Has anyone used $SUBJECT configuration? I am considering the WG103 for my home network, and I would really like to use its RADIUS support to start using "real" user IDs, rather than shared keys. I'm an experienced Linux admin (Red Hat RHCA certified), and I've got a pretty good familiarity with SSL and VLANs, but I have absolutely no experience with [Free]RADIUS. * Has anyone set up FreeRADIUS with the WG103 (or any other NETGEAR access point)? * How difficult is this likely to be? Thanks! -- ======================================================================== Ian Pilcher arequipeno@gmail.com "If you're going to shift my paradigm ... at least buy me dinner first." ========================================================================
Ian Pilcher wrote:
Has anyone used $SUBJECT configuration? I am considering the WG103 for my home network, and I would really like to use its RADIUS support to start using "real" user IDs, rather than shared keys.
What does that mean?
I'm an experienced Linux admin (Red Hat RHCA certified), and I've got a pretty good familiarity with SSL and VLANs, but I have absolutely no experience with [Free]RADIUS.
* Has anyone set up FreeRADIUS with the WG103 (or any other NETGEAR access point)?
* How difficult is this likely to be?
See the FAQ. Configure an IP and shared secret in clients.conf. Add a "known good" user/password. Profit! Alan DeKok.
On 09/14/2011 10:48 AM, Alan DeKok wrote:
Ian Pilcher wrote:
Has anyone used $SUBJECT configuration? I am considering the WG103 for my home network, and I would really like to use its RADIUS support to start using "real" user IDs, rather than shared keys.
What does that mean?
At least for the "private" networks, I want everyone to have their own credentials, rather than a shared key (a la WEP and WPA[2]-PSK).
* How difficult is this likely to be?
See the FAQ. Configure an IP and shared secret in clients.conf. Add a "known good" user/password. Profit!
I did read the FAQ and the documentation page on freeradius.org. The steps that you list look like the "Initial Tests" section of the documentation page, but will that actually work for wireless access? I've Googled up several HOWTO-type documents, and they all involve creating a bunch of SSL certificates. -- ======================================================================== Ian Pilcher arequipeno@gmail.com "If you're going to shift my paradigm ... at least buy me dinner first." ========================================================================
Ian Pilcher wrote:
At least for the "private" networks, I want everyone to have their own credentials, rather than a shared key (a la WEP and WPA[2]-PSK).
That's EAP, then.
* How difficult is this likely to be? See the FAQ. Configure an IP and shared secret in clients.conf. Add a "known good" user/password. Profit!
I did read the FAQ and the documentation page on freeradius.org. The steps that you list look like the "Initial Tests" section of the documentation page, but will that actually work for wireless access? I've Googled up several HOWTO-type documents, and they all involve creating a bunch of SSL certificates.
http://deployingradius.com/ There's an "EAP howto". It's detailed, explanatory, and works. Alan DeKok.
On 14/09/11 16:15, Ian Pilcher wrote:
Has anyone used $SUBJECT configuration? I am considering the WG103 for my home network, and I would really like to use its RADIUS support to start using "real" user IDs, rather than shared keys.
I'm an experienced Linux admin (Red Hat RHCA certified), and I've got a pretty good familiarity with SSL and VLANs, but I have absolutely no experience with [Free]RADIUS.
* Has anyone set up FreeRADIUS with the WG103 (or any other NETGEAR access point)?
* How difficult is this likely to be?
What have you tried so far? If the WAP supports radius, there should be space in the management UI for the IP/hostname and port of the auth/accounting radius server, and the "shared secret"; once you've done that, you might need to change the wireless config to WPA-Enterprise (if that's what you want). Once that's done, the WAP is configured. There's not usually much to do on the WAP (or "NAS" as RADIUS clients are normally termed). Next you just have to configure FreeRADIUS. See: http://deployingradius.com/ ...for starters.
On 09/14/2011 10:56 AM, Phil Mayers wrote:
What have you tried so far?
I haven't purchased the access point yet, so I haven't really tried anything. (The goal of my first post was to avoid investing $ if the project is likely to be a massive, frustrating time-suck.)
If the WAP supports radius, there should be space in the management UI for the IP/hostname and port of the auth/accounting radius server, and the "shared secret"; once you've done that, you might need to change the wireless config to WPA-Enterprise (if that's what you want).
Based on the manual, there are separate entries for authorization and accounting. I believe I can simply leave the accounting stuff blank, since I don't care about that.
Once that's done, the WAP is configured. There's not usually much to do on the WAP (or "NAS" as RADIUS clients are normally termed). Next you just have to configure FreeRADIUS. See:
But I'm not using Network Attached Storage. ;-)
That looks useful. Thanks! -- ======================================================================== Ian Pilcher arequipeno@gmail.com "If you're going to shift my paradigm ... at least buy me dinner first." ========================================================================
On Wed, Sep 14, 2011 at 11:22 PM, Ian Pilcher <arequipeno@gmail.com> wrote:
On 09/14/2011 10:56 AM, Phil Mayers wrote:
What have you tried so far?
I haven't purchased the access point yet, so I haven't really tried anything. (The goal of my first post was to avoid investing $ if the project is likely to be a massive, frustrating time-suck.)
There's stuff you can do even before buying the AP. Like creating a test radius installation that can handle EAP/802.1x.
If the WAP supports radius, there should be space in the management UI for the IP/hostname and port of the auth/accounting radius server, and the "shared secret"; once you've done that, you might need to change the wireless config to WPA-Enterprise (if that's what you want).
... or 802.1x.
Based on the manual, there are separate entries for authorization and accounting. I believe I can simply leave the accounting stuff blank, since I don't care about that.
Once that's done, the WAP is configured. There's not usually much to do on the WAP (or "NAS" as RADIUS clients are normally termed). Next you just have to configure FreeRADIUS. See:
But I'm not using Network Attached Storage. ;-)
I assume that's a joke :) http://en.wikipedia.org/wiki/Network_access_server -- Fajar
participants (4)
-
Alan DeKok -
Fajar A. Nugraha -
Ian Pilcher -
Phil Mayers