2009/9/26 Jacques FOUCHER
<jacques.foucher@gmail.com>
Hi,
I want to use eap to authenticate Wireless users on an radius server wich don't know EAP protocol. It seems that is possible to do that using a proxy freeradius. The architecture should be :
Access Point as a NAS Freeradius as a proxy Radius server without EAP
192.168.0.250 192.168.0.64 192.168.0.252
<-------------------------------EAP----------------------------------------->
<-----------------------------------MS-CHAP v2 or other-------------------------------------------------------------------->
The idea is to convert an EAP Response/Identity to a radius Access-Request without EAP inside
As the first radius i use freeradius Version 2.0.4
As the second one, i use IAS (just to test, but in the final configuration, it will not)
When i configure IAS with EAP method in Remote access Policy, it works. When I remove EAP method from IAS, it's not.
The problem is that freeradius is acting as a proxy without removing EAP and it is not what i want.
This is the modifications i did on configuration files, ask me if you need more
proxy.conf :
realm DEFAULT {
authhost = 192.168.0.252:1812
accthost = 192.168.0.252:1813
secret = secret
}
eap.conf :
ttls {
default_eap_type = md5
copy_request_to_tunnel = no
use_tunneled_reply = no
virtual_server = "inner-tunnel"
}
peap {
default_eap_type = mschapv2
copy_request_to_tunnel = no
use_tunneled_reply = no
proxy_tunneled_request_as_eap = no
virtual_server = "inner-tunnel"
}
On wireless, i tried TTLS and PEAP with same unsuccessfull result.
That is freeradius log :
Ready to process requests.
rad_recv: Access-Request packet from host 192.168.0.250 port 32769, id=30, length=229
Acct-Session-Id = "8b0b0795-0000009c"
NAS-Port = 157
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AP1"
NAS-IP-Address = 192.168.0.250
Framed-MTU = 1496
User-Name = "test"
Calling-Station-Id = "00-13-02-C4-80-4C"
Called-Station-Id = "00-0F-61-FE-EF-D2"
Service-Type = Framed-User
EAP-Message = 0x021a00090174657374
Colubris-AVPair = "ssid=test2"
Colubris-AVPair = "vsc-unique-id=3"
Colubris-AVPair = "phytype=IEEE802dot11g"
Colubris-Attr-250 = 0x00000000
Colubris-Attr-249 = 0x00000000
Message-Authenticator = 0x0ed85e6e5c0765e5390b037233c60d73
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
rlm_realm: No '@' in User-Name = "test", looking up realm NULL
rlm_realm: Found realm "DEFAULT"
rlm_realm: Adding Stripped-User-Name = "test"
rlm_realm: Adding Realm = "DEFAULT"
rlm_realm: Proxying request from user test to realm DEFAULT
rlm_realm: Preparing to proxy authentication request to realm "DEFAULT"
++[suffix] returns updated
rlm_eap: Request is supposed to be proxied to Realm DEFAULT. Not doing EAP.
++[eap] returns noop
++[unix] returns notfound
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Sending Access-Request of id 224 to 192.168.0.252 port 1812
Acct-Session-Id = "8b0b0795-0000009c"
NAS-Port = 157
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AP1"
NAS-IP-Address = 192.168.0.250
Framed-MTU = 1496
User-Name = "test"
Calling-Station-Id = "00-13-02-C4-80-4C"
Called-Station-Id = "00-0F-61-FE-EF-D2"
Service-Type = Framed-User
EAP-Message = 0x021a00090174657374
Colubris-AVPair = "ssid=test2"
Colubris-AVPair = "vsc-unique-id=3"
Colubris-AVPair = "phytype=IEEE802dot11g"
Colubris-Attr-250 = 0x00000000
Colubris-Attr-249 = 0x00000000
Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x3330
Proxying request 1 to home server 192.168.0.252 port 1812
Sending Access-Request of id 224 to 192.168.0.252 port 1812
Acct-Session-Id = "8b0b0795-0000009c"
NAS-Port = 157
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AP1"
NAS-IP-Address = 192.168.0.250
Framed-MTU = 1496
User-Name = "test"
Calling-Station-Id = "00-13-02-C4-80-4C"
Called-Station-Id = "00-0F-61-FE-EF-D2"
Service-Type = Framed-User
EAP-Message = 0x021a00090174657374
Colubris-AVPair = "ssid=test2"
Colubris-AVPair = "vsc-unique-id=3"
Colubris-AVPair = "phytype=IEEE802dot11g"
Colubris-Attr-250 = 0x00000000
Colubris-Attr-249 = 0x00000000
Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x3330
Going to the next request
Waking up in 0.9 seconds.
rad_recv: Access-Reject packet from host 192.168.0.252 port 1812, id=224, length=24
Proxy-State = 0x3330
+- entering group post-proxy
rlm_eap: No pre-existing handler found
++[eap] returns noop
Login incorrect (Home Server says so): [test/<no User-Password attribute>] (from client AP1 port 157 cli 00-13-02-C4-80-4C)
Found Post-Auth-Type Reject
+- entering group REJECT
expand: %{User-Name} -> test
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 1 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 1
Sending Access-Reject of id 30 to 192.168.0.250 port 32769
Waking up in 4.9 seconds.
On IAS Server, this is the error message (Sorry it is a french version, but the idea is IAS receive EAP message)
L'accès a été refusé à l'utilisateur test.
Nom-Complet-Utilisateur = jacques.net/Users/test
Adresse-IP-NAS = 192.168.0.250
Identificateur-NAS = AP1
Identificateur-Station-Appelée = 00-0F-61-FE-EF-D2
Identificateur-Station-Appelante = 00-13-02-C4-80-4C
Nom-Convivial-Client = freeradius
Adresse-IP-Client = 192.168.0.64
Type-Port-NAS = Wireless - IEEE 802.11
Port-NAS = 107
Proxy-Policy-Name = test
Authentication-Provider = Windows
Authentication-Server = <non déterminé>
Policy-Name = test
Authentication-Type = EAP
EAP-Type = <non déterminé>
Reason-Code = 66
Reason = L'utilisateur a essayé d'utiliser une méthode d'authentification qui n'est pas activée sur la stratégie d'accès à distance correspondante. Le nom de la stratégie d'accès à distance correspondante.
Pour plus d'informations, consultez le centre Aide et support à l'adresse http://go.microsoft.com/fwlink/events.asp.
I hope you could help me.
--
Jacques