<div>Ivan, the question is, do i need a client certificate installed on windows client machine? </div>
<div> </div>
<div>Thanks!<br><br>D.<br><br></div>
<div class="gmail_quote">2008/4/10 David Hláčik <david@hlacik.eu>:<br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">
<div>As i understood i have to use xpextensions for certificate, but my question is , i am using scripts on CentOs 5.1 for generating certificates with my own CA, how will i add those xpextensions, i did not found it in a system hierarchy, should i download freeradius source?<br>
<br>Thanks!<br><br>D.<br><br></div>
<div class="gmail_quote">2008/4/10 Ivan Kalik <<a href="mailto:tnt@kalik.net" target="_blank">tnt@kalik.net</a>>:
<div>
<div></div>
<div class="Wj3C7c"><br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Have a look at eap.conf. You might find a huge warning about this. It's<br>also in FAQ, ...<br><br>Upgrade or at least download 2.0 and use it to generate certificates.<br>
<div><br>Ivan Kalik<br>Kalik Informatika ISP<br><br><br></div>Dana 10/4/2008, "David Hláčik" <david@hlacik.eu> piše:<br>
<div>
<div></div>
<div><br>>Hi ,<br>><br>>i have just configured WPA with my radius working with ldap and pptp (VPN<br>>for windows client), i have uncommented peap parts and tls from eap.conf,<br>>created TLS keys, radius responses like ok, but still windows can not<br>
>connect with a result unable to connect to network :<br>><br>>here is my radius log (radiusd -X ) :<br>><br>>Ready to process requests.<br>>rad_recv: Access-Request packet from host <a href="http://10.123.42.11:3072/" target="_blank">10.123.42.11:3072</a>, id=133,<br>
>length=165<br>> User-Name = "boss"<br>> NAS-IP-Address = <a href="http://10.123.42.11/" target="_blank">10.123.42.11</a><br>> NAS-Port = 0<br>> Called-Station-Id = "001cf05a2b71"<br>> Calling-Station-Id = "001b77392d05"<br>
> NAS-Identifier = "Realtek Access Point. 8181"<br>> Framed-MTU = 1400<br>> NAS-Port-Type = Wireless-802.11<br>> Service-Type = Framed-User<br>> Connect-Info = "CONNECT 11Mbps 802.11b"<br>
> EAP-Message = 0x0201000901626f7373<br>> Message-Authenticator = 0xddd1cfc8f7271cf16ed0a682ca273fda<br>> Processing the authorize section of radiusd.conf<br>>modcall: entering group authorize for request 0<br>
> modcall[authorize]: module "preprocess" returns ok for request 0<br>> modcall[authorize]: module "chap" returns noop for request 0<br>> modcall[authorize]: module "mschap" returns noop for request 0<br>
> rlm_realm: No '@' in User-Name = "boss", looking up realm NULL<br>> rlm_realm: No such realm "NULL"<br>> modcall[authorize]: module "suffix" returns noop for request 0<br>
> rlm_eap: EAP packet type response id 1 length 9<br>> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation<br>> modcall[authorize]: module "eap" returns updated for request 0<br>> users: Matched entry DEFAULT at line 152<br>
> users: Matched entry DEFAULT at line 171<br>> modcall[authorize]: module "files" returns ok for request 0<br>>rlm_ldap: - authorize<br>>rlm_ldap: performing user authorization for boss<br>>radius_xlat: '(uid=boss)'<br>
>radius_xlat: 'ou=Users,o=Polarion'<br>>rlm_ldap: ldap_get_conn: Checking Id: 0<br>>rlm_ldap: ldap_get_conn: Got Id: 0<br>>rlm_ldap: attempting LDAP reconnection<br>>rlm_ldap: (re)connect to <a href="http://ldap.labs.polarion.com:389/" target="_blank">ldap.labs.polarion.com:389</a>, authentication 0<br>
>rlm_ldap: setting TLS CACert File to /etc/pki/CA/cacert.pem<br>>rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow<br>>rlm_ldap: bind as cn=radius,ou=Operators,o=Polarion/radius to<br>><a href="http://ldap.labs.polarion.com:389/" target="_blank">ldap.labs.polarion.com:389</a><br>
>rlm_ldap: waiting for bind result ...<br>>rlm_ldap: Bind was successful<br>>rlm_ldap: performing search in ou=Users,o=Polarion, with filter (uid=boss)<br>>rlm_ldap: checking if remote access for boss is allowed by dialupAccess<br>
>rlm_ldap: Added password xxx in check items<br>>rlm_ldap: Added password {CRYPT}DsKv3sgtnbJs. in check items<br>>rlm_ldap: looking for check items in directory...<br>>rlm_ldap: looking for reply items in directory...<br>
>rlm_ldap: user boss authorized to use remote access<br>>rlm_ldap: ldap_release_conn: Release Id: 0<br>> modcall[authorize]: module "ldap" returns ok for request 0<br>>modcall: leaving group authorize (returns updated) for request 0<br>
> rad_check_password: Found Auth-Type EAP<br>>auth: type "EAP"<br>> Processing the authenticate section of radiusd.conf<br>>modcall: entering group authenticate for request 0<br>> rlm_eap: EAP Identity<br>
> rlm_eap: processing type md5<br>>rlm_eap_md5: Issuing Challenge<br>> modcall[authenticate]: module "eap" returns handled for request 0<br>>modcall: leaving group authenticate (returns handled) for request 0<br>
>Sending Access-Challenge of id 133 to <a href="http://10.123.42.11/" target="_blank">10.123.42.11</a> port 3072<br>> Framed-IP-Address = <a href="http://255.255.255.254/" target="_blank">255.255.255.254</a><br>> Framed-MTU = 576<br>
> Service-Type = Framed-User<br>> EAP-Message = 0x010200160410c17d5cc4249e64748a3829d8b9ed0b0a<br>> Message-Authenticator = 0x00000000000000000000000000000000<br>> State = 0xebeac4a30b2b6a98c367497236ace6e6<br>
>Finished request 0<br>>Going to the next request<br>>--- Walking the entire request list ---<br>>Waking up in 6 seconds...<br>>rad_recv: Access-Request packet from host <a href="http://10.123.42.11:3072/" target="_blank">10.123.42.11:3072</a>, id=134,<br>
>length=174<br>> User-Name = "boss"<br>> NAS-IP-Address = <a href="http://10.123.42.11/" target="_blank">10.123.42.11</a><br>> NAS-Port = 0<br>> Called-Station-Id = "001cf05a2b71"<br>> Calling-Station-Id = "001b77392d05"<br>
> NAS-Identifier = "Realtek Access Point. 8181"<br>> NAS-Port-Type = Wireless-802.11<br>> Service-Type = Framed-User<br>> Connect-Info = "CONNECT 11Mbps 802.11b"<br>> EAP-Message = 0x020200060319<br>
> State = 0xebeac4a30b2b6a98c367497236ace6e6<br>> Message-Authenticator = 0x4b85c8e85bc77e7acec2836c717592e0<br>> Processing the authorize section of radiusd.conf<br>>modcall: entering group authorize for request 1<br>
> modcall[authorize]: module "preprocess" returns ok for request 1<br>> modcall[authorize]: module "chap" returns noop for request 1<br>> modcall[authorize]: module "mschap" returns noop for request 1<br>
> rlm_realm: No '@' in User-Name = "boss", looking up realm NULL<br>> rlm_realm: No such realm "NULL"<br>> modcall[authorize]: module "suffix" returns noop for request 1<br>
> rlm_eap: EAP packet type response id 2 length 6<br>> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation<br>> modcall[authorize]: module "eap" returns updated for request 1<br>> users: Matched entry DEFAULT at line 152<br>
> users: Matched entry DEFAULT at line 171<br>> modcall[authorize]: module "files" returns ok for request 1<br>>rlm_ldap: - authorize<br>>rlm_ldap: performing user authorization for boss<br>>radius_xlat: '(uid=boss)'<br>
>radius_xlat: 'ou=Users,o=Polarion'<br>>rlm_ldap: ldap_get_conn: Checking Id: 0<br>>rlm_ldap: ldap_get_conn: Got Id: 0<br>>rlm_ldap: performing search in ou=Users,o=Polarion, with filter (uid=boss)<br>
>rlm_ldap: checking if remote access for boss is allowed by dialupAccess<br>>rlm_ldap: Added password xxx in check items<br>>rlm_ldap: Added password {CRYPT}DsKv3sgtnbJs. in check items<br>>rlm_ldap: looking for check items in directory...<br>
>rlm_ldap: looking for reply items in directory...<br>>rlm_ldap: user boss authorized to use remote access<br>>rlm_ldap: ldap_release_conn: Release Id: 0<br>> modcall[authorize]: module "ldap" returns ok for request 1<br>
>modcall: leaving group authorize (returns updated) for request 1<br>> rad_check_password: Found Auth-Type EAP<br>>auth: type "EAP"<br>> Processing the authenticate section of radiusd.conf<br>>modcall: entering group authenticate for request 1<br>
> rlm_eap: Request found, released from the list<br>> rlm_eap: EAP NAK<br>> rlm_eap: EAP-NAK asked for EAP-Type/peap<br>> rlm_eap: processing type tls<br>> rlm_eap_tls: Initiate<br>> rlm_eap_tls: Start returned 1<br>
> modcall[authenticate]: module "eap" returns handled for request 1<br>>modcall: leaving group authenticate (returns handled) for request 1<br>>Sending Access-Challenge of id 134 to <a href="http://10.123.42.11/" target="_blank">10.123.42.11</a> port 3072<br>
> Framed-IP-Address = <a href="http://255.255.255.254/" target="_blank">255.255.255.254</a><br>> Framed-MTU = 576<br>> Service-Type = Framed-User<br>> EAP-Message = 0x010300061920<br>> Message-Authenticator = 0x00000000000000000000000000000000<br>
> State = 0x99b26000ca98d265024101e392f4e0f4<br>>Finished request 1<br>>Going to the next request<br>>Waking up in 6 seconds...<br>>rad_recv: Access-Request packet from host <a href="http://10.123.42.11:3072/" target="_blank">10.123.42.11:3072</a>, id=135,<br>
>length=283<br>> User-Name = "boss"<br>> NAS-IP-Address = <a href="http://10.123.42.11/" target="_blank">10.123.42.11</a><br>> NAS-Port = 0<br>> Called-Station-Id = "001cf05a2b71"<br>> Calling-Station-Id = "001b77392d05"<br>
> NAS-Identifier = "Realtek Access Point. 8181"<br>> NAS-Port-Type = Wireless-802.11<br>> Service-Type = Framed-User<br>> Connect-Info = "CONNECT 11Mbps 802.11b"<br>> EAP-Message =<br>>0x02030073198000000069160301006401000060030147fdfe009368704b239dc707c8df342badb9125a23c4386ec5642f4dde69cc30000018002f00350005000ac009c00ac013c01400320038001300040100001f000000090007000004626f7373000a00080006001700180019000b00020100<br>
> State = 0x99b26000ca98d265024101e392f4e0f4<br>> Message-Authenticator = 0xa32645b3a95d86f1aa2a2d2884436608<br>> Processing the authorize section of radiusd.conf<br>>modcall: entering group authorize for request 2<br>
> modcall[authorize]: module "preprocess" returns ok for request 2<br>> modcall[authorize]: module "chap" returns noop for request 2<br>> modcall[authorize]: module "mschap" returns noop for request 2<br>
> rlm_realm: No '@' in User-Name = "boss", looking up realm NULL<br>> rlm_realm: No such realm "NULL"<br>> modcall[authorize]: module "suffix" returns noop for request 2<br>
> rlm_eap: EAP packet type response id 3 length 115<br>> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation<br>> modcall[authorize]: module "eap" returns updated for request 2<br>> users: Matched entry DEFAULT at line 152<br>
> users: Matched entry DEFAULT at line 171<br>> modcall[authorize]: module "files" returns ok for request 2<br>>rlm_ldap: - authorize<br>>rlm_ldap: performing user authorization for boss<br>>radius_xlat: '(uid=boss)'<br>
>radius_xlat: 'ou=Users,o=Polarion'<br>>rlm_ldap: ldap_get_conn: Checking Id: 0<br>>rlm_ldap: ldap_get_conn: Got Id: 0<br>>rlm_ldap: performing search in ou=Users,o=Polarion, with filter (uid=boss)<br>
>rlm_ldap: checking if remote access for boss is allowed by dialupAccess<br>>rlm_ldap: Added password xxx in check items<br>>rlm_ldap: Added password {CRYPT}DsKv3sgtnbJs. in check items<br>>rlm_ldap: looking for check items in directory...<br>
>rlm_ldap: looking for reply items in directory...<br>>rlm_ldap: user boss authorized to use remote access<br>>rlm_ldap: ldap_release_conn: Release Id: 0<br>> modcall[authorize]: module "ldap" returns ok for request 2<br>
>modcall: leaving group authorize (returns updated) for request 2<br>> rad_check_password: Found Auth-Type EAP<br>>auth: type "EAP"<br>> Processing the authenticate section of radiusd.conf<br>>modcall: entering group authenticate for request 2<br>
> rlm_eap: Request found, released from the list<br>> rlm_eap: EAP/peap<br>> rlm_eap: processing type peap<br>> rlm_eap_peap: Authenticate<br>> rlm_eap_tls: processing TLS<br>>rlm_eap_tls: Length Included<br>
> eaptls_verify returned 11<br>> (other): before/accept initialization<br>> TLS_accept: before/accept initialization<br>> rlm_eap_tls: <<< TLS 1.0 Handshake [length 0064], ClientHello<br>> TLS_accept: SSLv3 read client hello A<br>
> rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello<br>> TLS_accept: SSLv3 write server hello A<br>> rlm_eap_tls: >>> TLS 1.0 Handshake [length 0658], Certificate<br>> TLS_accept: SSLv3 write certificate A<br>
> rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone<br>> TLS_accept: SSLv3 write server done A<br>> TLS_accept: SSLv3 flush data<br>> TLS_accept:error in SSLv3 read client certificate A<br>
>rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0)<br>>In SSL Handshake Phase<br>>In SSL Accept mode<br>> eaptls_process returned 13<br>> rlm_eap_peap: EAPTLS_HANDLED<br>> modcall[authenticate]: module "eap" returns handled for request 2<br>
>modcall: leaving group authenticate (returns handled) for request 2<br>>Sending Access-Challenge of id 135 to <a href="http://10.123.42.11/" target="_blank">10.123.42.11</a> port 3072<br>> Framed-IP-Address = <a href="http://255.255.255.254/" target="_blank">255.255.255.254</a><br>
> Framed-MTU = 576<br>> Service-Type = Framed-User<br>> EAP-Message =<br>>0x0104040a19c0000006b5160301004a02000046030147fdfe02b1a4ae5877abf205cc38701c976083493c62b1a28c018006ee7dd1b0201e218bf0d200f9af66934c627e7b0202f7ee6f6b7e55fced25e648bfb4a82016002f0016030106580b0006540006510003343082033030820299a003020102020103300d06092a864886f70d0101050500308190310b300906035504061302435a311730150603550408130e437a6563682052657075626c69633121301f060355040a1318506f6c6172696f6e20536f6674776172652c732e722e6f2e310b3009060355040b13024954311530130603550403130c446176696420486c6163696b3121301f0609<br>
> EAP-Message =<br>>0x2a864886f70d010901161261646d696e40706f6c6172696f6e2e636f6d301e170d3038303430313232313730325a170d3039303430313232313730325a3081ad310b300906035504061302435a311730150603550408130e437a6563682052657075626c6963310f300d0603550407130650726167756531223020060355040a1319506f6c6172696f6e20536f6674776172652c20732e722e6f2e310b3009060355040b13024954311e301c060355040313157378322e6c6162732e706f6c6172696f6e2e636f6d3123302106092a864886f70d010901161461646d696e40706f6c61646972696f6e2e636f6d30819f300d06092a864886f70d010101<br>
> EAP-Message =<br>>0x050003818d0030818902818100b8b50c7d4c6b38eb230e0ed4620584d7c1b7b01f0a4dd722f0e6b70cb1e3f766d20ed5ffd3980048dc1fb96c575b9fcdfc00370099b7f77177b8501ef803d8958a4bc0506b5d9d68b818b0ec691687f317033178a943d7d36bb8c8c0710e0ad5a62de862cd9fb8aba2cef590f95821d06470a4260b4e9d7d120bda632e46940f0203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e04160414c5aa4697905511d2be09acdb494f7b2d71f19daf301f0603551d23041830168014a175<br>
> EAP-Message =<br>>0xc012b7b04b01be5b898091f49e87c15edfc4300d06092a864886f70d0101050500038181005cb3b5a56589d4536935e04eadf4c4e254127edd73c49f6075a03e86c2e8273379b829cfeffcdcc8cd0124a401d306699a6968d09bd22cafd8eb1010f5bc1ce9c07c94bce99178b8602b0f64376e2da0577ad8b5ac6b17ac412830f44fabbb48456d6ff0275b7aa22db86eb3f03ee1ac31280fe2380ba922a3a4d5634e55ed82000317308203133082027ca003020102020100300d06092a864886f70d0101050500308190310b300906035504061302435a311730150603550408130e437a6563682052657075626c69633121301f060355040a1318506f<br>
> EAP-Message = 0x6c6172696f6e20536f6674776172652c732e722e6f2e<br>> Message-Authenticator = 0x00000000000000000000000000000000<br>> State = 0x314be08f865ca960862254a0e8bbc012<br>>Finished request 2<br>>Going to the next request<br>
>Waking up in 6 seconds...<br>>rad_recv: Access-Request packet from host <a href="http://10.123.42.11:3072/" target="_blank">10.123.42.11:3072</a>, id=136,<br>>length=174<br>> User-Name = "boss"<br>> NAS-IP-Address = <a href="http://10.123.42.11/" target="_blank">10.123.42.11</a><br>
> NAS-Port = 0<br>> Called-Station-Id = "001cf05a2b71"<br>> Calling-Station-Id = "001b77392d05"<br>> NAS-Identifier = "Realtek Access Point. 8181"<br>> NAS-Port-Type = Wireless-802.11<br>
> Service-Type = Framed-User<br>> Connect-Info = "CONNECT 11Mbps 802.11b"<br>> EAP-Message = 0x020400061900<br>> State = 0x314be08f865ca960862254a0e8bbc012<br>> Message-Authenticator = 0x4ffe78dc0c0ac5700556cdc34c9d2ee7<br>
> Processing the authorize section of radiusd.conf<br>>modcall: entering group authorize for request 3<br>> modcall[authorize]: module "preprocess" returns ok for request 3<br>> modcall[authorize]: module "chap" returns noop for request 3<br>
> modcall[authorize]: module "mschap" returns noop for request 3<br>> rlm_realm: No '@' in User-Name = "boss", looking up realm NULL<br>> rlm_realm: No such realm "NULL"<br>
> modcall[authorize]: module "suffix" returns noop for request 3<br>> rlm_eap: EAP packet type response id 4 length 6<br>> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation<br>> modcall[authorize]: module "eap" returns updated for request 3<br>
> users: Matched entry DEFAULT at line 152<br>> users: Matched entry DEFAULT at line 171<br>> modcall[authorize]: module "files" returns ok for request 3<br>>rlm_ldap: - authorize<br>>rlm_ldap: performing user authorization for boss<br>
>radius_xlat: '(uid=boss)'<br>>radius_xlat: 'ou=Users,o=Polarion'<br>>rlm_ldap: ldap_get_conn: Checking Id: 0<br>>rlm_ldap: ldap_get_conn: Got Id: 0<br>>rlm_ldap: performing search in ou=Users,o=Polarion, with filter (uid=boss)<br>
>rlm_ldap: checking if remote access for boss is allowed by dialupAccess<br>>rlm_ldap: Added password xxx in check items<br>>rlm_ldap: Added password {CRYPT}DsKv3sgtnbJs. in check items<br>>rlm_ldap: looking for check items in directory...<br>
>rlm_ldap: looking for reply items in directory...<br>>rlm_ldap: user boss authorized to use remote access<br>>rlm_ldap: ldap_release_conn: Release Id: 0<br>> modcall[authorize]: module "ldap" returns ok for request 3<br>
>modcall: leaving group authorize (returns updated) for request 3<br>> rad_check_password: Found Auth-Type EAP<br>>auth: type "EAP"<br>> Processing the authenticate section of radiusd.conf<br>>modcall: entering group authenticate for request 3<br>
> rlm_eap: Request found, released from the list<br>> rlm_eap: EAP/peap<br>> rlm_eap: processing type peap<br>> rlm_eap_peap: Authenticate<br>> rlm_eap_tls: processing TLS<br>>rlm_eap_tls: Received EAP-TLS ACK message<br>
> rlm_eap_tls: ack handshake fragment handler<br>> eaptls_verify returned 1<br>> eaptls_process returned 13<br>> rlm_eap_peap: EAPTLS_HANDLED<br>> modcall[authenticate]: module "eap" returns handled for request 3<br>
>modcall: leaving group authenticate (returns handled) for request 3<br>>Sending Access-Challenge of id 136 to <a href="http://10.123.42.11/" target="_blank">10.123.42.11</a> port 3072<br>> Framed-IP-Address = <a href="http://255.255.255.254/" target="_blank">255.255.255.254</a><br>
> Framed-MTU = 576<br>> Service-Type = Framed-User<br>> EAP-Message =<br>>0x010502bb1900310b3009060355040b13024954311530130603550403130c446176696420486c6163696b3121301f06092a864886f70d010901161261646d696e40706f6c6172696f6e2e636f6d301e170d3038303430313139323932385a170d3131303430313139323932385a308190310b300906035504061302435a311730150603550408130e437a6563682052657075626c69633121301f060355040a1318506f6c6172696f6e20536f6674776172652c732e722e6f2e310b3009060355040b13024954311530130603550403130c446176696420486c6163696b3121301f06092a864886f70d010901161261646d696e40706f6c6172696f6e2e<br>
> EAP-Message =<br>>0x636f6d30819f300d06092a864886f70d010101050003818d0030818902818100aadaaf37b6a0a71c376ba2add87d864494b8037dac4723436fcd4b018f325d5af3e0dbce665910bbc073ffc41289ace34a2cf56b2faf58765f2237b5e79ea13a211422347c56bcbd72e35dedb3d6c253892ceb778dc9a2d49c3481523b05f052880868f52dc43f639a8b3982169b3664b995728bcbaf2201bf37d33b49a82e310203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e04160414a175c012b7b04b01be5b898091f49e87<br>
> EAP-Message =<br>>0xc15edfc4301f0603551d23041830168014a175c012b7b04b01be5b898091f49e87c15edfc4300d06092a864886f70d01010505000381810004b58fbb98da552f9efe00e64e8ff994d9275915d868ab1dab94f8b05c6add140d9f12afc64430de6e4ea7702b20c93f9e897a44f1774092df6b2603faab1913b5b3c24ca89f63163ee9fdc4beff67d9f976c3ecf83ce30c4eedfb731eaffeb0fabf4e03cbdf122af3cb45f4f8365cfe842e236186d97a35c64cf8043678708c16030100040e000000<br>
> Message-Authenticator = 0x00000000000000000000000000000000<br>> State = 0x92b1436e5f136b0fcaee0bc38a032734<br>>Finished request 3<br>>Going to the next request<br>>Waking up in 6 seconds...<br>>rad_recv: Access-Request packet from host <a href="http://10.123.42.11:3072/" target="_blank">10.123.42.11:3072</a>, id=137,<br>
>length=174<br>> User-Name = "boss"<br>> NAS-IP-Address = <a href="http://10.123.42.11/" target="_blank">10.123.42.11</a><br>> NAS-Port = 0<br>> Called-Station-Id = "001cf05a2b71"<br>> Calling-Station-Id = "001b77392d05"<br>
> NAS-Identifier = "Realtek Access Point. 8181"<br>> NAS-Port-Type = Wireless-802.11<br>> Service-Type = Framed-User<br>> Connect-Info = "CONNECT 11Mbps 802.11b"<br>> EAP-Message = 0x020500061900<br>
> State = 0x92b1436e5f136b0fcaee0bc38a032734<br>> Message-Authenticator = 0x0530f7f118530a0c8eae3d63bab94be9<br>> Processing the authorize section of radiusd.conf<br>>modcall: entering group authorize for request 4<br>
> modcall[authorize]: module "preprocess" returns ok for request 4<br>> modcall[authorize]: module "chap" returns noop for request 4<br>> modcall[authorize]: module "mschap" returns noop for request 4<br>
> rlm_realm: No '@' in User-Name = "boss", looking up realm NULL<br>> rlm_realm: No such realm "NULL"<br>> modcall[authorize]: module "suffix" returns noop for request 4<br>
> rlm_eap: EAP packet type response id 5 length 6<br>> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation<br>> modcall[authorize]: module "eap" returns updated for request 4<br>> users: Matched entry DEFAULT at line 152<br>
> users: Matched entry DEFAULT at line 171<br>> modcall[authorize]: module "files" returns ok for request 4<br>>rlm_ldap: - authorize<br>>rlm_ldap: performing user authorization for boss<br>>radius_xlat: '(uid=boss)'<br>
>radius_xlat: 'ou=Users,o=Polarion'<br>>rlm_ldap: ldap_get_conn: Checking Id: 0<br>>rlm_ldap: ldap_get_conn: Got Id: 0<br>>rlm_ldap: performing search in ou=Users,o=Polarion, with filter (uid=boss)<br>
>rlm_ldap: checking if remote access for boss is allowed by dialupAccess<br>>rlm_ldap: Added password xxx in check items<br>>rlm_ldap: Added password {CRYPT}DsKv3sgtnbJs. in check items<br>>rlm_ldap: looking for check items in directory...<br>
>rlm_ldap: looking for reply items in directory...<br>>rlm_ldap: user boss authorized to use remote access<br>>rlm_ldap: ldap_release_conn: Release Id: 0<br>> modcall[authorize]: module "ldap" returns ok for request 4<br>
>modcall: leaving group authorize (returns updated) for request 4<br>> rad_check_password: Found Auth-Type EAP<br>>auth: type "EAP"<br>> Processing the authenticate section of radiusd.conf<br>>modcall: entering group authenticate for request 4<br>
> rlm_eap: Request found, released from the list<br>> rlm_eap: EAP/peap<br>> rlm_eap: processing type peap<br>> rlm_eap_peap: Authenticate<br>> rlm_eap_tls: processing TLS<br>>rlm_eap_tls: Received EAP-TLS ACK message<br>
> rlm_eap_tls: ack handshake fragment handler<br>> eaptls_verify returned 1<br>> eaptls_process returned 13<br>> rlm_eap_peap: EAPTLS_HANDLED<br>> modcall[authenticate]: module "eap" returns handled for request 4<br>
>modcall: leaving group authenticate (returns handled) for request 4<br>>Sending Access-Challenge of id 137 to <a href="http://10.123.42.11/" target="_blank">10.123.42.11</a> port 3072<br>> Framed-IP-Address = <a href="http://255.255.255.254/" target="_blank">255.255.255.254</a><br>
> Framed-MTU = 576<br>> Service-Type = Framed-User<br>> EAP-Message = 0x010600061900<br>> Message-Authenticator = 0x00000000000000000000000000000000<br>> State = 0xd79ee44aa26729aa589e2e46d1dc189b<br>>Finished request 4<br>
>Going to the next request<br>>Waking up in 6 seconds...<br>>--- Walking the entire request list ---<br>>Cleaning up request 0 ID 133 with timestamp 47fdfe02<br>>Cleaning up request 1 ID 134 with timestamp 47fdfe02<br>
>Cleaning up request 2 ID 135 with timestamp 47fdfe02<br>>Cleaning up request 3 ID 136 with timestamp 47fdfe02<br>>Cleaning up request 4 ID 137 with timestamp 47fdfe02<br>>Nothing to do. Sleeping until we see a request.<br>
><br>>2008/3/30 Ivan Kalik <<a href="mailto:tnt@kalik.net" target="_blank">tnt@kalik.net</a>>:<br>><br>>> Since Win XP is what most people have, you probably want to use PEAP.<br>>> That forms a TLS outer tunnel and then does EAP-MSCHAPv2 in the inner<br>
>> tunnel. Since you already have mschap (and ldap) working, there is very<br>>> little to do. If you have 1.1.x you need to create certificates and<br>>> configure tls and peap sections in eap.conf. With 2.0.x you probably<br>
>> don't need to do anything at all - it will "just work".<br>>><br>>> Ivan Kalik<br>>> Kalik Informatika ISP<br>>><br>>><br>>> Dana 30/3/2008, "David Hláčik" <david@hlacik.eu> piše:<br>
>><br>>> >Hi i have freeradius mschap ldap working configuration - i am using it<br>>> for<br>>> >pptpd (VPN server) to authentificate against freeradius with ldap .<br>>> >Windows VPN client can connect to our company network and use it.<br>
>> ><br>>> >Next i want to add user/password auth to our WIFI (based on Dlink AP -<br>>> with<br>>> >radius support). We are currently using wpa-preshared key. i want to use<br>>> wpa<br>
>> >enterprise with ldap authentification (providing username and password)<br>>> >without need to install any certificate on windows.<br>>> ><br>>> >First to make a clear - how do i achieve it? --- i mean exactly which<br>
>> >protocol i need to use and how it works (some shortcut to such howto)<br>>> ><br>>> >How do i arrange to use same freeradius for currently working VPN and for<br>>> my<br>>> >plan to make wpa enterprise.<br>
>> ><br>>> >Thanks in advance!<br>>> ><br>>> >David<br>>> ><br>>> ><br>>><br>>> -<br>>> List info/subscribe/unsubscribe? See<br>>> <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
>><br>><br><br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></div></div></blockquote></div></div></div>
<br></blockquote></div><br>