FreeRADIUS is an open source RADIUS server

learn more… | top users | synonyms

9
votes
1answer
1k views

Configuring WPA2-Enterprise with Freeradius

I'm trying to set up an authenticated wifi network with Freeradius. I've managed to get things working using self-signed certs etc. The problem is Windows clients need to uncheck the "Automatically ...
6
votes
1answer
904 views

Need help understanding PAM directives

I have the following directives in my /etc/pam.d/sshd file on a RHEL5 box and I'm a bit confused. These directives are there to make LDAP+RADIUS+OTP work. What I'm trying to do is tell pam not to ...
5
votes
2answers
3k views

FreeRADIUS2 and LDAP Authentication

I am currently running a CentOS 5.5 box with FreeRADIUS2 on it. I have the simple authentication turned on right now (username and pass is set via /etc/raddb/users). I want to have FreeRADIUS ...
4
votes
0answers
658 views

Multiple Valid Certificates in Windows 7 breaking Wired 802.1x Deployment

I have a Wired 802.1x deployment using TLS machine authentication on Windows 7 (built-in 802.1x supplicant) with the necessary certs (FreeRadius v2.2.3 generated on Linux). Cisco C2960 POE switch is ...
4
votes
1answer
576 views

Trying to authenticate to a Dell PowerConnect 5324 switch using FreeRADIUS and OpenLDAP

So here's the situation. I want to be able to use my LDAP credentials to log into this switch. Since there is no support for LDAP on the switch itself, I figured that FreeRADIUS has an LDAP module, ...
3
votes
2answers
5k views

Centos 7. Freeradius fails to start on boot due to priority

I was messing around with FreeRADIUS and MySQL (MariaDB) and it seems FreeRADIUS service can't start properly on startup. But it starts fine using root user or in debug mode (radiusd -X) and works ...
3
votes
1answer
2k views

Debian build the freeradius package with unixodbc support

Here is what I am trying to achieve, we want to install freeradius using a Microsoft SQL backend. I read on the internet that we need to achieve this goal using the unixodbc driver. I am able to set ...
3
votes
1answer
682 views

How many user/supplicant certificates are needed for WPA2 enterprise on a small network?

I am running WPA2 enterprise for wireless access and I followed the instructions in /etc/raddb/certs/README and the freeRadius site howto. I also read the instructions in the privacywonk site. The ...
3
votes
1answer
3k views

Configure Freeradius to check a connecting user against multiple LDAP groups

I'm setting up a Cisco ASA as a client vpn server. The appliance is relying on freeradius to authenticate the users. Freeradius has in turn been configured to query OpenLDAP. The modules/ldap file ...
3
votes
4answers
3k views

802.1x PEAP GPO that trusts self-signed CA certificate

I am working on a Freeradius backed 802.1.x authentication infrastructure for our wireless clients. I am using a rather generic Freeradius configuration with EAP-PEAP. Our clients are predominantly ...
3
votes
1answer
3k views

Auth-Type :- Reject in RADIUS users file matches inner tunnel request but sends Access-Accept

I have WPA2 802.11x EAP authentication setup using FreeRADIUS 2.1.8 on Ubuntu 10.04.4 talking to OpenLDAP, and can successfully authenticate using PEAP/MSCHAPv2, TTLS/MSCHAPv2 and TTLS/PAP (both via ...
2
votes
1answer
2k views

Configuring rlm_rest module in FreeRadius

using FreeRADIUS I need to authenticate RADIUS users against a web backend and have been attempting to use the rlm_rest module to do it. See here. In my site configuration I have something like this: ...
2
votes
2answers
912 views

Meraki's Accounting-Requests to RADIUS server

I'm running a RADIUS server with some Meraki APs, the process of Authentications is fine... But it seems that the Meraki Cloud Controller is just sending the authentication packets and not the ...
2
votes
2answers
1k views

freeradius two factor without factor concatenation

I have a cisco router providing an SSL VPN server which is talking to freeradius, which in turn uses pam and two pam modules (sss & yubico) to provide two factor authentication for the VPN. All ...
2
votes
2answers
9k views

Freeradius authentication failed for unknown reason

I followed this instruction to force freeradius to use mysql database. and run freeradius in debug mod. but it rejects all authentication. mysql database : mysql> select * from radcheck; ...
2
votes
1answer
569 views

Allowing multiple IP addresses for a single VPN user

Currently for one of the company I am using ASA 5505 as an VPN server with freeradius (mysql module) as an authentication backend. User authenticatin is based on the group password, user password ...
2
votes
1answer
5k views

Accounting setup in freeradius with mikrotik and the “always” module

I have a freeradius setup that is being used to provide authentication for users on a wireless network. The access points are all Mikrotik hardware and the users are connected 24/7. We've been ...
2
votes
0answers
486 views

FreeRADIUS using Active Directory integration broken without any traces

I've a FreeBSD 10.0 server running FreeRADIUS 3 and things got broken without any apparent reason. I'm using Winbind from Samba4 to authenticate with ntlm_auth. I've done some debug to solve the ...
2
votes
1answer
375 views

FreeRadius Server: RadGroupReply attribute for maximum connected users?

I have a FreeRadius server and I'd like to set a limitation for the number of users connected to a specific NAS. My current set up is that every user that connects to a certain NAS is added to the ...
2
votes
0answers
1k views

Dynamic VLANs with FreeRadius, OpenLDAP & Cisco WLC

Currently have a FreeRADIUS 1.1.6 server authenticating users from OpenLDAP which are stored in the posixAccount account schema. We've now installed a Cisco WLC, and want to authenticate those users ...
2
votes
2answers
2k views

TLS from Radius for Wifi is rejected by Win7

We do have the following Setup at our company Synology RS812+ hosting LDAP, RADIUS, DNS (Version DSM 5.0-4458 Update 2) 2*Cisco Wifi APs WAP561 (Firmware 1.0.3.4) Cisco Router ISA500 (Firmware ...
1
vote
2answers
277 views

Point of Shared Secrets on RADIUS Servers over a Cisco Switch

I was wondering what the point of Shared Secrets are on RADIUS servers if I set the secret in the Cisco switch configuration. If the supplicant wanting to be authenticated does not have to know it, ...
1
vote
2answers
343 views

Freeradius and self signed-certificate

our current wi-fi infrastructure is based on a Debian box that hosts Freeradius with LDAP backend. Currently we have two 802.1x protected SSIDs, a public and a private network: depending on an LDAP ...
1
vote
2answers
3k views

Freeradius: Assign Group to User based on Nas-IP-Address

I wonder if anyone can help me. The goal is to assign different users different ip address based on the AP they connect to. I cannot statically set this as users will travel and end up connecting ...
1
vote
1answer
368 views

Is there a way to make systemctl start synchronous

I'm developing/have developed a unit file for the FreeRADIUS project to integrate with systemd. [Unit] Description=FreeRADIUS multi-protocol policy server After=syslog.target network.target ...
1
vote
1answer
59 views

mod_auth_radius secure over https?

mod_auth_radius README file says: Using static passwords & RADIUS authentication over the web is a BAD IDEA. Everyone can sniff the passwords, as they're sent over the net in the clear. If I ...
1
vote
1answer
1k views

FreeRADIUS and Redis Module

I am wanting to use FreeRADIUS with REDIS for authorisation and accounting. I am running FreeRADIUS 3.0.3. I note the rlm_rediswho module, which appears to be used for caching recent accounting ...
1
vote
1answer
2k views

Reload Freeradius clients without restart the service

Is there a way to reload the Freeradius clients configuration without restarting the service? I'm using: Ubuntu Server 12 Freeradius 2.1.10 MySQL v5.5.20 (I'm storing the clients in the "nas" table) ...
1
vote
1answer
1k views

Monitor freeradius for failed login attempts and trigger email to user

We have 2 freeradius authentication servers which service around 12k users. Users often enter incorrect credentials and this causes significant strain on the helpdesk. I'd like to write a script to ...
1
vote
1answer
8k views

Cannot log into my RADIUS protected wireless connection. Here's the LOG contents

As soon as someone tries to connect to my network, this appears in the log: Tue May 3 15:58:40 2011 : Error: TLS Alert read:fatal:unknown CA Tue May 3 15:58:40 2011 : Error: TLS_accept:failed ...
1
vote
1answer
865 views

Can freeradius bypass authentication for one realm only?

I have a question similar to this one, but without the VLAN complications. How can(?) I configure FreeRadius 1.x to allow any combination of username/password for one realm only? If FreeRadius 1.x ...
1
vote
1answer
29 views

Windows cannot connect to Enterprise WPA2 WiFi access point with EAP-TTLS PAP authentication using freeradius

I was working on having an Enterprise WiFi access point where my clients need to enter username and password (which are in OpenLDAP directory), using AES, TTLS PAP. I setup my freeradius according to ...
1
vote
1answer
35 views

Radius and FE80::/16 ignoring client

Why is my freeradius sever ignoring FE80::/16 clients? client.conf: client localhost { ipaddr = 127.0.0.1 < secret = testing123< require_message_authenticator = no nastype = ...
1
vote
1answer
147 views

Freeradius TLS cetificate(win 7 and previous)

I'm configuring FreeRADIUS 2.2.6. I use TLS because TTLS is not supported by windows 7. With Windows 8.1 the WiFi connection works very well without installing certificate With Windows 7 and ...
1
vote
1answer
3k views

FreeRadius MSCHAP Authentication With Realm Fails

I have FreeRadius 2.0 server with AD as user store. Authenticating using EAP-PEAP-MSCHAP2.Local realm is defined in proxy.conf. Authentications works fine without realm added to the username. As soon ...
1
vote
1answer
832 views

Authentication to Squid proxy with a RADIUS-authenticated client

I want to set up a wireless environment where WPA2-Enterprise is used for authentication to a FreeRADIUS server (using EAP-TTLS or PEAP), and the wireless client is seamlessly routed through and ...
1
vote
1answer
1k views

Write hash password to LDAP when creating a new user

I am working on a project with a central user database system. One of the requirements of the system is that there should be only one set of users for all the application. FreeRADIUS and Samba are two ...
1
vote
2answers
2k views

How to limit user's access to a specific NAS?

I'm new to RADIUS and I have just set up a very basic FreeRADIUS server for 802.1x (WPA). I use EAP, MySQL as backend with daloRADIUS as webGUI (for user management, mainly). I got two WiFi networks, ...
1
vote
1answer
1k views

possible? radius server with active directory users and google authentication

We currently have an old RSA token - Radius environment we want to replace Would this architecture be possible? (this works, there are examples on the internet) Linux server Google Authentication ...
1
vote
1answer
202 views

Safe alternatives to using iptables redirection for database

We are using MySQL for our FreeRADIUS user store and accounting database for our web application. I would like to separate the accounting portion of the database, move it to a new server to lighten ...
1
vote
1answer
304 views

Requiring 802.1x login before allowing access to network resources

I have a ZyXel GS2200-24 managed switch, and a free-radius server running on Ubuntu 11.10. Radius is configured and when I log into the switch the authentication goes through Radius. Now, I'm trying ...
1
vote
0answers
15 views

how to configure freeradius for separate Code and Password prompts, instead of a single Password prompt?

I've got a Freeradius server set up where the users in /etc/freeradius/users have Auth-Type := PAM. This makes radius refer to the /etc/pam.d/radiusd file, and in this file I have auth requisite ...
1
vote
0answers
11 views

Can a FreeRadius presenting a SHA1 certificate accept SHA2 client certificates and validate them against a CA that accepts SHA1 and SHA2 certificates?

Can a FreeRadius presenting a SHA1 certificate accept SHA2 client certificates and validate them against a CA that accepts SHA1 and SHA2 certificates? Another option would be that the FreeRadius ...
1
vote
1answer
141 views

How can I configure openLDAP to lookup userPassword via FreeRadius?

I am running Ubuntu 12.04 and OpenLDAP 2.4.28-1.1ubuntu4.5. I have users populated in LDAP with userPassword attribute being an {SHA1} hash. Users are able to login over SSH and authenticate to web ...
1
vote
0answers
276 views

freeradius client send only accounting request, not access request

I have freeradius 2.2.6. Only at first connection the client send both access request and accounting request. subsequent connections sends only accouting request! This problem occurs ONLY with sone ...
1
vote
0answers
92 views

Same VLAN for LAN only and Internet users on 802.1x network with pfSense as gateway

I am creating an ISP for a student residence. The LAN is already there and working, with several CISCO switches. I want to provide Internet by a secured and automatic way to those who pay for it ...
1
vote
1answer
441 views

Debian Samba share Authentification with RADIUS server

I'm trying to configure Samba (apt-get install samba) to authenticate users using a RADIUS server and i cannot find anything useful. Is it possible ? I tought i could set Samba to use the PAM ...
1
vote
0answers
350 views

802.1x dynamic vlan assignment not assigning VLAN

I recently dived into 802.1x authentication with dynamic vlan assigment. My current set up contains of: - A client - A SG220 cisco switch (the supplicant) - A freeradius (authenticator) ...
1
vote
0answers
96 views

How to set up a simple Cisco ISG config for controlling internet access

First off, here is my config so far. http://pastebin.com/fV2NGCE2 I've gone through a few guides online and the 15.2s manual and the xe3 manual for Cisco's ISG (intelligent services gateway) and ...
1
vote
1answer
743 views

FreeRadius Accounting not working, bad passwords not cheked

I'm trying to configure a captive portal using a router with OpenWRT+ChilliSpot and an external server with Freeradius and a Web Server. ChilliSpot 1.3.0 My issue right now is that the freeradius ...