I created once again certs by myself, giving common name for user cert the same like in example<br><a href="mailto:user@example.com">user@example.com</a>, I place them on xp client - both of them looks ok,<br>now something is happening (anyway like Aragorn said: "still not king"):<br>
<br><br>Ready to process requests.<br>rad_recv: Access-Request packet from host 192.168.5.206 port 1812, id=206, length=147<br> NAS-IP-Address = 192.168.5.206<br> NAS-Port = 50046<br> NAS-Port-Type = Ethernet<br>
User-Name = "<a href="mailto:user@example.com">user@example.com</a>"<br> Called-Station-Id = "00-0C-30-81-9B-EE"<br> Calling-Station-Id = "00-0A-E4-13-1A-02"<br> Service-Type = Framed-User<br>
Framed-MTU = 1500<br> EAP-Message = 0x020000150175736572406578616d706c652e636f6d<br> Message-Authenticator = 0x380489e7e9bb9568103d6ee3dccdfb15<br>+- entering group authorize {...}<br>++[preprocess] returns ok<br>
++[chap] returns noop<br>++[mschap] returns noop<br>[suffix] Looking up realm "<a href="http://example.com">example.com</a>" for User-Name = "<a href="mailto:user@example.com">user@example.com</a>"<br>
[suffix] Found realm "<a href="http://example.com">example.com</a>"<br>[suffix] Adding Stripped-User-Name = "user"<br>[suffix] Adding Realm = "<a href="http://example.com">example.com</a>"<br>
[suffix] Proxying request from user user to realm <a href="http://example.com">example.com</a><br>[suffix] Preparing to proxy authentication request to realm "<a href="http://example.com">example.com</a>"<br>++[suffix] returns updated<br>
[eap] Request is supposed to be proxied to Realm <a href="http://example.com">example.com</a>. Not doing EAP.<br>++[eap] returns noop<br>++[unix] returns updated<br>++[files] returns noop<br>++[expiration] returns noop<br>
++[logintime] returns noop<br>++[pap] returns noop<br>Sending Access-Request of id 14 to 127.0.0.1 port 1812<br> NAS-IP-Address = 192.168.5.206<br> NAS-Port = 50046<br> NAS-Port-Type = Ethernet<br> User-Name = "user"<br>
Called-Station-Id = "00-0C-30-81-9B-EE"<br> Calling-Station-Id = "00-0A-E4-13-1A-02"<br> Service-Type = Framed-User<br> Framed-MTU = 1500<br> EAP-Message = 0x020000150175736572406578616d706c652e636f6d<br>
Message-Authenticator = 0x00000000000000000000000000000000<br> Proxy-State = 0x323036<br>Proxying request 0 to home server 127.0.0.1 port 1812<br>Sending Access-Request of id 14 to 127.0.0.1 port 1812<br> NAS-IP-Address = 192.168.5.206<br>
NAS-Port = 50046<br> NAS-Port-Type = Ethernet<br> User-Name = "user"<br> Called-Station-Id = "00-0C-30-81-9B-EE"<br> Calling-Station-Id = "00-0A-E4-13-1A-02"<br>
Service-Type = Framed-User<br> Framed-MTU = 1500<br> EAP-Message = 0x020000150175736572406578616d706c652e636f6d<br> Message-Authenticator = 0x00000000000000000000000000000000<br> Proxy-State = 0x323036<br>
Going to the next request<br>Waking up in 0.9 seconds.<br>rad_recv: Access-Request packet from host 127.0.0.1 port 1814, id=14, length=140<br> NAS-IP-Address = 192.168.5.206<br> NAS-Port = 50046<br> NAS-Port-Type = Ethernet<br>
User-Name = "user"<br> Called-Station-Id = "00-0C-30-81-9B-EE"<br> Calling-Station-Id = "00-0A-E4-13-1A-02"<br> Service-Type = Framed-User<br> Framed-MTU = 1500<br>
EAP-Message = 0x020000150175736572406578616d706c652e636f6d<br> Message-Authenticator = 0x2fe31c62e81552bf7a752f0c4a4b1633<br> Proxy-State = 0x323036<br>+- entering group authorize {...}<br>++[preprocess] returns ok<br>
++[chap] returns noop<br>++[mschap] returns noop<br>[suffix] No '@' in User-Name = "user", looking up realm NULL<br>[suffix] No such realm "NULL"<br>++[suffix] returns noop<br>[eap] EAP packet type response id 0 length 21<br>
[eap] No EAP Start, assuming it's an on-going EAP conversation<br>++[eap] returns updated<br>++[unix] returns updated<br>++[files] returns noop<br>++[expiration] returns noop<br>++[logintime] returns noop<br>[pap] Found existing Auth-Type, not changing it.<br>
++[pap] returns noop<br>Found Auth-Type = EAP<br>+- entering group authenticate {...}<br>[eap] Identity does not match User-Name, setting from EAP Identity.<br>[eap] Failed in handler<br>++[eap] returns invalid<br>Failed to authenticate the user.<br>
Using Post-Auth-Type Reject<br>+- entering group REJECT {...}<br>[attr_filter.access_reject] expand: %{User-Name} -> user<br> attr_filter: Matched entry DEFAULT at line 11<br>++[attr_filter.access_reject] returns updated<br>
Delaying reject of request 1 for 1 seconds<br>Going to the next request<br>Waking up in 0.9 seconds.<br>Sending delayed reject for request 1<br>Sending Access-Reject of id 14 to 127.0.0.1 port 1814<br> Proxy-State = 0x323036<br>
Waking up in 4.9 seconds.<br>rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=14, length=25<br> Proxy-State = 0x323036<br>+- entering group post-proxy {...}<br>[eap] No pre-existing handler found<br>
++[eap] returns noop<br>Using Post-Auth-Type Reject<br>+- entering group REJECT {...}<br>[attr_filter.access_reject] expand: %{User-Name} -> <a href="mailto:user@example.com">user@example.com</a><br> attr_filter: Matched entry DEFAULT at line 11<br>
++[attr_filter.access_reject] returns updated<br>Sending Access-Reject of id 206 to 192.168.5.206 port 1812<br>Finished request 0.<br>Going to the next request<br>Waking up in 4.9 seconds.<br>Cleaning up request 1 ID 14 with timestamp +43<br>
Cleaning up request 0 ID 206 with timestamp +43<br>Ready to process requests.<br><br><br><br><br><div class="gmail_quote">On Tue, May 19, 2009 at 2:23 PM, Bartosz Chodzinski <span dir="ltr"><<a href="mailto:bartosz.c@gmail.com">bartosz.c@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">So in other words this script is for all clients exept microsofts-like ? <br><div class="im">
>You should try altering make client command in Makefile so that client certificates are signed by ca and not server certificate.<br></div>
do you have such altered makefile?<div><div></div><div class="h5"><br>
<br><br><br><div class="gmail_quote">On Tue, May 19, 2009 at 1:35 PM, Ivan Kalik <span dir="ltr"><<a href="mailto:tnt@kalik.net" target="_blank">tnt@kalik.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>> # make client<br>
><br>
> next I made a copy of ca.der and client.p12 to xp directory,<br>
> next I opened mmc and install both of them to Trusted Root Certificate<br>
> Authorities and to Personal<br>
><br>
> exclamation mark on client certificate:<br>
> "windows does not have enough information to verify this certificate"<br>
> "you have private key that corresponds to this certificate"<br>
><br>
<br>
</div>This is explained in raddb/certs/README - Compatibility. You should try<br>
altering make client command in Makefile so that client certificates are<br>
signed by ca and not server certificate.<br>
<div><br>
Ivan Kalik<br>
Kalik Informatika ISP<br>
<br>
-<br>
</div><div><div></div><div>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
</div></div></blockquote></div><br>
</div></div></blockquote></div><br>