Hi. Due to the various reasons, we have to use PAP on our NASes. I would like to setup a FreeRADIUS proxy server which will tunnel a regular PAP requests from remote NASes into an EAP requests (TTLS) than can be proxied to remote FreeRADIUS servers in a more secure manner. At this moment we have a PAP to EAP bridge which utilises multithreaded Java server based on TinyRadius server API which invokes eapol_test as a client per every given request. This is quite ugly hack, unfortunately. Judging from the rlm_eap and proxy code in FreeRADIUS, I would say there is no way of doing it with current modules/code. I thought of hacking rlm_eap and making it to copy PAP requests to TTLS ones which can be later proxied. Is this the correct way? Thank you in advance. -- NAME:Dinko.kreator.Korunic DISCLAIMER:Standard.disclaimer.applies IRC:kre ICQ:16965294 JAB:kreatorMoo@jabber.org PGP:0xea160d0b HOME:http://dkorunic.net BLOG:http://dkorunic.wordpress.com
Dinko Korunic wrote:
At this moment we have a PAP to EAP bridge which utilises multithreaded Java server based on TinyRadius server API which invokes eapol_test as a client per every given request. This is quite ugly hack, unfortunately.
It's pretty close to a real solution.
Judging from the rlm_eap and proxy code in FreeRADIUS, I would say there is no way of doing it with current modules/code. I thought of hacking rlm_eap and making it to copy PAP requests to TTLS ones which can be later proxied. Is this the correct way?
No. The server implements the *server* side of TTLS, not the client side. You can run eapol_test directly from FreeRADIUS, but that's not much better than what you're doing right now. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
On Thu, Feb 08, 2007 at 01:52:18AM +0100, Alan DeKok wrote:
You can run eapol_test directly from FreeRADIUS, but that's not much better than what you're doing right now.
Huh, I was afraid you might say that :| Alright, thank you Alan. -- NAME:Dinko.kreator.Korunic DISCLAIMER:Standard.disclaimer.applies IRC:kre ICQ:16965294 JAB:kreatorMoo@jabber.org PGP:0xea160d0b HOME:http://dkorunic.net BLOG:http://dkorunic.wordpress.com
participants (2)
-
Alan DeKok -
Dinko Korunic