pfSense freeradius wifi hitelesités windows 7-hez

- Tehát users fájlba 1 user felvéve
"felhasználónév" Cleartext-Password := "Jelszó"
- client.conf-ba a kliens felvéve.
- eap.conf-ban default_eap_type = peap
- Windowsban tanúsítvány érvényesítés kikapcsolva, Hitelesítési mód MSChap v2
Windows felhasználónével való hitelesítés kikapcsolva
Hitelesítési mód: Felhasználóhitelesítés

A log-ban látható egy "Login OK" az az Android készülékkel való csatlakozás
Az "ERROR" és a "Login Incorrect" pedig a Windows 7-el való csatlakozás.


Mon Aug 17 17:28:26 2015 : Info: Ready to process requests.
Mon Aug 17 17:31:07 2015 : Auth: Login OK: [kisspepe/] (from client Teszt port 0 via TLS tunnel)
Mon Aug 17 17:31:07 2015 : Auth: Login OK: [kisspepe/] (from client Teszt port 0 cli 34-23-BA-B5-81-47)
Mon Aug 17 17:32:52 2015 : Error: TLS Alert read:fatal:unknown CA
Mon Aug 17 17:32:52 2015 : Error: TLS_accept: failed in SSLv3 read client certificate A
Mon Aug 17 17:32:52 2015 : Error: rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
Mon Aug 17 17:32:52 2015 : Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails.
Mon Aug 17 17:32:52 2015 : Auth: Login incorrect (TLS Alert read:fatal:unknown CA): [kisspepe/] (from client Teszt port 0 cli 84-4B-F5-16-36-01)
Mon Aug 17 17:32:55 2015 : Auth: Login incorrect: [KissGábor-PC\\Kiss Gábor/] (from client Teszt port 0 cli 84-4B-F5-16-36-01)
Mon Aug 17 17:33:01 2015 : Auth: Login incorrect: [/] (from client Teszt port 0 cli 84-4B-F5-16-36-01)


A freeradius -X kimenete szintén egy Android és egy Windows 7 csatlakozásánál:


Ready to process requests.
rad_recv: Access-Request packet from host 192.168.1.99 port 2048, id=31, length=137
NAS-IP-Address = 192.168.1.99
NAS-Port = 0
Called-Station-Id = "90-F6-52-6A-E8-B6:Teszt"
Calling-Station-Id = "84-4B-F5-16-36-01"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
EAP-Message = 0x0201000501
Message-Authenticator = 0x02325eade258784098b8803c458a29b2
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] Proxy reply, or no User-Name. Ignoring.
++[suffix] = ok
[eap] EAP packet type response id 1 length 5
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] = updated
++[files] = noop
++[expiration] = noop
++[logintime] = noop
[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.
++[pap] = noop
+} # group authorize = updated
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] UserIdentity Unknown
[eap] Identity Unknown, authentication failed
[eap] Failed in handler
++[eap] = invalid
+} # group authenticate = invalid
Failed to authenticate the user.
Login incorrect: [/] (from client Teszt port 0 cli 84-4B-F5-16-36-01)
Using Post-Auth-Type REJECT
# Executing group from file /etc/freeradius/sites-enabled/default
+group REJECT {
[attr_filter.access_reject] expand: %{User-Name} ->
++[attr_filter.access_reject] = noop
+} # group REJECT = noop
Delaying reject of request 15 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 15
Sending Access-Reject of id 31 to 192.168.1.99 port 2048
Waking up in 4.9 seconds.
Cleaning up request 15 ID 31 with timestamp +128
Ready to process requests.