4 votes
Accepted

dynamic VLANs on cheap Access Point after switch

If the AP won't do vlans, you'll need a different AP. End of story. You must have an AP that supports vlan assignment via radius, and since your current AP does not support them, you're out of luck ...
Joel Coel's user avatar
  • 13k
4 votes
Accepted

Freeradius VLAN assignment with EAP-TLS and WiFi 802.1x

I managed to get this sorted. The solution was that the first line should be a "Check", then the remaining lines are replied. This worked for me: DEFAULT NAS-Port-Type == Wireless-802.11 ...
user397220's user avatar
4 votes
Accepted

Can I make cisco router to act like a radius server?

You are missing the server. No you can't set the router as a server. Local auth is not RADIUS. The whole point of a RADIUS is to use a different machine for authentication purpose. The IP you set with ...
Overmind's user avatar
  • 3,141
4 votes
Accepted

802.1X Chicken or the Egg?

You understand correctly: if your only way to connect to the network requires a certificate, you can't connect if you don't have one. Your devices will be able to connect to your wireless network only ...
Massimo's user avatar
  • 71.3k
3 votes

Is it possible to host a RADIUS server on Windows 7

Internet Authentication Service (IAS) is part of Windows Server operating systems and is not available for desktop editions. As IAS stores its authentication information on Active Directory, you would ...
Esa Jokinen's user avatar
  • 49.8k
3 votes

How can I get a Radius server that can authenticate using my Google Apps domain credentials?

JumpCloud provides just that (G Suite-to-RADIUS-bridge), but comes at a price. Your other option would be to import your userbase into an LDAP directory, keep it in sync with G Suite using [Google ...
Boris van Rijndijk's user avatar
3 votes

Verifying RADIUS server is sending the correct certificates?

You can use eapol_test, which is part of the wpa_supplicant package. You need to download the source code and compile it with make eapol_test (it's not built by default). It should work at least on ...
Jan Fabry's user avatar
  • 1,006
3 votes
Accepted

FreeRADIUS with LDAP vs Kerberos

For FreeRADIUS The comment is there as a generic disclaimer and to address a deficiency in FreeRADIUS. In the majority of cases you don't know what the user's DN is to perform the bind. So first, ...
Arran Cudbard-Bell's user avatar
2 votes

Setting up Cisco ASA VPN to use both radius and local users

In a Cisco ASA remote access VPN you do not have the option of adding multiple AAA server groups for a single connection profile. Since each AAA server group is limited to one protocol you cannot ...
user5870571's user avatar
  • 3,154
2 votes
Accepted

Should a server or a client be able to verify a client/server certificate - intermediate certificate chain with a known root ca?

Yes it's fine to use chains with a common intermediary CA. Yes. Yes and it does. You need to post the debug output from FreeRADIUS. Saying it returns "error 20" is not helpful. That's likely not a ...
Arran Cudbard-Bell's user avatar
2 votes
Accepted

802.1x Wifi with Disabled AD Account

RADIUS doesn't control the functionality we were looking for. We are, instead, going to use our UniFi controller to kick off users if they are disabled or deleted.
kccoers's user avatar
  • 31
2 votes

Allow user to ssh to server without having local account

The easiest way to allow authentication is to configure your sssd daemon with your pam modules. Check here and here to see how. Moreover, you can block unwanted users (including local accounts, or ...
SomeGuy's user avatar
  • 131
2 votes

MSCHAPv2 authentication not working

You need neither enable the ntlm_auth row in /etc/raddb/mods-available/mschap nor set ntlm auth = yes in your smb.conf. As MSCHAPv2 doesn't seem to support NTLMv2, you do need to set the following in ...
pinjaliina's user avatar
2 votes

Why freeradius server says invalid Message-Authenticator which is generated from radtest?

It's probably not loading the right clients.conf or you have another definition for 127.0.0.1. Try using testing123 which is the default for the localhost client definition. If it works, you know ...
Arran Cudbard-Bell's user avatar
2 votes
Accepted

2FA via freeRADIUS, ignoring password

I figured this out myself. If anyone is interested, it's related to the configuration in /etc/pam.d/radiusd First, follow one of these tutorials to set up Google Authenticator as the second factor on ...
Jeedee's user avatar
  • 121
2 votes
Accepted

Is it ok to use PAP with TTLS on radius server?

In this instance, provided the certificate presented by the server is validated correctly by the supplicant, confidentiality (protection against snooping) and integrity (protection against ...
Arran Cudbard-Bell's user avatar
2 votes
Accepted

Adding compiled FreeRADIUS to systemd

The configure option "with-systemd" adds support of the systemd watch dog, but not includes the systemd unit file. If you don't sure, what you need it, don't enable this option. Try to diagnostize ...
Anton Danilov's user avatar
2 votes
Accepted

How to configure FreeRADIUS for use with strongSwan group selection?

You're missing the comma at the end of the Reply-Message line. See the examples in the users file man page.
Arran Cudbard-Bell's user avatar
2 votes

Daloradius ERROR: (3) sql: ERROR: rlm_sql_mysql: ERROR 1054 (Unknown column 'acctupdatetime' in 'field list')

Solution The issue is some table fields are missing. The SQL schema in daloradius does not create all the fields. To fix this error you have to add the missing SQL fields manually by yourself. Run ...
xaander1's user avatar
  • 141
2 votes
Accepted

How to show an internal static page to IP addresses list?

iptables can't redirect ip:443 to another ip:port (where I have apache2 virtualhost published with the info block page) You could redirect the TCP/IP stream, but the browser will show a security ...
vidarlo's user avatar
  • 9,190
1 vote

2FA via freeRADIUS, ignoring password

Radius is a network authentication/authorization/accounting protocol. It operates at layer 3 in the OSI model. Your web application operates at layer 7. So there's a bit of a mis-match here. You ...
Alex Forbes's user avatar
  • 2,462
1 vote

smb fails to start on centos7 radius server

I also encountered this issue too of Samba SMB daemon unable to start with the error of create_local_token failed: NT_STATUS_NO_MEMORY. After a fail amount of frustration I discovered this post ...
plaw-013's user avatar
1 vote
Accepted

radius or wpa2 error? - comptia network+

Bad wpa2 password wouldn't let you connect to hotspot which is a prerequisite to see the captive portal. Additionally captive portal usually means the wifi network is open - meaning no wep/wpa/wpa2 at ...
Tomek's user avatar
  • 3,553
1 vote
Accepted

MSCHAPv2 authentication not working

Setting ntlm auth = yes in the global section of smb.conf "fixed" it. I'd like to go back to disallowing ntlmv1 so if somebody has a way to get this working without ntlmv1 please post your own answer.
Dessa Simpson's user avatar
1 vote

Use Azure Active Directory as RADIUS server for VPN gateway?

Ok so I am guessing you want everything hosted on cloud and dont have an existing servers NPS, Radius etc, so what you will have to do is download the MFA Server and host it on an azure VM. From the ...
RickWeb's user avatar
  • 295
1 vote

Strongswan Installation for CentOS 7

If you are installing from EPEL, the eap-radius plugin is shipped in the strongswan-tnc-imcvs package for some reason. Try installing that before starting to compile strongSwan yourself.
ecdsa's user avatar
  • 4,103
1 vote
Accepted

How do I add RADIUS clients to Windows NPS without a known IP or DNS?

Apparently you can use CIDR notation when entering the IP address. However, when you do, all possible IPs in the subnet count towards the 50 count limit on NPS prior to Windows Server 2012. i.e. 192....
Novox's user avatar
  • 484
1 vote

How to clone and restore FreeRadius setup in another server?

Yes, everything is self-contained within raddb. You could also theoretically create your own debian package which provides 'freeradius-config' and use that to install your custom configuration.
Arran Cudbard-Bell's user avatar
1 vote
Accepted

more than one freeradius user and database

if i understood your question correctly, what you are looking for is to have a good performance radius database system. but on the face of it, what you have thought of doesn't sound a good idea. for ...
Lakshman Pilaka's user avatar
1 vote

Network Policy Server error message 'Negotiation failed. No available EAP methods'

one of these things that you do once a year and forget. Since this is top result I'll leave this here; So issue for me is that I'm using a self signed server cert to auth meraki 802.1x, PEAP refuses ...
Mizerka's user avatar
  • 11

Only top scored, non community-wiki answers of a minimum length are eligible