Hello, I'm using freeradius 3.0.10 to authenticate eduroam connections. In my inner server I return attributes to assign VLAN to our internal users and I want these attributes to be filtered when the connection is from an external organization. So in the outer server I have: post-proxy { eduroam_log files_eduroam_outer.authorize attr_filter.post-proxy } and in the attr_filter.post-proxy file I have: DEFAULT Service-Type == Framed-User, Service-Type == Login-User, Login-Service == Telnet, Login-Service == Rlogin, Login-Service == TCP-Clear, Login-TCP-Port <= 65536, Framed-IP-Address == 255.255.255.254, Framed-IP-Netmask == 255.255.255.255, Framed-Protocol == PPP, Framed-Protocol == SLIP, Framed-Compression == Van-Jacobson-TCP-IP, Framed-MTU >= 576, Framed-Filter-ID =* ANY, Reply-Message =* ANY, Proxy-State =* ANY, EAP-Message =* ANY, Message-Authenticator =* ANY, MS-MPPE-Recv-Key =* ANY, MS-MPPE-Send-Key =* ANY, MS-CHAP-MPPE-Keys =* ANY, State =* ANY, Session-Timeout <= 28800, Idle-Timeout <= 600, Calling-Station-Id =* ANY, Operator-Name =* ANY, Port-Limit <= 2, GSS-Acceptor-Service-Name =* ANY, GSS-Acceptor-Host-Name =* ANY, GSS-Acceptor-Service-Specifics =* ANY, GSS-Acceptor-Realm-Name =* ANY, SAML-AAA-Assertion =* ANY, EAP-Channel-Binding-Message =* ANY According to attr_filter documentation, if I don't have the Tunnel-Private-Group-Id in this file, then the attribute should be filtered, isn't it? But, the attribute is not being filtered. It is returned to my upper radius server. Any help? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337
Hi,
I'm using freeradius 3.0.10 to authenticate eduroam connections.
In my inner server I return attributes to assign VLAN to our internal users and I want these attributes to be filtered when the connection is from an external organization.
then best common practice is to create a new set of virtual servers (eg eduroam and eduroam-inner-tunnel) and then any requests from your national proxy servers get sent to those instead.....and all that set of servers do is authenticate users and dont set VLANs etc - thus you have a very easy, controlled policy AND you arent looking up group membership etc etc - whereas what you propose is still looking up group membership and then filtering it out (very inefficient!) alan
Hi, the filtering does not work also in freeradius 2.1.12, here at our university we have the same problem with VLAN infos and tried the same solution, filtering out the VLAN atributes via attr_filter ..... our frerradius are still sending that info out to the proxy. Our post-proxy: post-proxy { attr_filter.post-proxy eap } Our attrs: DEFAULT Service-Type == Login-User, Framed-MTU >= 576, Framed-Filter-ID =* ANY, Reply-Message =* ANY, Proxy-state =* ANY, Port-Limit <= 2, MS-MPPE-Recv-Key =* ANY, MS-MPPE-Send-Key =* ANY, User-Name =* ANY, EAP-Message =* ANY, Message-Authenticator =* ANY, Called-Station-Id =* ANY, Calling-Station-Id =* ANY, NAS-Port-Type =* ANY, NAS-Port =* ANY, State =* ANY, NAS-IP-Address =* ANY, NAS-Identifier =* ANY, Proxy-State =* ANY Any help regarding how to correctly configure it is welcomed. Thanks, Josu. 2015-11-24 15:48 GMT+01:00 <A.L.M.Buxey@lboro.ac.uk>:
Hi,
I'm using freeradius 3.0.10 to authenticate eduroam connections.
In my inner server I return attributes to assign VLAN to our internal users and I want these attributes to be filtered when the connection is from an external organization.
then best common practice is to create a new set of virtual servers (eg eduroam and eduroam-inner-tunnel) and then any requests from your national proxy servers get sent to those instead.....and all that set of servers do is authenticate users and dont set VLANs etc - thus you have a very easy, controlled policy AND you arent looking up group membership etc etc - whereas what you propose is still looking up group membership and then filtering it out (very inefficient!)
alan
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Angel L. Mateo -
Josu Gil Arriortua