<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><div><br></div><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;">I read the post: "PEAP or TTLS and Microsoft Vista".<br><br>what i remain is i have to test another wireless mlanager differentthan trhe built-in of windows XP. ok, i will as soon as i will be infront of the server (no chance, it's week-end now)<br><br><br><div style="font-family: arial,helvetica,sans-serif; font-size: 13px;">----- Message d'origine ----<br>De : nf-vale <nf-vale@critical-links.com><br>À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org><br>Envoyé le : Vendredi, 25 Juillet 2008, 20h51mn 58s<br>Objet : Re : Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)<br><br>Are you using vista supplicant? By reading the
last lines of your radius<br>debug file it seems so...<br><br><br>See earlier posts with subject: "PEAP or TTLS and Microsoft Vista".<br><br><br><br>Sex, 2008-07-25 às 17:10 +0000, Reveal MAP escreveu:<br>> <br>> <br>> > installing ca.der and putting user && pass into client machine, the <br>> authentication doesn't work?<br>> <br>> -- no, it doesn't! <br>> <br>> > you only need ca.der but, if you have an active directory like<br>> LDAP, <br>> check if your comunication with AD server also have tls<br>> authentication.<br>> Into ldap module you can configurate another tls block, which it's <br>> different than tls block into eap module.<br>> <br>> -- Well, the howto espalaining how freeradius has to authenticate<br>> users against Active Directory says nothing about ldap config files on<br>> linux server. it just gives tips about samba, using winbind,<br>>
ntlm_auth, krb5.conf, nsswitch.conf and mschap module in freeradius.<br>> I ever success this kind of authentication without reading or changing<br>> a line of ldap module in freeradius.<br>> and i think, authenticating users against Openldap won't be managed<br>> like authentication of freeradius using active directory.<br>> <br>> >I don't know if it is your problem, but I suppose that comunication <br>> between ldap server and radius can have different certificates, from <br>> different ca's than eap comunication.<br>> <br>> <br>> my wireless network is secured with wpa/wpa2 entreprise, requiring a<br>> RADIUS server to perform authentication. so i am doing 802.1x<br>> authentication which exploit a valid PKI,regardless of the base of<br>> users. this is how i understand it.<br>> <br>> > If it is your problem, I would <br>> check it. also would be good you post de debug of
radius to see which <br>> certificate can't validate.<br>> <br>> see the logf there: <a href="http://tinypaste.com/5b99b" target="_blank">http://tinypaste.com/5b99b</a> <br>> active and valid user is:<br>> login: glouglou<br>> password: glouglou<br>> <br>> aaa:~ # ntlm_auth --username=glouglou --request-nt-key --domain=PLUTON<br>> password:<br>> NT_STATUS_OK: Success (0x0)<br>> aaa:~ # <br>> <br>> <br>> :/ Any help will be appreciated. these days i am wondering about<br>> validity of the Server certificate!<br>> I have to tell you that, in my case, if i try a peap authentication<br>> against Active Directoiry with wrong users credentials, i have an<br>> error message saying that login or password is incorrect. with good<br>> users credential, i just obtain what you can see in the Radiusd -X<br>>
output (<a href="http://tinypaste.com/5b99b" target="_blank">http://tinypaste.com/5b99b</a>) <br>> <br>> thank you<br>> -<br>> List info/subscribe/unsubscribe? See<br>> <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>> <br>> <br>> ______________________________________________________________________<br>> Envoyé avec Yahoo! Mail.<br>> Une boite mail plus intelligente. <br>> -<br>> List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br><br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a></div></div></div><br>
<hr size="1">
Envoyé avec <a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html">Yahoo! Mail</a>.<br>Une boite mail plus intelligente. </a></body></html>