15
votes
Why would you use EAP-TTLS instead of PEAP?
Client restrictions
iOS clients won’t support EAP-TTLS with PAP (only MsCHAPv2) unless you manually (via a computer) install a profile.
Windows clients won’t support EAP-TTLS out-of-box (you’ll need ...
- 1,691
10
votes
Testing radius server from Mac OS X client
FreeRadius provides a tool called radtest that sends a RADIUS packet to a server, asking it to authorize a request with a username and password provided on the command line:
radtest username password ...
- 101
5
votes
Accepted
What are the risks of adding third-party Root CA certificate into NTAuth Store?
There are several points in the question.
First, NTAuth store is used to store *issuing* CA certificates that are eligible to issue logon certificates (when client certificate is mapped to a user ...
- 6,554
4
votes
Accepted
dynamic VLANs on cheap Access Point after switch
If the AP won't do vlans, you'll need a different AP. End of story. You must have an AP that supports vlan assignment via radius, and since your current AP does not support them, you're out of luck ...
- 12.9k
4
votes
Accepted
Freeradius VLAN assignment with EAP-TLS and WiFi 802.1x
I managed to get this sorted. The solution was that the first line should be a "Check", then the remaining lines are replied.
This worked for me:
DEFAULT NAS-Port-Type == Wireless-802.11
...
- 71
4
votes
Accepted
Can I make cisco router to act like a radius server?
You are missing the server. No you can't set the router as a server. Local auth is not RADIUS. The whole point of a RADIUS is to use a different machine for authentication purpose. The IP you set with ...
- 3,018
4
votes
Accepted
802.1X Chicken or the Egg?
You understand correctly: if your only way to connect to the network requires a certificate, you can't connect if you don't have one. Your devices will be able to connect to your wireless network only ...
- 69.5k
3
votes
How can I get a Radius server that can authenticate using my Google Apps domain credentials?
JumpCloud provides just that (G Suite-to-RADIUS-bridge), but comes at a price. Your other option would be to import your userbase into an LDAP directory, keep it in sync with G Suite using [Google ...
3
votes
Verifying RADIUS server is sending the correct certificates?
You can use eapol_test, which is part of the wpa_supplicant package. You need to download the source code and compile it with make eapol_test (it's not built by default). It should work at least on ...
- 906
3
votes
NPS/RADIUS authentication across one-way trust
Yes, from Technet:
NPS supports authentication across forests without a RADIUS proxy when
the two forests contain only domains that consist of domain
controllers running Windows Server 2008, ...
- 364
3
votes
EAP-TLS for Wireless with Active Directory
NPS as Radius server uses the Active Directory to perform authentication.
When using PEAP (MSCHAPv2), the client sends the radius server a
hash of its password. This hash is eventually compared to ...
- 1,783
3
votes
Accepted
radclient:: Failed to find IP address
radtest is trying to resolve the IP address of your host so it can use it for the value of NAS-IP-Address.
Add an entry for Host-002 in /etc/hosts, mapping it either to a loopback IP or the IP you ...
- 1,554
3
votes
Is it possible to host a RADIUS server on Windows 7
Internet Authentication Service (IAS) is part of Windows Server operating systems and is not available for desktop editions. As IAS stores its authentication information on Active Directory, you would ...
- 44.8k
3
votes
Accepted
FreeRADIUS with LDAP vs Kerberos
For FreeRADIUS
The comment is there as a generic disclaimer and to address a deficiency in FreeRADIUS.
In the majority of cases you don't know what the user's DN is to perform the bind. So first, ...
- 1,554
2
votes
How to bind with RADIUS port i.e.1812?
From the information provided, it seems that amongst other things, radiusd is not listening on port 58440. The first thing to do is to fix that.
Check your logs for relevant error messages.
Run ...
- 115k
2
votes
Accepted
mod_auth_radius secure over https?
Yes, over https basic auth is secure. Additionally between the RADIUS server and the HTTP server the passwords are reversibly encrypted using the RADIUS shared secret.
- 1,554
2
votes
Setting up Cisco ASA VPN to use both radius and local users
In a Cisco ASA remote access VPN you do not have the option of adding multiple AAA server groups for a single connection profile.
Since each AAA server group is limited to one protocol you cannot ...
- 3,069
2
votes
SSH Authentication using RADIUS + Google Authenticator
I figured it out. The problem was in the PAM stack for the /etc/pam.d/password-auth file. Specifically this line:
auth sufficient pam_unix.so nullok try_first_pass
What was happening is ...
- 171
2
votes
Debian Samba share Authentification with RADIUS server
The text you found is correct, SMB requires ntlm auth which isn't compatible with PAM.
The problem with PAM is it requires the user (or an agent acting on the users behalf, as the samba server would ...
- 1,554
2
votes
Tracing Untraceable AD Account Lockouts
I have only just finished a call with Microsoft about exactly this, so hopefully the following information will help :)
Authentication attempts can happen at a couple of spots, and notably if you are ...
- 688
2
votes
Accepted
802.1x Wifi with Disabled AD Account
RADIUS doesn't control the functionality we were looking for.
We are, instead, going to use our UniFi controller to kick off users if they are disabled or deleted.
- 31
2
votes
Accepted
Should a server or a client be able to verify a client/server certificate - intermediate certificate chain with a known root ca?
Yes it's fine to use chains with a common intermediary CA.
Yes.
Yes and it does. You need to post the debug output from FreeRADIUS. Saying it returns "error 20" is not helpful. That's likely not a ...
- 1,554
2
votes
Why freeradius server says invalid Message-Authenticator which is generated from radtest?
It's probably not loading the right clients.conf or you have another definition for 127.0.0.1.
Try using testing123 which is the default for the localhost client definition. If it works, you know ...
- 1,554
2
votes
MSCHAPv2 authentication not working
You need neither enable the ntlm_auth row in /etc/raddb/mods-available/mschap nor set ntlm auth = yes in your smb.conf. As MSCHAPv2 doesn't seem to support NTLMv2, you do need to set the following in ...
- 61
2
votes
Allow user to ssh to server without having local account
The easiest way to allow authentication is to configure your sssd daemon with your pam modules. Check here and here to see how. Moreover, you can block unwanted users (including local accounts, or ...
- 131
2
votes
Accepted
2FA via freeRADIUS, ignoring password
I figured this out myself. If anyone is interested, it's related to the configuration in /etc/pam.d/radiusd
First, follow one of these tutorials to set up Google Authenticator as the second factor on ...
- 121
2
votes
Accepted
Is it ok to use PAP with TTLS on radius server?
In this instance, provided the certificate presented by the server is validated correctly by the supplicant, confidentiality (protection against snooping) and integrity (protection against ...
- 1,554
2
votes
Accepted
Adding compiled FreeRADIUS to systemd
The configure option "with-systemd" adds support of the systemd watch dog, but not includes the systemd unit file. If you don't sure, what you need it, don't enable this option.
Try to diagnostize ...
- 4,982
2
votes
Accepted
How to configure FreeRADIUS for use with strongSwan group selection?
You're missing the comma at the end of the Reply-Message line.
See the examples in the users file man page.
- 1,554
2
votes
Accepted
How to show an internal static page to IP addresses list?
iptables can't redirect ip:443 to another ip:port (where I have apache2 virtualhost published with the info block page)
You could redirect the TCP/IP stream, but the browser will show a security ...
- 5,783
Only top scored, non community-wiki answers of a minimum length are eligible