<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=US-ASCII">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2658.24">
<TITLE>RE: Peap mschapv2 proxy early termination of EAP</TITLE>
</HEAD>
<BODY>
<UL>
<P><FONT FACE="Courier New"></FONT> <FONT SIZE=1 FACE="Tahoma">-----Original Message-----</FONT>
<BR><B><FONT SIZE=1 FACE="Tahoma">From: </FONT></B> <FONT SIZE=1 FACE="Tahoma">Andy Goy </FONT>
<BR><B><FONT SIZE=1 FACE="Tahoma">Sent: </FONT></B> <FONT SIZE=1 FACE="Tahoma">Friday, December 30, 2005 1:34 PM</FONT>
<BR><B><FONT SIZE=1 FACE="Tahoma">To: </FONT></B> <FONT SIZE=1 FACE="Tahoma">'freeradius-users@lists.freeradius.org'</FONT>
<BR><B><FONT SIZE=1 FACE="Tahoma">Subject: </FONT></B> <FONT SIZE=1 FACE="Tahoma">Peap mschapv2 proxy early termination of EAP</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Hi Alan</FONT>
<BR><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">Thanks for the reply</FONT>
</P>
</UL>
<P><FONT SIZE=2 FACE="Courier New">Andy Goy <Andy.Goy@kcom.com> wrote:</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> I have added 2 lines to the users file</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> </FONT>
<BR><FONT SIZE=2 FACE="Courier New">> DEFAULT FreeRADIUS-Proxied-To !* 127.0.0.1, Proxy-To-Realm := LOCAL,</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> Auth-Type = EAP (line 167)</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := wifi</FONT>
<BR><FONT SIZE=2 FACE="Courier New">> (line 168)</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New"> The first line is unnecessary. Delete it.</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New"> Alan DeKok.</FONT>
</P>
<BR>
<UL>
<P><FONT COLOR="#000000" SIZE=2 FACE="Arial">Without the first line the request goes straight out as EAP-MSCHAPv2 to the proxy server.</FONT>
</P>
<P><FONT COLOR="#000000" SIZE=2 FACE="Arial">With a lot more digging in the lists, I found a number of comments regarding my problem</FONT>
<BR><FONT COLOR="#000000" SIZE=2 FACE="Arial">Don't include a realm for the initial (outer) realm and make an the inner realm that contains the proxy server settings as unique</FONT></P>
<P><FONT COLOR="#000000" SIZE=2 FACE="Arial">Write a common detail file and use radrelay to proxy accounting </FONT>
<BR><FONT COLOR="#000000" SIZE=2 FACE="Arial">(also questions asking how to just get the realm variable) to select the correct proxy server for accounting</FONT>
</P>
<P><FONT COLOR="#000000" SIZE=2 FACE="Arial">This improved things, but the real solution was to include a ream for the outer pointing to LOCAL, and point the inner to the correct proxy server</FONT></P>
<P><FONT COLOR="#000000" SIZE=2 FACE="Arial">This then provides the %Realm variable to write a detail-combined file for each realm (using suffix)</FONT>
<BR><FONT SIZE=2 FACE="Arial">Two radrelays send accounting to the correct servers</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Thanks for all your comments in the lists</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Its a wonderful piece of software/work</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">The following config works a treat for me, I just need to purchase/install a real signed certificate now !!</FONT>
<BR><FONT SIZE=2 FACE="Arial">I hope it's correct and maybe helps someone</FONT>
<BR><FONT SIZE=2 FACE="Arial">Regards</FONT>
<BR><FONT SIZE=2 FACE="Arial">Andy</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">To proxy peap EAP mschap-v2 to a proxy server that only supports mschapv2 (and send accounting)</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Users logging in using username@wifi and username@isp2</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">users</FONT>
</UL>
<P><FONT SIZE=2 FACE="Courier New">DEFAULT User-Name =~ "@wifi$", FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := inner-wifi</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">Fall-Through = Yes</FONT>
<BR><FONT SIZE=2 FACE="Courier New">DEFAULT User-Name =~ "@isp2$", FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := inner-isp2</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">Fall-Through = Yes</FONT>
</P>
<BR>
<UL>
<P><FONT SIZE=2 FACE="Arial">radiusd.conf</FONT>
<BR><FONT SIZE=2 FACE="Arial">Detail{</FONT>
</UL>
<P><FONT SIZE=2 FACE="Courier New"> detailfile = ${radacctdir}/%{Realm}/detail-combined</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">detailperm = 0600</FONT>
<UL>
<P><FONT SIZE=2 FACE="Arial">}</FONT>
</P>
<BR>
</UL>
<P><FONT SIZE=2 FACE="Courier New">eap {</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">default_eap_type = peap</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">timer_expire = 60</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">ignore_unknown_eap_types = no</FONT>
<BR>
<BR> <FONT SIZE=2 FACE="Courier New">tls {</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">private_key_password = whatever</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">private_key_file = ${raddbdir}/certs/cert-srv.pem</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">certificate_file = ${raddbdir}/certs/cert-srv.pem</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">CA_file = ${raddbdir}/certs/demoCA/cacert.pem</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">dh_file = ${raddbdir}/certs/dh</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">random_file = ${raddbdir}/certs/random</FONT>
<BR> <FONT SIZE=2 FACE="Courier New"># Check the Certificate Revocation List</FONT>
<BR> <FONT SIZE=2 FACE="Courier New"># check_crl = yes</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> # check</FONT>
<BR><FONT SIZE=2 FACE="Courier New">}</FONT>
<BR> <FONT SIZE=2 FACE="Courier New"> peap {</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">default_eap_type = mschapv2</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> proxy_tunneled_request_as_eap = no</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> use_tunneled_reply = yes </FONT>
<BR><FONT SIZE=2 FACE="Courier New"> copy_request_to_tunnel = yes</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">}</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">mschapv2 {</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">}</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">}</FONT>
</P>
<BR>
<BR>
<UL>
<P><FONT SIZE=2 FACE="Arial">Proxy.conf</FONT>
</P>
</UL>
<P><FONT SIZE=2 FACE="Courier New">realm wifi {</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">type = radius</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">authhost = LOCAL</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">accthost = LOCAL</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> nostrip</FONT>
<BR><FONT SIZE=2 FACE="Courier New">}</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">realm inner-wifi {</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">type = radius</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">authhost = xxxxxxxxxx:1645</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">accthost = xxxxxxxxxx:1646</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">secret = wifisecret</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> nostrip</FONT>
<BR><FONT SIZE=2 FACE="Courier New">}</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">realm isp2 {</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">type = radius</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">authhost = LOCAL</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">accthost = LOCAL</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> nostrip</FONT>
<BR><FONT SIZE=2 FACE="Courier New">}</FONT>
<BR><FONT SIZE=2 FACE="Courier New">realm inner-isp2 {</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">type = radius</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">authhost = xxxxxxxx:1812</FONT>
<BR> <FONT SIZE=2 FACE="Courier New">accthost = xxxxxxxx:1813 </FONT>
<BR> <FONT SIZE=2 FACE="Courier New">secret = isp2secret</FONT>
<BR><FONT SIZE=2 FACE="Courier New"> nostrip</FONT>
<BR><FONT SIZE=2 FACE="Courier New">}</FONT>
</P>
<P><FONT SIZE=2 FACE="Courier New">Radrelay command for wifi realm </FONT>
<BR><FONT SIZE=2 FACE="Courier New">radrelay -a (your accounting dir/radacct/wifi -d /etc/raddb -r (address of wifi proxy:port) -s wifisecret detail-combined </FONT></P>
<P><FONT SIZE=2 FACE="Courier New">Radrelay command for isp2 realm</FONT>
<BR><FONT SIZE=2 FACE="Courier New">/radacct/isp2 (address of isp2 proxy:port)</FONT>
</P>
<BR>
<P><FONT SIZE=1 FACE="Arial">The content of this e-mail and any attachment is private and may be legally privileged. If you are not </FONT>
<BR><FONT SIZE=1 FACE="Arial">the intended recipient, any use, disclosure, copying or forwarding of this e-mail and/or its </FONT>
<BR><FONT SIZE=1 FACE="Arial">attachments is unauthorised. If you have received this e-mail in error please notify the sender by e-</FONT>
<BR><FONT SIZE=1 FACE="Arial">mail and delete this message and any attachments immediately from this system.</FONT>
</P>
<P><FONT SIZE=1 FACE="Arial">Kingston Communications (HULL) PLC is a public limited company incorporated in England and Wales </FONT>
<BR><FONT SIZE=1 FACE="Arial">with registration number 02150618 and whose registered office is at 37 Carr Lane, Hull HU1 3RE</FONT>
</P>
</BODY>
</HTML>