<div dir="ltr">Hi Alan and thanks for the reply.<br><div><div class="gmail_extra"><br><br><div class="gmail_quote">On 12 October 2013 13:42, Alan DeKok <span dir="ltr"><<a href="mailto:aland@deployingradius.com" target="_blank">aland@deployingradius.com</a>></span> wrote:<br>
<div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="im">> So far, I managed to do the dynamic VLAN assignment, but cannot seem to<br>
> get it to work together with the MAC checking.<br>
</div> </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Get them working independently. Then, put the pieces together. </blockquote><div><br>I managed to get them to work independently, it's the putting together phase that I can't quite crack... :)<br> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div class="im">
> I can get an auth to be refused if the MAC is not listed in the<br>
> authorized_macs file, but can't quite put the two things together.<br>
> Perhaps I am a bit confused with regards to where to put the MAC check.<br>
<br>
</div> Put it into "authorize".<br>
<div class="im"><br></div></blockquote><div>If I put the MAC check in the authorize section, then I can allow users to use only the devices in the authorized_macs file (unless I am missing something). I would like the users to use any device, but just have a limited access to the network if the device isn't listed in the authorized_macs file...<br>
<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="im">
> For now, I just managed to get the check to work only on the<br>
> authorization phase in sites-enabled/default, but then the VLAN<br>
> assignment, which is done in the internal-tunnel, seems to overwrite my<br>
> changes.<br>
<br>
</div> That can be fixed.<br>
<div class="im"><br>
> So I tried to put the MAC check in the post-auth section in the default<br>
> file, but the MAC check doesn't seem to ever work.<br>
<br>
</div> Because the "users" file works differently there.<br></blockquote><div><br></div><div>Can you point me to some part of the docs that explain what is different, please?<br> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div class="im"><br>
> Here are the relevant config files:<br>
<br>
</div> Which seem to use a reasonable approach.<br>
<div class="im"><br>
> As you can see, the device wasn't listed in the file, the authentication<br>
> went fine, saying that the tunnel that I should get has ID 40, but that<br>
> wasn't overwritten by the authorized_macs check...<br>
<br>
</div> I think part of the problem is you're juggling a lot. You also<br>
mentioned MACs and VLANs... and then halfway through the message "Oh,<br>
there's an inner-tunnel, too".<br>
<br>
Stop with all of your solutions. Instead, write down exactly what you<br>
have. Write down what you want to happen in plain English. Write down<br>
what should happen, and when. Then, convert it to the configuration.<br>
<br>
Your system is using TTLS. OK... I'll ignore the question of *why*<br>
you're authenticating unknown MACs. That seems weird.<br></blockquote><div> </div><div>What I am trying to achieve is the following:<br></div><div>1. Authenticate the users through LDAP<br></div><div>2. IF the user is using a device listed in the authorized_macs file, then assign a VLAN which depends on the user's LDAP group.<br>
</div><div>3. IF the user is using another (their own), allow them to access an "isolated" VLAN, which doesn't allow the device to talk to our servers.<br><br></div><div>This will allow my colleagues to connect to the Internet with their devices, but not to mess around with our servers in case there is malware installed on them.<br>
<br>Does this make sense?<br></div><div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
The debug log shows this:<br>
<div class="im"><br>
[ttls] Got tunneled reply code 2<br>
Tunnel-Type:0 = VLAN<br>
Tunnel-Medium-Type:0 = IEEE-802<br>
Tunnel-Private-Group-Id:0 = "40"<br>
<br>
</div> Where did that VLAN come from? Why is it there? If you don't know,<br>
that's a huge problem.<br></blockquote><div><br></div><div>SO SORRY! I pasted twice the sites-available/default file! <br><br></div><div>It comes from the post-auth section in the inner-tunnel file. <br></div><div>In inner-tunnel, I check if the user belongs to the dept_tech_corporate_it group, and if so, I update the outher request by assigning a VLAN with ID 40.<br>
<br></div><div>This part of the config works properly, as showed by the following few lines of debug output:<br></div><div><br>rlm_ldap::ldap_groupcmp: User found in group cn=dept_tech_corporate_it,ou=<div>Groups,c=gb,dc=mindcandy,dc=com<br>
[ldap] ldap_release_conn: Release Id: 0<br>? Evaluating (LDAP-Group == "cn=dept_tech_corporate_it,ou=Groups,c=gb,dc=mindcandy,dc=com") -> TRUE</div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
Generally, the policies should be arranged like this:<br>
<br>
authorize: allow only known kinds of authentication<br>
decide which authentication method to use<br>
grab "known good" passwords<br>
<br>
authenticate: run authentication methods<br>
<br>
post-auth: return attributes for a successfully authenticated user<br>
<br>
<br>
In your case, I'd say return to a default configuration. Then, get<br>
the MAC address filtering working in post-auth. Once that's working,<br>
add VLAN assignment.<br></blockquote><div><br></div><div>That seems to be an approach similar to the one I am trying to use. I would like to do the check of the MAC address for last, so that I can associate the right VLAN to the user. But for some reason this check doesn't seem to work. <br>
</div><br></div><div class="gmail_quote">I guess at the end of the day my question boils down to the following: where should I put the MAC check, so that the user gets assigned to the right VLAN?<br></div><div class="gmail_quote">
If I put it in the authorize part of sites-enabled/default, the VLAN update request will get overwritten by the post-auth part of sites-enabled/inner-tunnel; and if I put it in the post-auth of the file sites-enabled/default file (which gets executed after inner-tunnel), the authorized_macs function always returns noop.<br>
</div><div class="gmail_quote"><br>If I could get any pointers towards a working solution, I'd be really grateful.<br><br></div><div class="gmail_quote">Thanks,<br>Fabrizio <br></div></div></div></div>