Hi Matthew, thanks for your response, I see i can't match Auth-type accept with EAP, i did it because when I set auth-type EAP server also returns error. My previous configuration was Auth-type := EAP My NAS is a tp-link n750 access point, I configure it WPA2 enterprise, AES encryption, GKUP = 30 So when I try to connect with this configuration I receive the following output: rad_recv: Access-Request packet from host 10.25.4.250 port 44145, id=9, length=206 User-Name = "daniel" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "E8-DE-27-F7-83-A4:cdebiles.eti" Calling-Station-Id = "EC-0E-C4-12-81-3F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0209002b19001703010020e2655cfae9bba34897cb25ced3d5addeba14dd79244d067a52920706cecd672b State = 0xf9d08276fed99b298671c9ec938c6074 Message-Authenticator = 0x2a7334490eba3ac3d0321067d0fc8eef # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "daniel", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. *[peap] Peap state send tlv failure* *[peap] Received EAP-TLV response.* *[peap] The users session was previously rejected: returning reject (again.)* *[peap] *** This means you need to read the PREVIOUS messages in the debug output* *[peap] *** to find out the reason why the user was rejected.* *[peap] *** Look for "reject" or "fail". Those earlier messages will tell you.* *[peap] *** what went wrong, and how to fix the problem.* *[eap] Handler failed in EAP/peap* *[eap] Failed in EAP select* *++[eap] returns invalid* *Failed to authenticate the user*. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> daniel attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 9 to 10.25.4.250 port 44145 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. What i'm doing wrong? What i'm missing? Thanks again 2015-10-30 18:02 GMT-04:00 Matthew Newton <mcn4@leicester.ac.uk>:
On Fri, Oct 30, 2015 at 04:38:18PM -0400, Daniel Lopez wrote:
The user "daniel" belongs to usergroup "wifi". In radgroupcheck I set the attribute Auth-Type := Accept for the group "wifi". When I try to connect from the terminal, server returns an Access-accept message, but however i can't still connect, screen of my device shows an eternal loop trying to connect but it doesn't do.
Configure the eap module properly for your situation.
You can't just return an access-accept for eap; without the correct handshakes between the client and the RADIUS server it won't work, just like you've discovered.
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html