Freeradius is an open source radius server

learn more… | top users | synonyms

9
votes
1answer
1k views

Configuring WPA2-Enterprise with Freeradius

I'm trying to set up an authenticated wifi network with Freeradius. I've managed to get things working using self-signed certs etc. The problem is Windows clients need to uncheck the "Automatically ...
6
votes
1answer
254 views

Need help understanding PAM directives

I have the following directives in my /etc/pam.d/sshd file on a RHEL5 box and I'm a bit confused. These directives are there to make LDAP+RADIUS+OTP work. What I'm trying to do is tell pam not to ...
5
votes
2answers
2k views

FreeRADIUS2 and LDAP Authentication

I am currently running a CentOS 5.5 box with FreeRADIUS2 on it. I have the simple authentication turned on right now (username and pass is set via /etc/raddb/users). I want to have FreeRADIUS ...
4
votes
1answer
433 views

Trying to authenticate to a Dell PowerConnect 5324 switch using FreeRADIUS and OpenLDAP

So here's the situation. I want to be able to use my LDAP credentials to log into this switch. Since there is no support for LDAP on the switch itself, I figured that FreeRADIUS has an LDAP module, ...
3
votes
1answer
486 views

How many user/supplicant certificates are needed for WPA2 enterprise on a small network?

I am running WPA2 enterprise for wireless access and I followed the instructions in /etc/raddb/certs/README and the freeRadius site howto. I also read the instructions in the privacywonk site. The ...
3
votes
3answers
2k views

802.1x PEAP GPO that trusts self-signed CA certificate

I am working on a Freeradius backed 802.1.x authentication infrastructure for our wireless clients. I am using a rather generic Freeradius configuration with EAP-PEAP. Our clients are predominantly ...
3
votes
0answers
186 views

Multiple Valid Certificates in Windows 7 breaking Wired 802.1x Deployment

I have a Wired 802.1x deployment using TLS machine authentication on Windows 7 (built-in 802.1x supplicant) with the necessary certs (FreeRadius v2.2.3 generated on Linux). Cisco C2960 POE switch is ...
3
votes
1answer
2k views

Auth-Type :- Reject in RADIUS users file matches inner tunnel request but sends Access-Accept

I have WPA2 802.11x EAP authentication setup using FreeRADIUS 2.1.8 on Ubuntu 10.04.4 talking to OpenLDAP, and can successfully authenticate using PEAP/MSCHAPv2, TTLS/MSCHAPv2 and TTLS/PAP (both via ...
2
votes
2answers
444 views

Meraki's Accounting-Requests to RADIUS server

I'm running a RADIUS server with some Meraki APs, the process of Authentications is fine... But it seems that the Meraki Cloud Controller is just sending the authentication packets and not the ...
2
votes
2answers
133 views

freeradius two factor without factor concatenation

I have a cisco router providing an SSL VPN server which is talking to freeradius, which in turn uses pam and two pam modules (sss & yubico) to provide two factor authentication for the VPN. All ...
2
votes
1answer
188 views

Allowing multiple IP addresses for a single VPN user

Currently for one of the company I am using ASA 5505 as an VPN server with freeradius (mysql module) as an authentication backend. User authenticatin is based on the group password, user password ...
2
votes
1answer
788 views

Debian build the freeradius package with unixodbc support

Here is what I am trying to achieve, we want to install freeradius using a Microsoft SQL backend. I read on the internet that we need to achieve this goal using the unixodbc driver. I am able to set ...
2
votes
1answer
3k views

Accounting setup in freeradius with mikrotik and the “always” module

I have a freeradius setup that is being used to provide authentication for users on a wireless network. The access points are all Mikrotik hardware and the users are connected 24/7. We've been ...
2
votes
0answers
49 views

FreeRadius Server: RadGroupReply attribute for maximum connected users?

I have a FreeRadius server and I'd like to set a limitation for the number of users connected to a specific NAS. My current set up is that every user that connects to a certain NAS is added to the ...
2
votes
1answer
1k views

Configure Freeradius to check a connecting user against multiple LDAP groups

I'm setting up a Cisco ASA as a client vpn server. The appliance is relying on freeradius to authenticate the users. Freeradius has in turn been configured to query OpenLDAP. The modules/ldap file ...
2
votes
0answers
756 views

Dynamic VLANs with FreeRadius, OpenLDAP & Cisco WLC

Currently have a FreeRADIUS 1.1.6 server authenticating users from OpenLDAP which are stored in the posixAccount account schema. We've now installed a Cisco WLC, and want to authenticate those users ...
1
vote
2answers
39 views

Point of Shared Secrets on RADIUS Servers over a Cisco Switch

I was wondering what the point of Shared Secrets are on RADIUS servers if I set the secret in the Cisco switch configuration. If the supplicant wanting to be authenticated does not have to know it, ...
1
vote
1answer
110 views

Configuring rlm_rest module in FreeRadius

using FreeRADIUS I need to authenticate RADIUS users against a web backend and have been attempting to use the rlm_rest module to do it. See here. In my site configuration I have something like this: ...
1
vote
2answers
228 views

Freeradius: Assign Group to User based on Nas-IP-Address

I wonder if anyone can help me. The goal is to assign different users different ip address based on the AP they connect to. I cannot statically set this as users will travel and end up connecting ...
1
vote
1answer
670 views

Reload Freeradius clients without restart the service

Is there a way to reload the Freeradius clients configuration without restarting the service? I'm using: Ubuntu Server 12 Freeradius 2.1.10 MySQL v5.5.20 (I'm storing the clients in the "nas" table) ...
1
vote
2answers
4k views

Freeradius authentication failed for unknown reason

I followed this instruction to force freeradius to use mysql database. and run freeradius in debug mod. but it rejects all authentication. mysql database : mysql> select * from radcheck; ...
1
vote
1answer
5k views

Cannot log into my RADIUS protected wireless connection. Here's the LOG contents

As soon as someone tries to connect to my network, this appears in the log: Tue May 3 15:58:40 2011 : Error: TLS Alert read:fatal:unknown CA Tue May 3 15:58:40 2011 : Error: TLS_accept:failed ...
1
vote
1answer
667 views

Can freeradius bypass authentication for one realm only?

I have a question similar to this one, but without the VLAN complications. How can(?) I configure FreeRadius 1.x to allow any combination of username/password for one realm only? If FreeRadius 1.x ...
1
vote
1answer
267 views

Write hash password to LDAP when creating a new user

I am working on a project with a central user database system. One of the requirements of the system is that there should be only one set of users for all the application. FreeRADIUS and Samba are two ...
1
vote
2answers
526 views

How to limit user's access to a specific NAS?

I'm new to RADIUS and I have just set up a very basic FreeRADIUS server for 802.1x (WPA). I use EAP, MySQL as backend with daloRADIUS as webGUI (for user management, mainly). I got two WiFi networks, ...
1
vote
1answer
538 views

possible? radius server with active directory users and google authentication

We currently have an old RSA token - Radius environment we want to replace Would this architecture be possible? (this works, there are examples on the internet) Linux server Google Authentication ...
1
vote
1answer
170 views

Safe alternatives to using iptables redirection for database

We are using MySQL for our FreeRADIUS user store and accounting database for our web application. I would like to separate the accounting portion of the database, move it to a new server to lighten ...
1
vote
1answer
265 views

Requiring 802.1x login before allowing access to network resources

I have a ZyXel GS2200-24 managed switch, and a free-radius server running on Ubuntu 11.10. Radius is configured and when I log into the switch the authentication goes through Radius. Now, I'm trying ...
1
vote
1answer
267 views

TLS from Radius for Wifi is rejected by Win7

We do have the following Setup at our company Synology RS812+ hosting LDAP, RADIUS, DNS (Version DSM 5.0-4458 Update 2) 2*Cisco Wifi APs WAP561 (Firmware 1.0.3.4) Cisco Router ISA500 (Firmware ...
1
vote
1answer
187 views

l2tp/pptp + freeradius (accounting information only gets updated on disconnect)

I have a basic PPTP/L2TP setup that uses a remote freeradius server with mysql. Issue is that when a user gets connected to the vpn and as long as the user stays connected (could be hours), no ...
1
vote
0answers
68 views

Checking Statement of Health (NAP) info on Linux using Dhcp and Radius

I have a Linux DHCP server and windows clients. I want my DHCP server to assign an IP address from a network let's say 10.6.3.0/255.255.255.128 if the client has it's firewall enabled or an IP address ...
1
vote
1answer
66 views

Replacing a Freeradius library

I have a freeradius 2.0.4 server i want to update.it has been running without interruption for 2 years. My update consists only in updating the chap module without creating a new one. To avoid ...
1
vote
1answer
384 views

freeradius server adding additional check

I successfully managed to deploy a freeradius server and created a python script which does an additional check on the user (incoming request). I checked the internet (resources for freeradius are ...
1
vote
1answer
178 views

Howto change the default radius logging path for accounting?

I have freeradius 2.1.12+dfsg-1.2 working and logging accounting packets to /var/log/freeradius/radacct/detail-20130401. However I need to tail the log and I want to ideally tail a single log file ...
1
vote
1answer
441 views

Cisco 3750 switch wont transmit radius request to server

We have a radius server running on our lan and i am able to authenticate against it through direct link to the server. However when we want our clients to connect through our switch (cisco 3750 ...
1
vote
0answers
383 views

FreeRadius external authenification script

I am trying to configure FreeRadius to work with my external authentification script. I have a custom module exec myscript { wait = yes shell_escape = yes program = ...
1
vote
0answers
118 views

authentication of VM's using PPPoE

I have two VM's running on Ubuntu box.Their name and IP addresses are give below. nas 192.168.129.153 home_user 192.168.129.152 I establish a ppp connection ...
1
vote
0answers
383 views

Debian 6.0.3, Freeradius 2.1.10, PostgreSQL 8.4 High memory Usage

We are running a Freeradius server on a VMware server and we have a high memory usage that I am trying to troubleshoot. We are running the PostgreSQL 8.4 as the database backend on the same server for ...
0
votes
2answers
365 views

What is the best methodology for managing backups of configuration files on unix/linux systems?

Hey Serverfault community, So what are the best practices for managing backups of various configuration files on a production unix/linux systems? for example, (and why I am asking). I am part of a ...
0
votes
1answer
388 views

Where can I find the users file for FreeRADIUS in Ubuntu?

I'm using Ubuntu 10.10. I'm trying to learn how to configure a RADIUS server, but I'm having trouble with creating new users to authenticate. Almost all of the tutorials I've found online mention ...
0
votes
1answer
94 views

FreeRADIUS clients to access service with username and password with access periods

I am using freeradius/mysql/daloradius. I need my customers to be able to login using a username and password that they signed up with and at the same time give them different access periods. How do ...
0
votes
1answer
714 views

Monitor freeradius for failed login attempts and trigger email to user

We have 2 freeradius authentication servers which service around 12k users. Users often enter incorrect credentials and this causes significant strain on the helpdesk. I'd like to write a script to ...
0
votes
1answer
14 views

How to force JSON when using FreeRADIUS REST Module

I have compiled in JSON support to FreeRADIUS 3.0.2 however I note that if I configure authorisation to use POST it is sending RADIUS attributes encoded as application/x-www-form-urlencoded Is there ...
0
votes
1answer
42 views

FreeRADIUS Rest Module on Centos 6.x

I am attempting to add JSON support for the REST module on Centos 6.5 I have installed the json-c-devel package however when compiling FreeRADIUS it complains it can't find it: [root@dhcp01]# ...
0
votes
1answer
38 views

Configuring a RADIUS server for 802.1x over a Cisco Switch

I am trying to set up RADIUS authentication over a Cisco switch and I have gone through every tutorial they have. I am able to get the RADIUS server to authenticate when I access the CLI of the Cisco ...
0
votes
1answer
160 views

Configuring dhcp module in FreeRadius (3.0.2 - Centos 6.5)

I am using the REST module to authorise a DHCP request. I would like to send an explicit DHCP NAK if the authorisation fails, however the DHCP module seems to return immediately if there is a failure ...
0
votes
2answers
80 views

RADIUS-sever: Hashing password before checking

I do have to set up a RADIUS server for authentication with a captive portal of pfSense. Unfortunately, all passwords in the RADIUS' database are hashed with a certain algorithm. I do use a ...
0
votes
1answer
650 views

FreeRadius MSCHAP Authentication With Realm Fails

I have FreeRadius 2.0 server with AD as user store. Authenticating using EAP-PEAP-MSCHAP2.Local realm is defined in proxy.conf. Authentications works fine without realm added to the username. As soon ...
0
votes
1answer
187 views

Authenticate Radius user using pam and ssh [duplicate]

I am able to authenticate radius users using radius server+pam+ssh with creating local user with blank password in linux. Is it possible to authenticate radius users without creating users in local ...
0
votes
1answer
442 views

Multiple NAS-IP-Address check attributes in FreeRadius?

is it possible to have an OR statement in freeradius check attributes? I have say 10 VPN servers that authenticate from freeradius. Most users can access all servers but I have a demo user that can ...