RADIUS authentication for MAC addresses

Question

Level 6

13,697 points

RADIUS authentication for MAC addresses

I am still waiting for my Leopard Server upgrade to arrive, but I have downloaded and read the manuals.

A RADIUS server has been added to Leopard (I actually sent feedback requesting this a long time ago). From the manual however, it appears however to be limited to user authentication via LEAP.

I was hoping for a full-blown RADIUS server that could be used for various purposes, including authenticating wireless computers via their MAC address. This is a feature that the AirPort Extreme base stations do support. I would also like to use it for dialup or VPN user authentication, for example my hardware firewall supports authenticating user accounts for vpn access via the firewall.

Unfortunately, the Apple manuals almost totally lack examples (and for that matter diagrams, remember a picture is worth a 1000 words), and are very skimpy on details. The Unix man pages would probably be a better source of information except I am still waiting for the software to arrive 😟

Has anyone had a chance to kick the tyres of the new RADIUS server and can comment?

I was hoping it would be possible to define a computer group (which is based on MAC addresses), and have the Airport basestations check that the access attempt is from a member of the group you have defined as being allowed access. Just like you can have a user group defined to allow VPN access for only users that are a member of that group.

PowerBook G4, Mac OS X (10.4.10)

Posted on Oct 30, 2007 11:26 AM

Reply

Answer 1

Nov 1, 2007 3:25 PM in response to John Lockwood

I just installed my AMP upgrade yesterday on an Xserve and it appears (unless I'm missing something) that the radius server does not allow MAC address authentication. I, too, am disappointed as I was looking specifically for this functionality for wireless laptop carts in my school district.

Reply

Answer 2

John Lockwood Author

Level 6

13,697 points

Nov 2, 2007 5:57 AM in response to Mark Ranes

Mark Ranes wrote:
I just installed my AMP upgrade yesterday on an Xserve and it appears (unless I'm missing something) that the radius server does not allow MAC address authentication. I, too, am disappointed as I was looking specifically for this functionality for wireless laptop carts in my school district.

Thanks for the info, this is disappointing.

For what its worth the following alternate RADIUS servers are available

Radiator http://www.open.com.au/radiator/
Elektron http://www.periodiklabs.com/elektron/features
RDXServer http://www.rdxserver.com/
StellarRadius http://carpestellarem.com/Products/StellarRADIUSLite.php (site appears dead, product is a Mac GUI front-end to FreeRADIUS)

FreeRADIUS http://www.freeradius.org/ (you have to compile it yourself)
OpenRADIUS http://www.xs4all.nl/~evbergen/openradius/ (this does appear to have a current port for the Mac see http://openradius.darwinports.com/ )

Reply

Answer 3

Nov 2, 2007 8:02 AM in response to John Lockwood

I've looked at many of these options over the past couple of years, but I was hoping for an elegant Apple solution, running as a service on an existing Xserve. Maybe we'll get this in a future update.

Mark

Reply

Answer 4

John Lockwood Author

Level 6

13,697 points

Nov 5, 2007 4:22 AM in response to Mark Ranes

Mark Ranes wrote:
I've looked at many of these options over the past couple of years, but I was hoping for an elegant Apple solution, running as a service on an existing Xserve. Maybe we'll get this in a future update.

Mark

Me too. Based on past experience such a change would unfortunately not happen until 10.6 now.

Alas, from the documentation it also looks like they have failed to add a critical feature to their DHCP server (the ability to add additional DHCP option fields - needed to support a VoIP phone system). Standard bootpd and dhcpd can do this, but the mutant bootpd that Apple have used uptil now, cannot. I should get my new server this week to try it, but the documentation does not mention this, so I am not hopeful. 😟

Reply

Answer 5

Nov 6, 2007 7:48 AM in response to John Lockwood

MAC address filtering can be set up. I feel obligated to point out that MAC filtering is easily hacked and it is worth considering switching to 802.1X. To set up MAC filtering, create a user with the MAC address as the username and the password is the shared secret. The user name format is "123456-123456" for the long name. WGM automatically removes the dash in the short name.

There is one other step. The default configuration is going to use 'unix' as the authentication method, not Open Directory. You need to adjust the config files in /etc/raddb. I don't know off-hand how to do it. I think you can enable pam authentication. If that doesn't work, you need to get 'unix' authentication to use OD. I know it can be done somehow. Maybe you can change 'unix' to "Auth-Type unix { opendirectory }" in the authenticate section.

Reply

Answer 6

JuiceLSU

Level 1

35 points

Nov 14, 2007 7:54 PM in response to John Lockwood

The radius server included with Leopard is Freeradius. It seems Apple does not provide a good GUI to configure the advance features of Freeradius. I haven't messed with the included Freeradius distribution yet, but it seems like you should be able to edit the configuration files in /etc/raddb and still be able to start the service through Server Admin.

Reply