Date: Mon, 2 Apr 2007 18:17:06 +0200 (CEST) From: Mohacsi Janos <mohacsi@niif.hu> To: Marko Lerota <mlerota@iskon.hr> Cc: freebsd-security@freebsd.org Subject: Re: Stronger security with BSD Firewall and Freeradius Message-ID: <20070402175305.X73058@mignon.ki.iif.hu> In-Reply-To: <86lkha6eey.fsf@sparrow.local> References: <86lkha6eey.fsf@sparrow.local>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 2 Apr 2007, Marko Lerota wrote: > I've seen that is possible to use switch port blocking with freeradius > and cisco switches via 802.1X and EAP protocol. Here is more info: > http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO > > What if I don't have switch that supports 802.1X or I want that blocking > is done by FreeBSD, not the switch. Because FreeBSD is the firewall or > gateway to some networks. Is there any solution that implements freeradius > with PF or any other firewall/blocking feature? Definition: IEEE 802.1X is an IEEE standard for port-based Network Access Control. Port based means, that you have to have large number of ports that you can control by individual usage. Ports can be: ethernet ports or wireless port. In the first case you would need large number of ports in your firewall, which is not really feasible. The later case you should use hostapd. With the hostapd your can configure your firewall as a authenticator (802.1x terminology) or access point, that can provide wireless access based on credential supplied by your users (userid+password, certificate, etc.). I suspect you would like to have something similar that authpf do. Authenticate on the firewall, then allow access on the internal network. Have a look at man authpf or http://www.openbsd.org/faq/pf/authpf.html about authpf usage. I hope this helped. Best Regards, Janos Mohacsi Network Engineer, Research Associate, Head of Network Planning and Projects NIIF/HUNGARNET, HUNGARY Key 70EF9882: DEC2 C685 1ED4 C95A 145F 4300 6F64 7B00 70EF 9882 > > -- > One cannot sell the earth upon which the people walk > Tacunka Witco > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070402175305.X73058>