Yeah, not sure what “Abooba” does when it terminates PEAP, but it weirds things out sometimes.  Still doesn’t explain why XP just worked but W7 had bunches of issues, but I can attest that making the Abooba controllers pas *eap to FR works better – maybe works 100%.

The only thing we noticed is, if Abooba does NOT terminate PEAP – there is no “local” login option available.  We had our two FR servers configured as well as local login (as last resort).  I guess now we need to be REALLY sure at least one FR server is up all the time!

G

 

 

From: freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org] On Behalf Of Mark Jones
Sent: Thursday, May 19, 2011 12:15 PM
To: freeradius-users@lists.freeradius.org
Subject: Re: Renaming during Machine Authentication

 

This is on a samba domain Phil as per the cool solutions article I mentioned in an earlier post. I am looking into my Aruba settings now for termination

 

Mark

>>> Phil Mayers <p.mayers@imperial.ac.uk> 5/19/2011 1:58 AM >>>

> User-Name = "host/TECH-11501"

Machines which are in the domain normally have this as:

host/name.domain.com

i.e. there is a "domain.com" at the end of the name.

The absence of that suggests to me that the machine is not a domain
member. Is that the case? If so, it cannot do machine auth.

> Calling-Station-Id = "00265EE9B2CA"
> Called-Station-Id = "000B86611894"
> MS-CHAP-Challenge = 0x5551e00f40ce355de8053dbc2f64b5dd
> MS-CHAP2-Response =
> 0x0700226e95f1d0ae4efe8f381fd3714c7b0f0000000000000000904f33f5941ab6017f433da0f45438dc665447e9d6510a2d
> Service-Type = Login-User
> Aruba-Essid-Name = "HPSD_RAD2"
> Aruba-Location-Id = "Tech 01"

Great. More Aruba, probably terminating the PEAP locally. What a junky
product.

See other posts on the list in the past few days - you should DISABLE
"terminate PEAP" (or whatever the option is) on your Aruba equipment,
and let it do the EAP/PEAP.

> +- entering group MS-CHAP {...}
> [mschap] Creating challenge hash with username: host/TECH-11501
> [mschap] Told to do MS-CHAPv2 for host/TECH-11501 with NT-Password
> [mschap] FAILED: MS-CHAP2-Response is incorrect

Hmm. Indicating the password is not correct or the EAP has been fiddled
with.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

 

This communication is intended for the use of the recipient to which it is addressed and may contain confidential, personal and/or privileged information. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately.

"This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system."