I have been looking for a way to maintain accurate wireless access and usage
information for security auditing purposes. The problem I have is that
wireless network users may choose to provide an alternative identity by
providing an outer identity in the supplicant software. Although the user
still need a legitimate user id/password to pass the EAP TTLS
authentication. So far I could not find a "standard" way to track the user
identity via Radius accounting records. I do manage to configure the
FreeRadius to send the inner authentication user ID to the Cisco Aironet
Access point (IOS 12.3(7)JA) using the Radius attribute "Class" (ID 25).
For example, in my users file, the following is configured for guest access:
DEFAULT Hint == "guest"
Auth-Type = sql,
Class = "%{User-Name}",
Session-Timeout = 3600,
Fall-Through = No
The actual user id used in the EAP-TTLS authentication is passed to the
Cisco Aironet AP via the Class attribute. I have observed that both the
Radius "start" and "stop" records sent by the Cisco Aironet AP contained the
Class attribute with the actual user's ID. The reason I chose the Class
attribute is that it is the only attribute honored by the Aironet AP in
Access-Accept message and also included in the radius accounting send by the
Aironet AP according to the Cisco IOS Software Config Guide for Aironet APs.
Although it seems to work for me, I am not sure about the use of attribute
Class for tracking user ID would interfere with other operation (like the
one attribute Class was originally designed for)?
Also, the attribute Class is of type Octet. Does anyone know of a way to
convert it to text in SQL? I would like to convert it to text before
writing it into the mySQL database, preferably by way of the
accounting_xx_query in the sql.conf file.
Thanks
Cedric
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
