Tobias Brunner
186d25cbe6
Some clients won't do Mode Config or XAuth during reauthentication.
Because Start messages previously were triggered by TRANSACTION exchanges
none were sent for new SAs of such clients, while Stop messages were still
sent for the old SAs when they were destroyed. This resulted in an
incorrect state on the RADIUS server.
Since 31be582399 the assign_vips() event is also triggered during
reauthentication if the client does not do a Mode Config exchange.
So instead of waiting for a TRANSACTION exchange we trigger the Start
message when a virtual IP is assigned to a client.
With this the charon.plugins.eap-radius.accounting_requires_vip option
would not have any effect for IKEv1 anymore. However, it previously also
only worked if the client did an XAuth exchange, which is probably
rarely used without virtual IPs, so this might not be much of a
regression.
Fixes #937.
114 lines
4.7 KiB
Plaintext
114 lines
4.7 KiB
Plaintext
charon.plugins.eap-radius.accounting = no
|
|
Send RADIUS accounting information to RADIUS servers.
|
|
|
|
charon.plugins.eap-radius.accounting_close_on_timeout = yes
|
|
Close the IKE_SA if there is a timeout during interim RADIUS accounting
|
|
updates.
|
|
|
|
charon.plugins.eap-radius.accounting_interval = 0
|
|
Interval for interim RADIUS accounting updates, if not specified by the
|
|
RADIUS server in the Access-Accept message.
|
|
|
|
charon.plugins.eap-radius.accounting_requires_vip = no
|
|
If enabled, accounting is disabled unless an IKE_SA has at least one
|
|
virtual IP. Only for IKEv2, for IKEv1 a virtual IP is strictly necessary.
|
|
|
|
charon.plugins.eap-radius.class_group = no
|
|
Use class attributes in Access-Accept messages as group membership
|
|
information.
|
|
|
|
Use the _class_ attribute sent in the RADIUS-Accept message as group
|
|
membership information that is compared to the groups specified in the
|
|
**rightgroups** option in **ipsec.conf**(5).
|
|
|
|
charon.plugins.eap-radius.close_all_on_timeout = no
|
|
Closes all IKE_SAs if communication with the RADIUS server times out. If it
|
|
is not set only the current IKE_SA is closed.
|
|
|
|
charon.plugins.eap-radius.dae.enable = no
|
|
Enables support for the Dynamic Authorization Extension (RFC 5176).
|
|
|
|
charon.plugins.eap-radius.dae.listen = 0.0.0.0
|
|
Address to listen for DAE messages from the RADIUS server.
|
|
|
|
charon.plugins.eap-radius.dae.port = 3799
|
|
Port to listen for DAE requests.
|
|
|
|
charon.plugins.eap-radius.dae.secret
|
|
Shared secret used to verify/sign DAE messages. If set, make sure to adjust
|
|
the permissions of the config file accordingly.
|
|
|
|
charon.plugins.eap-radius.eap_start = no
|
|
Send EAP-Start instead of EAP-Identity to start RADIUS conversation.
|
|
|
|
charon.plugins.eap-radius.filter_id = no
|
|
Use filter_id attribute as group membership information.
|
|
|
|
If the RADIUS _tunnel_type_ attribute with value **ESP** is received, use
|
|
the _filter_id_ attribute sent in the RADIUS-Accept message as group
|
|
membership information that is compared to the groups specified in the
|
|
**rightgroups** option in **ipsec.conf**(5).
|
|
|
|
charon.plugins.eap-radius.forward.ike_to_radius
|
|
RADIUS attributes to be forwarded from IKEv2 to RADIUS.
|
|
|
|
RADIUS attributes to be forwarded from IKEv2 to RADIUS (can be defined by
|
|
name or attribute number, a colon can be used to specify vendor-specific
|
|
attributes, e.g. Reply-Message, or 11, or 36906:12).
|
|
|
|
charon.plugins.eap-radius.forward.radius_to_ike =
|
|
Same as ike_to_radius but from RADIUS to IKEv2.
|
|
|
|
Same as _charon.plugins.eap-radius.forward.ike_to_radius_ but from RADIUS to
|
|
IKEv2, a strongSwan specific private notify (40969) is used to transmit the
|
|
attributes.
|
|
|
|
charon.plugins.eap-radius.id_prefix
|
|
Prefix to EAP-Identity, some AAA servers use a IMSI prefix to select the
|
|
EAP method.
|
|
|
|
charon.plugins.eap-radius.nas_identifier = strongSwan
|
|
NAS-Identifier to include in RADIUS messages.
|
|
|
|
charon.plugins.eap-radius.port = 1812
|
|
Port of RADIUS server (authentication).
|
|
|
|
charon.plugins.eap-radius.secret =
|
|
Shared secret between RADIUS and NAS. If set, make sure to adjust the
|
|
permissions of the config file accordingly.
|
|
|
|
charon.plugins.eap-radius.server =
|
|
IP/Hostname of RADIUS server.
|
|
|
|
charon.plugins.eap-radius.servers {}
|
|
Section to specify multiple RADIUS servers.
|
|
|
|
Section to specify multiple RADIUS servers. The **nas_identifier**,
|
|
**secret**, **sockets** and **port** (or **auth_port**) options can be
|
|
specified for each server. A server's IP/Hostname can be configured using
|
|
the **address** option. The **acct_port** [1813] option can be used to
|
|
specify the port used for RADIUS accounting. For each RADIUS server a
|
|
priority can be specified using the **preference** [0] option.
|
|
|
|
charon.plugins.eap-radius.sockets = 1
|
|
Number of sockets (ports) to use, increase for high load.
|
|
|
|
charon.plugins.eap-radius.xauth {}
|
|
Section to configure multiple XAuth authentication rounds via RADIUS.
|
|
|
|
Section to configure multiple XAuth authentication rounds via RADIUS.
|
|
The subsections define so called authentication profiles with arbitrary
|
|
names. In each profile section one or more XAuth types can be configured,
|
|
with an assigned message. For each type a separate XAuth exchange will be
|
|
initiated and all replies get concatenated into the User-Password attribute,
|
|
which then gets verified over RADIUS.
|
|
|
|
Available XAuth types are **password**, **passcode**, **nextpin**, and
|
|
**answer**. This type is not relevant to strongSwan or the AAA server, but
|
|
the client may show a different dialog (along with the configured message).
|
|
|
|
To use the configured profiles, they have to be configured in the respective
|
|
connection in **ipsec.conf**(5) by appending the profile name, separated by
|
|
a colon, to the **xauth-radius** XAauth backend configuration in _rightauth_
|
|
or _rightauth2_, for instance, _rightauth2=xauth-radius:profile_.
|