Hi, i try to install 802.1x enviroment (windows 2000 -> Cisco Switch -> freeradius). The switch only allow auhtentificated clients (windows) to send packets to the intranet. All works well, but all the time freeradius reject because no User-Password, but i insert one in the login screen. System: Freeradius 1.0.4, Windows 2000, Cisco 3550 Log: rad_recv: Access-Request packet from host 192.168.1.3:1812, id=6, length=98 NAS-IP-Address = 192.168.1.3 NAS-Port = 50010 NAS-Port-Type = Ethernet User-Name = "test" Calling-Station-Id = "00-04-75-DA-4C-C8" Service-Type = Framed-User EAP-Message = 0x020100090174657374 Message-Authenticator = 0x05ada6b6c1de489b42a378805df01aac Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry test at line 54 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. User Entry: test Auth-Type := Local, User-Passwort == "xxx" Service-Type = Framed-User And i insert the password in the login screen (windows client) Thx for help and hints -- Weitersagen: GMX DSL-Flatrates mit Tempo-Garantie! Ab 4,99 Euro/Monat: http://www.gmx.net/de/go/dsl
"Michael Langer" <mphantom@gmx.net> wrote:
The switch only allow auhtentificated clients (windows) to send packets to the intranet. All works well, but all the time freeradius reject because no User-Password, but i insert one in the login screen.
Ok...
EAP-Message = 0x020100090174657374
So the supplicant is doing EAP, and the switch is sending EAP to the server.
rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
Hmm.. the EAP module should see that EAP packet as an EAP-Identity, and start doing EAP. Do you have any EAP types configured in the server? Alan DeKok.
--- Ursprüngliche Nachricht --- Von: "Alan DeKok" <aland@ox.org> An: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Betreff: Re: Win 2000 -> Cisco 3550 -> freeradius Datum: Mon, 04 Jul 2005 12:07:39 -0400
"Michael Langer" <mphantom@gmx.net> wrote:
The switch only allow auhtentificated clients (windows) to send packets to the intranet. All works well, but all the time freeradius reject because no User-Password, but i insert one in the login screen.
Ok...
EAP-Message = 0x020100090174657374
So the supplicant is doing EAP, and the switch is sending EAP to the server.
rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
Hmm.. the EAP module should see that EAP packet as an EAP-Identity, and start doing EAP.
Do you have any EAP types configured in the server?
Alan DeKok.
I copy the sections, if you need further information plz say it. (I thought the whole files will be to much) ->radiusd.conf: modules { ... $INCLUDE §(confdir)/eap.conf ... } authorize { ... eap ... } authenticate { ... eap } -> eap.conf: eap{ default_eap_type = peap ... md5 { } leap{ } gtc{ auth_type = PAP } tls{ ... } peap{ default_eap_type = mschapv2 } mschapv2{ } } -- Weitersagen: GMX DSL-Flatrates mit Tempo-Garantie! Ab 4,99 Euro/Monat: http://www.gmx.net/de/go/dsl
Hi, you need further informations? Plz can one help? Why
rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation occurs? I cant handle it on my own :(
thx Michael
--- Ursprüngliche Nachricht --- Von: "Alan DeKok" <aland@ox.org> An: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Betreff: Re: Win 2000 -> Cisco 3550 -> freeradius Datum: Mon, 04 Jul 2005 12:07:39 -0400
"Michael Langer" <mphantom@gmx.net> wrote:
The switch only allow auhtentificated clients (windows) to send packets to the intranet. All works well, but all the time freeradius reject because no User-Password, but i insert one in the login screen.
Ok...
EAP-Message = 0x020100090174657374
So the supplicant is doing EAP, and the switch is sending EAP to the server.
rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
Hmm.. the EAP module should see that EAP packet as an EAP-Identity, and start doing EAP.
Do you have any EAP types configured in the server?
Alan DeKok.
I copy the sections, if you need further information plz say it. (I thought the whole files will be to much) ->radiusd.conf: modules { ... $INCLUDE §(confdir)/eap.conf ... } authorize { ... eap ... } authenticate { ... eap } -> eap.conf: eap{ default_eap_type = peap ... md5 { } leap{ } gtc{ auth_type = PAP } tls{ ... } peap{ default_eap_type = mschapv2 } mschapv2{ } }
"Michael Langer" <mphantom@gmx.net> wrote:
you need further informations? Plz can one help? Why
rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation occurs? I cant handle it on my own :(
Those messages are fine. As to why the server doesn't do EAP, I don't know. I didn't see anything special in the debug logs. All I know is that the default configuration works. Start with that, and edit it, and test it, until you get the configuration you want. Alan DeKok.
Try change auth-type to EAP. ----- Original Message ----- From: "Michael Langer" <mphantom@gmx.net> To: <freeradius-users@lists.freeradius.org> Sent: Monday, July 04, 2005 18:30 Subject: Win 2000 -> Cisco 3550 -> freeradius
Hi,
i try to install 802.1x enviroment (windows 2000 -> Cisco Switch -> freeradius).
The switch only allow auhtentificated clients (windows) to send packets to the intranet. All works well, but all the time freeradius reject because no User-Password, but i insert one in the login screen.
System: Freeradius 1.0.4, Windows 2000, Cisco 3550
Log: rad_recv: Access-Request packet from host 192.168.1.3:1812, id=6, length=98 NAS-IP-Address = 192.168.1.3 NAS-Port = 50010 NAS-Port-Type = Ethernet User-Name = "test" Calling-Station-Id = "00-04-75-DA-4C-C8" Service-Type = Framed-User EAP-Message = 0x020100090174657374 Message-Authenticator = 0x05ada6b6c1de489b42a378805df01aac Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry test at line 54 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user.
User Entry: test Auth-Type := Local, User-Passwort == "xxx" Service-Type = Framed-User
And i insert the password in the login screen (windows client)
Thx for help and hints
-- Weitersagen: GMX DSL-Flatrates mit Tempo-Garantie! Ab 4,99 Euro/Monat: http://www.gmx.net/de/go/dsl - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Jefri bin Dahari -
Michael Langer