WPA2/AES + MSCHAPv2 + FreeRADIUS + NO AD/LDAP - Help w/ Local Config
Good afternoon, I have a configuration scenario that I have researched all day long (8+ hours now) and cannot solve. I know I must be missing something simple, but I'm not sure what that is. The environment is a small business location with Cisco 1130AG Access Points. We are currently use LEAP using the built in RADIUS server of the Cisco 1130AG, but need to move to an MSCHAPv2 solution for software compatibility reasons. This remote branch has no need for Active Directory due to cost/size so I essentially want to store usernames/passwords in the users.conf file I believe. The problem I have is that when I try to establish the connection from the Windows machine to the AP/FreeRADIUS, I can see the activity in FreeRADIUS debug, but it never authenticates. I can get a whole range of errors based on different configs I have tried, but I think the problem is rooted in the fact that it keeps inserting the computer name in front of the username. For example MYCOMPUTER\Bob. This is a problem because I just want usernames to authenticate no matter what computer they access from. Bob should be able to authenticate from a number of PCs. The most recent error received is: rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Login incorrect: [MYPCNAME\Username/<no User-Password attribute>] (from client TEST-AP p ort 464 cli 0016.e3af.2388) I appreciate any insight anyone can provide. As I mentioned, I looked around all day for a similar setup, but all I found were scenarios utilizing backend authentication databases like LDAP or Active Directory. Thanks in advance, Craig -- View this message in context: http://www.nabble.com/WPA2-AES-%2B-MSCHAPv2-%2B-FreeRADIUS-%2B-NO-AD-LDAP---... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Cregester said:
fact that it keeps inserting the computer name in front of the username. For example MYCOMPUTER\Bob. This is a problem because I just want usernames to authenticate no matter what computer they access from. Bob should be able to authenticate from a number of PCs.
Not sure if this is the problem, but did you enable this in the mschap module section of radiusd.conf: # Windows sends us a username in the form of # DOMAIN\user, but sends the challenge response # based on only the user portion. This hack # corrects for that incorrect behavior. # with_ntdomain_hack = yes -- hugh
Thank you for the response. Yes, that is one item I have turned off and on, trying to figure out exactly which way is better in my case. Most recently, I left it turned on. cheesegrits wrote:
Cregester said:
fact that it keeps inserting the computer name in front of the username. For example MYCOMPUTER\Bob. This is a problem because I just want usernames to authenticate no matter what computer they access from. Bob should be able to authenticate from a number of PCs.
Not sure if this is the problem, but did you enable this in the mschap module section of radiusd.conf:
# Windows sends us a username in the form of # DOMAIN\user, but sends the challenge response # based on only the user portion. This hack # corrects for that incorrect behavior. # with_ntdomain_hack = yes
-- hugh
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- View this message in context: http://www.nabble.com/WPA2-AES-%2B-MSCHAPv2-%2B-FreeRADIUS-%2B-NO-AD-LDAP---... Sent from the FreeRadius - User mailing list archive at Nabble.com.
hi, another thing you will have to change is either 1) configure the PCs to NOT log in using their username and password - then they login via the supplicant instead 2) use rlm_attr_rewrite to strip any thing that starts with blablah\ alan
Thanks for the response. I would prefer not to use a supplicant, but regarding #2, that is what I've been trying to figure out but cannot figure out how. Since the machines are not within a domain, they pass their PC Name instead of the domain, therefore I need to strip anything that starts with *\\ if possible... matching any computer name. This is what I need help on I believe. A.L.M.Buxey wrote:
hi,
another thing you will have to change is either
1) configure the PCs to NOT log in using their username and password - then they login via the supplicant instead
2) use rlm_attr_rewrite to strip any thing that starts with blablah\
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- View this message in context: http://www.nabble.com/WPA2-AES-%2B-MSCHAPv2-%2B-FreeRADIUS-%2B-NO-AD-LDAP---... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi,
I would prefer not to use a supplicant, but regarding #2, that is what I've
no supplicant = no 802.1x login. you are aware that windows2k, windowsXP and vista all come with the microsoft supplicant? just reconfigure that - its the 'wireless configurator' just go to the 'advanced settings; for the wireless and change the PEAP settings. alan
Yes, I am aware of the config options in XP and Vista. Vista in particular is what we are using here. I do not refer to the Vista configuration methods as a supplicant (perhaps in error) because I think of a supplicant as additional software (supplementing something...). So what are you purposing I reconfigure in the Vista configuration? I have changed it to PEAP settings, but as my initial issue states, Vista still tries to send the PCNAME\Username format. There is not an option I'm aware of to turn this off in Vista/XP. Since we are not joined to a domain, I need that PCNAME\ stripped off and then authenticate the Vista Username/Password against the users.conf file. That is what I can't figure out how to configure. Thanks for your continuing help!! A.L.M.Buxey wrote:
Hi,
I would prefer not to use a supplicant, but regarding #2, that is what I've
no supplicant = no 802.1x login.
you are aware that windows2k, windowsXP and vista all come with the microsoft supplicant? just reconfigure that - its the 'wireless configurator' just go to the 'advanced settings; for the wireless and change the PEAP settings.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- View this message in context: http://www.nabble.com/WPA2-AES-%2B-MSCHAPv2-%2B-FreeRADIUS-%2B-NO-AD-LDAP---... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi,
So what are you purposing I reconfigure in the Vista configuration? I have changed it to PEAP settings, but as my initial issue states, Vista still tries to send the PCNAME\Username format. There is not an option I'm aware of to turn this off in Vista/XP. Since we are not joined to a domain, I need that PCNAME\ stripped off and then authenticate the Vista Username/Password against the users.conf file. That is what I can't figure out how to configure.
you can configure the PEAP settings on a vista box, then export those settings , edit them, if needed, and simply reimport them onto other systems using netsh and the XML method that vista supports eg: http://support.microsoft.com/kb/929847 (ignore the title of this KB..its the text you want to read. alan
So what are you purposing I reconfigure in the Vista configuration? I have changed it to PEAP settings, but as my initial issue states, Vista still tries to send the PCNAME\Username format. There is not an option I'm aware of to turn this off in Vista/XP.
http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO#Con... BTW word supplicant has nothing to do with word supplement (addition) but means someone supplying a request (application) for addmission. Ivan Kalik Kalik Informatika ISP
tnt@kalik.co.yu said:
BTW word supplicant has nothing to do with word supplement (addition) but means someone supplying a request (application) for addmission.
From the Latin root "supplicare", "to kneel down".
I rather like the Kernerman definition of "a person begging humbly and earnestly". As a BOFH admin, I think more users should be encouraged to do this. Off topic, I know, but it's the weekend. :)
Ivan Kalik Kalik Informatika ISP
-- hugh
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
cregester -
Hugh Messenger -
tnt＠kalik.co.yu