Questions tagged [radius]

Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for computers to connect and use a network service.

0
votes
1answer
21 views

802.1x and NPS to secure wired intranet

I want to secure our network from unmanaged device (for example a user brings a laptop from home and connects it to a port in a meeting room). As far as I understood I can use 802.1x and a RADIUS ...
1
vote
1answer
1k views

HAProxy and Radius

I've a following situation: network1 - gate - network2 network2 has several services. network1 has a lot of developers. I need to make access from developers to services with separated access, for ...
0
votes
1answer
2k views

How do I add RADIUS clients to Windows NPS without a known IP or DNS?

When trying to add a RADIUS client to Windows NPS, it REQUIRES an IP address. What if this IP address is known? i.e. using cloud based WAPs with WPA Enterprise authentication? i.e. CloudTrax, ...
0
votes
0answers
19 views

pam_radius_auth with pam_script creates user but first authentication fails

on a CentOS 7 server I have a successfully working pam_radius_auth (installed from epel). I can authenticate on a windows NPS radius but only if the user already exists. In /etc/pam_radius.conf I ...
1
vote
0answers
35 views

Network Policy Server + RADIUS not listening on any ports for Windows Server 2019

I must be missing something basic - is there some "master" switch for enabling Network Policy Server? It's not listening on any of the RADIUS ports. Detail: Trying to setup Windows Server 2019 as a ...
0
votes
0answers
17 views

RADIUS Server won't authenticate user with MAC in “Verify Caller ID”

I have a domain Controller with RADIUS server installed in. The problem I face is, Users can be authenticated if their "Dial-In" Verify Caller-ID is disabled but as soon it is provided with MAC ...
1
vote
1answer
233 views

Use CHAP with NPS and a Domain Controller in Core

I've noticed a difference on the authentication behavior of Active Directory where the Core version failed to authenticate properly when using CHAP from the NPS server. I have reproduct the problem ...
0
votes
1answer
1k views

radius traffic accounting - what attributes do I use for traffic (and how)

we are building a web front end for a internet access token management system that uses radius (freeradius) queried from a captive portal. Reason for building this part is the integration into the ...
0
votes
1answer
45 views

Adding compiled FreeRADIUS to systemd

Working on getting FreeRADIUS up and running and having issues adding to systemd. Running standalone via radiusd -X works expected and all of the custom configurations are intact. Using freetds ...
0
votes
1answer
25 views

Strongswan cannot authenticate with FreeRADIUS server: DNS error

I'm trying to set up RADIUS auth with my Strongswan server. I get the following error: Jun 2 20:51:47 nl1 charon: 17[LIB] resolving 'radius.server.com' failed: Name or service not known Jun 2 20:...
3
votes
2answers
1k views

MSCHAPv2 authentication not working

I've been fighting with this for around a week now. I'm trying to get a RADIUS server to authenticate against our Samba-based Active Directory, but I can't get it to work. Because of our ...
1
vote
1answer
2k views

Microsoft NPS 2012 R2 - Can't perform authentication from Cisco ASA with PAP

I am trying to setup a Cisco ASA (version 9.1(7)6) to authenticate against a Microsoft Network Policy Server 2012 R2. The ASA is able to communicate with the NPS server, however the test aaa-server ...
2
votes
1answer
2k views

FreeRadius, login not working when using mschap

I've been trying to make RADIUS work with Zentyal without success, I've tried logging in with an Android phone and a Windows 10 PC but none of them worked. Joining the domain using LAN works fine, ...
2
votes
1answer
979 views

Google Authenticator FreeRADIUS

I'm trying to implement google authenticator PAM module in FreeRADIUS on RHEL7. I've loosely followed this guide: http://www.supertechguy.com/help/security/freeradius-google-auth The reason I say ...
1
vote
0answers
9 views

Certification Authority not issuing the right certificates for SCEP client

I'm doing certificate-based WiFi authentication (EAP-TLS). I have set up the CA server and in MMC console, I have added the certificate snap-in. In the certificate authority console, I've duplicated a ...
2
votes
1answer
57 views

EAP-TLS: How to verify a p12 key with freeradius?

I installed a Radius server with a EAP-TLS only configuration. I have a client.p12 file that is supposed to contain both the root-CA and the client certificate. I added the p12 key https://...
3
votes
1answer
2k views

Windows machines cannot connect to Radius Wifi

Environment Background: 4 Domain Controllers, DC01 DC02 DC03 DC04 DC01 is my PDC DC02 is my NPS Server The other two are load balancing and site specific. I'm using a Ruckus Zone Director with Ruckus ...
0
votes
1answer
3k views

Network Policy Server error message 'Negotiation failed. No available EAP methods'

I am trying to change our wireless access points to use RADIUS. I have installed Network Policy Server on a server and pointed our wireless access points RADIUS settings to it. I have allowed all ...
0
votes
0answers
17 views

Freeradius: differentiate between failed authentication and unknown username

I would like to configure a freeradius server to send a different answer when a user does not exist and not just "authentication failed". That way I could have a different behavior in with clients ...
5
votes
1answer
6k views

Use Azure Active Directory as RADIUS server for VPN gateway?

I'm using Azure Active Directory (Premium, with full MFA). I've set up a VPN gateway and would like users to be able to authenticate to it using their Azure AD username and password (instead of ...
5
votes
4answers
26k views

Authentication via RADIUS : MSCHAPv2 Error 691

I am working on setting up authentication into an Acme Packet Net-Net 3820 (SBC) via RADIUS. The accounting side of things is working just fine with no issues. The authentication side of things is ...
1
vote
1answer
2k views

Freeradius server is not accepting accounting packets through tcpreplay

I am running a free radius server on system A. I am sending test accounting requests using radclient radclient -x systemA acct testing123 from system B. I can see that the radius server recieved these ...
0
votes
1answer
3k views

Why freeradius server says invalid Message-Authenticator which is generated from radtest?

I am learning how to use freeradius, the version is v2.1.12. When I run radtest, there is no response from server, I see server side debug message has the following: Received packet from 127.0.0.1 ...
0
votes
1answer
88 views

RADIUS configurations on Server 2008 R2 - WiFi issue

I have configured WiFi authentication on FortiGate 100D through RADIUS on Windows server 2008 R2. When I'm trying to connect to the wifi from a PC (Win 10), it works only when I check "Use my Windows ...
1
vote
1answer
85 views

Suddenly RADIUS authentication is gone on macOS server (TLS session fails)

Suddenly my RADIUS authentication is gone on my MacOS Server running 10.13.6 and Server Version 5.6.1 (17S2109. I already restored the Open Directory Server. $ host name.domain.tld name.domain.tld ...
0
votes
1answer
997 views

Using NPS to restrict access to WLAN

We currently have one WLAN that only domain users can connect to. We will be adding a guest WLAN and would like all non-domain machines to use this, even if a user has a domain account. We have set ...
0
votes
0answers
17 views

Q: handling accounting request to count user download traffic

I'm trying to write a rest app to be used as FreeRadius backend (by rlm-rest) Kindly please tell we what Radius Accounting Attribute can be used to count usage of a NAS in periodic? I'm looking at ...
2
votes
1answer
1k views

FreeRadius - Authenticate any User & Password

I am trying to help a facility who's radius server crashed - no recoverable data. The clients are all installed (buried) in vehicles and are not readily accessible (need to tear stuff apart). Access ...
1
vote
1answer
55 views

WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?

We are using, as default, PEAP and MS-CHAPv2 as inner authentication. I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
1
vote
1answer
2k views

Cisco Remote Access VPN authenticating via RADIUS over Site2Site VPN

Is it possible to setup the remote access VPN to athenticate to a RADIUS server that is on the other end of a Site to site VPN on the same ASA? I have an ASA 5505 that is at a branch office with a ...
0
votes
0answers
17 views

RADIUS server to point my Azure deployment to for MFA

Our developer handed me (the Sys Admin) a PowerShell script to be ran in Azure Cloud Shell. It deploys various Resource Groups and a DC hosting a private FQDN in a Test environment. One of the input ...
2
votes
1answer
681 views

smb fails to start on centos7 radius server

I have a working radius server that auths connections to a PDC AD server. I wanted to create another one so that I can fail over on the firewall when needed. I created a second server using the same ...
0
votes
1answer
1k views

system authentication and radius authentication

I am using CentOS 6.3 and want to enable ssh RADIUS authentication along with Centos system Authentication. Right now my server is firstly authenticated with RADIUS server. And after system ...
0
votes
0answers
32 views

Draytek Host to LAN VPN using RADIUS not connecting

I have set up a brand new Draytek 2952 with the latest firmware 3.9.0. I have an external RADIUS set up so that it should authenticate domain users using the external radius server (setup on Windows ...
0
votes
1answer
1k views

freeradius radacct table is empty and fortigate

I configured freeradius with mysql and fortigate when I authorize one user every thing go fine but the radacct table is empty and there is no data was inserted into it I don't know where is the ...
1
vote
1answer
1k views

NPS server Active Directory registration & WIFI RADIUS

Background (I'm new to this, so bear with me): So, I set up an NPS server vm in an AD domain to try out RADIUS client WAPs. The NPS is installed alongside an AD CS server (enterprise, plus one ...
0
votes
1answer
57 views

Can I make cisco router to act like a radius server?

I need to configure local radius authentication on my cisco router. I have web application in which we have implemented dual factor authentication it works fine with other radius server like ...
0
votes
1answer
252 views

Is it ok to use PAP with TTLS on radius server?

We have deployed Radius server ( Freeradius 3.x ) and connected it to our LDAP database (ForgeRock OpenDJ). We have successfully configured EAP-TTLS with valid certificates and set it as default ...
0
votes
2answers
3k views

how to configure windows login to get OTP as password

I searched a little and understand that its possible,But i couldn't find any clue of how to do it.Also can i use any server that works or it must be something like SafeNet's blackShield server? What i'...
0
votes
0answers
41 views

Server certificate validation 802.1x

I have recently deployed CA and NPS for WPA2-Enterprise authentication. However doing the pen testing I found out that clients are accepting a certificate from any valid certificate authority. This is ...
2
votes
0answers
256 views

FreeRADIUS with Let's Enrypt Certificate (trusted connection without provisioning?)

I have a FreeRADIUS server set up for PEAP/MSCHAPv2 connections with an SQL user backend. On that server, I have set up a Let's encrypt certificate for domain access.example.org. This certificate is ...
0
votes
2answers
503 views

FreeRADIUS with LDAP vs Kerberos

The following site discusses how to setup FreeRADIUS to authenticate against an LDAP backend (it goes through a tutorial showing how to expose NT hashed passwords in FreeIPA so that FreeRADIUS can ...
0
votes
1answer
235 views

StrongSwan on Amazon Linux with RADIUS

I'm trying to run strongSwan on an Amazon Linux instance with authentication against RADIUS but I receive an error when trying to start strongSwan charon[9518]: 00[CFG] RADIUS initialization failed, ...
0
votes
0answers
68 views

Any way to change RADIUS source IP address in access request packet?

I have an LDAP server doing RADIUS auth to an OTP server which runs over Stunnel. The RADIUS server uses the source IP (I think this is the NAS Identifer) in the access-request packet as a key to ...
5
votes
2answers
571 views

2FA via freeRADIUS, ignoring password

I've been tasked with setting up freeRADIUS to prompt a user for their second authentication factor (eg. Google Authenticator OTP) BUT without first checking the user's password. I'm coming into this ...
0
votes
0answers
161 views

nginx captive portal radius authentication

I have multiple Ruckus Access Point and I want to provide a custom captive portal for guest authentication. The thing I want is to check if user currently has access - then switch him to the site he ...
0
votes
1answer
132 views

Log usernames in squid for clients connected in WiFi with Radius

I am looking for a solution to a problem: Clients connect to the WiFi network using a Radius server and then use the Internet through a transparent Squid server that logs access. I would like to ...
0
votes
0answers
42 views

Expired DC certificate back after reboot

In our environment we use DC-Cluster_CA to generate SSL certificates for .foo-bar.local domains for internal use. Example is certificate 'DC-01.foo-bar.local' The Radius server also uses this ...
-2
votes
1answer
23 views

radius or wpa2 error? - comptia network+ [closed]

Im taking the COMPTIA Network+ exam on thursday and have this practice question I dont understand the difference: Users connecting to an SSID appear to be unable to authenticate to the captive portal....
0
votes
0answers
243 views

Freeradius User Group Membership Not Working

dictionary file: ATTRIBUTE My-Group 3003 string users file: reza My-Group := "operators", Cleartext-Password := "hello" Fall-Through := Yes bob My-Group := "...