On 01/09/2006, at 6:37 PM, Alan DeKok wrote:

Loukas Kalenderidis <loukas@hb.com.au> wrote:

...

I've configured FreeRADIUS as best I can figure from what I've found on the web, but I'm having no success with getting WPA to work. I'm using a D-Link 2100AP access point, and a Mac OS X 10.4 client. From what I can gather it seems that I might have misconfigured FreeRADIUS, based on the error message below.

I've configured a test user as follows: pants Auth-Type := Accept

That won't make WPA work. WPA requires a whole bunch of data exchange before all the machines involved believe that net access has been granted.

You have to configure users, passwords, and certificates for it to work.

I've been trying to use an existing user that works with dialup access, but kept having authorization rejected, so I decided to try configuring that test user with Auth-Type:= Accept to simplify the problem. Bad idea? I was under the impression I don't need certificates unless I'm using TLS, is this incorrect?

...

The last 3 lines I found in a tutorial on the web, but I'm not sure if they are necessary or not (and commenting them out makes no difference).

They're for VLAN assignment. You don't need them.

Thanks.

...

Watching the traffic shows the Access-Accept packet being sent back to the AP, but confusingly the AP sends an Access-Accept back to the RADIUS server! (10.0.0.100 is the AP, 10.0.0.101 is the RADIUS server):

That's what the debug log shows, too.

Is this what the following error is about? Error: Authentication reply packet code 2 sent to a non-proxy reply port from client testap:1025 - ID 0 : IGNORED That makes more sense now. Thanks, Loukas

Hi, On 04/09/2006, at 11:36 AM, Alan DeKok wrote:

Loukas Kalenderidis <loukas@hb.com.au> wrote:

...

I've been trying to use an existing user that works with dialup access, but kept having authorization rejected, so I decided to try configuring that test user with Auth-Type:= Accept to simplify the problem. Bad idea? I was under the impression I don't need certificates unless I'm using TLS, is this incorrect?

As I said in my previous message, you need to configure users, passwords, and certificates for it to work.

You can believe me, or you can continue doing what you're doing now, which doesn't work.

I asked you questions relating to your statement in your previous message and you didn't really answer them. Can you elaborate on "configure users, passwords and certificates for it to work" please? Do you mean the users file needs specific configuration to work with WPA-EAP? And as I said before, I was under the impression I don't need certificates unless I'm using TLS, am I wrong? I'm happy to follow your advice, if you give me some that isn't just "configure stuff dude". This is what the debug log says when I connect now: rad_recv: Access-Request packet from host 10.0.0.100:1026, id=0, length=193 Message-Authenticator = 0x5206d718f6573c1eb840261956ec4ed5 Service-Type = Framed-User User-Name = "pants" Framed-MTU = 1488 Called-Station-Id = "00-11-95-DB-37-0B:TestWPA" Calling-Station-Id = "00-0D-93-86-48-8E" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000a0170616e7473 NAS-IP-Address = 10.0.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 rlm_realm: No '@' in User-Name = "pants", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: 'pants' rlm_sql (sql): sql_set_user escaped user --> 'pants' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM dialup_radcheck WHERE Username = 'pants' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User pants not found in radcheck radius_xlat: 'SELECT dialup_radgroupcheck.id,dialup_radgroupcheck.GroupName,dialup_radgroupch eck.Attribute,dialup_radgroupcheck.Value,dialup_radgroupcheck.op FROM dialup_radgroupcheck,dialup_usergroup WHERE dialup_usergroup.Username = 'pants' AND dialup_usergroup.GroupName = dialup_radgroupcheck.GroupName ORDER BY dialup_radgroupcheck.id' radius_xlat: 'SELECT dialup_radgroupreply.id,dialup_radgroupreply.GroupName,dialup_radgroupre ply.Attribute,dialup_radgroupreply.Value,dialup_radgroupreply.op FROM dialup_radgroupreply,dialup_usergroup WHERE dialup_usergroup.Username = 'pants' AND dialup_usergroup.GroupName = dialup_radgroupreply.GroupName ORDER BY dialup_radgroupreply.id' rlm_sql (sql): User pants not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 users: Matched entry pants at line 47 users: Matched entry DEFAULT at line 156 users: Matched entry DEFAULT at line 175 modcall[authorize]: module "files" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [pants] (from client testap port 1 cli 00-0D-93-86-48-8E) Sending Access-Accept of id 0 to 10.0.0.100:1026 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 10.0.0.100:1026, id=0, length=38 Authentication reply packet code 2 sent to a non-proxy reply port from client testap:1026 - ID 0 : IGNORED --- Walking the entire request list --- Waking up in 3 seconds... rad_recv: Access-Request packet from host 10.0.0.100:1026, id=1, length=193 Message-Authenticator = 0x593aef9381f04eb85805621b1ee22f6d Service-Type = Framed-User User-Name = "pants" Framed-MTU = 1488 Called-Station-Id = "00-11-95-DB-37-0B:TestWPA" Calling-Station-Id = "00-0D-93-86-48-8E" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201000a0170616e7473 NAS-IP-Address = 10.0.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 rlm_realm: No '@' in User-Name = "pants", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 radius_xlat: 'pants' rlm_sql (sql): sql_set_user escaped user --> 'pants' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM dialup_radcheck WHERE Username = 'pants' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User pants not found in radcheck radius_xlat: 'SELECT dialup_radgroupcheck.id,dialup_radgroupcheck.GroupName,dialup_radgroupch eck.Attribute,dialup_radgroupcheck.Value,dialup_radgroupcheck.op FROM dialup_radgroupcheck,dialup_usergroup WHERE dialup_usergroup.Username = 'pants' AND dialup_usergroup.GroupName = dialup_radgroupcheck.GroupName ORDER BY dialup_radgroupcheck.id' radius_xlat: 'SELECT dialup_radgroupreply.id,dialup_radgroupreply.GroupName,dialup_radgroupre ply.Attribute,dialup_radgroupreply.Value,dialup_radgroupreply.op FROM dialup_radgroupreply,dialup_usergroup WHERE dialup_usergroup.Username = 'pants' AND dialup_usergroup.GroupName = dialup_radgroupreply.GroupName ORDER BY dialup_radgroupreply.id' rlm_sql (sql): User pants not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns notfound for request 1 users: Matched entry pants at line 47 users: Matched entry DEFAULT at line 156 users: Matched entry DEFAULT at line 175 modcall[authorize]: module "files" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [pants] (from client testap port 1 cli 00-0D-93-86-48-8E) Sending Access-Accept of id 1 to 10.0.0.100:1026 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 44fcba57 Waking up in 4 seconds... rad_recv: Access-Accept packet from host 10.0.0.100:1026, id=1, length=38 Authentication reply packet code 2 sent to a non-proxy reply port from client testap:1026 - ID 1 : IGNORED --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 1 with timestamp 44fcba5b Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.0.0.100:1026, id=2, length=193 Message-Authenticator = 0xf0a27f90359498a1ec16af5eb7268366 Service-Type = Framed-User User-Name = "pants" Framed-MTU = 1488 Called-Station-Id = "00-11-95-DB-37-0B:TestWPA" Calling-Station-Id = "00-0D-93-86-48-8E" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0202000a0170616e7473 NAS-IP-Address = 10.0.0.100 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 rlm_realm: No '@' in User-Name = "pants", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 radius_xlat: 'pants' rlm_sql (sql): sql_set_user escaped user --> 'pants' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM dialup_radcheck WHERE Username = 'pants' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): User pants not found in radcheck radius_xlat: 'SELECT dialup_radgroupcheck.id,dialup_radgroupcheck.GroupName,dialup_radgroupch eck.Attribute,dialup_radgroupcheck.Value,dialup_radgroupcheck.op FROM dialup_radgroupcheck,dialup_usergroup WHERE dialup_usergroup.Username = 'pants' AND dialup_usergroup.GroupName = dialup_radgroupcheck.GroupName ORDER BY dialup_radgroupcheck.id' radius_xlat: 'SELECT dialup_radgroupreply.id,dialup_radgroupreply.GroupName,dialup_radgroupre ply.Attribute,dialup_radgroupreply.Value,dialup_radgroupreply.op FROM dialup_radgroupreply,dialup_usergroup WHERE dialup_usergroup.Username = 'pants' AND dialup_usergroup.GroupName = dialup_radgroupreply.GroupName ORDER BY dialup_radgroupreply.id' rlm_sql (sql): User pants not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns notfound for request 2 users: Matched entry pants at line 47 users: Matched entry DEFAULT at line 156 users: Matched entry DEFAULT at line 175 modcall[authorize]: module "files" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [pants] (from client testap port 1 cli 00-0D-93-86-48-8E) Sending Access-Accept of id 2 to 10.0.0.100:1026 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 10.0.0.100:1026, id=2, length=38 Authentication reply packet code 2 sent to a non-proxy reply port from client testap:1026 - ID 2 : IGNORED --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 2 with timestamp 44fcba61 Nothing to do. Sleeping until we see a request. Thanks, Loukas

Hi Loukas, Loukas Kalenderidis schrieb:

I'm happy to follow your advice, if you give me some that isn't just "configure stuff dude".

FreeRadius is very confusing and the docs do not explain everything in a manner, a beginner can understand. That was my problem. I found this HowTo very useful: http://www.hep.phys.soton.ac.uk/~jhe/documents/WPA-Authentication+RADIUS-HOW... Which will IMHO exactly do what you want. Start with that one and if it works start to go into details. This worked for me. Only a few hints, never forget the right OIDs in the certs and check that the time on your computers do not differ to much. And don't use Debian, because eap is not included and compilation fails on Debian. That should save you around 3 weeks of work and 2 years of your life. :-) cu Alexandros

Hi Alan, Alan DeKok schrieb:

They (and the main web page) point to EAP howto's on the main web site, which include screenshots for configuring Windows for wireless,

Thats true, but as a beginner it is not clear what is important to set up. Most people simply want to connect their notebook over WLAN to their network, other go more into detail with LDAP, SQL whatever. Knowledge about EAP-PEAP, EAP-TLS, MSCHAPv2 is still not developed. As you and others reply on questions of people on the list is very often like "tell us in detail what you want to do..." is not what many people seek, I think most expect to be told what is important and what they should do. As always in IT-Business, the customer doesn't know what he needs, but it must be nice and fancy when it is ready. :-)) FR is a great program, thanks a lot to all who work on this!

The server includes a "debian" directory, whixch is used to build debian packages.

I tried that with source-install of the deb, but compilation fails on sarge and unstable, bug list is full on debian.org, so I'am not the only one who had this problem. I think at least the eap module relies on some lib which is not GPL and not included into Debian and they try to move around it. But FR without EAP is at least for me useless. I did not try the debian dir of the official tar of freeradius.org, I will do that soon, because Suse 10.1 sucks. cu Alex P.S: I look for a good book, covering all about radius and especially FR. As an overview and as a reference.

-----Original Message----- 3. debian source package builds on unstable without problem here. And it provides a minimal intrusive way of enabling ssl and postgres related stuff.

Just to follow up. It appears that in FreeRadius 1.1.3, if you follow the directions in the WIKI http://wiki.freeradius.org/index.php/Build#Building_Debian_packages That you will get a working PEAP/TTLS EAP It has the necessary sections included. You can view what is done in the Debian/rules file

Alexandros Gougousoudis <gougousoudis@kh-berlin.de> wrote:

Thats true, but as a beginner it is not clear what is important to set up. Most people simply want to connect their notebook over WLAN to their network, other go more into detail with LDAP, SQL whatever.

That really is the fundamental problem, and one I've seen a lot. Everyone wants documentation for how to configure the server for their system. They'd rather not read through documentation for how to configure *other* peoples systems. And they'd rather not read through general documentation saying how the server works, and what each module does. I plan on addressing at least some of that with my book.

As you and others reply on questions of people on the list is very often like "tell us in detail what you want to do..." is not what many people seek, I think most expect to be told what is important and what they should do.

Yes, and many questions are "How do I configure the server to do stuff?" That's a useless question, and guaranteed to not solve the problem.

P.S: I look for a good book, covering all about radius and especially FR. As an overview and as a reference.

I'm writing one. I've got about 60 pages of good content, and 50 pages of rough notes. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

On Wed 06 Sep 2006 23:05, Lewis Bergman wrote:

----- Original Message ----- From: "Alan DeKok" <aland@deployingradius.com>

...

I plan on addressing at least some of that with my book.

...

P.S: I look for a good book, covering all about radius and especially FR. As an overview and as a reference.

I'm writing one. I've got about 60 pages of good content, and 50 pages of rough notes.

I would be glad to send you some of my configs for examples. Many of them you instructed me on how to accomplish the goal on the list. I posted a bunch on the wiki but that thing keeps getting spammed =( I would think at least ISP's would gain some insight from some of them.

The wiki should be mostly spam free these days as I have implimented some counter measures. If you notice any spam, please remove it AND notify me. Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc