Access Point: Cisco Aironet 1231
Client: Mac OS X/ Windoze XP
AAA Server: freeradius-0.9.3
Currently I’m trying to find a secure way to authenticate wireless users at our branch offices to freeradius without having to manage certificates because of users leaving the company so I thought PEAP might be a good way to go. Because we don’t own the users’ computers we need a generally supported (Windoze XP) EAP authentication method: PEAP, TLS, etc. I have generated the certificates and radiusd –X shows it’s starting and listening. The main problem I’m having is “No User-Password or CHAP-Password attribute in the request” messages.
PEAP tunnels MSCHAPv2 so you need to configure the server to authenticate using MSCHAPv2.
What user database is the server configured to use?
The files module appears to have an entry. For MSCHAPv2 you need to either provide the clear text password ('User-Password' attribute) or the NT-hash of the password ('NT-Password' attribute , e.g. with the smbencrypt tool) via some database to freeRADIUS, eg. files, mySQL, LDAP etc..
OS X has the capability of authenticating users via MSCHAPv2 (ie. via its native Directory Service ) but that is not yet integrated with freeRADIUS, as far as I know..
If you have that already configured, then I don't know.. maybe provide the 'radiusd -Xxxx' output ?
-Andreas
rlm_realm: No '@' in User-Name = "kevan", looking up realm NULL
rlm_realm: No such realm "NULL"
rlm_eap: EAP packet type response id 1 length 10
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 6
users: Matched kevan at 89
modcall[authorize]: module "files" returns ok for request 6
modcall: group authorize returns updated for request 6
rad_check_password: Found Auth-Type Local
auth: type Local
auth: No User-Password or CHAP-Password attribute in the request
auth: Failed to validate the user.
Does anyone want to help me out with this one? Thanks in advance.
Kevan
