Fast, feature-rich, modular, and scalable.

That makes us happy! https://t.co/us72Kyz0dA

EAP-AKA' is now supported in v4.0.x branch in git. Fully parameterized, fully tested.

Dynamic clients are extended in v4. Many clients at a time can be defined. All outstanding packets are cached unt… https://t.co/l4kesYSNjk

Sad to say, very true. We've seen pages which were abandoned 10 years ago. Pages which say to do things which the… https://t.co/xQGaZUdPQn

That's what we've been saying for years! Basic install is easy. DBs, EAP, certs, etc. are a bit more complicated. https://t.co/VAVdUEgWW0

And what was impossible in v3 is now trivial in v4. Proxying to multiple destinations! https://t.co/1F2kN7opCG

New documentation for proxying in v4, thanks to Matthew @mcnewton https://t.co/TRHbhJjKW5

Coverity scan for v4 now says 0 defects. As does ccpcheck (ignoring some false positives). As does clang scan.

The new proxying code in v4 has been tested in production with millions of packets. <whew>!

Which is what inspired https://t.co/lhkQ0mmMp8. Eduroam doesn't need to be complicated! https://t.co/hPySCFMPIs

can someone try to tell me the difficulty level of this kind of wifi captive portal setup. im knowledgeable in networking, not much in php/mysql but enough skills to setup my own webserver. and a 4/10 knowledge in radius. here's the scenario 1) a user will be directed in a captive portal page upon connecting in 2) a registration page will appear and the user will input a couple of fields (e.g email, name, etc.). 3) after submitting it will allow access to the network (valid only for 3hours with 512Kb bandwidth) i understand that i needed the ff: radius for (accounting and bandwidth limitting) apache for webserver mysql for user storage pfsense for the redirection to the portal / wall garden 1) and so, i followed a guide in which i managed to install freeradius with mysql and apache. i have a table called with these tables Tables in radius radacct radcheck radgroupcheck radgroupreply radpostauth radreply radusergroup as i understand in the document, i should place my accounts inside table. 2) then inside my /var/www/html are Check_login.php !! all php codes here are working using my other database; which consisted only a table and user and password fields !! i guess my question is, how do i make my php login work on a freeradius that is using mysql as a user storage? - not even sure if i placed the syntax/values correctly in my php and how do i implement session limit (3hours) and bandwidth limiting in freeradius?

I search an solution to creating users in command line, and to implement a script. I'm starting in IT i need help please. Sry to my bad language i'm french

I'm working on creating certificate for eap-tls so i can add this certificate to mobile and then mobile can access the access point without using username or password I follow the documentation on README in radiusd/certs So i run to create Root Certificate , and run to create Server Certificate Then run but I have this error:

I am currently developing an architecture as follows Admin User will create credentials for other users through an web application(Say App1). Same will be stored in a oracle 12C database(Say DB1) Ordinary user will connect to a different system(Say app2) with that credential That system will use Radius Server to authenticate(Simply pass the entered credentials to Radius Server). Radius Server(Say RS1) will use DB1 database to authenticate user Same has been done and working fine. Now I want the following thing Configure another Radius Server(Say RS2) which use another Oracle database (Say DB2). DB2 and DB1 must be on a different server to prevent single point failure. Shifting all request from RS1 to RS2 whenever RS1 is not available for this I need DB1 and DB2 are real-time synchronized(both way). IF DB2 is not available for some time, all the updates done on DB1 must be synced when DB2 is available vice versa. Can anyone let me how to achieve point 3 only? Please note, only one table needs to be synchronized. Only DML operations are there

You requirement is bit similar to High Availability of your DB server. please look into the following link https://docs.oracle.com/cd/B28359_01/server.111/b28281/architectures.htm#i1008361 http://www.oracle.com/technetwork/database/availability/index.html Ideally, High availability is configured with One Master Node(server) and two slaves (among them one at least should be active stage) Now, if the master is down, the active slave become Master and passive one will be active. Later when initial master is recovered, it will be acted as passive slave. All the servers would be in sync (periodically or with some pre-defined trigger points)

Maybe it is a bit unusual application, at least I didn't find this case in internet after some search. I am using FreeRadius in conjunction with LDAP (AD). Authentication and Authorisation works well. I am also able to translate LDAP attributes that I am getting from AD to RADIUS ones and send them back to Radius clients. We were thinking to add the group based authorization. In our case Raduis is supposed to add one attirbute Attr1 in case user is a member of a group Grp1, and to set Attr2 in case user is a mamber of a Grp2. I am not sure if this is supported in a way how I am explaining it here. I would appreciate if someone could tell if this is supported and give some hints how to implement that. Cheers, Danil

I am developing a custom radius server to authenticate wireless clients, using peapv0-mschapv2, at the final step, not sure how to generate the ms-mppe-send-key and ms-mppe-revc-key within the Access-Accept packet, i have follow rfc3079 to generate a 128 bit session keys, but with the last step, not sure what to do with the rc4_key() function, from rfc3079 GetNewKeyFromSHA(MasterSendKey, MasterSendKey, 16, SendSessionKey) GetNewKeyFromSHA(MasterReceiveKey, MasterReceiveKey, 16, ReceiveSessionKey) Finally, the RC4 tables are initialized using the new session keys: i generated a 16 bytes SendSessionKey and a 16 bytes ReceiveSessionKey, but not sure about where SendRC4Key and ReceiveRC4Key come from. doesn't say with rfc :( then i tried to use SendSessionKey and ReceiveSessionKey to follow rfc2548 and encrypted a ms-mppe-send-key and ms-mppe-recv-key and send to client, but doesn't work, client keep resetting and start over from client hello. when i do some searching online, looks like free radius using 32 bytes keys to do the encryption and send to client. not sure how to get a 32 bytes SendSessionKey too. Thank you advance for any help!!

I had found out that peapv0-ms-chapv2 use tls material to generate two 32 bytes keys. rfc didn't make it clear, confuse me until i try to use the tls method to generate the keys and give it a try, and it worked.

On some clients I want to be able to authenticate both locally and remotely (via RADIUS). However specific client like NetBotz only allow you to hit RADIUS first, and then local credentials if the radius server is down. This is problematic when the local admin account has a username that clashes with one in the ldap backend, thus causing radius to return an access-reject for that account. Can I configure radius so that when various clients attempt to authenticate with a specific username (admin), the radius server ignores the request and times out, forcing the client to fall back to its local credentials? Obviously I can create new accounts on the clients with usernames that dont clash, and I can configure finer permissions so we dont need those admin accounts, but I'd like to know if this is possible or not.

I'm setting up a wireless lab. User guest123 with password guest123 authenticates over wireless using 802.1X authentication. FreeRadius should also return FilterId=>labguest. A rule at the wireless controller sets the user role to whatever FilterId is returned during the RADIUS exchange. Instead, the request/response churns ten times, and the user is assigned the default role, "authenticated". The brief questions before launching into details is what am I doing wrong, and is there an automated tool to parse through FreeRadius -X output and produce recommendations? Simple command line tests from the wireless controller and freeradius show both authentication and returned attributes. Here's the part that works From freeradius: From Aruba controller: The role "labguest" is defined here: The rule to assign user role based on FilterId is here: Here's the part that is broken After authenticating over wireless and 802.1X, the user receives the default 802.1X role, "authenticated" rather than "labguest". Expected result: Actual result:

Add xlat instantiation framework

Group xlat functions in unlang_op.c

doxygen

well-known clients cannot be behind a NAT

dynamic clients behind a NAT gateway are not in any list instead, they cause a connection to be created, and that's that...

rename to "behind_nat" note that the admin CANNOT set static or dynamic clients as being NAT gateways. Instead, the code does that internally

more handling of nat'd clients

don't immediately delete NATed clients

generalize handling of conflicting packets

Include unlang.h where it's needed