5
votes
Accepted
SSH fallback to local account if Radius server isn't available
Enable common-auth (includes pam_unix.so), and change "required" to "sufficient".
auth sufficient pam_radius_auth.so
@include common-auth
(2016/05/03 JST) settings for "fallback"
auth [...
- 392
4
votes
Accepted
FreeRADIUS policy to restrict certain users trying to log on a specific device
You should put it in raddb/policy.conf inside the policy {} stanza. Then they can be referenced (by their name) as you would a normal module, in authorize, authenticate, post-auth etc...
Policies in ...
- 1,564
4
votes
Accepted
Freeradius VLAN assignment with EAP-TLS and WiFi 802.1x
I managed to get this sorted. The solution was that the first line should be a "Check", then the remaining lines are replied.
This worked for me:
DEFAULT NAS-Port-Type == Wireless-802.11
...
- 71
3
votes
Accepted
With freeradius and PEAP-MSCHAP, how does one limit connectivity to a single group?
For now, you need to use rlm_ldap (which will be considerably faster than a bash script). We have discussed exposing winbind's APIs for group lookups, but you'd need to be using Samba 3.2.1 and a ...
- 1,564
3
votes
FreeRADIUS using Active Directory integration broken without any traces
Check the permissions of the winbind privileged pipe - the user that FreeRADIUS runs as needs to be able to access it. You probably need to add your FreeRADIUS user into the winbindd_priv group, and ...
- 137
3
votes
Accepted
Freeradius and self signed-certificate
The supplicant cannot verify the CN in the certificate, so you could present any certificate to the supplicant (other than wildcard certs) and it would work.
You really have no choice other than to ...
- 1,564
3
votes
Accepted
Is there a list of FreeRADIUS specific attributes?
Funny that I would find the answer minutes after posting a question, despite searching for days beforehand.
While explanations of each attribute are not present, I have found where FreeRADIUS stores/...
3
votes
FreeRADIUS policy to restrict certain users trying to log on a specific device
Thanks to some info I found on http://linotp.org/doc/2.6/part-installation/integration/index.html you can use the following configuration if you use the nas table in the MySQL database.
in the nas ...
3
votes
MacOS clients sporadically disconnect from WPA Enterprise wireless network
This is a well known bug in a mac, but they fixed that a few months ago. If you have the latest update check the router instead or buy a cheap router. Select extender mode when setting it up, then ...
- 31
3
votes
Accepted
FreeRADIUS with LDAP vs Kerberos
For FreeRADIUS
The comment is there as a generic disclaimer and to address a deficiency in FreeRADIUS.
In the majority of cases you don't know what the user's DN is to perform the bind. So first, ...
- 1,564
3
votes
How to encrypt user password in Freeradius
In short,
You need to specify a password hash format instead of Cleartext-Password, and
You need to set auth_goodpass and auth_badpass to 'no' to prevent logging passwords.
Specifying a hash format
...
- 416
2
votes
FreeRadius Server: RadGroupReply attribute for maximum connected users?
Sure, first you need to set up RADIUS accounting with an SQL database like postgresql or MySQL.
Then you need to implement a solution for stale session detection. This can be as simple as enabling ...
- 1,564
2
votes
Accepted
mod_auth_radius secure over https?
Yes, over https basic auth is secure. Additionally between the RADIUS server and the HTTP server the passwords are reversibly encrypted using the RADIUS shared secret.
- 1,564
2
votes
Accepted
Freeradius auth error message
Unfortunately you can't.
In EAP RFC3748 there's an EAP-Notification-Request packet type, which is intended to transport messages destined for the end user. Unfortunately no supplicants that i'm aware ...
- 1,564
2
votes
Debian Samba share Authentification with RADIUS server
The text you found is correct, SMB requires ntlm auth which isn't compatible with PAM.
The problem with PAM is it requires the user (or an agent acting on the users behalf, as the samba server would ...
- 1,564
2
votes
MultiOTP + FreeRADIUS + MS Active Directory
Yes, you are right, MSCHAP and MSCHAPv2 are hashing the password, so if the password is [PIN/internal password + token], it's still ok for multiOTP to recalculate it, but with AD password, there is no ...
- 21
2
votes
Freeradius / python / package import fail
you have to find where is this module "jwt", so you include in the mods-available/python
python_path = ${modconfdir}/${.:name}:/path/to/the/package1:/path/to/the/package2
example:
python_path = ${...
- 21
2
votes
Accepted
freeradius, rlm_rest : Failed to Authenticate user
You're not using rest to do authentication here, you're just using it to retrieve the user's password.
You need to list the pap module too to actually perform the comparison.
i.e.
authorize {
...
- 1,564
2
votes
Accepted
FreeRadius authentication issue
No User-Password or CHAP-Password attribute in the request.
This why the request is failing, The request is not supplying any password!
- 1,290
2
votes
CentOS 6 ssh is not prompting for the verification code?
Thank you all for your help :)
I had to increase the timeout in the pam_radius.conf changed it from 15 to 30.
- 31
2
votes
Accepted
Client Certificate Authentication Apache 2.2
Since my version of Debian is Wheezy (7), I had to use apache 2.2 and use a clever work around. Here's my Apache configuration (with a couple lines omitted):
AddRadiusAuth ~~~~~~~~~~~~~~:1812 ~~~~~~~~...
- 51
2
votes
Accepted
Should a server or a client be able to verify a client/server certificate - intermediate certificate chain with a known root ca?
Yes it's fine to use chains with a common intermediary CA.
Yes.
Yes and it does. You need to post the debug output from FreeRADIUS. Saying it returns "error 20" is not helpful. That's likely not a ...
- 1,564
2
votes
Accepted
Missing raddb folder
Typically the software has a default location for configuration files decided on by the developer which can be overridden at build time.
You, or typically a package maintainer and the packaging ...
- 75.2k
2
votes
Accepted
Separate users in two groups (staff and guests) in FreeRADIUS 3
If you want to assign groups to users do it with check items which insert items into the &control list, i.e.
guest1 Mygroup := 'guests', Cleartext-Password := 'password1'
staff1 Mygroup := '...
- 1,564
2
votes
Why freeradius server says invalid Message-Authenticator which is generated from radtest?
It's probably not loading the right clients.conf or you have another definition for 127.0.0.1.
Try using testing123 which is the default for the localhost client definition. If it works, you know ...
- 1,564
2
votes
MSCHAPv2 authentication not working
You need neither enable the ntlm_auth row in /etc/raddb/mods-available/mschap nor set ntlm auth = yes in your smb.conf. As MSCHAPv2 doesn't seem to support NTLMv2, you do need to set the following in ...
- 61
2
votes
Accepted
2FA via freeRADIUS, ignoring password
I figured this out myself. If anyone is interested, it's related to the configuration in /etc/pam.d/radiusd
First, follow one of these tutorials to set up Google Authenticator as the second factor on ...
- 121
2
votes
Accepted
Is it ok to use PAP with TTLS on radius server?
In this instance, provided the certificate presented by the server is validated correctly by the supplicant, confidentiality (protection against snooping) and integrity (protection against ...
- 1,564
2
votes
Accepted
Adding compiled FreeRADIUS to systemd
The configure option "with-systemd" adds support of the systemd watch dog, but not includes the systemd unit file. If you don't sure, what you need it, don't enable this option.
Try to diagnostize ...
- 5,012
2
votes
Accepted
How to configure FreeRADIUS for use with strongSwan group selection?
You're missing the comma at the end of the Reply-Message line.
See the examples in the users file man page.
- 1,564
Only top scored, non community-wiki answers of a minimum length are eligible