subject:"Authentication failed"

Hi

I had just checked my Proxim AP 700 and it seems to report that

Radius Server not responding but i have already configured teh Radius Server
Profiles and IP address in the AP

What shoud i do

Devinder

2010/1/20 Devinder Singh 

> Hi Ivan,
>
> I created the certificates basd on the README file in etc/raddb and copied
> ca.der and client.p12 to Windows XP
>
> I also also made changed to the Makefile which runs on XP but when i
> connect to the SSID i get authentication failde and the radius does not seem
> to get any response from the Proxim AP.
>
>
>
> --
> Devinder
>



-- 
Devinder
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication Failed

Hello

I have followed the procedures to create EAP certificates in etc/raddb/certs
but when i copy the ca.der and client.P12 my windows XP cannot seem to
authenticate to the radisu Server.

I can se a small baloon appearing on xp stating failed to authenticate on
palstaff.


My Proxim AP reports Radius Server Error but i have already set the Radius
Server IP address in the Proxim AP.

I have also updated my make file as below to allow XP clients to
authenticate



##
#
#  Create a new client certificate, signed by the the above server
#  certificate.
#
##
client.csr client.key: client.cnf
openssl req -new  -out client.csr -keyout client.key -config
./client.cnf

client.crt: client.csr ca.pem ca.key index.txt serial
openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key
$(PASSWORD_CA) -out client.crt -extensions xpclient_ext -extfile
xpextensions -config ./client.cnf

client.p12: client.crt
openssl pkcs12 -export -in client.crt -inkey client.key -out
client.p12  -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)

client.pem: client.p12
openssl pkcs12 -in client.p12 -out client.pem -passin
pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
cp client.pem $(USER_NAME).pem

.PHONY: server.vrfy
client.vrfy: ca.pem client.pem
c_rehash .
openssl verify -CApath . client.pem



$ rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt*

and redo the certificates.


Please need help on this



Regards

Devinder


2010/1/20 Devinder Singh 

> After i had restarted my XP
>
> i get to see Windows was unable to log you on to palstaff.
>
>
> palstaff is my sssid
>
>
> Devinder
>
>
> 2010/1/20 Devinder Singh 
>
>> When i click on my SSID i get authentication failed. The Proxim AP reports
>> Radius not connected and i dont get to see any reply on Radius Server
>>
>>
>>
>> 2010/1/20 Devinder Singh 
>>
>>> ##
>>> #
>>> #  Create a new client certificate, signed by the the above server
>>> #  certificate.
>>> #
>>> ##
>>> client.csr client.key: client.cnf
>>> openssl req -new  -out client.csr -keyout client.key -config
>>> ./client.cnf
>>>
>>> client.crt: client.csr ca.pem ca.key index.txt serial
>>> openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr
>>> -key $(PASSWORD_CA) -out client.crt -extensions xpclient_ext -extfile
>>> xpextensions -config ./client.cnf
>>>
>>> client.p12: client.crt
>>> openssl pkcs12 -export -in client.crt -inkey client.key -out
>>> client.p12  -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
>>>
>>> client.pem: client.p12
>>> openssl pkcs12 -in client.p12 -out client.pem -passin
>>> pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
>>> cp client.pem $(USER_NAME).pem
>>>
>>> .PHONY: server.vrfy
>>> client.vrfy: ca.pem client.pem
>>> c_rehash .
>>> openssl verify -CApath . client.pem
>>>
>>>
>>>
>>> 2010/1/20 Devinder Singh 
>>>
>>>> Hi Ivan,
>>>>
>>>> I cant seem to authenticate my Windows XP client using EAP
>>>> authentication. I have folllowed the steps in /etc/raddb/certs
>>>>
>>>> This is my radius start up
>>>> Module: Instantiating
>>>> eap-tls
>>>>tls
>>>> {
>>>>
>>>> rsa_key_exchange =
>>>> no
>>>> dh_key_exchange =
>>>> yes
>>>> rsa_key_length =
>>>> 512
>>>> dh_key_length =
>>>> 512
>>>> verify_depth =
>>>> 0
>>>> pem_file_type =
>>>> yes
>>>> private_key_file =
>>>> "/etc/raddb/certs/server.pem"
>>>> certificate_file =
>>>> "/etc/raddb/certs/server.pem"
>>>> CA_file =
>>>> "/etc/raddb/certs/ca.pem"
>>>> private_key_password =
>>>> "myettelap"
>>>> dh_file =
>>>> "/etc/raddb/certs/dh"
>>>> random_file =
>>>> "/etc/raddb/certs/random"
>>>> fragment_size =
>>>

Re: Authentication Failed

After i had restarted my XP

i get to see Windows was unable to log you on to palstaff.


palstaff is my sssid


Devinder

2010/1/20 Devinder Singh 

> When i click on my SSID i get authentication failed. The Proxim AP reports
> Radius not connected and i dont get to see any reply on Radius Server
>
>
>
> 2010/1/20 Devinder Singh 
>
>> ##
>> #
>> #  Create a new client certificate, signed by the the above server
>> #  certificate.
>> #
>> ##
>> client.csr client.key: client.cnf
>> openssl req -new  -out client.csr -keyout client.key -config
>> ./client.cnf
>>
>> client.crt: client.csr ca.pem ca.key index.txt serial
>> openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr
>> -key $(PASSWORD_CA) -out client.crt -extensions xpclient_ext -extfile
>> xpextensions -config ./client.cnf
>>
>> client.p12: client.crt
>> openssl pkcs12 -export -in client.crt -inkey client.key -out
>> client.p12  -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
>>
>> client.pem: client.p12
>> openssl pkcs12 -in client.p12 -out client.pem -passin
>> pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
>> cp client.pem $(USER_NAME).pem
>>
>> .PHONY: server.vrfy
>> client.vrfy: ca.pem client.pem
>> c_rehash .
>> openssl verify -CApath . client.pem
>>
>>
>>
>> 2010/1/20 Devinder Singh 
>>
>>> Hi Ivan,
>>>
>>> I cant seem to authenticate my Windows XP client using EAP
>>> authentication. I have folllowed the steps in /etc/raddb/certs
>>>
>>> This is my radius start up
>>> Module: Instantiating
>>> eap-tls
>>>tls
>>> {
>>>
>>> rsa_key_exchange =
>>> no
>>> dh_key_exchange =
>>> yes
>>> rsa_key_length =
>>> 512
>>> dh_key_length =
>>> 512
>>> verify_depth =
>>> 0
>>> pem_file_type =
>>> yes
>>> private_key_file =
>>> "/etc/raddb/certs/server.pem"
>>> certificate_file =
>>> "/etc/raddb/certs/server.pem"
>>> CA_file =
>>> "/etc/raddb/certs/ca.pem"
>>> private_key_password =
>>> "myettelap"
>>> dh_file =
>>> "/etc/raddb/certs/dh"
>>> random_file =
>>> "/etc/raddb/certs/random"
>>> fragment_size =
>>> 1024
>>> include_length =
>>> yes
>>> check_crl =
>>> no
>>> cipher_list =
>>> "DEFAULT"
>>> make_cert_command =
>>> "/etc/raddb/certs/bootstrap"
>>> cache
>>> {
>>>
>>> enable =
>>> no
>>> lifetime =
>>> 24
>>> max_entries =
>>> 255
>>>
>>> }
>>>
>>>
>>> }
>>>
>>>  Module: Linked to sub-module
>>> rlm_eap_ttls
>>>  Module: Instantiating
>>> eap-ttls
>>>ttls
>>> {
>>>
>>> default_eap_type =
>>> "md5"
>>> copy_request_to_tunnel =
>>> no
>>> use_tunneled_reply =
>>> no
>>> virtual_server =
>>> "inner-tunnel"
>>>
>>> }
>>>
>>>  Module: Linked to sub-module
>>> rlm_eap_peap
>>>  Module: Instantiating
>>> eap-peap
>>>peap
>>> {
>>>
>>> default_eap_type =
>>> "mschapv2"
>>> copy_request_to_tunnel =
>>> no
>>> use_tunneled_reply =
>>> no
>>> proxy_tunneled_request_as_eap =
>>> yes
>>> virtual_server =
>>> "inner-tunnel"
>>>
>>> }
>>>
>>>  Module: Linked to sub-module
>>> rlm_eap_mschapv2
>>>  Module: Instantiating
>>> eap-mschapv2
>>>mschapv2
>>> {
>>>
>>> with_ntdomain_hack =
>>> no
>>>
>>> }
>>>
>>>  Module: Checking authorize {...} for more modules to
>>> load
>>>  Module: Linked to module
>>> rlm_realm
>>>  Module: Instantiating

Re: Authentication Failed

When i click on my SSID i get authentication failed. The Proxim AP reports
Radius not connected and i dont get to see any reply on Radius Server


2010/1/20 Devinder Singh 

> ##
> #
> #  Create a new client certificate, signed by the the above server
> #  certificate.
> #
> ##
> client.csr client.key: client.cnf
> openssl req -new  -out client.csr -keyout client.key -config
> ./client.cnf
>
> client.crt: client.csr ca.pem ca.key index.txt serial
> openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key
> $(PASSWORD_CA) -out client.crt -extensions xpclient_ext -extfile
> xpextensions -config ./client.cnf
>
> client.p12: client.crt
> openssl pkcs12 -export -in client.crt -inkey client.key -out
> client.p12  -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
>
> client.pem: client.p12
> openssl pkcs12 -in client.p12 -out client.pem -passin
> pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
> cp client.pem $(USER_NAME).pem
>
> .PHONY: server.vrfy
> client.vrfy: ca.pem client.pem
> c_rehash .
> openssl verify -CApath . client.pem
>
>
>
> 2010/1/20 Devinder Singh 
>
>> Hi Ivan,
>>
>> I cant seem to authenticate my Windows XP client using EAP authentication.
>> I have folllowed the steps in /etc/raddb/certs
>>
>> This is my radius start up
>> Module: Instantiating
>> eap-tls
>>tls
>> {
>>
>> rsa_key_exchange =
>> no
>> dh_key_exchange =
>> yes
>> rsa_key_length =
>> 512
>> dh_key_length =
>> 512
>> verify_depth =
>> 0
>> pem_file_type =
>> yes
>> private_key_file =
>> "/etc/raddb/certs/server.pem"
>> certificate_file =
>> "/etc/raddb/certs/server.pem"
>> CA_file =
>> "/etc/raddb/certs/ca.pem"
>> private_key_password =
>> "myettelap"
>> dh_file =
>> "/etc/raddb/certs/dh"
>> random_file =
>> "/etc/raddb/certs/random"
>> fragment_size =
>> 1024
>> include_length =
>> yes
>> check_crl =
>> no
>> cipher_list =
>> "DEFAULT"
>> make_cert_command =
>> "/etc/raddb/certs/bootstrap"
>> cache
>> {
>>
>> enable =
>> no
>> lifetime =
>> 24
>> max_entries =
>> 255
>>
>> }
>>
>>
>> }
>>
>>  Module: Linked to sub-module
>> rlm_eap_ttls
>>  Module: Instantiating
>> eap-ttls
>>ttls
>> {
>>
>> default_eap_type =
>> "md5"
>> copy_request_to_tunnel =
>> no
>> use_tunneled_reply =
>> no
>> virtual_server =
>> "inner-tunnel"
>>
>> }
>>
>>  Module: Linked to sub-module
>> rlm_eap_peap
>>  Module: Instantiating
>> eap-peap
>>peap
>> {
>>
>> default_eap_type =
>> "mschapv2"
>> copy_request_to_tunnel =
>> no
>> use_tunneled_reply =
>> no
>> proxy_tunneled_request_as_eap =
>> yes
>> virtual_server =
>> "inner-tunnel"
>>
>> }
>>
>>  Module: Linked to sub-module
>> rlm_eap_mschapv2
>>  Module: Instantiating
>> eap-mschapv2
>>mschapv2
>> {
>>
>> with_ntdomain_hack =
>> no
>>
>> }
>>
>>  Module: Checking authorize {...} for more modules to
>> load
>>  Module: Linked to module
>> rlm_realm
>>  Module: Instantiating
>> suffix
>>   realm suffix
>> {
>> format =
>> "suffix"
>> delimiter =
>> "@"
>> ignore_default =
>> no
>> ignore_null =
>> no
>>
>> }
>>
>>  Module: Linked to module
>> rlm_files
>>  Module: Instantiating
>> files
>>   files
>> {
>>
>> usersfile =
>> "/etc/raddb/users"
>> acctusersfile =
>> "/etc/raddb/acct_users"
>> preproxy_usersfile =
>> "/etc/raddb/preproxy_users"
>> compat =
>> "no"
>>
>> }
>>
>>  Module: Checkin

Re: Authentication Failed

##
#
#  Create a new client certificate, signed by the the above server
#  certificate.
#
##
client.csr client.key: client.cnf
openssl req -new  -out client.csr -keyout client.key -config
./client.cnf

client.crt: client.csr ca.pem ca.key index.txt serial
openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key
$(PASSWORD_CA) -out client.crt -extensions xpclient_ext -extfile
xpextensions -config ./client.cnf

client.p12: client.crt
openssl pkcs12 -export -in client.crt -inkey client.key -out
client.p12  -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)

client.pem: client.p12
openssl pkcs12 -in client.p12 -out client.pem -passin
pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
cp client.pem $(USER_NAME).pem

.PHONY: server.vrfy
client.vrfy: ca.pem client.pem
c_rehash .
openssl verify -CApath . client.pem


2010/1/20 Devinder Singh 

> Hi Ivan,
>
> I cant seem to authenticate my Windows XP client using EAP authentication.
> I have folllowed the steps in /etc/raddb/certs
>
> This is my radius start up
> Module: Instantiating
> eap-tls
>tls
> {
>
> rsa_key_exchange =
> no
> dh_key_exchange =
> yes
> rsa_key_length =
> 512
> dh_key_length =
> 512
> verify_depth =
> 0
> pem_file_type =
> yes
> private_key_file =
> "/etc/raddb/certs/server.pem"
> certificate_file =
> "/etc/raddb/certs/server.pem"
> CA_file =
> "/etc/raddb/certs/ca.pem"
> private_key_password =
> "myettelap"
> dh_file =
> "/etc/raddb/certs/dh"
> random_file =
> "/etc/raddb/certs/random"
> fragment_size =
> 1024
> include_length =
> yes
> check_crl =
> no
> cipher_list =
> "DEFAULT"
> make_cert_command =
> "/etc/raddb/certs/bootstrap"
> cache
> {
>
> enable =
> no
> lifetime =
> 24
> max_entries =
> 255
>
> }
>
>
> }
>
>  Module: Linked to sub-module
> rlm_eap_ttls
>  Module: Instantiating
> eap-ttls
>ttls
> {
>
> default_eap_type =
> "md5"
> copy_request_to_tunnel =
> no
> use_tunneled_reply =
> no
> virtual_server =
> "inner-tunnel"
>
> }
>
>  Module: Linked to sub-module
> rlm_eap_peap
>  Module: Instantiating
> eap-peap
>peap
> {
>
> default_eap_type =
> "mschapv2"
> copy_request_to_tunnel =
> no
> use_tunneled_reply =
> no
> proxy_tunneled_request_as_eap =
> yes
> virtual_server =
> "inner-tunnel"
>
> }
>
>  Module: Linked to sub-module
> rlm_eap_mschapv2
>  Module: Instantiating
> eap-mschapv2
>mschapv2
> {
>
> with_ntdomain_hack =
> no
>
> }
>
>  Module: Checking authorize {...} for more modules to
> load
>  Module: Linked to module
> rlm_realm
>  Module: Instantiating
> suffix
>   realm suffix
> {
> format =
> "suffix"
> delimiter =
> "@"
> ignore_default =
> no
> ignore_null =
> no
>
> }
>
>  Module: Linked to module
> rlm_files
>  Module: Instantiating
> files
>   files
> {
>
> usersfile =
> "/etc/raddb/users"
> acctusersfile =
> "/etc/raddb/acct_users"
> preproxy_usersfile =
> "/etc/raddb/preproxy_users"
> compat =
> "no"
>
> }
>
>  Module: Checking session {...} for more modules to
> load
>  Module: Linked to module
> rlm_radutmp
>  Module: Instantiating
> radutmp
>   radutmp
> {
>
> filename =
> "/var/log/radius/radutmp"
> username =
> "%{User-Name}"
> case_sensitive =
> yes
> check_with_nas =
> yes
> perm =
> 384
> callerid =
> yes
>
> }
>
>  Module: Checking post-proxy {...} for more modules to
> load
>  Module: Checking post-auth {...} for more modules to
> load
>  Module: Linked to module
> rlm_attr_filter
>  Module: Instantiating
> attr_filter.access_reject
>   attr_filter attr_filter.access_reject
> {
> attrsfile =
> "/etc/raddb/attrs.access_reject"
> key =
> "%{User-Name}"
>
> }
>
>  }
>
> }
>
>  modules
> {
>
>  Module: Checking authenticate {...} for more modules to
> load
>  Module: Checking authorize {...} for more modules to
> load
>  Module: Linked to module
> rlm_preprocess
>  Module: Instantiating
> preprocess
>   preprocess
> {
>
> huntgroups =
> "/etc/raddb/huntgroups"
> hints =
> "/etc/raddb/hints"
> with_ascend_hack =
> no
> ascend_channels_per_line =
> 23
> with_ntdomain_hack =
> no
> with_specialix_jetstream_hack =
> no
> with_cisco_vsa_hack =
> no
> with_alvarion_vsa_hack =
> no
>
> }
>
>  Module: Checking preacct {...} for more modules to
> load
>  Module: Linked to module
> rlm_acct_unique
>  Module: Instantiating acct_unique
>   acct_unique {
> key = "User-Name, Acct-Session-Id, NAS-IP-Address,
> Client-IP-Address, NAS-Port"
>   }
>  Mod

Re: Authentication Failed

2010-01-19 Thread Devinder Singh

Hi Ivan,

I cant seem to authenticate my Windows XP client using EAP authentication. I
have folllowed the steps in /etc/raddb/certs

This is my radius start up
Module: Instantiating
eap-tls
   tls
{

rsa_key_exchange =
no
dh_key_exchange =
yes
rsa_key_length =
512
dh_key_length =
512
verify_depth =
0
pem_file_type =
yes
private_key_file =
"/etc/raddb/certs/server.pem"
certificate_file =
"/etc/raddb/certs/server.pem"
CA_file =
"/etc/raddb/certs/ca.pem"
private_key_password =
"myettelap"
dh_file =
"/etc/raddb/certs/dh"
random_file =
"/etc/raddb/certs/random"
fragment_size =
1024
include_length =
yes
check_crl =
no
cipher_list =
"DEFAULT"
make_cert_command =
"/etc/raddb/certs/bootstrap"
cache
{

enable =
no
lifetime =
24
max_entries =
255

}


}

 Module: Linked to sub-module
rlm_eap_ttls
 Module: Instantiating
eap-ttls
   ttls
{

default_eap_type =
"md5"
copy_request_to_tunnel =
no
use_tunneled_reply =
no
virtual_server =
"inner-tunnel"

}

 Module: Linked to sub-module
rlm_eap_peap
 Module: Instantiating
eap-peap
   peap
{

default_eap_type =
"mschapv2"
copy_request_to_tunnel =
no
use_tunneled_reply =
no
proxy_tunneled_request_as_eap =
yes
virtual_server =
"inner-tunnel"

}

 Module: Linked to sub-module
rlm_eap_mschapv2
 Module: Instantiating
eap-mschapv2
   mschapv2
{

with_ntdomain_hack =
no

}

 Module: Checking authorize {...} for more modules to
load
 Module: Linked to module
rlm_realm
 Module: Instantiating
suffix
  realm suffix
{
format =
"suffix"
delimiter =
"@"
ignore_default =
no
ignore_null =
no

}

 Module: Linked to module
rlm_files
 Module: Instantiating
files
  files
{

usersfile =
"/etc/raddb/users"
acctusersfile =
"/etc/raddb/acct_users"
preproxy_usersfile =
"/etc/raddb/preproxy_users"
compat =
"no"

}

 Module: Checking session {...} for more modules to
load
 Module: Linked to module
rlm_radutmp
 Module: Instantiating
radutmp
  radutmp
{

filename =
"/var/log/radius/radutmp"
username =
"%{User-Name}"
case_sensitive =
yes
check_with_nas =
yes
perm =
384
callerid =
yes

}

 Module: Checking post-proxy {...} for more modules to
load
 Module: Checking post-auth {...} for more modules to
load
 Module: Linked to module
rlm_attr_filter
 Module: Instantiating
attr_filter.access_reject
  attr_filter attr_filter.access_reject
{
attrsfile =
"/etc/raddb/attrs.access_reject"
key =
"%{User-Name}"

}

 }

}

 modules
{

 Module: Checking authenticate {...} for more modules to
load
 Module: Checking authorize {...} for more modules to
load
 Module: Linked to module
rlm_preprocess
 Module: Instantiating
preprocess
  preprocess
{

huntgroups =
"/etc/raddb/huntgroups"
hints =
"/etc/raddb/hints"
with_ascend_hack =
no
ascend_channels_per_line =
23
with_ntdomain_hack =
no
with_specialix_jetstream_hack =
no
with_cisco_vsa_hack =
no
with_alvarion_vsa_hack =
no

}

 Module: Checking preacct {...} for more modules to
load
 Module: Linked to module
rlm_acct_unique
 Module: Instantiating acct_unique
  acct_unique {
key = "User-Name, Acct-Session-Id, NAS-IP-Address,
Client-IP-Address, NAS-Port"
  }
 Module: Checking accounting {...} for more modules to load
 Module: Linked to module rlm_detail
 Module: Instantiating detail
  detail {
detailfile =
"/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
header = "%t"
detailperm = 384
dirperm = 493
locking = no
log_packet_header = no
  }
 Module: Instantiating attr_filter.accounting_response
  attr_filter attr_filter.accounting_response {
attrsfile = "/etc/raddb/attrs.accounting_response"
key = "%{User-Name}"
  }
 Module: Checking session {...} for more modules to load
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 }
radiusd:  Opening IP addresses and Ports 
listen {
type = "auth"
ipaddr = *
port = 0
}
listen {
type = "acct"
ipaddr = *
port = 0
}
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on proxy address * port 1814
Ready to process requests.
^[[6~^[[6~


2010/1/20 Devinder Singh 

> Hi Ivan,
>
> I created the certificates basd on the README file in etc/raddb and copied
> ca.der and client.p12 to Windows XP
>
> I also also made changed to the Makefile which runs on XP but when i
> connect to the SSID i get authentication failde and the radius does not seem
> to get any response from the Proxim AP.
>
>
>
> --
> Devinder
>



-- 
Devinder
-
List info/subscribe/unsubscribe? See http:/

Authentication Failed

2010-01-19 Thread Devinder Singh

Hi Ivan,

I created the certificates basd on the README file in etc/raddb and copied
ca.der and client.p12 to Windows XP

I also also made changed to the Makefile which runs on XP but when i connect
to the SSID i get authentication failde and the radius does not seem to get
any response from the Proxim AP.



-- 
Devinder
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: authentication failed because sqlcounter...

2009-05-13 Thread Nizar Zulmi

the problem solved it just because 30 second less than one minute, i've tried 
using Max-All-Sesion:=3600 and it works..

--- On Sat, 5/9/09, Nizar Zulmi  wrote:

From: Nizar Zulmi 
Subject: Re: authentication failed because sqlcounter...
To: t...@kalik.net, "FreeRadius users mailing list" 

Date: Saturday, May 9, 2009, 2:03 PM

i am using freeradius 1.1.7, not that old rite??? i've tried using := operator 
and cleartext-password but still doesn't work..this bellow is my radcheck 
table..
++--++++
| id | UserName | Attribute  | op | Value  |
++--++++
|  1 | nizar    | Password   | == | nizar  |
|  2 | nizar1   | Password   | == | nizar1 |
|  6 | tes  | Max-All-Session    | == | 90 |
|  4 | tes  | Password   |
 == | tes    |
|  7 | denizaro | Cleartext-Password | := | 123456 |
|  8 | denizaro | Max-All-Session    | := | 30 |
++--++++
6 rows in set (0.00 sec)

i try to log in with user denizaro first time before i add attribute 
max-all-session its succesfully logged in, but after i adding max-all-session 
attribut its failed..
whats happen??

--- On Sat, 5/9/09, Ivan Kalik  wrote:

From: Ivan Kalik 
Subject: Re: authentication failed because sqlcounter...
To: "FreeRadius users mailing list" 
Date: Saturday, May 9, 2009, 2:51 AM

> mm confusing..i just enable the sqlcounter in
 radiusd.conf. i just let it
> as default no change i made in noresetcounter module. then i adding
> noresetcounter in authorize and instantiate section.
> i have defined 1user named tes and password tes has loged in normally
> before i add attribut max-all-session in the table radcheck just like
> this.
> ++--+-+++
> | id | UserName | Attribute   | op | Value  |
> ++--+-+++
> |  1 | nizar    | Password    | == | nizar  |
> |  2 | nizar1   | Password    | == | nizar1 |
> |  6 | tes  | Max-All-Session | == | 90 |
> |  4 | tes  |
 Password    | == | tes    |
> ++--+-+++
> after i adding the attribut max-all-session the user tes cannot login
> anymore. i do running freeradius in debug mode and the following si the
> result..

:= not ==. And that password attribute Password is deprecated for many
years. How old is your freeradius version?

Ivan Kalik
Kalik Informatika ISP

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-Inline Attachment Follows-

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

  -
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: authentication failed because sqlcounter...

2009-05-09 Thread Nizar Zulmi

i am using freeradius 1.1.7, not that old rite??? i've tried using := operator 
and cleartext-password but still doesn't work..this bellow is my radcheck 
table..
++--++++
| id | UserName | Attribute  | op | Value  |
++--++++
|  1 | nizar    | Password   | == | nizar  |
|  2 | nizar1   | Password   | == | nizar1 |
|  6 | tes  | Max-All-Session    | == | 90 |
|  4 | tes  | Password   | == | tes    |
|  7 | denizaro | Cleartext-Password | := | 123456 |
|  8 | denizaro | Max-All-Session    | := | 30 |
++--++++
6 rows in set (0.00 sec)

i try to log in with user denizaro first time before i add attribute 
max-all-session its succesfully logged in, but after i adding max-all-session 
attribut its failed..
whats happen??

--- On Sat, 5/9/09, Ivan Kalik  wrote:

From: Ivan Kalik 
Subject: Re: authentication failed because sqlcounter...
To: "FreeRadius users mailing list" 
Date: Saturday, May 9, 2009, 2:51 AM

> mm confusing..i just enable the sqlcounter in radiusd.conf. i just let it
> as default no change i made in noresetcounter module. then i adding
> noresetcounter in authorize and instantiate section.
> i have defined 1user named tes and password tes has loged in normally
> before i add attribut max-all-session in the table radcheck just like
> this.
> ++--+-+++
> | id | UserName | Attribute   | op | Value  |
> ++--+-+++
> |  1 | nizar    | Password    | == | nizar  |
> |  2 | nizar1   | Password    | == | nizar1 |
> |  6 | tes  | Max-All-Session | == | 90 |
> |  4 | tes  | Password    | == | tes    |
> ++--+-+++
> after i adding the attribut max-all-session the user tes cannot login
> anymore. i do running freeradius in debug mode and the following si the
> result..

:= not ==. And that password attribute Password is deprecated for many
years. How old is your freeradius version?

Ivan Kalik
Kalik Informatika ISP

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html


  -
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: authentication failed because sqlcounter...

2009-05-09 Thread Nizar Zulmi

i am using freeradius 1.1.7, not that old rite??? i've tried using := operator 
and cleartext-password but still doesn't work..this bellow is my radcheck 
table..
++--++++
| id | UserName | Attribute  | op | Value  |
++--++++
|  1 | nizar    | Password   | == | nizar  |
|  2 | nizar1   | Password   | == | nizar1 |
|  6 | tes  | Max-All-Session    | == | 90 |
|  4 | tes  | Password   | == | tes    |
|  7 | denizaro | Cleartext-Password | := | 123456 |
|  8 | denizaro | Max-All-Session    | := | 30 |
++--++++
6 rows in set (0.00 sec)

i try to log in with user denizaro first time before i add attribute 
max-all-session its succesfully logged in, but after i adding max-all-session 
attribut its failed..
whats happen??

--- On Sat, 5/9/09, Ivan Kalik  wrote:

From: Ivan Kalik 
Subject: Re: authentication failed because sqlcounter...
To: "FreeRadius users mailing list" 
Date: Saturday, May 9, 2009, 2:51 AM

> mm confusing..i just enable the sqlcounter in radiusd.conf. i just let it
> as default no change i made in noresetcounter module. then i adding
> noresetcounter in authorize and instantiate section.
> i have defined 1user named tes and password tes has loged in normally
> before i add attribut max-all-session in the table radcheck just like
> this.
> ++--+-+++
> | id | UserName | Attribute   | op | Value  |
> ++--+-+++
> |  1 | nizar    | Password    | == | nizar  |
> |  2 | nizar1   | Password    | == | nizar1 |
> |  6 | tes  | Max-All-Session | == | 90 |
> |  4 | tes  | Password    | == | tes    |
> ++--+-+++
> after i adding the attribut max-all-session the user tes cannot login
> anymore. i do running freeradius in debug mode and the following si the
> result..

:= not ==. And that password attribute Password is deprecated for many
years. How old is your freeradius version?

Ivan Kalik
Kalik Informatika ISP

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html


  -
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: authentication failed because sqlcounter...

2009-05-08 Thread Ivan Kalik

> mm confusing..i just enable the sqlcounter in radiusd.conf. i just let it
> as default no change i made in noresetcounter module. then i adding
> noresetcounter in authorize and instantiate section.
> i have defined 1user named tes and password tes has loged in normally
> before i add attribut max-all-session in the table radcheck just like
> this.
> ++--+-+++
> | id | UserName | Attribute   | op | Value  |
> ++--+-+++
> |  1 | nizar    | Password    | == | nizar  |
> |  2 | nizar1   | Password    | == | nizar1 |
> |  6 | tes  | Max-All-Session | == | 90 |
> |  4 | tes  | Password    | == | tes    |
> ++--+-+++
> after i adding the attribut max-all-session the user tes cannot login
> anymore. i do running freeradius in debug mode and the following si the
> result..

:= not ==. And that password attribute Password is deprecated for many
years. How old is your freeradius version?

Ivan Kalik
Kalik Informatika ISP

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

authentication failed because sqlcounter...

2009-05-08 Thread Nizar Zulmi

mm confusing..i just enable the sqlcounter in radiusd.conf. i just let it as 
default no change i made in noresetcounter module. then i adding noresetcounter 
in authorize and instantiate section. 
i have defined 1user named tes and password tes has loged in normally before i 
add attribut max-all-session in the table radcheck just like this. 
++--+-+++
| id | UserName | Attribute   | op | Value  |
++--+-+++
|  1 | nizar    | Password    | == | nizar  | 
|  2 | nizar1   | Password    | == | nizar1 | 
|  6 | tes  | Max-All-Session | == | 90 | 
|  4 | tes  | Password    | == | tes    | 
++--+-+++
after i adding the attribut max-all-session the user tes cannot login anymore. 
i do running freeradius in debug mode and the following si the result..
somebody help me please...
freeradius debug result===
rad_recv: Access-Request packet from host 192.168.0.1:56614, id=0, length=194
    User-Name = "tes"
    User-Password = "tes"
    NAS-IP-Address = 0.0.0.0
    Service-Type = Login-User
    Framed-IP-Address = 192.168.182.3
    Calling-Station-Id = "00-1E-68-23-E9-C8"
    Called-Station-Id = "00-00-E2-78-FF-39"
    NAS-Identifier = "nas01"
    Acct-Session-Id = "4a048168"
    NAS-Port-Type = Wireless-802.11
    NAS-Port = 0
    Message-Authenticator = 0x1c3a148590ef0762aed6069cc9ac0715
    WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff";
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 3
  modcall[authorize]: module "preprocess" returns ok for request 3
  modcall[authorize]: module "chap" returns noop for request 3
  modcall[authorize]: module "mschap" returns noop for request 3
    rlm_realm: No '@' in User-Name = "tes", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 3
  rlm_eap: No EAP-Message, not doing EAP
  modcall[authorize]: module "eap" returns noop for request 3
radius_xlat:  'tes'
rlm_sql (sql): sql_set_user escaped user --> 'tes'
radius_xlat:  'SELECT id, UserName, Attribute, Value, op   FROM 
radcheck   WHERE Username = 'tes'   ORDER BY id'
rlm_sql (sql): Reserving sql socket id: 0
radius_xlat:  'SELECT 
radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op 
 FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tes' AND 
usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id'
radius_xlat:  'SELECT id, UserName, Attribute, Value, op   FROM 
radreply   WHERE Username = 'tes'   ORDER BY id'
radius_xlat:  'SELECT 
radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op 
 FROM radgroupreply,usergroup WHERE usergroup.Username = 'tes' AND 
usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id'
rlm_sql (sql): Released sql socket id: 0
rlm_sql (sql): No matching entry in the database for request from user [tes]
  modcall[authorize]: module "sql" returns notfound for request 3
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
  modcall[authorize]: module "noresetcounter" returns noop for request 3
rlm_pap: WARNING! No "known good" password found for the user.  Authentication 
may fail because of this.
  modcall[authorize]: module "pap" returns noop for request 3
modcall: leaving group authorize (returns ok) for request 3
auth: No authenticate method (Auth-Type) configuration found for the request: 
Rejecting the user
auth: Failed to validate the user.
Delaying request 3 for 1 seconds
Finished request 3
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 1 seconds...
rad_recv: Access-Request packet from host 192.168.0.1:56614, id=0, length=194
Sending Access-Reject of id 0 to 192.168.0.1 port 56614
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 4 seconds...
--- Walking the entire request list ---
Cleaning up request 3 ID 0 with timestamp 4a048180
Nothing to do.  Sleeping until we see a request.




  -
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

authentication failed because sqlcounter...

2009-05-08 Thread Nizar Zulmi

mm confusing..i just enable the sqlcounter in radiusd.conf. i just let it as 
default no change i made in noresetcounter module. then i adding noresetcounter 
in authorize and instantiate section. 
i have defined 1user named tes and password tes has loged in normally before i 
add attribut max-all-session in the table radcheck just like this. 
++--+-+++
| id | UserName | Attribute   | op | Value  |
++--+-+++
|  1 | nizar    | Password    | == | nizar  | 
|  2 | nizar1   | Password    | == | nizar1 | 
|  6 | tes  | Max-All-Session | == | 90 | 
|  4 | tes  | Password    | == | tes    | 
++--+-+++
after i adding the attribut max-all-session the user tes cannot login anymore. 
i do running freeradius in debug mode and the following si the result..
somebody help me please...
freeradius debug result===
rad_recv: Access-Request packet from host 192.168.0.1:56614, id=0, length=194
    User-Name = "tes"
    User-Password = "tes"
    NAS-IP-Address = 0.0.0.0
    Service-Type = Login-User
    Framed-IP-Address = 192.168.182.3
    Calling-Station-Id = "00-1E-68-23-E9-C8"
    Called-Station-Id = "00-00-E2-78-FF-39"
    NAS-Identifier = "nas01"
    Acct-Session-Id = "4a048168"
    NAS-Port-Type = Wireless-802.11
    NAS-Port = 0
    Message-Authenticator = 0x1c3a148590ef0762aed6069cc9ac0715
    WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff";
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 3
  modcall[authorize]: module "preprocess" returns ok for request 3
  modcall[authorize]: module "chap" returns noop for request 3
  modcall[authorize]: module "mschap" returns noop for request 3
    rlm_realm: No '@' in User-Name = "tes", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 3
  rlm_eap: No EAP-Message, not doing EAP
  modcall[authorize]: module "eap" returns noop for request 3
radius_xlat:  'tes'
rlm_sql (sql): sql_set_user escaped user --> 'tes'
radius_xlat:  'SELECT id, UserName, Attribute, Value, op   FROM 
radcheck   WHERE Username = 'tes'   ORDER BY id'
rlm_sql (sql): Reserving sql socket id: 0
radius_xlat:  'SELECT 
radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op 
 FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tes' AND 
usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id'
radius_xlat:  'SELECT id, UserName, Attribute, Value, op   FROM 
radreply   WHERE Username = 'tes'   ORDER BY id'
radius_xlat:  'SELECT 
radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op 
 FROM radgroupreply,usergroup WHERE usergroup.Username = 'tes' AND 
usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id'
rlm_sql (sql): Released sql socket id: 0
rlm_sql (sql): No matching entry in the database for request from user [tes]
  modcall[authorize]: module "sql" returns notfound for request 3
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
  modcall[authorize]: module "noresetcounter" returns noop for request 3
rlm_pap: WARNING! No "known good" password found for the user.  Authentication 
may fail because of this.
  modcall[authorize]: module "pap" returns noop for request 3
modcall: leaving group authorize (returns ok) for request 3
auth: No authenticate method (Auth-Type) configuration found for the request: 
Rejecting the user
auth: Failed to validate the user.
Delaying request 3 for 1 seconds
Finished request 3
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 1 seconds...
rad_recv: Access-Request packet from host 192.168.0.1:56614, id=0, length=194
Sending Access-Reject of id 0 to 192.168.0.1 port 56614
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 4 seconds...
--- Walking the entire request list ---
Cleaning up request 3 ID 0 with timestamp 4a048180
Nothing to do.  Sleeping until we see a request.




  -
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

authentication failed because sqlcounter...

2009-05-08 Thread Nizar Zulmi

mm confusing..i just enable the sqlcounter in radiusd.conf. i just let it as 
default no change i made in noresetcounter module. then i adding noresetcounter 
in authorize and instantiate section. 
i have defined 1user named tes and password tes has loged in normally before i 
add attribut max-all-session in the table radcheck just like this. 
++--+-+++
| id | UserName | Attribute   | op | Value  |
++--+-+++
|  1 | nizar    | Password    | == | nizar  | 
|  2 | nizar1   | Password    | == | nizar1 | 
|  6 | tes  | Max-All-Session | == | 90 | 
|  4 | tes  | Password    | == | tes    | 
++--+-+++
after i adding the attribut max-all-session the user tes cannot login anymore. 
i do running freeradius in debug mode and the following si the result..
somebody help me please...
freeradius debug result===
rad_recv: Access-Request packet from host 192.168.0.1:56614, id=0, length=194
    User-Name = "tes"
    User-Password = "tes"
    NAS-IP-Address = 0.0.0.0
    Service-Type = Login-User
    Framed-IP-Address = 192.168.182.3
    Calling-Station-Id = "00-1E-68-23-E9-C8"
    Called-Station-Id = "00-00-E2-78-FF-39"
    NAS-Identifier = "nas01"
    Acct-Session-Id = "4a048168"
    NAS-Port-Type = Wireless-802.11
    NAS-Port = 0
    Message-Authenticator = 0x1c3a148590ef0762aed6069cc9ac0715
    WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff";
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 3
  modcall[authorize]: module "preprocess" returns ok for request 3
  modcall[authorize]: module "chap" returns noop for request 3
  modcall[authorize]: module "mschap" returns noop for request 3
    rlm_realm: No '@' in User-Name = "tes", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 3
  rlm_eap: No EAP-Message, not doing EAP
  modcall[authorize]: module "eap" returns noop for request 3
radius_xlat:  'tes'
rlm_sql (sql): sql_set_user escaped user --> 'tes'
radius_xlat:  'SELECT id, UserName, Attribute, Value, op   FROM 
radcheck   WHERE Username = 'tes'   ORDER BY id'
rlm_sql (sql): Reserving sql socket id: 0
radius_xlat:  'SELECT 
radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op 
 FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tes' AND 
usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id'
radius_xlat:  'SELECT id, UserName, Attribute, Value, op   FROM 
radreply   WHERE Username = 'tes'   ORDER BY id'
radius_xlat:  'SELECT 
radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op 
 FROM radgroupreply,usergroup WHERE usergroup.Username = 'tes' AND 
usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id'
rlm_sql (sql): Released sql socket id: 0
rlm_sql (sql): No matching entry in the database for request from user [tes]
  modcall[authorize]: module "sql" returns notfound for request 3
rlm_sqlcounter: Entering module authorize code
rlm_sqlcounter: Could not find Check item value pair
  modcall[authorize]: module "noresetcounter" returns noop for request 3
rlm_pap: WARNING! No "known good" password found for the user.  Authentication 
may fail because of this.
  modcall[authorize]: module "pap" returns noop for request 3
modcall: leaving group authorize (returns ok) for request 3
auth: No authenticate method (Auth-Type) configuration found for the request: 
Rejecting the user
auth: Failed to validate the user.
Delaying request 3 for 1 seconds
Finished request 3
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 1 seconds...
rad_recv: Access-Request packet from host 192.168.0.1:56614, id=0, length=194
Sending Access-Reject of id 0 to 192.168.0.1 port 56614
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 4 seconds...
--- Walking the entire request list ---
Cleaning up request 3 ID 0 with timestamp 4a048180
Nothing to do.  Sleeping until we see a request.




  -
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication failed from Radius server

2009-01-06 Thread Alan DeKok

Aravind Arjunan wrote:
...

  You already asked this question, and it was already answered.

  If you are not going to read the replies to your questions, then you
shouldn't be asking questions.

  Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Authentication failed from Radius server

2009-01-06 Thread Aravind Arjunan

hi


Radius(freeradius)  server has configured and integrated with Openldap
server  for user authentication in RHEL 5.
Using radtest, NTRadPing and Radiustest (Utility) it is working fine.  I got
Access-Acept by using this utility.

When i try from enduser through Wireless access point i may not able to
authenticate. Wireless access point is configured with WPA for security.

>From the radius debug level log and slapd log i can able to see that it can
able to fetch  username and it was successful but in the case of
userPassword authetication was getting failed.

How to send the User-Password in clear text format.?
Is there any way to decrypt the userpassword in RADIUS server which was
coming from access point.?

here is the radius debug level log




rad_recv: Access-Request packet from host 192.168.1.100:1645, id=45,
length=130

   * User-Name = "sivaji"*

Framed-MTU = 1400

Called-Station-Id = "0023.045c.3f20"

Calling-Station-Id = "001f.3c78.503a"

Service-Type = Login-User

Message-Authenticator = 0xd56b1bff210c624ccf5b1d5c56285f10

EAP-Message = 0x0202000b01736976616a69

NAS-Port-Type = Wireless-802.11

NAS-Port = 542

NAS-Port-Id = "542"

NAS-IP-Address = 192.168.1.100

NAS-Identifier = "ap"

  Processing the authorize section of radiusd.conf

modcall: entering group authorize for request 0

  modcall[authorize]: module "preprocess" returns ok for request 0

*rlm_realm: No '@' in User-Name = "sivaji", looking up realm NULL*

*rlm_realm: No such realm "NULL"*

  modcall[authorize]: module "suffix" returns noop for request 0

  rlm_eap: EAP packet type response id 2 length 11

  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation

  modcall[authorize]: module "eap" returns updated for request 0

users: Matched entry DEFAULT at line 157

 * modcall[authorize]: module "files" returns ok for request 0*

rlm_ldap: - authorize

rlm_ldap: performing user authorization for sivaji

*radius_xlat:  '(uid=sivaji)'*

*radius_xlat:  'dc=rgipt,dc=in'*

rlm_ldap: ldap_get_conn: Checking Id: 0

rlm_ldap: ldap_get_conn: Got Id: 0

rlm_ldap: attempting LDAP reconnection

rlm_ldap: (re)connect to localhost:389, authentication 0

*rlm_ldap: bind as / to localhost:389*

*rlm_ldap: waiting for bind result ...*

*rlm_ldap: Bind was successful*

*rlm_ldap: performing search in dc=rgipt,dc=in, with filter (uid=sivaji)*

rlm_ldap: looking for check items in directory...

rlm_ldap: looking for reply items in directory...

*rlm_ldap: user sivaji authorized to use remote access*

rlm_ldap: ldap_release_conn: Release Id: 0

  modcall[authorize]: module "ldap" returns ok for request 0

modcall: leaving group authorize (returns updated) for request 0

  rad_check_password:  Found Auth-Type LDAP

auth: type "LDAP"

  Processing the authenticate section of radiusd.conf

modcall: entering group LDAP for request 0



*rlm_ldap: - authenticate*

*rlm_ldap: Attribute "User-Password" is required for authentication.*

* *

*  modcall[authenticate]: module "ldap" returns invalid for request 0*

*modcall: leaving group LDAP (returns invalid) for request 0*

*auth: Failed to validate the user.*

*Login incorrect: [sivaji] (from client AP port 542 cli 001f.3c78.503a)*

*Delaying request 0 for 1 seconds*

*Finished request 0*

Going to the next request

--- Walking the entire request list ---

Waking up in 1 seconds...

--- Walking the entire request list ---

Waking up in 1 seconds...

--- Walking the entire request list ---

Sending Access-Reject of id 45 to 192.168.1.100 port 1645

Waking up in 4 seconds...

--- Walking the entire request list ---

Cleaning up request 0 ID 45 with timestamp 4960b0d2

Nothing to do.  Sleeping until we see a request.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication failed from Radius server

2009-01-05 Thread Alan DeKok

Aravind Arjunan wrote:
> Radius(freeradius)  server has configured and integrated with Openldap
> server  for user authentication in RHEL 5.
> Using radtest, NTRadPing and Radiustest (Utility) it is working fine.  I
> got Access-Acept by using this utility.

  Yes.  Because they're not doing EAP.  They're doing clear-text passwords.

> From the radius debug level log and slapd log i can able to see that it
> can able to fetch  username and it was successful but in the case of
> userPassword authetication was getting failed.

  You want to fetch the *password* from LDAP.  Repeat after me: LDAP is
a database.  LDAP is not an authentication server.

> How to send the User-Password in clear text format.?

  You don't.  Wireless access points don't work that way.

> Is there any way to decrypt the userpassword in RADIUS server which was
> coming from access point.?

  No.

> here is the radius debug level log
...
>   Processing the authorize section of radiusd.conf

  You are running a very old version of the server.  You should really
upgrade.

> users: Matched entry DEFAULT at line 157

  Which sets Auth-Type := LDAP.  This breaks EAP.

> *rlm_ldap: - authenticate* 
> *rlm_ldap: Attribute "User-Password" is required for authentication.*

  Your LDAP database doesn't do EAP.  This is because it's a database.

  (1) Do NOT set Auth-Type := LDAP
  (2) Test it with clear-text passwords.  If that works,
  (3) EAP will work, too.

  And you should upgrade to 2.1.3.

  Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Authentication failed from Radius server

2009-01-05 Thread Aravind Arjunan

Radius(freeradius)  server has configured and integrated with Openldap
server  for user authentication in RHEL 5.
Using radtest, NTRadPing and Radiustest (Utility) it is working fine.  I got
Access-Acept by using this utility.

When i try from enduser through Wireless access point i may not able to
authenticate. Wireless access point is configured with WPA for security.

>From the radius debug level log and slapd log i can able to see that it can
able to fetch  username and it was successful but in the case of
userPassword authetication was getting failed.

How to send the User-Password in clear text format.?
Is there any way to decrypt the userpassword in RADIUS server which was
coming from access point.?

here is the radius debug level log




rad_recv: Access-Request packet from host 192.168.1.100:1645, id=45,
length=130

   * User-Name = "sivaji"*

Framed-MTU = 1400

Called-Station-Id = "0023.045c.3f20"

Calling-Station-Id = "001f.3c78.503a"

Service-Type = Login-User

Message-Authenticator = 0xd56b1bff210c624ccf5b1d5c56285f10

EAP-Message = 0x0202000b01736976616a69

NAS-Port-Type = Wireless-802.11

NAS-Port = 542

NAS-Port-Id = "542"

NAS-IP-Address = 192.168.1.100

NAS-Identifier = "ap"

  Processing the authorize section of radiusd.conf

modcall: entering group authorize for request 0

  modcall[authorize]: module "preprocess" returns ok for request 0

*rlm_realm: No '@' in User-Name = "sivaji", looking up realm NULL*

*rlm_realm: No such realm "NULL"*

  modcall[authorize]: module "suffix" returns noop for request 0

  rlm_eap: EAP packet type response id 2 length 11

  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation

  modcall[authorize]: module "eap" returns updated for request 0

users: Matched entry DEFAULT at line 157

 * modcall[authorize]: module "files" returns ok for request 0*

rlm_ldap: - authorize

rlm_ldap: performing user authorization for sivaji

*radius_xlat:  '(uid=sivaji)'*

*radius_xlat:  'dc=rgipt,dc=in'*

rlm_ldap: ldap_get_conn: Checking Id: 0

rlm_ldap: ldap_get_conn: Got Id: 0

rlm_ldap: attempting LDAP reconnection

rlm_ldap: (re)connect to localhost:389, authentication 0

*rlm_ldap: bind as / to localhost:389*

*rlm_ldap: waiting for bind result ...*

*rlm_ldap: Bind was successful*

*rlm_ldap: performing search in dc=rgipt,dc=in, with filter (uid=sivaji)*

rlm_ldap: looking for check items in directory...

rlm_ldap: looking for reply items in directory...

*rlm_ldap: user sivaji authorized to use remote access*

rlm_ldap: ldap_release_conn: Release Id: 0

  modcall[authorize]: module "ldap" returns ok for request 0

modcall: leaving group authorize (returns updated) for request 0

  rad_check_password:  Found Auth-Type LDAP

auth: type "LDAP"

  Processing the authenticate section of radiusd.conf

modcall: entering group LDAP for request 0



*rlm_ldap: - authenticate*

*rlm_ldap: Attribute "User-Password" is required for authentication.*

* *

*  modcall[authenticate]: module "ldap" returns invalid for request 0*

*modcall: leaving group LDAP (returns invalid) for request 0*

*auth: Failed to validate the user.*

*Login incorrect: [sivaji] (from client AP port 542 cli 001f.3c78.503a)*

*Delaying request 0 for 1 seconds*

*Finished request 0*

Going to the next request

--- Walking the entire request list ---

Waking up in 1 seconds...

--- Walking the entire request list ---

Waking up in 1 seconds...

--- Walking the entire request list ---

Sending Access-Reject of id 45 to 192.168.1.100 port 1645

Waking up in 4 seconds...

--- Walking the entire request list ---

Cleaning up request 0 ID 45 with timestamp 4960b0d2

Nothing to do.  Sleeping until we see a request.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: EAP/MD5 with mysql authentication failed

2008-12-18 Thread henry1412

> EAP-MD5 doesn't use inner-tunnel. Enable sql in default virtual server.
> Ivan Kalik
> Kalik Informatika ISP
The problem has resolved by your way. 
Thank your ver much! 

 -
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: EAP/MD5 with mysql authentication failed

2008-12-17 Thread tnt

>IN sites-enabled/inner-tunnel
>--
>authorize {
>eap {
>ok = return
>}
>files
>sql
>expiration
>logintime
>}
>
>authenticate {
>eap
>}
>

EAP-MD5 doesn't use inner-tunnel. Enable sql in default virtual server.

Ivan Kalik
Kalik Informatika ISP

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: EAP/MD5 with mysql authentication failed

2008-12-17 Thread A . L . M . Buxey

hi,

dont set the default auth-type for users

alan
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

EAP/MD5 with mysql authentication failed

2008-12-16 Thread henry1412

  EAP/MD5 with mysql authentication failed
 
My running environment is freeraius-2.1.3 and mysql-5.0.37. 
The authentication type is EAP/MD5. It's running well with individual 'user' 
file, however, If I enable the sql optioal, it rejects with '[eap]
Handler failed in EAP/md5'. The mysql module was loaded success and could 
connected with my database.
 
It could authorized in freeradius-1.0.5 and freeradius-1.1.7 with mysql, but 
failed in freeradius-2.1.3.
 
I paste my mainly configuration file and debug information below.
Thanks for your help!
 
IN radius.conf
--
$INCLUDE sql.conf
 
IN sql.conf
--
server = "localhost"
port = 3306
login = "radius"
password = "radius"
 
IN sites-enabled/inner-tunnel
--
authorize {
eap {
ok = return
}
files
sql
expiration
logintime
}
 
authenticate {
eap
}
 
IN eap.conf
--
eap {
default_eap_type = md5
timer_expire = 60
ignore_unknown_eap_types = no
 max_sessions = 2048
md5 {
}
}
 
IN user
--
DEFAULT Auth-Type := EAP
Fall-Through = 1
 
IN radcheck table
--
mysql> select * from radcheck;
++--+++---+
| id | username | attribute  | op | value |
++--+++---+
|  1 | test | Cleartext-Password | := | test  | 

IN radreply table
--
mysql> select * from radreply;
++--+---++---+
| id | username | attribute | op | value |
++--+---++---+
|  1 | test | Framed-IP-Address | := | 192.168.1.55  | 
 
DEBUG information
--
---Ready to process requests.
rad_recv: Access-Request packet from host 192.168.1.7 port 1024, id=0, 
length=142
User-Name = "test"
NAS-IP-Address = 192.168.1.7
NAS-Port = 0
Called-Station-Id = "00-0F-1E-51-00-04:"
Calling-Station-Id = "00-13-D7-20-00-90"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 11Mbps 802.11b"
EAP-Message = 0x02090174657374
Message-Authenticator = 0xbfed0ae2dd3f0b2a36fe1a88cbd3569d
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "test", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 0 length 9
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[unix] returns notfound
[files] users: Matched entry DEFAULT at line 144
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.  Authentication may 
fail because of this.
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type md5
rlm_eap_md5: Issuing Challenge
++[eap] returns handled
Sending Access-Challenge of id 0 to 192.168.1.7 port 1024
EAP-Message = 0x01010016041095e48ee00d7d5ecc1639d149c9aa7283
Message-Authenticator = 0x
State = 0x40ca4f4d40cb4b4734e42cbd94a7636b
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.1.7 port 1024, id=1, 
length=173
User-Name = "test"
NAS-IP-Address = 192.168.1.7
NAS-Port = 0
Called-Station-Id = "00-0F-1E-51-00-04:"
Calling-Station-Id = "00-13-D7-20-00-90"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 11Mbps 802.11b"
EAP-Message = 0x020100160410f34f8c1c140e4f4b3846e691a7aa2175
State = 0x40ca4f4d40cb4b4734e42cbd94a7636b
Message-Authenticator = 0xa9e8279e3d299800129cc25ad426acce
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "test", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 1 length 22
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[unix] returns notfound
[files] users: Matched entry DEFAULT at line 144
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.  Authentication may 
fail because of this.
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/md5
[eap] processing type md5
rlm_eap_md5: Cleartext-Password is requir

RE: Authentication failed

2007-07-13 Thread Carlos Jimenez Barranco


***
Mensaje examinado por el antivirus perimetral de Impala Network Solutions
***-***


Good morning:

Enterasys is the AP and the wireless card. Otherways, we have also tried with 
an integrated Intel Centrino card with the same result.
About the supplicant, we tried with Windows Client and with one provided by 
Enterasys. In both of them we cannot connect correctly.

Unfortunately, this point was into a project that should be finished yesterday 
(I'd like to have found this mailing list several days before) and we should to 
configure the system with preshared keys in order to left system running. 
Authentication with domain was finally not implemented. Today, we have not 
access to that system and cannot do anything more. The project's world!  :(

Otherways, we really appreciate all your help and advices.


Thank you.

Carlos Jimenez Barranco
- Área de Postventa
    Telf. +34 933034139
 

www.impala-net.com

Sistemas de Comunicaciones Corporativas

 


-Mensaje original-
De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de [EMAIL PROTECTED]
Enviado el: jueves, 12 de julio de 2007 16:24
Para: FreeRadius users mailing list
Asunto: RE: Authentication failed

***
Mensaje examinado por el antivirus perimetral de Impala Network Solutions
***-***


Lets get few things straight:

Enterasys is your AP, not your wireless card?

What supplicant are you using on your PC to connect: Windows XP
supplicant, supplicant provided by the manufacturer of PC's wireless
card or something else? Supplicant is the program you are using to make
the wireless connection.

What EAP type are you trying to use? You started with PEAP but in the
last output your supplicant was trying to do TTLS of some sort.

Ivan Kalik
Kalik Informatika ISP


Dana 12/7/2007, "Carlos Jimenez Barranco" <[EMAIL PROTECTED]>
piše:

>
>***
>Mensaje examinado por el antivirus perimetral de Impala Network Solutions
>***-***
>
>
>Hi:
>
>We have found that on PC, wireless card needs to introduce manually a username 
>and password, it doesn't takes the domain credentials automatically.
>We have tried, just for probing, with a non valid user, in this case root and 
>the password for the freeradius server. This is why it appears "anonymous". 
>But we have not made more changes.
>After this trying, we restarted the service and we found that with domain user 
>credentials didn't connect correctly the PC.
>Could it be due a malfunctioning or an issue of the Enterasys wireless card 
>and/or AP?
>
>Thanks.
>
>Carlos Jimenez Barranco
>- Área de Postventa
>    Telf. +34 933034139
> 
>
>www.impala-net.com
>
>Sistemas de Comunicaciones Corporativas
>
> 
>
>
>
>-Mensaje original-
>De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de [EMAIL PROTECTED]
>Enviado el: jueves, 12 de julio de 2007 14:41
>Para: FreeRadius users mailing list
>CC: Cristina Martin Molin
>Asunto: Re: Authentication failed
>
>***
>Mensaje examinado por el antivirus perimetral de Impala Network Solutions
>***-***
>
>
>Hi,
>
>
>you are CHANING more than ONE thing at a time. look at this:
>
>>   rlm_eap: Request found, released from the list
>>   rlm_eap: EAP NAK
>>  rlm_eap: EAP-NAK asked for EAP-Type/ttls
>>  rlm_eap: No such EAP type ttls
>>   rlm_eap: Failed in EAP select
>>   modcall[authenticate]: module "eap" returns invalid for request 7
>> modcall: group authenticate returns invalid for request 7
>> auth: Failed to validate the user.
>> Login incorrect: [anonymous/] (from client 
>> 17224.230.15 port 1 cli 00118865b6e5)
>
>why is it now attempting TTLS authentication? why have you taken such
>auth method out of the loop?  ntlm_auth isnt being called AT ALL now.
>
>one change at a time!
>
>alan
>- 
>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>
>
>
>___
>
>Este mensaje se dirije exclusivamente a su destinatario y puede contener
>información privilegiada o confidencial de Impala Network Solutions S.L.
>Si no es vd. el destinatario indicado, queda notificado de que la utilización,
>divulgación y/o copia sin autorización está prohibida en virtud de la 
>legislación vigente.
>Si ha recibido este mensaje por error, le rogamos nos lo comunique
>inmediatamente por esta misma via y proceda a su destrucción.
>
>
>This message is intended exclusively for its addressee and may contain
>information that is CONFIDENTIAL and protected by professional privilege.
>If you are not the intende

RE: Authentication failed

2007-07-12 Thread tnt

Lets get few things straight:

Enterasys is your AP, not your wireless card?

What supplicant are you using on your PC to connect: Windows XP
supplicant, supplicant provided by the manufacturer of PC's wireless
card or something else? Supplicant is the program you are using to make
the wireless connection.

What EAP type are you trying to use? You started with PEAP but in the
last output your supplicant was trying to do TTLS of some sort.

Ivan Kalik
Kalik Informatika ISP


Dana 12/7/2007, "Carlos Jimenez Barranco" <[EMAIL PROTECTED]>
piše:

>
>***
>Mensaje examinado por el antivirus perimetral de Impala Network Solutions
>***-***
>
>
>Hi:
>
>We have found that on PC, wireless card needs to introduce manually a username 
>and password, it doesn't takes the domain credentials automatically.
>We have tried, just for probing, with a non valid user, in this case root and 
>the password for the freeradius server. This is why it appears "anonymous". 
>But we have not made more changes.
>After this trying, we restarted the service and we found that with domain user 
>credentials didn't connect correctly the PC.
>Could it be due a malfunctioning or an issue of the Enterasys wireless card 
>and/or AP?
>
>Thanks.
>
>Carlos Jimenez Barranco
>- Área de Postventa
>    Telf. +34 933034139
> 
>
>www.impala-net.com
>
>Sistemas de Comunicaciones Corporativas
>
> 
>
>
>
>-Mensaje original-
>De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de [EMAIL PROTECTED]
>Enviado el: jueves, 12 de julio de 2007 14:41
>Para: FreeRadius users mailing list
>CC: Cristina Martin Molin
>Asunto: Re: Authentication failed
>
>***
>Mensaje examinado por el antivirus perimetral de Impala Network Solutions
>***-***
>
>
>Hi,
>
>
>you are CHANING more than ONE thing at a time. look at this:
>
>>   rlm_eap: Request found, released from the list
>>   rlm_eap: EAP NAK
>>  rlm_eap: EAP-NAK asked for EAP-Type/ttls
>>  rlm_eap: No such EAP type ttls
>>   rlm_eap: Failed in EAP select
>>   modcall[authenticate]: module "eap" returns invalid for request 7
>> modcall: group authenticate returns invalid for request 7
>> auth: Failed to validate the user.
>> Login incorrect: [anonymous/] (from client 
>> 17224.230.15 port 1 cli 00118865b6e5)
>
>why is it now attempting TTLS authentication? why have you taken such
>auth method out of the loop?  ntlm_auth isnt being called AT ALL now.
>
>one change at a time!
>
>alan
>- 
>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>
>
>
>___
>
>Este mensaje se dirije exclusivamente a su destinatario y puede contener
>información privilegiada o confidencial de Impala Network Solutions S.L.
>Si no es vd. el destinatario indicado, queda notificado de que la utilización,
>divulgación y/o copia sin autorización está prohibida en virtud de la 
>legislación vigente.
>Si ha recibido este mensaje por error, le rogamos nos lo comunique
>inmediatamente por esta misma via y proceda a su destrucción.
>
>
>This message is intended exclusively for its addressee and may contain
>information that is CONFIDENTIAL and protected by professional privilege.
>If you are not the intended recipient you are hereby notified that any
>dissemination, copy or disclosure of this communication is strictly
>prohibited by law. If this message has been received in error, please
>immediately notify us via e-mail and delete it.
>___
>
>- 
>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>
>

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re : Authentication failed

2007-07-12 Thread Eshun Benjamin

domain user credentials

read the config comments carefully and the howtos on the wiki and can fix it.
 
== 
Benjamin K. Eshun

- Message d'origine 
De : Carlos Jimenez Barranco <[EMAIL PROTECTED]>
À : FreeRadius users mailing list 
Cc : Cristina Martin Molin <[EMAIL PROTECTED]>
Envoyé le : Jeudi, 12 Juillet 2007, 14h53mn 59s
Objet : RE: Authentication failed


***
Mensaje examinado por el antivirus perimetral de Impala Network Solutions
***-***


Hi:

We have found that on PC, wireless card needs to introduce manually a username 
and password, it doesn't takes the domain credentials automatically.
We have tried, just for probing, with a non valid user, in this case root and 
the password for the freeradius server. This is why it appears "anonymous". But 
we have not made more changes.
After this trying, we restarted the service and we found that with domain user 
credentials didn't connect correctly the PC.
Could it be due a malfunctioning or an issue of the Enterasys wireless card 
and/or AP?

Thanks.

Carlos Jimenez Barranco
- Área de Postventa
Telf. +34 933034139
 

www.impala-net.com

Sistemas de Comunicaciones Corporativas

 



-Mensaje original-
De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de [EMAIL PROTECTED]
Enviado el: jueves, 12 de julio de 2007 14:41
Para: FreeRadius users mailing list
CC: Cristina Martin Molin
Asunto: Re: Authentication failed

***
Mensaje examinado por el antivirus perimetral de Impala Network Solutions
***-***


Hi,


you are CHANING more than ONE thing at a time. look at this:

>   rlm_eap: Request found, released from the list
>   rlm_eap: EAP NAK
>  rlm_eap: EAP-NAK asked for EAP-Type/ttls
>  rlm_eap: No such EAP type ttls
>   rlm_eap: Failed in EAP select
>   modcall[authenticate]: module "eap" returns invalid for request 7
> modcall: group authenticate returns invalid for request 7
> auth: Failed to validate the user.
> Login incorrect: [anonymous/] (from client 
> 172.24.230.15 port 1 cli 00118865b6e5)

why is it now attempting TTLS authentication? why have you taken such
auth method out of the loop?  ntlm_auth isnt being called AT ALL now.

one change at a time!

alan
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html



___

Este mensaje se dirije exclusivamente a su destinatario y puede contener
información privilegiada o confidencial de Impala Network Solutions S.L.
Si no es vd. el destinatario indicado, queda notificado de que la utilización,
divulgación y/o copia sin autorización está prohibida en virtud de la 
legislación vigente.
Si ha recibido este mensaje por error, le rogamos nos lo comunique
inmediatamente por esta misma via y proceda a su destrucción.


This message is intended exclusively for its addressee and may contain
information that is CONFIDENTIAL and protected by professional privilege.
If you are not the intended recipient you are hereby notified that any
dissemination, copy or disclosure of this communication is strictly
prohibited by law. If this message has been received in error, please
immediately notify us via e-mail and delete it.
___

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html












___ 
Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! 
Profitez des connaissances, des opinions et des expériences des internautes sur 
Yahoo! Questions/Réponses 
http://fr.answers.yahoo.com- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Authentication failed


***
Mensaje examinado por el antivirus perimetral de Impala Network Solutions
***-***


Hi:

We have found that on PC, wireless card needs to introduce manually a username 
and password, it doesn't takes the domain credentials automatically.
We have tried, just for probing, with a non valid user, in this case root and 
the password for the freeradius server. This is why it appears "anonymous". But 
we have not made more changes.
After this trying, we restarted the service and we found that with domain user 
credentials didn't connect correctly the PC.
Could it be due a malfunctioning or an issue of the Enterasys wireless card 
and/or AP?

Thanks.

Carlos Jimenez Barranco
- Área de Postventa
    Telf. +34 933034139
 

www.impala-net.com

Sistemas de Comunicaciones Corporativas

 



-Mensaje original-
De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de [EMAIL PROTECTED]
Enviado el: jueves, 12 de julio de 2007 14:41
Para: FreeRadius users mailing list
CC: Cristina Martin Molin
Asunto: Re: Authentication failed

***
Mensaje examinado por el antivirus perimetral de Impala Network Solutions
***-***


Hi,


you are CHANING more than ONE thing at a time. look at this:

>   rlm_eap: Request found, released from the list
>   rlm_eap: EAP NAK
>  rlm_eap: EAP-NAK asked for EAP-Type/ttls
>  rlm_eap: No such EAP type ttls
>   rlm_eap: Failed in EAP select
>   modcall[authenticate]: module "eap" returns invalid for request 7
> modcall: group authenticate returns invalid for request 7
> auth: Failed to validate the user.
> Login incorrect: [anonymous/] (from client 
> 172.24.230.15 port 1 cli 00118865b6e5)

why is it now attempting TTLS authentication? why have you taken such
auth method out of the loop?  ntlm_auth isnt being called AT ALL now.

one change at a time!

alan
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html



___

Este mensaje se dirije exclusivamente a su destinatario y puede contener
información privilegiada o confidencial de Impala Network Solutions S.L.
Si no es vd. el destinatario indicado, queda notificado de que la utilización,
divulgación y/o copia sin autorización está prohibida en virtud de la 
legislación vigente.
Si ha recibido este mensaje por error, le rogamos nos lo comunique
inmediatamente por esta misma via y proceda a su destrucción.


This message is intended exclusively for its addressee and may contain
information that is CONFIDENTIAL and protected by professional privilege.
If you are not the intended recipient you are hereby notified that any
dissemination, copy or disclosure of this communication is strictly
prohibited by law. If this message has been received in error, please
immediately notify us via e-mail and delete it.
___

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication failed

2007-07-12 Thread A . L . M . Buxey

Hi,


you are CHANING more than ONE thing at a time. look at this:

>   rlm_eap: Request found, released from the list
>   rlm_eap: EAP NAK
>  rlm_eap: EAP-NAK asked for EAP-Type/ttls
>  rlm_eap: No such EAP type ttls
>   rlm_eap: Failed in EAP select
>   modcall[authenticate]: module "eap" returns invalid for request 7
> modcall: group authenticate returns invalid for request 7
> auth: Failed to validate the user.
> Login incorrect: [anonymous/] (from client 
> 172.24.230.15 port 1 cli 00118865b6e5)

why is it now attempting TTLS authentication? why have you taken such
auth method out of the loop?  ntlm_auth isnt being called AT ALL now.

one change at a time!

alan
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Authentication failed


***
Mensaje examinado por el antivirus perimetral de Impala Network Solutions
***-***


Hello, Stefan:

Thank you for your help.
You are in reason: I need a good book of Unix command-line tools. :)
For the moment, I left all in just one line.


Carlos Jimenez Barranco
- Área de Postventa
    Telf. +34 933034139
 

www.impala-net.com

Sistemas de Comunicaciones Corporativas

 



-Mensaje original-
De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de Stefan Winter
Enviado el: jueves, 12 de julio de 2007 14:00
Para: FreeRadius users mailing list
Asunto: Re: Authentication failed

> We have entered this data in radiusd.conf:
>
> # Be VERY careful when editing the following line!
>   #
>   #ntlm_auth = "/path/to/ntlm_auth --request-nt-key
> --username=%{Stripped-User-Name:-%{User-Name:-None}}
> --challenge=%{mschap:Challenge:-00}
> --nt-response=%{mschap:NT-Response:-00}"
>
> ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
>  --domain=%{mschap:NT-Domain}
>  --username=%{mschap:User-Name}
>  --challenge=%{mschap:Challenge:-00}
>  --nt-response=%{mschap:NT-Response:-00}"
>
>
> Maybe, the "intro" after every line is not correct, so we have changed it
> for:
>
> ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
> --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name}
> --challenge=%{mschap:Challenge:-00}
> --nt-response=%{mschap:NT-Response:-00}"
>
>
> And the problem continues.

Well, this is "UNIX 101": if you want a command to continue over multiple 
lines, you have to put a \ (Backslash) at the end of the lines. The spaces 
themselves are perfectly fine. Something like

 ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key \
  --domain=%{mschap:NT-Domain} \
  --username=%{mschap:User-Name} \
  --challenge=%{mschap:Challenge:-00} \
  --nt-response=%{mschap:NT-Response:-00}"

should work a lot better. Go buy a book about UNIX command-line tools ;-)

Stefan

-- 
Stefan WINTER

Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de 
la Recherche
Ingenieur Forschung & Entwicklung

6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
E-Mail: [EMAIL PROTECTED]     Tel.:     +352 424409-1
http://www.restena.lu                Fax:      +352 422473


___

Este mensaje se dirije exclusivamente a su destinatario y puede contener
información privilegiada o confidencial de Impala Network Solutions S.L.
Si no es vd. el destinatario indicado, queda notificado de que la utilización,
divulgación y/o copia sin autorización está prohibida en virtud de la 
legislación vigente.
Si ha recibido este mensaje por error, le rogamos nos lo comunique
inmediatamente por esta misma via y proceda a su destrucción.


This message is intended exclusively for its addressee and may contain
information that is CONFIDENTIAL and protected by professional privilege.
If you are not the intended recipient you are hereby notified that any
dissemination, copy or disclosure of this communication is strictly
prohibited by law. If this message has been received in error, please
immediately notify us via e-mail and delete it.
___

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Authentication failed


***
Mensaje examinado por el antivirus perimetral de Impala Network Solutions
***-***


Hello:

We have restarted the radius service.
This is the output of the debug:


Starting - reading configuration files ...
reread_config:  reading radiusd.conf
Config:   including file: /etc/raddb/proxy.conf
Config:   including file: /etc/raddb/clients.conf
Config:   including file: /etc/raddb/snmp.conf
Config:   including file: /etc/raddb/eap.conf
Config:   including file: /etc/raddb/sql.conf
 main: prefix = "/usr"
 main: localstatedir = "/var"
 main: logdir = "/var/log/radius"
 main: libdir = "/usr/lib"
 main: radacctdir = "/var/log/radius/radacct"
 main: hostname_lookups = yes
 main: max_request_time = 60
 main: cleanup_delay = 5
 main: max_requests = 1024
 main: delete_blocked_requests = 0
 main: port = 0
 main: allow_core_dumps = no
 main: log_stripped_names = no
 main: log_file = "/var/log/radius/radius.log"
 main: log_auth = yes
 main: log_auth_badpass = yes
 main: log_auth_goodpass = no
 main: pidfile = "/var/run/radiusd/radiusd.pid"
 main: user = "radiusd"
 main: group = "radiusd"
 main: usercollide = no
 main: lower_user = "no"
 main: lower_pass = "no"
 main: nospace_user = "no"
 main: nospace_pass = "no"
 main: checkrad = "/usr/sbin/checkrad"
 main: proxy_requests = yes
 proxy: retry_delay = 5
 proxy: retry_count = 3
 proxy: synchronous = no
 proxy: default_fallback = yes
 proxy: dead_time = 120
 proxy: post_proxy_authorize = yes
 proxy: wake_all_if_all_dead = no
 security: max_attributes = 200
 security: reject_delay = 1
 security: status_server = no
 main: debug_level = 0
read_config_files:  reading dictionary
read_config_files:  reading naslist
Using deprecated naslist file.  Support for this will go away soon.
read_config_files:  reading clients
read_config_files:  reading realms
radiusd:  entering modules setup
Module: Library search path is /usr/lib
Module: Loaded exec 
 exec: wait = yes
 exec: program = "(null)"
 exec: input_pairs = "request"
 exec: output_pairs = "(null)"
 exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec) 
Module: Loaded expr 
Module: Instantiated expr (expr) 
Module: Loaded PAP 
 pap: encryption_scheme = "crypt"
Module: Instantiated pap (pap) 
Module: Loaded CHAP 
Module: Instantiated chap (chap) 
Module: Loaded MS-CHAP 
 mschap: use_mppe = yes
 mschap: require_encryption = no
 mschap: require_strong = no
 mschap: with_ntdomain_hack = yes
 mschap: passwd = "(null)"
 mschap: authtype = "MS-CHAP"
 mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key 
--domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} 
--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
Module: Instantiated mschap (mschap) 
Module: Loaded System 
 unix: cache = no
 unix: passwd = "(null)"
 unix: shadow = "/etc/shadow"
 unix: group = "(null)"
 unix: radwtmp = "/var/log/radius/radwtmp"
 unix: usegroup = no
 unix: cache_reload = 600
Module: Instantiated unix (unix) 
Module: Loaded eap 
 eap: default_eap_type = "peap"
 eap: timer_expire = 60
 eap: ignore_unknown_eap_types = no
 eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
 gtc: challenge = "Password: "
 gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
 tls: rsa_key_exchange = no
 tls: dh_key_exchange = yes
 tls: rsa_key_length = 512
 tls: dh_key_length = 512
 tls: verify_depth = 0
 tls: CA_path = "(null)"
 tls: pem_file_type = yes
 tls: private_key_file = "/etc/raddb/certs/cert-srv.pem"
 tls: certificate_file = "/etc/raddb/certs/cert-srv.pem"
 tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem"
 tls: private_key_password = "whatever"
 tls: dh_file = "/etc/raddb/certs/dh"
 tls: random_file = "/dev/urandom"
 tls: fragment_size = 1024
 tls: include_length = yes
 tls: check_crl = no
 tls: check_cert_cn = "(null)"
rlm_eap: Loaded and initialized type tls
 peap: default_eap_type = "mschapv2"
 peap: copy_request_to_tunnel = no
 peap: use_tunneled_reply = no
 peap: proxy_tunneled_request_as_eap = yes
rlm_eap: Loaded and initialized type peap
 mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap) 
Module: Loaded preprocess 
 preprocess: huntgroups = "/etc/raddb/huntgroups"
 preprocess: hints = "/etc/raddb/hints"
 preprocess: with_ascend_hack = no
 preprocess: ascend_channels_per_line = 23
 preprocess: with_ntdomain_hack = no
 preprocess: with_specialix_jetstream_hack = no
 preprocess: with_cisco_vsa_hack = no
Module: Instantiated preprocess (preprocess) 
Module: Loaded realm 
 realm: format = "suffix"
 realm: delimiter = "@"
 realm: ignore_default = no
 realm: ignore_null = no
Module: Instantiated realm (suffix) 
Module: Loaded files 
 files: usersfile = "/etc/raddb/users"
 files: acctusersfile = "/etc/raddb/acct_users"
 files: preproxy_usersfile = "/etc/raddb/preproxy_users"
 files

Re: Authentication failed

> We have entered this data in radiusd.conf:
>
> # Be VERY careful when editing the following line!
>   #
>   #ntlm_auth = "/path/to/ntlm_auth --request-nt-key
> --username=%{Stripped-User-Name:-%{User-Name:-None}}
> --challenge=%{mschap:Challenge:-00}
> --nt-response=%{mschap:NT-Response:-00}"
>
> ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
>  --domain=%{mschap:NT-Domain}
>  --username=%{mschap:User-Name}
>  --challenge=%{mschap:Challenge:-00}
>  --nt-response=%{mschap:NT-Response:-00}"
>
>
> Maybe, the "intro" after every line is not correct, so we have changed it
> for:
>
> ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
> --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name}
> --challenge=%{mschap:Challenge:-00}
> --nt-response=%{mschap:NT-Response:-00}"
>
>
> And the problem continues.

Well, this is "UNIX 101": if you want a command to continue over multiple 
lines, you have to put a \ (Backslash) at the end of the lines. The spaces 
themselves are perfectly fine. Something like

 ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key \
  --domain=%{mschap:NT-Domain} \
  --username=%{mschap:User-Name} \
  --challenge=%{mschap:Challenge:-00} \
  --nt-response=%{mschap:NT-Response:-00}"

should work a lot better. Go buy a book about UNIX command-line tools ;-)

Stefan

-- 
Stefan WINTER

Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de 
la Recherche
Ingenieur Forschung & Entwicklung

6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
E-Mail: [EMAIL PROTECTED]     Tel.:     +352 424409-1
http://www.restena.lu                Fax:      +352 422473


signature.asc
Description: This is a digitally signed message part.
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication failed

2007-07-12 Thread A . L . M . Buxey

Hi,

> Maybe, the "intro" after every line is not correct, so we have changed it for:
> 
> ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} 
> --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} 
> --nt-response=%{mschap:NT-Response:-00}"

did you restart the freeradius server? what does the output now say?

alan
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Authentication failed


***
Mensaje examinado por el antivirus perimetral de Impala Network Solutions
***-***


Hello, Stefan:

We have entered this data in radiusd.conf:

# Be VERY careful when editing the following line!
#
#ntlm_auth = "/path/to/ntlm_auth --request-nt-key 
--username=%{Stripped-User-Name:-%{User-Name:-None}} 
--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"

ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
 --domain=%{mschap:NT-Domain}
 --username=%{mschap:User-Name}
 --challenge=%{mschap:Challenge:-00}
 --nt-response=%{mschap:NT-Response:-00}"


Maybe, the "intro" after every line is not correct, so we have changed it for:

ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} 
--username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} 
--nt-response=%{mschap:NT-Response:-00}"


And the problem continues. 


Carlos Jimenez Barranco
- Área de Postventa
    Telf. +34 933034139
 

www.impala-net.com

Sistemas de Comunicaciones Corporativas

 



-Mensaje original-
De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de Stefan Winter
Enviado el: jueves, 12 de julio de 2007 13:17
Para: FreeRadius users mailing list
Asunto: Re: Authentication failed

Hi,

okay, now that the User-Name thing is fixed, another problem with your config 
shows up. The ntlm_auth line is way too short! Therefore, the key can't be 
retrieved.
Is there maybe a line wrap in radiusd.conf, line "ntlm_auth = ..." or 
something? The shipped ntlm_auth line works by default! Yours is only

'/usr/bin/ntlm_auth --request-nt-key '

i.e. it's missing all the important parts!

Stefan

> modcall: entering group Auth-Type for request 8
>   rlm_mschap: No User-Password configured.  Cannot create LM-Password.
>   rlm_mschap: No User-Password configured.  Cannot create NT-Password.
>   rlm_mschap: Told to do MS-CHAPv2 for host/PC-BARCMM2.it.local with
> NT-Password radius_xlat:  '/usr/bin/ntlm_auth --request-nt-key '
> Exec-Program: /usr/bin/ntlm_auth --request-nt-key
> username must be specified!
>
> Usage: [OPTION...]
>   --helper-protocol=helper protocol to use operate as a stdio-based
> helper --username=STRINGusername
>   --domain=STRING  domain name
>   --workstation=STRING workstation
>   --challenge=STRING   challenge (HEX encoded)
>   --lm-response=STRING LM Response to the challenge
>(HEX encoded)
>   --nt-response=STRING NT or NTLMv2 Response to the
>challenge (HEX encoded)
>   --password=STRINGUser's plaintext password
>   --request-lm-key Retreive LM session key
>   --request-nt-key Retreive User (NT) session
> key --diagnosticsPerform diagnostics on the
> authentictaion chain --require-membership-of=STRING   Require
> that a user be a member of this group (either name or SID) for
> authentication to succeed
>
> Help options
>   -?, --help   Show this help message
>   --usage  Display brief usage message
>
> Common samba options:
>   -d, --debuglevel=DEBUGLEVEL  Set debug level
>   -s, --configfile=CONFIGFILE  Use alternative
> configuration file
>   -l, --log-basename=LOGFILEBASE   Basename for log/debug files
>   -V, --versionPrint version
> Exec-Program output:
> Exec-Program: returned: 1
>   rlm_mschap: External script failed.


-- 
Stefan WINTER

Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de 
la Recherche
Ingenieur Forschung & Entwicklung

6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
E-Mail: [EMAIL PROTECTED]     Tel.:     +352 424409-1
http://www.restena.lu                Fax:      +352 422473


___

Este mensaje se dirije exclusivamente a su destinatario y puede contener
información privilegiada o confidencial de Impala Network Solutions S.L.
Si no es vd. el destinatario indicado, queda notificado de que la utilización,
divulgación y/o copia sin autorización está prohibida en virtud de la 
legislación vigente.
Si ha recibido este mensaje por error, le rogamos nos lo comunique
inmediatamente por esta misma via y proceda

Re: Authentication failed

2007-07-12 Thread A . L . M . Buxey

Hi,

err, hello. have a look at your debug logs.


>   rlm_mschap: No User-Password configured.  Cannot create LM-Password.
>   rlm_mschap: No User-Password configured.  Cannot create NT-Password.
>   rlm_mschap: Told to do MS-CHAPv2 for host/PC-BARCMM2.it.local with 
> NT-Password
> radius_xlat:  '/usr/bin/ntlm_auth --request-nt-key '
> Exec-Program: /usr/bin/ntlm_auth --request-nt-key
> username must be specified!
^

how are you calling ntlm_auth in your radiusd.conf ? - looks like
you're not passing the User-Name, realm OR challenge (!)

that fact that ntlm_auth spews out its options at you is very telling.


folk, scan through your debug outputfor PEAP (and some others)
it may seem that the EAP bit is just being continuously called -
thats somewhat true as it passes through about 6 times whilst
setting up the inner stuff.  go through those 6 or so times and then
the good juicy stuff appears.

alan
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication failed

Hi,

okay, now that the User-Name thing is fixed, another problem with your config 
shows up. The ntlm_auth line is way too short! Therefore, the key can't be 
retrieved.
Is there maybe a line wrap in radiusd.conf, line "ntlm_auth = ..." or 
something? The shipped ntlm_auth line works by default! Yours is only

'/usr/bin/ntlm_auth --request-nt-key '

i.e. it's missing all the important parts!

Stefan

> modcall: entering group Auth-Type for request 8
>   rlm_mschap: No User-Password configured.  Cannot create LM-Password.
>   rlm_mschap: No User-Password configured.  Cannot create NT-Password.
>   rlm_mschap: Told to do MS-CHAPv2 for host/PC-BARCMM2.it.local with
> NT-Password radius_xlat:  '/usr/bin/ntlm_auth --request-nt-key '
> Exec-Program: /usr/bin/ntlm_auth --request-nt-key
> username must be specified!
>
> Usage: [OPTION...]
>   --helper-protocol=helper protocol to use operate as a stdio-based
> helper --username=STRINGusername
>   --domain=STRING  domain name
>   --workstation=STRING workstation
>   --challenge=STRING   challenge (HEX encoded)
>   --lm-response=STRING LM Response to the challenge
>(HEX encoded)
>   --nt-response=STRING NT or NTLMv2 Response to the
>challenge (HEX encoded)
>   --password=STRINGUser's plaintext password
>   --request-lm-key Retreive LM session key
>   --request-nt-key Retreive User (NT) session
> key --diagnosticsPerform diagnostics on the
> authentictaion chain --require-membership-of=STRING   Require
> that a user be a member of this group (either name or SID) for
> authentication to succeed
>
> Help options
>   -?, --help   Show this help message
>   --usage  Display brief usage message
>
> Common samba options:
>   -d, --debuglevel=DEBUGLEVEL  Set debug level
>   -s, --configfile=CONFIGFILE  Use alternative
> configuration file
>   -l, --log-basename=LOGFILEBASE   Basename for log/debug files
>   -V, --versionPrint version
> Exec-Program output:
> Exec-Program: returned: 1
>   rlm_mschap: External script failed.


-- 
Stefan WINTER

Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de 
la Recherche
Ingenieur Forschung & Entwicklung

6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
E-Mail: [EMAIL PROTECTED]     Tel.:     +352 424409-1
http://www.restena.lu                Fax:      +352 422473


signature.asc
Description: This is a digitally signed message part.
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Authentication failed


***
Mensaje examinado por el antivirus perimetral de Impala Network Solutions
***-***


Hello again:

We have found that when we configure supplicant as OPEN authentication method, 
it Works right, but not when we configure it as WPA (authenticating versus 
Active Directory with freeradius). In this second case, it seems that 
connection establishes but immediately, it disconnects.


Carlos Jimenez Barranco
- Área de Postventa
    Telf. +34 933034139
 

www.impala-net.com

Sistemas de Comunicaciones Corporativas

 



-Mensaje original-
De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de [EMAIL PROTECTED]
Enviado el: jueves, 12 de julio de 2007 12:41
Para: FreeRadius users mailing list
Asunto: RE: Authentication failed

***
Mensaje examinado por el antivirus perimetral de Impala Network Solutions
***-***


What EAP method are you using? PEAP? Can you post the radiusd -X output.

Ivan Kalik
Kalik Informatika ISP


Dana 12/7/2007, "Carlos Jimenez Barranco" <[EMAIL PROTECTED]>
piše:

>
>***
>Mensaje examinado por el antivirus perimetral de Impala Network Solutions
>***-***
>
>
>Hello, Stefan:
>
>As you told us, the supplicant was sending an empty username. We had to 
>introduce manually the username and password because wireless card was not 
>taking correctly domain login values and using an empty value.
>The most recent log is:
>
>Thu Jul 12 11:03:38 2007 : Auth: Login incorrect: [barcmm2/attribute>] (from client localhost port 0) Thu Jul 12 11:03:38 2007 : Auth: 
>Login incorrect: [barcmm2/] (from client 
>172..24.230.15 port 1 cli 00118865b6e5)
>
>
>Thank you,
>
>Carlos Jimenez Barranco
>- Área de Postventa
>    Telf. +34 933034139
> 
>
>www.impala-net.com
>
>Sistemas de Comunicaciones Corporativas
>
> 
>
>
>
>-Mensaje original-
>De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de Stefan Winter
>Enviado el: jueves, 12 de julio de 2007 10:51
>Para: FreeRadius users mailing list
>Asunto: Re: Authentication failed
>
>Hi,
>
>> About the supplicant, we are using just Windows XP. We have tried with
>> several wireless card (enterasys one, integrated Intel Centrino
>> 2200b/g...). I have may not understood the supplicant meaning, tell me
>> then, please. I thought it could be a problem related to the way the
>> freeradius deals credentials (i. e. MSCHAP, with_ntdomain_hack value...).
>
>FreeRADIUS can't do *anything* if it doesn't know who to authenticate. Your 
>NAS is sending an *empty* username. As far as I can tell, your problem does 
>not lie on the server side, but on the client side.
>
>Stefan
>
>-- 
>Stefan WINTER
>
>Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de 
>la Recherche
>Ingenieur Forschung & Entwicklung
>
>6, rue Richard Coudenhove-Kalergi
>L-1359 Luxembourg
>E-Mail: [EMAIL PROTECTED]     Tel.:     +352 424409-1
>http://www.restena.lu                Fax:      +352 422473
>
>
>___
>
>Este mensaje se dirije exclusivamente a su destinatario y puede contener
>información privilegiada o confidencial de Impala Network Solutions S.L.
>Si no es vd. el destinatario indicado, queda notificado de que la utilización,
>divulgación y/o copia sin autorización está prohibida en virtud de la 
>legislación vigente.
>Si ha recibido este mensaje por error, le rogamos nos lo comunique
>inmediatamente por esta misma via y proceda a su destrucción.
>
>
>This message is intended exclusively for its addressee and may contain
>information that is CONFIDENTIAL and protected by professional privilege.
>If you are not the intended recipient you are hereby notified that any
>dissemination, copy or disclosure of this communication is strictly
>prohibited by law. If this message has been received in error, please
>immediately notify us via e-mail and delete it.
>___
>
>- 
>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>
>

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html



___

Este mensaje se dirije exclusivamente a su destinatario y puede contener
información privilegiada o confidencial de Impala Network Solutions S.L.
Si no es vd. el destinatario indicado, queda notificado de que la utilización,
divulgación y/o copia sin autorización está prohibida en virtud de la 
legislación vigente.
Si ha recibido este mensaje por error, le rogamos nos lo comunique
i

RE: Authentication failed

 rlm_eap: processing type peap
  rlm_eap_peap: Authenticate
  rlm_eap_tls: processing TLS
  eaptls_verify returned 7
  rlm_eap_tls: Done initial handshake
  eaptls_process returned 7
  rlm_eap_peap: EAPTLS_OK
  rlm_eap_peap: Session established.  Decoding tunneled attributes.
  rlm_eap_peap: Received EAP-TLV response.
  rlm_eap_peap: Tunneled data is valid.
  rlm_eap_peap:  Had sent TLV failure, rejecting.
 rlm_eap: Handler failed in EAP/peap
  rlm_eap: Failed in EAP select
  modcall[authenticate]: module "eap" returns invalid for request 9
modcall: group authenticate returns invalid for request 9
auth: Failed to validate the user.
Login incorrect: [host/PC-BARCMM2.it.local/] (from 
client 172.24.230.15 port 1 cli 000e359071d6)
Delaying request 9 for 1 seconds
Finished request 9
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Sending Access-Reject of id 123 to 172.24.230.15:1279
EAP-Message = 0x04080004
Message-Authenticator = 0x
Waking up in 3 seconds...
--- Walking the entire request list ---
Cleaning up request 2 ID 116 with timestamp 4695fe85
Cleaning up request 3 ID 117 with timestamp 4695fe85
Cleaning up request 4 ID 118 with timestamp 4695fe85
Cleaning up request 5 ID 119 with timestamp 4695fe85
Cleaning up request 6 ID 120 with timestamp 4695fe85
Cleaning up request 7 ID 121 with timestamp 4695fe85
Cleaning up request 8 ID 122 with timestamp 4695fe85
Waking up in 1 seconds...
--- Walking the entire request list ---
Cleaning up request 9 ID 123 with timestamp 4695fe86
Nothing to do.  Sleeping until we see a request.


Thank you, Ivan

Carlos Jimenez Barranco
- Área de Postventa
    Telf. +34 933034139
 

www.impala-net.com

Sistemas de Comunicaciones Corporativas

 



-Mensaje original-
De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de [EMAIL PROTECTED]
Enviado el: jueves, 12 de julio de 2007 12:41
Para: FreeRadius users mailing list
Asunto: RE: Authentication failed

***
Mensaje examinado por el antivirus perimetral de Impala Network Solutions
***-***


What EAP method are you using? PEAP? Can you post the radiusd -X output.

Ivan Kalik
Kalik Informatika ISP


Dana 12/7/2007, "Carlos Jimenez Barranco" <[EMAIL PROTECTED]>
piše:

>
>***
>Mensaje examinado por el antivirus perimetral de Impala Network Solutions
>***-***
>
>
>Hello, Stefan:
>
>As you told us, the supplicant was sending an empty username. We had to 
>introduce manually the username and password because wireless card was not 
>taking correctly domain login values and using an empty value.
>The most recent log is:
>
>Thu Jul 12 11:03:38 2007 : Auth: Login incorrect: [barcmm2/attribute>] (from client localhost port 0) Thu Jul 12 11:03:38 2007 : Auth: 
>Login incorrect: [barcmm2/] (from client 
>172..24.230.15 port 1 cli 00118865b6e5)
>
>
>Thank you,
>
>Carlos Jimenez Barranco
>- Área de Postventa
>    Telf. +34 933034139
> 
>
>www.impala-net.com
>
>Sistemas de Comunicaciones Corporativas
>
> 
>
>
>
>-Mensaje original-
>De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de Stefan Winter
>Enviado el: jueves, 12 de julio de 2007 10:51
>Para: FreeRadius users mailing list
>Asunto: Re: Authentication failed
>
>Hi,
>
>> About the supplicant, we are using just Windows XP. We have tried with
>> several wireless card (enterasys one, integrated Intel Centrino
>> 2200b/g...). I have may not understood the supplicant meaning, tell me
>> then, please. I thought it could be a problem related to the way the
>> freeradius deals credentials (i. e. MSCHAP, with_ntdomain_hack value...).
>
>FreeRADIUS can't do *anything* if it doesn't know who to authenticate. Your 
>NAS is sending an *empty* username. As far as I can tell, your problem does 
>not lie on the server side, but on the client side.
>
>Stefan
>
>-- 
>Stefan WINTER
>
>Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de 
>la Recherche
>Ingenieur Forschung & Entwicklung
>
>6, rue Richard Coudenhove-Kalergi
>L-1359 Luxembourg
>E-Mail: [EMAIL PROTECTED]     Tel.:     +352 424409-1
>http://www.restena.lu                Fax:      +352 422473
>
>
>___
>
>Este mensaje se dirije exclusivamente a su destinatario y puede contener
>información privilegiada o confidencial de Impala Network Solutions S.L.
>Si no es vd. el destinatario indicado, queda notificado de que la utilización,
>divulgación y/o copia sin autorización está prohibida en virtud d

RE: Authentication failed

2007-07-12 Thread tnt

What EAP method are you using? PEAP? Can you post the radiusd -X output.

Ivan Kalik
Kalik Informatika ISP


Dana 12/7/2007, "Carlos Jimenez Barranco" <[EMAIL PROTECTED]>
piše:

>
>***
>Mensaje examinado por el antivirus perimetral de Impala Network Solutions
>***-***
>
>
>Hello, Stefan:
>
>As you told us, the supplicant was sending an empty username. We had to 
>introduce manually the username and password because wireless card was not 
>taking correctly domain login values and using an empty value.
>The most recent log is:
>
>Thu Jul 12 11:03:38 2007 : Auth: Login incorrect: [barcmm2/attribute>] (from client localhost port 0) Thu Jul 12 11:03:38 2007 : Auth: 
>Login incorrect: [barcmm2/] (from client 
>172..24.230.15 port 1 cli 00118865b6e5)
>
>
>Thank you,
>
>Carlos Jimenez Barranco
>- Área de Postventa
>    Telf. +34 933034139
> 
>
>www.impala-net.com
>
>Sistemas de Comunicaciones Corporativas
>
> 
>
>
>
>-Mensaje original-
>De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de Stefan Winter
>Enviado el: jueves, 12 de julio de 2007 10:51
>Para: FreeRadius users mailing list
>Asunto: Re: Authentication failed
>
>Hi,
>
>> About the supplicant, we are using just Windows XP. We have tried with
>> several wireless card (enterasys one, integrated Intel Centrino
>> 2200b/g...). I have may not understood the supplicant meaning, tell me
>> then, please. I thought it could be a problem related to the way the
>> freeradius deals credentials (i. e. MSCHAP, with_ntdomain_hack value...).
>
>FreeRADIUS can't do *anything* if it doesn't know who to authenticate. Your 
>NAS is sending an *empty* username. As far as I can tell, your problem does 
>not lie on the server side, but on the client side.
>
>Stefan
>
>-- 
>Stefan WINTER
>
>Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de 
>la Recherche
>Ingenieur Forschung & Entwicklung
>
>6, rue Richard Coudenhove-Kalergi
>L-1359 Luxembourg
>E-Mail: [EMAIL PROTECTED]     Tel.:     +352 424409-1
>http://www.restena.lu                Fax:      +352 422473
>
>
>___
>
>Este mensaje se dirije exclusivamente a su destinatario y puede contener
>información privilegiada o confidencial de Impala Network Solutions S.L.
>Si no es vd. el destinatario indicado, queda notificado de que la utilización,
>divulgación y/o copia sin autorización está prohibida en virtud de la 
>legislación vigente.
>Si ha recibido este mensaje por error, le rogamos nos lo comunique
>inmediatamente por esta misma via y proceda a su destrucción.
>
>
>This message is intended exclusively for its addressee and may contain
>information that is CONFIDENTIAL and protected by professional privilege.
>If you are not the intended recipient you are hereby notified that any
>dissemination, copy or disclosure of this communication is strictly
>prohibited by law. If this message has been received in error, please
>immediately notify us via e-mail and delete it.
>___
>
>- 
>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>
>

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Authentication failed

***
Mensaje examinado por el antivirus perimetral de Impala Network Solutions
***-***

Hello, Stefan:

As you told us, the supplicant was sending an empty username. We had to
introduce manually the username and password because wireless card was not
taking correctly domain login values and using an empty value.
The most recent log is:

Thu Jul 12 11:03:38 2007 : Auth: Login incorrect: [barcmm2/] (from client localhost port 0) Thu Jul 12 11:03:38 2007 : Auth:
Login incorrect: [barcmm2/] (from client
172.24.230.15 port 1 cli 00118865b6e5)

Thank you,

Carlos Jimenez Barranco
- Área de Postventa
Telf. +34 933034139

www.impala-net.com

Sistemas de Comunicaciones Corporativas

-Mensaje original-
De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de Stefan Winter
Enviado el: jueves, 12 de julio de 2007 10:51
Para: FreeRadius users mailing list
Asunto: Re: Authentication failed

Hi,

> About the supplicant, we are using just Windows XP. We have tried with
> several wireless card (enterasys one, integrated Intel Centrino
> 2200b/g...). I have may not understood the supplicant meaning, tell me
> then, please. I thought it could be a problem related to the way the
> freeradius deals credentials (i. e. MSCHAP, with_ntdomain_hack value...).

FreeRADIUS can't do *anything* if it doesn't know who to authenticate. Your
NAS is sending an *empty* username. As far as I can tell, your problem does
not lie on the server side, but on the client side.

Stefan

--
Stefan WINTER

Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de
la Recherche
Ingenieur Forschung & Entwicklung

6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
E-Mail: [EMAIL PROTECTED] Tel.: +352 424409-1
http://www.restena.lu Fax: +352 422473

___

Este mensaje se dirije exclusivamente a su destinatario y puede contener
información privilegiada o confidencial de Impala Network Solutions S.L.
Si no es vd. el destinatario indicado, queda notificado de que la utilización,
divulgación y/o copia sin autorización está prohibida en virtud de la
legislación vigente.
Si ha recibido este mensaje por error, le rogamos nos lo comunique
inmediatamente por esta misma via y proceda a su destrucción.

This message is intended exclusively for its addressee and may contain
information that is CONFIDENTIAL and protected by professional privilege.
If you are not the intended recipient you are hereby notified that any
dissemination, copy or disclosure of this communication is strictly
prohibited by law. If this message has been received in error, please
immediately notify us via e-mail and delete it.
___

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Authentication failed


***
Mensaje examinado por el antivirus perimetral de Impala Network Solutions
***-***


Hi:

Thank you, Stefan. We are going to revise the client configuration.

Carlos Jimenez Barranco
- Área de Postventa
    Telf. +34 933034139
 

www.impala-net.com

Sistemas de Comunicaciones Corporativas

 



-Mensaje original-
De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de Stefan Winter
Enviado el: jueves, 12 de julio de 2007 10:51
Para: FreeRadius users mailing list
Asunto: Re: Authentication failed

Hi,

> About the supplicant, we are using just Windows XP. We have tried with
> several wireless card (enterasys one, integrated Intel Centrino
> 2200b/g...). I have may not understood the supplicant meaning, tell me
> then, please. I thought it could be a problem related to the way the
> freeradius deals credentials (i. e. MSCHAP, with_ntdomain_hack value...).

FreeRADIUS can't do *anything* if it doesn't know who to authenticate. Your 
NAS is sending an *empty* username. As far as I can tell, your problem does 
not lie on the server side, but on the client side.

Stefan

-- 
Stefan WINTER

Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de 
la Recherche
Ingenieur Forschung & Entwicklung

6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
E-Mail: [EMAIL PROTECTED]     Tel.:     +352 424409-1
http://www.restena.lu                Fax:      +352 422473


___

Este mensaje se dirije exclusivamente a su destinatario y puede contener
información privilegiada o confidencial de Impala Network Solutions S.L.
Si no es vd. el destinatario indicado, queda notificado de que la utilización,
divulgación y/o copia sin autorización está prohibida en virtud de la 
legislación vigente.
Si ha recibido este mensaje por error, le rogamos nos lo comunique
inmediatamente por esta misma via y proceda a su destrucción.


This message is intended exclusively for its addressee and may contain
information that is CONFIDENTIAL and protected by professional privilege.
If you are not the intended recipient you are hereby notified that any
dissemination, copy or disclosure of this communication is strictly
prohibited by law. If this message has been received in error, please
immediately notify us via e-mail and delete it.
___

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication failed

Hi,

> About the supplicant, we are using just Windows XP. We have tried with
> several wireless card (enterasys one, integrated Intel Centrino
> 2200b/g...). I have may not understood the supplicant meaning, tell me
> then, please. I thought it could be a problem related to the way the
> freeradius deals credentials (i. e. MSCHAP, with_ntdomain_hack value...).

FreeRADIUS can't do *anything* if it doesn't know who to authenticate. Your 
NAS is sending an *empty* username. As far as I can tell, your problem does 
not lie on the server side, but on the client side.

Stefan

-- 
Stefan WINTER

Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de 
la Recherche
Ingenieur Forschung & Entwicklung

6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
E-Mail: [EMAIL PROTECTED]     Tel.:     +352 424409-1
http://www.restena.lu                Fax:      +352 422473


signature.asc
Description: This is a digitally signed message part.
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Authentication failed


***
Mensaje examinado por el antivirus perimetral de Impala Network Solutions
***-***


Hello, Stefan:

About the supplicant, we are using just Windows XP. We have tried with several 
wireless card (enterasys one, integrated Intel Centrino 2200b/g...). I have may 
not understood the supplicant meaning, tell me then, please.
I thought it could be a problem related to the way the freeradius deals 
credentials (i. e. MSCHAP, with_ntdomain_hack value...).

Thank you,

Carlos Jimenez Barranco
- Área de Postventa
    Telf. +34 933034139
 

www.impala-net.com

Sistemas de Comunicaciones Corporativas

 



-Mensaje original-
De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de Stefan Winter
Enviado el: jueves, 12 de julio de 2007 10:15
Para: FreeRadius users mailing list
Asunto: Re: Authentication failed

Hi,

> Thank you for your quick answer Stefan. Just one more question: Who is the
> supplicant? The AP or the PC client? On the PC Client (WinXP) we have
> always entered a login and password.

The supplicant is the PC client. That's odd. If you really have entered a 
username on the supplicant, the NAS *MUST* put that into the RADIUS packet. 
So there's two possibilities:

- the supplicant software on the PC has a bug and doesn't actually send it 
even though you have entered it (which supplicant are you using?)
- the NAS (AP) is flawed. Unfortunately I have no experience with Enterasys.

Stefan

-- 
Stefan WINTER

Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de 
la Recherche
Ingenieur Forschung & Entwicklung

6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
E-Mail: [EMAIL PROTECTED]     Tel.:     +352 424409-1
http://www.restena.lu                Fax:      +352 422473


___

Este mensaje se dirije exclusivamente a su destinatario y puede contener
información privilegiada o confidencial de Impala Network Solutions S.L.
Si no es vd. el destinatario indicado, queda notificado de que la utilización,
divulgación y/o copia sin autorización está prohibida en virtud de la 
legislación vigente.
Si ha recibido este mensaje por error, le rogamos nos lo comunique
inmediatamente por esta misma via y proceda a su destrucción.


This message is intended exclusively for its addressee and may contain
information that is CONFIDENTIAL and protected by professional privilege.
If you are not the intended recipient you are hereby notified that any
dissemination, copy or disclosure of this communication is strictly
prohibited by law. If this message has been received in error, please
immediately notify us via e-mail and delete it.
___

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication failed

Hi,

> Thank you for your quick answer Stefan. Just one more question: Who is the
> supplicant? The AP or the PC client? On the PC Client (WinXP) we have
> always entered a login and password.

The supplicant is the PC client. That's odd. If you really have entered a 
username on the supplicant, the NAS *MUST* put that into the RADIUS packet. 
So there's two possibilities:

- the supplicant software on the PC has a bug and doesn't actually send it 
even though you have entered it (which supplicant are you using?)
- the NAS (AP) is flawed. Unfortunately I have no experience with Enterasys.

Stefan

-- 
Stefan WINTER

Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de 
la Recherche
Ingenieur Forschung & Entwicklung

6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
E-Mail: [EMAIL PROTECTED]     Tel.:     +352 424409-1
http://www.restena.lu                Fax:      +352 422473


signature.asc
Description: This is a digitally signed message part.
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Authentication failed


***
Mensaje examinado por el antivirus perimetral de Impala Network Solutions
***-***


Good morning:

Thank you for your quick answer Stefan. Just one more question: Who is the 
supplicant? The AP or the PC client?
On the PC Client (WinXP) we have always entered a login and password.


With kind regards,

Carlos Jimenez Barranco
- Área de Postventa
    Telf. +34 933034139
 

www.impala-net.com

Sistemas de Comunicaciones Corporativas

 


-Mensaje original-
De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de Stefan Winter
Enviado el: jueves, 12 de julio de 2007 9:52
Para: FreeRadius users mailing list
Asunto: Re: Authentication failed

Hello,

> rad_recv: Access-Request packet from host 172.24.230.15:3324, id=10,
> length=113 NAS-IP-Address = 172.24.230.15
>     NAS-Port-Type = Wireless-802.11
>     NAS-Port = 1
>     Framed-MTU = 1400
>     User-Name = ""
>     Calling-Station-Id = "00118865b6e5"
>     Called-Station-Id = "0011885ae5b0"
>     NAS-Identifier = "RoamAbout AP"
>     EAP-Message = 0x0201000501
>     Message-Authenticator = 0xf6e4825749e3bc4b04a99bc11c37fbba
[...]
> modcall: entering group authenticate for request 4
> rlm_eap: UserIdentity Unknown
> rlm_eap: Identity Unknown, authentication failed
>   rlm_eap: Failed in handler
>   modcall[authenticate]: module "eap" returns invalid for request 4
> modcall: group authenticate returns invalid for request 4
> auth: Failed to validate the user.

Your NAS is sending an empty User-Name. That's fatal, because then the 
FreeRADIUS server has no clue which user it should authenticate. Check the 
settings on your supplicant - enter a user name.

> Is it necessarily to attach the system message log?
> Tell me if you need more info.

Most of the times, radiusd -X is sufficient.

Stefan

-- 
Stefan WINTER

Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de 
la Recherche
Ingenieur Forschung & Entwicklung

6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
E-Mail: [EMAIL PROTECTED]     Tel.:     +352 424409-1
http://www.restena.lu                Fax:      +352 422473


___

Este mensaje se dirije exclusivamente a su destinatario y puede contener
información privilegiada o confidencial de Impala Network Solutions S.L.
Si no es vd. el destinatario indicado, queda notificado de que la utilización,
divulgación y/o copia sin autorización está prohibida en virtud de la 
legislación vigente.
Si ha recibido este mensaje por error, le rogamos nos lo comunique
inmediatamente por esta misma via y proceda a su destrucción.


This message is intended exclusively for its addressee and may contain
information that is CONFIDENTIAL and protected by professional privilege.
If you are not the intended recipient you are hereby notified that any
dissemination, copy or disclosure of this communication is strictly
prohibited by law. If this message has been received in error, please
immediately notify us via e-mail and delete it.
___

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication failed

Hello,

> rad_recv: Access-Request packet from host 172.24.230.15:3324, id=10,
> length=113 NAS-IP-Address = 172.24.230.15
>     NAS-Port-Type = Wireless-802.11
>     NAS-Port = 1
>     Framed-MTU = 1400
>     User-Name = ""
>     Calling-Station-Id = "00118865b6e5"
>     Called-Station-Id = "0011885ae5b0"
>     NAS-Identifier = "RoamAbout AP"
>     EAP-Message = 0x0201000501
>     Message-Authenticator = 0xf6e4825749e3bc4b04a99bc11c37fbba
[...]
> modcall: entering group authenticate for request 4
> rlm_eap: UserIdentity Unknown
> rlm_eap: Identity Unknown, authentication failed
>   rlm_eap: Failed in handler
>   modcall[authenticate]: module "eap" returns invalid for request 4
> modcall: group authenticate returns invalid for request 4
> auth: Failed to validate the user.

Your NAS is sending an empty User-Name. That's fatal, because then the 
FreeRADIUS server has no clue which user it should authenticate. Check the 
settings on your supplicant - enter a user name.

> Is it necessarily to attach the system message log?
> Tell me if you need more info.

Most of the times, radiusd -X is sufficient.

Stefan

-- 
Stefan WINTER

Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de 
la Recherche
Ingenieur Forschung & Entwicklung

6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
E-Mail: [EMAIL PROTECTED]     Tel.:     +352 424409-1
http://www.restena.lu                Fax:      +352 422473


signature.asc
Description: This is a digitally signed message part.
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Authentication failed