MSCHAPv2 use_tunneling_reply problem
Hi all! I have a problem with users using the anonymous identity field during connecting. It turned out that for privacy reasons it is hidden outside of the tunnel. I found that by setting use_tunneling_reply to yes i can "transfer" the inner username outside of the tunnel, and the correct (not anonymous) username will appear in the accounting records. I've uncommented even the update outer.reply... part in the sites-enabled/inner-tunnel file. Unfortunatelly it does not work. Is there anything else, what i need to do to get it work? I use coovachilli for nas. Thanks for you help, all the best Dávid
So what you're saying is that even though the users are using anonymous outerid and want anonymity you want to release their id to the site they are at? -- Sent from my Android device with K-9 Mail. Please excuse my brevity.
Hi! Yes. I'm saying that. It's a dorm's network we are talking about. We have to measure how much they download and upload, and since we have a very narrow internet link (6Mbps (!)), therefore we must limit the bandwidth, what each users can use. Of course each and every user know that we measure their usage, and they accepted it. D On Fri, Oct 11, 2013 at 12:54 AM, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
So what you're saying is that even though the users are using anonymous outerid and want anonymity you want to release their id to the site they are at?
-- Sent from my Android device with K-9 Mail. Please excuse my brevity.
Hi,
Yes. I'm saying that. It's a dorm's network we are talking about. We have to measure how much they download and upload, and since we have a very narrow internet link (6Mbps (!)), therefore we must limit the bandwidth, what each users can use. Of course each and every user know that we measure their usage, and they accepted it.
..so why release their real userID - the CSI is available...as is any other static value that you decide on - eg CUI. alan
On 16 Oct 2013, at 22:45, Tekán Dávid <tek.david@gmail.com> wrote:
Hi all!
I have a problem with users using the anonymous identity field during connecting. It turned out that for privacy reasons it is hidden outside of the tunnel. I found that by setting use_tunneling_reply to yes i can "transfer" the inner username outside of the tunnel, and the correct (not anonymous) username will appear in the accounting records. I've uncommented even the update outer.reply... part in the sites-enabled/inner-tunnel file. Unfortunatelly it does not work. Is there anything else, what i need to do to get it work? I use coovachilli for nas.
in inner-tunnel post-auth try: # # Copy inner id to reply so the NAS knows the real identity of who logged in # update reply { User-Name := "%{request:User-Name}" }
On 16 Oct 2013, at 23:36, Scott Armitage <S.P.Armitage@lboro.ac.uk> wrote:
On 16 Oct 2013, at 22:45, Tekán Dávid <tek.david@gmail.com> wrote:
Hi all!
I have a problem with users using the anonymous identity field during connecting. It turned out that for privacy reasons it is hidden outside of the tunnel. I found that by setting use_tunneling_reply to yes i can "transfer" the inner username outside of the tunnel, and the correct (not anonymous) username will appear in the accounting records. I've uncommented even the update outer.reply... part in the sites-enabled/inner-tunnel file. Unfortunatelly it does not work. Is there anything else, what i need to do to get it work? I use coovachilli for nas.
What does the output of radiusd -X show?
participants (4)
-
A.L.M.Buxey@lboro.ac.uk -
Alan Buxey -
Scott Armitage -
Tekán Dávid