Decoupled accounting
Devinder Singh
devinbhullar at gmail.com
Tue Aug 4 10:28:53 CEST 2009
Hi Ivan,
ok could you let me know what do i need to alter in the Make File.
Just wanted to make sure i dont do something wrong here
What are the steps that i need to take to do this.
I can see a Makefile in /etc/raddb/certs
Thanks
Devinder
2009/8/4 Ivan Kalik <tnt at kalik.net>:
> OK, I think this is the issue where Windows refuses to accept server
> certificate as the intermediate CA. You should alter Makefile in certs to
> sign client certificates with CA and not server certificate.
>
> Ivan Kalik
> Kalik Informatika ISP
>
>> Hi Ivan
>>
>>
>> I still get the same error now
>>
>>
>> Found Auth-Type = EAP
>> +- entering group authenticate {...}
>> [eap] Request found, released from the list
>> [eap] EAP/tls
>> [eap] processing type tls
>> [tls] Authenticate
>> [tls] processing EAP-TLS
>> [tls] eaptls_verify returned 7
>> [tls] Done initial handshake
>> [tls] <<< TLS 1.0 Handshake [length 03b2], Certificate
>> --> verify error:num=20:unable to get local issuer certificate
>> [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca
>> TLS Alert write:fatal:unknown CA
>> TLS_accept:error in SSLv3 read client certificate B
>> rlm_eap: SSL error error:140890B2:SSL
>> routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
>> SSL: SSL_read failed in a system call (-1), TLS session fails.
>> TLS receive handshake failed during operation
>> [tls] eaptls_process returned 4
>> [eap] Handler failed in EAP/tls
>> [eap] Failed in EAP select
>> ++[eap] returns invalid
>> Failed to authenticate the user.
>> Using Post-Auth-Type Reject
>> +- entering group REJECT {...}
>> [attr_filter.access_reject] expand: %{User-Name} ->
>> devinder at palettemm.com
>> attr_filter: Matched entry DEFAULT at line 11
>> ++[attr_filter.access_reject] returns updated
>> Delaying reject of request 7 for 1 seconds
>> Going to the next request
>> Waking up in 0.9 seconds.
>> Sending delayed reject for request 7
>> Sending Access-Reject of id 141 to 203.121.4.59 port 6001
>> EAP-Message = 0x04070004
>> Message-Authenticator = 0x00000000000000000000000000000000
>> Waking up in 3.8 seconds.
>> Cleaning up request 1 ID 135 with timestamp +120
>> Cleaning up request 2 ID 136 with timestamp +120
>> Cleaning up request 3 ID 137 with timestamp +120
>> Cleaning up request 4 ID 138 with timestamp +120
>> Cleaning up request 5 ID 139 with timestamp +120
>> Cleaning up request 6 ID 140 with timestamp +120
>> Waking up in 1.0 seconds.
>> Cleaning up request 7 ID 141 with timestamp +120
>> Ready to process requests.
>>
>>
>>
>> 2009/8/4 Devinder Singh <devinbhullar at gmail.com>:
>>> Ok i took your advise and yes its a diffeenrent error now
>>>
>>> Listening on authentication address * port 1812
>>> Listening on accounting address * port 1813
>>> Listening on proxy address * port 1814
>>> Ready to process requests.
>>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001,
>>> id=134, length=181
>>> User-Name = "devinder at palettemm.com"
>>> NAS-IP-Address = 203.121.4.59
>>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff"
>>> Calling-Station-Id = "00-04-23-7b-56-b9"
>>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d"
>>> Framed-MTU = 1400
>>> NAS-Port-Type = Wireless-802.11
>>> EAP-Message =
>>> 0x0203001b01646576696e6465724070616c657474656d6d2e636f6d
>>> Message-Authenticator = 0xb7f29ed2232abda7b5b24bb131883617
>>> +- entering group authorize {...}
>>> ++[preprocess] returns ok
>>> ++[chap] returns noop
>>> ++[mschap] returns noop
>>> [suffix] Looking up realm "palettemm.com" for User-Name =
>>> "devinder at palettemm.com"
>>> [suffix] No such realm "palettemm.com"
>>> ++[suffix] returns noop
>>> [eap] EAP packet type response id 3 length 27
>>> [eap] No EAP Start, assuming it's an on-going EAP conversation
>>> ++[eap] returns updated
>>> ++[unix] returns notfound
>>> [files] users: Matched entry devinder at palettemm.com at line 94
>>> ++[files] returns ok
>>> ++[expiration] returns noop
>>> ++[logintime] returns noop
>>> [pap] WARNING! No "known good" password found for the user.
>>> Authentication may fail because of this.
>>> ++[pap] returns noop
>>> Found Auth-Type = EAP
>>> +- entering group authenticate {...}
>>> [eap] EAP Identity
>>> [eap] processing type md5
>>> rlm_eap_md5: Issuing Challenge
>>> ++[eap] returns handled
>>> Sending Access-Challenge of id 134 to 203.121.4.59 port 6001
>>> EAP-Message = 0x010400160410edd3007f1e599b71120693ed62eaee7c
>>> Message-Authenticator = 0x00000000000000000000000000000000
>>> State = 0x17b5db9117b1dfd16583cca5ed9db022
>>> Finished request 0.
>>> Going to the next request
>>> Waking up in 4.9 seconds.
>>> Cleaning up request 0 ID 134 with timestamp +1
>>> Ready to process requests.
>>>
>>>
>>>
>>>
>>>
>>> 2009/8/4 Devinder Singh <devinbhullar at gmail.com>:
>>>> HI Ivan
>>>>
>>>> Thanks. Yes i have double click on the ca.der file and client.p12 both
>>>> were installed successfuly.
>>>>
>>>> I also manaed to set up my SSID palstaff and when i click on the SSID
>>>> i see a pop up windows on my wireles LAN asking for my username on
>>>> certificate and i selected
>>>>
>>>> devinder at palettemm.com from the combo drop down list and click OK
>>>>
>>>> when i click OK radius reports the following error
>>>>
>>>> TLS Alert write:fatal:unknown CA
>>>> TLS_accept:error in SSLv3 read client certificate B
>>>> rlm_eap: SSL error error:140890B2:SSL
>>>> routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
>>>> SSL: SSL_read failed in a system call (-1), TLS session fails.
>>>> TLS receive handshake failed during operation
>>>> [tls] eaptls_process returned 4
>>>> [eap] Handler failed in EAP/tls
>>>> [eap] Failed in EAP select
>>>> ++[eap] returns invalid
>>>> Failed to authenticate the user.
>>>> Using Post-Auth-Type Reject
>>>> +- entering group REJECT {...}
>>>> [attr_filter.access_reject] expand: %{User-Name} ->
>>>> devinder at palettemm.com
>>>> attr_filter: Matched entry DEFAULT at line 11
>>>> ++[attr_filter.access_reject] returns updated
>>>> Delaying reject of request 6 for 1 seconds
>>>> Going to the next request
>>>> Waking up in 0.9 seconds.
>>>> Sending delayed reject for request 6
>>>> Sending Access-Reject of id 133 to 203.121.4.59 port 6001
>>>> EAP-Message = 0x040a0004
>>>> Message-Authenticator = 0x00000000000000000000000000000000
>>>> Waking up in 3.6 seconds.
>>>> Cleaning up request 0 ID 127 with timestamp +18
>>>> Cleaning up request 1 ID 128 with timestamp +18
>>>> Cleaning up request 2 ID 129 with timestamp +18
>>>> Cleaning up request 3 ID 130 with timestamp +18
>>>> Cleaning up request 4 ID 131 with timestamp +18
>>>> Waking up in 0.2 seconds.
>>>> Cleaning up request 5 ID 132 with timestamp +18
>>>> Waking up in 1.0 seconds.
>>>> Cleaning up request 6 ID 133 with timestamp +19
>>>> Ready to process requests.
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> 2009/8/4 Ivan Kalik <tnt at kalik.net>:
>>>>>> I mnaged to follow the steps in /etc/raddb/certs/README
>>>>>>
>>>>>> and copied ca.der and client.p12 to XP machine
>>>>>
>>>>> It looks like you have copied them but not installed them in the
>>>>> certificate store. Double-click the certificates and install them
>>>>> first.
>>>>>
>>>>> Ivan Kalik
>>>>> Kalik Informatika ISP
>>>>>
>>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> Devinder
>>>>
>>>
>>>
>>>
>>> --
>>> Devinder
>>>
>>
>>
>>
>> --
>> Devinder
>>
>
>
>
--
Devinder
More information about the Freeradius-Users
mailing list