Vista PEAP troubleshooting
I setup a freeradius server 1.1.7 with mysql on Ubuntu and wanted to use PEAP to avoid any certificate stuff on the clients as they will be guest visiting my company and was hoping for a name/password to connect. Everything worked fine for my testing (XP SP3) until I tried to connect a Vista user. More or less when they are prompt for the name and password and then it goes nowhere and they are not connected. I also tried a Windows & computer with the same PEAP settings and had the same results as Vista. Now I am wondering where to look to find what I have missed. I have been looking over logs from the debugging -X and have done some PEAP tracing on Vista but still find myself guessing on what the cause might be. I was hoping someone could point me on where/what to look for to get the Vista/PEAP working or if I should try something else. I am fairly new to Ubuntu/Freeradius but do enjoy working and learning with it so I apologize in advance if that gets in the way. I used these site for getting it running. http://www.howtoforge.com/setting-up-a-freeradius-based-aaa-server-with- mysql-and-management-with-daloradius then this for some SSL certificates after the Vista problem started thinking/hoping it would help. http://www.linuxjournal.com/article/8095 I appreciate any help you can offer. J Hawk
I started by just looking into it to see if it would work the way I had hoped and that first link had instructions for the exactly what I was looking for so I followed them. I could start over fresh or upgrade I guess if that would help or solve my problem but I have to admit I did rely on the instructions from the site quite a bit. Would a new install be similar enough for me to follow? Thanks J Hawk -----Original Message----- From: freeradius-users-bounces+jeff.hawkins=accraply.com@lists.freeradius.org [mailto:freeradius-users-bounces+jeff.hawkins=accraply.com@lists.freerad ius.org] On Behalf Of Garber, Neal Sent: Friday, September 11, 2009 12:08 PM To: 'FreeRadius users mailing list' Subject: RE: Vista PEAP troubleshooting
I setup a freeradius server 1.1.7 with mysql on Ubuntu
If you just setup this new server, why aren't you using the latest version of FreeRADIUS? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I started by just looking into it to see if it would work the way I had hoped and that first link had instructions for the exactly what I was looking for so I followed them. I could start over fresh or upgrade I guess if that would help or solve my problem but I have to admit I did rely on the instructions from the site quite a bit. Would a new install be similar enough for me to follow?
I would think it is similar enough. I don't know whether it will solve your problem; but, I do recall problems with Vista in some old releases (not sure which one(s) without searching). But, there are lots of known issues that are fixed in the newer releases, so it doesn't make sense (to me anyway) to build a new server with an ancient release of any product that has been functionally stabilized (i.e., no new features will be developed and only security related fixes will be created).
On 09/11/2009 01:16 PM, Hawkins, Jeff (APLY-MN) wrote:
I started by just looking into it to see if it would work the way I had hoped and that first link had instructions for the exactly what I was looking for so I followed them. I could start over fresh or upgrade I guess if that would help or solve my problem but I have to admit I did rely on the instructions from the site quite a bit. Would a new install be similar enough for me to follow?
FreeRADIUS 2.x is vastly superior to 1.x. Most external documentation (not from FreeRADIUS) is out of data or simply wrong. You best path for success is to use a current 2.x version of FreeRADIUS and use only documentation found in the FreeRADIUS distribution, on the FreeRADIUS web site (and http://deployingradius.com which is run by Alan DeKok). Most people do not realize there is a lot of useful documentation in FreeRADIUS, they just don't know where to look for it. Quite a bit of it is in /etc/raddb in the configuration files and examples). -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
John Dennis wrote:
Most people do not realize there is a lot of useful documentation in FreeRADIUS, they just don't know where to look for it. Quite a bit of it is in /etc/raddb in the configuration files and examples).
i.e. ignore the documentation that comes with the server, and instead follow a *third-party* web site that is *years* out of date. Why? I've never been able to figure it out. Alan DeKok.
Hi Alan - BTW, are you going to release your 2.x upgrade guide? -John On 09/11/2009 01:57 PM, Alan DeKok wrote:
John Dennis wrote:
Most people do not realize there is a lot of useful documentation in FreeRADIUS, they just don't know where to look for it. Quite a bit of it is in /etc/raddb in the configuration files and examples).
i.e. ignore the documentation that comes with the server, and instead follow a *third-party* web site that is *years* out of date.
Why? I've never been able to figure it out.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
John Center wrote:
Hi Alan - BTW, are you going to release your 2.x upgrade guide? -John
At this time, it only available via a support contract http://networkradius.com/support/ The reason is simple: I already give a lot away for free. I'm writing the book (it will be done real soon now), and I have incentive to collect the best documentation there, rather than to give it away for nothing. Since my only income right now is FreeRADIUS, I *need* to do paid work. Alan DeKok.
I appreciate all of the help and I am sorry if I was way off base with this. I am doing a fresh os install and will grab the latest FR. J Hawk -----Original Message----- From: freeradius-users-bounces+jeff.hawkins=accraply.com@lists.freeradius.org [mailto:freeradius-users-bounces+jeff.hawkins=accraply.com@lists.freerad ius.org] On Behalf Of Alan DeKok Sent: Friday, September 11, 2009 12:58 PM To: FreeRadius users mailing list Subject: Re: Vista PEAP troubleshooting John Dennis wrote:
Most people do not realize there is a lot of useful documentation in FreeRADIUS, they just don't know where to look for it. Quite a bit of it is in /etc/raddb in the configuration files and examples).
i.e. ignore the documentation that comes with the server, and instead follow a *third-party* web site that is *years* out of date. Why? I've never been able to figure it out. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I believe the version that Ubuntu would grab is 1.1.7. I know that version has the Vista support but would it be easier for me to get it to work by grabbing the latest 2.1.6 off of the freeradius.org site? Thanks J Hawk -----Original Message----- From: freeradius-users-bounces+jeff.hawkins=accraply.com@lists.freeradius.org [mailto:freeradius-users-bounces+jeff.hawkins=accraply.com@lists.freerad ius.org] On Behalf Of Alan DeKok Sent: Friday, September 11, 2009 2:38 PM To: FreeRadius users mailing list Subject: Re: Vista PEAP troubleshooting Hawkins, Jeff (APLY-MN) wrote:
I appreciate all of the help and I am sorry if I was way off base with this. I am doing a fresh os install and will grab the latest FR.
Installing the version that comes with your OS is fine. But it *does* come with documentation. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
I believe the version that Ubuntu would grab is 1.1.7. I know that version has the Vista support but would it be easier for me to get it to work by grabbing the latest 2.1.6 off of the freeradius.org site?
I thought the latest Ubuntu cam with a 2.x flavour now. anyway, you might want to ensure your RADIUS server has a cert signed by an authority known by default windows alan
i.e. ignore the documentation that comes with the server, and instead follow a *third-party* web site that is *years* out of date.
Why? I've never been able to figure it out.
Alan DeKok.
I don't understand it either, but everyone seems to do it (and everyone cannot be idiots). Maybe the following will work (and alleviate a lot of irritation). Add a global configuration parameter, with a default of yes. "documentation warning = yes" Also document the "documentation warning" parameter asking package maintainers to please NOT switch it off. If it is on, Freeradius will spit out the following when it starts up to as many places it can. syslog, log files, stdout (even in non-debug mode). ******************************************************* ******************************************************* *** *** *** WARNING WARNING WARNING WARNING *** *** *** ******************************************************* ******************************************************* * * * This server comes with a lot of documentation * * PLEASE READ IT! * * * * A lot of third party web sites are out of date * * and therefore give incorrect or invalid * * instructions for setting up the server * * * * You will find the best documentation in: * * 1) the doc directory * * 2) the configuration files, * * 3) http://www.freeradius.org/ * * 4) http://deployingradius.com/ * * * * Some packages to not include the documentation * * If so, please download the tarball * * * * Please also read the FAQ. If you don't come * * right, please see the section titled * * "It still doesn't work" * * * ******************************************************* -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782
Johan Meiring wrote:
I don't understand it either, but everyone seems to do it (and everyone cannot be idiots).
It isn't everyone. It's mainly people who run into problems. i.e. ignore the documentation, fail to configure the server. And it has nothing to do with intelligence. It's because the method they're using is largely trial and error, rather than systematic tests.
Add a global configuration parameter, with a default of yes. "documentation warning = yes"
It's not a bad idea, to be honest. I'll take a look at doing it for the next release. Alan DeKok.
I setup a freeradius server 1.1.7 with mysql on Ubuntu and wanted to use PEAP to avoid any certificate stuff on the clients as they will be guest visiting my company and was hoping for a name/password to connect. Everything worked fine for my testing (XP SP3) until I tried to connect a Vista user. More or less when they are prompt for the name and password and then it goes nowhere and they are not connected. I also tried a Windows & computer with the same PEAP settings and had the same results as Vista.
If you are using (self signed) certificates generated by freeradius you need to import ca certificate (ca.der) onto the XP/Vista client for PEAP to work. Ivan Kalik Kalik Informatika ISP
If you uncheck the Validate Server Certificate box on XP/Vista do you still need to import any certificates? I was able to get XP SP3 to connect without the checkbox marked and was hoping for the same with Vista/Win7. Thanks J Hawk -----Original Message----- From: freeradius-users-bounces+jeff.hawkins=accraply.com@lists.freeradius.org [mailto:freeradius-users-bounces+jeff.hawkins=accraply.com@lists.freerad ius.org] On Behalf Of Ivan Kalik Sent: Friday, September 11, 2009 4:16 PM To: FreeRadius users mailing list Subject: Re: Vista PEAP troubleshooting
I setup a freeradius server 1.1.7 with mysql on Ubuntu and wanted to use PEAP to avoid any certificate stuff on the clients as they will be guest visiting my company and was hoping for a name/password to connect. Everything worked fine for my testing (XP SP3) until I tried to connect a Vista user. More or less when they are prompt for the name and password and then it goes nowhere and they are not connected. I also tried a Windows & computer with the same PEAP settings and had the same results as Vista.
If you are using (self signed) certificates generated by freeradius you need to import ca certificate (ca.der) onto the XP/Vista client for PEAP to work. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
If you uncheck the Validate Server Certificate box on XP/Vista do you still need to import any certificates? I was able to get XP SP3 to connect without the checkbox marked and was hoping for the same with Vista/Win7.
you are now talking about playing with PEAP settings on the clients systems - and many of your guests may have enterprise locked systems anyway. if you are going down this route, you may as well have some form of 802.1X autoconfiguration tool to do your work for you.... it'll configure their system for your SSID and install certificate etc etc. if you truly want to 'just use username and password' (and leave the other settings alone) then you'll have to ensure that your RADIUS server is signed by a well known CA alan
participants (8)
-
Alan Buxey -
Alan DeKok -
Garber, Neal -
Hawkins, Jeff (APLY-MN) -
Ivan Kalik -
Johan Meiring -
John Center -
John Dennis