Help with eduroam proxying config
Hello, With this config, I want to say: anyuser@anything.edu should go to eduroam, but I get a warning that it wont be the case.. What's the correct config: Thanks a lot, Mohamed. proxy.conf: home_server eduroam1 { type = auth ipaddr = tlrs1.eduroam.us port = 1645 secret = eduroam_radius_secret } home_server eduroam2 { type = auth ipaddr = tlrs2.eduroam.us port = 1645 secret = eduroam_radius_secret } home_server_pool eduroam { type = fail-over home_server = eduroam1 home_server = eduroam2 } realm LOCAL { } realm NULL { } realm georgetown.edu { } realm gu.edu { } realm "~(.*\\.)+edu$" { nostrip auth_pool = eduroam } realm DEFAULT{ nostrip } radius/radacct/172.17.0.187/auth-detail-20150311 (0) auth_log : EXPAND %t (0) auth_log : --> Wed Mar 11 14:32:10 2015 (0) [auth_log] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Looking up realm "foo.edu" for User-Name = "ml623@foo.edu" (0) suffix : Found realm "~(.*\.)+edu$" (0) suffix : Adding Realm = "foo.edu" (0) suffix : Proxying request from user ml623@foo.edu to realm ~(.*\.)+edu$ (0) suffix : Preparing to proxy authentication request to realm "~(.*\.)+edu$" (0) [suffix] = updated (0) if ("%{Realm}" != 'NULL' && "%{Realm}" != 'LOCAL' && "%{Realm}" !~ /\\.edu$/) (0) EXPAND %{Realm} (0) --> foo.edu (0) EXPAND %{Realm} (0) --> foo.edu (0) EXPAND %{Realm} (0) --> foo.edu (0) if ("%{Realm}" != 'NULL' && "%{Realm}" != 'LOCAL' && "%{Realm}" !~ /\\.edu$/) -> FALSE (0) eap : EAP packet type response id 0 length 18 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) WARNING: You set Proxy-To-Realm = DEFAULT, but it is a LOCAL realm! Cancelling proxy request. (0) Found Auth-Type = EAP
Hi,
realm "~(.*\\.)+edu$" { nostrip auth_pool = eduroam }
urgh. use unlang instead in the authorize section use update for the control to assign the Proxy-To-Realm to "eduroam" (theres plenty of docs out there showing how this is done in eduroam community) you can then ensure , via unlang, that all badjunk gets ditched/rejected rather than sent to DEFAULT (which , for a lot of badly configured sites, is just the upstream proxy) alan
On 11 Mar 2015, at 14:46, Mohamed Lrhazi <Mohamed.Lrhazi@georgetown.edu> wrote:
Hello,
With this config, I want to say: anyuser@anything.edu should go to eduroam, but I get a warning that it wont be the case.. What's the correct config:
Thanks a lot, Mohamed.
proxy.conf:
home_server eduroam1 { type = auth ipaddr = tlrs1.eduroam.us port = 1645 secret = eduroam_radius_secret } home_server eduroam2 { type = auth ipaddr = tlrs2.eduroam.us port = 1645 secret = eduroam_radius_secret }
Why 1645 and not 1812?
home_server_pool eduroam { type = fail-over home_server = eduroam1 home_server = eduroam2 }
realm LOCAL { } realm NULL { } realm georgetown.edu { } realm gu.edu { }
realm "~(.*\\.)+edu$" { nostrip auth_pool = eduroam }
This isn’t being a good eduroam neighbour as you will send all kinds of crap upstream, but more importantly eduroam ISN’T JUST EDU. I’d use the approach of: In proxy.conf: realm eduroam { auth_pool = eduroam nostrip } Then in your authorize section something like: if("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) { if(!"%{2}" || ("%{2}" =~ /.*georgetown\.edu$/i) ) { update request { #Stripped-User-Name := "%{1}" Realm := "local" } if(!"%{2}" && ("%{User-Name}" =~ /^@/) && ("%{User-Name}" !~ /georgetown\\.edu$/i) ) { update request { #Stripped-User-Name := "%{1}" Realm := "eduroam" } update control { Proxy-To-Realm := "eduroam" } } } else{ update request { #Stripped-User-Name := "%{1}@%{2}" Realm := "%{2}" } } } regards Scott Armitage
Thanks a lot guys, we'll try those suggestions and be back :) My first try at freeradius, just figuring out the basics... seeing how requests would be routed based on username and so on... Mohamed. On Wed, Mar 11, 2015 at 10:59 AM, Scott Armitage <S.P.Armitage@lboro.ac.uk> wrote:
On 11 Mar 2015, at 14:46, Mohamed Lrhazi <Mohamed.Lrhazi@georgetown.edu> wrote:
Hello,
With this config, I want to say: anyuser@anything.edu should go to eduroam, but I get a warning that it wont be the case.. What's the correct config:
Thanks a lot, Mohamed.
proxy.conf:
home_server eduroam1 { type = auth ipaddr = tlrs1.eduroam.us port = 1645 secret = eduroam_radius_secret } home_server eduroam2 { type = auth ipaddr = tlrs2.eduroam.us port = 1645 secret = eduroam_radius_secret }
Why 1645 and not 1812?
home_server_pool eduroam { type = fail-over home_server = eduroam1 home_server = eduroam2 }
realm LOCAL { } realm NULL { } realm georgetown.edu { } realm gu.edu { }
realm "~(.*\\.)+edu$" { nostrip auth_pool = eduroam }
This isn’t being a good eduroam neighbour as you will send all kinds of crap upstream, but more importantly eduroam ISN’T JUST EDU. I’d use the approach of:
In proxy.conf:
realm eduroam { auth_pool = eduroam nostrip }
Then in your authorize section something like:
if("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) {
if(!"%{2}" || ("%{2}" =~ /.*georgetown\.edu$/i) ) { update request { #Stripped-User-Name := "%{1}" Realm := "local" } if(!"%{2}" && ("%{User-Name}" =~ /^@/) && ("%{User-Name}" !~ /georgetown\\.edu$/i) ) { update request { #Stripped-User-Name := "%{1}" Realm := "eduroam" } update control { Proxy-To-Realm := "eduroam" } } } else{ update request { #Stripped-User-Name := "%{1}@%{2}" Realm := "%{2}" } } }
regards
Scott Armitage
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I documented my first working config as a runnable docker image, in case it's useful to anyone: https://github.com/lrhazi/freeradius-eduroam Thanks, Mohamed. On Wed, Mar 11, 2015 at 11:27 AM, Mohamed Lrhazi < Mohamed.Lrhazi@georgetown.edu> wrote:
Thanks a lot guys, we'll try those suggestions and be back :)
My first try at freeradius, just figuring out the basics... seeing how requests would be routed based on username and so on...
Mohamed.
On Wed, Mar 11, 2015 at 10:59 AM, Scott Armitage <S.P.Armitage@lboro.ac.uk
wrote:
On 11 Mar 2015, at 14:46, Mohamed Lrhazi <Mohamed.Lrhazi@georgetown.edu> wrote:
Hello,
With this config, I want to say: anyuser@anything.edu should go to eduroam, but I get a warning that it wont be the case.. What's the correct config:
Thanks a lot, Mohamed.
proxy.conf:
home_server eduroam1 { type = auth ipaddr = tlrs1.eduroam.us port = 1645 secret = eduroam_radius_secret } home_server eduroam2 { type = auth ipaddr = tlrs2.eduroam.us port = 1645 secret = eduroam_radius_secret }
Why 1645 and not 1812?
home_server_pool eduroam { type = fail-over home_server = eduroam1 home_server = eduroam2 }
realm LOCAL { } realm NULL { } realm georgetown.edu { } realm gu.edu { }
realm "~(.*\\.)+edu$" { nostrip auth_pool = eduroam }
This isn’t being a good eduroam neighbour as you will send all kinds of crap upstream, but more importantly eduroam ISN’T JUST EDU. I’d use the approach of:
In proxy.conf:
realm eduroam { auth_pool = eduroam nostrip }
Then in your authorize section something like:
if("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) {
if(!"%{2}" || ("%{2}" =~ /.*georgetown\.edu$/i) ) { update request { #Stripped-User-Name := "%{1}" Realm := "local" } if(!"%{2}" && ("%{User-Name}" =~ /^@/) && ("%{User-Name}" !~ /georgetown\\.edu$/i) ) { update request { #Stripped-User-Name := "%{1}" Realm := "eduroam" } update control { Proxy-To-Realm := "eduroam" } } } else{ update request { #Stripped-User-Name := "%{1}@%{2}" Realm := "%{2}" } } }
regards
Scott Armitage
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Mohamed Lrhazi -
Scott Armitage