Identifying Virtual-Server from Inner-Tunnel
I’m still fairly new at FreeRADIUS. Running 2.1.10 (we are planning our upgrade shortly). Kind of a two pronged question here...I'm encountering a particular issue, but also would like to hear if my broad approach is suitable. I am attempting to do the following: - Use one FreeRADIUS server to authenticate for two different 802.1X networks (EAP-PEAP / MSCHAP). - Both will use the mschap module to interface with Microsoft Active Directory. - The first 802.1X network will authenticate against DOMAIN1, the second against both DOMAIN1 and DOMAIN2. The first network should reject authentication attempts from DOMAIN2. - All usernames are specified with a full realm / fqdn. - The RADIUS clients (wireless access points) will all be the same for the two networks. What (I think) is the solution: - In order for FreeRADIUS to distinguish what set of users (DOMAIN1 or DOMAIN1/2) to authenticate against, I have setup two virtual servers listening on different ports and (obviously) different names. (working) - The clients connect to FreeRADIUS over a different port depending on the network they're attempting to connect to. (working) - Setup realms for both DOMAIN1 and DOMAIN2 to have them both authenticate locally. (working) - Setup two mschap modules to call ntlm_auth command with the proper DOMAIN string. (working) - Depending on the realm provided, call a different mschap module from the inner-tunnel. (working) - Depending on the virtual server the request was received through, call a different mschap module from the inner-tunnel or reject the request. (not working) If there's a better/cleaner/simpler way to do this, I'm all ears. My issue: Since its EAP-PEAP, the request passes through the outer and inner-tunnel virtual servers. In my inner-tunnel, I'm doing an IF on the Realm. That seems to be evaluating properly if I look at the debug logs. If I do an IF on Virtual-Server it comes back with 'inner-tunnel'. If I do outer.request:Virtual-Server it oddly also comes back with 'inner-tunnel'. How do I see the actual virtual-server? Should I need to set a separate variable in the outer-server and read it below? Here is my attempted code in "server inner-tunnel" authenticate { Auth-Type MS-CHAP { if ("%{outer.request:Virtual-Server}" == "secure") { mschap_domain1 } else { if ("%{Realm}" == "domain1.fqdn.org") { mschap_domain1 } elsif ("%{Realm}" == "domain2.fqdn.org") { mschap_domain2 } } } eap } In my debug logs: Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +- entering group MS-CHAP {...} Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ++? if ("%{outer.request:Virtual-Server}" == "secure") Thu Oct 4 13:05:18 2012 : Info: [mschapv2] expand: %{outer.request:Virtual-Server} -> inner-tunnel Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ? Evaluating ("%{outer.request:Virtual-Server}" == "secure") -> FALSE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ++? if ("%{outer.request:Virtual-Server}" == "secure") -> FALSE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ++- entering else else {...} Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +++? if ("%{Realm}" == "domain1.fqdn.org") Thu Oct 4 13:05:18 2012 : Info: [mschapv2] expand: %{Realm} -> domain2.fqdn.org Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ? Evaluating ("%{Realm}" == "domain1.fqdn.org") -> FALSE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +++? if ("%{Realm}" == "domain1.fqdn.org") -> FALSE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +++? elsif ("%{Realm}" == "domain2.fqdn.org") Thu Oct 4 13:05:18 2012 : Info: [mschapv2] expand: %{Realm} -> domain2.fqdn.org Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ? Evaluating ("%{Realm}" == "domain2.fqdn.org") -> TRUE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +++? elsif ("%{Realm}" == "domain2.fqdn.org") -> TRUE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +++- entering elsif ("%{Realm}" == "domain2.fqdn.org") {...} Any suggestions for what I'm doing wrong or maybe a better way to tackle it? Thanks, Jordan Dohms
On Thu, Oct 04, 2012 at 01:07:57PM -0600, Jordan Dohms wrote:
- Depending on the virtual server the request was received through, call a different mschap module from the inner-tunnel or reject the request. (not working)
You've gone to the hassle of duplicating RADIUS server configs in your clients and sending requests to different ports, so you could do your check based on Packet-Dst-Port.
If there's a better/cleaner/simpler way to do this, I'm all ears.
If there is something in the packet that can indicate which network is being connected to, you likely don't need to use two ports as you can just do it all in one server (testing based on that attribute). For example, with wireless networks, you can usually get the SSID in the request somehow.
virtual-server? Should I need to set a separate variable in the outer-server and read it below?
I guess that's another way of doing it. Personally unless functionality was a lot different (which it doesn't sound like it is), I'd probably do it all in one outer server and test based on request attribute or Packet-Dst-Port, but if it works then it's OK. Cheers Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Exactly what I needed, thank you. This worked perfectly....and needs just one virtual-server. if ("%{outer.request:Packet-Dst-Port}" == "1912") { } elsif ("%{outer.request:Packet-Dst-Port}" == "1812") { } On Thu, Oct 4, 2012 at 4:21 PM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Thu, Oct 04, 2012 at 01:07:57PM -0600, Jordan Dohms wrote:
- Depending on the virtual server the request was received through, call a different mschap module from the inner-tunnel or reject the request. (not working)
You've gone to the hassle of duplicating RADIUS server configs in your clients and sending requests to different ports, so you could do your check based on Packet-Dst-Port.
If there's a better/cleaner/simpler way to do this, I'm all ears.
If there is something in the packet that can indicate which network is being connected to, you likely don't need to use two ports as you can just do it all in one server (testing based on that attribute). For example, with wireless networks, you can usually get the SSID in the request somehow.
virtual-server? Should I need to set a separate variable in the outer-server and read it below?
I guess that's another way of doing it. Personally unless functionality was a lot different (which it doesn't sound like it is), I'd probably do it all in one outer server and test based on request attribute or Packet-Dst-Port, but if it works then it's OK.
Cheers
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 10/04/2012 08:07 PM, Jordan Dohms wrote:
Since its EAP-PEAP, the request passes through the outer and inner-tunnel virtual servers. In my inner-tunnel, I'm doing an IF on the Realm. That seems to be evaluating properly if I look at the debug logs. If I do an IF on Virtual-Server it comes back with 'inner-tunnel'. If I do outer.request:Virtual-Server it oddly also comes back with 'inner-tunnel'. How do I see the actual virtual-server?
You can't. "Virtual-Server" is a virtual attribute, not a real one. It doesn't exist in the packet. It's *always* calculated off the current request, which is always the one in "inner-tunnel", even if you reference the "outer.request" list. YOu'll need to do it another way, as Matthew suggested.
participants (3)
-
Jordan Dohms -
Matthew Newton -
Phil Mayers