EAP-TLS/PEAP authentication problem(can not reply correct attribute)
Hi All I have NAS client which support WISPr standard working with freeradius 2.1.10+MySQL 5.5 install on Fedora OS. I create my test certificate and configure EAP-TLS/PEAP authentication well in my setup. I am using WINDOWS XP as client pc it can pass authentication but freeradius can not reply correct attribute I configured such as bandwidth control. I noticed in the reply attribute the vendor is Microsoft not WISPr. I wonder if this is WINDOWS default setting how can I modify so that FR can reply the correct attribute I configured? Best Regards Gary BROWAN COMMUNICATIONS INC. Tel:886-3-600-6899 ext.4842 Fax:886-3-597-2970 e-mail:gary.yang@browan.com
On 31 Aug 2011, at 04:37, gary wrote:
Hi All I have NAS client which support WISPr standard working with freeradius 2.1.10+MySQL 5.5 install on Fedora OS. I create my test certificate and configure EAP-TLS/PEAP authentication well in my setup. I am using WINDOWS XP as client pc it can pass authentication but freeradius can not reply correct attribute I configured such as bandwidth control. I noticed in the reply attribute the vendor is Microsoft not WISPr. I wonder if this is WINDOWS default setting how can I modify so that FR can reply the correct attribute I configured?
Look in the dictionary file for your NAS vendor and figure out what the actual attribute name is for the reply attribute you're trying to send. The name of a VSA is just there to make it easier to extract and manipulate attributes, it has no effect on the contents of the packet. So if you insert a VSA and it comes up as a Microsoft Vendor and this is not what you intended, then there's a naming conflict and the other Vendors VSAs will have been renamed. -Arran Arran Cudbard-Bell a.cudbardb@freeradius.org RADIUS - Half the complexity of Diameter
On 31 Aug 2011, at 08:11, Arran Cudbard-Bell wrote:
On 31 Aug 2011, at 04:37, gary wrote:
Hi All I have NAS client which support WISPr standard working with freeradius 2.1.10+MySQL 5.5 install on Fedora OS. I create my test certificate and configure EAP-TLS/PEAP authentication well in my setup. I am using WINDOWS XP as client pc it can pass authentication but freeradius can not reply correct attribute I configured such as bandwidth control. I noticed in the reply attribute the vendor is Microsoft not WISPr. I wonder if this is WINDOWS default setting how can I modify so that FR can reply the correct attribute I configured?
Look in the dictionary file for your NAS vendor and figure out what the actual attribute name is for the reply attribute you're trying to send.
The name of a VSA is just there to make it easier to extract and manipulate attributes, it has no effect on the contents of the packet. So if you insert a VSA and it comes up as a Microsoft Vendor and this is not what you intended, then there's a naming conflict and the other Vendors VSAs will have been renamed.
Of course if you're adding attributes in the inner tunnel you'll have to make sure tunnelled reply is set to yes in eap.conf for the relevant EAP methods. Arran Cudbard-Bell a.cudbardb@freeradius.org RADIUS - Half the complexity of Diameter
Hi Arran I do not define my private attribute while I follow the WISPr such as "Bandwidth-Max-Up" and "Bandwidth-Max-Down". It is no problem that I use UAM method(user login with login page by user name/password) and freeradius can reply correct attribute. But when I use PEAP authentication,after user login it can not reply correct attribute that I configure in the radgroupreply table. Can anyone give some idea? BR//Gary ----- Original Message ----- From: Arran Cudbard-Bell To: FreeRadius users mailing list Sent: Wednesday, August 31, 2011 2:21 PM Subject: Re: EAP-TLS/PEAP authentication problem(can not reply correctattribute) On 31 Aug 2011, at 08:11, Arran Cudbard-Bell wrote: On 31 Aug 2011, at 04:37, gary wrote: Hi All I have NAS client which support WISPr standard working with freeradius 2.1.10+MySQL 5.5 install on Fedora OS. I create my test certificate and configure EAP-TLS/PEAP authentication well in my setup. I am using WINDOWS XP as client pc it can pass authentication but freeradius can not reply correct attribute I configured such as bandwidth control. I noticed in the reply attribute the vendor is Microsoft not WISPr. I wonder if this is WINDOWS default setting how can I modify so that FR can reply the correct attribute I configured? Look in the dictionary file for your NAS vendor and figure out what the actual attribute name is for the reply attribute you're trying to send. The name of a VSA is just there to make it easier to extract and manipulate attributes, it has no effect on the contents of the packet. So if you insert a VSA and it comes up as a Microsoft Vendor and this is not what you intended, then there's a naming conflict and the other Vendors VSAs will have been renamed. Of course if you're adding attributes in the inner tunnel you'll have to make sure tunnelled reply is set to yes in eap.conf for the relevant EAP methods. Arran Cudbard-Bell a.cudbardb@freeradius.org RADIUS - Half the complexity of Diameter ------------------------------------------------------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
gary wrote:
I do not define my private attribute while I follow the WISPr such as "Bandwidth-Max-Up" and "Bandwidth-Max-Down". It is no problem that I use UAM method(user login with login page by user name/password) and freeradius can reply correct attribute. But when I use PEAP authentication,after user login it can not reply correct attribute that I configure in the radgroupreply table. Can anyone give some idea?
See "use_tunneled_reply" in raddb/eap.conf. Alan DeKok.
Hi Alan Thank you,it can reply correct attribute. some more question pls. 1.sometimes it can login while sometimes failure, it is random. I am using the same user/password for PEAP authentication and totally the same configuration both server and client PC/user. 2.after user success login, sometimes it will re-authentication automatically. It seems client issue the authentication itself but I wonder. 3.looking for the log below,it seems finish authentication by FR but the result is failure. why sending Access-Challenge to NAS(192.168.21.223) after success? ***************************************************************** rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok } # server inner-tunnel [peap] Got tunneled reply code 2 Auth-Type := Local Service-Type := Framed-User Framed-IP-Address := 255.255.255.254 Framed-IP-Netmask := 255.255.255.0 Bandwidth-Max-Up := 2097152 Bandwidth-Max-Down := 2097152 Redirection-URL := "http://speedtest.net" Idle-Timeout := 60 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xe8e6189faa5581198681e65eab0a0270 MS-MPPE-Recv-Key = 0x0ea859d9cf1789a14e71ea9f41cfa8e0 EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "gary" [peap] Got tunneled reply RADIUS code 2 Auth-Type := Local Service-Type := Framed-User Framed-IP-Address := 255.255.255.254 Framed-IP-Netmask := 255.255.255.0 Bandwidth-Max-Up := 2097152 Bandwidth-Max-Down := 2097152 Redirection-URL := "http://speedtest.net" Idle-Timeout := 60 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xe8e6189faa5581198681e65eab0a0270 MS-MPPE-Recv-Key = 0x0ea859d9cf1789a14e71ea9f41cfa8e0 EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "gary" [peap] Tunneled authentication was successful. [peap] SUCCESS [peap] Saving tunneled attributes for later ++[eap] returns handled Sending Access-Challenge of id 117 to 192.168.21.223 port 1812 EAP-Message = 0x010d00261900170301001bb702fe1896d6726825ec785647a34e3d8126e49337f16e73596446 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2f1a077a27171e8af826d2444a0b0c36 Finished request 79. Going to the next request Waking up in 2.8 seconds. Cleaning up request 71 ID 109 with timestamp +1967 Cleaning up request 72 ID 110 with timestamp +1967 Cleaning up request 73 ID 111 with timestamp +1967 Cleaning up request 74 ID 112 with timestamp +1967 Cleaning up request 75 ID 113 with timestamp +1967 Cleaning up request 76 ID 114 with timestamp +1967 Waking up in 0.8 seconds. Cleaning up request 77 ID 115 with timestamp +1968 Cleaning up request 78 ID 116 with timestamp +1968 Waking up in 1.0 seconds. Cleaning up request 79 ID 117 with timestamp +1969 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x2f1a077a27171e8a did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. *********************************************************************** Best Regards Gary ----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Thursday, September 01, 2011 8:48 PM Subject: Re: EAP-TLS/PEAP authentication problem(can notreply correctattribute)
gary wrote:
I do not define my private attribute while I follow the WISPr such as "Bandwidth-Max-Up" and "Bandwidth-Max-Down". It is no problem that I use UAM method(user login with login page by user name/password) and freeradius can reply correct attribute. But when I use PEAP authentication,after user login it can not reply correct attribute that I configure in the radgroupreply table. Can anyone give some idea?
See "use_tunneled_reply" in raddb/eap.conf.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
gary