- Freeradius-Users - lists.freeradius.org

WPA-Enterprise with TTLS fails to authenticate (from Windows ok, but Linux fails).
by Janusz Syrytczyk 24 Sep '07

24 Sep '07

Hello, I'm running WPA-Enterprise with TTLS authentication and LDAP backend. Config was running fine since 1,5 year. Problem is that I cannot authenticate to my network with wpa_supplicant, although I could, and from Windows & Secure2w TTLS wrapper - I can. I use Gentoo and did some upgrades (but nothing special I guess, kernel is the same, and wpa_supplicant also) My eap.conf: eap { default_eap_type = mschapv2 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } tls { private_key_file = ${raddbdir}/certs/radius1.uni.opole.pl.key certificate_file = ${raddbdir}/certs/radius1.uni.opole.pl.pem CA_path = ${raddbdir}/certs/ CA_file = ${raddbdir}/certs/ca.uni.opole.pl.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 check_cert_cn = %{User-Name} #check_crl = yes crl_dir = /etc/raddb/certs proxy_tunneled_request_as_eap = yes } peap { default_eap_type = mschapv2 } ttls { default_eap_type = md5 copy_request_to_tunnel = yes use_tunneled_reply = yes } mschapv2 { } } My wpa_supplicant.conf ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=0 eapol_version=1 fast_reauth=1 update_config=0 network={ ssid="eduroam" scan_ssid=1 proto=WPA key_mgmt=WPA-EAP pairwise=TKIP eap=TTLS identity="jsyrytczyk(a)uni.opole.pl" password="mycorrectpassword" ca_cert="/etc/wpa_supplicant/ca.uni.opole.pl.pem" phase2="auth=PAP" } My error: Ready to process requests. rad_recv: Access-Request packet from host 217.173.193.40:4347, id=89, length=205 User-Name = "jsyrytczyk(a)uni.opole.pl" Framed-MTU = 1400 Called-Station-Id = "0019.a9b5.3a01" Calling-Station-Id = "0002.7258.7f14" Cisco-AVPair = "ssid=eduroam" Service-Type = Login-User Message-Authenticator = 0x2e72d462f1fb588c9674049e6b61e580 EAP-Message = 0x0201001c016a7379727974637a796b40756e692e6f706f6c652e706c NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "461" NAS-Port = 461 NAS-IP-Address = 10.59.223.247 NAS-Identifier = "AP1242_eduroam_CI" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: Looking up realm "uni.opole.pl" for User-Name = "jsyrytczyk(a)uni.opole.pl" rlm_realm: Found realm "uni.opole.pl" rlm_realm: Proxying request from user jsyrytczyk to realm uni.opole.pl rlm_realm: Adding Realm = "uni.opole.pl" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_acct_unique: WARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing 'NAS-Port = 461,Client-IP-Address = 217.173.193.40,NAS-IP-Address = 10.59.223.247,,User-Name = "jsyrytczyk(a)uni.opole.pl"' rlm_acct_unique: Acct-Unique-Session-ID = "0e208dc42b670eee". modcall[authorize]: module "acct_unique" returns ok for request 0 radius_xlat: 'jsyrytczyk(a)uni.opole.pl' rlm_attr_rewrite: Added attribute Stripped-User-Name with value 'jsyrytczyk(a)uni.opole.pl' modcall[authorize]: module "copy.user-name" returns ok for request 0 radius_xlat: '@.*$' rlm_attr_rewrite: Changed value for attribute Stripped-User-Name from 'jsyrytczyk(a)uni.opole.pl' to 'jsyrytczyk' modcall[authorize]: module "strip.user-name" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for jsyrytczyk(a)uni.opole.pl radius_xlat: '(&(objectClass=VirtualMailAccount) (mail=jsyrytczyk(a)uni.opole.pl)(accountActive=TRUE)(delete=FALSE))' radius_xlat: 'o=hosting,dc=uo,dc=opole,dc=pl' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 217.173.193.3:389, authentication 0 rlm_ldap: bind as cn=dovecot,dc=uo,dc=opole,dc=pl/hereismyldapdatabasepass to 217.173.193.3:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=hosting,dc=uo,dc=opole,dc=pl, with filter (&(objectClass=VirtualMailAccount)(mail=jsyrytczyk(a)uni.opole.pl) (accountActive=TRUE)(delete=FALSE)) rlm_ldap: checking if remote access for jsyrytczyk(a)uni.opole.pl is allowed by dialupAccess rlm_ldap: Password header not found in password {CRYPT}hash for user jsyrytczyk(a)uni.opole.pl rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password == "{CRYPT}hash" rlm_ldap: looking for reply items in directory... rlm_ldap: user jsyrytczyk(a)uni.opole.pl authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_eap: EAP packet type response id 1 length 28 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 89 to 217.173.193.40 port 4347 EAP-Message = 0x010200311a0102002c10124897b1c632a0dd9edec5d89e10c5bc6a7379727974637a796b40756e692e6f706f6c652e706c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcdc132917ef520c9537ed9cbb1481929 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 217.173.193.40:4347, id=90, length=201 User-Name = "jsyrytczyk(a)uni.opole.pl" Framed-MTU = 1400 Called-Station-Id = "0019.a9b5.3a01" Calling-Station-Id = "0002.7258.7f14" Cisco-AVPair = "ssid=eduroam" Service-Type = Login-User Message-Authenticator = 0x1290a4533963f73ed925dec295cbefdf EAP-Message = 0x020200060315 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "461" NAS-Port = 461 State = 0xcdc132917ef520c9537ed9cbb1481929 NAS-IP-Address = 10.59.223.247 NAS-Identifier = "AP1242_eduroam_CI" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_realm: Looking up realm "uni.opole.pl" for User-Name = "jsyrytczyk(a)uni.opole.pl" rlm_realm: Found realm "uni.opole.pl" rlm_realm: Proxying request from user jsyrytczyk to realm uni.opole.pl rlm_realm: Adding Realm = "uni.opole.pl" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 rlm_acct_unique: WARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing 'NAS-Port = 461,Client-IP-Address = 217.173.193.40,NAS-IP-Address = 10.59.223.247,,User-Name = "jsyrytczyk(a)uni.opole.pl"' rlm_acct_unique: Acct-Unique-Session-ID = "0e208dc42b670eee". modcall[authorize]: module "acct_unique" returns ok for request 1 radius_xlat: 'jsyrytczyk(a)uni.opole.pl' rlm_attr_rewrite: Added attribute Stripped-User-Name with value 'jsyrytczyk(a)uni.opole.pl' modcall[authorize]: module "copy.user-name" returns ok for request 1 radius_xlat: '@.*$' rlm_attr_rewrite: Changed value for attribute Stripped-User-Name from 'jsyrytczyk(a)uni.opole.pl' to 'jsyrytczyk' modcall[authorize]: module "strip.user-name" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for jsyrytczyk(a)uni.opole.pl radius_xlat: '(&(objectClass=VirtualMailAccount) (mail=jsyrytczyk(a)uni.opole.pl)(accountActive=TRUE)(delete=FALSE))' radius_xlat: 'o=hosting,dc=uo,dc=opole,dc=pl' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=hosting,dc=uo,dc=opole,dc=pl, with filter (&(objectClass=VirtualMailAccount)(mail=jsyrytczyk(a)uni.opole.pl) (accountActive=TRUE)(delete=FALSE)) rlm_ldap: checking if remote access for jsyrytczyk(a)uni.opole.pl is allowed by dialupAccess rlm_ldap: Password header not found in password {CRYPT}hashed for user jsyrytczyk(a)uni.opole.pl rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password == "{CRYPT}hashed" rlm_ldap: looking for reply items in directory... rlm_ldap: user jsyrytczyk(a)uni.opole.pl authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall[authorize]: module "files" returns notfound for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/ttls rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 90 to 217.173.193.40 port 4347 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf7496deb8d0573d9ee6c13a2b51ba8bc Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 217.173.193.40:4347, id=91, length=201 User-Name = "jsyrytczyk(a)uni.opole.pl" Framed-MTU = 1400 Called-Station-Id = "0019.a9b5.3a01" Calling-Station-Id = "0002.7258.7f14" Cisco-AVPair = "ssid=eduroam" Service-Type = Login-User Message-Authenticator = 0xed18d300aabdabba014117f1b2bca527 EAP-Message = 0x020200060315 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "461" NAS-Port = 461 State = 0xf7496deb8d0573d9ee6c13a2b51ba8bc NAS-IP-Address = 10.59.223.247 NAS-Identifier = "AP1242_eduroam_CI" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_realm: Looking up realm "uni.opole.pl" for User-Name = "jsyrytczyk(a)uni.opole.pl" rlm_realm: Found realm "uni.opole.pl" rlm_realm: Proxying request from user jsyrytczyk to realm uni.opole.pl rlm_realm: Adding Realm = "uni.opole.pl" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 2 rlm_acct_unique: WARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing 'NAS-Port = 461,Client-IP-Address = 217.173.193.40,NAS-IP-Address = 10.59.223.247,,User-Name = "jsyrytczyk(a)uni.opole.pl"' rlm_acct_unique: Acct-Unique-Session-ID = "0e208dc42b670eee". modcall[authorize]: module "acct_unique" returns ok for request 2 radius_xlat: 'jsyrytczyk(a)uni.opole.pl' rlm_attr_rewrite: Added attribute Stripped-User-Name with value 'jsyrytczyk(a)uni.opole.pl' modcall[authorize]: module "copy.user-name" returns ok for request 2 radius_xlat: '@.*$' rlm_attr_rewrite: Changed value for attribute Stripped-User-Name from 'jsyrytczyk(a)uni.opole.pl' to 'jsyrytczyk' modcall[authorize]: module "strip.user-name" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for jsyrytczyk(a)uni.opole.pl radius_xlat: '(&(objectClass=VirtualMailAccount) (mail=jsyrytczyk(a)uni.opole.pl)(accountActive=TRUE)(delete=FALSE))' radius_xlat: 'o=hosting,dc=uo,dc=opole,dc=pl' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=hosting,dc=uo,dc=opole,dc=pl, with filter (&(objectClass=VirtualMailAccount)(mail=jsyrytczyk(a)uni.opole.pl) (accountActive=TRUE)(delete=FALSE)) rlm_ldap: checking if remote access for jsyrytczyk(a)uni.opole.pl is allowed by dialupAccess rlm_ldap: Password header not found in password {CRYPT}hashed for user jsyrytczyk(a)uni.opole.pl rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password == "{CRYPT}hashed" rlm_ldap: looking for reply items in directory... rlm_ldap: user jsyrytczyk(a)uni.opole.pl authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 modcall[authorize]: module "files" returns notfound for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 2 modcall: leaving group authenticate (returns invalid) for request 2 auth: Failed to validate the user. Login incorrect: [jsyrytczyk(a)uni.opole.pl] (from client UniNet port 461 cli 0002.7258.7f14) Delaying request 2 for 1 seconds Finished request 2 Going to the next request Waking up in 6 seconds... Freeradius writes my password is incorrect, but of course it is correct. It also complains about bad {crypt} header, but it performs well with it when using Windows. Anyway, when I pass correct header or change it to any other in radiusd.conf it changes nothing. I substituted all passwords of course. -- Syrytczyk Janusz - Administrator serwerów Centrum Informatyczne Uniwersytetu Opolskiego Nr telefonu: +48 77 452-70-91 E-mail: jsyrytczyk(a)uni.opole.pl -- Syrytczyk Janusz - Administrator serwerów Centrum Informatyczne Uniwersytetu Opolskiego Nr telefonu: +48 77 452-70-91 E-mail: jsyrytczyk(a)uni.opole.pl

4 4

FreeRADIUS and iODBC
by Josh Howlett 24 Sep '07

24 Sep '07

You must use a DSN of 'radius' in odbc.ini when using the iodbc SQL module. You can't use any other name. I have this working against MSSQL. josh. JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxon OX11 0SG

2 1

EAP fragment size clarification needed
by Stefan Winter 24 Sep '07

24 Sep '07

Hi, eap.conf states: # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # # fragment_size = 1024 I wonder what the sentence about MAX packet size on APs is about. Is it their maximum allowed length of a RADIUS packet? Frankly, that would be quite stupid because packets can legitimately be much larger than that. (-> RADIUS implementation problem on AP) If it is about fragmented and re-assembled UDP: that would mean those APs can't re-assemble UDP properly (-> again implementation problem) finally, if it's about the max layer-2 size for the EAP conversation: then a fragment size of 1500 would be okay on a 1500 MTU on layer 2 (and if one only authenticates 802.3 LANs and 802.11 WLANs, both of them handle 1500 just fine). So I wonder, why does anything impose specifically 1500-1600 on the AP side, and why does that imply 1024 is an upper bound for the fragment size? That question doesn't come from thin air: higher fragment size reduces amount of round-trips for an EAP auth (even though it generates more UDP packets on the wire, sure). And with EAP-TLS, there are supplicants that fill their 1500 on the layer 2 unconfigurably, and it appears to work well - if there's no firewall that discards the second fragment of the RADIUS message. So if the above holds true, I would much rather set fragment size to 1500, and fix any upcoming impl problems that have nothing to do with EAP frag size, rather than yield with my frag size. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

3 2

simultaneous login
by Michael Ziemann 24 Sep '07

24 Sep '07

Hi ! I have a problem with simultaneous login. The user connects to the RADIUS Server, then the user appears in the MySQL-DB in the table radacct. But if the user disconnect, the user doesn't disappear in the table. If I remove the entry by myself, the user can connect again. In the table radreply i added an Idle-Timeout in the Attribut field with the value 5 and op = . I added also Idle-Timeout to radgroupreply to the group of user with the value 5. Regards Michael

2 1

RE: Vista Authentication
by Josh Howlett 24 Sep '07

24 Sep '07

Ensure that you're using a recent version of samba. Search the list for a value of 'recent'. josh. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Alan DeKok > Sent: 23 September 2007 14:26 > To: FreeRadius users mailing list > Subject: Re: Vista Authentication > > Iain Ellis wrote: > > Are there any known gotcha's concerning Vista clients > authenticating? > > Not that I know of. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxon OX11 0SG

1 0

RE: Support for SSO Active Directory & PEAP-MS-CHAP-v2
by Rakesh Jha 24 Sep '07

24 Sep '07

Can you please send steps, I am also trying to so the same. Rakesh ________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of rick wiltshire Sent: Sunday, September 23, 2007 4:48 PM To: freeradius-users(a)lists.freeradius.org Subject: Support for SSO Active Directory & PEAP-MS-CHAP-v2 Dear All, I need help with dot1x implementation in an Enterprise LAN. Our target is to authenticate and authorize users based on their identities (domain user names) as well as applying GPOs on users. Our authentication Backend is: Active Directory Our Authorization & Accounting is done by: freeRADIUS Authorization Attributes control VLAN assignment (hence, IP address pool) Required Authentication EAP-Type : PEAP & MS-CHAP All Clients are using WinXP supplicant. I managed to implement PEAP&MS-CHAP with this setup however with users who have cached credentials on their PCs. If the user logs on the PC for the first time, he fails to reach the active directory to authenticate since the connection is not yet authorized. So what I need is get the computer authenticated and assigned an IP address and then authenticate the user in a following phase while the connection is up. Any clues with authenticating domain machines using freeradius and active directory implementation? Attention: Any non-official business related views, opinions and other information presented in this electronic mail are solely those of the sender/author. Burgan Bank does not endorse or accept responsibility for their opinions. If you are not the addressed indicated in this mail or responsible for delivering this message to the intended, you should delete this message and notify the sender immediately. ------------------------------------------------------- Burgan Bank S.A.K www.burgan.com

1 0

[newbie] radutmp question
by Cheng-Lin Yang 23 Sep '07

23 Sep '07

Hi all, I have encountered a problem with radutmp. The information of my environment is a vpn service and auth with freeradius 1.1.7. The problem happened as below: 1. start up the radiusd 2. user "abc" connect to vpn, and I can use radwho to see "abc" user 3. shutdown radiusd 4. user disconnect from vpn server (radiusd not start yet) 5. start up radiusd, and radwho still shows "abc" is connected Is there any way to solve this problem? any suggestion is extremely welcomed. Thank you. :) Regards, clyang

3 4

Re: EAP (PEAP) MS-CHAPv2b how to
by Piero Giobbi 23 Sep '07

23 Sep '07

Hi riky. I had exactly the same problem, upgrading to 1.1.7 solved my problem (debian package is only at 1.1.3, didn't get Cleartext-Password to work there either). Just upgrade, all of you whos not running 1.1.7!! : ) And why use :=? Not == (more secure)? Thx. On Sep 21, 2007, at 4:36 PM, freeradius-users- request(a)lists.freeradius.org wrote: > From: "riky.none" <riky.none(a)email.it> > Date: September 21, 2007 3:03:18 PM GMT+02:00 > To: FreeRadius users mailing list <freeradius- > users(a)lists.freeradius.org> > Subject: Re: EAP (PEAP) MS-CHAPv2b how to > Reply-To: FreeRadius users mailing list <freeradius- > users(a)lists.freeradius.org> > > > Alan DeKok ha scritto: >> riky.none wrote: >> >>> I configure freeradius on basic autentication mode (using file >>> /etc/freeradius/users) >>> >>> paperino Auth-Type := Local, User-Password == "paperino" >>> >>> topolino Auth-Type := EAP, User-Password == "topolino" >>> >> >> (1) DO NOT SET AUTH-TYPE >> (2) Use Cleartext-Password := ... >> NOT User-Password == >> >> >>> rlm_eap: No such EAP type peap >>> >> >> Read eap.conf. >> >> >>> I want use autentication without certificate >>> >> >> If you're using PEAP, you need a server certificate. >> >> >>> HOW TO configuration WIFI (cliente xp) and freeradius using EAP/ >>> PEAP ??? >>> >> >> See the Wiki. This is covered there. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/ >> list/users.html >> >> . >> >> > not hangry Alan > > I feel really stupid now... > > i insert in users file: > > myuser Cleartext-Password := "somepass" > > run freeradius -X > /etc/freeradius/users[219]: Parse error (check) for entry myuser: > Unknown attribute "Cleartext-Password" > > eap config is not easy to read (for newbie) > > There is one basic howto to configure freeradius using TTLS??? > > in wiki i not find one basic howto EAP-TTSL

2 1

Support for SSO Active Directory & PEAP-MS-CHAP-v2
by rick wiltshire 23 Sep '07

23 Sep '07

Dear All, I need help with dot1x implementation in an Enterprise LAN. Our target is to authenticate and authorize users based on their identities (domain user names) as well as applying GPOs on users. Our authentication Backend is: Active Directory Our Authorization & Accounting is done by: freeRADIUS Authorization Attributes control VLAN assignment (hence, IP address pool) Required Authentication EAP-Type : PEAP & MS-CHAP All Clients are using WinXP supplicant. I managed to implement PEAP&MS-CHAP with this setup however with users who have cached credentials on their PCs. If the user logs on the PC for the first time, he fails to reach the active directory to authenticate since the connection is not yet authorized. So what I need is get the computer authenticated and assigned an IP address and then authenticate the user in a following phase while the connection is up. Any clues with authenticating domain machines using freeradius and active directory implementation?

2 1

Vista Authentication
by Iain Ellis 23 Sep '07

23 Sep '07

Hello Are there any known gotcha's concerning Vista clients authenticating? I'm running 1.1.7 with my certificates compiled with xpextensions and I can't get a Vista client to go beyond Sending Access-Challenge when authenticating. XP clients are authenticating OK, just not Vista. I'm authenticating to NDS via LDAP. Any suggestions\thoughts gratefully received Rgds, Iain --------------------------------------------------------------------------- This email and any attachment(s) is intended for and confidential to the addressee. If you are neither the addressee nor an authorised recipient for the addressee please notify us of receipt, delete this message from your system and do not use, copy or disseminate the information in, or attached to it, in any way. Our messages are checked for viruses but please note that we do not accept liability for any viruses which may be transmitted in or with this message. --------------------------------------------------------------------------- The College of Law of England and Wales. Registered charity No 271297 ---------------------------------------------------------------------------

2 1