Beeblebrox wrote:

Keeping in mind that the system in question is an OpenWRT (hence minimal install):

The web site contains documentation. As does the wiki. The distribution "tar" file contains documentation. You're not stuck with just a minimal install on a constrained box.

But this is not possible since a router environment is not suitable for git + building things.

You can run the scripts on another machine, and copy the certificates over to the constrained machine.

But more importantly:

...

The incoming request doesn't use certificate authentication So that means the certificate business is not of immediate relevance to my problem? Good to hear!

Well, no. The debug log you posted doesn't use certificates. Hence my question about where it came from.

...

1) what client did you use to send the Access-Request? ssh into box and: echo "User-Name = steve, User-Password = testing" | radcli ent -x 192.168.1.2 auth mysecret

So... it's a test request with a test user and test password. It's not a real request from a client. Did you configure the user on the radius server? i.e. how does the RADIUS server know how to authenticate the user?

...

3) Why did you send the Access-Request? To debug freeradius config since wifi connection attempt fails with very little info.

That is the point of running the server in debugging mode. Do a WiFi connection, and read the debug output for *that*.

...

The whole point of running in debugging mode is to READ IT I read the output several times before posting - nothing out of the ordinary and all modules are loaded smoothly.

Messages like "No known good password" don't mean anything?

Also, no debug info in /var/log/radius.log - not even when I increase log-level in /etc/freeradius2/radiusd.conf.

The normal log file is for normal logs. It's not for debug output.

config file snippets: users: steve Cleartext-Password := "testing"

Well... the debug output shows that the "files" module (which handles the users file) returned "noop". i.e. it didn't find that entry. Please read the FAQ about debugging authentication. It gives examples, and detailed instructions. Alan DeKok.

Update: I tried connection from an XP laptop and got the message: Windows was unable to find a certificate to log you on to the network

Beeblebrox wrote:

Update: I tried connection from an XP laptop and got the message: Windows was unable to find a certificate to log you on to the network

You need to follow the documentation or you will be unsubscribed, and banned from the list. 10+ years of experience shows us that this is the ONLY WAY to convince certain people to read the documentation. - You are using "radiusd -Xx". Don't do that. All of the documentation says "radiusd -X" for a reason. Follow the documentation. - I told you to read the FAQ to see how to configure a user. Your previous message showed you didn't do that. Follow the documentation. - This message shows you have issues with EAP. Go to freeradius.org, click on the "documentation" link. There is an EAP-TLS "howto". It has detailed instructions, including screen shots for XP. It ALWAYS WORKS. If it doesn't work for you, it's because you DID NOT FOLLOW THE DOCUMENTATION. If you think my response is harsh, then see it from my point of view. There are hundreds of pages of easily found documentation that describes exactly what you want to do. I (among many other people) spent years writing it. You can't be bothered to even click a link or two, and follow instructions. If you think my response is rude, keep it to yourself. Any response complaining that we're rude for asking you to follow the documentation will result in you being unsubscribed and banned. Follow the documentation. It's damned easy to do. Alan DeKok.

Beeblebrox wrote:

First off, thanks again for your help. I fully appreciate that you are giving of your time to answer posts, when you really have no obligation to do so. I know you are one of the developers or project leader since your name keeps coming up on almost every web page that posts something about Freeradius.

I started FreeRADIUS. I've written most of the code. I've been doing this for ~14 years. And now, probably 50% of the new RADIUS specifications are mine.

That said, I would like to comment on the documentation of your project. It's quite extensive, but equally confusing (at least for me).

http://freeradius.org/doc/ contains documentation for all of the problems you've seen so far. That documentation is given in pretty excruciating detail. "edit this, run that command, see this output". And yet... most people who have problems start off with third-party web sites that are *worse*, in my opinion. They tell you to do things which aren't necessary, and they give wrong explanations.

I am a FreeBSD user and have a pretty good handle on many advanced issues in that OS - so I think I am fairly capable of reading and implementing documentation. However, I have found that your documentation assumes too much, does not follow much of a logical path, is not organized by topic, does not "get to the point" and does not have concrete examples / solutions to at least recurring and common mistakes or errors.

As I've been saying for !4 years: the community is free to write better documentation. No, that's not true... I've been *begging* for better documentation. It doesn't happen.

When reading documentation, I'm not interested in becoming an expert in that subject, I just want to get the damn thing up and working. So in essence, I'm not able to find the answers I'm looking for in your documentation, and that's frustrating.

Please explain how the "pap" and "EAP" guides don't do what you're asking for. They follow a logical path. They are clearly labeled by topic. They get to the point. They give concrete examples. Now, much *else* in the server doesn't have that. But the issues you ran into are documented *exactly* as you want. For the rest, the comments in the configuration file describe in great detail how the server works, and what the configurations do. And about "becoming an expert"... it helps to *understand* what you're doing. Many of the problems people run into are because they read crappy third-party documentation, and are obsessed with implementing a particular solution. They don't care to listen to the experts *here* who are telling them to do something else. And they don't care to *understand* what they're doing, so that they can do it *right*.

I have found (in debugging other software problems) that it is very important for the person who knows more and is assisting, to ask the right questions. Honestly, I have understoode very little from your posts in this thread (with exception of the last one). Asking some specific questions, then posting relevant links to the wiki (depending on the answers from the OP) would be immensly more helpful. I suggest that you have links in your signature to the entry-level wiki pages (like faq, debug, etc).

So... I'm supposed to cut & paste links from the wiki, because you... what... don't want to look there? Can't use the "search" button on the wiki? And add *more* links saying "please read the FAQ"? That's a terrible suggestion.

...

If you think my response is rude, keep it to yourself. I don't think that at all and as stated, very much appreciated your input and taking time (again, without obligation) to provide help. In fact, I previously refrained on commenting on how I disliked the documentation structure so as not to appear rude to you.

It's a pro-active comment. Most of the time when I say "I REALLY MEAN READ THE DOCUMENTATION", people get offended and accuse me of being rude.

...

will result in you being unsubscribed and banned. Fascinating! I'm enthralled.

It's the only way to convince certain people to READ THE DOCUMENTATION. It's not hard. Go to the web site. Click on "documentation". The PAP / EAP issues you were having are documented from there, in great detail, exactly how you want. What *else* should we be doing to convince people to READ IT? Write it on flaming letters 150 feet high? It's already in the "man" pages, web pages, daily posts to this list, top entries on google. Alan DeKok.

Beeblebrox wrote:

Just writing to advise of the strange issues I came accross.

1. The Authentication issue was solved when by accident I placed in users the name / password without any whitespace (<tab> or <space>) before the password string. So I found that this works: bob Cleartext-Password := "hello888" while this does not: bob Cleartext-Password := "hello888" Test client now logs in very smoothly.

This is documented. See "man users", and the comments in the "users" file, and in the dozens of examples.

2. Similarly, below spec gives error (probably my mistake): DEFAULT Simultaneous-Use := 4 Fall-Through = Yes

/etc/freeradius2/users[8]: Parse error (check) for entry Simultaneous-Use: Unknown attribute "" requires a hex string, not "4" Errors reading /etc/freeradius2/users /etc/freeradius2/modules/files[7]: Instantiation failed for module "files" /etc/freeradius2/sites/default[170]: Failed to find "files" in the "modules" section. /etc/freeradius2/sites/default[69]: Errors parsing authorize section.

Off the top, I would venture to guess that OpenWRT's build of FreeRadius is significantly different than the "standard build" and that is probably where the bug is coming from.

It's because you're again not following the documentation. Read the documentation and follow it. It's not rocket science. If you post another message indicating you've been ignoring the documentation, you will be unsubscribed and banned. I've had it with people who whine about the bad documentation, and then fanatically refuse to follow it. Get off your high horse about the documentation. It's fine. THE PROBLEM IS YOU. Alan DeKok.