I change rule and this is solved My file users _______________________________________ DEFAULT Huntgroup-Name == "cisco" Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15", Fall-Through = Yes DEFAULT Group == "Central" DEFAULT Group == "DEP25", Client-Shortname == "25" DEFAULT Group == "DEP29", Client-Shortname == "29" DEFAULT Group == "DEP57", Client-Shortname == "57" DEFAULT Auth-Type := Reject ______________________________________ For my second problem ,It isn't resolve. debug : Error: TLS Alert read:fatal:unknown CA Sun Feb 2 22:03:14 2014 : Error: TLS_accept: failed in SSLv3 read client certificate A Sun Feb 2 22:03:14 2014 : Error: rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca Sun Feb 2 22:03:14 2014 : Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails. and trace user: ./eapol_test -c eapol-config -a xen-squeeze-freeradius -p 1812 -s testing123 -r1 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=4 method=21 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=509) - Flags 0x80 SSL: TLS Message Length: 2527 SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 read server hello A TLS: Certificate verification failed, error 19 (self signed certificate in certificate chain) depth 1 for '/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin@example.com/CN=xen-squeeze-freeradius' CTRL-EVENT-EAP-TLS-CERT-ERROR reason=1 depth=1 subject='/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress= admin@example.com/CN=xen-squeeze-freeradius' err='self signed certificate in certificate chain' SSL: (where=0x4008 ret=0x230) SSL: SSL3 alert: write (local SSL3 detected an error):fatal:unknown CA SSL: (where=0x1002 ret=0xffffffff) SSL: SSL_connect:error in SSLv3 read server certificate B OpenSSL: openssl_handshake - SSL_connect error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed SSL: 7 bytes pending from ssl_out SSL: Failed - tls_out available to report error SSL: 7 bytes left to be sent out (of total 7 bytes) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE My ca.cnf ... [ req ] prompt = no distinguished_name = certificate_authority default_bits = 2048 input_password = whatever output_password = whatever x509_extensions = v3_ca [certificate_authority] countryName = FR stateOrProvinceName = Radius localityName = Somewhere organizationName = Example Inc. emailAddress = admin@example.com commonName = "xen-squeeze-freeradius" [v3_ca] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer:always basicConstraints = CA:true ... My server.cnf ... [ req ] prompt = no distinguished_name = server default_bits = 2048 input_password = whatever output_password = whatever [server] countryName = FR stateOrProvinceName = Radius localityName = Somewhere organizationName = Example Inc. emailAddress = admin@example.com commonName = "xen-squeeze-freeradius" err='self signed certificate in certificate chain' I followed the guide http://deployingradius.com/documents/configuration/certificates.html but Freeradius error is "self-signed certificate." How to remove this error? thank you!!!! 2014-01-31 Alan DeKok <aland@deployingradius.com>:

Yves Deuscher wrote:

...

For DEP commissioned the first connection goes well

Thu Jan 30 23:48:28 2014 : Info: ++[eap] returns noop Thu Jan 30 23:48:28 2014 : Info: ++[unix] returns updated Thu Jan 30 23:48:28 2014 : Info: [files] expand: %{Client-Shortname} -> DEP25 Thu Jan 30 23:48:28 2014 : Info: [files] users: Matched entry DEFAULT at line 208 Thu Jan 30 23:48:28 2014 : Info: ++[files] returns ok

You'll have to look at the rest of the debug log to see what's going on.

If the packets are being processed differently, it's because the packets are different. You'll have to look at the packets to see what's different. Then, re-write the rules to match both packets.

...

I miss something for the dynamic substitution takes place at each connection or I can not be the problem taken in the right direction have?

Each packet is completely independent. FreeRADIUS doesn't change it's behavior from one packet to the next.

...

More I try to configure a secure WPA / TTLS working with all key calculated installing Freeradius. by cons with mine I have a CA_unknown error do you have a clue?

Follow the EAP guide on http://deployingradius.com/ . It *will* work.

If you have unknown CA errors, it's because the certificate configuration is wrong. Follow the guide.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html