No authenticate method (Auth-Type) found when using eap2 (eap-psk)
Hi, i am willing to experiment openPAN/Panatiki implementation , thus using eap-psk . I build and run the whole thing using cooja and openpaa then, regarding Radiusd and OpenPana user manual I've been told to use eap2 : May be I don't know who to follow the instruction from experimental.conf, which says : * You MUST force # the server to choose "eap2" for authentication, because this # module has no "authorize" section.* How do I do that ? Because , EAP exchange starts well up to radius then Radius reject in this way : ***************** rad_recv: Access-Request packet from host 127.0.0.1 port 47462, id=0, length=103 User-Name = "usera" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "00-00-00-00-00-00" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT" EAP-Message = 0x0249000a017573657261 Message-Authenticator = 0xf338498fefb32b0cb5f94bc46f13 fa09 # Executing section authorize from file /home/gilles/freeradius-server-2.2.3/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "usera", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++[unix] = notfound ++[files] = noop ++[expiration] = noop ++[logintime] = noop +} # group authorize = ok *ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user* Failed to authenticate the user. ******************* Thanks for help Regards Gilles
Hi,
May be I don't know who to follow the instruction from experimental.conf, which says : You MUST force # the server to choose "eap2" for authentication, because this # module has no "authorize" section.
How do I do that ?
as you do for other methods. this is the one case where doing so is 'valid' eg if (!control:Auth-Type) { update control { Auth-Type = "eap2" } } (in the authorize section) alan
Bourgeois gilles wrote:
i am willing to experiment openPAN/Panatiki implementation , thus using eap-psk . I build and run the whole thing using cooja and openpaa then, regarding Radiusd and OpenPana user manual I've been told to use eap2 :
The main EAP module doesn't implement EAP-PSK.
May be I don't know who to follow the instruction from experimental.conf, which says : * You MUST force # the server to choose "eap2" for authentication, because this # module has no "authorize" section.*
How do I do that ?
In the "users" file: DEFAULT Auth-Type := eap2 This configuration will make all other authentication methods fail. But it's fine for testing EAP2. Alan DeKok.
Hi, and thanks for answer ! Well, in my 'user' file I added DEFAULT Auth-Type := eap2 then execution failed with seg fault : # Executing section authorize from file /home/gilles/freeradius-server-2.2.3/etc/raddb/sites-enabled/default +group authorize { [suffix] No '@' in User-Name = "usera", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop *[files] users: Matched entry DEFAULT at line 196* ++[files] = ok ++[expiration] = noop ++[logintime] = noop +} # group authorize = ok *Found Auth-Type = eap2* # Executing group from file /home/gilles/freeradius-server-2.2.3/etc/raddb/sites-enabled/default +group eap2 { Erreur de segmentation (core dumped) looking forward for the dump, seems not to be generated by default 2014-02-18 20:39 GMT+01:00 Alan DeKok <aland@deployingradius.com>:
Bourgeois gilles wrote:
i am willing to experiment openPAN/Panatiki implementation , thus using eap-psk . I build and run the whole thing using cooja and openpaa then, regarding Radiusd and OpenPana user manual I've been told to use eap2 :
The main EAP module doesn't implement EAP-PSK.
May be I don't know who to follow the instruction from experimental.conf, which says : * You MUST force # the server to choose "eap2" for authentication, because this # module has no "authorize" section.*
How do I do that ?
In the "users" file:
DEFAULT Auth-Type := eap2
This configuration will make all other authentication methods fail. But it's fine for testing EAP2.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
I may notice , in the default file from site-enable, there is now : # Allow EAP authentication. Auth-Type eap2{ eap2 } 2014-02-19 9:34 GMT+01:00 Bourgeois gilles <gilles.felis@gmail.com>:
Hi, and thanks for answer ! Well, in my 'user' file I added DEFAULT Auth-Type := eap2
then execution failed with seg fault :
# Executing section authorize from file /home/gilles/freeradius-server-2.2.3/etc/raddb/sites-enabled/default +group authorize { [suffix] No '@' in User-Name = "usera", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop *[files] users: Matched entry DEFAULT at line 196* ++[files] = ok
++[expiration] = noop ++[logintime] = noop +} # group authorize = ok *Found Auth-Type = eap2* # Executing group from file /home/gilles/freeradius-server-2.2.3/etc/raddb/sites-enabled/default +group eap2 { Erreur de segmentation (core dumped)
looking forward for the dump, seems not to be generated by default
2014-02-18 20:39 GMT+01:00 Alan DeKok <aland@deployingradius.com>:
Bourgeois gilles wrote:
i am willing to experiment openPAN/Panatiki implementation , thus using eap-psk . I build and run the whole thing using cooja and openpaa then, regarding Radiusd and OpenPana user manual I've been told to use eap2 :
The main EAP module doesn't implement EAP-PSK.
May be I don't know who to follow the instruction from experimental.conf, which says : * You MUST force # the server to choose "eap2" for authentication, because this # module has no "authorize" section.*
How do I do that ?
In the "users" file:
DEFAULT Auth-Type := eap2
This configuration will make all other authentication methods fail. But it's fine for testing EAP2.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Bourgeois gilles wrote:
Hi, and thanks for answer ! Well, in my 'user' file I added DEFAULT Auth-Type := eap2
then execution failed with seg fault :
See doc/bugs Unfortunately, I haven't looked at, or even compiled, the eap2 module for about 3 years. It was intended as a "proof of concept", and not something to be used in production. Alan DeKok.
Right, not for production as mentionned Then if we consider eap psk suitable enough for bootstrapping wireless sensors contrained nodes network, then we might enjoy hiring a developer and solve the issue thanks Alan 2014-02-19 15:58 GMT+01:00 Alan DeKok <aland@deployingradius.com>:
Bourgeois gilles wrote:
Hi, and thanks for answer ! Well, in my 'user' file I added DEFAULT Auth-Type := eap2
then execution failed with seg fault :
See doc/bugs
Unfortunately, I haven't looked at, or even compiled, the eap2 module for about 3 years. It was intended as a "proof of concept", and not something to be used in production.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
On 19 Feb 2014, at 16:11, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
Then if we consider eap psk suitable enough for bootstrapping wireless sensors contrained nodes network, then we might enjoy hiring a developer and solve the issue
EAP-PWD? :-)
Which is officially supported in v3.0.x, as in there's a sub-module for rlm_eap which implements it. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 19 Feb 2014, at 16:17, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 19 Feb 2014, at 16:11, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
Then if we consider eap psk suitable enough for bootstrapping wireless sensors contrained nodes network, then we might enjoy hiring a developer and solve the issue
EAP-PWD? :-)
Which is officially supported in v3.0.x, as in there's a sub-module for rlm_eap which implements it.
I'm not sure what the advantage of EAP-PSK http://tools.ietf.org/html/rfc4764 over EAP-PWD http://tools.ietf.org/html/rfc5931 is? Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Hi,
EAP-PWD? :-)
Which is officially supported in v3.0.x, as in there's a sub-module for rlm_eap which implements it.
exactly...which is why i suggested it
I'm not sure what the advantage of EAP-PSK http://tools.ietf.org/html/rfc4764
over EAP-PWD http://tools.ietf.org/html/rfc5931
is?
exactly...which is why i suggested it ;-) alan
Well, up to me or anyone to implement on supplicant side. 2014-02-19 17:39 GMT+01:00 <A.L.M.Buxey@lboro.ac.uk>:
Hi,
EAP-PWD? :-)
Which is officially supported in v3.0.x, as in there's a sub-module for rlm_eap which implements it.
exactly...which is why i suggested it
I'm not sure what the advantage of EAP-PSK http://tools.ietf.org/html/rfc4764
over EAP-PWD http://tools.ietf.org/html/rfc5931
is?
exactly...which is why i suggested it
;-)
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Ok, I'll have a look at http://tools.ietf.org/html/rfc5931, keeping in mind 802.15.4 sensor does NOT have any user interface of any kind. 2014-02-19 17:27 GMT+01:00 Arran Cudbard-Bell <a.cudbardb@freeradius.org>:
On 19 Feb 2014, at 16:17, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 19 Feb 2014, at 16:11, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
Then if we consider eap psk suitable enough for bootstrapping wireless sensors contrained nodes network, then we might enjoy hiring a
developer
and solve the issue
EAP-PWD? :-)
Which is officially supported in v3.0.x, as in there's a sub-module for rlm_eap which implements it.
I'm not sure what the advantage of EAP-PSK http://tools.ietf.org/html/rfc4764
over EAP-PWD http://tools.ietf.org/html/rfc5931
is?
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
On 19 Feb 2014, at 19:42, Bourgeois gilles <gilles.felis@gmail.com> wrote:
Ok, I'll have a look at http://tools.ietf.org/html/rfc5931, keeping in mind 802.15.4 sensor does NOT have any user interface of any kind.
Why would that make any difference? Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Right, I'll provide if find smthing 2014-02-19 17:42 GMT+01:00 Alan DeKok <aland@deployingradius.com>:
Bourgeois gilles wrote:
Right, not for production as mentionned Then if we consider eap psk suitable enough for bootstrapping wireless sensors contrained nodes network, then we might enjoy hiring a developer and solve the issue
Patches are always welcome.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Arran Cudbard-Bell -
Bourgeois gilles -
Phil Mayers