<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New","serif";
color:black;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Courier New","serif";
color:windowtext;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Courier New","serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-family:"Courier New","serif";color:#1F497D'>Thanks Chris.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New","serif";color:#1F497D'>This what I would have gone for, but a quick google search for EAP/TLS capable DSL router, does not really return any feasible router. This is mostly used/deployed on WiFi networks, using APs, or WiFi clients.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New","serif";color:#1F497D'>Are you aware of any DSL router which can use EAP/TLS with PPP? I know that PPP can use EAP/TLS for authentication as well, but I presume PPP on the CPE must be told to use a specific authentication protocol, and on most CPEs the options are CHAP, PAP.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New","serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New","serif";color:#1F497D'>Regards<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New","serif";color:#1F497D'>Raz <o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New","serif";color:#1F497D'><o:p> </o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> freeradius-users-bounces+raz.muhammad=cerberusnetworks.co.uk@lists.freeradius.org [mailto:freeradius-users-bounces+raz.muhammad=cerberusnetworks.co.uk@lists.freeradius.org] <b>On Behalf Of </b>Christ Schlacta<br><b>Sent:</b> 21 September 2011 06:54<br><b>To:</b> freeradius-users@lists.freeradius.org<br><b>Subject:</b> Re: User + X Authentication<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>If you've got sufficient control over CPE and CPE is all sufficiently capable, you should be doing EAP-TLS authentication anyway. if CPE is compromised, you can simply reflash, replace the credentials, and revoke the old ones.<br><br>On 9/20/2011 04:18, Raz Muhammad wrote: <o:p></o:p></p><p class=MsoNormal><span style='font-family:"Courier New","serif"'>Hi,</span><o:p></o:p></p><p class=MsoNormal><span style='font-family:"Courier New","serif"'> </span><o:p></o:p></p><p class=MsoNormal><span style='font-family:"Courier New","serif"'>We are successfully running the following version on our network for our DSL users.</span><o:p></o:p></p><p class=MsoNormal><span style='font-family:"Courier New","serif"'> </span><o:p></o:p></p><p class=MsoNormal><span style='font-family:"Courier New","serif"'>FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31</span><o:p></o:p></p><p class=MsoNormal><span style='font-family:"Courier New","serif"'>Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.</span><o:p></o:p></p><p class=MsoNormal><span style='font-family:"Courier New","serif"'> </span><o:p></o:p></p><p class=MsoNormal><span style='font-family:"Courier New","serif"'>FreeRADIUS was compiled with MySQL and radcheck is used for authentication along with other relevant tables.</span><o:p></o:p></p><p class=MsoNormal><span style='font-family:"Courier New","serif"'>We recently had a scenario where security of a CPE is a concern, and using PPP authentication is not enough. Someone suggested using Routers mac address along with PPP username/password authentication. But this method would relay on getting the router Mac address during the PPP negotiation, and it might be coming via the calling-station-id attribute, some suggestions are about using EAP and certifcates on the router.</span><o:p></o:p></p><p class=MsoNormal><span style='font-family:"Courier New","serif"'>I would like to find out what would be the best way to go for extra layer of authentication based security while using FreeRADIUS? and how can that be done with MySQL?</span><o:p></o:p></p><p class=MsoNormal><span style='font-family:"Courier New","serif"'> </span><o:p></o:p></p><p class=MsoNormal><span style='font-family:"Courier New","serif"'>Regards</span><o:p></o:p></p><p class=MsoNormal><span style='font-family:"Courier New","serif"'>Raz</span><o:p></o:p></p><p class=MsoNormal><span style='font-family:"Courier New","serif"'> </span><o:p></o:p></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><br><br><br><o:p></o:p></span></p><pre>-<o:p></o:p></pre><pre>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a><o:p></o:p></pre><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p></div></div></body></html>