On Sat, Dec 10, 2011 at 1:54 AM, Alan DeKok <aland@deployingradius.com> wrote:
Ryan Garland wrote:
We have also tried creating the certs with the bootstrap program and modifying eap.conf accordingly, to no avail.
For reference, eapol_test also fails in the same manner when running locally on the FreeRADIUS box.
Uh... then all bets are off. If eapol_test doesn't work, then you broke the FR configuration. FR && eapol_test work together. I do this pretty much every day.
Post the output from eapol_test. It should produce *many* messages describing exactly what is going wrong, and why.
Thanks for the response, Alan. It turns out part of my issue was certificate related. This has been resolved, but eapol_test continues to fail for a different reason. However, I am having trouble determining a fix. Attached is the eapol_test configuration, debug output, FreeRADIUS configuration & debug output. It appears that the relevant portion of the FreeRADIUS debug output is: Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication [eap] Handler failed in EAP/md5 [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server inner-tunnel [ttls] Got tunneled reply code 3 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls rlm_eap_ttls: Freeing handler for user ryan [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. I am having an even more difficult time deciphering the eapol_test debug output - I just see the EAP failure from the radius server. I have also tried commenting out 'virtual_server = "inner-tunnel"' in the ttls section of eap.conf to force it to use default (as the documentation inside the "default" virtual server would seem to imply I should do) and I get the same result. I may be mis-reading it, however. Do you see something glaringly wrong? I appreciate any insight you can provide. -RG