Hi all,
I use freeradius 1.0.1 to authenticate wireless users with EAP-TTLS or PEAP against an LDAP backend.
Now, I want to switch the users into a vlan by using an LDAP attribute named here 'title'.
I put in the ldap.attrmap file : replyItem Tunnel-Private-Group-Id title
And in the users file :
DEFAULT
Tunnel-Type = 6,
Tunnel-Medium-Type = 13My radiusd.conf contains :
authorize {
preprocess
auth_log
mschap
eap
files
ldap
}
authenticate {
Auth-Type LDAP {
ldap
}
}It works... but with some conditions. The NAS put the user in the good vlan if the vlan reply items are _outside_ the TLS tunnel.
So I have to put the same User-Name in the request inside _and_ outside the tunnel to take effect because the option "use_tunneled_reply" in eap.conf doesn't work with PEAP.
And it is a security problem : If I know a valid User-Name authorized to acces another vlan, I can authenticate with my credentials but puting that valid User-Name outside the tunnel permits me to access the vlan attached to this User-Name.
In clear, (so difficult to explain with my bad english) with that simple configuration of users file :
"etutest" User-Password == "etupwd"
Tunnel-Type = 13,
Tunnel-Medium-Type = 6,
Tunnel-Private-Group-Id = "Etudiant"
"persotest" User-Password == "persopwd"
Tunnel-Type = 13,
Tunnel-Medium-Type = 6,
Tunnel-Private-Group-Id = "Personnel"If user 'etutest' is authenticating using PEAP or EAP-TTLS with his credentials but with the User-Name 'persotest' outside the tunnel, he will be allowed to acces the vlan 'Personnel'.
My question is : How can I solve this problem ?
If anyone got ideas, they are welcome ! Thanks in advance.
Regards, REMY Lionel
PS : Here's my debug :
rad_recv: Access-Request packet from host xxxxxx, id=112, length=256
* User-Name = "persotest"*
Service-Type = Login-User
Message-Authenticator = 0x212b595685a865b0add9b1af752fecf7
EAP-Message = 0x0206007415800000006a170301002093cdb538a3537a5f01833f3aa50a8a551837ef3ec889b67d9363d37939553d27170301004060390f5606775508870b4eeb911726807b78584e15d94023077fb9f16734cb9422ce7514df1e92bbfb5e3c79fe36452b0f21d1364e7f32d0d649c7e0bcb85a1d
NAS-Port-Type = Wireless-802.11
NAS-Port = 282
State = 0x39fe6a4f8451ad346da60590d0d1b81c
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 4
modcall[authorize]: module "preprocess" returns ok for request 4
modcall[authorize]: module "auth_log" returns ok for request 4
modcall[authorize]: module "mschap" returns noop for request 4
modcall: entering group redundant for request 4
rlm_eap: EAP packet type response id 6 length 116
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 4
modcall: group redundant returns updated for request 4
users: Matched persotest at 7
modcall[authorize]: module "files" returns ok for request 4
rlm_ldap: - authorize
rlm_ldap: performing user authorization for persotest
radius_xlat: '(uid=persotest)'
radius_xlat: 'ou=people,dc=ups-tlse,dc=fr'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in ou=people,dc=ups-tlse,dc=fr, with filter (uid=persotest)
rlm_ldap: object not found or got ambiguous search result
rlm_ldap: search failed
rlm_ldap: ldap_release_conn: Release Id: 0
modcall[authorize]: module "ldap" returns notfound for request 4
modcall: group authorize returns updated for request 4
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 4
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Length Included
eaptls_verify returned 11
eaptls_process returned 7
rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes.
* TTLS: Got tunneled request
User-Name = "etutest"
User-Password = "etupwd"
FreeRADIUS-Proxied-To = 127.0.0.1
TTLS: Sending tunneled request
User-Name = "etutest"
User-Password = "etupwd"
FreeRADIUS-Proxied-To = 127.0.0.1*
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 4
modcall[authorize]: module "preprocess" returns ok for request 4
modcall[authorize]: module "auth_log" returns ok for request 4
modcall[authorize]: module "mschap" returns noop for request 4
modcall: entering group redundant for request 4
rlm_eap: No EAP-Message, not doing EAP
modcall[authorize]: module "eap" returns noop for request 4
rlm_realm: No '@' in User-Name = "etutest", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 4
modcall: group redundant returns noop for request 4
users: Matched etutest at 2
modcall[authorize]: module "files" returns ok for request 4
rlm_ldap: - authorize
rlm_ldap: performing user authorization for etutest
radius_xlat: '(uid=etutest)'
radius_xlat: 'ou=people,dc=ups-tlse,dc=fr'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in ou=people,dc=ups-tlse,dc=fr, with filter (uid=etutest)
rlm_ldap: object not found or got ambiguous search result
rlm_ldap: search failed
rlm_ldap: ldap_release_conn: Release Id: 0
modcall[authorize]: module "ldap" returns notfound for request 4
modcall: group authorize returns ok for request 4
auth: type Local
auth: user supplied User-Password matches local User-Password
Login OK: [etutest/etupwd] (from client localhost port 0)
Processing the post-auth section of radiusd.conf
modcall: entering group post-auth for request 4
modcall[post-auth]: module "reply_log" returns ok for request 4
modcall: group post-auth returns ok for request 4
* TTLS: Got tunneled reply RADIUS code 2
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "Etudiant"
TTLS: Got tunneled Access-Accept*
rlm_eap: Freeing handler
modcall[authenticate]: module "eap" returns ok for request 4
modcall: group authenticate returns ok for request 4
Login OK: [persotest/<no User-Password attribute>] (from client ap-test port 282 cli 0040.96a2.46c4)
Processing the post-auth section of radiusd.conf
modcall: entering group post-auth for request 4
modcall[post-auth]: module "reply_log" returns ok for request 4
modcall: group post-auth returns ok for request 4
Sending Access-Accept of id 112 to xxxxxx
* Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
** Tunnel-Private-Group-Id:0 = "Personnel"*
MS-MPPE-Recv-Key = 0xd67c04ab06a40a64f27502a324df0b2ee4b7e358a38a942848300501d00a8273
MS-MPPE-Send-Key = 0xcd2f79d9d1e06f2ef58e12ecabcf335f93da1dd1d361cd61d50699a6932bbaae
EAP-Message = 0x03060004
Message-Authenticator = 0x00000000000000000000000000000000
* User-Name = "persotest"
*
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
