<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7651.59">
<TITLE>RE: (Solved) Re: MAC authorisation (but not authentication) via LDAP</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>this looks great for my purpose as well thanks very much for your help<BR>
<BR>
<BR>
Alan,<BR>
<BR>
The problem for me was that when the ldapsearch failed to find the MAC<BR>
address, freeradius didn't reject authorisation.<BR>
<BR>
The solution for me, ( I'm sure the big boys can point out how it's<BR>
wrong ), was the following script..<BR>
<BR>
-------snip-------<BR>
#!/bin/sh<BR>
if $( echo $MODULE_FAILURE_MESSAGE | grep "not found" > /dev/null ); then<BR>
echo "Auth-Type := reject";<BR>
exit 0;<BR>
fi<BR>
-------snip-------<BR>
and the following clause in radiusd.conf<BR>
-------snip-------<BR>
exec rejectOnNotFound {<BR>
wait = yes<BR>
program = "/usr/local/etc/raddb/rejectOnNotFound.sh"<BR>
input_pairs = request<BR>
output_pairs = config<BR>
}<BR>
-------snip-------<BR>
which is used in the authorise section thus<BR>
-------snip-------<BR>
Autz-Type LdapMAC {<BR>
ldapMAC<BR>
rejectOnNotFound<BR>
}<BR>
-------snip-------<BR>
<BR>
<BR>
As I said, works for me.<BR>
<BR>
Hope it helps..<BR>
<BR>
Mart<BR>
<BR>
Alan Walters wrote:<BR>
> we a trying to add mac authentication to our wireless aps radius request<BR>
> comes in like so.<BR>
><BR>
> rad_recv: Access-Request packet from host 10.250.100.3:1038, id=119,<BR>
> length=95<BR>
> Service-Type = Framed-User<BR>
> NAS-Port-Id = "wlan1"<BR>
> User-Name = "00:0B:6B:56:1D:48"<BR>
> User-Password = ""<BR>
> NAS-Identifier = "ballyvaughan_ap_1"<BR>
> NAS-IP-Address = 10.250.100.3<BR>
><BR>
><BR>
> the mac address is in a field in the ldap so i created a second<BR>
> ldap.attrib.map and a new ldap autz-type. the problem is that the<BR>
> user-password that is sent i blank so i added this to the users file.<BR>
> like so.<BR>
><BR>
> DEFAULT Huntgroup-Name == test, Autz-Type := ldapMAC, User-Password ==<BR>
> "", Simultaneous-Use := 1<BR>
> Fall-Through = 0<BR>
><BR>
> great now the user with authorise and authenticate from files. but what<BR>
> i had hoped would happen was if they failure authorisation they would<BR>
> not continue, i can see this is not the default proceedure. how can i<BR>
> make this work this way.<BR>
><BR>
> Processing the authorize section of radiusd.conf<BR>
> modcall: entering group authorize for request 0<BR>
> modcall[authorize]: module "preprocess" returns ok for request 0<BR>
> modcall[authorize]: module "chap" returns noop for request 0<BR>
> modcall[authorize]: module "mschap" returns noop for request 0<BR>
> users: Matched entry DEFAULT at line 4<BR>
> modcall[authorize]: module "files" returns ok for request 0<BR>
> modcall: leaving group authorize (returns ok) for request 0<BR>
> Found Autz-Type ldapMAC<BR>
> Processing the authorize section of radiusd.conf<BR>
> modcall: entering group ldapMAC for request 0<BR>
> modcall: entering group redundant for request 0<BR>
> rlm_ldap: - authorize<BR>
> rlm_ldap: performing user authorization for 00:0B:6B:56:1D:48<BR>
> radius_xlat: '(rdwaveuserWirelessMac=00:0B:6B:56:1D:48)'<BR>
> radius_xlat: 'o=clients,dc=radiowave,dc=net'<BR>
> rlm_ldap: ldap_get_conn: Checking Id: 0<BR>
> rlm_ldap: ldap_get_conn: Got Id: 0<BR>
> rlm_ldap: attempting LDAP reconnection<BR>
> rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0<BR>
> rlm_ldap: bind as cn=admin,dc=radiowave,dc=net/xxxxxxx to 127.0.0.1:389<BR>
> radiustest:/etc/freeradius/config-clients#<BR>
> rlm_ldap: Bind was successful<BR>
> rlm_ldap: performing search in o=clients,dc=radiowave,dc=net, with<BR>
> filter (rdwaveuserWirelessMac=00:0B:6B:56:1D:48)<BR>
> rlm_ldap: object not found or got ambiguous search result<BR>
> rlm_ldap: search failed<BR>
> rlm_ldap: ldap_release_conn: Release Id: 0<BR>
> modcall[authorize]: module "ldapmac1" returns notfound for request 0<BR>
> modcall: leaving group redundant (returns notfound) for request 0<BR>
> modcall: leaving group ldapMAC (returns notfound) for request 0<BR>
><BR>
><BR>
> but when the authentication starts this stilll happens, below was an<BR>
> idea someone had in respect to this issue or a similar one but i have no<BR>
> idea how to deploy this look forward to your replys.<BR>
><BR>
> auth: type Local<BR>
> auth: user supplied User-Password matches local User-Password<BR>
> Processing the session section of radiusd.conf<BR>
> modcall: entering group session for request 0<BR>
> modcall: entering group redundant for request 0<BR>
> modcall[session]: module "sql2" returns noop for request 0<BR>
> modcall: leaving group redundant (returns noop) for request 0<BR>
> modcall: leaving group session (returns noop) for request 0<BR>
> Login OK: [00:0B:6B:56:1D:48/] (from client ballyvaughan port 0)<BR>
> Sending Access-Accept of id 119 to 10.250.100.3 port 1038<BR>
><BR>
><BR>
> On Sun, 2007-02-25 at 20:05 +0000, Martin Whinnery wrote:<BR>
>> Martin Whinnery wrote:<BR>
>>> Markus Krause wrote:<BR>
>>> <BR>
>>>> Zitat von Martin Whinnery <martin.whinnery@sbc.ac.uk>:<BR>
>>>><BR>
>>>> <BR>
>>>> <BR>
>>>>> Hi.<BR>
>>>>><BR>
>>>>> Probly just me not understanding...<BR>
>>>>><BR>
>>>>> What I want is for our switches to only allow access to MAC addresses in<BR>
>>>>> our LDAP database.<BR>
>>>>><BR>
>>>>> I don't want to store passwords on our LDAP host entries.<BR>
>>>>><BR>
>>>>> I'm set up to check LDAP during authorisation, and it correctly returns<BR>
>>>>> authorised / not authorised depending on whether the appropriate<BR>
>>>>> attribute contains the right value.<BR>
>>>>><BR>
>>>>> The trouble comes with authentication - either I set Auth-Type :=<BR>
>>>>> Accept, in which case and failed authorisation is overridden, or I allow<BR>
>>>>> authentication to carry on against LDAP ( or System, or whatever ), in<BR>
>>>>> which case it fails always and access is denied, even for authorised MACs.<BR>
>>>>><BR>
>>>>> Is there a way to make the Authorisation part final and authoritative?<BR>
>>>>><BR>
>>>>><BR>
>>>>> As I say, probly just being stoopid.<BR>
>>>>><BR>
>>>>><BR>
>>>>> Mart<BR>
>>>>><BR>
>>>>><BR>
>>>>> <BR>
>>>>> <BR>
>>>> don't no if it is a good solution, but i just do this by setting the <BR>
>>>> following in radiusd.conf:<BR>
>>>><BR>
>>>> authenticate {<BR>
>>>> ...<BR>
>>>> Auth-Type LdapMAC {<BR>
>>>> ok<BR>
>>>> }<BR>
>>>> ...<BR>
>>>> }<BR>
>>>><BR>
>>>> the Auth-Type is set in users file depending on huntgroups:<BR>
>>>><BR>
>>>> DEFAULT Huntgroup-Name == switch, Autz-Type := LdapMAC, Auth-Type := LdapMAC<BR>
>>>><BR>
>>>> i assume there are better/smarter sollutions as one can read "don't <BR>
>>>> set Auth-Type" on many places but it works here ;-)<BR>
>>>><BR>
>>>> regards<BR>
>>>> markus<BR>
>>>><BR>
>>>> <BR>
>>>> <BR>
>>> Thanks Markus,<BR>
>>><BR>
>>> the problem seems to be that the authorisation pass returns "notfound",<BR>
>>> whereas I want it to "reject", as if it found an entry in LDAP without<BR>
>>> the appropriate attribute.<BR>
>>><BR>
>>> Mart<BR>
>>><BR>
>>> <BR>
>> This was exactly the problem. What I've done is created an exec module,<BR>
>> which checks for 'not found' in MODULE_FAILURE_MESSAGE, returning<BR>
>> non-zero if there's a match. So authorization *fails* rather than<BR>
>> succeeds with 'not found'.<BR>
>><BR>
>> I think.<BR>
>><BR>
>> Anyway, it works.<BR>
>><BR>
>> Thanks for all your help.<BR>
>><BR>
>> Mart<BR>
>><BR>
> -<BR>
> List info/subscribe/unsubscribe? See <A HREF="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</A><BR>
><BR>
<BR>
<BR>
--<BR>
This message has been scanned for viruses and<BR>
dangerous content by MailScanner, and is<BR>
believed to be clean.<BR>
<BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>