3

We have internet access in both LAN and WLAN in our offices which is only used to internet access.

How do we enable a password based authentication in this infrastructure so that authenticated user will type a user name and password first to gain access to the Internet services? Whenever a user will connect to a SSID the system will prompt for a user name and password. After verifying the user name and password the user will be given internet access.

I have read many articles on it and came to know RADIUS server can be one solution for this. I look forward how to configure one with Ubuntu Linux (preferably) and store user name and password in a database (if possible) so that the server will authenticate only those users.

Improve this question
3
  • What network hardware are you using currently?
    – Gerben
    Commented Aug 20, 2015 at 7:42
  • We are using a linux based server for Internet access and as a DHCP server. Thanks.
    – Sayeed
    Commented Aug 20, 2015 at 7:46
  • For the network part we are using Cisco 2500 series WLC and 1200 series LAP.
    – Sayeed
    Commented Aug 20, 2015 at 7:47

3 Answers 3

Reset to default
2

Consider looking into PacketFence(.org) + FreeRADIUS.

PacketFence describes itself as :

PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, powerful BYOD management options, 802.1X support, layer-2 isolation of problematic devices; PacketFence can be used to effectively secure networks small to very large heterogeneous networks.

(Emphasis mine.)

When users first attempt to connect to the network, you can require that they authenticate using a username and password, as shown in this example image from PF's website : http://www.packetfence.org/typo3temp/pics/3623b54ba0.png

As for (Free)RADIUS, PacketFence's administration guide has this to say :

In some occasions, a RADIUS server is mandatory in order to give access to the network. For example, the usage of WPA2-Enterprise (Wireless 802.1X), MAC authentication and Wired 802.1X all requires a RADIUS server to authenticate the users and the devices, and then to push the proper VLAN to the network equipment. We strongly recommend that you install FreeRADIUS even if you plan not to use the feature now.

Unfortunately I can't exactly include a whole configuration guide in this answer, but there is good documentation available on the PacketFence site.

Best of luck !

Improve this answer
1
  • Thanks many for the reply. Let me try it out and will inform you.
    – Sayeed
    Commented Aug 20, 2015 at 12:02
2

Your Cisco 2500 WLC can authenticate wireless clients in many different ways, one of them being a captive web portal with username and password.

A Radius server can be used, but this might be overkill if you are only going to set it up for authentication on the wireless network. Users can also be defined directly on the WLC.

Explaining how to set this up is beyond the scope of this Q&A site, but have a look at the Wireless Controller Configuration Guide, more specifically at the sections "Managing User Accounts" and "Managing Web Authentication"

Improve this answer
1
  • This is the best solution since the captive portal functionality is part of the WLC software. This is generally far better than adding a third party solution unless one needs features above and beyond the functionality provided natively.
    – YLearn
    Commented Aug 21, 2015 at 0:12
0

you need Radius Server and 802.1x Enabled AP , for Radius server you have good option Microsoft Network Policy server and you need to define users on active directory integrated with your NPS

Improve this answer
1
  • Hi Thanks for the reply. Can I achieve the same with Linux based server?
    – Sayeed
    Commented Aug 20, 2015 at 8:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.