<div class="gmail_quote">Hi ! I meet a ERROR in the test of EAP/PEAP<br>
" radtest sqluser 123 localhost 1812 testing123 " is OK<br>
,I just delete the # before 'eap' in radiusd.conf and default files.<br>
the test eapol_test -c peap.txt -s testing123<br>
<br>
my peap.txt is<br>
network={<br>
eap=PEAP<br>
eapol_flags=0<br>
key_mgmt=IEEE8021X<br>
identity="sqluser"<br>
password="123"<br>
ca_cert="/usr/local/freeradius/etc/raddb/certs/ca.pem"<br>
phase2="auth=MSCHAPV2"<br>
anonymous_identity="anonymous"<br>
}<br>
<br>
The result is(too long I cut it,all the messages which contain<br>
'fail'and'warning' are here)<br>
<br>
rad_recv: Access-Request packet from host 127.0.0.1 port 40004, id=0, length=126<br>
User-Name = "anonymous"<br>
NAS-IP-Address = 127.0.0.1<br>
Calling-Station-Id = "02-00-00-00-00-01"<br>
Framed-MTU = 1400<br>
NAS-Port-Type = Wireless-802.11<br>
Connect-Info = "CONNECT 11Mbps 802.11b"<br>
EAP-Message = 0x0200000e01616e6f6e796d6f7573<br>
Message-Authenticator = 0x028746a6804037ea96543cd3853748ca<br>
# Executing section authorize from file<br>
/usr/local/freeradius/etc/raddb/sites-enabled/default<br>
+- entering group authorize {...}<br>
++[preprocess] returns ok<br>
++[chap] returns noop<br>
++[mschap] returns noop<br>
++[digest] returns noop<br>
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL<br>
[suffix] No such realm "NULL"<br>
++[suffix] returns noop<br>
[eap] EAP packet type response id 0 length 14<br>
[eap] No EAP Start, assuming it's an on-going EAP conversation<br>
++[eap] returns updated<br>
++[files] returns noop<br>
[sql] expand: %{User-Name} -> anonymous<br>
[sql] sql_set_user escaped user --> 'anonymous'<br>
rlm_sql (sql): Reserving sql socket id: 3<br>
<br>
……<br><br>
[pap] WARNING! No "known good" password found for the user.<br>
Authentication may fail because of this.<br>
++[pap] returns noop<br>
Found Auth-Type = EAP<br>
# Executing group from file<br>
/usr/local/freeradius/etc/raddb/sites-enabled/default<br>
+- entering group authenticate {...}<br>
[eap] Request found, released from the list<br>
[eap] EAP NAK<br>
[eap] EAP-NAK asked for EAP-Type/peap<br>
[eap] processing type tls<br>
[tls] Initiate<br>
[tls] Start returned 1<br>
++[eap] returns handled<br>
Sending Access-Challenge of id 1 to 127.0.0.1 port 40004<br>
EAP-Message = 0x010200061920<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
State = 0x2e0cc3a22f0eda51cc2cadc82e7658db<br>
Finished request 2.<br>
Going to the next request<br>
<br>
……<br><br>
Found Auth-Type = EAP<br>
# Executing group from file<br>
/usr/local/freeradius/etc/raddb/sites-enabled/inner-tunnel<br>
+- entering group authenticate {...}<br>
[eap] Request found, released from the list<br>
[eap] EAP/mschapv2<br>
[eap] processing type mschapv2<br>
[mschapv2] # Executing group from file<br>
/usr/local/freeradius/etc/raddb/sites-enabled/inner-tunnel<br>
[mschapv2] +- entering group MS-CHAP {...}<br>
[mschap] No Cleartext-Password configured. Cannot create LM-Password.<br>
[mschap] No Cleartext-Password configured. Cannot create NT-Password.<br>
[mschap] Creating challenge hash with username: sqluser<br>
[mschap] Told to do MS-CHAPv2 for sqluser with NT-Password<br>
[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.<br>
[mschap] FAILED: MS-CHAP2-Response is incorrect<br>
++[mschap] returns reject<br>
[eap] Freeing handler<br>
++[eap] returns reject<br>
Failed to authenticate the user.<br>
} # server inner-tunnel<br>
[peap] Got tunneled reply code 3<br>
MS-CHAP-Error = "\010E=691 R=1"<br>
EAP-Message = 0x04080004<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
[peap] Got tunneled reply RADIUS code 3<br>
MS-CHAP-Error = "\010E=691 R=1"<br>
EAP-Message = 0x04080004<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
[peap] Tunneled authentication was rejected.<br>
[peap] FAILURE<br>
++[eap] returns handled<br>
Sending Access-Challenge of id 8 to 127.0.0.1 port 40004<br>
EAP-Message = 0x0109003b190017030100302ab43a32e6ec7ff42289efbdfda591f3a3562799d9559589146b128457125284645e7d72ef66bb121d8dbb003bdab8ab<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
State = 0x2e0cc3a22605da51cc2cadc82e7658db<br>
Finished request 9.<br>
Going to the next request<br>
Waking up in 4.8 seconds.<br>
rad_recv: Access-Request packet from host 127.0.0.1 port 40004, id=9, length=226<br>
User-Name = "anonymous"<br>
NAS-IP-Address = 127.0.0.1<br>
Calling-Station-Id = "02-00-00-00-00-01"<br>
Framed-MTU = 1400<br>
NAS-Port-Type = Wireless-802.11<br>
Connect-Info = "CONNECT 11Mbps 802.11b"<br>
EAP-Message = 0x0209006019001703010020b314a72f4acdfaf2dd08dcf94fd6c7082929e8fd0472499fb3f0ba7b79cae39517030100300bbd73ce8691181df7af8f7caabe39c7c75fa967f055a40ba68caf2780dbcf60a2f6b8be08e9d789e433758deacb3e88<br>
State = 0x2e0cc3a22605da51cc2cadc82e7658db<br>
Message-Authenticator = 0x6b7fca3ade7064bc39fb78dc05a9d319<br>
# Executing section authorize from file<br>
/usr/local/freeradius/etc/raddb/sites-enabled/default<br>
+- entering group authorize {...}<br>
++[preprocess] returns ok<br>
++[chap] returns noop<br>
++[mschap] returns noop<br>
++[digest] returns noop<br>
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL<br>
[suffix] No such realm "NULL"<br>
++[suffix] returns noop<br>
[eap] EAP packet type response id 9 length 96<br>
[eap] Continuing tunnel setup.<br>
++[eap] returns ok<br>
Found Auth-Type = EAP<br>
# Executing group from file<br>
/usr/local/freeradius/etc/raddb/sites-enabled/default<br>
+- entering group authenticate {...}<br>
[eap] Request found, released from the list<br>
[eap] EAP/peap<br>
[eap] processing type peap<br>
[peap] processing EAP-TLS<br>
[peap] eaptls_verify returned 7<br>
[peap] Done initial handshake<br>
[peap] eaptls_process returned 7<br>
[peap] EAPTLS_OK<br>
[peap] Session established. Decoding tunneled attributes.<br>
[peap] Peap state send tlv failure<br>
[peap] Received EAP-TLV response.<br>
[peap] The users session was previously rejected: returning reject (again.)<br>
[peap] *** This means you need to read the PREVIOUS messages in the<br>
debug output<br>
[peap] *** to find out the reason why the user was rejected.<br>
[peap] *** Look for "reject" or "fail". Those earlier messages will tell you.<br>
[peap] *** what went wrong, and how to fix the problem.<br>
[eap] Handler failed in EAP/peap<br>
[eap] Failed in EAP select<br>
++[eap] returns invalid<br>
Failed to authenticate the user.<br>
Using Post-Auth-Type Reject<br>
# Executing group from file<br>
/usr/local/freeradius/etc/raddb/sites-enabled/default<br>
+- entering group REJECT {...}<br>
[attr_filter.access_reject] expand: %{User-Name} -> anonymous<br>
attr_filter: Matched entry DEFAULT at line 11<br>
++[attr_filter.access_reject] returns updated<br>
Delaying reject of request 10 for 1 seconds<br>
Going to the next request<br>
Waking up in 0.9 seconds.<br>
Sending delayed reject for request 10<br>
Sending Access-Reject of id 9 to 127.0.0.1 port 40004<br>
EAP-Message = 0x04090004<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
Waking up in 3.8 seconds.<br>
<br>
can somebody give me a hand .<br>
best regards.<br>
thank you!<br>
</div><br>