1. First thing written is eap.conf is "Do not set Auth-Type:=EAP". The first thing you did put in your user's entry is ...
2. This applies to TTLS as well: http://wiki.freeradius.org/index.php/FreeRADIUS_Wiki:FAQ#PEAP_or_EAP-TLS_Doesn.27t_Work_with_a_Windows_machine If you have signed the server certificate yourself you also need to import it onto the XP machine. 3. OK. Even if EAP part did work - where is your password??? Ivan Kalik Kalik Informatika ISP Dana 26/9/2007, "elhammoud rachida" <[EMAIL PROTECTED]> piše: >hello >I try to put authentication eap/ttls with win XP, I install secureW2 TTLS, >and i put this in my files: >radiusd.conf >autorize { > eap > files >} >authenticate { > Auth-Type PAP { > pap > } > eap >} > >eap.conf >eap { > default_eap_type = ttls > timer_expire = 60 >gtc { > auth_type = PAP > } > >tls { > private_key_password = whatever > private_key_file = ${raddbdir}/certs/serveur.pem > > certificate_file = ${raddbdir}/certs/serveur.pem > CA_file = ${raddbdir}/certs/root.pem > dh_file = ${raddbdir}/certs/dh > random_file = ${raddbdir}/certs/random > > fragment_size = 1024 > > include_length = yes >} > >ttls { > default_eap_type = gtc > > copy_request_to_tunnel = yes > > use_tunneled_reply = yes > > } > >users >"Joel" Auth-Type := EAP , Calling-Station-Id =="00123f0e996f" > Service-Type = Framed-User, > Tunnel-type = VLAN, > Tunnel-Private-Group-ID =4, > Tunnel-Medium-Type =IEEE-802 > >After start freeradius with radiusd -X -A i have this : > >Starting - reading configuration files ... >reread_config: reading radiusd.conf >Config: including file: /etc//raddb/proxy.conf >Config: including file: /etc//raddb/clients.conf >Config: including file: /etc//raddb/snmp.conf >Config: including file: /etc//raddb/eap.conf >Config: including file: /etc//raddb/sql.conf >main: prefix = "/usr/local" >main: localstatedir = "/usr/local/var" >main: logdir = "/usr/local/var/log/radius" >main: libdir = "/usr/local/lib" >main: radacctdir = "/usr/local/var/log/radius/radacct" >main: hostname_lookups = no >main: max_request_time = 30 >main: cleanup_delay = 5 >main: max_requests = 1024 >main: delete_blocked_requests = 0 >main: port = 1812 >main: allow_core_dumps = no >main: log_stripped_names = no >main: log_file = "/usr/local/var/log/radius/radius.log" >main: log_auth = no >main: log_auth_badpass = no >main: log_auth_goodpass = no >main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" >main: user = "(null)" >main: group = "(null)" >main: usercollide = no >main: lower_user = "no" >main: lower_pass = "no" >main: nospace_user = "no" >main: nospace_pass = "no" >main: checkrad = "/usr/local/sbin/checkrad" >main: proxy_requests = yes >proxy: retry_delay = 5 >proxy: retry_count = 3 >proxy: synchronous = no >proxy: default_fallback = yes >proxy: dead_time = 120 >proxy: post_proxy_authorize = yes >proxy: wake_all_if_all_dead = no >security: max_attributes = 200 >security: reject_delay = 1 >security: status_server = no >main: debug_level = 0 >read_config_files: reading dictionary >read_config_files: reading naslist >Using deprecated naslist file. Support for this will go away soon. >read_config_files: reading clients >read_config_files: reading realms >radiusd: entering modules setup >Module: Library search path is /usr/local/lib >Module: Loaded exec >exec: wait = yes >exec: program = "(null)" >exec: input_pairs = "request" >exec: output_pairs = "(null)" >exec: packet_type = "(null)" >rlm_exec: Wait=yes but no output defined. Did you mean output=none? >Module: Instantiated exec (exec) >Module: Loaded expr >Module: Instantiated expr (expr) >Module: Loaded PAP >pap: encryption_scheme = "crypt" >Module: Instantiated pap (pap) >Module: Loaded CHAP >Module: Instantiated chap (chap) >Module: Loaded MS-CHAP >mschap: use_mppe = yes >mschap: require_encryption = no >mschap: require_strong = no >mschap: with_ntdomain_hack = no >mschap: passwd = "(null)" >mschap: authtype = "MS-CHAP" >mschap: ntlm_auth = "(null)" >Module: Instantiated mschap (mschap) >Module: Loaded System >unix: cache = no >unix: passwd = "(null)" >unix: shadow = "(null)" >unix: group = "(null)" >unix: radwtmp = "/usr/local/var/log/radius/radwtmp" >unix: usegroup = no >unix: cache_reload = 600 >Module: Instantiated unix (unix) >Module: Loaded eap >eap: default_eap_type = "ttls" >eap: timer_expire = 60 >eap: ignore_unknown_eap_types = no >eap: cisco_accounting_username_bug = no >rlm_eap: Loaded and initialized type md5 >rlm_eap: Loaded and initialized type leap >gtc: challenge = "Password: " >gtc: auth_type = "PAP" >rlm_eap: Loaded and initialized type gtc >tls: rsa_key_exchange = no >tls: dh_key_exchange = yes >tls: rsa_key_length = 512 >tls: dh_key_length = 512 >tls: verify_depth = 0 >tls: CA_path = "(null)" >tls: pem_file_type = yes >tls: private_key_file = "/etc//raddb/certs/serveur.pem" >tls: certificate_file = "/etc//raddb/certs/serveur.pem" >tls: CA_file = "/etc//raddb/certs/root.pem" >tls: private_key_password = "whatever" >tls: dh_file = "/etc//raddb/certs/dh" >tls: random_file = "/etc//raddb/certs/random" >tls: fragment_size = 1024 >tls: include_length = yes >tls: check_crl = no >tls: check_cert_cn = "(null)" >rlm_eap: Loaded and initialized type tls >ttls: default_eap_type = "mschapv2" >ttls: copy_request_to_tunnel = yes >ttls: use_tunneled_reply = yes >rlm_eap: Loaded and initialized type ttls >mschapv2: with_ntdomain_hack = no >rlm_eap: Loaded and initialized type mschapv2 >Module: Instantiated eap (eap) >Module: Loaded preprocess >preprocess: huntgroups = "/etc//raddb/huntgroups" >preprocess: hints = "/etc//raddb/hints" >preprocess: with_ascend_hack = no >preprocess: ascend_channels_per_line = 23 >preprocess: with_ntdomain_hack = no >preprocess: with_specialix_jetstream_hack = no >preprocess: with_cisco_vsa_hack = no >Module: Instantiated preprocess (preprocess) >Module: Loaded files >files: usersfile = "/etc//raddb/users" >files: acctusersfile = "/etc//raddb/acct_users" >files: preproxy_usersfile = "/etc//raddb/preproxy_users" >files: compat = "no" >Module: Instantiated files (files) >Module: Loaded Acct-Unique-Session-Id >acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, >Client-IP-Address, NAS-Port" >Module: Instantiated acct_unique (acct_unique) >Module: Loaded realm >realm: format = "suffix" >realm: delimiter = "@" >realm: ignore_default = no >realm: ignore_null = no >Module: Instantiated realm (suffix) >Module: Loaded detail >detail: detailfile = >"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" >detail: detailperm = 384 >detail: dirperm = 493 >detail: locking = no >Module: Instantiated detail (detail) >Module: Loaded radutmp >radutmp: filename = "/usr/local/var/log/radius/radutmp" >radutmp: username = "%{User-Name}" >radutmp: case_sensitive = yes >radutmp: check_with_nas = yes >radutmp: perm = 384 >radutmp: callerid = yes >Module: Instantiated radutmp (radutmp) >Listening on authentication *:1812 >Listening on accounting *:1813 >Listening on proxy *:1814 >Ready to process requests. >rad_recv: Access-Request packet from host 145.238.3.182:1026, id=239, >length=206 > Framed-MTU = 1480 > NAS-IP-Address = 145.238.3.182 > NAS-Identifier = "sw-test-radius-1" > User-Name = "Joel" > Service-Type = Framed-User > Framed-Protocol = PPP > NAS-Port = 15 > NAS-Port-Type = Ethernet > NAS-Port-Id = "15" > Called-Station-Id = "00-14-38-fe-12-00" > Calling-Station-Id = "00-12-3f-0e-99-6f" > Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" > Tunnel-Type:0 = VLAN > Tunnel-Medium-Type:0 = IEEE-802 > Tunnel-Private-Group-Id:0 = "301" > EAP-Message = 0x02010009014a6f656c > Message-Authenticator = 0xe987ca4236baf7af5832f2d7ac47fa3a > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > rlm_eap: EAP packet type response id 1 length 9 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > modcall[authorize]: module "files" returns notfound for request 0 >modcall: group authorize returns updated for request 0 > rad_check_password: Found Auth-Type EAP >auth: type "EAP" > Processing the authenticate section of radiusd.conf >modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type tls > rlm_eap_tls: Initiate > rlm_eap_tls: Start returned 1 > modcall[authenticate]: module "eap" returns handled for request 0 >modcall: group authenticate returns handled for request 0 >Sending Access-Challenge of id 239 to 145.238.3.182:1026 > EAP-Message = 0x010200061520 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x5f4f4c366e47d80bec5ce29845ad9308 >Finished request 0 >Going to the next request >--- Walking the entire request list --- >Waking up in 6 seconds... >rad_recv: Access-Request packet from host 145.238.3.182:1026, id=240, >length=275 > Framed-MTU = 1480 > NAS-IP-Address = 145.238.3.182 > NAS-Identifier = "sw-test-radius-1" > User-Name = "Joel" > Service-Type = Framed-User > Framed-Protocol = PPP > NAS-Port = 15 > NAS-Port-Type = Ethernet > NAS-Port-Id = "15" > Called-Station-Id = "00-14-38-fe-12-00" > Calling-Station-Id = "00-12-3f-0e-99-6f" > Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" > Tunnel-Type:0 = VLAN > Tunnel-Medium-Type:0 = IEEE-802 > Tunnel-Private-Group-Id:0 = "301" > State = 0x5f4f4c366e47d80bec5ce29845ad9308 > EAP-Message = >0x0202003c158000000032160301002d0100002903017c822dabc05ae9c9eac2421c1cf36eaa52c66b2b24fdb8be8662cadc1a769b95000002000a0100 > Message-Authenticator = 0xac95333ed54c9a95b895a469e622951b > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > rlm_eap: EAP packet type response id 2 length 60 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 1 > modcall[authorize]: module "files" returns notfound for request 1 >modcall: group authorize returns updated for request 1 > rad_check_password: Found Auth-Type EAP >auth: type "EAP" > Processing the authenticate section of radiusd.conf >modcall: entering group authenticate for request 1 > rlm_eap: Request found, released from the list > rlm_eap: EAP/ttls > rlm_eap: processing type ttls > rlm_eap_ttls: Authenticate > rlm_eap_tls: processing TLS >rlm_eap_tls: Length Included > eaptls_verify returned 11 > (other): before/accept initialization > TLS_accept: before/accept initialization > rlm_eap_tls: <<< TLS 1.0 Handshake [length 002d], ClientHello > TLS_accept: SSLv3 read client hello A > rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello > TLS_accept: SSLv3 write server hello A > rlm_eap_tls: >>> TLS 1.0 Handshake [length 05ad], Certificate > TLS_accept: SSLv3 write certificate A > rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone > TLS_accept: SSLv3 write server done A > TLS_accept: SSLv3 flush data > TLS_accept:error in SSLv3 read client certificate A >In SSL Handshake Phase >In SSL Accept mode > eaptls_process returned 13 > modcall[authenticate]: module "eap" returns handled for request 1 >modcall: group authenticate returns handled for request 1 >Sending Access-Challenge of id 240 to 145.238.3.182:1026 > EAP-Message = >0x0103040a15c00000060a160301004a02000046030146fa2c3627c9d7140c169813e76dd29247253a7d534e5ed1d0dc4fe3e08b2d012099b4829e16b10f36ace24dd900a7f05856cbb16214ea00c61e365508836f03c4000a0016030105ad0b0005a90005a600027d30820279308201e2a003020102020900fd1e14e415a449f4300d06092a864886f70d01010405003069310b3009060355040613024652311330110603550408130a536f6d652d5374617465310e300c06035504071305506172697331123010060355040a13094f42532050415249533121301f06092a864886f70d01090116127261636861383140686f746d61696c2e6672301e17 > EAP-Message = >0x0d3037303832303039303334385a170d3038303831393039303334385a307b310b3009060355040613024652311330110603550408130a536f6d652d5374617465310e300c06035504071305506172697331123010060355040a13094f42532050415249533110300e06035504031307736572766575723121301f06092a864886f70d01090116127261636861383140686f746d61696c2e667230819f300d06092a864886f70d010101050003818d0030818902818100c352574d8e392703e9fc02359e2d6a0073f5a3bc045025852665d74fd997416e207aad4474609fd093465d59f76edb110f4d9aeefbc49752f2eab5341b40f7d349e940221e17 > EAP-Message = >0xbde405d8af927ce2e0ef7f34d21d78544292a2c6cf51685e5bdba6d024a19f2eff5a9960a04d84cf2588bc8170bc282eb5afa43f6e83f4ca738f0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000381810088b7bd87cc58db7e30d5a68a0483af59de1eab87934d3fdc54d5d09c0ad88d5a2eb0dc696351bd11b034f69dadd04504b50b2879a9e845ca805b1cda5563ca52047727fed85accadc1e5f7a4914432c1a4a107138bd60eae9e81e2857a78f2b233777b6b0ce8a37321dce032819fd6b6f59034cf585037488a820396d890686d0003233082031f30820288a0030201020209 > EAP-Message = >0x00fd1e14e415a449f3300d06092a864886f70d01010405003069310b3009060355040613024652311330110603550408130a536f6d652d5374617465310e300c06035504071305506172697331123010060355040a13094f42532050415249533121301f06092a864886f70d01090116127261636861383140686f746d61696c2e6672301e170d3037303832303038353934315a170d3037303931393038353934315a3069310b3009060355040613024652311330110603550408130a536f6d652d5374617465310e300c06035504071305506172697331123010060355040a13094f42532050415249533121301f06092a864886f70d010901161272 > EAP-Message = 0x61636861383140686f746d61696c2e667230819f300d > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x27e30d08b4b036fbc4c4cb4e73b755f2 >Finished request 1 >Going to the next request >Waking up in 6 seconds... >rad_recv: Access-Request packet from host 145.238.3.182:1026, id=241, >length=221 > Framed-MTU = 1480 > NAS-IP-Address = 145.238.3.182 > NAS-Identifier = "sw-test-radius-1" > User-Name = "Joel" > Service-Type = Framed-User > Framed-Protocol = PPP > NAS-Port = 15 > NAS-Port-Type = Ethernet > NAS-Port-Id = "15" > Called-Station-Id = "00-14-38-fe-12-00" > Calling-Station-Id = "00-12-3f-0e-99-6f" > Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" > Tunnel-Type:0 = VLAN > Tunnel-Medium-Type:0 = IEEE-802 > Tunnel-Private-Group-Id:0 = "301" > State = 0x27e30d08b4b036fbc4c4cb4e73b755f2 > EAP-Message = 0x020300061500 > Message-Authenticator = 0x317ff3409960cc916aed1d95b1dc0c10 > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 2 > modcall[authorize]: module "preprocess" returns ok for request 2 > rlm_eap: EAP packet type response id 3 length 6 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 2 > modcall[authorize]: module "files" returns notfound for request 2 >modcall: group authorize returns updated for request 2 > rad_check_password: Found Auth-Type EAP >auth: type "EAP" > Processing the authenticate section of radiusd.conf >modcall: entering group authenticate for request 2 > rlm_eap: Request found, released from the list > rlm_eap: EAP/ttls > rlm_eap: processing type ttls > rlm_eap_ttls: Authenticate > rlm_eap_tls: processing TLS >rlm_eap_tls: Received EAP-TLS ACK message > rlm_eap_tls: ack handshake fragment handler > eaptls_verify returned 1 > eaptls_process returned 13 > modcall[authenticate]: module "eap" returns handled for request 2 >modcall: group authenticate returns handled for request 2 >Sending Access-Challenge of id 241 to 145.238.3.182:1026 > EAP-Message = >0x0104021415800000060a06092a864886f70d010101050003818d0030818902818100d4b0c79059d9d90d53ff5dc74021d46ccd692fc811a151830caecdffa6e0b1db0e83d3ccc6a2fc78c2f454c2b7f88d3ec3d94a8afa67a43e0a492a4c0fc325eced7a3254009d91dff43d9b3ab002490b76f1ffc1ff60f6f945e7cad5a6379f19ae352e60aba13b6be53dcce00cba3dbd8b326dd5de1edf98d504828f2fdcc6670203010001a381ce3081cb301d0603551d0e04160414ecad61e4ba4b1a2d0a20dfa1b098081abad1558e30819b0603551d230481933081908014ecad61e4ba4b1a2d0a20dfa1b098081abad1558ea16da46b3069310b3009060355 > EAP-Message = >0x040613024652311330110603550408130a536f6d652d5374617465310e300c06035504071305506172697331123010060355040a13094f42532050415249533121301f06092a864886f70d01090116127261636861383140686f746d61696c2e6672820900fd1e14e415a449f3300c0603551d13040530030101ff300d06092a864886f70d0101040500038181008ec769c6359265980f6504894d5eb86717619881aa21e618aa6104f307f5788b3e77d40a21a61afbd3c20a0095ee7f509b363e415e48923ccb7d168f08c923ad21a06f2728290e082e08c57a0f4ed2b0b641e655899c345ed41321b7b1807c3b698faff5bec6de2c3ea547e512d196 > EAP-Message = 0xb73b3e8a7155a4173dc20ead5eee0240fc16030100040e000000 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x0cbaf20c360d994292155c1353603bf9 >Finished request 2 >Going to the next request >Waking up in 6 seconds... >--- Walking the entire request list --- >Cleaning up request 0 ID 239 with timestamp 46fa2c36 >Cleaning up request 1 ID 240 with timestamp 46fa2c36 >Cleaning up request 2 ID 241 with timestamp 46fa2c36 >Nothing to do. Sleeping until we see a request. > >why a server dont sent response to client? no access-accept no access-rejet? >and i dont have SSL negotiation finished successfully? >please can you help me!!! >thanks > >_________________________________________________________________ >Gagnez des écrans plats avec Live.com http://www.image-addict.fr/ > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html