On 3/15/04 10:41 AM, "Andreas Wolf" <[EMAIL PROTECTED]> wrote:
> > On Mar 14, 2004, at 9:04 PM, Kevan Olhausen wrote: > >> Okay, I know that PEAP is supported with XP/OSX. > > I am glad you do but that is not relevant. If you've heard that OS X > supports > PEAP then this was in reference to the 802.1X CLIENT. I was writing > about the > ramifications of using PEAP with freeRADIUS SERVER on OS X. Actually the clients are Windoze XP and OSX, the server is FreeBSD 5.1 and AFAIK not all clients support all EAP methods. I have found a document: http://www.broadbandreports.com/forum/remark,9286052~mode=flat that I'm working through at the moment that seems to clear things up. This might be useful to others as well. I'm very new at this and many of the documents I've found about TLS/FreeRADIUS assume a lot about the setup and are more than a year old so it's been hard to learn everything needed to make it work, for me at least. >> What are the options in >> radiusd.conf I need to configure for PEAP? > > Okay, that's a different question now. > I have to concur with Alan, the answer is in the docs and in numerous > previous postings. > >> I have the users file with >> entries like: kevan Auth-Type := EAP, User-Password == "mypassword". >> Do I >> still need to install certificates on the client? What are the options >> on >> the Cisco 1231 that I need to make sure this works correctly? >> >> Kevan >> >> On 3/14/04 2:18 PM, "Andreas Wolf" <[EMAIL PROTECTED]> wrote: >> >>> On Mar 14, 2004, at 12:06 AM, Kevan Olhausen wrote: >>> >>>> Access Point: Cisco Aironet 1231 >>>> Client: Mac OS X/ Windoze XP >>>> AAA Server: freeradius-0.9.3 >>>> >>>> Currently I�m trying to find a secure way to authenticate wireless >>>> users at our branch offices to freeradius without having to manage >>>> certificates because of users leaving the company so I thought PEAP >>>> might be a good way to go. Because we don�t own the users� computers >>>> we need a generally supported (Windoze XP) EAP authentication method: >>>> PEAP, TLS, etc. I have generated the certificates and radiusd �X >>>> shows >>>> it�s starting and listening. The main problem I�m having is �No >>>> User-Password or CHAP-Password attribute in the request� messages. >>> >>> PEAP tunnels MSCHAPv2 so you need to configure the server to >>> authenticate using MSCHAPv2. >>> What user database is the server configured to use? >>> The files module appears to have an entry. For MSCHAPv2 you need to >>> either provide the clear text password ('User-Password' attribute) or >>> the NT-hash of the password ('NT-Password' attribute , e.g. with the >>> smbencrypt tool) via some database to freeRADIUS, eg. files, mySQL, >>> LDAP etc.. >>> >>> OS X has the capability of authenticating users via MSCHAPv2 (ie. via >>> its native Directory Service ) but that is not yet integrated with >>> freeRADIUS, as far as I know.. >>> >>> If you have that already configured, then I don't know.. maybe >>> provide >>> the 'radiusd -Xxxx' output ? >>> >>> -Andreas >>> >>>> >>>> rlm_realm: No '@' in User-Name = "kevan", looking up realm NULL >>>> ����rlm_realm: No such realm "NULL" >>>> ��rlm_eap: EAP packet type response id 1 length 10 >>>> ��rlm_eap: No EAP Start, assuming it's an on-going EAP conversation >>>> ��modcall[authorize]: module "eap" returns updated for request 6 >>>> ����users: Matched kevan at 89 >>>> ��modcall[authorize]: module "files" returns ok for request 6 >>>> modcall: group authorize returns updated for request 6 >>>> ��rad_check_password: �Found Auth-Type Local >>>> auth: type Local >>>> auth: No User-Password or CHAP-Password attribute in the request >>>> auth: Failed to validate the user. >>>> >>>> >>>> Does anyone want to help me out with this one? Thanks in advance. >>>> >>>> Kevan >>>> >> >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
