Okay, I know that PEAP is supported with XP/OSX. What are the options in
radiusd.conf I need to configure for PEAP? I have the users file with
entries like: kevan Auth-Type := EAP, User-Password == "mypassword". Do I
still need to install certificates on the client? What are the options on
the Cisco 1231 that I need to make sure this works correctly?
Kevan
On 3/14/04 2:18 PM, "Andreas Wolf" <[EMAIL PROTECTED]> wrote:
> On Mar 14, 2004, at 12:06 AM, Kevan Olhausen wrote:
>
>> Access Point: Cisco Aironet 1231
>> Client: Mac OS X/ Windoze XP
>> AAA Server: freeradius-0.9.3
>>
>> Currently I�m trying to find a secure way to authenticate wireless
>> users at our branch offices to freeradius without having to manage
>> certificates because of users leaving the company so I thought PEAP
>> might be a good way to go. Because we don�t own the users� computers
>> we need a generally supported (Windoze XP) EAP authentication method:
>> PEAP, TLS, etc. I have generated the certificates and radiusd �X shows
>> it�s starting and listening. The main problem I�m having is �No
>> User-Password or CHAP-Password attribute in the request� messages.
>
> PEAP tunnels MSCHAPv2 so you need to configure the server to
> authenticate using MSCHAPv2.
> What user database is the server configured to use?
> The files module appears to have an entry. For MSCHAPv2 you need to
> either provide the clear text password ('User-Password' attribute) or
> the NT-hash of the password ('NT-Password' attribute , e.g. with the
> smbencrypt tool) via some database to freeRADIUS, eg. files, mySQL,
> LDAP etc..
>
> OS X has the capability of authenticating users via MSCHAPv2 (ie. via
> its native Directory Service ) but that is not yet integrated with
> freeRADIUS, as far as I know..
>
> If you have that already configured, then I don't know.. maybe provide
> the 'radiusd -Xxxx' output ?
>
> -Andreas
>
>>
>> rlm_realm: No '@' in User-Name = "kevan", looking up realm NULL
>> ����rlm_realm: No such realm "NULL"
>> ��rlm_eap: EAP packet type response id 1 length 10
>> ��rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
>> ��modcall[authorize]: module "eap" returns updated for request 6
>> ����users: Matched kevan at 89
>> ��modcall[authorize]: module "files" returns ok for request 6
>> modcall: group authorize returns updated for request 6
>> ��rad_check_password: �Found Auth-Type Local
>> auth: type Local
>> auth: No User-Password or CHAP-Password attribute in the request
>> auth: Failed to validate the user.
>>
>>
>> Does anyone want to help me out with this one? Thanks in advance.
>>
>> Kevan
>>
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
