Hi, I have a lot of problems doing an EAP-TLS authentification with Freeradius 2.1.3. We're doing a machine-based authentification with certs, using EAP-TLS with 802.1x capable Linksys switches (cable based). We had NO problems at all with Freeradius 1.1.0 and Windows 2000 SP4 and XP SP2 and Linux. We're using no Vista machines at all. With XP SP3 the auth failed, I googled that FR 1.1.0 is not capable to do this, because SP3 is realizing the same 802.1x engine as Vista does. So I upgraded to 2.1.3 and compiled it on OpenSuse 10.1 without errors and the software runs without problems. But the auth still doesn't work. I'am a bit confused about the new inner-tunnel and a few options I'am not aware of from my FR 1.1. setup. Is there somewhere a walk-thru published to make XP SP3 work with FR again? TIA Alex
Hi,
With XP SP3 the auth failed, I googled that FR 1.1.0 is not capable to do this, because SP3 is realizing the same 802.1x engine as Vista does. So I upgraded to 2.1.3 and compiled it on OpenSuse 10.1 without errors and the software runs without problems. But the auth still doesn't work. I'am a bit confused about the new inner-tunnel and a few options I'am not aware of from my FR 1.1. setup. Is there somewhere a walk-thru published to make XP SP3 work with FR again?
if you had a working 1.1.0 system then you could upgrade quickly to 1.1.7 - same config etc etc - and then spend 'offline-time' getting your config migrated to work with 2.1.3 (use a test box...or the same box but with FR listening on different ports). migrating from 1.x to 2.x isnt too hard, but its certainly not a quick 'dump old config over' operation....those with migration experience can effect it within hours. alan
Hi, I tried to compile the 1.1.7 OpenSUSE 10.1. But I get the following error at the end: Processing files: freeradius-dialupadmin-1.1.7-0.suse1010 Processing files: freeradius-devel-1.1.7-0.suse1010 Checking for unpackaged file(s): /usr/lib/rpm/check-files /var/tmp/freeradius-1.1.7-build error: Installed (but unpackaged) file(s) found: /etc/raddb/postgresqlippool.conf RPM build errors: Installed (but unpackaged) file(s) found: /etc/raddb/postgresqlippool.conf I have no "/etc/raddb/postgresqlippool.conf" file. Don't know why the programs complaines about that. FR 2.1.3 compiled without errors. Any ideas? TIA Alex
if you had a working 1.1.0 system then you could upgrade quickly to 1.1.7 - same config etc etc - and then spend 'offline-time' getting
Hi solved it. Must be a bug in 1.1.7. I used 1.1.6 and all works fine (inkl. XP SP3). cu Alex
Hi Alan, A.L.M.Buxey@lboro.ac.uk schrieb:
if you had a working 1.1.0 system then you could upgrade quickly to 1.1.7 - same config etc etc - and then spend 'offline-time' getting
I thought it's working, but it isn't. I upgraded to 1.1.6 from 1.1.0, same setup, but XP SP3 doesn't authenticate against Freeradius. Though I don't think it's a problem of Freeradius, because radiusd -X shows no requests from the XP machine. We had that a couple of years ago, when XP couldn't determine which certificate to use. But using the right extended-usage keys solved the problems. The new 802.x service is of course set to automatic and it's running. If I downgrade my machines to SP2, radius works immediately. So I think the cert creation differs from old XP. Are there any hints about it? I googled for Vista and Freeradius or SP3, but most information is not for eap-tls, not for machinebased authentification or prior Vista or SP3. Is XP SP3 somewhere running with EAP-TLS (machine based authentification)? What can I do? TIA Alex
Can you post the debug of the *same* client certificate being accepted from the SP2 machine and rejected from SP3. Ivan Kalik Kalik Informatika ISP Dana 12/1/2009, "Alexandros Gougousoudis" <gougousoudis-list@servicecenter-khs.de> piše:
Hi,
I have a lot of problems doing an EAP-TLS authentification with Freeradius 2.1.3. We're doing a machine-based authentification with certs, using EAP-TLS with 802.1x capable Linksys switches (cable based).
We had NO problems at all with Freeradius 1.1.0 and Windows 2000 SP4 and XP SP2 and Linux. We're using no Vista machines at all.
With XP SP3 the auth failed, I googled that FR 1.1.0 is not capable to do this, because SP3 is realizing the same 802.1x engine as Vista does. So I upgraded to 2.1.3 and compiled it on OpenSuse 10.1 without errors and the software runs without problems. But the auth still doesn't work. I'am a bit confused about the new inner-tunnel and a few options I'am not aware of from my FR 1.1. setup. Is there somewhere a walk-thru published to make XP SP3 work with FR again?
TIA Alex
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Alexandros Gougousoudis -
tnt＠kalik.net