Sending Reply-Message in Access-Reject (PEAP/MSCHAPv2)
Hello, Just looking for a bit of advice here. I've been setting up freeradius here recently, and whilst I'm mostly finished, there are a few points that still need to be addressed. The main one is sending a (semi) meaningful reply message when a user is rejected. Unfortunately, I'm having trouble figuring out how to return a Reply-Message from with in the inner tunnel. Well, to be more specific, returning that Reply-Message within the final Access-Reject. So far, I've figured that I can update outer.reply within the inner tunnel, but this gets sent out in an Access-Challenge follows the initial failure, but not subsequently. I've tried to put the update clause within Post-Auth-Type REJECT {}, both in the inner tunnel and outside as well, with no sucess (the inner one appears never to be called), the outer one has no knowledge of what was set in the inner one, so I could set an arbitrary message such as "failed", but I was hoping to be a little more helpful than that. Any pointers as to where to look/what to do, or even if this is possible, would be appreciated. Thanks in advance, Martin -- Martin Goldstone Keele University, Keele, IT Systems Administrator Staffordshire, United Kingdom, ST5 5BG Finance & IT Telephone: +44 1782 734457
On 24/05/11 12:16, Martin Goldstone wrote:
Hello,
Just looking for a bit of advice here. I've been setting up freeradius here recently, and whilst I'm mostly finished, there are a few points that still need to be addressed. The main one is sending a (semi) meaningful reply message when a user is rejected. Unfortunately, I'm having trouble figuring out how to return a Reply-Message from with in the inner tunnel. Well, to be more specific, returning that Reply-Message within the final Access-Reject.
Do you have this in eap.conf: eap { peap { use_tunneled_reply = yes } } ?
On 24/05/11 12:46, Phil Mayers wrote:
On 24/05/11 12:16, Martin Goldstone wrote:
Hello,
Just looking for a bit of advice here. I've been setting up freeradius here recently, and whilst I'm mostly finished, there are a few points that still need to be addressed. The main one is sending a (semi) meaningful reply message when a user is rejected. Unfortunately, I'm having trouble figuring out how to return a Reply-Message from with in the inner tunnel. Well, to be more specific, returning that Reply-Message within the final Access-Reject.
Do you have this in eap.conf:
eap { peap { use_tunneled_reply = yes } }
?
Yes, I have this in both the peap stanza and the ttls stanza. This seems to be fine when access is accepted, for example if I set a Reply-Message saying "Welcome" in the post-auth section of the inner-tunnel config, I see this in the final access-accept message. Also, the output from freeradius -X suggests that (in the case of a user rejection) it gets the reply from the tunnel and that tunneled authentication is rejected, but immediately after that it sends an Access-Challenge out, and then upon receipt of another Access-Request, goes in to peap, figures it has already rejected this one, and finally sends an Access-Reject, but without any Reply-Message I tried to set in the inner-tunnel. If I put something in the Post-Auth REJECT section of the outer tunnel, it works, but unfortunately at this point it has no idea of what it had previously set as a Reply-Message, so I can only send an arbitrary string, such as "Authentication Failure", which is a little obvious and unhelpful. Thanks -- Martin Goldstone Keele University, Keele, IT Systems Administrator Staffordshire, United Kingdom, ST5 5BG Finance & IT Telephone: +44 1782 734457
On 24/05/11 15:23, Martin Goldstone wrote:
Yes, I have this in both the peap stanza and the ttls stanza. This seems to be fine when access is accepted, for example if I set a Reply-Message saying "Welcome" in the post-auth section of the inner-tunnel config, I see this in the final access-accept message. Also, the output from freeradius -X suggests that (in the case of a user rejection) it gets the reply from the tunnel and that tunneled
Ah, damn... I've just remembered - the PEAP code doesn't save the attributes on reject :o( As you mentioned in your original email, the outer tunnel code doesn't have any of the "useful" info so can only set a generic message.
Hi,
On 24/05/11 15:23, Martin Goldstone wrote:
Yes, I have this in both the peap stanza and the ttls stanza. This seems to be fine when access is accepted, for example if I set a Reply-Message saying "Welcome" in the post-auth section of the inner-tunnel config, I see this in the final access-accept message. Also, the output from freeradius -X suggests that (in the case of a user rejection) it gets the reply from the tunnel and that tunneled
Ah, damn...
I've just remembered - the PEAP code doesn't save the attributes on reject :o(
As you mentioned in your original email, the outer tunnel code doesn't have any of the "useful" info so can only set a generic message.
....For EAP methods with tunneled authentication sessions (i.e. PEAP and EAP-TTLS), the inner tunnel session can also reference "outer.request", "outer.reply", and "outer.control". Those references allow you to address the relevant list in the outer tunnel session. so, in inner-tunnel post-auth, set "outer.reply" to be whatever you want.. you can then, in the outer layer, query/check or use that reply. alan
so, in inner-tunnel post-auth, set "outer.reply" to be whatever you want.. you can then, in the outer layer, query/check or use that reply.
There's an additional round trip after the failure which is why Phil said it needs to be saved. I had a patch to save/restore it; but, it needs rework and I don't have the time to do it now.. :-(
participants (4)
-
Alan Buxey -
Garber, Neal -
Martin Goldstone -
Phil Mayers