Hi,<br><br>I'm using freeRadius 2.0.3 on my WLAN. I have WindowsXP, WindowsVista and Apple (OSX) clients. Windows clients authenticate well with freeRadius but I have problems with OSX Leopard. I can't figure out where the problem originates from. I'm using MySQL, Cleartext-Passwords, PEAP auth, WPA-Enterprise, AES. The error that pops up while authenticating OSX is the following (see below for extended logs):<br>
<br>Tue Jun 17 20:02:53 2008 : Error: TLS Alert read:warning:close notify<br>Tue Jun 17 20:02:53 2008 : Auth: Login incorrect: [userX] (from client NAS1-WiFi port 8 cli 001c34c14d76)<br><br>Does anybody have experience with OSX clients and freeRadius? Does anybody have a radiusd and eap configuration file which is known to work with OSX Leopard and could you post it to me? <br>
Ofcourse I realise that the problem could be with the AP (WAP54G) or the clients itself. I've done many hours of testing/reading though but can't figure out what's causing it.<br><br>Ok, thanks for all your help!<br>
<br><br>gr, Jelle<br><br><br>Logs of "radiusd -X":<br>-> As you can see I use a littlebit of a hacked version of the SQL implementation to use another MySQL table (integration with Lan Management System), but that shouldn't matter. As I said, other clients authenticate without problems.<br>
<br> User-Name = "userX"<br> NAS-IP-Address = <a href="http://172.16.27.18" target="_blank">172.16.27.18</a><br> Called-Station-Id = "001a70abad32"<br> Calling-Station-Id = "001b63c13f76"<br>
NAS-Identifier = "001a70abad32"<br> NAS-Port = 8<br> Framed-MTU = 1400<br> State = 0xeb256c65e8d575619976542f479f49d4<br> NAS-Port-Type = Wireless-802.11<br> EAP-Message = 0x02f0002f1980000000251503010020c5ac7365546396895a7fb74e2ab11d3ec7a8f2de0a7c761fda82cbd9f1a99de2<br>
Message-Authenticator = 0x2f90d0e5a8325a3bf379f1243dda8195<br>+- entering group authorize<br>++[preprocess] returns ok<br> expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/<a href="http://172.16.27.18/auth-detail-20080617" target="_blank">172.16.27.18/auth-detail-20080617</a><br>
rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/<a href="http://172.16.27.18/auth-detail-20080617" target="_blank">172.16.27.18/auth-detail-20080617</a><br> expand: %t -> Tue Jun 17 20:17:07 2008<br>
++[auth_log] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br> rlm_realm: No '@' in User-Name = "userX", looking up realm NULL<br> rlm_realm: No such realm "NULL"<br>++[suffix] returns noop<br>
rlm_eap: EAP packet type response id 240 length 47<br> rlm_eap: Continuing tunnel setup.<br>++[eap] returns ok<br> expand: %{User-Name} -> userX<br>rlm_sql (sql): sql_set_user escaped user --> 'userX'<br>
rlm_sql (sql): Reserving sql socket id: 0<br> expand: SELECT ownerid as id, username, 'Cleartext-Password' as attribute, passwd as value, ':=' as op FROM nodes WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT ownerid as id, username, 'Cleartext-Password' as attribute, passwd as value, ':=' as op FROM nodes WHERE username = 'userX' ORDER BY id<br>
rlm_sql (sql): User found in radcheck table<br> expand: SELECT ownerid as id, username, 'Cleartext-Password' as attribute, passwd as value, ':=' as op FROM nodes WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT ownerid as id, username, 'Cleartext-Password' as attribute, passwd as value, ':=' as op FROM nodes WHERE username = 'userX' ORDER BY id<br>
expand: SELECT 'dynamic' as groupname FROM customers WHERE name = '%{SQL-User-Name}' ORDER BY id -> SELECT 'dynamic' as groupname FROM customers WHERE name = 'userX' ORDER BY id<br>
rlm_sql (sql): Released sql socket id: 0<br>++[sql] returns ok<br>++[expiration] returns noop<br>++[logintime] returns noop<br>rlm_pap: Found existing Auth-Type, not changing it.<br>++[pap] returns noop<br> rad_check_password: Found Auth-Type EAP<br>
auth: type "EAP"<br>+- entering group authenticate<br> rlm_eap: Request found, released from the list<br> rlm_eap: EAP/peap<br> rlm_eap: processing type peap<br> rlm_eap_peap: Authenticate<br> rlm_eap_tls: processing TLS<br>
TLS Length 37<br>rlm_eap_tls: Length Included<br> eaptls_verify returned 11<br> eaptls_process returned 7<br> rlm_eap_peap: EAPTLS_OK<br> rlm_eap_peap: Session established. Decoding tunneled attributes.<br> rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], warning close_notify<br>
TLS Alert read:warning:close notify<br>SSL Connection Established<br>rlm_eap_tls: Application Data<br> rlm_eap_peap: Tunneled data is invalid.<br> rlm_eap: Handler failed in EAP/peap<br> rlm_eap: Failed in EAP select<br>
++[eap] returns invalid<br>auth: Failed to validate the user.<br>Login incorrect: [userX/<via Auth-Type = EAP>] (from client NAS1-WiFi port 8 cli 001b63c13f76)<br>Delaying reject of request 9 for 1 seconds<br>Going to the next request<br>
Waking up in 0.9 seconds.<br>Sending delayed reject for request 9<br> EAP-Message = 0x04f00004<br> Message-Authenticator = 0x00000000000000000000000000000000<br>Waking up in 4.9 seconds.<br>Cleaning up request 9 ID 0 with timestamp +33<br>