<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
--></style>
</head>
<body class='hmmessage'>
> Date: Thu, 17 Jun 2010 22:14:45 +0100<br>> From: A.L.M.Buxey@lboro.ac.uk<br>> To: freeradius-users@lists.freeradius.org<br>> Subject: Re: eduroam PEAP + TTLS<br>> <br>> Hi,<br><br>Hi thank you very much for you quick answer !<br><br>> > I'm trying to implement PEAP-MSCHAPV2 support in an existing and working configuration with EAP-TTLS + PAP,<br>> > giving users a full support of eduroam. There are proxy radius maintained by our national "provider", and they test<br>> > authentication every 15 minutes.<br>> > <br>> > When they only test EAP-TTLS authentication, it works, and this is a part of the output of freeradius -X.<br>> <br>> can I ask a quick question. do you need/want your own users to use PEAP....whether<br>> you choose to use EAP-TTLS/PAP or PEAP/MSCHAPv2 is up to you for your users....a visitor<br>> to your site should be able to use PEAP if their home site supports it as your FreeRADIUS<br>> boxes will just proxy the request to the national proxies.<br>> <br>> I'm not sure why the central test should be forcing you to support all types of EAP - it<br>> should only check that you are working for the EAP methods that you, as an IdP support.<br><br>I need my own users to use PEAP because on Windows client, there is no support of EAP-TTLS without installing a soft to implement it.<br>And I want to use Active Directory because I can't use actual password field in OpenLDAP with PEAP.<br>Otherwise you're right, this is how eduroam works.<br><br>> > } # server inner-tunnel<br>> > [ttls] Got tunneled reply code 2<br>> ^^^^^^ <br>> <br>> eh? I thought you said this second test was a PEAP test. are you sure it is as<br>> this looks very much like an EAP-TTLS/MSCHAPv2 test<br><br>That's right, whereas before, I've got this line :<br>Login OK: [<i>user</i>/<via Auth-Type = mschap>] (from client <i>proxyradius</i>
port 0 cli 02-00-00-00-00-01 via TLS tunnel)<br>Which occurs after these lines :<br>Found Auth-Type = MSCHAP<br>+- entering group MS-CHAP {...}<br>[mschap] Told to do MS-CHAPv2 for user@realm with NT-Password<br>[mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details<br>[mschap] expand: --username=%{Stripped-User-Name:-%{mschap:User-Name:-None}} -> --username=user<br>[mschap] mschap2: d6<br>[mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=45d29cf49c25ed29<br>[mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=6c2dbac31a48ddf0cbf4a1c8e6c5c1262ec6b8f77bb9ae46<br>Exec-Program output: NT_KEY: 64BA19DEDFDDB5A3ABAC7FEB95BF671F<br>Exec-Program-Wait: plaintext: NT_KEY: 64BA19DEDFDDB5A3ABAC7FEB95BF671F<br>Exec-Program: returned: 0<br>++[mschap] returns ok<br><br>So, I suppose that it's really a PEAP-MSCHAPV2 test. Maybe I've made something wrong in the order of Auth-Type in my conf files ?<br><br>> > Sending Access-Challenge of id 9 to 193.51.182.121 port 35055<br>> > User-Name = "user@realm"<br>> > EAP-Message = 0x010a005f1580000000551703010050f984b434f276e050b0697e427d30ddfe2c0d9cc56a8f5da6ab447bbabae115d8181dfce1b6e52f33fcd2a20d5e26f574b9be69fa946342eafbd7ea350d5782490593a260401dae6b1c71f16f30b3ab38<br>> > Message-Authenticator = 0x00000000000000000000000000000000<br>> > State = 0xcda13382c4ab2647095b27820a4b1850<br>> <br>> theres plenty in the FreeRADIUS docs about 'why do I not get anything after an Access-Challenge'<br>> - usually down to certs.<br><br>I've already added my certs in the Active Directory, as it's said in eap.conf and that solved the problem for PEAP-MSCHAPV2. So now, I can use<br>default PEAP options in the native wpa supplicant on Windows and that works.<br><br>I'm gonna look for more about this.<br><br>> alan<br><br>J-P.<br> <br /><hr />Envie de plus d'originalité dans vos conversations ? <a href='http://www.ilovemessenger.fr/emoticones/telecharger-emoticones-emochticones.aspx' target='_new'>Téléchargez gratuitement les Emoch'ticones !</a></body>
</html>