<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2658.34">
<TITLE>Re: HOWTO PEAP + FreeRadius + XP Client</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>Hi. George KNIGHT</FONT>
</P>
<P><FONT SIZE=2>Here there are many people's experts.</FONT>
</P>
<P><FONT SIZE=2>I have an infrastructure as yours</FONT>
</P>
<P><FONT SIZE=2>EAP, PEAP, WinCE with HANDHELD, WIN XP, WIN VISTA and Cisco.</FONT>
</P>
<P><FONT SIZE=2>It's working very good in a two CentOS Servers, 1 master and 1 backup for redundancy.</FONT>
</P>
<P><FONT SIZE=2>Alan Dekok sends you instructions but don't worry, if you have any questions and I can help you, I do it.</FONT>
</P>
<P><FONT SIZE=2>Saludos!</FONT>
</P>
<P><FONT SIZE=2>-----Mensaje original-----</FONT>
<BR><FONT SIZE=2>De: freeradius-users-bounces+gchavelas=bfmx.com.mx@lists.freeradius.org [<A HREF="mailto:freeradius-users-bounces+gchavelas=bfmx.com.mx@lists.freeradius.org">mailto:freeradius-users-bounces+gchavelas=bfmx.com.mx@lists.freeradius.org</A>] En nombre de freeradius-users-request@lists.freeradius.org</FONT></P>
<P><FONT SIZE=2>Enviado el: Martes, 29 de Abril de 2008 02:08 p.m.</FONT>
<BR><FONT SIZE=2>Para: freeradius-users@lists.freeradius.org</FONT>
<BR><FONT SIZE=2>Asunto: Freeradius-Users Digest, Vol 36, Issue 173</FONT>
</P>
<P><FONT SIZE=2>Send Freeradius-Users mailing list submissions to</FONT>
<BR> <FONT SIZE=2>freeradius-users@lists.freeradius.org</FONT>
</P>
<P><FONT SIZE=2>To subscribe or unsubscribe via the World Wide Web, visit</FONT>
<BR> <FONT SIZE=2><A HREF="http://lists.freeradius.org/mailman/listinfo/freeradius-users" TARGET="_blank">http://lists.freeradius.org/mailman/listinfo/freeradius-users</A></FONT>
<BR><FONT SIZE=2>or, via email, send a message with subject or body 'help' to</FONT>
<BR> <FONT SIZE=2>freeradius-users-request@lists.freeradius.org</FONT>
</P>
<P><FONT SIZE=2>You can reach the person managing the list at</FONT>
<BR> <FONT SIZE=2>freeradius-users-owner@lists.freeradius.org</FONT>
</P>
<P><FONT SIZE=2>When replying, please edit your Subject line so it is more specific</FONT>
<BR><FONT SIZE=2>than "Re: Contents of Freeradius-Users digest..."</FONT>
</P>
<BR>
<P><FONT SIZE=2>Today's Topics:</FONT>
</P>
<P><FONT SIZE=2> 1. Re: can peap and ttls live together? (Sergio Belkin)</FONT>
<BR><FONT SIZE=2> 2. dot1x specification EAPOL-Logoff clarification</FONT>
<BR><FONT SIZE=2> (Arran Cudbard-Bell)</FONT>
<BR><FONT SIZE=2> 3. Re: dot1x specification EAPOL-Logoff clarification</FONT>
<BR><FONT SIZE=2> (Arran Cudbard-Bell)</FONT>
<BR><FONT SIZE=2> 4. HOWTO PEAP + FreeRadius + XP Client (George KNIGHT)</FONT>
<BR><FONT SIZE=2> 5. Re: HOWTO PEAP + FreeRadius + XP Client (Michael Schwartzkopff)</FONT>
<BR><FONT SIZE=2> 6. Re: SPAM-LOW: Re: EAP/TLS connection problem.. (Alan DeKok)</FONT>
<BR><FONT SIZE=2> 7. Re: HOWTO PEAP + FreeRadius + XP Client (Alan DeKok)</FONT>
</P>
<BR>
<P><FONT SIZE=2>----------------------------------------------------------------------</FONT>
</P>
<P><FONT SIZE=2>Message: 1</FONT>
<BR><FONT SIZE=2>Date: Tue, 29 Apr 2008 12:56:38 -0300</FONT>
<BR><FONT SIZE=2>From: "Sergio Belkin" <sebelk@gmail.com></FONT>
<BR><FONT SIZE=2>Subject: Re: can peap and ttls live together?</FONT>
<BR><FONT SIZE=2>To: "FreeRadius users mailing list"</FONT>
<BR> <FONT SIZE=2><freeradius-users@lists.freeradius.org></FONT>
<BR><FONT SIZE=2>Message-ID:</FONT>
<BR> <FONT SIZE=2><8c6f7f450804290856oce00b42h557aba09dfb7ee22@mail.gmail.com></FONT>
<BR><FONT SIZE=2>Content-Type: text/plain; charset=ISO-8859-2</FONT>
</P>
<P><FONT SIZE=2>2008/4/29 Ivan Kalik <tnt@kalik.net>:</FONT>
<BR><FONT SIZE=2>> That probably won't work in 2.0. Mapping to Cleartext-Password will.</FONT>
</P>
<P><FONT SIZE=2>I am using 2.0.2 :)</FONT>
</P>
<P><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> Ivan Kalik</FONT>
<BR><FONT SIZE=2>> Kalik Informatika ISP</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> Dana 29/4/2008, "Sergio Belkin" <sebelk@gmail.com> pi?e:</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> >2008/4/29 Ivan Kalik <tnt@kalik.net>:</FONT>
<BR><FONT SIZE=2>> >> You need to add the entry for Cleartext-Password. Something like:</FONT>
<BR><FONT SIZE=2>> >></FONT>
<BR><FONT SIZE=2>> >> checkItem Cleartext-Password clrtxtPassword</FONT>
<BR><FONT SIZE=2>> >></FONT>
<BR><FONT SIZE=2>> >></FONT>
<BR><FONT SIZE=2>> >> Ivan Kalik</FONT>
<BR><FONT SIZE=2>> >> Kalik Informatika ISP</FONT>
<BR><FONT SIZE=2>> >></FONT>
<BR><FONT SIZE=2>> >></FONT>
<BR><FONT SIZE=2>> >></FONT>
<BR><FONT SIZE=2>> >></FONT>
<BR><FONT SIZE=2>> >Hmmmm. I advanced and before of reading your answer I added:</FONT>
<BR><FONT SIZE=2>> ></FONT>
<BR><FONT SIZE=2>> >checkItem User-Password userPassword</FONT>
<BR><FONT SIZE=2>> ></FONT>
<BR><FONT SIZE=2>> >replyItem Tunnel-Type radiusTunnelType</FONT>
<BR><FONT SIZE=2>> >replyItem Tunnel-Medium-Type radiusTunnelMediumType</FONT>
<BR><FONT SIZE=2>> >replyItem Tunnel-Private-Group-Id radiusTunnelPrivateGroupId</FONT>
<BR><FONT SIZE=2>> ></FONT>
<BR><FONT SIZE=2>> >end of snip</FONT>
<BR><FONT SIZE=2>> ></FONT>
<BR><FONT SIZE=2>> >It worked! Anywat Is that right?</FONT>
<BR><FONT SIZE=2>> ></FONT>
<BR><FONT SIZE=2>> >--</FONT>
<BR><FONT SIZE=2>> >--</FONT>
<BR><FONT SIZE=2>> >Open Kairos <A HREF="http://www.openkairos.com" TARGET="_blank">http://www.openkairos.com</A></FONT>
<BR><FONT SIZE=2>> >Watch More TV <A HREF="http://sebelk.blogspot.com" TARGET="_blank">http://sebelk.blogspot.com</A></FONT>
<BR><FONT SIZE=2>> >Sergio Belkin -</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> >-</FONT>
<BR><FONT SIZE=2>> >List info/subscribe/unsubscribe? See <A HREF="http://www.freeradius.org/list/users.html" TARGET="_blank">http://www.freeradius.org/list/users.html</A></FONT>
<BR><FONT SIZE=2>> ></FONT>
<BR><FONT SIZE=2>> ></FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> -</FONT>
<BR><FONT SIZE=2>> List info/subscribe/unsubscribe? See <A HREF="http://www.freeradius.org/list/users.html" TARGET="_blank">http://www.freeradius.org/list/users.html</A></FONT>
<BR><FONT SIZE=2>></FONT>
</P>
<BR>
<BR>
<P><FONT SIZE=2>-- </FONT>
<BR><FONT SIZE=2>--</FONT>
<BR><FONT SIZE=2>Open Kairos <A HREF="http://www.openkairos.com" TARGET="_blank">http://www.openkairos.com</A></FONT>
<BR><FONT SIZE=2>Watch More TV <A HREF="http://sebelk.blogspot.com" TARGET="_blank">http://sebelk.blogspot.com</A></FONT>
<BR><FONT SIZE=2>Sergio Belkin -</FONT>
</P>
<BR>
<BR>
<P><FONT SIZE=2>------------------------------</FONT>
</P>
<P><FONT SIZE=2>Message: 2</FONT>
<BR><FONT SIZE=2>Date: Tue, 29 Apr 2008 17:33:06 +0100</FONT>
<BR><FONT SIZE=2>From: Arran Cudbard-Bell <A.Cudbard-Bell@sussex.ac.uk></FONT>
<BR><FONT SIZE=2>Subject: dot1x specification EAPOL-Logoff clarification</FONT>
<BR><FONT SIZE=2>To: FreeRadius users mailing list</FONT>
<BR> <FONT SIZE=2><freeradius-users@lists.freeradius.org></FONT>
<BR><FONT SIZE=2>Message-ID: <48174DC2.3060205@sussex.ac.uk></FONT>
<BR><FONT SIZE=2>Content-Type: text/plain; charset=ISO-8859-1; format=flowed</FONT>
</P>
<P><FONT SIZE=2>Hi,</FONT>
</P>
<P><FONT SIZE=2>Having some interesting issues with a HP ProCurve 2510 an Apple Mac </FONT>
<BR><FONT SIZE=2>Power Book running OSX 10.5.2, and MAC-Auth + EAP-Auth on the same wired </FONT>
<BR><FONT SIZE=2>port.</FONT>
</P>
<P><FONT SIZE=2>I know this isn't strictly the list for this as this isn't really </FONT>
<BR><FONT SIZE=2>RADIUS, but i'm not sure where to post...</FONT>
</P>
<P><FONT SIZE=2>Two questions:</FONT>
</P>
<P><FONT SIZE=2> IEE802.1x-2004</FONT>
<BR><FONT SIZE=2> 8.1.3 EAPOL-Logoff</FONT>
<BR><FONT SIZE=2> When a Supplicant wishes the Authenticator PAE to perform a </FONT>
<BR><FONT SIZE=2>logoff (i.e., to set the controlled Port state to</FONT>
<BR><FONT SIZE=2> unauthorized), the Supplicant PAE originates an EAPOL-Logoff </FONT>
<BR><FONT SIZE=2>message (see 7.5.4) to the Authenticator</FONT>
<BR><FONT SIZE=2> PAE. As a result, the Authenticator PAE immediately places the </FONT>
<BR><FONT SIZE=2>controlled Port in the unauthorized state</FONT>
</P>
<P><FONT SIZE=2>1) It appears in the spec that there is no requirement or indeed method </FONT>
<BR><FONT SIZE=2>of the Supplicant PAE of confirming that the EAPOL-Logoff has been </FONT>
<BR><FONT SIZE=2>honoured. So the supplicant PAE could be in the unauthorised state while </FONT>
<BR><FONT SIZE=2>the Authenticator could be in the authorised state. Is this an over site </FONT>
<BR><FONT SIZE=2>of the dot1x spec, or is this meant to be handled at a higher level with </FONT>
<BR><FONT SIZE=2>EAP ?</FONT>
</P>
<P><FONT SIZE=2>---</FONT>
</P>
<P><FONT SIZE=2>2) On the termination of an EAP session, VLAN membership is usually </FONT>
<BR><FONT SIZE=2>altered, either to a MAC-Authorised VID a default unauthorised VID, or </FONT>
<BR><FONT SIZE=2>the port is blocked. Windows clients are pretty crap in terms of DHCP </FONT>
<BR><FONT SIZE=2>when this happens, and fail to renew their leases when moving between </FONT>
<BR><FONT SIZE=2>authorised and unauthorised states. Apple Mac clients however are very </FONT>
<BR><FONT SIZE=2>good in terms of DHCP dot1x integration. Unfortunately with EAP-Based </FONT>
<BR><FONT SIZE=2>and MAC-Based authentication transistions, DHCP renewal doesn't appear </FONT>
<BR><FONT SIZE=2>to work. This is what i've seen from the traces:</FONT>
</P>
<P><FONT SIZE=2>FRAME 6436 - TS 212.482482 - Assumed VLAN 603 - Actual VLAN 603 - EAPOL </FONT>
<BR><FONT SIZE=2>Logoff</FONT>
<BR><FONT SIZE=2>FRAME 6440 - TS 212.484947 - Assumed VLAN Blocked (transistion) - Actual </FONT>
<BR><FONT SIZE=2>VLAN 603 - DHCP REQUEST</FONT>
<BR><FONT SIZE=2>FRAME 6443 - TS 212.487252 - Assumed VLAN Blocked (transistion) - Actual </FONT>
<BR><FONT SIZE=2>VLAN 603 - DHCP ACK (Answered by server on 603)</FONT>
<BR><FONT SIZE=2>FRAME 6454 - TS 212.529774 - Assumed VLAN 134 - Actual VLAN 134 - EAP </FONT>
<BR><FONT SIZE=2>Failure (Seems to denotate MAC Authentication succeeding)</FONT>
</P>
<P><FONT SIZE=2>So it appears after the supplicant sends the EAPOL-Logoff, the DHCP client attempts to get a lease very quickly; so quickly in fact that the switch hasn't altered the state of the port. The result being that the DHCP request is acked by the DHCP server on the dot1x authorised VLAN, the VLAN transistion *then* occurs, but as the DHCP client has satisfied itself that it has a valid lease for the PAE unauthorised state it doesn't renew the lease until it expires...</FONT></P>
<P><FONT SIZE=2>Should I be shouting at HP to get their switches to register the state change faster, or shouting at Apple to make their DHCP timings less agressive ?</FONT></P>
<P><FONT SIZE=2>Many Thanks,</FONT>
<BR><FONT SIZE=2>Arran</FONT>
</P>
<P><FONT SIZE=2>-- </FONT>
<BR><FONT SIZE=2>Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk)</FONT>
<BR><FONT SIZE=2>Authentication, Authorisation and Accounting Officer</FONT>
<BR><FONT SIZE=2>Infrastructure Services | ENG1 E1-1-08 </FONT>
<BR><FONT SIZE=2>University Of Sussex, Brighton</FONT>
<BR><FONT SIZE=2>EXT:01273 873900 | INT: 3900</FONT>
</P>
<BR>
<BR>
<P><FONT SIZE=2>------------------------------</FONT>
</P>
<P><FONT SIZE=2>Message: 3</FONT>
<BR><FONT SIZE=2>Date: Tue, 29 Apr 2008 17:50:14 +0100</FONT>
<BR><FONT SIZE=2>From: Arran Cudbard-Bell <A.Cudbard-Bell@sussex.ac.uk></FONT>
<BR><FONT SIZE=2>Subject: Re: dot1x specification EAPOL-Logoff clarification</FONT>
<BR><FONT SIZE=2>To: FreeRadius users mailing list</FONT>
<BR> <FONT SIZE=2><freeradius-users@lists.freeradius.org></FONT>
<BR><FONT SIZE=2>Message-ID: <481751C6.7050301@sussex.ac.uk></FONT>
<BR><FONT SIZE=2>Content-Type: text/plain; charset=ISO-8859-1; format=flowed</FONT>
</P>
<P><FONT SIZE=2>Arran Cudbard-Bell wrote:</FONT>
<BR><FONT SIZE=2>> Hi,</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> Having some interesting issues with a HP ProCurve 2510 an Apple Mac </FONT>
<BR><FONT SIZE=2>> Power Book running OSX 10.5.2, and MAC-Auth + EAP-Auth on the same </FONT>
<BR><FONT SIZE=2>> wired port.</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> I know this isn't strictly the list for this as this isn't really </FONT>
<BR><FONT SIZE=2>> RADIUS, but i'm not sure where to post...</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> Two questions:</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> IEE802.1x-2004</FONT>
<BR><FONT SIZE=2>> 8.1.3 EAPOL-Logoff</FONT>
<BR><FONT SIZE=2>> When a Supplicant wishes the Authenticator PAE to perform a </FONT>
<BR><FONT SIZE=2>> logoff (i.e., to set the controlled Port state to</FONT>
<BR><FONT SIZE=2>> unauthorized), the Supplicant PAE originates an EAPOL-Logoff </FONT>
<BR><FONT SIZE=2>> message (see 7.5.4) to the Authenticator</FONT>
<BR><FONT SIZE=2>> PAE. As a result, the Authenticator PAE immediately places the </FONT>
<BR><FONT SIZE=2>> controlled Port in the unauthorized state</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> 1) It appears in the spec that there is no requirement or indeed </FONT>
<BR><FONT SIZE=2>> method of the Supplicant PAE of confirming that the EAPOL-Logoff has </FONT>
<BR><FONT SIZE=2>> been honoured. So the supplicant PAE could be in the unauthorised </FONT>
<BR><FONT SIZE=2>> state while the Authenticator could be in the authorised state. Is </FONT>
<BR><FONT SIZE=2>> this an over site of the dot1x spec, or is this meant to be handled at </FONT>
<BR><FONT SIZE=2>> a higher level with EAP ?</FONT>
<BR><FONT SIZE=2>Sorry. Looking at the diagrams in 8-5 it appears my suspicion is </FONT>
<BR><FONT SIZE=2>correct. Unless a re-auth timer is implemented by the Authenticator PAE, </FONT>
<BR><FONT SIZE=2>this mismatched authentication state could persist indefinitely.</FONT>
</P>
<P><FONT SIZE=2>The EAPOL-LOGOFF frame is *not* retransmitted to the Authentication </FONT>
<BR><FONT SIZE=2>server... and the Authenticator PAE does not respond to EAPOL-LOGOFF </FONT>
<BR><FONT SIZE=2>frames, it just alters it's state. So if the EAPOL-LOGOFF frame was lost </FONT>
<BR><FONT SIZE=2>in transit... damn, why no EAPOL-LOGOFF-CONFIRMATION packet ... In every </FONT>
<BR><FONT SIZE=2>other part of the EAP/dot1x spec a request *should* always be answered </FONT>
<BR><FONT SIZE=2>by a response... but not here... are these guys idiots, or am I being </FONT>
<BR><FONT SIZE=2>dense ?!</FONT>
</P>
<P><FONT SIZE=2>See this would solve the issue in question 2 perfectly.</FONT>
</P>
<BR>
<P><FONT SIZE=2>-- </FONT>
<BR><FONT SIZE=2>Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk)</FONT>
<BR><FONT SIZE=2>Authentication, Authorisation and Accounting Officer</FONT>
<BR><FONT SIZE=2>Infrastructure Services | ENG1 E1-1-08 </FONT>
<BR><FONT SIZE=2>University Of Sussex, Brighton</FONT>
<BR><FONT SIZE=2>EXT:01273 873900 | INT: 3900</FONT>
</P>
<BR>
<BR>
<P><FONT SIZE=2>------------------------------</FONT>
</P>
<P><FONT SIZE=2>Message: 4</FONT>
<BR><FONT SIZE=2>Date: Tue, 29 Apr 2008 14:14:16 -0400</FONT>
<BR><FONT SIZE=2>From: "George KNIGHT" <georgeknight@gmail.com></FONT>
<BR><FONT SIZE=2>Subject: HOWTO PEAP + FreeRadius + XP Client</FONT>
<BR><FONT SIZE=2>To: freeradius-users@lists.freeradius.org</FONT>
<BR><FONT SIZE=2>Message-ID:</FONT>
<BR> <FONT SIZE=2><d6da8e1d0804291114g56d9d9bfr2f58e923357e093e@mail.gmail.com></FONT>
<BR><FONT SIZE=2>Content-Type: text/plain; charset="iso-8859-1"</FONT>
</P>
<P><FONT SIZE=2>Hello everyone,</FONT>
<BR><FONT SIZE=2>Before I write my question here, I just want to let all of you know that I</FONT>
<BR><FONT SIZE=2>did lots of searching in both google and this email list. But couldn't find</FONT>
<BR><FONT SIZE=2>anything to get the answer.</FONT>
</P>
<P><FONT SIZE=2>My question is I have been looking for a HOWTO paper for a beginner to set</FONT>
<BR><FONT SIZE=2>freeradius as an AAA server in a wireless environment to Windows XP SP2</FONT>
<BR><FONT SIZE=2>clients. I will use Windows' own PEAP client. Is there such a paper someone</FONT>
<BR><FONT SIZE=2>can give me the link?</FONT>
</P>
<P><FONT SIZE=2>I'm very frustrated to find out that there is no information available for a</FONT>
<BR><FONT SIZE=2>setup from the scratch. I wrote papers like that before for various topics</FONT>
<BR><FONT SIZE=2>such as subversion implementation for a multiple OS environment, VoIP</FONT>
<BR><FONT SIZE=2>implementation with a Linux based open sources S/W etc. I have intention to</FONT>
<BR><FONT SIZE=2>write such a paper for how to set up PEAP implementation with freeradius as</FONT>
<BR><FONT SIZE=2>well. But for that, I'm hoping someone can give me a good start.</FONT>
</P>
<P><FONT SIZE=2>OK, here is my network settings and needed information;</FONT>
</P>
<P><FONT SIZE=2>I have a SUSE SLES 10 server to be used as an AAA server. This server is</FONT>
<BR><FONT SIZE=2>called store-AAA and also acts as a DHCP server for the clients. I have a</FONT>
<BR><FONT SIZE=2>few of Cisco 1242 AP as an authenticator.</FONT>
<BR><FONT SIZE=2>Clients are going to be computers with WinCE as their OS and they will</FONT>
<BR><FONT SIZE=2>contact to the LAN wirelessly. What I want to achieve is authenticating this</FONT>
<BR><FONT SIZE=2>clients with server-AAA using PEAP before letting them use the other network</FONT>
<BR><FONT SIZE=2>resources.</FONT>
</P>
<P><FONT SIZE=2>Thank you in advance for your time and effort.</FONT>
</P>
<P><FONT SIZE=2>George Knight</FONT>
<BR><FONT SIZE=2>-------------- next part --------------</FONT>
<BR><FONT SIZE=2>An HTML attachment was scrubbed...</FONT>
<BR><FONT SIZE=2>URL: <<A HREF="https://lists.freeradius.org/pipermail/freeradius-users/attachments/20080429/ab4e6bcc/attachment-0001.html" TARGET="_blank">https://lists.freeradius.org/pipermail/freeradius-users/attachments/20080429/ab4e6bcc/attachment-0001.html</A>></FONT>
</P>
<P><FONT SIZE=2>------------------------------</FONT>
</P>
<P><FONT SIZE=2>Message: 5</FONT>
<BR><FONT SIZE=2>Date: Tue, 29 Apr 2008 20:28:44 +0200</FONT>
<BR><FONT SIZE=2>From: Michael Schwartzkopff <misch@multinet.de></FONT>
<BR><FONT SIZE=2>Subject: Re: HOWTO PEAP + FreeRadius + XP Client</FONT>
<BR><FONT SIZE=2>To: FreeRadius users mailing list</FONT>
<BR> <FONT SIZE=2><freeradius-users@lists.freeradius.org></FONT>
<BR><FONT SIZE=2>Message-ID: <481768DC.5080808@multinet.de></FONT>
<BR><FONT SIZE=2>Content-Type: text/plain; charset=ISO-8859-1</FONT>
</P>
<P><FONT SIZE=2>George KNIGHT schrieb:</FONT>
<BR><FONT SIZE=2>> Hello everyone,</FONT>
<BR><FONT SIZE=2>> Before I write my question here, I just want to let all of you know that I</FONT>
<BR><FONT SIZE=2>> did lots of searching in both google and this email list. But couldn't find</FONT>
<BR><FONT SIZE=2>> anything to get the answer.</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> My question is I have been looking for a HOWTO paper for a beginner to set</FONT>
<BR><FONT SIZE=2>> freeradius as an AAA server in a wireless environment to Windows XP SP2</FONT>
<BR><FONT SIZE=2>> clients. I will use Windows' own PEAP client. Is there such a paper someone</FONT>
<BR><FONT SIZE=2>> can give me the link?</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> I'm very frustrated to find out that there is no information available for a</FONT>
<BR><FONT SIZE=2>> setup from the scratch. I wrote papers like that before for various topics</FONT>
<BR><FONT SIZE=2>> such as subversion implementation for a multiple OS environment, VoIP</FONT>
<BR><FONT SIZE=2>> implementation with a Linux based open sources S/W etc. I have intention to</FONT>
<BR><FONT SIZE=2>> write such a paper for how to set up PEAP implementation with freeradius as</FONT>
<BR><FONT SIZE=2>> well. But for that, I'm hoping someone can give me a good start.</FONT>
</P>
<P><FONT SIZE=2>For everyone who can create good google expressions:</FONT>
</P>
<P><FONT SIZE=2><A HREF="http://www.wi-fiplanet.com/tutorials/article.php/3557251" TARGET="_blank">http://www.wi-fiplanet.com/tutorials/article.php/3557251</A></FONT>
<BR><FONT SIZE=2><A HREF="http://www.linuxjournal.com/article/8095" TARGET="_blank">http://www.linuxjournal.com/article/8095</A></FONT>
<BR><FONT SIZE=2><A HREF="http://www.rinta-aho.org/docs/wlan/wlan.html" TARGET="_blank">http://www.rinta-aho.org/docs/wlan/wlan.html</A></FONT>
<BR><FONT SIZE=2><A HREF="http://ubuntuforums.org/showthread.php?t=478804" TARGET="_blank">http://ubuntuforums.org/showthread.php?t=478804</A></FONT>
<BR><FONT SIZE=2><A HREF="http://tldp.org/HOWTO/8021X-HOWTO/freeradius.html" TARGET="_blank">http://tldp.org/HOWTO/8021X-HOWTO/freeradius.html</A></FONT>
<BR><FONT SIZE=2><A HREF="http://www.greatnorthcomputing.com/2008/03/using-freeradius-with-both-eap-peap.html" TARGET="_blank">http://www.greatnorthcomputing.com/2008/03/using-freeradius-with-both-eap-peap.html</A></FONT>
</P>
<P><FONT SIZE=2>and about 100.000 more.</FONT>
</P>
<P><FONT SIZE=2>order of apperance at google, not related to relevance.</FONT>
</P>
<P><FONT SIZE=2>Greetings,</FONT>
</P>
<P><FONT SIZE=2>Michael.</FONT>
</P>
<BR>
<P><FONT SIZE=2>------------------------------</FONT>
</P>
<P><FONT SIZE=2>Message: 6</FONT>
<BR><FONT SIZE=2>Date: Tue, 29 Apr 2008 20:49:41 +0200</FONT>
<BR><FONT SIZE=2>From: Alan DeKok <aland@deployingradius.com></FONT>
<BR><FONT SIZE=2>Subject: Re: SPAM-LOW: Re: EAP/TLS connection problem..</FONT>
<BR><FONT SIZE=2>To: FreeRadius users mailing list</FONT>
<BR> <FONT SIZE=2><freeradius-users@lists.freeradius.org></FONT>
<BR><FONT SIZE=2>Message-ID: <48176DC5.8010101@deployingradius.com></FONT>
<BR><FONT SIZE=2>Content-Type: text/plain; charset=ISO-8859-1</FONT>
</P>
<P><FONT SIZE=2>Johan Nyman wrote:</FONT>
<BR><FONT SIZE=2>> I have not edited the debug "a lot"! </FONT>
</P>
<P><FONT SIZE=2> You posted a small portion of the debug output. There is a lot more</FONT>
<BR><FONT SIZE=2>available during an EAP-TLS session.</FONT>
</P>
<P><FONT SIZE=2>> What information, from what .log files do you want/need? </FONT>
</P>
<P><FONT SIZE=2> The output of radiusd -X?</FONT>
</P>
<P><FONT SIZE=2>> Perhaps you are referring to another debug file?</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> That information I posted is directly from the "Radiusd -X" console.</FONT>
</P>
<P><FONT SIZE=2> Yes, I know that. Please understand that posting a *tiny* portion of</FONT>
<BR><FONT SIZE=2>it doesn't help. Posting *all* of it helps.</FONT>
</P>
<P><FONT SIZE=2> Alan DeKok.</FONT>
</P>
<BR>
<P><FONT SIZE=2>------------------------------</FONT>
</P>
<P><FONT SIZE=2>Message: 7</FONT>
<BR><FONT SIZE=2>Date: Tue, 29 Apr 2008 21:03:10 +0200</FONT>
<BR><FONT SIZE=2>From: Alan DeKok <aland@deployingradius.com></FONT>
<BR><FONT SIZE=2>Subject: Re: HOWTO PEAP + FreeRadius + XP Client</FONT>
<BR><FONT SIZE=2>To: FreeRadius users mailing list</FONT>
<BR> <FONT SIZE=2><freeradius-users@lists.freeradius.org></FONT>
<BR><FONT SIZE=2>Message-ID: <481770EE.8010803@deployingradius.com></FONT>
<BR><FONT SIZE=2>Content-Type: text/plain; charset=ISO-8859-1</FONT>
</P>
<P><FONT SIZE=2>George KNIGHT wrote:</FONT>
<BR><FONT SIZE=2>> Before I write my question here, I just want to let all of you know that</FONT>
<BR><FONT SIZE=2>> I did lots of searching in both google and this email list. But couldn't</FONT>
<BR><FONT SIZE=2>> find anything to get the answer. </FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> My question is I have been looking for a HOWTO paper for a beginner to</FONT>
<BR><FONT SIZE=2>> set freeradius as an AAA server in a wireless environment to Windows XP</FONT>
<BR><FONT SIZE=2>> SP2 clients. I will use Windows' own PEAP client. Is there such a paper</FONT>
<BR><FONT SIZE=2>> someone can give me the link?</FONT>
</P>
<P><FONT SIZE=2>$ ./configure</FONT>
<BR><FONT SIZE=2>$ make</FONT>
<BR><FONT SIZE=2>$ make install</FONT>
<BR><FONT SIZE=2>$ radiusd -X</FONT>
</P>
<P><FONT SIZE=2>- Un-check "verify server certificate" in Windows (ONLY for testing).</FONT>
</P>
<P><FONT SIZE=2>- Add a user to the database (username/password, example in the FAQ)</FONT>
</P>
<P><FONT SIZE=2> That's it.</FONT>
</P>
<P><FONT SIZE=2>> I'm very frustrated to find out that there is no information available</FONT>
<BR><FONT SIZE=2>> for a setup from the scratch.</FONT>
</P>
<P><FONT SIZE=2> Part of the problem is that in 2.0, there is so little to do...</FONT>
</P>
<P><FONT SIZE=2>> I wrote papers like that before for</FONT>
<BR><FONT SIZE=2>> various topics such as subversion implementation for a multiple OS</FONT>
<BR><FONT SIZE=2>> environment, VoIP implementation with a Linux based open sources S/W</FONT>
<BR><FONT SIZE=2>> etc. I have intention to write such a paper for how to set up PEAP</FONT>
<BR><FONT SIZE=2>> implementation with freeradius as well. But for that, I'm hoping someone</FONT>
<BR><FONT SIZE=2>> can give me a good start.</FONT>
</P>
<P><FONT SIZE=2> The EAP-TLS "howtos" contain additional documentation:</FONT>
</P>
<P><FONT SIZE=2><A HREF="http://freeradius.org/doc/" TARGET="_blank">http://freeradius.org/doc/</A></FONT>
</P>
<P><FONT SIZE=2>> Clients are going to be computers with WinCE as their OS and they will</FONT>
<BR><FONT SIZE=2>> contact to the LAN wirelessly. What I want to achieve is authenticating</FONT>
<BR><FONT SIZE=2>> this clients with server-AAA using PEAP before letting them use the</FONT>
<BR><FONT SIZE=2>> other network resources.</FONT>
</P>
<P><FONT SIZE=2> Install 2.0, start the server.</FONT>
</P>
<P><FONT SIZE=2> See also raddb/certs/README. You can create "real" certificates, and</FONT>
<BR><FONT SIZE=2>import them into WinCE.</FONT>
</P>
<P><FONT SIZE=2> There is very, very, little to change in order to get PEAP to work.</FONT>
</P>
<P><FONT SIZE=2> Alan DeKok.</FONT>
</P>
<BR>
<P><FONT SIZE=2>------------------------------</FONT>
</P>
<P><FONT SIZE=2>-</FONT>
<BR><FONT SIZE=2>List info/subscribe/unsubscribe? See <A HREF="http://www.freeradius.org/list/users.html" TARGET="_blank">http://www.freeradius.org/list/users.html</A></FONT>
</P>
<BR>
<P><FONT SIZE=2>End of Freeradius-Users Digest, Vol 36, Issue 173</FONT>
<BR><FONT SIZE=2>*************************************************</FONT>
</P>
</BODY>
</HTML>