Re: FreeRADIUS Guidance

--===============4984304473531945359==
Content-Type: multipart/signed;
	boundary="Apple-Mail=_5A4CB7FB-36ED-4D18-95EA-13D4A4A1D35E";
	protocol="application/pgp-signature";
	micalg=pgp-sha256


--Apple-Mail=_5A4CB7FB-36ED-4D18-95EA-13D4A4A1D35E
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

On Jul 6, 2026, at 4:49=E2=80=AFPM, Phillip Morley via Freeradius-Users =
<[email protected]> wrote:
> We are looking for FreeRADIUS to work in conjunction with trusted and =
signed SSL/TLS certificates, so that when users connect to wireless on a =
Ubiquiti platform, they are NOT prompted to accept or "trust" the RADIUS =
server's certificate. That's the end goal......

  Android, Microsoft, and Apple disagree with this goal.

  As a result, what you want doesn't work.

> I need to better understand how to specify a wide range or a list of =
"client" IP addresses, which will be the Ubiquiti access points, in the =
FreeRADIUS configuration. Right now, I have 1 AP defined as our test AP.

  See the clients.conf file.  This is all documented.

> Right now, after putting SSL/TLS certificates on the RADIUS server, I =
cannot get the "server" to answer or process any requests for user =
authentication external to the server. I have disabled firewalld and =
rebooted. We are working with FQDNs as well and not sure if this has =
anything to do with this.....

  Is the AP sending packets to the server?  You can check with tcpdump =
or wireshark.

> In terms of the user file, this is great for very small environments, =
however this one is going to be several hundred user accounts, and where =
a VLAN ID needs to be specified along with their user account entry, so =
when they connect, they get placed on the VLAN they are supposed to by =
the RADIUS authentication request. For this level of credential storage, =
is there a standard MySQL DB that is canned and can be put up as the =
mechanism to store user credentials? A software developer in this =
environment can and I think we should have him develop a custom web =
page/portal for non-technical users to add/remove user credentials. What =
is the best recommended set of tools and stuff for this need?

  MySQL is fine.  You can use AI to create a simple UI for exactly what =
you want.

> Finally, we want to store user credentials in a secure fashion. I am =
reading there is a way to encrypt them on the server and in transit but =
requires some configuration and such. What are the components of getting =
this done, and then also storing them in whatever medium needed to =
address the immediately preceding question I made above about a database =
for them?

  It depends.  If the end user devices are using PEAP/MS-CHAP, then you =
have to store the passwords in the DB in clear-text.  Or, reconfigure =
the end user devices to use TTLS+PAP.

  If the end user devices are all using TTLS+PAP, then you can store the =
passwords in the DB in crypt'd form.

> Legal Disclaimer:

  That's meaningless.

  Alan DeKok.


--Apple-Mail=_5A4CB7FB-36ED-4D18-95EA-13D4A4A1D35E
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEIUl02elqcIsf1zM0v3SJ0h7dTTMFAmpMIn0ACgkQv3SJ0h7d
TTMkdg//b5YqEZTYMPypGY/An8ftt6DvlnU9ZYhWJ3SqRIsJxoEc27JdymPXtgTp
i38YbMAAV5bgXQFJ/hmM0EW2SHfpaljUshKptvL9HklGD806MMioSuj8XxaOfRQH
bLujfmG9QCgOjdg/rs5mKWvqRrQhVCNXYeYlVCrlYCuJDG+SZf25pn4qemj4DFyK
YEsi0NJvHAw+EY5UwSTFLA4/ocmii5uu2mK9okYQmvtE3oZPXNt0d+GlyeCvh75J
JYhuXiMJapeuxKq3WOxX3SLVpX2ZIrfNoFRgpNnCXGPQTgEn1apiunFLKkbo9BX1
uz/TZsQ3HKQ/3iZx5MvN2n11b6TcDXx8s2V5em4Q7uglMCaQKPJqaExuqfnpEuUt
uIWtw3Bcn31PTBAO62p8C8eaVLK+l4Zk9FHC7nHdKKRrBb1093p51F6FqS2zISU2
gyZRf0s6C+BVSKE5tBFt9KQuBEfMwOLMBAahywZCptqGD284Y5ZA+rllXLBwvh2J
LU8zPT+e56apNlkQEToIgCy/5Aa8DAlR4QAC1G8yOHC9pnsvUv3zyQciqNSqwlgd
oRG85whrpwgd/xAOd0zedSrULyfF6bcp6HQel8t6SO1plLwz7oc2VNDwZqmp+UDh
j0NlTQt2H049hAeD30f5txZB7hBBILGo5Al81/Hdm1mQKQfmlNY=
=fDLQ
-----END PGP SIGNATURE-----

--Apple-Mail=_5A4CB7FB-36ED-4D18-95EA-13D4A4A1D35E--

--===============4984304473531945359==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

--===============4984304473531945359==--