realms and local user file processing question
Hello- Having some problems getting a match on the local users file after a successful realm proxy. I would like to have a user be able to log in with different realms and get different IP addresses. I have tried all sorts of formats in the users file. I would have thought that the first was the correct syntax but it didn't work, hence the trial and error. mdhare@test Framed-IP-Address = 146.151.211.254 mdhare Realm == "test" Framed-IP-Address = 146.151.211.254 "mdhare@test" Framed-IP-Address = 146.151.211.254 according to http://wiki.freeradius.org/Proxy#What_Happens "Then the users file is processed as usual. The username used at this point is the one after hints file processing (regardless of the "hints" option). It also includes the realm (regardless of the setting of the "nostrip" option) unless the realm is LOCAL." Here is the debug from a login. How do I further troubleshoot why the local users file is not being matched? -Michael ------------ rad_recv: Access-Request packet from host 144.92.44.114:2523, id=152, length=128 User-Name = "mdhare@test" User-Password = ***** NAS-Port = 1953 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "144.92.44.114" Calling-Station-Id = "128.104.19.106" Tunnel-Client-Endpoint:0 = "128.104.19.106" NAS-IP-Address = 144.92.44.114 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "attr_filter" returns noop for request 0 rlm_realm: Looking up realm "test" for User-Name = "mdhare@test" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "mdhare" rlm_realm: Proxying request from user mdhare to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Preparing to proxy authentication request to realm "DEFAULT" modcall[authorize]: module "suffix" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: leaving group authorize (returns updated) for request 0 Sending Access-Request of id 0 to 144.92.254.243 port 1812 User-Name = "mdhare" User-Password = ********* NAS-Port = 1953 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "144.92.44.114" Calling-Station-Id = "128.104.19.106" Tunnel-Client-Endpoint:0 = "128.104.19.106" NAS-IP-Address = 144.92.44.114 NAS-Port-Type = Virtual Proxy-State = 0x313532 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 144.92.254.243:1812, id=0, length=31 Service-Type = NAS-Prompt-User Proxy-State = 0x313532 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 0 modcall[post-proxy]: module "eap" returns noop for request 0 modcall: leaving group post-proxy (returns noop) for request 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 attr_filter: Matched entry DEFAULT at line 84 modcall[authorize]: module "attr_filter" returns updated for request 0 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[authorize]: module "suffix" returns noop for request 0 ---------------------- problem ---------------------------------- modcall[authorize]: module "files" returns notfound for request 0 ---------------------- problem ---------------------------------- modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type rad_check_password: Auth-Type = Accept, accepting the user Sending Access-Accept of id 152 to 144.92.44.114 port 2523 Finished request 0 Going to the next request Waking up in 6 seconds... -- =======================W=== Michael Hare UW-Madison + WiscNet Network Engineering Desk: 608-262-5236 24 Hr Noc: 608-263-4188
Michael Hare wrote:
Having some problems getting a match on the local users file after a successful realm proxy.
That will change in 2.0, when it's released. The "users" file should ONLY be processed before proxying, not after.
I have tried all sorts of formats in the users file. I would have thought that the first was the correct syntax but it didn't work, hence the trial and error.
mdhare@test Framed-IP-Address = 146.151.211.254
When you're processing the "users" file after proxying, the user name is the *stripped* name, i.e. without the realm.
mdhare Realm == "test" Framed-IP-Address = 146.151.211.254
This should work.
"mdhare@test" Framed-IP-Address = 146.151.211.254
This is the same as the first entry.
according to
http://wiki.freeradius.org/Proxy#What_Happens
"Then the users file is processed as usual. The username used at this point is the one after hints file processing (regardless of the "hints" option). It also includes the realm (regardless of the setting of the "nostrip" option) unless the realm is LOCAL."
Hmm... I think that's wrong.
Here is the debug from a login. How do I further troubleshoot why the local users file is not being matched?
Go back and read the "users" file. The debug log shows it matching on line 84, are you *sure* that the "mdhare" entries are before that? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Alan- Thanks for your time.
When you're processing the "users" file after proxying, the user name is the *stripped* name, i.e. without the realm.
Ok, this corresponds more with what I see than that wiki link I sent you. When I supply the original username 'mdhare@test', entry #2 [see immediately below] is the one that matches after the proxy. mdhare Realm == "test" Framed-IP-Address = 146.151.211.254 mdhare Framed-IP-Address = 146.151.211.254 However, I'd like to provide a different Framed-IP-Address based on the supplied realm. The goal that we are trying to implement are IP groups in a VPN server. I'm trying to hammer this out with radius because I don't want a vendor specific solution. Can you think of a creative way to provide a Framed-IP-Address on the local server based on realm with Freeradius 1.x code? To be more specific, lets say that I belong to three departments. I may have multiple logins 'mdhare@dept1', 'mdhare@dept2', and 'mdhare@dept3' that would hand back different IPs but auth with the same central DB. It looks like I could setup a new radius server to proxy to for each individual realm [since I can guarantee unique username per realm] but that could be a LOT of realms [one for each dept that wants to participate, which may be dozens].
That will change in 2.0, when it's released. The "users" file should ONLY be processed before proxying, not after.
When 2.0 comes out, will this mean that I will be able to match on the realm in the users file and provide the Framed-IP-Address with a format like the below? mdhare@test Framed-IP-Address = 146.151.211.254
Go back and read the "users" file. The debug log shows it matching on line 84, are you *sure* that the "mdhare" entries are before that?
I think that the match on line 84 of the debug was for the attrs filter. I don't fully understand how this may be applicable to the question. Is there some interaction that I don't understand, or was your suggestion in err? -Michael -- =======================W=== Michael Hare UW-Madison + WiscNet Network Engineering Desk: 608-262-5236 24 Hr Noc: 608-263-4188
Alan- I did think of a way out of this; Accomplish 'realmlike' functionality with attr_rewrite, because the radius server I proxy to is under my control as well. user example: mdhare_(dept) on 'master' radius server (one that all requests are proxied through) attr_rewrite force_username { attribute = User-Name searchin = packet searchfor = "_[a-z]+" replacewith = "" append = no new_attribute = no max_matches = 1 } My understanding is that the User-Name attribute will be rewritten by the proxy for auth but the proxier will still match on the original. Not very intuitive but easier than a server per realm. -Michael Michael Hare wrote:
Alan-
Thanks for your time.
When you're processing the "users" file after proxying, the user name is the *stripped* name, i.e. without the realm.
Ok, this corresponds more with what I see than that wiki link I sent you. When I supply the original username 'mdhare@test', entry #2 [see immediately below] is the one that matches after the proxy.
mdhare Realm == "test" Framed-IP-Address = 146.151.211.254
mdhare Framed-IP-Address = 146.151.211.254
However, I'd like to provide a different Framed-IP-Address based on the supplied realm. The goal that we are trying to implement are IP groups in a VPN server. I'm trying to hammer this out with radius because I don't want a vendor specific solution. Can you think of a creative way to provide a Framed-IP-Address on the local server based on realm with Freeradius 1.x code? To be more specific, lets say that I belong to three departments. I may have multiple logins 'mdhare@dept1', 'mdhare@dept2', and 'mdhare@dept3' that would hand back different IPs but auth with the same central DB.
It looks like I could setup a new radius server to proxy to for each individual realm [since I can guarantee unique username per realm] but that could be a LOT of realms [one for each dept that wants to participate, which may be dozens].
That will change in 2.0, when it's released. The "users" file should ONLY be processed before proxying, not after.
When 2.0 comes out, will this mean that I will be able to match on the realm in the users file and provide the Framed-IP-Address with a format like the below?
mdhare@test Framed-IP-Address = 146.151.211.254
Go back and read the "users" file. The debug log shows it matching on line 84, are you *sure* that the "mdhare" entries are before that?
I think that the match on line 84 of the debug was for the attrs filter. I don't fully understand how this may be applicable to the question. Is there some interaction that I don't understand, or was your suggestion in err?
-Michael
-- =======================W=== Michael Hare UW-Madison + WiscNet Network Engineering Desk: 608-262-5236 24 Hr Noc: 608-263-4188
Michael Hare wrote:
However, I'd like to provide a different Framed-IP-Address based on the supplied realm. The goal that we are trying to implement are IP groups in a VPN server. I'm trying to hammer this out with radius because I don't want a vendor specific solution. Can you think of a creative way to provide a Framed-IP-Address on the local server based on realm with Freeradius 1.x code? To be more specific, lets say that I belong to three departments. I may have multiple logins 'mdhare@dept1', 'mdhare@dept2', and 'mdhare@dept3' that would hand back different IPs but auth with the same central DB.
Are they all the same user? If so, separate the authentication from the realm. Part of the problem you're runing into is that you're trying to implement realms by proxying, which just isn't necessary. See the LOCAL configuration in proxy.conf for details. And if most of what you're doing is mapping User-Name to IP, use rlm_passwd, which is much simpler than the "users" file. It won't care about realms, so you can configure it to use User-Name as a key, and return Framed-IP-Address. The User-Name will then be the full username, which is what you want.
It looks like I could setup a new radius server to proxy to for each individual realm [since I can guarantee unique username per realm] but that could be a LOT of realms [one for each dept that wants to participate, which may be dozens].
No. There's NO need to do that. One server can do it all. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
participants (2)
-
Alan DeKok -
Michael Hare