Questions tagged [radius]

Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for computers to connect and use a network service.

0
votes
1answer
17 views

802.1x and NPS to secure wired intranet

I want to secure our network from unmanaged device (for example a user brings a laptop from home and connects it to a port in a meeting room). As far as I understood I can use 802.1x and a RADIUS ...
0
votes
0answers
18 views

pam_radius_auth with pam_script creates user but first authentication fails

on a CentOS 7 server I have a successfully working pam_radius_auth (installed from epel). I can authenticate on a windows NPS radius but only if the user already exists. In /etc/pam_radius.conf I ...
1
vote
0answers
35 views

Network Policy Server + RADIUS not listening on any ports for Windows Server 2019

I must be missing something basic - is there some "master" switch for enabling Network Policy Server? It's not listening on any of the RADIUS ports. Detail: Trying to setup Windows Server 2019 as a ...
0
votes
0answers
17 views

RADIUS Server won't authenticate user with MAC in “Verify Caller ID”

I have a domain Controller with RADIUS server installed in. The problem I face is, Users can be authenticated if their "Dial-In" Verify Caller-ID is disabled but as soon it is provided with MAC ...
0
votes
1answer
45 views

Adding compiled FreeRADIUS to systemd

Working on getting FreeRADIUS up and running and having issues adding to systemd. Running standalone via radiusd -X works expected and all of the custom configurations are intact. Using freetds ...
0
votes
1answer
24 views

Strongswan cannot authenticate with FreeRADIUS server: DNS error

I'm trying to set up RADIUS auth with my Strongswan server. I get the following error: Jun 2 20:51:47 nl1 charon: 17[LIB] resolving 'radius.server.com' failed: Name or service not known Jun 2 20:...
1
vote
0answers
9 views

Certification Authority not issuing the right certificates for SCEP client

I'm doing certificate-based WiFi authentication (EAP-TLS). I have set up the CA server and in MMC console, I have added the certificate snap-in. In the certificate authority console, I've duplicated a ...
2
votes
1answer
54 views

EAP-TLS: How to verify a p12 key with freeradius?

I installed a Radius server with a EAP-TLS only configuration. I have a client.p12 file that is supposed to contain both the root-CA and the client certificate. I added the p12 key https://...
0
votes
0answers
17 views

Freeradius: differentiate between failed authentication and unknown username

I would like to configure a freeradius server to send a different answer when a user does not exist and not just "authentication failed". That way I could have a different behavior in with clients ...
0
votes
1answer
88 views

RADIUS configurations on Server 2008 R2 - WiFi issue

I have configured WiFi authentication on FortiGate 100D through RADIUS on Windows server 2008 R2. When I'm trying to connect to the wifi from a PC (Win 10), it works only when I check "Use my Windows ...
0
votes
0answers
17 views

Q: handling accounting request to count user download traffic

I'm trying to write a rest app to be used as FreeRadius backend (by rlm-rest) Kindly please tell we what Radius Accounting Attribute can be used to count usage of a NAS in periodic? I'm looking at ...
1
vote
1answer
55 views

WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?

We are using, as default, PEAP and MS-CHAPv2 as inner authentication. I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
0
votes
0answers
17 views

RADIUS server to point my Azure deployment to for MFA

Our developer handed me (the Sys Admin) a PowerShell script to be ran in Azure Cloud Shell. It deploys various Resource Groups and a DC hosting a private FQDN in a Test environment. One of the input ...
0
votes
0answers
31 views

Draytek Host to LAN VPN using RADIUS not connecting

I have set up a brand new Draytek 2952 with the latest firmware 3.9.0. I have an external RADIUS set up so that it should authenticate domain users using the external radius server (setup on Windows ...
0
votes
1answer
57 views

Can I make cisco router to act like a radius server?

I need to configure local radius authentication on my cisco router. I have web application in which we have implemented dual factor authentication it works fine with other radius server like ...
1
vote
1answer
85 views

Suddenly RADIUS authentication is gone on macOS server (TLS session fails)

Suddenly my RADIUS authentication is gone on my MacOS Server running 10.13.6 and Server Version 5.6.1 (17S2109. I already restored the Open Directory Server. $ host name.domain.tld name.domain.tld ...
0
votes
1answer
249 views

Is it ok to use PAP with TTLS on radius server?

We have deployed Radius server ( Freeradius 3.x ) and connected it to our LDAP database (ForgeRock OpenDJ). We have successfully configured EAP-TTLS with valid certificates and set it as default ...
1
vote
1answer
233 views

Use CHAP with NPS and a Domain Controller in Core

I've noticed a difference on the authentication behavior of Active Directory where the Core version failed to authenticate properly when using CHAP from the NPS server. I have reproduct the problem ...
0
votes
0answers
41 views

Server certificate validation 802.1x

I have recently deployed CA and NPS for WPA2-Enterprise authentication. However doing the pen testing I found out that clients are accepting a certificate from any valid certificate authority. This is ...
2
votes
0answers
255 views

FreeRADIUS with Let's Enrypt Certificate (trusted connection without provisioning?)

I have a FreeRADIUS server set up for PEAP/MSCHAPv2 connections with an SQL user backend. On that server, I have set up a Let's encrypt certificate for domain access.example.org. This certificate is ...
0
votes
2answers
497 views

FreeRADIUS with LDAP vs Kerberos

The following site discusses how to setup FreeRADIUS to authenticate against an LDAP backend (it goes through a tutorial showing how to expose NT hashed passwords in FreeIPA so that FreeRADIUS can ...
0
votes
1answer
235 views

StrongSwan on Amazon Linux with RADIUS

I'm trying to run strongSwan on an Amazon Linux instance with authentication against RADIUS but I receive an error when trying to start strongSwan charon[9518]: 00[CFG] RADIUS initialization failed, ...
0
votes
0answers
68 views

Any way to change RADIUS source IP address in access request packet?

I have an LDAP server doing RADIUS auth to an OTP server which runs over Stunnel. The RADIUS server uses the source IP (I think this is the NAS Identifer) in the access-request packet as a key to ...
5
votes
2answers
569 views

2FA via freeRADIUS, ignoring password

I've been tasked with setting up freeRADIUS to prompt a user for their second authentication factor (eg. Google Authenticator OTP) BUT without first checking the user's password. I'm coming into this ...
0
votes
0answers
160 views

nginx captive portal radius authentication

I have multiple Ruckus Access Point and I want to provide a custom captive portal for guest authentication. The thing I want is to check if user currently has access - then switch him to the site he ...
0
votes
1answer
132 views

Log usernames in squid for clients connected in WiFi with Radius

I am looking for a solution to a problem: Clients connect to the WiFi network using a Radius server and then use the Internet through a transparent Squid server that logs access. I would like to ...
0
votes
0answers
42 views

Expired DC certificate back after reboot

In our environment we use DC-Cluster_CA to generate SSL certificates for .foo-bar.local domains for internal use. Example is certificate 'DC-01.foo-bar.local' The Radius server also uses this ...
2
votes
1answer
679 views

smb fails to start on centos7 radius server

I have a working radius server that auths connections to a PDC AD server. I wanted to create another one so that I can fail over on the firewall when needed. I created a second server using the same ...
-2
votes
1answer
23 views

radius or wpa2 error? - comptia network+ [closed]

Im taking the COMPTIA Network+ exam on thursday and have this practice question I dont understand the difference: Users connecting to an SSID appear to be unable to authenticate to the captive portal....
0
votes
0answers
243 views

Freeradius User Group Membership Not Working

dictionary file: ATTRIBUTE My-Group 3003 string users file: reza My-Group := "operators", Cleartext-Password := "hello" Fall-Through := Yes bob My-Group := "...
1
vote
0answers
393 views

Freeradius multi-factor auth with LDAP and Yubikey

I just set up a freeradius server and would like to be able to authenticate using both the password of a ldap user and the yubico otp generated from their yubikey. It is working using the ldap ...
0
votes
1answer
43 views

Some Macs not authorizing via 802.1x

Hello I have a really weird issue with some macs not being able to connect to 801.1x in some areas on campus. They however can connect in other places on campus. The configs for both switches are the ...
1
vote
1answer
259 views

Allow user to ssh to server without having local account

I have a pam_radius module set up on a rhel7 server. A user with a local account is able to ssh into the server with the radius login information. I was wondering if it is possible to allow a user ...
0
votes
1answer
52 views

RADIUS Will Not Authenticate For Console & SSH

I am trying to RADIUS authenticate on my HP ProCurve 2910al W14.38 with both console and SSH. My show authentication shows the following: Access Task | Login Primary Login Secondary Enable ...
0
votes
1answer
77 views

Advice on deploying services like NTP, DNS, Radius etc for a small NOC

network engineer here. I recently deployed a small office network and was asked to help out with deployment of some of the services. I have two ESXi servers on my hands and I need to deploy NTP, ...
3
votes
2answers
1k views

MSCHAPv2 authentication not working

I've been fighting with this for around a week now. I'm trying to get a RADIUS server to authenticate against our Samba-based Active Directory, but I can't get it to work. Because of our ...
1
vote
1answer
763 views

“Transport encryption required” when using transport encryption

I'm trying to set up a radius server to authenticate against LDAP, but I'm running into a weird issue: rlm_ldap (ldap): Bind with radiusd@[domain] to ldaps://localhost:636 failed: Strong(er) ...
0
votes
1answer
520 views

How Windows check radius server certificate?

How Windows check radius server certificate (for wifi connections)? Does it look only on CN field from radius server certificate and not look at Subject Alternative Name field altogether? I did some ...
0
votes
1answer
337 views

What is expected value of SMD5-Password in freeradius' user config file?

I am using freeradius v2.1.12 on Ubuntu v14.04. Here is /etc/freeradius/users: test SMD5-Password := "{SMD5}xbYqJDY4gqVyE8Vhty//QnRlc3RpbmcxMjM=" I get this value by using the perl script from ...
0
votes
1answer
3k views

Why freeradius server says invalid Message-Authenticator which is generated from radtest?

I am learning how to use freeradius, the version is v2.1.12. When I run radtest, there is no response from server, I see server side debug message has the following: Received packet from 127.0.0.1 ...
1
vote
1answer
2k views

Is it possible to host a RADIUS server on Windows 7 [closed]

Is it possible to host a RADIUS server on Windows 7. I am trying to use this as an authenticating server for my Routers. A third-party application is fine, however maybe if its possible it can use ...
5
votes
1answer
6k views

Use Azure Active Directory as RADIUS server for VPN gateway?

I'm using Azure Active Directory (Premium, with full MFA). I've set up a VPN gateway and would like users to be able to authenticate to it using their Azure AD username and password (instead of ...
1
vote
0answers
341 views

Azure VPN using RADIUS to solve local admin requirements

Now that Azure point to site VPN can be authenticated via RADIUS, would using RADIUS instead of certificates change the need for local admin privilege? I have clients that connect to Azure via point ...
0
votes
1answer
298 views

Asus AC5300 WPA2 enterprise hourly disconnection

I have an Asus RT-AC5300 running the latest stock firmware setup with WPA2 Entreprise. I can connect to the Wi-Fi with the radius server without any issue but I get disconnected every single hour. I ...
1
vote
0answers
233 views

Freeradius Proxy eap-mschapv2 auth to non-eap Radius server

I'm using strongswan 5.6.0 & Freeradius 3.0.13 on CentOS7 as vpn server - Strongswan send radius requests to freeradius - freeradius proxy all request to another Radius Server that not support EAP ...
0
votes
1answer
1k views

Strongswan Installation for CentOS 7

I'm want to use IKEv2 VPN on a CentOS 7.* VMs, and I want to Authenticate the users with our RADIUS server. Currently, I'm using yum install strongswan command to install the strongswan repo, but it ...
0
votes
1answer
2k views

How do I add RADIUS clients to Windows NPS without a known IP or DNS?

When trying to add a RADIUS client to Windows NPS, it REQUIRES an IP address. What if this IP address is known? i.e. using cloud based WAPs with WPA Enterprise authentication? i.e. CloudTrax, ...
1
vote
0answers
218 views

Use two Auth-Type in FreeRadius

I have a RADIUS server with works with mysql, I use this RADIUS for AAA for 2 different services, Service1 uses Auth-Type as "PAP" and Service2 uses "EAP" radcheck table +-----+----------+-----------...
0
votes
1answer
565 views

proxy.conf file in freeradius

I am working on free radius management System which I developing it with PHP language. my system will be available on the cloud, suppose there are company1 and company2 which will use our system. ...
0
votes
1answer
189 views

How to clone and restore FreeRadius setup in another server?

I have an up and running Freeradius instance in Ubuntu server with several configuration changes. Is there a standard way of cloning this radius server to another server with same configurations. My ...