9

I'm trying to set up an authenticated wifi network with Freeradius. I've managed to get things working using self-signed certs etc.

The problem is Windows clients need to uncheck the "Automatically use my windows logon name and password [etc.]" option in the MSCHAPv2 settings. When I connect to my local university with Eduroam, it automatically asks for a username and password instead of sending windows login credentials. How did the sysadmins accomplish this? Is it some kind of RADIUS Attribute that gets sent back?

Improve this question
6
  • Have you tried emailing the administrators of your University's Eduroam?
    – Michael
    Feb 3, 2012 at 17:22
  • I have emailed my national eduroam administrator, no answer so far.
    – Vincent O.
    Feb 18, 2012 at 15:29
  • It may be just that, when the initial credentials get sent, RADIUS kicks back Access-Reject so Windows decides to prompt the user instead of sending the other credentials again. Are you using SecureW2 or something else?
    – Michael
    Feb 18, 2012 at 21:21
  • -edit- Now it's broken again. I am using the Win7 native supplicant. How do I send back Access-Reject? Can I use the DEFAULT entry in the users config file for that and if so, how?
    – Vincent O.
    Feb 22, 2012 at 16:27
  • Every guide I've seen for Eduroam requires you to make the same changes to the configuration profile for Eduroam.
    – Zanchey
    Oct 4, 2012 at 13:15

1 Answer 1

Reset to default
2

This is more of an answer to the comments than the question, but putting it here so I can format it:

You could use the DEFAULT entry in your users file along with a huntgroup to match users based on the username provided.

First step would be to run radiusd in debug mode radiusd -X and capture the format which the username comes in as when it's authenticating as the logged in user, iirc it's something like /hostname$/account.

You can then specify the huntgroup in $raddbdir/huntgroups using a regular expression:

badusers User-Name =~ ^aregex.*$

Then add the huntgroup to a rule with an access-reject return type in the users file.

DEFAULT Huntgroup-Name == badusers, Auth-Type := Reject

Whether this will cause Windows to prompt for a username and password depends on your NAS and the Windows WPA supplicant.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .