<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><title>Inner tunnel post auth question</title><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>My FR version is 2.1.10+dfsg-3build2_amd64. Unless there’s a nice package for Ubuntu 12.04 server then I’ll be compiling from source then I think. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>This is the peap bit of eap.conf :<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>peap {<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> default_eap_type = mschapv2<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> copy_request_to_tunnel = yes<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> use_tunneled_reply = yes<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> # proxy_tunneled_request_as_eap = yes<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> virtual_server = "inner-tunnel"<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>so yes, the “use_tunneled reply” bit is there. Is that what’s causing the copying of attributes from within the tunnel to fail, or is that setting what it’s supposed to be? I’m still getting my head around the eap thing – like for example why I need authorization and authentication settings in the inner-tunnel virtual server for eap again – my intuition would tell me that the inner eap just needs mschap in there if that’s the protocol inside the tunnel, but then perhaps it’s something to do with the “protection” bit of peap that means it’s a “tunnel within a tunnel” or something. Like I said still getting my head around it all.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I’d still like to get the attributes copying from the inner to outer tunnels regardless of the fix in 2.2. It’s gnawing at me a bit.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Thanks<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Andy<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] <b>On Behalf Of </b>Alex Sharaz<br><b>Sent:</b> 10 May 2013 14:09<br><b>To:</b> FreeRadius users mailing list<br><b>Subject:</b> Re: Inner tunnel post auth question<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Andy,<o:p></o:p></p><div><p class=MsoNormal>What version of FreeRadius are you using?<o:p></o:p></p></div><div><p class=MsoNormal>I *think* that unless you are using the git source for 2.2.1, post-auth reject is broken. There was some stuff I was doing a few months ago that got fixed in 2.2.1 … but I'm getting old and can't remember all the details :-(<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>On 10 May 2013, at 13:53, Franks Andy (RLZ) IT Systems Engineer <<a href="mailto:Andy.Franks@sath.nhs.uk">Andy.Franks@sath.nhs.uk</a>> wrote:<o:p></o:p></p></div><p class=MsoNormal><br><br><o:p></o:p></p><div><p><span style='font-family:"Calibri","sans-serif"'>Hi,</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'> This may have come up before but I can’t find any solutions :</span> <o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'>I’m using a NAS which always</span> <span style='font-family:"Calibri","sans-serif"'>performs EAP/MSCHAP2 authentication, so I’ve stripped the sites-enabled/default right down to pretty much just include the eap stuff for authorisation/authentication, and am doing all the rest inside the inner tunnel</span> <span style='font-family:"Calibri","sans-serif"'>– fine.</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'>When the radius returns an access-accept, it runs the stuff in the</span> <span style='font-family:"Calibri","sans-serif"'>inner-tunnel</span> <span style='font-family:"Calibri","sans-serif"'>post_auth section ok, and I can record the attributes I want to a mysql db, including a custom ldap attribute inserted into a control variable.</span> <o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'>However it seems that following a reject, the post_auth reject section of inner-tunnel isn’t actually used, so it doesn’t record any info about the attributes in the sql database if I use an sql call.</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'>Ok .. so do it in the default post_auth reject bit</span> <span style='font-family:"Calibri","sans-serif"'>– ok</span> <span style='font-family:"Calibri","sans-serif"'>but I can’t figure how to pass back control variables to the outer tunnel. I’d imagine it should be</span> <span style='font-family:"Calibri","sans-serif"'>similar to the description in the post auth reject section of the inner tunnel :</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'>update outer.reply {</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'> User-Name = "%{request:User-Name}"</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'> </span> <span style='font-family:"Calibri","sans-serif"'>}</span><o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div></div><div><p class=MsoNormal>have u got <o:p></o:p></p></div><div><p class=MsoNormal>use_tunneled_reply = yes<o:p></o:p></p></div><div><p class=MsoNormal>set up in eap.conf?<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Rgds<o:p></o:p></p></div><div><p class=MsoNormal>Alex<o:p></o:p></p></div><p class=MsoNormal><br><br><o:p></o:p></p><div><p><span style='font-family:"Calibri","sans-serif"'>But the section never gets called, so I tried putting it after the ldap authorization bit, as I can’t do it in the authentication part, or so I gather (no unlang support in there?).</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'>In the below update,</span> <span style='font-family:"Calibri","sans-serif"'>ldap-UserDescription is my custom attribute, which</span> <span style='font-family:"Calibri","sans-serif"'>I can see from the logs is being populated :</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'> [ldap] description -> Ldap-UserDescription == "test ip phone"</span><o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><p><span style='font-family:"Calibri","sans-serif"'>Authorize {</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'>..</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'>..</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'>ldap</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'> update outer.control {</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'> Ldap-UserDescription := "%{control:Ldap-UserDescription}"</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'> }</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'>}</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'>But again it doesn’t make it through (or am I doing it wrong?)</span><o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><p><span style='font-family:"Calibri","sans-serif"'>+- entering group REJECT {...}</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'> expand: %{control:Ldap-UserDescription} -></span> <span style='font-family:"Calibri","sans-serif"'>:</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'>++[reply] returns noop</span><o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><p><span style='font-family:"Calibri","sans-serif"'>Am I being stupid? The best thing would be for the post_auth reject section in inner tunnel to run, but failing that I need to work out the control item passback to the outer tunnel.</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'>Thanks for any help in advance!</span><o:p></o:p></p><p><span style='font-family:"Calibri","sans-serif"'>Andy</span><o:p></o:p></p></div><p class=MsoNormal>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a><o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>