So currently we have a server running FreeRADIUS that a previous
staff member stood up, and then created a php web app to manage
the Mac addresses within the MySQL database. We use this for
just simple Mac authentication for our one wireless network. The
Aruba controller then points to the FreeRADIUS server and checks
if the client trying to authenticate is in the database, and will
either allow it to connect or not.
Is there something similar that I can do with PacketFence? Just
worried something will go wrong with this php site and no one
really has the programming experience to maintain it.
On Thu, Oct 12, 2017 at 12:26 PM, Sallee, Jake via
PacketFence-users <[email protected]
<mailto:[email protected]>> wrote:
Matt:
To elaborate on Fabrice's statements jut a bit:
The RADIUS portion of PF can be thought of as just the
mechanism PF uses to talk to the controllers / APs / Switches.
All the logic of who and what devices get what role is
defined in PF and those roles should correspond with some
type of established network based method of controlling access.
In our instance we use VLans and internal firewalls.
When a user authenticates the role they are assigned in PF
triggers the RADIUS server to respond to the AP with a VLan
assignment for that host, that vlan has established rules
concerning where hosts on the subnet can and cannot go on the
network which are enforced via our internal firewalls.
There are other ways you can do it but this is how we do it
and my gut feeling is it is very similar to how must people
deploy PF.
PF will not return an ACCESS DENY except under special
circumstances, most of the time you don't want access deny
anyway. Typically when you want to deny a user access to
network resources, you want to isolate them.
Isolation provides the ability to push the user onto a
network subnet where you can better control their access and
allow for self-remediation, if you want.
There are corner cases where outright rejecting the user is
what you want, and I am just a stranger on the Internet who
knows nothing about your specific requirements ... so you can
take my comments with a proverbial grain of salt, YMMV, etc.
Hope that helps, please feel free to post back to the list
with any problems you have. If I can help and I have time
I'll respond.
Jake Sallee
Godfather of Bandwidth
System Engineer
University of Mary Hardin-Baylor
WWW.UMHB.EDU <http://WWW.UMHB.EDU>
900 College St.
Belton, Texas
76513
Fone: 254-295-4658 <tel:254-295-4658>
Phax: 254-295-4221 <tel:254-295-4221>
________________________________
From: Fabrice Durand via PacketFence-users
<[email protected]
<mailto:[email protected]>>
Sent: Thursday, October 12, 2017 10:30 AM
To: [email protected]
<mailto:[email protected]>
Cc: Fabrice Durand
Subject: Re: [PacketFence-users] PacketFence FreeRADIUS only
configuration
Hello Matt,
with mac auth packetfence return by default Accept but the
vlan_id/Acl/Role is different based on the status of the device.
Let say if a device is unreg then you probably want to return
Accept with an acl name that will deny the access to the
network and when you set the device reg with a role then you
probably want to Accept too by with an acl name that will
allow the device on the network.
On the opposite when you do 802.1x then if the username and
password is correct then PacketFence will return Accept but
if you use a wrong username and password the return will be Deny.
Also to debug when freeradius run, go in /usr/local/pf and do
raddebug -f var/run/radius.sock -t 3000
Regards
Fabrice
Le 2017-10-12 à 10:47, Matt Fogleman via PacketFence-users a
écrit :
I'm really new to both FreeRADIUS and PacketFence, what I am
trying to do is just get a simple Mac auth configuration up
for our wireless network. I installed PacketFence with the
new RADIUS only option on RHEL7, I added our wireless
controller in the Configuration > Switches section and gave
it the RADIUS key, and also configured the same thing on our
wireless controller.
It seems to be accepting connections, but it is just
accepting everything. I added the Mac address of a laptop in
the "Nodes" section, and saw in Auditing that it sent back an
Accept message. But then I deleted the Mac address out of
"Nodes" and tried again and it sent the Accept message again.
So I tried a different device that I hadn't added before, and
it got accepted as well.
Is there somewhere I have to configure the conditions for it
to send back a Reject message?
I'm also getting an error when trying to start debugging.
Refusing to start with libssl version OpenSSL 1.0.1e-fips 11
Feb 2013 0x1000105f (1.0.1e release) (in range 1.0.1 release
- 1.0.1t rele)
Has anyone else encountered this?
--
Matt Fogleman
Network Technician
Unionville-Chadds Ford School District
(o) (610) 347-0970 <tel:%28610%29%20347-0970>
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites,
Slashdot.org<https://linkprotect.cudasvc.com/url?a=https://Slashdot.org&c=E,1,ZuIlSdKDzcG9MeyeaZU0g_sTRetVx7ox44Zillzgd_QYh06SXQux6EOVD7OUQ6ne2oMulBKKIHthE_VKdDiXvKOPE4e-qSJHNIOSM4iGDs3T18cV561JX3QJ&typo=1
<https://linkprotect.cudasvc.com/url?a=https://Slashdot.org&c=E,1,ZuIlSdKDzcG9MeyeaZU0g_sTRetVx7ox44Zillzgd_QYh06SXQux6EOVD7OUQ6ne2oMulBKKIHthE_VKdDiXvKOPE4e-qSJHNIOSM4iGDs3T18cV561JX3QJ&typo=1>>!
http://sdm.link/slashdot<https://linkprotect.cudasvc.com/url?a=http://sdm.link/slashdot&c=E,1,LZg9XqvjBmhirgrEMOjDbHOW3DxyqvZDn9XS0Mt5VdZtZAqXzoN2JFvHu4zD-eMlSG7_JzIxqcFkpjna14uexyLCsAdzZJ6MHLuC3mY,&typo=1
<https://linkprotect.cudasvc.com/url?a=http://sdm.link/slashdot&c=E,1,LZg9XqvjBmhirgrEMOjDbHOW3DxyqvZDn9XS0Mt5VdZtZAqXzoN2JFvHu4zD-eMlSG7_JzIxqcFkpjna14uexyLCsAdzZJ6MHLuC3mY,&typo=1>>
_______________________________________________
PacketFence-users mailing list
[email protected]
<mailto:[email protected]><mailto:[email protected]
<mailto:[email protected]>>
https://lists.sourceforge.net/lists/listinfo/packetfence-users
<https://lists.sourceforge.net/lists/listinfo/packetfence-users>
--
Fabrice Durand
[email protected]
<mailto:[email protected]><mailto:[email protected]
<mailto:[email protected]>> :: +1.514.447.4918
<tel:%2B1.514.447.4918> (x135) :: www.inverse.ca
<http://www.inverse.ca><https://linkprotect.cudasvc.com/url?a=http://www.inverse.ca&c=E,1,uYjcnRPETfowTOn17pZlwJbrD2E2fo5JpIGoi200YDy_2nDgQIAZQx2U80UfMFQDcDONkhzydqUdWCMCLpOoqLJfq9iPH3ZTMxGWeS1dK5U,&typo=1
<https://linkprotect.cudasvc.com/url?a=http://www.inverse.ca&c=E,1,uYjcnRPETfowTOn17pZlwJbrD2E2fo5JpIGoi200YDy_2nDgQIAZQx2U80UfMFQDcDONkhzydqUdWCMCLpOoqLJfq9iPH3ZTMxGWeS1dK5U,&typo=1>>
Inverse inc. :: Leaders behind SOGo
(http://www.sogo.nu<https://linkprotect.cudasvc.com/url?a=http://www.sogo.nu&c=E,1,Gm7t-itAvsZQsxUp8W9RQOiJaqglSV_Dj0jqDiIJWt5LLeIwWrQ-H9o63PhiPS2TJgf5OwKYLXSpsa1Uvddwby2kC-ffgwy5DjcqdYqAlOH6LyTeZqY,&typo=1
<https://linkprotect.cudasvc.com/url?a=http://www.sogo.nu&c=E,1,Gm7t-itAvsZQsxUp8W9RQOiJaqglSV_Dj0jqDiIJWt5LLeIwWrQ-H9o63PhiPS2TJgf5OwKYLXSpsa1Uvddwby2kC-ffgwy5DjcqdYqAlOH6LyTeZqY,&typo=1>>)
and PacketFence
(http://packetfence.org<https://linkprotect.cudasvc.com/url?a=http://packetfence.org&c=E,1,pe1X9i4Y8D9gUO2QsxvdXkhQ0P2nVnDm-njBcQdr0gJcsKML5MYeCC3RRCfo-Mxku3gHyo1-89TAYX-xhnfl8Gj_gaXoYvXIrJ_MweZpOuDC&typo=1
<https://linkprotect.cudasvc.com/url?a=http://packetfence.org&c=E,1,pe1X9i4Y8D9gUO2QsxvdXkhQ0P2nVnDm-njBcQdr0gJcsKML5MYeCC3RRCfo-Mxku3gHyo1-89TAYX-xhnfl8Gj_gaXoYvXIrJ_MweZpOuDC&typo=1>>)
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
PacketFence-users mailing list
[email protected]
<mailto:[email protected]>
https://lists.sourceforge.net/lists/listinfo/packetfence-users
<https://lists.sourceforge.net/lists/listinfo/packetfence-users>
--
*Matt Fogleman*
Network Technician
Unionville-Chadds Ford School District
*(o)**(610) 347-0970 <tel:%28610%29%20347-0970>*
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org!http://sdm.link/slashdot
_______________________________________________
PacketFence-users mailing list
[email protected]
<mailto:[email protected]>
https://lists.sourceforge.net/lists/listinfo/packetfence-users
<https://lists.sourceforge.net/lists/listinfo/packetfence-users>
