On Dec 21, 2018, at 6:28 PM, Anton Kiryushkin <swood@fotofor.biz> wrote:
Thank you very much for your explanation. I fixed one of my problems. But there is one more, unfortunately. Could you please tell me why some clients still can't log in:
The debug messages are clear...
(100) eap: Peer sent packet with method EAP MD5 (4) (100) eap: Calling submodule eap_md5 to process data (100) eap_md5: ERROR: Cleartext-Password is required for EAP-MD5 authentication
You need a Cleartext-Password to do EAP-MD5. The rest of the debug messages make it clear that the EAP-MD5 method is being used *inside* of PEAP.
I suppose, the main problem from this string:
(100) eap_peap: EAP method MD5 (4)
But, I haven't enabled this type of authorization:
Yes, you have. You've listed "md5" inside of the "eap" module configuration. If you didn't list "md5" there, then FreeRADIUS would complain that EAP-MD5 wasn't permitted. Instead, it runs EAP-MD5.
Probably I should have two versions of hashes for wifi and ethernet authorization?
The debug log says you need the Cleartext-Password, not a hashed password. And once you have that, FreeRADIUS can do PEAP/MS-CHAP, too. Alan DeKok.