutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
permissions = 384
caller_id = yes
}
# Loaded module rlm_chap
# Loading module "chap" from file
/usr/local/etc/raddb/mods-enabled/chap
# Loaded module rlm_attr_filter
# Loading module "attr_filter.post-proxy" from file
/usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.post-proxy {
filename =
"/usr/local/etc/raddb/mods-config/attr_filter/post-proxy"
key = "%{Realm}"
relaxed = no
}
# Loading module "attr_filter.pre-proxy" from file
/usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.pre-proxy {
filename =
"/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy"
key = "%{Realm}"
relaxed = no
}
# Loading module "attr_filter.access_reject" from file
/usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.access_reject {
filename =
"/usr/local/etc/raddb/mods-config/attr_filter/access_reject"
key = "%{User-Name}"
relaxed = no
}
# Loading module "attr_filter.access_challenge" from file
/usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.access_challenge {
filename =
"/usr/local/etc/raddb/mods-config/attr_filter/access_challenge"
key = "%{User-Name}"
relaxed = no
}
# Loading module "attr_filter.accounting_response" from file
/usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.accounting_response {
filename =
"/usr/local/etc/raddb/mods-config/attr_filter/accounting_response"
key = "%{User-Name}"
relaxed = no
}
# Loaded module rlm_sql
# Loading module "sql" from file
/usr/local/etc/raddb/mods-enabled/sql
sql {
driver = "rlm_sql_mysql"
server = "sql.mydomain.de<http://sql.mydomain.de>"
port = 3306
login = "radius"
password = <<< secret >>>
radius_db = "radius"
read_groups = yes
read_profiles = yes
read_clients = yes
delete_stale_sessions = yes
sql_user_name = "%{User-Name}"
default_user_profile = ""
client_query = "SELECT id, nasname, shortname, type, secret,
server FROM nas"
authorize_check_query = "SELECT id, username, attribute, value,
op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id"
authorize_reply_query = "SELECT id, username, attribute, value,
op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id"
authorize_group_check_query = "SELECT id, groupname, attribute,
Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY
id"
authorize_group_reply_query = "SELECT id, groupname, attribute,
value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY
id"
group_membership_query = "SELECT groupname FROM radusergroup
WHERE username = '%{SQL-User-Name}' ORDER BY priority"
simul_count_query = "SELECT COUNT(*) FROM radacct WHERE
username = '%{SQL-User-Name}' AND acctstoptime IS NULL"
simul_verify_query = "SELECT radacctid, acctsessionid,
username, nasipaddress, nasportid, framedipaddress, callingstationid,
framedprotocol FROM radacct WHERE username = '%{SQL-Group}' AND
acctstoptime IS NULL"
safe_characters =
"#@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
/"
accounting {
reference = "%{tolower:type.%{Acct-Status-Type}.query}"
type {
accounting-on {
query = "UPDATE radacct SET acctstoptime =
%{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime =
(%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} -
strftime('%%s', acctstarttime)), acctterminatecause =
'%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress
= '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}"
}
accounting-off {
query = "UPDATE radacct SET acctstoptime =
%{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime =
(%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} -
strftime('%%s', acctstarttime)), acctterminatecause =
'%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress
= '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}"
}
start {
query = "INSERT INTO radacct (acctsessionid, acctuniqueid,
username, realm, nasipaddress, nasportid, nasporttype, acctstarttime,
acctupdatetime, acctstoptime, acctsessiontime, acctauthentic,
connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets,
calledstationid, callingstationid, acctterminatecause, servicetype,
framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}',
'%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}',
'%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}',
'%{NAS-Port-Type}', %{%{integer:Event-Timestamp}:-date('now')},
%{%{integer:Event-Timestamp}:-date('now')}, NULL, '0',
'%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0',
'%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}',
'%{Framed-Protocol}', '%{Framed-IP-Address}')"
}
interim-update {
query = "UPDATE radacct SET acctupdatetime =
%{%{integer:Event-Timestamp}:-date('now')}, acctinterval = 0,
framedipaddress = '%{Framed-IP-Address}', acctsessiontime =
%{%{Acct-Session-Time}:-NULL}, acctinputoctets =
%{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0},
acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 |
%{%{Acct-Output-Octets}:-0} WHERE AcctUniqueId =
'%{Acct-Unique-Session-Id}'"
}
stop {
query = "UPDATE radacct SET acctstoptime =
%{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime =
%{%{Acct-Session-Time}:-NULL}, acctinputoctets =
%{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0},
acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 |
%{%{Acct-Output-Octets}:-0}, acctterminatecause =
'%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE
AcctUniqueId = '%{Acct-Unique-Session-Id}'"
}
}
}
post-auth {
reference = ".query"
query = "INSERT INTO radpostauth (username, pass, reply,
authdate) VALUES ( '%{SQL-User-Name}',
'%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')"
}
}
rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and
linked
Creating attribute SQL-Group
# Loaded module rlm_realm
# Loading module "IPASS" from file
/usr/local/etc/raddb/mods-enabled/realm
realm IPASS {
format = "prefix"
delimiter = "/"
ignore_default = no
ignore_null = no
}
# Loading module "suffix" from file
/usr/local/etc/raddb/mods-enabled/realm
realm suffix {
format = "suffix"
delimiter = "@"
ignore_default = no
ignore_null = no
}
# Loading module "realmpercent" from file
/usr/local/etc/raddb/mods-enabled/realm
realm realmpercent {
format = "suffix"
delimiter = "%"
ignore_default = no
ignore_null = no
}
# Loading module "ntdomain" from file
/usr/local/etc/raddb/mods-enabled/realm
realm ntdomain {
format = "prefix"
delimiter = "\\"
ignore_default = no
ignore_null = no
}
instantiate {
}
# Instantiating module "expiration" from file
/usr/local/etc/raddb/mods-enabled/expiration
# Instantiating module "files" from file
/usr/local/etc/raddb/mods-enabled/files
reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize
reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting
reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy
# Instantiating module "pap" from file
/usr/local/etc/raddb/mods-enabled/pap
# Instantiating module "cache_eap" from file
/usr/local/etc/raddb/mods-enabled/cache_eap
rlm_cache (cache_eap): Driver rlm_cache_rbtree (module
rlm_cache_rbtree) loaded and linked
# Instantiating module "auth_log" from file
/usr/local/etc/raddb/mods-enabled/detail.log
rlm_detail (auth_log): 'User-Password' suppressed, will not appear in
detail output
# Instantiating module "reply_log" from file
/usr/local/etc/raddb/mods-enabled/detail.log
# Instantiating module "pre_proxy_log" from file
/usr/local/etc/raddb/mods-enabled/detail.log
# Instantiating module "post_proxy_log" from file
/usr/local/etc/raddb/mods-enabled/detail.log
# Instantiating module "linelog" from file
/usr/local/etc/raddb/mods-enabled/linelog
# Instantiating module "log_accounting" from file
/usr/local/etc/raddb/mods-enabled/linelog
# Instantiating module "reject" from file
/usr/local/etc/raddb/mods-enabled/always
# Instantiating module "fail" from file
/usr/local/etc/raddb/mods-enabled/always
# Instantiating module "ok" from file
/usr/local/etc/raddb/mods-enabled/always
# Instantiating module "handled" from file
/usr/local/etc/raddb/mods-enabled/always
# Instantiating module "invalid" from file
/usr/local/etc/raddb/mods-enabled/always
# Instantiating module "userlock" from file
/usr/local/etc/raddb/mods-enabled/always
# Instantiating module "notfound" from file
/usr/local/etc/raddb/mods-enabled/always
# Instantiating module "noop" from file
/usr/local/etc/raddb/mods-enabled/always
# Instantiating module "updated" from file
/usr/local/etc/raddb/mods-enabled/always
# Instantiating module "logintime" from file
/usr/local/etc/raddb/mods-enabled/logintime
# Instantiating module "mschap" from file
/usr/local/etc/raddb/mods-enabled/mschap
rlm_mschap (mschap): using internal authentication
# Instantiating module "eap" from file
/usr/local/etc/raddb/mods-enabled/eap
# Linked to sub-module rlm_eap_md5
# Linked to sub-module rlm_eap_leap
# Linked to sub-module rlm_eap_gtc
gtc {
challenge = "Password: "
auth_type = "PAP"
}
# Linked to sub-module rlm_eap_tls
tls {
tls = "tls-common"
}
tls-config tls-common {
verify_depth = 0
ca_path = "/usr/local/etc/raddb/certs"
pem_file_type = yes
private_key_file = "/usr/local/etc/raddb/certs/server.pem"
certificate_file = "/usr/local/etc/raddb/certs/server.pem"
ca_file = "/usr/local/etc/raddb/certs/ca.pem"
private_key_password = <<< secret >>>
dh_file = "/usr/local/etc/raddb/certs/dh"
fragment_size = 1024
include_length = yes
auto_chain = yes
check_crl = no
check_all_crl = no
cipher_list = "DEFAULT"
cipher_server_preference = no
ecdh_curve = "prime256v1"
tls_max_version = ""
tls_min_version = "1.0"
cache {
enable = no
lifetime = 24
max_entries = 255
}
verify {
skip_if_ocsp_ok = no
}
ocsp {
enable = no
override_cert_url = yes
url = "[1]http://127.0.0.1/ocsp/<http://127.0.0.1/ocsp/>"
use_nonce = yes
timeout = 0
softfail = no
}
}
# Linked to sub-module rlm_eap_ttls
ttls {
tls = "tls-common"
default_eap_type = "md5"
copy_request_to_tunnel = no
use_tunneled_reply = no
virtual_server = "inner-tunnel"
include_length = yes
require_client_cert = no
}
tls: Using cached TLS configuration from previous invocation
# Linked to sub-module rlm_eap_peap
peap {
tls = "tls-common"
default_eap_type = "mschapv2"
copy_request_to_tunnel = no
use_tunneled_reply = no
proxy_tunneled_request_as_eap = yes
virtual_server = "inner-tunnel"
soh = no
require_client_cert = no
}
tls: Using cached TLS configuration from previous invocation
# Linked to sub-module rlm_eap_mschapv2
mschapv2 {
with_ntdomain_hack = no
send_error = no
}
# Instantiating module "detail" from file
/usr/local/etc/raddb/mods-enabled/detail
# Instantiating module "preprocess" from file
/usr/local/etc/raddb/mods-enabled/preprocess
reading pairlist file
/usr/local/etc/raddb/mods-config/preprocess/huntgroups
reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints
# Instantiating module "attr_filter.post-proxy" from file
/usr/local/etc/raddb/mods-enabled/attr_filter
reading pairlist file
/usr/local/etc/raddb/mods-config/attr_filter/post-proxy
# Instantiating module "attr_filter.pre-proxy" from file
/usr/local/etc/raddb/mods-enabled/attr_filter
reading pairlist file
/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy
# Instantiating module "attr_filter.access_reject" from file
/usr/local/etc/raddb/mods-enabled/attr_filter
reading pairlist file
/usr/local/etc/raddb/mods-config/attr_filter/access_reject
[/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check
item "FreeRADIUS-Response-Delay" found in filter list for realm
"DEFAULT".
[/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check
item "FreeRADIUS-Response-Delay-USec" found in filter list for
realm "DEFAULT".
# Instantiating module "attr_filter.access_challenge" from file
/usr/local/etc/raddb/mods-enabled/attr_filter
reading pairlist file
/usr/local/etc/raddb/mods-config/attr_filter/access_challenge
# Instantiating module "attr_filter.accounting_response" from file
/usr/local/etc/raddb/mods-enabled/attr_filter
reading pairlist file
/usr/local/etc/raddb/mods-config/attr_filter/accounting_response
# Instantiating module "sql" from file
/usr/local/etc/raddb/mods-enabled/sql
rlm_sql_mysql: libmysql version: 10.1.26-MariaDB
mysql {
tls {
}
warnings = "auto"
}
rlm_sql (sql): Attempting to connect to database "radius"
rlm_sql (sql): Initialising connection pool
pool {
start = 5
min = 3
max = 32
spare = 10
uses = 0
lifetime = 0
cleanup_interval = 30
idle_timeout = 60
retry_delay = 30
spread = no
}
rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots
used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via
TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10
rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots
used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via
TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10
rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots
used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via
TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10
rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots
used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via
TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10
rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots
used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via
TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10
rlm_sql (sql): Processing generate_sql_clients
rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname,
shortname, type, secret, server FROM nas
rlm_sql (sql): Reserved connection (0)
rlm_sql (sql): Executing select query: SELECT id, nasname, shortname,
type, secret, server FROM nas
rlm_sql (sql): Adding client 10.0.0.1 (RAS1) to global clients list
rlm_sql (10.0.0.1): Client "RAS1" (sql) added
[...]
rlm_sql (sql): Adding client 192.168.100.1 (radius.mydomain.de<http://radius.mydomain.de>) to
global clients list
rlm_sql (192.168.100.1): Client "radius.mydomain.de<http://radius.mydomain.de>" (sql) added
rlm_sql (sql): Adding client 127.0.0.1<http://127.0.0.1> (localhost) to global clients
list
rlm_sql (127.0.0.1<http://127.0.0.1>: Client "localhost" (sql) added
rlm_sql (sql): Released connection (0)
Need 5 more connections to reach 10 spares
rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots
used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via
TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10
# Instantiating module "IPASS" from file
/usr/local/etc/raddb/mods-enabled/realm
# Instantiating module "suffix" from file
/usr/local/etc/raddb/mods-enabled/realm
# Instantiating module "realmpercent" from file
/usr/local/etc/raddb/mods-enabled/realm
# Instantiating module "ntdomain" from file
/usr/local/etc/raddb/mods-enabled/realm
} # modules
radiusd: #### Loading Virtual Servers ####
server { # from file /usr/local/etc/raddb/radiusd.conf
} # server
server default { # from file /usr/local/etc/raddb/sites-enabled/default
# Loading authenticate {...}
# Loading authorize {...}
# Loading preacct {...}
# Loading accounting {...}
# Loading session {...}
# Loading post-proxy {...}
# Loading post-auth {...}
} # server default
server inner-tunnel { # from file
/usr/local/etc/raddb/sites-enabled/inner-tunnel
# Loading authenticate {...}
# Loading authorize {...}
Ignoring "ldap" (see raddb/mods-available/README.rst)
# Loading session {...}
# Loading post-proxy {...}
# Loading post-auth {...}
# Skipping contents of 'if' as it is always 'false' --
/usr/local/etc/raddb/sites-enabled/inner-tunnel:331
} # server inner-tunnel
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "auth"
ipv4addr = 192.168.100.1
port = 1812
limit {
max_connections = 64
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "acct"
ipv4addr = 192.168.100.1
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "auth"
ipaddr = 127.0.0.1<http://127.0.0.1>
port = 18120
}
Listening on auth address 192.168.100.1 port 1812 bound to server
default
Listening on acct address 192.168.100.1 port 1813 bound to server
default
Listening on auth address 127.0.0.1<http://127.0.0.1> port 18120 bound to server
inner-tunnel
Ready to process requests

References

1. http://127.0.0.1/ocsp/<http://127.0.0.1/ocsp/>


------------------------------

Subject: Digest Footer

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<http://www.freeradius.org/list/users.html>

------------------------------

End of Freeradius-Users Digest, Vol 161, Issue 2
************************************************
-
List info/subscribe/unsubscribe? See http://www.fre
Matthew Newton
2018-10-19 20:13:38 UTC
Permalink
Post by Kevin Virk
I currently have dynamic vlans working with post-auth user
authentication but my boss would like to do it based off computer
name. I have searched and become a little confused as how to proceed.
In the LDAP conf do I change stripped username to stripped computer
name or is it more complicated than that?
It's more complicated than that.

What attributes are in the request?

If the computer name is there, you can use it. If it's not there,
then... you can't. Closest approximation might be the MAC address in
Calling-Station-Id, maybe.

The computer name is usually only included in EAP-TLS when you're using
a certificate with the name of the computer in it. Which sounds
unlikely: you'll have one or the other, and you've got the user name
instead.
--
Matthew

-
List info/subscribe/un
Hans-Christian Esperer
2018-10-19 21:31:22 UTC
Permalink
Post by Matthew Newton
If the computer name is there, you can use it. If it's not there,
then... you can't. Closest approximation might be the MAC address in
Calling-Station-Id, maybe.
Hmm, MAC addresses are not cryptographically signed, though... Meaning you
can't rely on them to be genuine.

HC
-
List info/subscribe/unsubscribe? See http://www.fre
Matthew Newton
2018-10-19 21:39:33 UTC
Permalink
Post by Hans-Christian Esperer
Post by Matthew Newton
If the computer name is there, you can use it. If it's not there,
then... you can't. Closest approximation might be the MAC address in
Calling-Station-Id, maybe.
Hmm, MAC addresses are not cryptographically signed, though...
Meaning you
can't rely on them to be genuine.
Never said it was a good replacement, just a close approximation.

Sometimes you have to work with what you've got.
--
Matthew

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list
Hans-Christian Esperer
2018-10-19 21:45:22 UTC
Permalink
Post by Matthew Newton
Never said it was a good replacement, just a close approximation.
Sometimes you have to work with what you've got.
I don't agree that it is an approximation, let alone a close one.

TBH, I don't understand at all why MAC addresses are used everywhere in
security relevant contexts. All these wifi "portals" are fundamentally flawed
because of this.

HC
-
List info/subscribe/unsubscri
Matthew Newton
2018-10-19 22:08:53 UTC
Permalink
Post by Hans-Christian Esperer
Post by Matthew Newton
Never said it was a good replacement, just a close approximation.
Sometimes you have to work with what you've got.
I don't agree that it is an approximation, let alone a close one.
Given we don't even know if the OP is using EAP or not, that might be all they've got to work with.
Post by Hans-Christian Esperer
TBH, I don't understand at all why MAC addresses are used everywhere in
security relevant contexts. All these wifi "portals" are fundamentally
flawed because of this.
Because nothing's perfect, and sometimes you can only work with what you've got. Like I said last time.

Nobody said you have to like it, or that web portals are secure.
--
Matthew

-
List info/subscribe/unsubscribe? See http://www.freera
Alan DeKok
2018-10-19 22:20:12 UTC
Permalink
Post by Hans-Christian Esperer
Post by Matthew Newton
Never said it was a good replacement, just a close approximation.
Sometimes you have to work with what you've got.
I don't agree that it is an approximation, let alone a close one.
You're welcome to your opinion. Unfortunately, your opinion can't change reality.

The issues you bring up have been known for years, if not decades.
Post by Hans-Christian Esperer
TBH, I don't understand at all why MAC addresses are used everywhere in
security relevant contexts. All these wifi "portals" are fundamentally flawed
because of this.
Because it's all we have. As Matthew said, we're limited by what we have.

We *cannot* upgrade tens of millions of access points and end devices. So any *realistic* security solution uses the available tools to come up with the best possible solution, given the limitations we have.

Denying that is a fools dream.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list
Hans-Christian Esperer
2018-10-20 12:38:54 UTC
Permalink
Well, we don't even know yet what the original poster's intention was.

Maybe it can be solved in a secure and a less secure way? Why point out the
less secure way first? All I meant to do was point out that the mac approach
has disadvantages to the original approach, maybe that's something that wasn't
taken into consideration by the original poster.

On a personal sidenode, my original motivation to look into freeradius in the
first place was precisely that I wanted to avoid them portals. =) Not only are
they utterly insecure, they are also incredibly inconvenient if what you want
is a stable and long lived wifi connection...

HC
-
List info/subscribe/unsubscribe? See http:/
Alan DeKok
2018-10-20 12:51:02 UTC
Permalink
Post by Hans-Christian Esperer
Well, we don't even know yet what the original poster's intention was.
That's where it's helpful to ask good questions. And give useful information, like "we're using WiFi with EAP".
Post by Hans-Christian Esperer
Maybe it can be solved in a secure and a less secure way? Why point out the
less secure way first?
Because of the vague nature of the question. The MAC approach is almost always available.
Post by Hans-Christian Esperer
All I meant to do was point out that the mac approach
has disadvantages to the original approach,
Which was what? The "original approach" didn't actually describe the authentication that was being used.
Post by Hans-Christian Esperer
maybe that's something that wasn't
taken into consideration by the original poster.
At this point, we're all just guessing.
Post by Hans-Christian Esperer
On a personal sidenode, my original motivation to look into freeradius in the
first place was precisely that I wanted to avoid them portals. =) Not only are
they utterly insecure, they are also incredibly inconvenient if what you want
is a stable and long lived wifi connection...
Hotspot 2.0 is supposed to solve a lot of these problems.

My point is that it's not useful to complain about the insecurity of MAC addresses. Everyone knows, and has known for years. So comments like this:

"I don't understand at all why MAC addresses are used everywhere in security relevant contexts"

Just show a lack of understanding of *how* things work. Since solutions are driven by available information, the answer to "why" is simple: It's often the only choice.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.f
Alan DeKok
2018-10-19 20:14:20 UTC
Permalink
Post by Kevin Virk
I currently have dynamic vlans working with post-auth user authentication but my boss would like to do it based off computer name. I have searched and become a little confused as how to proceed. In the LDAP conf do I change stripped username to stripped computer name or is it more complicated than that?
If you need to send a message to the mailing list, just send a message. Don't reply to a digest message. And don't include hundreds of lines of useless text in your message.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http
Kevin Virk
2018-10-22 16:05:04 UTC
Permalink
I recently sparked a discussion regarding post-auth with computer names rather than usernames and I did not include complete information, my apologies. I am currently using EAP-TLS and have crafted certificates based on usernames. Alan had responded saying that post-auth via Ldap was possible if you make certs with workstations names included. I can do this my question is then does the stripped username take the computer name and then do my ldap queries just need to change to check workstation groups rather than security groups ? Thank you in advance for any help.





-
List info/subscribe/unsubscribe? See http://www
Alan DeKok
2018-10-22 16:13:18 UTC
Permalink
Post by Kevin Virk
I recently sparked a discussion regarding post-auth with computer names rather than usernames and I did not include complete information, my apologies. I am currently using EAP-TLS and have crafted certificates based on usernames. Alan had responded saying that post-auth via Ldap was possible if you make certs with workstations names included. I can do this my question is then does the stripped username take the computer name and then do my ldap queries just need to change to check workstation groups rather than security groups ? Thank you in advance for any help.
The default configuration uses Stripped-User-Name if it exists, or else it uses User-Name.

The LDAP queries need to check the correct group, whatever that is.

The point here is to understand (a) what you have, and (b) what you want to do with it. Once you've written everything down, the solution is usually pretty simple.

i.e. How do you tell the difference between users authenticating and computes authentication?

Well... look at the certs and the debug output. See what's different and then write policies that key off of that.

Most people run into problems because they want FreeRADIUS to "do the right thing". When? Always. How? Mumble mumble...

The hardest part of most configurations is convincing the admins to come up with a detailed technical description of the problem.

Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freeradius.o

Loading...