Authenticating Login Users via Radius with LDAP backend

RouterOS General
1

Hi

I try to integrate the Miktrotik Routers into our central Radius AAA System. We use Freeradius with a LDAP backend.
The problem I’m facing is that when I try to log in on the web interface is that it send’s an authentication request with mschap and
freeradius seams not to be able to handle that. Is there a way to change this so that it die simple plaintext authentication?

Regards

Matthias

2

Webfig is MSCHAPv2.
Winbox is CHAP.
Console/SSH/Terminal is PAP.

No way to configure any of these sadly.

Why not AAA directly to MS Radius thats included with NPS?

3

Problem is, the LDAP is not an AD (it’s an Apache Directory Server), we do not use Windows for such things.

@Mikrotik: would it be possible to add a config option to be able to do also PAP/CHAP for Webfig ?

Regards

Matthias

4

Anyone got a way to set rate limit on freeradius that use LDAP on back-end?

Thanks

5

It definatelly should be possible, but I am not good enough with Radius to tell you how.

6

Thanks, is there anyone on the list who has an idea about this. Basically i need a way to apply rate limit by different groups in ldap; a way to use the user profiles in hotspot to match the ldap group entries.

Thanks

7

Anyone got an idea how i could rate-limit using freeradius with ldap backend?