eap_peap: We sent a success, but the client did not agree [FreeRadius + samba4 AD + dynamic vlans]
Hello guys, At first everything is ok with the settings. I made internal tests with radtest and the authentication of a domain user is done correctly. I also tested with pfsense's captiveportal and it worked correctly. We have a wifi controller from the motorola and created a ssid and set the AAA profile as it showed in the extreme support itself. After trying to connect via mobile with android, the following error occurs: Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: [eaptls process] = ok Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Session established. Decoding tunneled attributes Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: PEAP state send tlv success Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Received EAP-TLV response Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Client rejected our response. The password is probably incorrect *Wed Jul 18 14:44:25 2018 : ERROR: (71) eap_peap: We sent a success, but the client did not agree* *Wed Jul 18 14:44:25 2018 : ERROR: (71) eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed* Wed Jul 18 14:44:25 2018 : Debug: (71) eap: Sending EAP Failure (code 4) ID 12 length 4 Wed Jul 18 14:44:25 2018 : Debug: (71) eap: Failed in EAP select Wed Jul 18 14:44:25 2018 : Debug: (71) modsingle[authenticate]: returned from eap (rlm_eap) Wed Jul 18 14:44:25 2018 : Debug: (71) [eap] = invalid Wed Jul 18 14:44:25 2018 : Debug: (71) } # authenticate = invalid Wed Jul 18 14:44:25 2018 : Debug: (71) Failed to authenticate the user Wed Jul 18 14:44:25 2018 : Debug: (71) Using Post-Auth-Type Reject Wed Jul 18 14:44:25 2018 : Debug: (71) # Executing group from file /etc/freeradius/3.0/sites-enabled/default Wed Jul 18 14:44:25 2018 : Debug: (71) Post-Auth-Type REJECT { Wed Jul 18 14:44:25 2018 : Debug: (71) modsingle[post-auth]: calling ldap (rlm_ldap) https://pastebin.com/raw/Nzki0y1d (sites-enable/default and inner-tunnel Has anyone ever had this problem? -- Elias Pereira
On Jul 18, 2018, at 2:12 PM, Elias Pereira <empbilly@gmail.com> wrote:
At first everything is ok with the settings. I made internal tests with radtest and the authentication of a domain user is done correctly. I also tested with pfsense's captiveportal and it worked correctly.
We have a wifi controller from the motorola and created a ssid and set the AAA profile as it showed in the extreme support itself.
After trying to connect via mobile with android, the following error occurs:
Read http://wiki.freeradius.org/list-help. We want to see "radiusd -X". Not "radiusd -Xxxxxxxxx"
Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: [eaptls process] = ok Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Session established. Decoding tunneled attributes Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: PEAP state send tlv success Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Received EAP-TLV response Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Client rejected our response. The password is probably incorrect
That message should be clear.
*Wed Jul 18 14:44:25 2018 : ERROR: (71) eap_peap: We sent a success, but the client did not agree* *Wed Jul 18 14:44:25 2018 : ERROR: (71) eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed*
OK... so you're ignoring the one useful message, and worrying about two *subsequent* messages?
Has anyone ever had this problem?
Yes. When the password is incorrect. If you want to get it working, there is a step-by-step guide on my web site: http://deployingradius.com Alan DeKok.
I forgot to mention it in the first email. I configured the ldap module so that I could work with groups and redirect to the corresponding vlan.
Read http://wiki.freeradius.org/list-help. We want to see "radiusd -X". Not "radiusd -Xxxxxxxxx"
Ok. Thanks! That message should be clear.
*Wed Jul 18 14:44:25 2018 : ERROR: (71) eap_peap: We sent a success, but the client did not agree* *Wed Jul 18 14:44:25 2018 : ERROR: (71) eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed* OK... so you're ignoring the one useful message, and worrying about two *subsequent* messages?
New log in the pastbin. All logs refer to 1 or 2 cell authentication attempts. https://pastebin.com/raw/45tzkG6w Yes. When the password is incorrect. At first the password is correct. I put the very easy password to test. :) If you want to get it working, there is a step-by-step guide on my web
Ok. Thanks for the guide. PAP ok EAP ok Create certificate ok Import ? I tried importing the ca.der to my android, but did not recognize it. Which certificate does it import? On Wed, Jul 18, 2018 at 3:50 PM Alan DeKok <aland@deployingradius.com> wrote:
On Jul 18, 2018, at 2:12 PM, Elias Pereira <empbilly@gmail.com> wrote:
At first everything is ok with the settings. I made internal tests with radtest and the authentication of a domain user is done correctly. I also tested with pfsense's captiveportal and it worked correctly.
We have a wifi controller from the motorola and created a ssid and set
the
AAA profile as it showed in the extreme support itself.
After trying to connect via mobile with android, the following error occurs:
Read http://wiki.freeradius.org/list-help.
We want to see "radiusd -X". Not "radiusd -Xxxxxxxxx"
Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: [eaptls process] = ok Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Session established. Decoding tunneled attributes Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: PEAP state send tlv success Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Received EAP-TLV response Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Client rejected our response. The password is probably incorrect
That message should be clear.
*Wed Jul 18 14:44:25 2018 : ERROR: (71) eap_peap: We sent a success, but the client did not agree* *Wed Jul 18 14:44:25 2018 : ERROR: (71) eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed*
OK... so you're ignoring the one useful message, and worrying about two *subsequent* messages?
Has anyone ever had this problem?
Yes. When the password is incorrect.
If you want to get it working, there is a step-by-step guide on my web site:
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Elias Pereira
Any tips & tricks here? :) On Wed, Jul 18, 2018 at 5:16 PM Elias Pereira <empbilly@gmail.com> wrote:
I forgot to mention it in the first email. I configured the ldap module so that I could work with groups and redirect to the corresponding vlan.
Read http://wiki.freeradius.org/list-help. We want to see "radiusd -X". Not "radiusd -Xxxxxxxxx"
Ok. Thanks!
That message should be clear.
*Wed Jul 18 14:44:25 2018 : ERROR: (71) eap_peap: We sent a success, but the client did not agree* *Wed Jul 18 14:44:25 2018 : ERROR: (71) eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed* OK... so you're ignoring the one useful message, and worrying about two *subsequent* messages?
New log in the pastbin. All logs refer to 1 or 2 cell authentication attempts. https://pastebin.com/raw/45tzkG6w
Yes. When the password is incorrect.
At first the password is correct. I put the very easy password to test. :)
If you want to get it working, there is a step-by-step guide on my web
Ok. Thanks for the guide.
PAP ok EAP ok Create certificate ok Import ?
I tried importing the ca.der to my android, but did not recognize it. Which certificate does it import?
On Wed, Jul 18, 2018 at 3:50 PM Alan DeKok <aland@deployingradius.com> wrote:
On Jul 18, 2018, at 2:12 PM, Elias Pereira <empbilly@gmail.com> wrote:
At first everything is ok with the settings. I made internal tests with radtest and the authentication of a domain user is done correctly. I
also
tested with pfsense's captiveportal and it worked correctly.
We have a wifi controller from the motorola and created a ssid and set the AAA profile as it showed in the extreme support itself.
After trying to connect via mobile with android, the following error occurs:
Read http://wiki.freeradius.org/list-help.
We want to see "radiusd -X". Not "radiusd -Xxxxxxxxx"
Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: [eaptls process] = ok Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Session established. Decoding tunneled attributes Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: PEAP state send tlv success Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Received EAP-TLV response Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Client rejected our response. The password is probably incorrect
That message should be clear.
*Wed Jul 18 14:44:25 2018 : ERROR: (71) eap_peap: We sent a success, but the client did not agree* *Wed Jul 18 14:44:25 2018 : ERROR: (71) eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed*
OK... so you're ignoring the one useful message, and worrying about two *subsequent* messages?
Has anyone ever had this problem?
Yes. When the password is incorrect.
If you want to get it working, there is a step-by-step guide on my web site:
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Elias Pereira
-- Elias Pereira
New logs shows. ... (11) eap_peap: The users session was previously rejected: returning reject (again.) (11) eap_peap: This means you need to read the PREVIOUS messages in the debug output (11) eap_peap: to find out the reason why the user was rejected (11) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you (11) eap_peap: what went wrong, and how to fix the problem (11) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed ... Full log: https://pastebin.com/raw/8qaPZwqK On Thu, Jul 19, 2018 at 10:19 AM Elias Pereira <empbilly@gmail.com> wrote:
Any tips & tricks here? :)
On Wed, Jul 18, 2018 at 5:16 PM Elias Pereira <empbilly@gmail.com> wrote:
I forgot to mention it in the first email. I configured the ldap module so that I could work with groups and redirect to the corresponding vlan.
Read http://wiki.freeradius.org/list-help. We want to see "radiusd -X". Not "radiusd -Xxxxxxxxx"
Ok. Thanks!
That message should be clear.
*Wed Jul 18 14:44:25 2018 : ERROR: (71) eap_peap: We sent a success, but the client did not agree* *Wed Jul 18 14:44:25 2018 : ERROR: (71) eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed* OK... so you're ignoring the one useful message, and worrying about two *subsequent* messages?
New log in the pastbin. All logs refer to 1 or 2 cell authentication attempts. https://pastebin.com/raw/45tzkG6w
Yes. When the password is incorrect.
At first the password is correct. I put the very easy password to test. :)
If you want to get it working, there is a step-by-step guide on my web
Ok. Thanks for the guide.
PAP ok EAP ok Create certificate ok Import ?
I tried importing the ca.der to my android, but did not recognize it. Which certificate does it import?
On Wed, Jul 18, 2018 at 3:50 PM Alan DeKok <aland@deployingradius.com> wrote:
On Jul 18, 2018, at 2:12 PM, Elias Pereira <empbilly@gmail.com> wrote:
At first everything is ok with the settings. I made internal tests with radtest and the authentication of a domain user is done correctly. I
also
tested with pfsense's captiveportal and it worked correctly.
We have a wifi controller from the motorola and created a ssid and set the AAA profile as it showed in the extreme support itself.
After trying to connect via mobile with android, the following error occurs:
Read http://wiki.freeradius.org/list-help.
We want to see "radiusd -X". Not "radiusd -Xxxxxxxxx"
Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: [eaptls process] = ok Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Session established. Decoding tunneled attributes Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: PEAP state send tlv success Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Received EAP-TLV response Wed Jul 18 14:44:25 2018 : Debug: (71) eap_peap: Client rejected our response. The password is probably incorrect
That message should be clear.
*Wed Jul 18 14:44:25 2018 : ERROR: (71) eap_peap: We sent a success, but the client did not agree* *Wed Jul 18 14:44:25 2018 : ERROR: (71) eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed*
OK... so you're ignoring the one useful message, and worrying about two *subsequent* messages?
Has anyone ever had this problem?
Yes. When the password is incorrect.
If you want to get it working, there is a step-by-step guide on my web site:
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Elias Pereira
-- Elias Pereira
-- Elias Pereira
On Jul 19, 2018, at 2:11 PM, Elias Pereira <empbilly@gmail.com> wrote:
New logs shows.
... (11) eap_peap: The users session was previously rejected: returning reject (again.) (11) eap_peap: This means you need to read the PREVIOUS messages in the debug output
Which generally means READ THE PREVIOUS MESSAGES. What part of that is unclear? From the logs: (10) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (10) authenticate { (10) eap: Expiring EAP session with state 0x67a3fc4367a8e64c (10) eap: Finished EAP session with state 0x67a3fc4367a8e64c (10) eap: Previous EAP request found for state 0x67a3fc4367a8e64c, released from the list (10) eap: Peer sent packet with method EAP MSCHAPv2 (26) (10) eap: Calling submodule eap_mschapv2 to process data (10) eap_mschapv2: Auth-Type sub-section not found. Ignoring. You edited the default configuration and broke it. Don't do that. a) start with the default config b) follow the documentation c) it WILL work Alan DeKok.
Hello Alan, Thanks for all your help!! I have reviewed the conf files and the mschap entry in the authenticate block from sites-enable/default was disabled. I guess that's why it was not working properly. On Thu, Jul 19, 2018 at 5:12 PM Alan DeKok <aland@deployingradius.com> wrote:
On Jul 19, 2018, at 2:11 PM, Elias Pereira <empbilly@gmail.com> wrote:
New logs shows.
... (11) eap_peap: The users session was previously rejected: returning reject (again.) (11) eap_peap: This means you need to read the PREVIOUS messages in the debug output
Which generally means READ THE PREVIOUS MESSAGES.
What part of that is unclear?
From the logs:
(10) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (10) authenticate { (10) eap: Expiring EAP session with state 0x67a3fc4367a8e64c (10) eap: Finished EAP session with state 0x67a3fc4367a8e64c (10) eap: Previous EAP request found for state 0x67a3fc4367a8e64c, released from the list (10) eap: Peer sent packet with method EAP MSCHAPv2 (26) (10) eap: Calling submodule eap_mschapv2 to process data (10) eap_mschapv2: Auth-Type sub-section not found. Ignoring.
You edited the default configuration and broke it. Don't do that.
a) start with the default config
b) follow the documentation
c) it WILL work
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Elias Pereira
participants (2)
-
Alan DeKok -
Elias Pereira