Hi guys, go a question - Is it possible to use freeradius with some 2FA somehow? Most perfect scenario would be: - try to log in on remote hosts, - remote server communicates with freeradius, - radius gives a question to some phone 2FA app, - then we get click "ALLOW" on the mobile 2FA app, - tadam we are logged in, -- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000
Yes. We have implemented username+pw+TOTP auth. Can also use certs(smartcards), the options are endless. FR can do anything you tell it to do. Of course you have to understand what exactly you want to do in the first place. On August 2, 2023 8:34:19 AM GMT+02:00, "Jarosław Kłopotek" <jkl@interduo.pl> wrote:
Is it possible to use freeradius with some 2FA somehow?
W dniu 2.08.2023 o 10:39, marki pisze:
Yes.
We have implemented username+pw+TOTP auth. Can also use certs(smartcards), the options are endless. I will check the smartcards also. Thanks for advice. FR can do anything you tell it to do. Of course you have to understand what exactly you want to do in the first place. In my first mail (that part that You didn't quoted) I propposed specific ideal scenario. Is it possible to work like that? On August 2, 2023 8:34:19 AM GMT+02:00, "Jarosław Kłopotek" <jkl@interduo.pl> wrote:
Is it possible to use freeradius with some 2FA somehow?
-- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000
Probably. But your "specifications" weren't very detailed. Just try it. On August 2, 2023 10:56:04 AM GMT+02:00, "Jarosław Kłopotek" <jkl@interduo.pl> wrote:
W dniu 2.08.2023 o 10:39, marki pisze:
On August 2, 2023 8:34:19 AM GMT+02:00, "Jarosław Kłopotek" <jkl@interduo.pl> wrote:
Is it possible to use freeradius with some 2FA somehow?
Oh and concerning smartcards, it is more tricky as FR doesn't get to see the entire cert i.e. the TLS handshake. Your NAS needs to validate the CA(s) and FR can act on the attributes present in the cert. On August 2, 2023 11:22:34 AM GMT+02:00, marki <jm+freeradiususer@roth.lu> wrote:
Probably. But your "specifications" weren't very detailed. Just try it.
On August 2, 2023 10:56:04 AM GMT+02:00, "Jarosław Kłopotek" <jkl@interduo.pl> wrote:
W dniu 2.08.2023 o 10:39, marki pisze:
On August 2, 2023 8:34:19 AM GMT+02:00, "Jarosław Kłopotek" <jkl@interduo.pl> wrote:
Is it possible to use freeradius with some 2FA somehow?
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
This is of course the case with SSL VPN only and not with EAP. As I said it depends. Good luck. On August 2, 2023 11:25:47 AM GMT+02:00, marki <jm+freeradiususer@roth.lu> wrote:
Oh and concerning smartcards, it is more tricky as FR doesn't get to see the entire cert i.e. the TLS handshake. Your NAS needs to validate the CA(s) and FR can act on the attributes present in the cert.
Probably. But your "specifications" weren't very detailed. Just try it.
On August 2, 2023 10:56:04 AM GMT+02:00, "Jarosław Kłopotek" <jkl@interduo.pl> wrote:
W dniu 2.08.2023 o 10:39, marki pisze:
On August 2, 2023 8:34:19 AM GMT+02:00, "Jarosław Kłopotek" <jkl@interduo.pl> wrote:
Is it possible to use freeradius with some 2FA somehow?
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On August 2, 2023 11:22:34 AM GMT+02:00, marki <jm+freeradiususer@roth.lu> wrote: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
W dniu 2.08.2023 o 11:22, marki pisze:
Probably. But your "specifications" weren't very detailed. What is missing? Just try it. I am using freeradius in many services but unfortunately now without 2FA. On August 2, 2023 10:56:04 AM GMT+02:00, "Jarosław Kłopotek" <jkl@interduo.pl> wrote:
W dniu 2.08.2023 o 10:39, marki pisze:
On August 2, 2023 8:34:19 AM GMT+02:00, "Jarosław Kłopotek" <jkl@interduo.pl> wrote:
Is it possible to use freeradius with some 2FA somehow?
-- Jarosław Kłopotek, kom. 607 893 111 INTERDUO Bujek Kłopotek Sowa sp.j. ul. Krańcowa 17, 21-100 Lubartów tel. 81 475 3000
On Aug 2, 2023, at 2:34 AM, Jarosław Kłopotek <jkl@interduo.pl> wrote:
Hi guys,
go a question - Is it possible to use freeradius with some 2FA somehow?
Most perfect scenario would be: - try to log in on remote hosts, - remote server communicates with freeradius, - radius gives a question to some phone 2FA app,
i.e. you need a phone AP, and some kind of additional server or servers to coordinate between the phone app and FreeRADIUS.
- then we get click "ALLOW" on the mobile 2FA app, - tadam we are logged in,
Lots of companies sell this product. It's not cheap. Or, use mods-available/totp Alan DeKok.
participants (3)
-
Alan DeKok -
Jarosław Kłopotek -
marki