On Mar 14, 2004, at 9:04 PM, Kevan Olhausen wrote:
Okay, I know that PEAP is supported with XP/OSX.
I am glad you do but that is not relevant. If you've heard that OS X supports
PEAP then this was in reference to the 802.1X CLIENT. I was writing about the
ramifications of using PEAP with freeRADIUS SERVER on OS X.
What are the options in radiusd.conf I need to configure for PEAP?
Okay, that's a different question now.
I have to concur with Alan, the answer is in the docs and in numerous previous postings.
-A
I have the users file with
entries like: kevan Auth-Type := EAP, User-Password == "mypassword". Do I
still need to install certificates on the client? What are the options on
the Cisco 1231 that I need to make sure this works correctly?
Kevan
On 3/14/04 2:18 PM, "Andreas Wolf" <[EMAIL PROTECTED]> wrote:
On Mar 14, 2004, at 12:06 AM, Kevan Olhausen wrote:
Access Point: Cisco Aironet 1231 Client: Mac OS X/ Windoze XP AAA Server: freeradius-0.9.3
Currently I’m trying to find a secure way to authenticate wireless
users at our branch offices to freeradius without having to manage
certificates because of users leaving the company so I thought PEAP
might be a good way to go. Because we don’t own the users’ computers
we need a generally supported (Windoze XP) EAP authentication method:
PEAP, TLS, etc. I have generated the certificates and radiusd –X shows
it’s starting and listening. The main problem I’m having is “No
User-Password or CHAP-Password attribute in the request” messages.
PEAP tunnels MSCHAPv2 so you need to configure the server to authenticate using MSCHAPv2. What user database is the server configured to use? The files module appears to have an entry. For MSCHAPv2 you need to either provide the clear text password ('User-Password' attribute) or the NT-hash of the password ('NT-Password' attribute , e.g. with the smbencrypt tool) via some database to freeRADIUS, eg. files, mySQL, LDAP etc..
OS X has the capability of authenticating users via MSCHAPv2 (ie. via its native Directory Service ) but that is not yet integrated with freeRADIUS, as far as I know..
If you have that already configured, then I don't know.. maybe provide
the 'radiusd -Xxxx' output ?
-Andreas
rlm_realm: No '@' in User-Name = "kevan", looking up realm NULL rlm_realm: No such realm "NULL" rlm_eap: EAP packet type response id 1 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched kevan at 89 modcall[authorize]: module "files" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user.
Does anyone want to help me out with this one? Thanks in advance.
Kevan
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
