- Freeradius-Users - lists.freeradius.org

(no subject)
by Adnan Miljkovic 30 Nov '13

30 Nov '13

Hello, I am trying to use exec to check if a user in valid in a custom PHP script, what I would like is to get multiple attributes returned. I created a module as: ======================================================================= exec checkuser { wait = yes input_pairs = request output_pairs = reply program = "/etc/raddb/check-user.php -log -debug '%{User-Name}' '%{User-Password}'" shell_escape = yes } ======================================================================= and then activated it in the "authorize" section. The check-user.php script I would like to output the following: ======================================================================= <?php echo "Access-Accept = Accept"; // I used also commas.. same error echo "Mikrotik-Group = student"; echo "Mikrotik-Rate-Limit = 1564k/6400k"; So howevery I am echo-ing these I just get: "Exec format error" ======================================================================== [checkuser] expand: '%{User-Name}' -> 'AC:81:F3:63:7D:07' [checkuser] expand: '%{User-Password}' -> '' Exec-Program output: Exec-Program: FAILED to execute /etc/raddb/check-user.php: Exec format error Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute /etc/raddb/check-user.php: Exec format error Exec-Program: returned: 1 ++[checkuser] returns reject ====================================================================== What is the correct way to return multiple attributes in PHP All help is appreciated, that you. Adnan

3 2

Throttle Authentication Requests
by Fahad Saleem 30 Nov '13

30 Nov '13

Greetings All, What would be the best way to rate limit the number of authentication requests. Our current setup has one server doing 150 Auths per sec but under certain circumstances during GGSN migrations the auths per seconds go up to 1000 for a 20 to 30 minute period before things start to calm down. So I was wondering if this was possible in anyway from the freeradius end, kind of as a safe guard. I've looked at the rlm_cache module and the idea of getting packets dropped is a bit scary. Any thoughts about this will be appreciated! Regards

2 1

mySQL SSL Support
by Scott Pettit - Vorco 29 Nov '13

29 Nov '13

Hi, We¹re running FreeRADIUS 2.1.10 on Ubuntu. We¹d like to have the mySQL connections running over SSL. I can¹t find anything in the documentation about it but I found this patch from a long time ago http://dev.gentoo.org/~wschlich/src/freeradius-1.0.2-mysql-ssl.patch Is SSL supported on the mySQL driver and if so how do I specify the location of my SSL CA Cert and enable SSL? -Scott ________________________________ The content of this message and any attachments may be privileged, confidential or sensitive. Any unauthorised used is prohibited. Views expressed in this message are those of the individual sender, except where stated otherwise with appropriate authority. All pricing provided is valid at the time of writing only and due to factors such as the exchange rate, may change without notice. Sales are made subject to our Terms & Conditions, available on our website or on request. ________________________________

2 2

Possible to check certain SQL values in freeradius?
by Muhammad Nuzaihan Bin Kamal Luddin 29 Nov '13

29 Nov '13

Hi, Typically, FreeRADIUS would be using selects by using one value - %{Packet-Src-IP-Address}. I would like to know the secret it is using to communicate with the freeradius to compare on our user database. (the user actually generates these secrets and implement it into their NAS) Is there other ways to do it (even using other than secrets?) or do i have to depend solely on Packet-Src-IP-Address? I am doing more development than doing implementation myself and i am seeing all the secret values seemed to be transparent to the freeradius configuration itself (for building applications on top of it) Thanks, Muhammad Nuzaihan -- Taqi Systems 269-J Jalan Panji Kampung Chempaka, Kota Bharu, Kelantan 16100 Phone: +6097738657 Mobile: +60199788657 pub 4096R/4C77F88C 2013-04-06 [expires: 2015-04-06] Key fingerprint = 2FE1 87FA E775 2E05 CC0F B3F6 3CB7 C65F 4C77 F88C uid Muhammad Nuzaihan Bin Kamal Luddin <muhammad(a)taqisystems.com>

2 1

Max length of SQl return string?
by Alexander Silveröhrt 29 Nov '13

29 Nov '13

Hello, We are doing a query which are supposed to comeback with a bunch of subscriber accounts. update request { Subscriber-Accounts := "%{sql-cisco-bng:SELECT GROUP_CONCAT(username SEPARATOR ';') FROM radcheck WHERE username LIKE '%{User-Name}%%'}" } But it seems that there is a limit on how long the return string can be? In this case a query for acccount for user "10.33.2.3_GigabitEthernet0/0/2" did return below accounts but the return query cuts off after a while. (And yes port 1 and port 2 also gets account for 10-19 and 20-22 which is why we noticed this bugg/feature..?) 10.33.2.3_GigabitEthernet0/0/21 10.33.2.3_GigabitEthernet0/0/20 CH_VoIP 10.33.2.3_GigabitEthernet0/0/20 CH_IPTV 10.33.2.3_GigabitEthernet0/0/20 10.33.2.3_GigabitEthernet0/0/2 KAL_IPTV 10.33.2.3_GigabitEthernet0/0/20 KAL_IPTV 10.33.2.3_GigabitEthernet0/0/2 Here is from the debug where one can see where it gets cut off rlm_perl: sub-pre-auth: Debug: RAD_REQUEST in sub authorize: Subscriber-Accounts = 10.33.2.3_GigabitEthernet0/0/21;10.33.2.3_GigabitEthernet0/0/20 CH_VoIP;10.33.2.3_GigabitEthernet0/0/20 CH_IPTV;10.33.2.3_GigabitEthernet0/0/20;10.33.2.3_GigabitEthernet0/0/2 KAL_IPTV;10.33.2.3_GigabitEthernet0/0/20 KAL_IPTV;10.33.2.3_GigabitEth And and after splitted rlm_perl: sub-pre-auth: i = 0, SQL Found Account[0]: 10.33.2.3_GigabitEthernet0/0/21 rlm_perl: sub-pre-auth: i = 1, SQL Found Account[1]: 10.33.2.3_GigabitEthernet0/0/20 CH_VoIP rlm_perl: sub-pre-auth: i = 2, SQL Found Account[2]: 10.33.2.3_GigabitEthernet0/0/20 CH_IPTV rlm_perl: sub-pre-auth: i = 3, SQL Found Account[3]: 10.33.2.3_GigabitEthernet0/0/20 rlm_perl: sub-pre-auth: i = 4, SQL Found Account[4]: 10.33.2.3_GigabitEthernet0/0/2 KALEJDO_IPTV rlm_perl: sub-pre-auth: i = 5, SQL Found Account[5]: 10.33.2.3_GigabitEthernet0/0/20 KALEJDO_IPTV rlm_perl: sub-pre-auth: i = 6, SQL Found Account[6]: 10.33.2.3_GigabitEth So my question is if there is a limitation can i change it somewhere and why is there one in the first place? We temporary fixed it by a better matched SQL query which doesnt give us accounts we are not asking for.. Subscriber-Accounts := "%{sql-cisco-bng:SELECT GROUP_CONCAT(username SEPARATOR ';') AS FOO_RID FROM radcheck WHERE username LIKE '%{User-Name} %' OR username = '%{User-Name}'}" but it is still going to give us problems in the future since users can have more than above exemples of accounts. Thanks for your time. Alex ********* DISCLAIMER ********* This message and any attachment are confidential and may be privileged or otherwise protected from disclosure and may include proprietary information. If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system. If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person

3 3

Yet another Freeradius+openldap eap-ttls pap issue
by Work 28 Nov '13

28 Nov '13

Hi there, this is my first post on the list and It's always a shame to start with a problem :) . I woul like to implement a freeradius authentication server that uses openldap as backend and supports both pap authentication (for the VPN client) and eap -ttls pap for the wi-fi lan. I think I've successfullyconfigured freeradius for the pap authentication with openldap since the radtest returns ok. In the ldap module I've also enabled the groupcheck since in my company they want to restrict vpn access through ldap group membership. This works great. To to this I've removed the comment from the groupcheck and added to the user file thinks like this: 188:DEFAULT LDAP-Group=="vpntest" 189: Reply-Message="Test per VPN", 190: Class="vpntest", 191: Fall-Through = Yes is this ugly? My company does not want to add radiuschema to the users. Ok now just forget for the small OT and let's focus on the real problem. These are the configs: root@ldap:/etc/freeradius# egrep -v '(#|^\s*$)' modules/ldap ldap { server = "test-ldap.newenergygroup.com" identity = "cn=admin,dc=newenergygroup,dc=com" password = XXXXXXXXX basedn = "dc=newenergygroup,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" password_attribute = userPassword ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = radiusGroupName } egrep -v '(#|^\s*$)' sites-enabled/default authorize { preprocess chap mschap suffix eap { ok = return } files ldap expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } root@ldap:/etc/freeradius# egrep -v '(#|^\s*$)' eap.conf eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 md5 { } leap { } gtc { auth_type = PAP } tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" cache { enable = no max_entries = 255 } } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } } I'm testing the eap eapol_test -c eap_pool_test_config -a 127.0.0.1 -p 1812 -s testing123 -r1 and the config is: network={ eap=TTLS ssid="example" eapol_flags=0 key_mgmt=WPA-EAP identity="atest" password="atest" #ca_cert="/etc/freeradius/certs/ccaa.pem" phase2="auth=PAP" } the debug from radius is: rad_recv: Access-Request packet from host 127.0.0.1 port 33653, id=0, length=118 User-Name = "atest" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000a016174657374 Message-Authenticator = 0xf57a3eb5217b5475fcd4acf2ab929c6c +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "atest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] Entering ldap_groupcmp() [files] expand: dc=newenergygroup,dc=com -> dc=newenergygroup,dc=com [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> atest [files] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=atest) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to test-ldap.newenergygroup.com:389, authentication 0 [ldap] bind as cn=admin,dc=newenergygroup,dc=com/Ld4pPa$$w0rD to test-ldap.newenergygroup.com:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=newenergygroup,dc=com, with filter (uid=atest) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=newenergygroup,dc=com, with filter (&(cn=vpnfullaccess)(|(&(objectClass=GroupOfNames)(member=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in uid=atest,ou=people,dc=newenergygroup,dc=com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: ldap_get_values() failed [ldap] ldap_release_conn: Release Id: 0 [ldap] Entering ldap_groupcmp() [files] expand: dc=newenergygroup,dc=com -> dc=newenergygroup,dc=com [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=newenergygroup,dc=com, with filter (&(cn=vpnlowaccess)(|(&(objectClass=GroupOfNames)(member=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in uid=atest,ou=people,dc=newenergygroup,dc=com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: ldap_get_values() failed [ldap] ldap_release_conn: Release Id: 0 [ldap] Entering ldap_groupcmp() [files] expand: dc=newenergygroup,dc=com -> dc=newenergygroup,dc=com [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=newenergygroup,dc=com, with filter (&(cn=vpntest)(|(&(objectClass=GroupOfNames)(member=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in uid=atest,ou=people,dc=newenergygroup,dc=com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: ldap_get_values() failed [ldap] ldap_release_conn: Release Id: 0 [ldap] Entering ldap_groupcmp() [files] expand: dc=newenergygroup,dc=com -> dc=newenergygroup,dc=com [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=newenergygroup,dc=com, with filter (&(cn=vpntestadmin)(|(&(objectClass=GroupOfNames)(member=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3datest\2cou\3dpeople\2cdc\3dnewenergygroup\2cdc\3dcom)))) rlm_ldap::ldap_groupcmp: User found in group vpntestadmin [ldap] ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 193 ++[files] returns ok [ldap] performing user authorization for atest [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> atest [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=atest) [ldap] expand: dc=newenergygroup,dc=com -> dc=newenergygroup,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=newenergygroup,dc=com, with filter (uid=atest) [ldap] Added User-Password = {MD5}tQzXLan1f4v2iAMD/1t2Ig== in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user atest authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = LDAP +- entering group LDAP {...} [ldap] Attribute "User-Password" is required for authentication. You seem to have set "Auth-Type := LDAP" somewhere. THAT CONFIGURATION IS WRONG. DELETE IT. YOU ARE PREVENTING THE SERVER FROM WORKING PROPERLY. ++[ldap] returns invalid Failed to authenticate the user. Login incorrect: [atest] (from client localhost port 0 cli 02-00-00-00-00-01) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> atest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 0 to 127.0.0.1 port 33653 Reply-Message = "Test per VPN ADMIN" Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +23 Ready to process requests. Thank you :), hope I'm not missing somithing stupid, I've read a lot of documentation here and there. ps. password on the LDAP are stored in hash form.

5 9

[v3] LDAP access_attribute
by Hachmer, Tobias 28 Nov '13

28 Nov '13

Hello list members, what are the considerations to change the behavior regarding "access_attribute" in ldap from the "access_attr" in v2? >From a ldap perspective is it easier to administer user objects in ldap when you can see directly if a user has access or not. Is there a chance to get the simple boolean test back in v3? Kind regards, Tobias Hachmer

2 4

FreeRADIUS 3 LDAP Questions
by Hachmer, Tobias 28 Nov '13

28 Nov '13

Hello list members, I am migrating here from FreeRADIUS v2 to v3 and have some questions regarding the ldap module. As I understand everyone has to do the LDAP Attribute Mapping manually: - It would be much easier if the old ldap.attrmap would be translated already, maybe commented. - All checkItems have to defined with "control: ... := ..."? valuepair_attribute - Can I define multiple valuepair attributes? I just want radiusCheckItem and radiusReplyItem By default there are no hardcoded attribute mappings? Our servers here just asking a read-only ldap server. The new accounting options of the ldap module need to write to ldap. - Would it be sufficient just to comment the whole accounting and post-auth section if we do not need them? Kind regards, Tobias Hachmer

2 6

Update of Radhuntgroup table via dynamic client
by Muhammad Nuzaihan Bin Kamal Luddin 28 Nov '13

28 Nov '13

Hi, I am working out a modification of the dynamic-client to update the radhuntgroups when the dynamic-client (nas) table is updated. For every user added, it will be added to the radhuntgroup ("groupname" column will be the same as "shortname" column in nas table) But when the nas is accessing the freeradius and got in via the shared secret. i was looking at updating the radhuntgroup table with the "groupname" column with the IP address - so i can allow this dynamic NAS to authenticate these users from radhuntgroup via that IP. if ("%{sql: SELECT nasname FROM accesspoints WHERE nasname = '%{Packet-Src-IP-Address}'}") { update control { # # Echo the IP. # FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" # # Do multiple SELECT statements to grab # the various definitions. FreeRADIUS-Client-Shortname = "%{sql: SELECT shortname FROM accesspoints WHERE nasname = '%{Packet-Src-IP-Address}'}" FreeRADIUS-Client-Secret = "%{sql: SELECT secret FROM accesspoints WHERE nasname = '%{Packet-Src-IP-Address}'}" FreeRADIUS-Client-NAS-Type = "%{sql: SELECT type FROM accesspoints WHERE nasname = '%{Packet-Src-IP-Address}'}" FreeRADIUS-Client-Virtual-Server = "%{sql: SELECT server FROM accesspoints WHERE nasname = '%{Packet-Src-IP-Address}'}" } } I am looking at FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" to run the Update query but am having problems with looking at using the UPDATE sql query. Have anyone did something similar to this? Thanks and Regards, Muhammad Nuzaihan -- Taqi Systems 269-J Jalan Panji Kampung Chempaka, Kota Bharu, Kelantan 16100 Phone: +6097738657 Mobile: +60199788657 pub 4096R/4C77F88C 2013-04-06 [expires: 2015-04-06] Key fingerprint = 2FE1 87FA E775 2E05 CC0F B3F6 3CB7 C65F 4C77 F88C uid Muhammad Nuzaihan Bin Kamal Luddin <muhammad(a)taqisystems.com>

1 0

EAP-TLS Authentication fails( TLS_accept: error in SSLv3 read client certificate B)
by Esma Yalcinkaya 27 Nov '13

27 Nov '13

Hi, Could anybody help me about EAP-TLS authentication? I use freeradius-server-2.2.0 version, and openssl is installed and use glassfish. Configured eap.conf file (make default_eap_type = tls and update the tls certificate configs.) Then, created certificates via "bootstap", "make" and "make client" commands. Import them to glassfish with keytool: keytool -import -alias root -keystore keystore.jks -trustcacerts -file ca.der keytool -import -alias client -keystore keystore.jks -trustcacerts -file client.crt However, when I sent an eap-tls authentication request, I took following error: [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 0007], Certificate [tls] >>> TLS 1.0 Alert [length 0002], fatal handshake_failure TLS Alert write:fatal:handshake failure TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type REJECT I read a lot about this issue, but I could not figure out what is missing. Thanks & Regards,

3 4