Is there a more reliable method of detecting EAP then checking for the presence of an EAP-Message, I heard mention of an EAP-Type attribute... guessing this is set by the EAP module in authorize ? Is this a control attribute ? -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
On Wed, 2007-06-27 at 09:58 +0100, Arran Cudbard-Bell wrote:
Is there a more reliable method of detecting EAP then checking for the presence of an EAP-Message, I heard mention of an EAP-Type attribute... guessing this is set by the EAP module in authorize ?
EAP-Type is an internal server attribute added to the config/check items. See dictionary.freeradius.internal
Is this a control attribute ?
They're already called both "config" and "check" - let's not start calling them "control" as well!
Phil Mayers wrote:
On Wed, 2007-06-27 at 09:58 +0100, Arran Cudbard-Bell wrote:
Is there a more reliable method of detecting EAP then checking for the presence of an EAP-Message, I heard mention of an EAP-Type attribute... guessing this is set by the EAP module in authorize ?
EAP-Type is an internal server attribute added to the config/check items. See dictionary.freeradius.internal
Is this a control attribute ?
They're already called both "config" and "check" - let's not start calling them "control" as well!
As of V2 they're now called control attributes in unlang :p update control { } update request { } update reply { } Fun ! -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900
Phil Mayers wrote:
They're already called both "config" and "check" - let's not start calling them "control" as well!
"check" was used because of the "users" file. "config" was wrong, because there's also the configuration files. In 2.x, the preferred name is "control", and the docs & examples are being updated to use that. Alan DeKok.
Hi, list I have no samba installed in my linux. 1.freeradius + AD : When I user radtest tool to test user/password on Win2k3/AD, I can get correct answer when I set authenticate type to ldap too. 2.eap/peap + 8021x + freeradius + openldap: Success. 3.eap/peap + 8021x + freeradius + Win2k3/AD When I auth the Winxp user access to switch. It failed. Even if I set Authenticate type to ldap or not, why?? rad_recv: Access-Request packet from host 10.155.20.84:1077, id=179, length=206 User-Name = "hwang" NAS-IP-Address = 10.155.20.84 NAS-Identifier = "hiveos" NAS-Port = 0 Called-Station-Id = "00-19-77-00-00-34:hhe" Calling-Station-Id = "00-19-E0-80-A5-5A" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0237002b19001703010020ee2ceed58c0ee38c2943f392498a1d0ce71f57156ed1e81ea1ae15ad61a5f53b State = 0x00bebc716634b88b8ea1ecd2216ccf25 Message-Authenticator = 0xec79f9c13e33bd20c35a6a6a7d6f291d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 65 modcall[authorize]: module "mschap" returns noop for request 65 rlm_realm: No '@' in User-Name = "hwang", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 65 rlm_eap: EAP packet type response id 55 length 43 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 65 rlm_ldap: - authorize rlm_ldap: performing user authorization for hwang radius_xlat: '(cn=hwang)' radius_xlat: 'cn=users,dc=aehve,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=users,dc=aehve,dc=com, with filter (cn=hwang) rlm_ldap: checking if remote access for hwang is allowed by cn rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user hwang authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 65 modcall: leaving group authorize (returns updated) for request 65 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 65 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 65 modcall: leaving group authenticate (returns invalid) for request 65 auth: Failed to validate the user. Sending Access-Reject of id 179 to 10.155.20.84 port 1077 EAP-Message = 0x04370004 Thanks! John --------------------------------- 抢注雅虎免费邮箱3.5G容量，20M附件！
Hangjun He wrote:
* I have no samba installed in my linux.*
Then you won't get PEAP to work with AD. There's a reason the howto's say to use Samba: it's needed.
*3.eap/peap + 8021x + freeradius + Win2k3/AD* * When I auth the Winxp user access to switch. It failed. Even if I set Authenticate type to ldap or not, why?? *
Because AD is not an LDAP server. Install Samba. Follow the howto's. Alan DeKok.
Thanks Alan DeKok. But there are no enough memory on my linux system to install samba. What should I do? John Alan DeKok <aland@deployingradius.com> 写道： Hangjun He wrote:
* I have no samba installed in my linux.*
Then you won't get PEAP to work with AD. There's a reason the howto's say to use Samba: it's needed.
*3.eap/peap + 8021x + freeradius + Win2k3/AD* * When I auth the Winxp user access to switch. It failed. Even if I set Authenticate type to ldap or not, why?? *
Because AD is not an LDAP server. Install Samba. Follow the howto's. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html --------------------------------- 抢注雅虎免费邮箱3.5G容量，20M附件！
Ｃan I start ldap-auth after eap authenticate failed..just like radclient. Hangjun He <elmerhe@yahoo.com.cn> 写道： Thanks Alan DeKok. But there are no enough memory on my linux system to install samba. What should I do? John Alan DeKok <aland@deployingradius.com> 写道： Hangjun He wrote:
* I have no samba installed in my linux.*
Then you won't get PEAP to work with AD. There's a reason the howto's say to use Samba: it's needed.
*3.eap/peap + 8021x + freeradius + Win2k3/AD* * When I auth the Winxp user access to switch. It failed. Even if I set Authenticate type to ldap or not, why?? *
Because AD is not an LDAP server. Install Samba. Follow the howto's. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html --------------------------------- 抢注雅虎免费邮箱3.5G容量，20M附件！ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html --------------------------------- 抢注雅虎免费邮箱3.5G容量，20M附件！
On Wed, 2007-06-27 at 13:00 +0200, Alan DeKok wrote:
Phil Mayers wrote:
They're already called both "config" and "check" - let's not start calling them "control" as well!
"check" was used because of the "users" file. "config" was wrong, because there's also the configuration files.
In 2.x, the preferred name is "control", and the docs & examples are being updated to use that.
Ok, as long as we pick one ;o) Cheers, Phil
Arran Cudbard-Bell wrote:
Is there a more reliable method of detecting EAP then checking for the presence of an EAP-Message, I heard mention of an EAP-Type attribute... guessing this is set by the EAP module in authorize ?
EAP *is* detected by the presence of EAP-Message. Alan DeKok.
participants (4)
-
Alan DeKok -
Arran Cudbard-Bell -
Hangjun He -
Phil Mayers