wpa2 enterprise separate users
Hello! I have a running freeradius server version 2.1.12. Here's how thing are working: 1.Freeradius server is up and running, i have configured it to work with wpa2 enterprise eap-tls 2.Soho routers are configured to connect to freeradius server 3. In clients.conf i have defined multiple client directives ("Router1" and "Router2"), each with it's own public ip and different secret password (these are simple soho routers) 4. In users file i defined couple of users (let them be user "A" and user "B", each having their own certificate for authentication 5.User "A" is supposed to connect to Router1, and user "B" is supposed to connect to to Router2 6.User "A" can connect to Router1 via wifi, but also CAN connect to Router2, and the other way around: user "B" can connect to Router1 and Router2 (this make sense to me according how freeradius works) 7.What i want to achieve is to seperate those users the way, that they can only connect to defined Router (1 or 2, not both at the same time). Is there a way of doing it? Any help would be appreciated.
On Jan 26, 2015, at 6:43 AM, howtocisco <howtocisco@howtocisco.pl> wrote:
7.What i want to achieve is to seperate those users the way, that they can only connect to defined Router (1 or 2, not both at the same time).
Is there a way of doing it?
See http://wiki.freeradius.org/. Look for Simultaneous-Use. Alan DeKok.
Hi! Thanks for reply! Maybe i expressed myself in a wrong way... Simultaneous-Use indeed would block user from connecting via Router1 and Router2 at the same time, but nothing stops him to use Router1 OR Router2. Imagine situation, where user "A" supposed to connect to Router1's SSID, but instead, he chooses SSID from Router2, and still he will be authorized by freeradius. How can i block this kind of access. I want the user to connect only via Router1, and take away the possibility for him to connect via Router2. ---- Wł. Pn, 26 sty 2015 14:30:19 +0100 Alan DeKok napisał(a) ----
On Jan 26, 2015, at 6:43 AM, howtocisco <howtocisco@howtocisco.pl> wrote:
7.What i want to achieve is to seperate those users the way, that they can only connect to defined Router (1 or 2, not both at the same time).
Is there a way of doing it?
See http://wiki.freeradius.org/. Look for Simultaneous-Use.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jan 26, 2015, at 9:01 AM, howtocisco <howtocisco@howtocisco.pl> wrote:
Simultaneous-Use indeed would block user from connecting via Router1 and Router2 at the same time, but nothing stops him to use Router1 OR Router2. Imagine situation, where user "A" supposed to connect to Router1's SSID, but instead, he chooses SSID from Router2, and still he will be authorized by freeradius. How can i block this kind of access. I want the user to connect only via Router1, and take away the possibility for him to connect via Router2.
Put the users into groups. Then, check the group membership against the router they’re using. See rlm_passwd for simple Unix-style groups. Alan DeKok.
participants (2)
-
Alan DeKok -
howtocisco