WebGui and RADIUS authentication

[aduffield]

Hi there,

I need to configure MFA on access to our pfsense web gui for compliance reasons.

We currently have a single local admin account.

I want to configure a new user that will be authenticated via an on-premise NPS server (which is configured for MFA)

Can I have a local admin user authenticated against a local database, and a separate admin user authenticating to a RADIUS server?

Thanks

[jimp]

If RADIUS authentication fails the user (even if it's due to an invalid password) it falls back to local auth.

So you can set the GUI to use RADIUS for auth, and continue to use the local admin account if necessary. Users who auth via RADIUS will be able to reach the GUI (Assuming you setup their groups properly)

[aduffield]

@jimp said in WebGui and RADIUS authentication:

GUI

Thanks jimp,

So, to be clear, if I set the GUI to use RADIUS for auth, I will still be able to log in as the local admin account?

Regarding the users, I have Windows NPS in place for Radius which uses Windows AD groups, do I need to set the usernames on the pfsense to match the users in AD?

Cheers

[jimp]

@aduffield said in WebGui and RADIUS authentication:

So, to be clear, if I set the GUI to use RADIUS for auth, I will still be able to log in as the local admin account?

That's what I just said, yes.

Regarding the users, I have Windows NPS in place for Radius which uses Windows AD groups, do I need to set the usernames on the pfsense to match the users in AD?

Read the docs about how this works, especially with regard to groups on pfSense and the class attribute:

• https://docs.netgate.com/pfsense/en/latest/book/usermanager/authentication-servers.html#radius
• https://www.netgate.com/resources/videos/radius-and-ldap-on-pfsense-24.html