Dear all, I am a new user of freeradius, currently using freeradius 1.1.0 on Redhat Linux. I wish to setup freeradius for a 2 factor authentication, such that: NAS issue an Access-Request to Radius server Radius server authenticate against LDAP once successful -- Radius server then issue an Access-Chanllenge to NAS (second factor, asking for an additional password/token) NAS reply with an Acces-Request Radius server then authenticate the second Access-request and reply to NAS. The above is roughly the authentication flow I wish to achieve. After reading the configuration setup instructions, I still have no clue where to start with the configuration, can some one please enlighten me? Is there a custom built radius module required? Thanks in advance for all the help regards Kaden --------------------------------- New Yahoo! Messenger with Voice. Call regular phones from your PC for low, low rates.
Yizhi Lao <laoyizhi@yahoo.com> wrote:
I am a new user of freeradius, currently using freeradius 1.1.0 on Redhat Linux. I wish to setup freeradius for a 2 factor authentication, such that:
NAS issue an Access-Request to Radius server Radius server authenticate against LDAP once successful -- Radius server then issue an Access-Chanllenge to NAS (second factor, asking for an additional password/token) NAS reply with an Acces-Request Radius server then authenticate the second Access-request and reply to NAS.
This is a very unusual request, since it isn't tied to an authentication method. You will have to write a module to do this. Alan DeKok.
Hi Alan, thank you for the response. What I am worried about is not the second authentication method, but to chain two authentication together. is there any convenient way to do it? Say: First access request, authenticated against LDAP, Radisu server reply with an Access challenge, NAS answers chanllenge, the answer is authenticated against LDAP again. Is it possible? Thanks and best regards Kaden Alan DeKok <aland@ox.org> wrote: Yizhi Lao wrote:
I am a new user of freeradius, currently using freeradius 1.1.0 on Redhat Linux. I wish to setup freeradius for a 2 factor authentication, such that:
NAS issue an Access-Request to Radius server Radius server authenticate against LDAP once successful -- Radius server then issue an Access-Chanllenge to NAS (second factor, asking for an additional password/token) NAS reply with an Acces-Request Radius server then authenticate the second Access-request and reply to NAS.
This is a very unusual request, since it isn't tied to an authentication method. You will have to write a module to do this. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html --------------------------------- New Yahoo! Messenger with Voice. Call regular phones from your PC and save big.
Yizhi Lao <laoyizhi@yahoo.com> wrote:
What I am worried about is not the second authentication method, but to chain two authentication together. is there any convenient way to do it?
As I said, you have to write you own module to do this. The "example" module that is included with the server shows how to chain two authentications together. Take a look at it. Alan DeKok.
Hi, This is related to my previous mail on setting up Freeradius for 2 factor authentication with chanllenge-response. I looked at what JRadius module can do and am going to attempt the following approach 1. insert a JRadius module into the "post-auth" section, such that the module will process an "Access-Accept" packet into an "Access-Chanllange" packet Question: is this allowed by FreeRadius? i.e. would FreeRadius allow an module in "post-auth" to change the packet type(Code)? 2. insert a JRadius module into either the "authorize" or "authenticate" section, such that it will recognize an access-request packet which answers the chanllenge, and process it using its own logic Question: Would freeradius allow a module called in "authorize" part to directly accept or reject a request, without making it go through to the "authenticate" section? Thank you and best regards Kaden --- Alan DeKok <aland@ox.org> wrote:
Yizhi Lao <laoyizhi@yahoo.com> wrote:
What I am worried about is not the second authentication method, but to chain two authentication together. is there any convenient way to do it?
As I said, you have to write you own module to do this.
The "example" module that is included with the server shows how to chain two authentications together. Take a look at it.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
__________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
participants (2)
-
Alan DeKok -
Yizhi Lao