FreeRadius with link-local addresses

Ντέντος Σταύρος stdedos at gmail.com
Sun Nov 18 22:42:36 CET 2018


I am trying to authenticate using a link-local IPv6 address.

I was reading
http://lists.freeradius.org/pipermail/freeradius-users/2013-May/066690.html,
but I assume it is old already?

$ radtest -6 user password 'fe80::link-local-ipv6-address%eth0' 0 'secret'
0 'fe80::link-local-ipv6-address' # <--------- radtest --version = 2.2.8
Sending Access-Request of id 68 to 'fe80::link-local-ipv6-address' port 1812
        User-Name = "user"
        User-Password = "password"
        NAS-IPv6-Address = 'fe80::link-local-ipv6-address'
        NAS-Port = 0
        Message-Authenticator = 0x00000000000000000000000000000000
^C
$
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
# Example of passing request
(1) Sent Access-Accept Id 74 from [global-ipv6-address]:1812 to
[global-ipv6-address]:52427 length 0
(1)   Reply-Message = "Hello, user"
(1) Finished request
Waking up in 4.9 seconds.
(1) Cleaning up request packet ID 74 with timestamp +42
Ready to process requests
Ignoring request to auth address :: port 1812 bound to server default from
unknown client 'fe80::link-local-ipv6-address' port 45077 proto udp
Ready to process requests

I already have the clients setup correctly and they work:
client LinkLocal {
  ipv6addr    = fd80::/16
  secret      = "secret"
  require_message_authenticator = yes
  nastype   = other
}

client Global {
  ipv6addr    = fd00::/16
  secret      = "secret"
  require_message_authenticator = yes
  nastype   = other
}

I would prefer a solution of 2.2.8 FreeRadius, but I could consider
updating.

Ντέντος Σταύρος


More information about the Freeradius-Users mailing list