On Fri, Nov 9, 2012 at 3:12 PM, Alan DeKok <aland@deployingradius.com> wrote:

Stefano Zanmarchi wrote:
> we're currently supporting only PEAP, that is we base our security on
> passwords.
> We'd like to introduce higher security for a limited set of users this way:
> 1. support both PEAP and EAP/TTLS
> 2. configure freeradius to authenticate these users (stored in a local
> table)
> *only* if they use EAP/TTLS. They should *not* be authenticated if
> they used PEAP.

Put the users into a group. Then, in the "authorize" section, after
"eap", do:

if ((EAP-Type == PEAP) && (My-Group == "notpeap")) {
reject
}

See "man rlm_passwd" for examples of creating a group.

Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html