Re: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-24 Thread Simon L.
Phil Mayers schrieb: On 05/23/2011 06:53 PM, Simon L. wrote: Please have a look at my new, attached debug log. The server you are proxying to sends a reject. Fix that server. - Why accepts the home server a proxied request from radtest but not from a wpa supplicant. The home server can not

Re: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-24 Thread Phil Mayers
On 24/05/11 08:35, Simon L. wrote: Phil Mayers schrieb: On 05/23/2011 06:53 PM, Simon L. wrote: Please have a look at my new, attached debug log. The server you are proxying to sends a reject. Fix that server. - Why accepts the home server a proxied request from radtest but not from a

Re: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-24 Thread Simon L.
Phil Mayers schrieb: On 24/05/11 08:35, Simon L. wrote: Phil Mayers schrieb: On 05/23/2011 06:53 PM, Simon L. wrote: Please have a look at my new, attached debug log. The server you are proxying to sends a reject. Fix that server. - Why accepts the home server a proxied request from

Re: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-24 Thread Alan Buxey
Hi, proxy-inner-tunnel: server proxy-inner-tunnel { authorize { update control { Proxy-To-Realm := NULL #I want to proxy realm NULL } } authenticate { eap } post-proxy { eap } } dont set it to NULL - that keeps it very much local. instead set it to FOOBAR and

Re: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-23 Thread Simon L.
Hi again, now i got a real Problem. ... The debug you sent contains no reject. Please send a debug for this case. I will generate a separate log for the WPA2 scenario soon. I have no problems with WPA/2 and local authentication anymore. But now I try to proxy the

Re: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-23 Thread Phil Mayers
On 05/23/2011 06:53 PM, Simon L. wrote: Please have a look at my new, attached debug log. The server you are proxying to sends a reject. Fix that server. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-18 Thread Gary Gatten
: freeradius-users-bounces+ggatten=waddell@lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell@lists.freeradius.org] On Behalf Of Simon L. Sent: Wednesday, May 18, 2011 10:27 AM To: FreeRadius users mailing list Subject: Authentication issues with Win7 and WPA/WPA2 Enterprise Dear

Re: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-18 Thread Phil Mayers
On 18/05/11 16:26, Simon L. wrote: Using WPA2-Enterprise results in Access-Rejects after one Request. That is not normal. WPA2 should be the same as WPA at the radius level. Using WPA-Enterprise results in about nine different Access-Challanges and one final Access-Accept - that cant be

RE: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-18 Thread Gary Gatten
+ggatten=waddell@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Wednesday, May 18, 2011 10:52 AM To: freeradius-users@lists.freeradius.org Subject: Re: Authentication issues with Win7 and WPA/WPA2 Enterprise On 18/05/11 16:26, Simon L. wrote: Using WPA2-Enterprise results in Access

Re: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-18 Thread Phil Mayers
On 18/05/11 16:50, Gary Gatten wrote: I can't comment on your problem right now, but be aware there seem to be MANY issues with Windows 7. Our config works PERFECT with XP, Apple IOS, and other basic stuff. When we started testing Windows 7 (WPA2 Enterprise) we ran into all kinds of weirdness.

Re: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-18 Thread Phil Mayers
On 18/05/11 16:59, Gary Gatten wrote: One point of clarification: PEAP uses TLS. PEAP needs certs too. Not *all* peap uses TLS and hence needs certs. The MS PEAP/MSCHAPv2 is a common example. Incorrect. PEAP *requires* a server certificate. The client does not need one. - List

RE: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-18 Thread Gary Gatten
@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Wednesday, May 18, 2011 11:01 AM To: freeradius-users@lists.freeradius.org Subject: Re: Authentication issues with Win7 and WPA/WPA2 Enterprise On 18/05/11 16:50, Gary Gatten wrote: I can't comment on your problem right now, but be aware there seem to be MANY

RE: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-18 Thread Gary Gatten
with Win7 and WPA/WPA2 Enterprise On 18/05/11 16:59, Gary Gatten wrote: One point of clarification: PEAP uses TLS. PEAP needs certs too. Not *all* peap uses TLS and hence needs certs. The MS PEAP/MSCHAPv2 is a common example. Incorrect. PEAP *requires* a server certificate. The client

Re: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-18 Thread Phil Mayers
On 18/05/11 17:10, Gary Gatten wrote: I would LOVE if W7 just worked! People here are blaming FR and I'm trying to convince them it has nothing to do with it, but since the MSCHAP challenges / responses are hashed I can't PROVE it to them. I have FR debugs of a working auth and a rejected

RE: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-18 Thread Gary Gatten
-users-bounces+ggatten=waddell@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Wednesday, May 18, 2011 11:27 AM To: freeradius-users@lists.freeradius.org Subject: Re: Authentication issues with Win7 and WPA/WPA2 Enterprise On 18/05/11 17:10, Gary Gatten wrote: I would LOVE if W7 just worked

Re: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-18 Thread Phil Mayers
On 18/05/11 17:10, Gary Gatten wrote: I would LOVE if W7 just worked! People here are blaming FR and I'm trying to convince them it has nothing to do with it, but since the MSCHAP challenges / responses are hashed I can't PROVE it to them. As per previous posts: Your Aruba wireless equipment

Re: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-18 Thread Phil Mayers
On 18/05/11 17:35, Gary Gatten wrote: That's what I was afraid of... Can you expand on this: You *can* check that a given response is valid for a given challenge, if you know the password or nt hash. At length, but I would be here all day ;o) Basically, I've got a python script that

Re: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-18 Thread Gary Gatten
: Wednesday, May 18, 2011 12:29 PM To: freeradius-users@lists.freeradius.org freeradius-users@lists.freeradius.org Subject: Re: Authentication issues with Win7 and WPA/WPA2 Enterprise On 18/05/11 17:10, Gary Gatten wrote: I would LOVE if W7 just worked! People here are blaming FR and I'm trying

Re: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-18 Thread Sven Hartge
Phil Mayers p.may...@imperial.ac.uk wrote: On 18/05/11 17:10, Gary Gatten wrote: I would LOVE if W7 just worked! People here are blaming FR and I'm trying to convince them it has nothing to do with it, but since the MSCHAP challenges / responses are hashed I can't PROVE it to them. Are you

RE: Authentication issues with Win7 and WPA/WPA2 Enterprise

2011-05-18 Thread Gary Gatten
To: 'freeradius-users@lists.freeradius.org' Subject: Re: Authentication issues with Win7 and WPA/WPA2 Enterprise I have a 2.1.10 server we are tesing with, but I thought the patch you mentioned wasn't in 2.1.10, I think Alan said he'd put it in 3.x? We will be testing passing the entire *eap session