FreeRADIUS latest package upgrade

Wow, I thought you had to have a user that matched the common name of the cert?

johnpoz

Been working 2 years with no users listed in the freerad users group. I know that for sure..

I have 3 devices using eap-tls, well actually 4 (my pc - but its never on wireless) My phone, my wife phone and the ipad.

All three connect just fine, and show log as they authed. And there have been no users in the freerad users..

Indeed strange.

I have to run out. Taking my elderly neighbor to get her Covid vaccine.

viktor_g

@johnpoz all users you created on the FreeRADIUS / Users page are saved in /usr/local/etc/raddb/users

it seems that you connected using this (fixed in _25) issue https://redmine.pfsense.org/issues/11054:

A user attempting TLS authentication with a certificate signed by the configured CA, and with a common name matching the user-provided identity, passes authentication even if that common name/identity is not a valid user configured under FreeRADIUS / Users. This option only seems to ensure the common name of the client certificate matches the user-provided identity.

johnpoz

Ok - so that was an issue that it would auth, even without users in the freerad users.. And you fixed that. So now I just add them that match the CN on the certs..

Not a big deal.. Thanks!!

All back to working for my 3 devices.. And it does make sense.. That users should also have to be listed in freerad to match the CN on the cert.

And - makes it easy to just delete a user vs worried about revoking a cert, etc. etc..

Thanks again for looking into this so quickly and link to the other bug that was fixed.. That was causing my problem.

edit: Project for this weekend maybe is moving to eap-tls via wpa3-enterprise.. I got wpa3 working on my psk ssids.. But have to do some reading - Not sure wpa3-enterprise really gets me all that much over wpa2-enterprise.. Can use a higher level encryption sure.. But not sure if makes any sense when using eap-tls.. Some reading to do..

But wpa3-psk is working nice.. Sad part is - with all these shitty iot devices, that don't support wpa3, you have to still run in wpa2/wpa3 mode..