I was wondering if any of you could help me with my configuration of freeradius.

I configured it to be able to authenticate via Ldap to acces to my wifi (cisco WAP321 Wireless-N Selectable-Band Access Point with Single Point Setup) and it works great when testing it from a shell but not when cisco is sending the request.

I think I found from where it comes : when I send a request from a shell, you can see it send this :

Received Access-Request Id 80 from 10/ip:54745 to ip:1812 length 109
    User-Name = 'username'
    User-Password = 'password'
    NAS-IP-Address = ip
    NAS-Port = 0
    Message-Authenticator = 0x3c2cfee784c322c6ed8dd8d33d17a99d
    Framed-Protocol = PPP
    EAP-Message = 0x0291001201656d696c69652e636f656c686f

But when cisco send it :

Access-Request Id 0 from ip:33571 to ip:1812 length 176
        User-Name = 'username'
        NAS-IP-Address = ip
        NAS-Port = 0
        Called-Station-Id = 'B8-38-61-EE-2F-AA:UShareSoft-secure'
        Calling-Station-Id = '9C-2A-70-C8-E4-E1'
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = 'CONNECT 0Mbps 802.11g'
        EAP-Message = 0x0200001201656d696c69652e636f656c686f
        Message-Authenticator = 0x162cba8095a9b8a60a9697913a9ec8d9

Where is the User-password with cisco ??

Ldap doesn't work as it doesn't find a password to compare.

Thanks by advance for your advice and answers !

  • Ok I tried it again with new certificates because the password is in fact encrypted in the eap message attribute (from what I understood) so if the servers doesn't succeed in decrypting it then it must certainly come from the certificates. I generated them like shown here : github.com/FreeRADIUS/freeradius-server/tree/v3.1.x/raddb/certs – Ise Nov 25 '16 at 7:46
  • Then I changed my certificates in .crt like this guy advised :community.cambiumnetworks.com/t5/Other-PMP-Solutions/… "To make ca.crt, pipe the output of the command 'openssl x509 -text -in ca.pem' '" So now I can see the password attribute further in the exchange even if I have another error concerning my authentication : Fri Nov 25 08:10:35 2016 : ERROR: (16) No Auth-Type found: rejecting the user via Post-Auth-Type = Reject – Ise Nov 25 '16 at 7:51

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.