3
votes
Accepted
Missing raddb folder
Typically the software has a default location for configuration files decided on by the developer which can be overridden at build time.
You, or typically a package maintainer and the packaging ...
- 81.7k
3
votes
MacOS clients sporadically disconnect from WPA Enterprise wireless network
This is a well known bug in a mac, but they fixed that a few months ago. If you have the latest update check the router instead or buy a cheap router. Select extender mode when setting it up, then ...
- 31
3
votes
Accepted
Freeradius VLAN assignment with EAP-TLS and WiFi 802.1x
I managed to get this sorted. The solution was that the first line should be a "Check", then the remaining lines are replied.
This worked for me:
DEFAULT NAS-Port-Type == Wireless-802.11
...
- 61
3
votes
Accepted
FreeRADIUS with LDAP vs Kerberos
For FreeRADIUS
The comment is there as a generic disclaimer and to address a deficiency in FreeRADIUS.
In the majority of cases you don't know what the user's DN is to perform the bind. So first, ...
- 1,649
3
votes
How to encrypt user password in Freeradius
In short,
You need to specify a password hash format instead of Cleartext-Password, and
You need to set auth_goodpass and auth_badpass to 'no' to prevent logging passwords.
Specifying a hash format
...
- 416
2
votes
Accepted
freeradius, rlm_rest : Failed to Authenticate user
You're not using rest to do authentication here, you're just using it to retrieve the user's password.
You need to list the pap module too to actually perform the comparison.
i.e.
authorize {
...
- 1,649
2
votes
CentOS 6 ssh is not prompting for the verification code?
Thank you all for your help :)
I had to increase the timeout in the pam_radius.conf changed it from 15 to 30.
- 31
2
votes
Accepted
FreeRadius authentication issue
No User-Password or CHAP-Password attribute in the request.
This why the request is failing, The request is not supplying any password!
- 1,300
2
votes
Accepted
Should a server or a client be able to verify a client/server certificate - intermediate certificate chain with a known root ca?
Yes it's fine to use chains with a common intermediary CA.
Yes.
Yes and it does. You need to post the debug output from FreeRADIUS. Saying it returns "error 20" is not helpful. That's likely not a ...
- 1,649
2
votes
Accepted
What characters are allowed for the username and password in FreeRADIUS?
Radius strings may be any valid UTF8 sequence. There's no limitations on what characters can be used for a user's password or for their username.
- 1,649
2
votes
Accepted
Client Certificate Authentication Apache 2.2
Since my version of Debian is Wheezy (7), I had to use apache 2.2 and use a clever work around. Here's my Apache configuration (with a couple lines omitted):
AddRadiusAuth ~~~~~~~~~~~~~~:1812 ~~~~~~~~...
- 51
2
votes
Why freeradius server says invalid Message-Authenticator which is generated from radtest?
It's probably not loading the right clients.conf or you have another definition for 127.0.0.1.
Try using testing123 which is the default for the localhost client definition. If it works, you know ...
- 1,649
2
votes
Accepted
Freeradius 3 can't find Auth-Type for pfSense OpenVPN Auth-Requests
In the above example you're doing PAP not PEAP. There's no module which'll automatically set ntlm_auth as the auth type so you need to do it in the policy language, i.e.
authorize {
if (&...
- 1,649
2
votes
Accepted
Separate users in two groups (staff and guests) in FreeRADIUS 3
If you want to assign groups to users do it with check items which insert items into the &control list, i.e.
guest1 Mygroup := 'guests', Cleartext-Password := 'password1'
staff1 Mygroup := '...
- 1,649
2
votes
MSCHAPv2 authentication not working
You need neither enable the ntlm_auth row in /etc/raddb/mods-available/mschap nor set ntlm auth = yes in your smb.conf. As MSCHAPv2 doesn't seem to support NTLMv2, you do need to set the following in ...
- 61
2
votes
Accepted
2FA via freeRADIUS, ignoring password
I figured this out myself. If anyone is interested, it's related to the configuration in /etc/pam.d/radiusd
First, follow one of these tutorials to set up Google Authenticator as the second factor on ...
- 121
2
votes
Accepted
Is it ok to use PAP with TTLS on radius server?
In this instance, provided the certificate presented by the server is validated correctly by the supplicant, confidentiality (protection against snooping) and integrity (protection against ...
- 1,649
2
votes
Accepted
Adding compiled FreeRADIUS to systemd
The configure option "with-systemd" adds support of the systemd watch dog, but not includes the systemd unit file. If you don't sure, what you need it, don't enable this option.
Try to diagnostize ...
- 5,302
2
votes
Accepted
How to configure FreeRADIUS for use with strongSwan group selection?
You're missing the comma at the end of the Reply-Message line.
See the examples in the users file man page.
- 1,649
2
votes
How to encrypt user password in Freeradius
Here is the list of attributes coresponding to the hashing method : https://freeradius.org/radiusd/man/rlm_pap.txt
Header Attribute Description
------ --------- --...
- 89
2
votes
Daloradius ERROR: (3) sql: ERROR: rlm_sql_mysql: ERROR 1054 (Unknown column 'acctupdatetime' in 'field list')
Solution
The issue is some table fields are missing.
The SQL schema in daloradius does not create all the fields. To fix this error you have to add the missing SQL fields manually by yourself.
Run ...
- 141
1
vote
Accepted
MSCHAPv2 authentication not working
Setting ntlm auth = yes in the global section of smb.conf "fixed" it. I'd like to go back to disallowing ntlmv1 so if somebody has a way to get this working without ntlmv1 please post your own answer.
- 568
1
vote
Accepted
Can't authenticate radius against active directory
With AD you have two credential options, either the plaintext password, or the NT-Password (MD4 hash of the password). With plaintext auth you can use an LDAP authenticated bind to validate the ...
- 1,649
1
vote
Accepted
What does the FreeRADIUS error "SSL says error 25 : path length constraint exceeded" mean?
What does the error "SSL says error 25 : path length constraint exceeded" mean and does this have to do with the length of the chains of trust?
This refers to the pathLenConstraint extension of the ...
- 13.9k
1
vote
freeradius failover when ldap not available
Use the redundant section e.g.
authorize {
redundant {
ldap
files
}
}
If the first module fails, the second module will be called.
If you want the server to start if LDAP is ...
- 1,649
1
vote
Accepted
freeradius hush rlm_ldap log messages
You could, you know, fix the underlying issue. i.e. Tweak the connection pool settings to that the connection pool isn't constantly creating and destroying connections.
Without knowing why it's ...
- 1,649
1
vote
FreeRadius + Active Directory + Google Authenticator
We have a similar setup, but without Google auth. AD group restrictions in freeradius can be configured as follows:
The users file contains:
DEFAULT Ldap-Group != "vpn", Auth-Type := Reject
The ...
- 1,796
1
vote
Accepted
How do I force freeradius to check certificates validity?
Yes I found a wait
I have to enable eap-tls
Then you have to give a Ca certificate and user certificate
The Ca certificate is here only to secure the connection not for identification. The fact ...
- 41
1
vote
Accepted
Freeradius: Clients.conf and CoA
Got a reply from other forum that it is not possible in v3
http://lists.freeradius.org/pipermail/freeradius-users/2017-August/088480.html
- 136
1
vote
How to clone and restore FreeRadius setup in another server?
Yes, everything is self-contained within raddb. You could also theoretically create your own debian package which provides 'freeradius-config' and use that to install your custom configuration.
- 1,649
Only top scored, non community-wiki answers of a minimum length are eligible