- Freeradius-Users - lists.freeradius.org

Re : Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)
by Reveal MAP 27 Jul '08

27 Jul '08

I'm agree, a good begining would be comment out all modules you're not using. The instances of the modules are in sites-enabled/default and sites-enabled/inner-tunnel (for peap and ttls). - --- Donb't worry, it will be done soon (as soon as the week starts again ). i really want to figure it out _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)
by Reveal MAP 27 Jul '08

27 Jul '08

thanx for responding dude. let's take a look at this part of log! (remember too that i am a new linux, many thing are still chinese for me) i agree, my certificate are OK to do EAP in general my coments are the red lines : my mschap module config is: -------------- mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}}" } my peap and mschapv2 module config is: --------------- Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = yes } output of eap/mschapv2authentication is: ------------ rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. //Normal, i am not willing to do PAP but mschapv2 ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for glouglou with NT-Password //does the 3 previous lines means there is an error? what does "No Cleartext-Password configured means? // what does LM-Password means? and if it's error, how could i correct it? // ithought it was normal, as I am surewindows never sends "cleartext-Password" expand: --username=%{mschap:User-Name}-> --username=glouglou //...???... mschap2: d1 expand: --challenge=%{mschap:Challenge:-00} -> --challenge=4a2a69e7929b2c03 //...???... expand: --nt-response=%{mschap:NT-Response:-00}} -> --nt-response=e9ea7e1669ef48501476149962484763f8f98b93fca2ced6} //...???... Exec-Program output: NT_KEY: 067F1C60B6DDB9D2802A458C4EFE22C1 //...???... Exec-Program-Wait: plaintext: NT_KEY: 067F1C60B6DDB9D2802A458C4EFE22C1 //...???... //negociation that is out of the range of my brain till now, but i think ity's normal security negociation in windows system, and there is no error here. Exec-Program: returned: 0 //...???... rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success //...???... if MSCHAP Success, where is the matter with this module??? ++[eap] returns handled } # server (null) //...???... PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x011200331a0311002e533d31303435323031393932463633443944424132303644424643343341413242354132313236344636 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x95b92b9094ab31501a0a30daea5106ca PEAP: Processing from tunneled session code 0x81b78d8 11 EAP-Message = 0x011200331a0311002e533d31303435323031393932463633443944424132303644424643343341413242354132313236344636 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x95b92b9094ab31501a0a30daea5106ca PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 164 to 10.10.44.246 port 1042 EAP-Message = 0x0112004a1900170301003f9d2524cd5e275d581a614935870e9c19c11e3a4e05332e915ef1f0a46bed9a751bbc330d98db1e52e04119a926415da6ee52cb7e6cc6693a8f1bb8847a7af3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe8ed0301efff1a196c3b0024d8e45892 //...???... and then What? and why its stops..???... Finished request 9. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 157 with timestamp +47 Cleaning up request 3 ID 158 with timestamp +47 Cleaning up request 4 ID 159 with timestamp +47 Cleaning up request 5 ID 160 with timestamp +47 Cleaning up request 6 ID 161 with timestamp +47 Cleaning up request 7 ID 162 with timestamp +47 Cleaning up request 8 ID 163 with timestamp +47 Cleaning up request 9 ID 164 with timestamp +47 Ready to process requests. > aaa:~ # ntlm_auth --username=glouglou --request-nt-key --domain=PLUTON > password: > NT_STATUS_OK: Success (0x0) > aaa:~ # > > > :/ Any help will be appreciated. these days i am wondering about > validity of the Server certificate! > I have to tell you that, in my case, if i try a peap authentication > against Active Directoiry with wrong users credentials, i have an > error message saying that login or password is incorrect. with good > users credential, i just obtain what you can see in the Radiusd -X > output (http://tinypaste.com/5b99b) > > thank you > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------------------------------------------------ > but I think you don't have any problem with certificates, looking at radius debug: rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established the client is telling you that has verified the server cert (against ca.der). Then, the server writes ChangeCipherSpec and Fin, and tls phase is finished. I think you have problems with mschapv2 phase, assuming your sql querys working. Your problem begin here: rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for glouglou with NT-Password expand: --username=%{mschap:User-Name} -> --username=glouglou I think...... I've never configured peap/mschapv2 but sometimes i've read, not carefully, about some dependencies between mschap module and mschapv2 or something like that. hope this help you - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

4 3

FreeRadius 2.0.3 setup help
by Brooks, Kyle 27 Jul '08

27 Jul '08

Hello, We have been trying to setup the new FreeRadius server, version 2.0.3 on Fedora 9. We are very close as during testing a user was able to authenticate to AD via LDAP. Radtest was ok, but there is no accept packet/acknowledgment sent back, so the network switch thinks the user hasn't been authenticated yet. Below is the radius log, sensitive information has been taken out. I'm hoping someone can help us figure out what we are doing wrong. The log below has been shorten. Thanks, Kyle +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 17 to 10.0.1.9 port 1645 EAP-Message = 0x010502d51900446f6d61696e253230417574656e7469636174696f6e2c434e3d4149412c434e3d5075626c69632532304b657925323053657276696365732c434e3d53657276696365732c434e3d436f6e66696775726174696f6e2c44433d6164732c44433d6e696e742c44433d6f72673f634143657274696669636174653f626173653f6f626a656374436c6173733d63657274696669636174696f6e417574686f72697479306d06082b060105050730028661687474703a2f2f636e737261646975732e6164732e6e696e742e6f72672f43657274456e726f6c6c2f636e737261646975732e6164732e6e696e742e6f72675f4e494e5425323044 EAP-Message = 0x6f6d61696e253230417574656e7469636174696f6e2e637274300c0603551d130101ff04023000300b0603551d0f0404030205a0303d06092b06010401823715070430302e06262b060104018237150881bae62e8783f93e81e18d3483c9895b86a3bc175e86cef50084f0c57d020166020103301d0603551d250416301406082b0601050507030106082b06010505070302302706092b060104018237150a041a3018300a06082b06010505070301300a06082b06010505070302300d06092a864886f70d010105050003820101004a343f89b942c17c6da2ef12d595d6701f9472e09e7d33d437ff95f02178ac3a2e631b68331b07b40a593348ff47 EAP-Message = 0x0fcf80a89ea5cb645c2769973d97cccec41a95c14f1abf0988286c79d8db6b0aef25e3817ff272879a9ad89bcb01bbcbd6400d9f53d16d16c9d7b78857cdfa9647ad88df7a79d6c544f1a0f68019ef56c1cf79548b60711e896296467a3200be5881bb358827915491040126d5e642fe016c908827488887f7ff3807f3a99409edb0b82415d5f484357df9456b1b7b4a9f8f01a53d47d62642d7677315c944aa77610b947de933bf29b14db7ee28b0e9601fb9e9ac2a6bdba788f8380cdbf59333d2be1887f202cbc8b505fec54d2b2ba19516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x87d5a69b85d0bf58ea7c4f63c1b50a12 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.1.9 port 1645, id=18, length=351 User-Name = "XXXX\\<username>" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "<mac address>" Calling-Station-Id = "<mac address>" EAP-Message = 0x020500d01980000000c61603010086100000820080b2cfa1111edc9fb8469c48b5fab8b7b3ad52036f0030c1f02ce6d994ca3f4d7de0918bf718ee71a422cce5df2aac531d313793dad5127a79e509dd08f898a7c7ad3627f1a2fcfed774bfb8e901414e44627de44b3d40a738fe0580a15c514dd5e922fef25ecfe95de8ba80e98740727dc76ba5a7fa7b9325c29b7ad955742f4414030100010116030100307bd8da6c0510da3056427272fafb8890d885cf8f926fe5cbeadf95bd902f81128e9559dfc5d21ddc3c428a8292ff230d Message-Authenticator = 0xa70f5aa988544c98139e0ac08e9300aa NAS-Port-Type = Ethernet NAS-Port = 50117 State = 0x87d5a69b85d0bf58ea7c4f63c1b50a12 NAS-IP-Address = 10.0.1.9 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "XXXX\<username>", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: Looking up realm "XXXX" for User-Name = "XXXX\<username>" rlm_realm: Found realm "XXXX" rlm_realm: Adding Stripped-User-Name = "<username>" rlm_realm: Proxying request from user <username> to realm XXXX rlm_realm: Adding Realm = "XXXX" rlm_realm: Authentication realm is LOCAL. ++[ntdomain] returns noop rlm_eap: EAP packet type response id 5 length 208 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 198 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 18 to 10.0.1.9 port 1645 EAP-Message = 0x0106004119001403010001011603010030b5334958337959abd8ee1c69ce59d04b7d408af44109bb668b2dde9c69c2c19c31d59fe6308e986f95ba68e28e729810 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x87d5a69b84d3bf58ea7c4f63c1b50a12 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.1.9 port 1645, id=19, length=149 User-Name = "XXXX\\<username>" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "<mac address>" Calling-Station-Id = "<mac address>" EAP-Message = 0x020600061900 Message-Authenticator = 0x8ae0ce1dd64a77972c966f420912d7ca NAS-Port-Type = Ethernet NAS-Port = 50117 State = 0x87d5a69b84d3bf58ea7c4f63c1b50a12 NAS-IP-Address = 10.0.1.9 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "XXXX\<username>", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: Looking up realm "XXXX" for User-Name = "XXXX\<username>" rlm_realm: Found realm "XXXX" rlm_realm: Adding Stripped-User-Name = "<username>" rlm_realm: Proxying request from user <username> to realm XXXX rlm_realm: Adding Realm = "XXXX" rlm_realm: Authentication realm is LOCAL. ++[ntdomain] returns noop rlm_eap: EAP packet type response id 6 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 19 to 10.0.1.9 port 1645 EAP-Message = 0x0107002b19001703010020fb69d7f8ea5ff2236c3d3f2024af829aa0c1308d48050be568e073018586f039 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x87d5a69b83d2bf58ea7c4f63c1b50a12 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.1.9 port 1645, id=20, length=202 User-Name = "XXXX\\<username>" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "<mac address>" Calling-Station-Id = "<mac address>" EAP-Message = 0x0207003b19001703010030c55fd862b91f5c191c4fb7c5ff098300eadda3a90a5fcca8448b8ce2f7743a0847595fb27698b8f44eb34d661d83a511 Message-Authenticator = 0xdf26170e6390e116aac0d3ca3a837ee6 NAS-Port-Type = Ethernet NAS-Port = 50117 State = 0x87d5a69b83d2bf58ea7c4f63c1b50a12 NAS-IP-Address = 10.0.1.9 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "XXXX\<username>", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: Looking up realm "XXXX" for User-Name = "XXXX\<username>" rlm_realm: Found realm "XXXX" rlm_realm: Adding Stripped-User-Name = "<username>" rlm_realm: Proxying request from user <username> to realm XXXX rlm_realm: Adding Realm = "XXXX" rlm_realm: Authentication realm is LOCAL. ++[ntdomain] returns noop rlm_eap: EAP packet type response id 7 length 59 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - XXXX\<username> PEAP: Got tunneled EAP-Message EAP-Message = 0x02070014014e494e545c4272616462726f6f6b43 PEAP: Got tunneled identity of XXXX\<username> PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to XXXX\<username> PEAP: Sending tunneled request EAP-Message = 0x02070014014e494e545c4272616462726f6f6b43 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "XXXX\\<username>" server inner-tunnel { +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "XXXX\<username>", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 7 length 20 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: Entering ldap_groupcmp() expand: dc=XXX,dc=XXXX,dc=org -> dc=XXX,dc=XXXX,dc=org expand: (&(samaccountName=%{mschap:User-Name})) -> (&(samaccountName=<username>)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=XXX,dc=XXXX,dc=org, with filter (&(samaccountName=<username>)) rlm_ldap: ldap_release_conn: Release Id: 0 expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=XXX,dc=XXXX,dc=org, with filter (&(cn=<groupname>)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=<lastname>\, <firstname>OU=XXX,OU=SupportGrp,DC=XXX,DC=XXXX,DC=org, with filter (objectclass=*) rlm_ldap: performing search in CN=<groupname>,OU=XXX,OU=SupportGrp,DC=XXX,DC=XXXX,DC=org, with filter (cn=<groupname>) rlm_ldap::ldap_groupcmp: User found in group <groupname> rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 203 ++[files] returns ok rlm_ldap: - authorize rlm_ldap: performing user authorization for XXXX\<username> expand: (&(samaccountName=%{mschap:User-Name})) -> (&(samaccountName=<username>)) expand: dc=XXX,dc=XXXX,dc=org -> dc=XXX,dc=XXXX,dc=org rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=XXX,dc=XXXX,dc=org, with filter (&(samaccountName=<username>)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: user XXXX\<username> authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: You set Proxy-To-Realm = LOCAL, but it is a LOCAL realm! Cancelling invalid proxy request. rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 Auth-Type := LDAP Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "254" EAP-Message = 0x010800291a0108002410909bca3a1ddf359aa29467c6ee5f3a4f4e494e545c4272616462726f6f6b43 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcfb49cd3cfbc861246fc3b9974c46d68 PEAP: Processing from tunneled session code 0x8429e98 11 Auth-Type := LDAP Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "254" EAP-Message = 0x010800291a0108002410909bca3a1ddf359aa29467c6ee5f3a4f4e494e545c4272616462726f6f6b43 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcfb49cd3cfbc861246fc3b9974c46d68 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 20 to 10.0.1.9 port 1645 EAP-Message = 0x0108004b1900170301004002ef8b0533cf1129c2581465716039cc96393aba17750b5d9e2d8b7b3c8089bec9cb61fde85732f2cc1f2422023627a75ad6e48c27369bc1c8ecd66848cfed1b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x87d5a69b82ddbf58ea7c4f63c1b50a12 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.1.9 port 1645, id=21, length=250 User-Name = "XXXX\\<username>" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "<mac address>" Calling-Station-Id = "<mac address>" EAP-Message = 0x0208006b190017030100605880e9d9f1f726cdc4859cee7c6736df04551ffaf018caea3208975520b6618c84176ddec93e83d804a52e5b8e196f61a45b9aeccbbea37de546400d2cbc1f8258e2b87afbcba19a47b243a95b9dc210d869e4cc835dc7904de4f41fa0444b60 Message-Authenticator = 0xc3c19d23b0eaae1e99aceb9c6b9b67cb NAS-Port-Type = Ethernet NAS-Port = 50117 State = 0x87d5a69b82ddbf58ea7c4f63c1b50a12 NAS-IP-Address = 10.0.1.9 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "XXXX\<username>", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: Looking up realm "XXXX" for User-Name = "XXXX\<username>" rlm_realm: Found realm "XXXX" rlm_realm: Adding Stripped-User-Name = "<username>" rlm_realm: Proxying request from user <username> to realm XXXX rlm_realm: Adding Realm = "XXXX" rlm_realm: Authentication realm is LOCAL. ++[ntdomain] returns noop rlm_eap: EAP packet type response id 8 length 107 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x0208004a1a020800453111abc389151d4c11a8471471acc91213000000000000000038d132783b1dbbd9db142d7a5938ebe32cc165ed13bab4aa004e494e545c4272616462726f6f6b43 PEAP: Setting User-Name to XXXX\<username> PEAP: Sending tunneled request EAP-Message = 0x0208004a1a020800453111abc389151d4c11a8471471acc91213000000000000000038d132783b1dbbd9db142d7a5938ebe32cc165ed13bab4aa004e494e545c4272616462726f6f6b43 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "XXXX\\<username>" State = 0xcfb49cd3cfbc861246fc3b9974c46d68 server inner-tunnel { +- entering group authorize ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "XXXX\<username>", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 8 length 74 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: Entering ldap_groupcmp() expand: dc=XXX,dc=XXXX,dc=org -> dc=XXX,dc=XXXX,dc=org expand: (&(samaccountName=%{mschap:User-Name})) -> (&(samaccountName=<username>)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=XXX,dc=XXXX,dc=org, with filter (&(samaccountName=<username>)) rlm_ldap: ldap_release_conn: Release Id: 0 expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=XXX,dc=XXXXxx,dc=org, with filter (&(cn=<groupname>)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=<lastname>\, <firstname>,OU=CNS,OU=SupportGrp,DC=XXX,DC=XXXX,DC=org, with filter (objectclass=*) rlm_ldap: performing search in CN=<groupname>,OU=CNS,OU=SupportGrp,DC=XXX,DC=XXXX,DC=org, with filter (cn=<groupname>) rlm_ldap::ldap_groupcmp: User found in group <groupname> rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 203 ++[files] returns ok rlm_ldap: - authorize rlm_ldap: performing user authorization for XXXX\<username> expand: (&(samaccountName=%{mschap:User-Name})) -> (&(samaccountName=<username>)) expand: dc=XXX,dc=XXXX,dc=org -> dc=XXX,dc=XXXX,dc=org rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=XXX,dc=XXXX,dc=org, with filter (&(samaccountName=<username>)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: user XXXX\<username> authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: You set Proxy-To-Realm = LOCAL, but it is a LOCAL realm! Cancelling invalid proxy request. rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for <username> with NT-Password expand: --username=%{mschap:User-Name} -> --username=<username> mschap2: 90 expand: --challenge=%{mschap:Challenge:-00} -> --challenge=ae1b5e25b6575f38 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=38d132783b1dbbd9db142d7a5938ebe32cc165ed13bab4aa Exec-Program output: NT_KEY: 537255BB863DD9024B7D2582198B9657 Exec-Program-Wait: plaintext: NT_KEY: 537255BB863DD9024B7D2582198B9657 Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 Auth-Type := LDAP Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "254" EAP-Message = 0x010900331a0308002e533d38393446463732323031443644373745323435324537334531373735394635324634344533354443 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcfb49cd3cebd861246fc3b9974c46d68 PEAP: Processing from tunneled session code 0x83fc7d0 11 Auth-Type := LDAP Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "254" EAP-Message = 0x010900331a0308002e533d38393446463732323031443644373745323435324537334531373735394635324634344533354443 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcfb49cd3cebd861246fc3b9974c46d68 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 21 to 10.0.1.9 port 1645 EAP-Message = 0x0109005b19001703010050acf799d4d09f9221585544ed0d61e14e0eb13d4781dcbe9e6fe7423d1f1f6620939f16d7c7113f3c7be0735d0bcf4a463c760c12da2d85a850a3c22ed81efecdba83d919935cda81ca7bcc377b51825e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x87d5a69b81dcbf58ea7c4f63c1b50a12 Finished request 6. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 15 with timestamp +20 Cleaning up request 1 ID 16 with timestamp +20 Cleaning up request 2 ID 17 with timestamp +20 Cleaning up request 3 ID 18 with timestamp +20 Cleaning up request 4 ID 19 with timestamp +20 Cleaning up request 5 ID 20 with timestamp +20 Cleaning up request 6 ID 21 with timestamp +20 Ready to process requests.

2 1

ippool with non-contiguous ip ranges
by Marco C. Coelho 27 Jul '08

27 Jul '08

I've got 3 class C ranges that are contiguous assigned to a freeradius server. I want to add an additional class C ranges to this server, but they are not contiguous with the previous three. I would like to add 64.202.231.1 - 64.202.234.254 without creating an additional IP Pool . I've searched the docs and net and cannot find an answer. my radiusd.conf has a section like this: SNIP*** ippool main_pool { # range-start,range-stop: The start and end ip # addresses for the ip pool range-start = 64.202.227.1 range-stop = 64.202.229.254 # netmask: The network mask used for the ip's netmask = 255.255.255.0 # cache-size: The gdbm cache size for the db # files. Should be equal to the number of ip's # available in the ip pool cache-size = 768 SNIP*** Thanks, Marco

3 2

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)
by Reveal MAP 27 Jul '08

27 Jul '08

e: Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) > http://tinypaste.com/5b99b = Radiusd -X output. [snip] rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. //Normal, i am not willing to do PAP but mschapv2 <me> If you’re not using a module, disable it. All it’ll do is add latency, delays and unnecessary log messages. Comment it out ... lol, i deactivated chap module yet, i let pap cause sometimes i use "radtest" for test! but PAP, SQL module will be deactivated soon and we shall see. maybe monday or tuesday, you will have a clean log! please, stay connected to the post ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for glouglou with NT-Password //does the 3 previous lines means there is an error? what does "No Cleartext-Password configured means? <me> it means, it cannot find a clear text password in the backend data store, which it expects to do .. <Revealmap> pfiouh, previously with another version of freeradius and the same devices and the same config, doing thesame astype of authentication, iwas sure i had these two lines and encounterd no error! but i am not sure.! // what does LM-Password means? and if it's error, how could i correct it? <me> Check your configuration. All depends on so many things .. // ithought it was normal, as I am surewindows never sends "cleartext-Password" Oh, Windows sure has been using clear text passwords, so it then also has a need to be backwards compatible with itself, right? expand: --username=%{mschap:User-Name}-> --username=glouglou //...???... mschap2: d1 expand: --challenge=%{mschap:Challenge:-00} -> --challenge=4a2a69e7929b2c03 //...???... expand: --nt-response=%{mschap:NT-Response:-00}} -> --nt-response=e9ea7e1669ef48501476149962484763f8f98b93fca2ced6} //...???... Exec-Program output: NT_KEY: 067F1C60B6DDB9D2802A458C4EFE22C1 //...???... Exec-Program-Wait: plaintext: NT_KEY: 067F1C60B6DDB9D2802A458C4EFE22C1 //...???... //negociation that is out of the range of my brain till now, but i think ity's normal security negociation in windows system, and there is no error here. Exec-Program: returned: 0 //...???... rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success //...???... if MSCHAP Success, where is the matter with this module??? <me> what makes you believe there is a problem at this stage? <Revealmap I was just showing to sergionthat i think mschapv2 module is correct ++[eap] returns handled } # server (null) //...???... PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x011200331a0311002e533d31303435323031393932463633443944424132303644424643343341413242354132313236344636 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x95b92b9094ab31501a0a30daea5106ca PEAP: Processing from tunneled session code 0x81b78d8 11 EAP-Message = 0x011200331a0311002e533d31303435323031393932463633443944424132303644424643343341413242354132313236344636 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x95b92b9094ab31501a0a30daea5106ca PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 164 to 10.10.44.246 port 1042 EAP-Message = 0x0112004a1900170301003f9d2524cd5e275d581a614935870e9c19c11e3a4e05332e915ef1f0a46bed9a751bbc330d98db1e52e04119a926415da6ee52cb7e6cc6693a8f1bb8847a7af3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe8ed0301efff1a196c3b0024d8e45892 //...???... and then What? and why its stops..???... <me> why do I get the feeling that if Message-Authenticator is all zeros, it is a “nope, not going to happen mate” type return, effectively stopping any further processing. Why I have no idea .. Alan?? <Revealmap the NAS sends message authenticator, but what happens here? (see below) and um... isn't it cleartext-password received here?? rad_recv: Access-Request packet from host 10.10.44.246 port 1042, id=157, length=168 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 2 Called-Station-Id = "00-1C-F0-08-FB-FA:PEAP" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020a001401504c55544f4e5c676c6f75676c6f75 Message-Authenticator = 0x89dbb5baabca7b646ff74e7a0372d4d2 [cut out bits that are not relevant, nor commented, nor anything. Let’s trim messages folks. If it’s not used or relevant, get rid of it.. It only takes space] _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)
by Reveal MAP 27 Jul '08

27 Jul '08

hmm... it's true i didn't test authentication with another laptop! i will! and i will too with secureW2 instead ofXP built-in wireless manager, and see!! > see the logf there: http://tinypaste.com/5b99b Your problem is nothing to do with certificates. The PEAP tunnel gets setup correctly, the MS-CHAP client->server auth succeeds, but the final server->client (mutual) auth appears to fail. This could be for a number of reasons, but it's a problem at the client side. You will need to debug it at the client side. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)
by Reveal MAP 27 Jul '08

27 Jul '08

I read the post: "PEAP or TTLS and Microsoft Vista". what i remain is i have to test another wireless mlanager differentthan trhe built-in of windows XP. ok, i will as soon as i will be infront of the server (no chance, it's week-end now) ----- Message d'origine ---- De : nf-vale <nf-vale(a)critical-links.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Vendredi, 25 Juillet 2008, 20h51mn 58s Objet : Re : Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) Are you using vista supplicant? By reading the last lines of your radius debug file it seems so... See earlier posts with subject: "PEAP or TTLS and Microsoft Vista". Sex, 2008-07-25 às 17:10 +0000, Reveal MAP escreveu: > > > > installing ca.der and putting user && pass into client machine, the > authentication doesn't work? > > -- no, it doesn't! > > > you only need ca.der but, if you have an active directory like > LDAP, > check if your comunication with AD server also have tls > authentication. > Into ldap module you can configurate another tls block, which it's > different than tls block into eap module. > > -- Well, the howto espalaining how freeradius has to authenticate > users against Active Directory says nothing about ldap config files on > linux server. it just gives tips about samba, using winbind, > ntlm_auth, krb5.conf, nsswitch.conf and mschap module in freeradius. > I ever success this kind of authentication without reading or changing > a line of ldap module in freeradius. > and i think, authenticating users against Openldap won't be managed > like authentication of freeradius using active directory. > > >I don't know if it is your problem, but I suppose that comunication > between ldap server and radius can have different certificates, from > different ca's than eap comunication. > > > my wireless network is secured with wpa/wpa2 entreprise, requiring a > RADIUS server to perform authentication. so i am doing 802.1x > authentication which exploit a valid PKI,regardless of the base of > users. this is how i understand it. > > > If it is your problem, I would > check it. also would be good you post de debug of radius to see which > certificate can't validate. > > see the logf there: http://tinypaste.com/5b99b > active and valid user is: > login: glouglou > password: glouglou > > aaa:~ # ntlm_auth --username=glouglou --request-nt-key --domain=PLUTON > password: > NT_STATUS_OK: Success (0x0) > aaa:~ # > > > :/ Any help will be appreciated. these days i am wondering about > validity of the Server certificate! > I have to tell you that, in my case, if i try a peap authentication > against Active Directoiry with wrong users credentials, i have an > error message saying that login or password is incorrect. with good > users credential, i just obtain what you can see in the Radiusd -X > output (http://tinypaste.com/5b99b) > > thank you > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > ______________________________________________________________________ > Envoyé avec Yahoo! Mail. > Une boite mail plus intelligente. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

Re : Re : Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)
by Reveal MAP 26 Jul '08

26 Jul '08

> installing ca.der and putting user && pass into client machine, the authentication doesn't work? -- no, it doesn't! > you only need ca.der but, if you have an active directory like LDAP, check if your comunication with AD server also have tls authentication. Into ldap module you can configurate another tls block, which it's different than tls block into eap module. -- Well, the howto espalaining how freeradius has to authenticate users against Active Directory says nothing about ldap config files on linux server. it just gives tips about samba, using winbind, ntlm_auth, krb5.conf, nsswitch.conf and mschap module in freeradius. I ever success this kind of authentication without reading or changing a line of ldap module in freeradius. and i think, authenticating users against Openldap won't be managed like authentication of freeradius using active directory. >I don't know if it is your problem, but I suppose that comunication between ldap server and radius can have different certificates, from different ca's than eap comunication. my wireless network is secured with wpa/wpa2 entreprise, requiring a RADIUS server to perform authentication. so i am doing 802.1x authentication which exploit a valid PKI,regardless of the base of users. this is how i understand it. > If it is your problem, I would check it. also would be good you post de debug of radius to see which certificate can't validate. see the logf there: http://tinypaste.com/5b99b active and valid user is: login: glouglou password: glouglou aaa:~ # ntlm_auth --username=glouglou --request-nt-key --domain=PLUTON password: NT_STATUS_OK: Success (0x0) aaa:~ # :/ Any help will be appreciated. these days i am wondering about validity of the Server certificate! I have to tell you that, in my case, if i try a peap authentication against Active Directoiry with wrong users credentials, i have an error message saying that login or password is incorrect. with good users credential, i just obtain what you can see in the Radiusd -X output (http://tinypaste.com/5b99b) thank you - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

4 4

Re : Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)
by Reveal MAP 25 Jul '08

25 Jul '08

> But I think this problem do not affect peap because peap do not use > client certs, you only need to install ca.der into client machine and > put the passwords i refer to that: > so my question is, if the certificate (with server extension) is missing on the client, could it interfer in EAP-PEAP authentication success? yes. you need a RADIUS cert with the extensions...and if doing proper PEAP, you need the CA installed on the client too - with 'validate server certificate' checked and cross-linked (ie you choose the correct CA in the list!) alan really?? it seems to affect PEAP too when freeradius authenticates against Active Directory. if i understood well,PEAP authentication need client side a login + password and server side a certificate in order to the authentication process to success! so, which certificate have i to install on client side? - i did ever try ca.der with no success! 'after an access-challenge, the request simply stops. - i am trying sever.crt too, with no more success. i install it in intermediate authority containeer,but it won't be available in the list of the wireless manager of xp. if you have a suggestion, i am open! ----- Message d'origine ---- De : Sergio <sergioyebenes(a)alumnos.upm.es> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Vendredi, 25 Juillet 2008, 13h20mn 54s Objet : Re: Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) Reveal MAP escribió: > HOW TO FIX THE PROBLEM OF THE ISSUER of clients certificates in > default configuration? > > - this bug is suspected to make i can't do EAP-PEAP and affect the CRL > management too. it's a real problem > > > > ----- Message d'origine ---- > De : Alan DeKok <aland(a)deployingradius.com> > À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Envoyé le : Jeudi, 24 Juillet 2008, 19h54mn 32s > Objet : Re: cert bootstrap bug? (was Re: definitively, I have a > problem with eap-tls) > > Sergio wrote: > > But the debug I posted shows that radius doesn't recognize the issuer of > > client cert using default certs. If default certs works and I don't need > > to install server.pem and ca.pem into ssl/certs dir, what I'm forgetting > > alan? > > You need to follow the documentation in eap.conf. > > # If CA_file (below) is not used, then the > # certificate_file below MUST include not > # only the server certificate, but ALSO all > # of the CA certificates used to sign the > # server certificate. > certificate_file = ${certdir}/server.pem > > Have you done that? > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------------------------------------------------ > Envoyé avec Yahoo! Mail > <http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/…>. > Une boite mail plus intelligente. > But I think this problem do not affect peap because peap do not use client certs, you only need to install ca.der into client machine and put the passwords - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)
by Reveal MAP 25 Jul '08

25 Jul '08

HOW TO FIX THE PROBLEM OF THE ISSUER of clients certificates in default configuration? - this bug is suspected to make i can't do EAP-PEAP and affect the CRL management too. it's a real problem ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Jeudi, 24 Juillet 2008, 19h54mn 32s Objet : Re: cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) Sergio wrote: > But the debug I posted shows that radius doesn't recognize the issuer of > client cert using default certs. If default certs works and I don't need > to install server.pem and ca.pem into ssl/certs dir, what I'm forgetting > alan? You need to follow the documentation in eap.conf. # If CA_file (below) is not used, then the # certificate_file below MUST include not # only the server certificate, but ALSO all # of the CA certificates used to sign the # server certificate. certificate_file = ${certdir}/server.pem Have you done that? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1