Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    WPA2 Enterprise with EAP-TLS auth issue with freeradius2 1.7.3_1

    Scheduled Pinned Locked Moved pfSense Packages
    2 Posts 2 Posters 914 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dw
      last edited by

      I manage to set up WPA2 Enterprise with EAP-TLS.

      After some security testing I can see that I can login with correct generated certificate but with NO user at all in “FreeRADIUS > Users”
      and I have
      “Check Client Certificate CN” enabled in Package/FreeRADIUS: EAP/EAP /EAP-TLS

      I’m  running:
      2.3.1-RELEASE-p1 (amd64) built on Wed May 25 14:53:06 CDT 2016 FreeBSD 10.3-RELEASE-p3
      with freeradius2 1.7.3_1.

      The guide I was using is from https://doc.pfsense.org/index.php/Using_EAP_and_PEAP_with_FreeRADIUS

      I’m missing something or its is a known bug?

      1 Reply Last reply Reply Quote 0
      • N
        Nachtfalke
        last edited by

        Hi,

        found this on the web:
        https://groups.google.com/forum/#!topic/mailing.unix.freeradius-users/AxI-ebtSqDI

        No, the only thing that check_cert_cn does is make sure that the CN in
        the certificate matches the User-Name attribute in the RADIUS request.
        It's basically just a sanity/security check on the request itself.  It
        does not go looking on other autz sources for you.  It is up to you to
        decide elsewhere (users file, SQL DB, LDAP) whether or not to allow that
        user to authenticate.  If you do nothing, the user will be allowed to
        authenticate by default.  If, for some reason, you decide you don't want
        a user to be allowed to authenticate, you must specifically reject him.

        So if you want to block a certificate you need a CRL (Certificate Revocation List) and put the certificate in it.

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.