Fernando escribió:
Sergio wrote:
Fernando escribió:
Sergio Yébenes Moreno wrote:
Ivan Kalik escribió:
Ok. DNIe gives PUBLIC access control, to a public network (university, madrid Wifi (jeje, gallardón va de rey alcalde) etc), Dinamic keys, and all in 802.1x and, in consequence, 802.11i. But probably we don't want everybody in this network.Surely we hadn't spend money and time issuing certificates to clients. Because of this, we have "autorizados" file. Then, we only should issue certificates to radius. Clients trust in my CA, and radius trust in "ministerio del interior" jejeje, that sings certificates for everybody in Spain.
I can see where you are heading with this. You want to use usernames/passwords *and* check client certificates. Freeradius doesn't support this. That is called PEAP-EAP-TLS and is supported in Microsoft-only networks.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
__________ Información de NOD32, revisión 3257 (20080710) __________
Este mensaje ha sido analizado con NOD32 antivirus system http://www.nod32.com
I don't want to use passwords. Only want to use what at this time is working: public domain eap-tls, but only students of an university, for example. Probably there are better methods to do this, but this works. I promise..... "identity" field in wpa_supplicant and cert's "commonName" in winXP clients. Now I want to put 3 virtual server, one for DNIe and one for another public CA (FNMT) that have less range than DNIe. I'd like to ask you, if you know. "authorize" section supports unlang and we can use User-Name, for example, to authenticate in any virtual server. I suspect that I can't do this based on signer of client certificate. The point is that common name in certificates signed by FNMT comes with a prefix well-known, and DNIe CommonName comes with a suffix well-known. I don't know how to begin.....hints file, sites-enabled, regular expressions....Freeradius virtual servers documentation shows virtual server based on IP, access points, server pools, but nothing about user credentials..... - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
mmmm.... Do you want authenticate people at different servers?. Use a proxy.
CLIENT ------------------> PROXY RADIUS ------------------> DNIe AUTH
------------------> MY CA AUTH
ok? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
__________ Información de NOD32, revisión 3257 (20080710) __________
Este mensaje ha sido analizado con NOD32 antivirus system http://www.nod32.com
mmmmm I see that I can authenticate users to different servers, based on the domain of user-name, using radius as a proxy. But I have "(AUTENTICACIÓN)" suffix for some users and "NOMBRE" prefix for the others. I think this will make me spent some time..... Thanks Fernando - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
mmmm i don't understand... put a example :). what do you mean with "AUTENTICACION" and "NOMBRE"? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
__________ Información de NOD32, revisión 3260 (20080710) __________
Este mensaje ha sido analizado con NOD32 antivirus system http://www.nod32.com
"AUTENTICACIÓN" is a suffix of user-name, but only for those certificates that are subordinated to FNMT ca. "NOMBRE" is a prefix of user-name which have DNIe, subordinated to another ca. I want to configure two virtual servers based on this details, if I can.