Hi! I compiled the freeradius 2.2.9 on my nas and I configured a MySQL database for radius. It seems like works, but if I make a test connection from my router, it sends an Access-Reject package... If I make a radtest it also sends Access-Reject package, but if I edit the Cleartext-Password := guest1234 to Password == guest1234 it sends Access-Accept package... Why? What's wrong? Thanks for your answer!
On Mar 12, 2016, at 7:33 AM, Mr Dini <diniboy74@gmail.com> wrote:
I compiled the freeradius 2.2.9 on my nas and I configured a MySQL database for radius. It seems like works, but if I make a test connection from my router, it sends an Access-Reject package...
If I make a radtest it also sends Access-Reject package, but if I edit the Cleartext-Password := guest1234 to Password == guest1234 it sends Access-Accept package... Why?
As always, run the server in debugging mode to see why. And use "Cleartext-Password := ..." Don't use "Password ==" Alan DeKok.
Sorry, I missed the debugger output. I changed the Password to Cleartext-Password, but it not solved the problem. So I changed the password to a longer one and now it sends Access-Accept to radtest! :D But when I try it with my router and a client with PEAP it gives me "Access-Reject" message... Here is the debugger output: http://pastebin.com/raw/5TYG0vhS Thanks! 2016-03-12 15:44 GMT+01:00 Alan DeKok <aland@deployingradius.com>:
On Mar 12, 2016, at 7:33 AM, Mr Dini <diniboy74@gmail.com> wrote:
I compiled the freeradius 2.2.9 on my nas and I configured a MySQL database for radius. It seems like works, but if I make a test connection from my router, it sends an Access-Reject package...
If I make a radtest it also sends Access-Reject package, but if I edit the Cleartext-Password := guest1234 to Password == guest1234 it sends Access-Accept package... Why?
As always, run the server in debugging mode to see why.
And use "Cleartext-Password := ..." Don't use "Password =="
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mar 12, 2016, at 10:06 AM, Mr Dini <diniboy74@gmail.com> wrote:
Sorry, I missed the debugger output. I changed the Password to Cleartext-Password, but it not solved the problem. So I changed the password to a longer one and now it sends Access-Accept to radtest! :D
That's weird.
But when I try it with my router and a client with PEAP it gives me "Access-Reject" message...
Here is the debugger output: http://pastebin.com/raw/5TYG0vhS
The relevant portion is here: Sending Access-Challenge of id 0 to 192.168.1.1 port 13048 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdcf80390ddfa1a45d157fcd070d8538a Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 13048, id=0, length=121 Cleaning up request 1 ID 0 with timestamp +37 User-Name = "sqltest" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "1eb72cd00f4f" Calling-Station-Id = "00e3b22aafa3" NAS-Identifier = "1eb72cd00f4f" NAS-Port = 38 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100060319 Message-Authenticator = 0xb5d4d4fc0b4f3bd750dd632538e44460 # Executing section authorize from file /ffp/etc/raddb/sites-enabled/default The Access-Request MUST include the State attribute which was sent in the Access-Challenge. But it's not there. Your AP is broken. Throw it in the garbage, and buy one that works. If you're using an EAP test client instead of a real AP, the EAP test client is broken. Throw it in the garbage, and buy one that works. No amount of poking FreeRADIUS will fix this problem. The AP and/or EAP test client is broken. Use software that works. Alan DeKok.
participants (2)
-
Alan DeKok -
Mr Dini