Portál AbcLinuxu, 15. července 2025 08:34
Wed Sep 29 19:17:04 2010 : Info: Loaded virtual server inner-tunnel Wed Sep 29 19:17:04 2010 : Info: Loaded virtual server Wed Sep 29 19:17:04 2010 : Info: Ready to process requests. Wed Sep 29 19:17:30 2010 : Error: TLS Alert read:fatal:unknown CA Wed Sep 29 19:17:30 2010 : Error: TLS_accept:failed in SSLv3 read client certificate A Wed Sep 29 19:17:30 2010 : Error: rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
# We do NOT recommend using EAP-MD5 authentication
# for wireless connections. It is insecure, and does
# not provide for dynamic WEP keys.
#
md5 {
}
zadne volby to proste nema :) Jinak muzete nastavit i jine autentizacni mechanismy jako treba ten tls, leap, peap, mschapv (coz by mohli byt vas favorit pro pripojeni z windows, kdyz to MS vymyslel :)
Wed Sep 29 19:17:30 2010 : Error: TLS Alert read:fatal:unknown CA Wed Sep 29 19:17:30 2010 : Error: TLS_accept:failed in SSLv3 read client certificate A Wed Sep 29 19:17:30 2010 : Error: rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown caznamena, ze pre klienta je certifikacna autorita servera neznama, teda pri pouziti EAP-PEAP resp EAP-TTLS je potrebne nainstalovat na klientsky system CA certifikat, ktorou sa podpisoval certifikat radius serveru. Inak sa nevytvori TLS tunel cez ktory prebieha pri PEAPe autentifikacia pouzivatela.
radtest test heslo 192.168.1.1 1812 testa uživatel se mi korektně ověří. V logu je toto:
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = LDAP
+- entering group LDAP {...}
[ldap] login attempt by "test" with password "heslo"
[ldap] expand: %{Stripped-User-Name} ->
[ldap] ... expanding second conditional
[ldap] expand: %{User-Name} -> test
[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=test)
atd...
Ale když potom nakonfiguruji windows tak abych se mohl pomocí wifi přihlásit, mám v logu toto:
++[eap] returns updated
++[unix] returns notfound
[files] users: Matched entry DEFAULT at line 208
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = LDAP
+- entering group LDAP {...}
[ldap] Attribute "User-Password" is required for authentication.
You seem to have set "Auth-Type := LDAP" somewhere.
THAT CONFIGURATION IS WRONG. DELETE IT.
YOU ARE PREVENTING THE SERVER FROM WORKING PROPERLY.
++[ldap] returns invalid
Failed to authenticate the user.
Using Post-Auth-Type Reject
+- entering group REJECT {...}
[attr_filter.access_reject] expand: %{User-Name} ->
++[attr_filter.access_reject] returns noop
Delaying reject of request 2 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 2
Sending Access-Reject of id 0 to 192.168.1.1 port 1060
Waking up in 4.9 seconds.
Cleaning up request 2 ID 0 with timestamp +28
Ready to process requests.
V users mám toto:
DEFAULT Auth-Type := LDAP
Fall-Through = 1
Pokud do users zadám ještě:
test Cleartext-Password := "test123"a to do windows tak se přihlásím. Mohl by mi prosím někdo pomoci co dělám špatně?
DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1
User-Name := `%{User-Name}`,
Fall-Through = Yes
Ale to je to samé v bledě modrém, a teď se to dokonce ani necpe na ten LDAP server :( nemá někdo nějakou radu jak to zprovoznit?
Tiskni
Sdílej:
ISSN 1214-1267, (c) 1999-2007 Stickfish s.r.o.