FreeRADIUS Guidance

[Phillip Morley]

Greetings,

I am looking for some guidance on the following matters with an instance of FreeRADIUS I am trying to put up/complete......

If there is anyone out there who can provide some simple guidance, that would be appreciated.

We are looking for FreeRADIUS to work in conjunction with trusted and signed SSL/TLS certificates, so that when users connect to wireless on a Ubiquiti platform, they are NOT prompted to accept or "trust" the RADIUS server's certificate. That's the end goal......

I need to better understand how to specify a wide range or a list of "client" IP addresses, which will be the Ubiquiti access points, in the FreeRADIUS configuration. Right now, I have 1 AP defined as our test AP.

Right now, after putting SSL/TLS certificates on the RADIUS server, I cannot get the "server" to answer or process any requests for user authentication external to the server. I have disabled firewalld and rebooted. We are working with FQDNs as well and not sure if this has anything to do with this.....

In terms of the user file, this is great for very small environments, however this one is going to be several hundred user accounts, and where a VLAN ID needs to be specified along with their user account entry, so when they connect, they get placed on the VLAN they are supposed to by the RADIUS authentication request. For this level of credential storage, is there a standard MySQL DB that is canned and can be put up as the mechanism to store user credentials? A software developer in this environment can and I think we should have him develop a custom web page/portal for non-technical users to add/remove user credentials. What is the best recommended set of tools and stuff for this need?

Finally, we want to store user credentials in a secure fashion. I am reading there is a way to encrypt them on the server and in transit but requires some configuration and such. What are the components of getting this done, and then also storing them in whatever medium needed to address the immediately preceding question I made above about a database for them?

Thanks so much!

Phillip Morley
phillip at is-md.com<mailto:phillip at is-md.com>

Legal Disclaimer:

The information contained in this electronic transmission, and any documents attached hereto, may contain confidential information that is legally privileged and confidential. This electronic transmission is intended solely for its recipients only and is not intended to be relied upon without subsequent written confirmation of its contents. Accordingly Information Systems of Maryland, LLC., its subsidiaries and all its associated entities disclaim all responsibility and accept no liability (including in negligence) for the unauthorized use of such information prior to the receipt by the above addressed person(s). Any disclosure, copying, distribution or the taking of any action in reliance on the contents of the information received in error is strictly prohibited by U.S. Law (Title 18, Section 2511). If you have received this electronic message in error, please notify the sender and delete the electronic message and any associated content of its transmission.