<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML xmlns="http://www.w3.org/TR/REC-html40" xmlns:v =
"urn:schemas-microsoft-com:vml" xmlns:o =
"urn:schemas-microsoft-com:office:office" xmlns:w =
"urn:schemas-microsoft-com:office:word" xmlns:x =
"urn:schemas-microsoft-com:office:excel" xmlns:m =
"http://schemas.microsoft.com/office/2004/12/omml"><HEAD>
<META content="text/html; charset=us-ascii" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.19190">
<STYLE>@font-face {
font-family: Calibri;
}
@page WordSection1 {size: 612.0pt 792.0pt; margin: 72.0pt 72.0pt 72.0pt 72.0pt; }
P.MsoNormal {
MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Calibri","sans-serif"; FONT-SIZE: 11pt
}
LI.MsoNormal {
MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Calibri","sans-serif"; FONT-SIZE: 11pt
}
DIV.MsoNormal {
MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Calibri","sans-serif"; FONT-SIZE: 11pt
}
A:link {
COLOR: blue; TEXT-DECORATION: underline; mso-style-priority: 99
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline; mso-style-priority: 99
}
A:visited {
COLOR: purple; TEXT-DECORATION: underline; mso-style-priority: 99
}
SPAN.MsoHyperlinkFollowed {
COLOR: purple; TEXT-DECORATION: underline; mso-style-priority: 99
}
SPAN.EmailStyle17 {
FONT-FAMILY: "Calibri","sans-serif"; COLOR: windowtext; mso-style-type: personal-compose
}
.MsoChpDefault {
mso-style-type: export-only
}
DIV.WordSection1 {
page: WordSection1
}
</STYLE>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></HEAD>
<BODY lang=EN-GB link=blue vLink=purple>
<DIV dir=ltr align=left><FONT color=#0000ff size=2
face=Arial></FONT> </DIV>
<DIV dir=ltr align=left><SPAN class=692145315-23032012><FONT color=#0000ff
size=2 face=Arial>Not sure, but you should consider running non-virtual
instances</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=692145315-23032012><FONT color=#0000ff
size=2 face=Arial>(not that hard to do) and using privilage separation such that
</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=692145315-23032012><FONT color=#0000ff
size=2 face=Arial>there is little potential for exposure of your
internal authentication</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=692145315-23032012><FONT color=#0000ff
size=2 face=Arial>structure or </FONT></SPAN><SPAN
class=692145315-23032012><FONT color=#0000ff size=2
face=Arial>internally-utilized crypto material to an
externally</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=692145315-23032012><FONT color=#0000ff
size=2 face=Arial>presented service.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=692145315-23032012><FONT color=#0000ff
size=2 face=Arial></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=692145315-23032012><FONT color=#0000ff
size=2 face=Arial>Also, it is possible to get your local users to have local
privileges</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=692145315-23032012><FONT color=#0000ff
size=2 face=Arial>when using their eduroam-formatted credentials on the
eduroam</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=692145315-23032012><FONT color=#0000ff
size=2 face=Arial>SSID, just a bit tricky.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=692145315-23032012><FONT color=#0000ff
size=2 face=Arial></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=692145315-23032012></SPAN><SPAN
class=692145315-23032012><FONT color=#0000ff size=2 face=Arial>Here we run 4
instances for eduroam, </FONT></SPAN><FONT face=Arial><FONT color=#0000ff><FONT
size=2>t<SPAN class=692145315-23032012>wo for IDP and two for
SP</SPAN></FONT></FONT></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial><FONT color=#0000ff><FONT size=2><SPAN
class=692145315-23032012>(one each 3.0 radsec proxy/filter and one 2.x
</SPAN></FONT></FONT></FONT><FONT face=Arial><FONT color=#0000ff><FONT
size=2><SPAN class=692145315-23032012>internal.) Only the
internal</SPAN></FONT></FONT></FONT></DIV>
<DIV dir=ltr align=left><SPAN class=692145315-23032012></SPAN><FONT
face=Arial><FONT color=#0000ff><FONT size=2>s<SPAN
class=692145315-23032012>essions have any interaction with
LDAP/SQL/AD.</SPAN></FONT></FONT></FONT><BR></DIV>
<BLOCKQUOTE
style="BORDER-LEFT: #0000ff 2px solid; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; MARGIN-RIGHT: 0px">
<DIV dir=ltr lang=en-us class=OutlookMessageHeader align=left>
<HR tabIndex=-1>
<FONT size=2 face=Tahoma><B>From:</B>
freeradius-users-bounces+bjulin=clarku.edu@lists.freeradius.org
[mailto:freeradius-users-bounces+bjulin=clarku.edu@lists.freeradius.org] <B>On
Behalf Of </B>mark.leese@stfc.ac.uk<BR><B>Sent:</B> Friday, March 23, 2012
10:13 AM<BR><B>To:</B>
freeradius-users@lists.freeradius.org<BR><B>Subject:</B> can you internally
proxy a request more than once?<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV class=WordSection1>
<P class=MsoNormal>Hi,<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>I have been using FreeRADIUS to authenticate visitors onto
a wireless network using LDAP against Active Directory. I now need to also
deploy eduroam.<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>I thought it would be sensible to do this as two separate
virtual servers, so I created a new minimal ‘default’ server that proxies to a
‘visitors’ or ‘eduroam’ virtual server based on the wireless SSID, which the
wireless NAS adds to an attribute in the Access-Request. The default server
sets the Proxy-To-Realm attribute in the list of control items. The Realm then
maps to a home_server in proxy.conf which has an associated virtual server
e.g. <o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal> home_server virtual_server_for_eduroam
{<o:p></o:p></P>
<P class=MsoNormal> type =auth+acct<o:p></o:p></P>
<P class=MsoNormal> virtual_server = eduroam<o:p></o:p></P>
<P class=MsoNormal> }<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal> home_server_pool virtual_server_for_eduroam_pool
{<o:p></o:p></P>
<P class=MsoNormal> home_server =
virtual_server_for_eduroam<o:p></o:p></P>
<P class=MsoNormal> }<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal> realm EDUROAM_VIRTUAL_SERVER {<o:p></o:p></P>
<P class=MsoNormal> pool =
virtual_server_for_eduroam_pool<o:p></o:p></P>
<P class=MsoNormal> }<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>The ‘visitors’ virtual server works fine.<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>The ‘eduroam’ virtual server proxies the Access-Request to
LOCAL or our National RADIUS Proxy Servers depending on whether the realm in
the User-Name attribute is our realm or not. Local authentications are
performed against Active Directory, and so we are using PEAP-MS-CHAPv2. For
local authentications the inner MS-CHAPv2 authentications are proxied to the
‘inner-tunnel’ virtual server.<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>If (for testing) I configure clients.conf so that
Access-Requests from the wireless NAS are always sent to the ‘eduroam’ virtual
server, then it works fine. The ‘eduroam’ virtual server doesn’t work if it is
called from the new ‘default’ server using internal proxying. In that case I
get an error saying “Multiple levels of TLS nesting is
invalid”.<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>I’m running FreeRADIUS 2.1.11.<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>I may not have provided enough detail, but am I doing
something that obviously won’t work? I don’t know if it’s possible to
internally proxy a request more than once, e.g. to two different virtual
servers. If it isn’t possible, do I have any other options? Would a solution
be to make the virtual servers listen on two different IP addresses, and
configure the NAS to use a different RADIUS server IP address for each SSID?
Alternatively, could the NAS continue to send all RADIUS packets to one IP
address, and the default server proxy to virtual servers listening on
different IP addresses?<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>Thanks in advance of any help you can give,<o:p></o:p></P>
<P class=MsoNormal>Have a good weekend,<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>Mark.<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P></DIV><BR>
<P>-- <BR>Scanned by iCritical. </P><BR></BLOCKQUOTE></BODY></HTML>