Get inner tunnel attributes to outer server for logging.
Firstly: "FreeRADIUS Version 3.0.16, for host x86_64-pc-linux-gnu" We are using MsCHAPv2 over TLS. I've been trying to get the inner-tunnel username and module failure message back to the "outer" session similar to this situation: http://lists.freeradius.org/pipermail/freeradius-users/2014-December/074994.... or this: http://lists.freeradius.org/pipermail/freeradius-users/2014-December/074961.... I have read a lot of the archived posts but am still not sure what's the "right" way of doing it. I have got most of it working except when the user is rejected by the inner tunnel. To be clearer, we want the inner-tunnel username to be available for the linelog and to go in to the postauth table. Is there some sort of definitive howto for this? It seems to be a common situation.
Just use inland to copy the stuff to outer: when in inner. The default inner-tunnel had such an example alan On Wed, 30 May 2018, 16:47 Dom Latter, <freeradius-users@latter.org> wrote:
Firstly: "FreeRADIUS Version 3.0.16, for host x86_64-pc-linux-gnu"
We are using MsCHAPv2 over TLS.
I've been trying to get the inner-tunnel username and module failure message back to the "outer" session similar to this situation:
http://lists.freeradius.org/pipermail/freeradius-users/2014-December/074994.... or this:
http://lists.freeradius.org/pipermail/freeradius-users/2014-December/074961....
I have read a lot of the archived posts but am still not sure what's the "right" way of doing it. I have got most of it working except when the user is rejected by the inner tunnel.
To be clearer, we want the inner-tunnel username to be available for the linelog and to go in to the postauth table.
Is there some sort of definitive howto for this? It seems to be a common situation.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 30/05/18 17:07, Alan Buxey wrote:
Just use inland to copy the stuff to outer: when in inner. The default inner-tunnel had such an example
Yes, the copying back works as long as the inner-tunnel authentication works. If the user is rejected then the username does not get passed back, although the failure message does. I've got the following lines in "Post-Auth-Type REJECT {" update outer.session-state { Module-Failure-Message := &request:Module-Failure-Message } update outer.request { User-Name := &request:User-Name } update outer.reply { User-Name := &request:User-Name } and in addition the two User-Name ones are also in "post-auth {" and "authenticate {". NB to potential respondees I won't be back on this project again until next week...
On 30/05/18 17:15, Dom Latter wrote:
On 30/05/18 17:07, Alan Buxey wrote:
Just use inland to copy the stuff to outer: when in inner. The default inner-tunnel had such an example
Yes, the copying back works as long as the inner-tunnel authentication works. If the user is rejected then the username does not get passed back, although the failure message does.
I put this in the inner tunnel post-auth section: update outer.session-state { &User-Name = &User-Name } mods-enabled/linelog has something like: Access-Accept = "%S %{reply:Packet-Type} %{%{session-state:User- Name}:-%{%{reply:User-Name}:-%{request:User-Name}}} %{Calling- Station-Id} <snip the rest> mods-config/sql/main/mysql/queries.conf has sql_user_name = "%{%{session-state:User-Name}:-%{%{reply:User-Name}:-% {request:User-Name}}}" and that seems to more or less do the job. The SQL query that is part of the post-authentication in the "outer" layer now uses: WHERE u.username = '%{%{reply:User-Name}:-%{request:User-Name}}' which again seems fine. I read something in the list archive about it being a bad idea to use "use_tunneled_reply" when using mschapv2 - should I worry about this?
On 05/06/18 17:51, Alan DeKok wrote:
On Jun 5, 2018, at 12:28 PM, Dom Latter <freeradius-users@latter.org> wrote:
I read something in the list archive about it being a bad idea to use "use_tunneled_reply" when using mschapv2 - should I worry about this?
No.
Alan DeKok.
Thanks Alan.
participants (3)
-
Alan Buxey -
Alan DeKok -
Dom Latter