Alan DeKok <aland <at> deployingradius.com> writes:
WorkingMan wrote:
My design is that I don't actually care about secondary authentication
with
RADIUS since it's already doing certificate validation from strongswan side before doing secondary authentication. All is good if I was only need secondary authentication since I can bypass with verify_eap from strongswan side but I want to make use of the Expiration module on freeradius side (works great).
Bypassing authentication is generally a bad idea.
I have few questions so it can help me determine next course of action:
1) is there a way to configure freeradius for Accounting only and also does the user expiration check?
No. User expiration checks are done on authentication.
2) is it possible for me in any way to reject expired user but accept eap based authentication (from configuration or code modification)?
Yes.
3) when connection is rejected does the strongswan side (xauth-eap plugin in particular) receive information that can differentiate this logic (send attribute that it can handle maybe? I have no idea how that work)?
A reject is a reject. The client usually doesn't get told *why* it was rejected.
Rather than asking vague questions, it would help to read the config files. They're documented in exhaustive detail.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Can you give me an example on how to always accept connection on EAP-* authentication (it will be password based from xauth-eap from strongswan) but at the same time still honour Expiration logic? I am not sure what to do it (or what to look for). I have been trying different settings for a week now without success. Background: As you know default IPSec VPN clients for iOS and Android are ikev1 based and that doesn't support EAP-TLS which is ideal for me (mutual certificate authentication). For ikev1 I can still do mutual certificate authentication but I want freeradius to do accounting stuff and sort of centralize login (otherwise there is no need of RADIUS). the only option with strongswan is via xauth-eap (internally via eap-radius; using eap-md5, eap-mschapv2, etc password based authentication). There is no way according to strongswan's team to do accounting only with ikev1 that's why I need to use xauth-eap so I can talk to freeradius. There is no need to do password authentication when certificate is already validated by the server and you can filter clients via certificate details (so it is safe; unless someone can sign fake client certificate). If I didn't care about user expiration (and simultaneous access control) I wouldn't need to ask for help (simply modify xauth-eap to always pass authentication and doesn't bother talking to RADIUS during authentication). I really want to use as much freeradius' feature as possible so I don't have to do things on the side (ex: do expiration check on VPN side). Any help would be much appreciated. Thanks