Authentication failure - PEAP - MS-CHAPv2
Dear List, I'm having a strange issue with FreeRADIUS 2.1.4, using a configuration with the following items: - Cisco Aironet 1130AG access point - Ubuntu-based server with FreeRADIUS and OpenLDAP - Client machines (Windows XP SP2, Ubuntu 9.04) The issue I have is, that I don't get a response from the client after the server sends an Access-Challange packet. The certificates were made with the bootstrap script of FreeRADIUS, so it already contains the OIDs required by Windows. The AP is configured correctly, IP-address, port numbers and shared secret are properly set up, I've already checked them. Users are stored in an LDAP database and each user has a sambaNTPassword attribute, which contains an NT-hashed password. LDAP-RADIUS attribute mappings are properly set (NT-Password -> sambaNTPassword). The strange thing is, that I can successfully authenticate using an EAP test tool (eapol_test), no errors show up in the output. Using another AP with a slightly different configuration (using smbpasswd instead of LDAP for authorization) works, too. I've also read, that XP SP2 is incompatible with third-party RADIUS-servers. I decided to install SP3, but it did not help. What I can see, is an Access-Challange message at the end of the debug output. What can be wrong with my configuration? Can it be, that it's an incompatibility issue between FreeRADIUS and the access point? Thank you for your help in advance! Best regards: Gergely Kiss
I'm having a strange issue with FreeRADIUS 2.1.4, using a configuration with the following items:
- Cisco Aironet 1130AG access point - Ubuntu-based server with FreeRADIUS and OpenLDAP - Client machines (Windows XP SP2, Ubuntu 9.04)
The issue I have is, that I don't get a response from the client after the server sends an Access-Challange packet. The certificates were made with the bootstrap script of FreeRADIUS, so it already contains the OIDs required by Windows.
The AP is configured correctly, IP-address, port numbers and shared secret are properly set up, I've already checked them. Users are stored in an LDAP database and each user has a sambaNTPassword attribute, which contains an NT-hashed password. LDAP-RADIUS attribute mappings are properly set (NT-Password -> sambaNTPassword). The strange thing is, that I can successfully authenticate using an EAP test tool (eapol_test), no errors show up in the output. Using another AP with a slightly different configuration (using smbpasswd instead of LDAP for authorization) works, too. I've also read, that XP SP2 is incompatible with third-party RADIUS-servers. I decided to install SP3, but it did not help. What I can see, is an Access-Challange message at the end of the debug output.
What can be wrong with my configuration? Can it be, that it's an incompatibility issue between FreeRADIUS and the access point?
Post the debug. Ivan Kalik Kalik Informatika ISP
I'm not able to do that now. I only saw two interesting things in the output: a warning message about the LDAP directory, but that's okay, because there are no clear text passwords, only NT-hashed ones. The output tells me, that the user is authorized for access. Then, the EAP conversation starts, no errors can be seen. The last message in the output tells me, that the server sent an Access-Challange packet, but nothing happens after that. 2009/6/10 Ivan Kalik <tnt@kalik.net>
Post the debug.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
kissg wrote:
I'm not able to do that now. I only saw two interesting things in the output: a warning message about the LDAP directory, but that's okay, because there are no clear text passwords, only NT-hashed ones. The output tells me, that the user is authorized for access. Then, the EAP conversation starts, no errors can be seen. The last message in the output tells me, that the server sent an Access-Challange packet, but nothing happens after that.
Blame Windows. It's the one deciding to stop the EAP process. Alan DeKok.
The strange thing is, that the same happens, if I try to connect from the Ubuntu client. I've set the AP to WPA-PSK now, but it would be nice if we could use PEAP, as it is more secure (security plays an important role on this network, as there is a hotspot system configured on these APs). The main goal is to be able to completely separate the private and the public part of the network (using VLANs and PEAP). Do you have any other ideas? 2009/6/10 Alan DeKok <aland@deployingradius.com>
kissg wrote:
I'm not able to do that now. I only saw two interesting things in the output: a warning message about the LDAP directory, but that's okay, because there are no clear text passwords, only NT-hashed ones. The output tells me, that the user is authorized for access. Then, the EAP conversation starts, no errors can be seen. The last message in the output tells me, that the server sent an Access-Challange packet, but nothing happens after that.
Blame Windows. It's the one deciding to stop the EAP process.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
kissg wrote:
The strange thing is, that the same happens, if I try to connect from the Ubuntu client. I've set the AP to WPA-PSK now, but it would be nice if we could use PEAP, as it is more secure (security plays an important role on this network, as there is a hotspot system configured on these APs). The main goal is to be able to completely separate the private and the public part of the network (using VLANs and PEAP). Do you have any other ideas?
Follow the instructions on my web site: http://deployingradius.com It has a step by step guide to get EAP working. Follow the guide. It *will* work. Alan DeKok.
Follow the instructions on my web site: http://deployingradius.com
It has a step by step guide to get EAP working. Follow the guide. It *will* work.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks, I'm going to try it. Anyway, I don't think it could be Samba related, because my config uses an LDAP database, which is totally independent from Samba. The only reason I can imagine, is a bug in the firmware of the access point... but let's see what happens using your configuration. Gergely Kiss
Have you tried, as a test, to temporarily disable server certificate validation on the WinXP wireless network definition? ________________________________ From: freeradius-users-bounces+neal.garber=energyeast.com@lists.freeradius.org [mailto:freeradius-users-bounces+neal.garber=energyeast.com@lists.freeradius.org] On Behalf Of kissg Sent: Wednesday, June 10, 2009 10:12 AM To: FreeRadius users mailing list Subject: Re: Authentication failure - PEAP - MS-CHAPv2 Follow the instructions on my web site: http://deployingradius.com It has a step by step guide to get EAP working. Follow the guide. It *will* work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Thanks, I'm going to try it. Anyway, I don't think it could be Samba related, because my config uses an LDAP database, which is totally independent from Samba. The only reason I can imagine, is a bug in the firmware of the access point... but let's see what happens using your configuration. Gergely Kiss
Hi,
I'm not able to do that now. I only saw two interesting things in the
no debug = no help :-| you might want to try the latest 2.1.6 as the bootstrap EAP ing got a bit cleaner - are you using EAP-PEAP or are you putting client certs on the windows and actually using EAP-TLS ? following the EAP guide on deployingradius with no other changes will work. i wonder if you are playign with UserName? alan
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Garber, Neal -
Ivan Kalik -
kissg