Certificate validation checkbox - windows 7 wired
Hi all, I'm getting an odd problem where even when my clients are configured not to validate the server certificate (test environment at the mo) on their wired connections they are failing to authenticate on one freeradius server but getting access-accept on another. Debug output shows the familiar: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xbec39c4bbac58529 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! I accept that it's very likely I've messed something up with install of the secondary server, and am planning to wipe it and start again tomorrow and THEN introduce the production certificates, but I'm confused as to why this certificate compatibility issue would even be mentioned in the debug if my client is set to validate any server. The odd thing is that my wireless clients are authenticating fine through this server, also set to not validate the server. Can anybody shed any light please? Cheers, Andi ________________________________
From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
On Tue, Jul 24, 2012 at 03:47:03PM +0000, Morris, Andi wrote:
I'm getting an odd problem where even when my clients are configured not to validate the server certificate (test environment at the mo) on their wired connections they are failing to authenticate on one freeradius server but getting access-accept on another.
That error is generated when the client goes away in the middle of the EAP transaction. The most usual is that a Windows client sees a server certificate that it doesn't like for some reason, such as it missing the OIDs that Microsoft decided should be included. Hence the certificate compatibility problem. If you copy the server certs from the working server to the broken one, does it all start to work then? However, the client rejecting the cert isn't the only cause of this - anything that causes the client to stop doing EAP can give that error, for example client wandering out of range at the wrong moment, or the wireless system (AP / wireless controller / etc) disconnecting the client for some reason. EAP timers in Cisco Wireless Controllers can give this issue if set incorrectly (e.g. to the defaults... :) ) The error is basically "Hey, I was talking to you, but you've stopped responding".
Can anybody shed any light please?
Diff the configs & certs for a start. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On 24/07/12 16:47, Morris, Andi wrote:
Hi all,
I'm getting an odd problem where even when my clients are configured not to validate the server certificate (test environment at the mo) on their wired connections they are failing to authenticate on one freeradius server but getting access-accept on another.
Debug output shows the familiar:
Can you show the full debug? It is VERY occasionally not SSL validation, but a failure of MSCHAP mutual auth that causes this; often Samba has "gone funny", or there's some ntlm_auth misconfiguration.
Cheers both, this is only happening for wired clients, so it's definitely not that they're wandering out of AP range. Very odd why it would only happen for wired clients though. Interesting to read that it's not necessarily a problem with the certificate, I'll double and triple check all my mschap and ntlm_auth configs first thing tomorrow. I'll see if it still happens after I reinstall tomorrow and post full debugs and configs if so. Thanks, Andi ________________________________________ From: freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org [freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org] on behalf of Phil Mayers [p.mayers@imperial.ac.uk] Sent: 24 July 2012 17:13 To: freeradius-users@lists.freeradius.org Subject: Re: Certificate validation checkbox - windows 7 wired On 24/07/12 16:47, Morris, Andi wrote:
Hi all,
I'm getting an odd problem where even when my clients are configured not to validate the server certificate (test environment at the mo) on their wired connections they are failing to authenticate on one freeradius server but getting access-accept on another.
Debug output shows the familiar:
Can you show the full debug? It is VERY occasionally not SSL validation, but a failure of MSCHAP mutual auth that causes this; often Samba has "gone funny", or there's some ntlm_auth misconfiguration. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>
OK, one reinstall later and the exact same thing is occurring. Users on the wireless network (NAS 10.1.1.13) can authenticate, whereas users on the wired network (example NAS 10.1.1.125) cannot and see the certificate_compatibility error. The same setup on my primary FR server authenticates both clients. I'll happily attach an output from that server to a separate email if anyone needs to see it. I've attached the full debug if anyone would be so kind to have a look please? I've run it through the online parser but it doesn't point anything obvious out to me. Much appreciated as always, Andi -----Original Message----- From: freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org] On Behalf Of Morris, Andi Sent: 24 July 2012 18:05 To: FreeRadius users mailing list Subject: RE: Certificate validation checkbox - windows 7 wired Cheers both, this is only happening for wired clients, so it's definitely not that they're wandering out of AP range. Very odd why it would only happen for wired clients though. Interesting to read that it's not necessarily a problem with the certificate, I'll double and triple check all my mschap and ntlm_auth configs first thing tomorrow. I'll see if it still happens after I reinstall tomorrow and post full debugs and configs if so. Thanks, Andi ________________________________________ From: freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org [freeradius-users-bounces+amorris=cardiffmet.ac.uk@lists.freeradius.org] on behalf of Phil Mayers [p.mayers@imperial.ac.uk] Sent: 24 July 2012 17:13 To: freeradius-users@lists.freeradius.org Subject: Re: Certificate validation checkbox - windows 7 wired On 24/07/12 16:47, Morris, Andi wrote:
Hi all,
I'm getting an odd problem where even when my clients are configured not to validate the server certificate (test environment at the mo) on their wired connections they are failing to authenticate on one freeradius server but getting access-accept on another.
Debug output shows the familiar:
Can you show the full debug? It is VERY occasionally not SSL validation, but a failure of MSCHAP mutual auth that causes this; often Samba has "gone funny", or there's some ntlm_auth misconfiguration. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Matthew Newton -
Morris, Andi -
Phil Mayers