(RADIATOR) MAC address filtering?
Mike McCauley
mikem at open.com.au
Wed Jan 26 01:05:16 CST 2005
Hi Hugh,
actually, the mac address file just needs to have the addresses one per line:
00409638d4cb
00409638d4cc
no Auth-Type check items should be required.
Cheers.
On Wednesday 26 January 2005 16:10, Hugh Irvine wrote:
> Hello Jim -
>
> OK - once more to see if we can get it to work.....
>
> Here is yet another variation:
>
> <Handler TunnelledByTTLS=1>
>
> AuthByPolicy ContinueWhileAccept
> <AuthBy FILE>
> AuthenticateAttribute Calling-Station-Id
> Filename %D/addresses.mac
> </AuthBy>
> <AuthBy LDAP2>
> Host ren.chesterfield.mo.us
> AuthDN cn=admin,o=coc
> AuthPassword xxxxxxxxxx
> BaseDN ou=Users,o=Private
> UsernameAttr cn
> ServerChecksPassword
> SearchFilter (&(cn=%1)(cocWLANAllowed=true))
> </AuthBy>
>
> </Handler>
>
> <Handler>
>
> <AuthBy FILE>
> Filename /etc/radiator/users
> EAPType TTLS
>
> EAPTLS_CAFile /etc/radiator/certificates/digicert.pem
> EAPTLS_CertificateFile
> /etc/radiator/certificates/star_chesterfield_mo_us.crt
> EAPTLS_CertificateType PEM
> EAPTLS_PrivateKeyFile
> /etc/radiator/certificates/digicert.pem
> EAPTLS_PrivateKeyPassword locutusofborg
> EAPTLS_MaxFragmentSize 1000
> AutoMPPEKeys
> PreHandlerHook sub {${$_[0]}->add_attr('Calling-Station-Id', \
> ${$_[0]}->{outerRequest}->get_attr('Calling-Station-Id'))}
> </AuthBy>
>
> </Handler>
>
>
> # CONTENTS OF addresses.mac
>
> 000bcd5a0861 Auth-Type = Accept
>
> ......
>
>
> Note that this requires Radiator 3.11 plus all the latest patches.
>
>
> Here's hoping .....
>
> :-)
>
> regards
>
> Hugh
>
> On 26 Jan 2005, at 10:32, Jim Michael wrote:
> > Hi Hugh-
> >
> > Thanks for YOUR patience with all this! I'm the newbie asking all the
> > questions ;-) I tried the new config with the modified users file, but
> > unfortunately it too does not work. Now users are authenticated
> > properly, no matter WHAT I put as the mac address in the users file.
> > The
> > intention was to NOT allow a user to authenticate unless their mac is
> > in
> > the list, but its letting everyone in, even if the mac address is
> > invalid.
> >
> > Perhaps this is just not something Radiator can do? I just don't see
> > how adding
> >
> > DEFAULT User-Name = anonymous, Calling-Station-Id = 000bcd5a0861
> >
> > changes anything? Nothing at all changed in the config file to make it
> > "aware" of the Calling-Station-ID or to look for its existence... its
> > just looking for ANY user named 'anonymous' and if found, then goes
> > ahead to do the inner authentication. Correct me if I'm wrong?
> >
> > Thanks again for all the help. I guess if we have to live without mac
> > address filtering, we will... but the boss won't be happy!
> >
> > Jim
> >
> >>>> Hugh Irvine <hugh at open.com.au> 1/25/2005 4:35:55 PM >>>
> >
> > Hello Jim -
> >
> > Sorry about all this - we'll get there soon I hope.
> >
> > I think we should forget about multiple AuthBy clauses and just do
> > something simpler.
> >
> > We can use the original configuration with a slightly more complex
> > /etc/radiator/users file.
> >
> > Here is yet another version of the configuration file to try.
> >
> >
> >
> > AuthPort 1812
> > AcctPort 1813
> > Foreground
> > LogStdout
> > LogDir /var/log/radius
> > DbDir /etc/radiator
> > Trace 4
> >
> > <Client DEFAULT>
> > Secret xxxxxxxxxx
> > DupInterval 0
> > </Client>
> >
> > <Handler TunnelledByTTLS=1>
> >
> > <AuthBy LDAP2>
> > Host ren.chesterfield.mo.us
> > AuthDN cn=admin,o=coc
> > AuthPassword xxxxxxxxxx
> > BaseDN ou=Users,o=Private
> > UsernameAttr cn
> > ServerChecksPassword
> > SearchFilter (&(cn=%1)(cocWLANAllowed=true))
> > </AuthBy>
> >
> > </Handler>
> >
> > <Handler>
> >
> > <AuthBy FILE>
> > Filename /etc/radiator/users
> > EAPType TTLS
> >
> > EAPTLS_CAFile /etc/radiator/certificates/digicert.pem
> > EAPTLS_CertificateFile
> > /etc/radiator/certificates/star_chesterfield_mo_us.crt
> > EAPTLS_CertificateType PEM
> > EAPTLS_PrivateKeyFile
> > /etc/radiator/certificates/digicert.pem
> > EAPTLS_PrivateKeyPassword locutusofborg
> > EAPTLS_MaxFragmentSize 1000
> > AutoMPPEKeys
> > </AuthBy>
> >
> > </Handler>
> >
> >
> > The file /etc/radiator/users should contain multiple lines like this
> > (one for each MAC address):
> >
> > # /etc/radiator/users
> >
> > DEFAULT User-Name = anonymous, Calling-Station-Id = 000bcd5a0861
> >
> > DEFAULT User-Name = anonymous, Calling-Station-Id = .....
> >
> > ......
> >
> > Please let me know if this one works any better.
> >
> > thanks for your patience
> >
> > regards
> >
> > Hugh
> >
> > On 26 Jan 2005, at 03:21, Jim Michael wrote:
> >> Hi Hugh-
> >>
> >> I think we're getting closer! (but still not working). Now it
> >
> > appears
> >
> >> that the mac address as listed in my addresses.mac file is not
> >> accepted.
> >> Could the format of the address be wrong? I see that my AP has
> >
> > various
> >
> >> options for the format (eg xxxxxxxxxxxx, xx-xx-xx-xx-xx-xx,
> >> xx:xx:xx:xx:xx:xx, etc. I have it configured currently for no
> >> separators, just the raw mac address. Below is the exact contents of
> >
> > my
> >
> >> addresses.mac file again, as well as the log and my exact current
> >> config
> >> (in case you see a typo). You can see that the mac address in the
> >
> > file
> >
> >> is identical to the one in the log for calling-station-id, so I know
> >
> > it
> >
> >> is correct. Just not sure what else is wrong!
> >>
> >> Jim
> >>
> >> # CONTENTS OF addresses.mac
> >>
> >> 000bcd5a0861 Auth-Type = Accept
> >>
> >> START OF LOG
> >> Tue Jan 25 10:07:25 2005: DEBUG: Finished reading configuration file
> >> '/etc/radiator/coc.cfg'
> >> Tue Jan 25 10:07:25 2005: DEBUG: Reading dictionary file
> >> '/etc/radiator/dictionary'
> >> Tue Jan 25 10:07:25 2005: DEBUG: Creating authentication port
> >> 0.0.0.0:1812
> >> Tue Jan 25 10:07:25 2005: DEBUG: Creating accounting port
> >
> > 0.0.0.0:1813
> >
> >> Tue Jan 25 10:07:25 2005: NOTICE: Server started: Radiator 3.11 on
> >> suser (LOCKED)
> >> Tue Jan 25 10:07:35 2005: DEBUG: Packet dump:
> >> *** Received from 192.168.10.41 port 1048 ....
> >> Code: Access-Request
> >> Identifier: 11
> >> Authentic: lKlKlKlKlKlKlKlK
> >> Attributes:
> >> NAS-IP-Address = 192.168.10.41
> >> NAS-Port-Type = Wireless-IEEE-802-11
> >> NAS-Port = 1
> >> Framed-MTU = 1400
> >> User-Name = "anonymous"
> >> Calling-Station-Id = "000bcd5a0861"
> >> Called-Station-Id = "000d9df60559"
> >> NAS-Identifier = "Enterprise AP"
> >> EAP-Message = <2><1><0><14><1>anonymous
> >> Message-Authenticator = <14>#<211>Z<138>+1<151>}~*M<138>[5<161>
> >>
> >> Tue Jan 25 10:07:35 2005: DEBUG: Handling request with Handler ''
> >> Tue Jan 25 10:07:35 2005: DEBUG: Deleting session for anonymous,
> >> 192.168.10.41, 1
> >> Tue Jan 25 10:07:35 2005: DEBUG: Handling with Radius::AuthFILE:
> >> CheckMACAddress
> >> Tue Jan 25 10:07:35 2005: DEBUG: Handling with EAP: code 2, 1, 14
> >> Tue Jan 25 10:07:35 2005: DEBUG: Response type 1
> >> Tue Jan 25 10:07:35 2005: DEBUG: EAP result: 1, EAP authentication
> >
> > is
> >
> >> not permitted.
> >> Tue Jan 25 10:07:35 2005: INFO: Access rejected for anonymous: EAP
> >> authentication is not permitted.
> >> Tue Jan 25 10:07:35 2005: DEBUG: Packet dump:
> >> *** Sending to 192.168.10.41 port 1048 ....
> >> Code: Access-Reject
> >> Identifier: 11
> >> Authentic: lKlKlKlKlKlKlKlK
> >> Attributes:
> >> Reply-Message = "Request Denied"
> >>
> >> END OF LOG
> >>
> >> START OF CONFIG
> >> AuthPort 1812
> >> AcctPort 1813
> >> Foreground
> >> LogStdout
> >> LogDir /var/log/radius
> >> DbDir /etc/radiator
> >> Trace 4
> >>
> >> <Client DEFAULT>
> >> Secret xxxxxxxxxx
> >> DupInterval 0
> >> </Client>
> >>
> >> <AuthBy FILE>
> >> Identifier CheckMACAddress
> >> Filename /etc/radiator/addresses.mac
> >> AuthenticateAttribute Calling-Station-Id
> >> </AuthBy>
> >>
> >> <AuthBy LDAP2>
> >> Identifier CheckLDAP
> >> Host ren.chesterfield.mo.us
> >> AuthDN cn=admin,o=coc
> >> AuthPassword xxxxxxxxxx
> >> BaseDN ou=Users,o=Private
> >> UsernameAttr cn
> >> ServerChecksPassword
> >> SearchFilter (&(cn=%1)(cocWLANAllowed=true))
> >> </AuthBy>
> >>
> >> <Handler TunnelledByTTLS=1>
> >>
> >> AuthBy CheckLDAP
> >>
> >> </Handler>
> >>
> >> <Handler>
> >>
> >> AuthByPolicy ContinueWhileAccept
> >>
> >> AuthBy CheckMACAddress
> >>
> >> <AuthBy FILE>
> >> Filename /etc/radiator/users
> >> EAPType TTLS
> >>
> >> EAPTLS_CAFile /etc/radiator/certificates/digicert.pem
> >> EAPTLS_CertificateFile
> >> /etc/radiator/certificates/star_chesterfield_mo_us.crt
> >> EAPTLS_CertificateType PEM
> >> EAPTLS_PrivateKeyFile
> >> /etc/radiator/certificates/digicert.pem
> >> EAPTLS_PrivateKeyPassword locutusofborg
> >> EAPTLS_MaxFragmentSize 1000
> >> AutoMPPEKeys
> >> </AuthBy>
> >>
> >> </Handler>
> >>
> >> END OF CONFIG
> >>
> >>>>> Hugh Irvine <hugh at open.com.au> 1/24/2005 6:40:34 PM >>>
> >>
> >> Hello Jim -
> >>
> >> Thanks for sending the configuration and debug - it helps
> >
> > enormously.
> >
> >> The problem is that the Called-Station-Id / Calling-Station-Id are
> >
> > not
> >
> >> included in the inner request.
> >>
> >> Therefore here is an alternative configuration - note the changed
> >> addresses.mac file and the changed configuration file.
> >>
> >> Please let me know how you get on.
> >>
> >> regards
> >>
> >> Hugh
> >
> > NB:
> >
> > Have you read the reference manual ("doc/ref.html")?
> > Have you searched the mailing list archive
> > (www.open.com.au/archives/radiator)?
> > Have you had a quick look on Google (www.google.com)?
> > Have you included a copy of your configuration file (no secrets),
> > together with a trace 4 debug showing what is happening?
> >
> > --
> > Radiator: the most portable, flexible and configurable RADIUS server
> > anywhere. Available on *NIX, *BSD, Windows, MacOS X.
> > -
> > Nets: internetwork inventory and management - graphical, extensible,
> > flexible with hardware, software, platform and database independence.
> > -
> > CATool: Private Certificate Authority for Unix and Unix-like systems.
>
> NB:
>
> Have you read the reference manual ("doc/ref.html")?
> Have you searched the mailing list archive
> (www.open.com.au/archives/radiator)?
> Have you had a quick look on Google (www.google.com)?
> Have you included a copy of your configuration file (no secrets),
> together with a trace 4 debug showing what is happening?
--
Mike McCauley mikem at open.com.au
Open System Consultants Pty. Ltd Unix, Perl, Motif, C++, WWW
9 Bulbul Place Currumbin Waters QLD 4223 Australia http://www.open.com.au
Phone +61 7 5598-7474 Fax +61 7 5598-7070
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. SQL, proxy, DBM, files, LDAP, NIS+, password, NT, Emerald,
Platypus, Freeside, TACACS+, PAM, external, Active Directory, EAP, TLS,
TTLS, PEAP etc on Unix, Windows, MacOS etc.
--
Archive at http://www.open.com.au/archives/radiator/
Announcements on radiator-announce at open.com.au
To unsubscribe, email 'majordomo at open.com.au' with
'unsubscribe radiator' in the body of the message.
More information about the radiator
mailing list