Приветствую. Прошу помощи, ибо совсем сломал мозг следующей задачей:
Необходимо реализовать процедуру аутентификации пользователей при коннекте к беспроводной сети и направление пользователя в указанный в аккаунте VLAN. Wi-Fi точка настроена на обращение к Radius'у, который, в свою очередь, должен запрашивать аккаунты у LDAP'а. Между Радиусом и точкой настроен протокол PEAP для аутентификации, а PEAP, в свою очередь, использует EAP-MSCHAPv2.
НО! На данный момент работает только схема, при которой аккаунт хранится в файле users на Радиусе. А забрать аккаунт с LDAP'а ни в какую не выходит. Выкладываю конфиги
radiusd.conf (не полностью, лишь значимую часть):
proxy_requests = yes
$INCLUDE proxy.conf
$INCLUDE clients.conf
modules {
$INCLUDE ${confdir}/modules/
$INCLUDE eap.conf
$INCLUDE sql.conf
$INCLUDE sql/mysql/counter.conf
}
$INCLUDE policy.conf
$INCLUDE sites-enabled/
clients.conf:
client localhost {
ipaddr = 127.0.0.1
secret = testing123
require_message_authenticator = no
nastype = other
}
client 192.168.60.20/32 {
secret = ***
shortname = wifi
nastype = cisco
}
eap.conf:
eap {
default_eap_type = peap
timer_expire = 60
ignore_unknown_eap_types = yes
cisco_accounting_username_bug = no
max_sessions = 2048
tls {
certdir = ${confdir}/certs
cadir = ${confdir}/certs
private_key_file = ${certdir}/newkey.pem
certificate_file = ${certdir}/newcert.pem
CA_file = ${cadir}/cacert.pem
dh_file = ${certdir}/dh
random_file = /dev/urandom
fragment_size = 1024
include_length = yes
cipher_list = "DEFAULT"
make_cert_command = "${certdir}/bootstrap"
cache {
enable = no
}
}
ttls {
default_eap_type = peap
copy_request_to_tunnel = no
use_tunneled_reply = yes
virtual_server = "inner-tunnel"
}
peap {
default_eap_type = mschapv2
copy_request_to_tunnel = no
use_tunneled_reply = yes
proxy_tunneled_request_as_eap = no
virtual_server = "inner-tunnel"
}
mschapv2 {
with_ntdomain_hack = yes
use_mppe = no
require_encryption = no
require_strong = no
authtype = MS-CHAPv2
}
}
ldap.attrmap (также не полностью):
checkItem Auth-Type radiusAuthType
checkItem LM-Password lmPassword
checkItem NT-Password ntPassword
checkItem LM-Password sambaLmPassword
checkItem NT-Password sambaNtPassword
checkItem LM-Password dBCSPwd
#мною прописанные
checkItem Cleartext-Password userPassword
replyItem Tunnel-Type radiusTunnelType
replyItem Tunnel-Medium-Type radiusTunnelMediumType
replyItem Tunnel-Private-Group-ID radiusTunnelPrivateGroupId
proxy.conf:
proxy server {
default_fallback = no
}
home_server localhost {
type = auth
ipaddr = 127.0.0.1
port = 1812
secret = testing123
response_window = 20
zombie_period = 40
revive_interval = 120
status_check = status-server
check_interval = 30
num_answers_to_alive = 3
}
users (аутентификация именно для этого юзера работает прекрасно):
vlan50 Cleartext-Password :="***"
Tunnel-Private-Group-ID = 50,
Tunnel-Type = "VLAN",
Tunnel-Medium-Type = "IEEE-802"
sites-enables/default:
authorize {
auth_log
mschap
eap {
ok = return
}
files
ldap
}
authenticate {
Auth-Type MS-CHAP {
mschap
}
Auth-Type LDAP {
ldap
}
eap
}
preacct {
files
}
accounting {
detail
sql
attr_filter.accounting_response
}
session {
radutmp
}
post-auth {
exec
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}
pre-proxy {
}
post-proxy {
eap
}
sites-enables/inner-tunnel:
server inner-tunnel {
listen {
ipaddr = 127.0.0.1
port = 18120
type = auth
}
authorize {
mschap
ntdomain
update control {
Proxy-To-Realm := LOCAL
}
inner-eap {
ok = return
}
files
ldap
expiration
logintime
}
authenticate {
Auth-Type MS-CHAP {
mschap
}
Auth-Type LDAP {
ldap
}
inner-eap
}
session {
radutmp
}
post-auth {
Post-Auth-Type REJECT {
attr_filter.access_reject
}
}
pre-proxy {
}
post-proxy {
inner-eap
}
[\code]
modules/inner-eap:
eap inner-eap {
default_eap_type = mschapv2
timer_expire = 60
max_sessions = 2048
mschapv2 {
with_ntdomain_hack = yes
use_mppe = no
require_encryption = no
require_strong = no
authtype = MS-CHAPv2
}
tls {
certdir = ${confdir}/certs
cadir = ${confdir}/certs
private_key_file = ${certdir}/newkey.pem
certificate_file = ${certdir}/newcert.pem
CA_file = ${cadir}/cacert.pem
dh_file = ${certdir}/dh
random_file = /dev/urandom
fragment_size = 1024
include_length = yes
cipher_list = "DEFAULT"
}
}
modules/ldap:
ldap {
server = "ldap://ldap.uriit.ru"
identity = "cn=radius,ou=Services,dc=uriit,dc=local"
password = "***"
basedn = "ou=People,dc=uriit,dc=local"
filter = "(&(objectclass=radiusprofile)(uid=%{Stripped-User-Name:-%{User-Name}}))"
ldap_connections_number = 5
timeout = 4
timelimit = 3
net_timeout = 1
tls {
start_tls = yes
port = 389
cacertfile = /etc/openldap/ssl/cacert.pem
certfile = /etc/openldap/ssl/newcert.pem
keyfile = /etc/openldap/ssl/newkey.pem
require_cert = "allow"
}
dictionary_mapping = ${confdir}/ldap.attrmap
password_attribute = userPassword
edir_account_policy_check = no
set_auth_type = no
}
modules/mschap:
mschap {
use_mppe = no
require_encryption = no
require_strong = no
with_ntdomain_hack = yes
}
Логи в первом комменте.
