EAP-TTLS w/ files - cert and username issues
jck-freeradius at southwestern.edu
jck-freeradius at southwestern.edu
Thu Jul 7 13:42:43 CEST 2005
List,
I am experiencing several barriers in getting the FreeRadius 1.0.2 port
to work, in FreeBSD 5.4-RELEASE. The supplicant is XP SP2, requesting through
a Cisco 1100 AP NAS.
Included is my startup, along with a couple of supplicant requests.
In the past I have used sql authorization. I now use files, and am taking
baby-steps (with http://www.alphacore.net/spipen/article.php3?id_article=4 as
my guide).
When I can get everything working with the built-in XP 802.1x
authentcation client, I would like to enable multiple VLAN support into my
radius config.
My questions can be found at the bottom of this post.
---
/usr/local/sbin/radiusd -X -A -y -z
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config: including file: /usr/local/etc/raddb/proxy.conf
Config: including file: /usr/local/etc/raddb/clients.conf
Config: including file: /usr/local/etc/raddb/snmp.conf
Config: including file: /usr/local/etc/raddb/eap.conf
Config: including file: /usr/local/etc/raddb/sql.conf
main: prefix = "/usr/local"
main: localstatedir = "/var"
main: logdir = "/var/log"
main: libdir = "/usr/local/lib"
main: radacctdir = "/var/log/radacct"
main: hostname_lookups = yes
main: snmp = no
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 1645
main: allow_core_dumps = no
main: log_stripped_names = yes
main: log_file = "/var/log/radius.log"
main: log_auth = yes
main: log_auth_badpass = yes
main: log_auth_goodpass = yes
main: pidfile = "/var/run/radiusd/radiusd.pid"
main: user = "nobody"
main: group = "nobody"
main: usercollide = no
main: lower_user = "no"
main: lower_pass = "no"
main: nospace_user = "no"
main: nospace_pass = "no"
main: checkrad = "/usr/local/sbin/checkrad"
main: proxy_requests = yes
proxy: retry_delay = 5
proxy: retry_count = 3
proxy: synchronous = no
proxy: default_fallback = yes
proxy: dead_time = 120
proxy: post_proxy_authorize = yes
proxy: wake_all_if_all_dead = no
security: max_attributes = 200
security: reject_delay = 1
security: status_server = no
main: debug_level = 0
read_config_files: reading dictionary
read_config_files: reading naslist
Using deprecated naslist file. Support for this will go away soon.
read_config_files: reading clients
read_config_files: reading realms
radiusd: entering modules setup
Module: Library search path is /usr/local/lib
Module: Loaded exec
exec: wait = yes
exec: program = "(null)"
exec: input_pairs = "request"
exec: output_pairs = "(null)"
exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded PAP
pap: encryption_scheme = "crypt"
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded MS-CHAP
mschap: use_mppe = yes
mschap: require_encryption = no
mschap: require_strong = no
mschap: with_ntdomain_hack = no
mschap: passwd = "(null)"
mschap: authtype = "MS-CHAP"
mschap: ntlm_auth = "(null)"
Module: Instantiated mschap (mschap)
Module: Loaded System
unix: cache = no
unix: passwd = "(null)"
unix: shadow = "(null)"
unix: group = "(null)"
unix: radwtmp = "/var/log/radwtmp"
unix: usegroup = no
unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded eap
eap: default_eap_type = "md5"
eap: timer_expire = 60
eap: ignore_unknown_eap_types = no
eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
gtc: challenge = "Password: "
gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
tls: rsa_key_exchange = no
tls: dh_key_exchange = yes
tls: rsa_key_length = 512
tls: dh_key_length = 512
tls: verify_depth = 0
tls: CA_path = "(null)"
tls: pem_file_type = yes
tls: private_key_file = "/usr/local/etc/raddb/certs/demoCA/private/cakey.pem"
tls: certificate_file = "/usr/local/etc/raddb/certs/cacert.pem"
tls: CA_file = "/usr/local/etc/raddb/certs/cacert.pem"
tls: private_key_password = "xXxXxX"
tls: dh_file = "/usr/local/etc/raddb/certs/dh"
tls: random_file = "/usr/local/etc/raddb/certs/random"
tls: fragment_size = 1024
tls: include_length = yes
tls: check_crl = no
tls: check_cert_cn = "(null)"
rlm_eap: Loaded and initialized type tls
ttls: default_eap_type = "md5"
ttls: copy_request_to_tunnel = yes
ttls: use_tunneled_reply = yes
rlm_eap: Loaded and initialized type ttls
mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups"
preprocess: hints = "/usr/local/etc/raddb/hints"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line = 23
preprocess: with_ntdomain_hack = no
preprocess: with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded detail
detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (auth_log)
Module: Loaded realm
realm: format = "suffix"
realm: delimiter = "@"
realm: ignore_default = no
realm: ignore_null = no
Module: Instantiated realm (suffix)
Module: Loaded files
files: usersfile = "/usr/local/etc/raddb/users"
files: acctusersfile = "/usr/local/etc/raddb/acct_users"
files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"
files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename = "/var/log/radutmp"
radutmp: username = "%{User-Name}"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on authentication *:1645
Listening on accounting *:1646
Listening on proxy *:1647
Ready to process requests.
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=204, length=160
User-Name = "\\test"
Framed-MTU = 1400
Called-Station-Id = "0014.691e.dee0"
Calling-Station-Id = "000e.35b5.eb8f"
Service-Type = Login-User
Message-Authenticator = 0x238c744d504314eab835667ae645baac
EAP-Message = 0x0205001115800000000715030100020230
NAS-Port-Type = Wireless-802.11
NAS-Port = 5109
State = 0x9b473d358960d6200af1bc554cb69e61
NAS-IP-Address = 192.168.1.249
NAS-Identifier = "freeradius1100"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module "preprocess" returns ok for request 0
radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
modcall[authorize]: module "auth_log" returns ok for request 0
modcall[authorize]: module "chap" returns noop for request 0
modcall[authorize]: module "mschap" returns noop for request 0
rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 0
rlm_eap: EAP packet type response id 5 length 17
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 0
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 0
modcall: group authorize returns updated for request 0
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
rlm_eap: Request not found in the list
rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request
rlm_eap: Failed in handler
modcall[authenticate]: module "eap" returns invalid for request 0
modcall: group authenticate returns invalid for request 0
auth: Failed to validate the user.
Login incorrect: [\\test/<no User-Password attribute>] (from client Aironet1100 port 5109 cli 000e.35b5.eb8f)
Delaying request 0 for 1 seconds
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Sending Access-Reject of id 204 to 192.168.1.249:1645
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=205, length=135
User-Name = "\\test"
Framed-MTU = 1400
Called-Station-Id = "0014.691e.dee0"
Calling-Station-Id = "000e.35b5.eb8f"
Service-Type = Login-User
Message-Authenticator = 0x8fa769b77767a6d40c0f4368065836f7
EAP-Message = 0x0201000a015c74657374
NAS-Port-Type = Wireless-802.11
NAS-Port = 5110
NAS-IP-Address = 192.168.1.249
NAS-Identifier = "freeradius1100"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
modcall[authorize]: module "preprocess" returns ok for request 1
radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
modcall[authorize]: module "auth_log" returns ok for request 1
modcall[authorize]: module "chap" returns noop for request 1
modcall[authorize]: module "mschap" returns noop for request 1
rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 1
rlm_eap: EAP packet type response id 1 length 10
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 1
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 1
modcall: group authorize returns updated for request 1
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 1
rlm_eap: EAP Identity
rlm_eap: processing type md5
rlm_eap_md5: Issuing Challenge
modcall[authenticate]: module "eap" returns handled for request 1
modcall: group authenticate returns handled for request 1
Sending Access-Challenge of id 205 to 192.168.1.249:1645
EAP-Message = 0x010200160410f8699c142f2b04174aa12d7ba7e1acb3
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xefbab3f23eae914a7e7e787f980a33ea
Finished request 1
Going to the next request
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=206, length=149
User-Name = "\\test"
Framed-MTU = 1400
Called-Station-Id = "0014.691e.dee0"
Calling-Station-Id = "000e.35b5.eb8f"
Service-Type = Login-User
Message-Authenticator = 0x028ca873c46d637a9313e8a7c400e9f9
EAP-Message = 0x020200060315
NAS-Port-Type = Wireless-802.11
NAS-Port = 5110
State = 0xefbab3f23eae914a7e7e787f980a33ea
NAS-IP-Address = 192.168.1.249
NAS-Identifier = "freeradius1100"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 2
modcall[authorize]: module "preprocess" returns ok for request 2
radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
modcall[authorize]: module "auth_log" returns ok for request 2
modcall[authorize]: module "chap" returns noop for request 2
modcall[authorize]: module "mschap" returns noop for request 2
rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 2
rlm_eap: EAP packet type response id 2 length 6
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 2
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 2
modcall: group authorize returns updated for request 2
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 2
rlm_eap: Request found, released from the list
rlm_eap: EAP NAK
rlm_eap: EAP-NAK asked for EAP-Type/ttls
rlm_eap: processing type tls
rlm_eap_tls: Initiate
rlm_eap_tls: Start returned 1
modcall[authenticate]: module "eap" returns handled for request 2
modcall: group authenticate returns handled for request 2
Sending Access-Challenge of id 206 to 192.168.1.249:1645
EAP-Message = 0x010300061520
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x92217acdcb66585c00578271b16e607a
Finished request 2
Going to the next request
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=207, length=249
User-Name = "\\test"
Framed-MTU = 1400
Called-Station-Id = "0014.691e.dee0"
Calling-Station-Id = "000e.35b5.eb8f"
Service-Type = Login-User
Message-Authenticator = 0x2720f14be41136a09d19c7eccb60cfe9
EAP-Message = 0x0203006a158000000060160301005b01000057030142cd0f6a8f09262c8c4b8acc2ac7d156e44e412a5860a00d23512d0ea279941000003000390038003500160013000a00330032002f0066000500040065006400630062006000150012000900140011000800030100
NAS-Port-Type = Wireless-802.11
NAS-Port = 5110
State = 0x92217acdcb66585c00578271b16e607a
NAS-IP-Address = 192.168.1.249
NAS-Identifier = "freeradius1100"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 3
modcall[authorize]: module "preprocess" returns ok for request 3
radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
modcall[authorize]: module "auth_log" returns ok for request 3
modcall[authorize]: module "chap" returns noop for request 3
modcall[authorize]: module "mschap" returns noop for request 3
rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 3
rlm_eap: EAP packet type response id 3 length 106
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 3
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 3
modcall: group authorize returns updated for request 3
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 3
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Length Included
eaptls_verify returned 11
(other): before/accept initialization
TLS_accept: before/accept initialization
rlm_eap_tls: <<< TLS 1.0 Handshake [length 005b], ClientHello
TLS_accept: SSLv3 read client hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello
TLS_accept: SSLv3 write server hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0454], Certificate
TLS_accept: SSLv3 write certificate A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
TLS_accept: SSLv3 write server done A
TLS_accept: SSLv3 flush data
TLS_accept:error in SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
eaptls_process returned 13
modcall[authenticate]: module "eap" returns handled for request 3
modcall: group authenticate returns handled for request 3
Sending Access-Challenge of id 207 to 192.168.1.249:1645
EAP-Message = 0x0104040a15c0000004b1160301004a02000046030142ccc10ed21fab0d59b10e6188e109574dae7147d68ffb41d3d2023030eeda75207f4a0ac74177d7255e411ecedbe3ebc5db188d491a11923c4cffb6354b0b32fb00350016030104540b00045000044d00044a30820446308203afa003020102020900b4ffbc458a823a63300d06092a864886f70d01010405003081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572
EAP-Message = 0x204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e656475301e170d3035303730363133353630335a170d3135303730343133353630335a3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504
EAP-Message = 0x031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e65647530819f300d06092a864886f70d010101050003818d0030818902818100952a6e25e986e7297e0fe23d8ab71a410a827faeed95c076d4bb558f46790b556c13bb40cb082da6776bcad9d70c884d7f831dce00b984cc2c1818a744c529c21a9fb708244e09ef55c7edc2c063659d0ab8f2948bcf9e98c862460023c17a5ce91ed97429e6a79e2726c11c8acbbf109f12f4a8d8efcea365a5831944dc14250203010001a38201323082012e301d0603551d
EAP-Message = 0x0e04160414166b7bb5824d8888245b04f718d44f9d85d631783081fe0603551d230481f63081f38014166b7bb5824d8888245b04f718d44f9d85d63178a181cfa481cc3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d69
EAP-Message = 0x6e40736f7574687765737465726e2e656475820900b4
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x2509db5459d6466c777ef4f8e39fe7bc
Finished request 3
Going to the next request
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=208, length=149
User-Name = "\\test"
Framed-MTU = 1400
Called-Station-Id = "0014.691e.dee0"
Calling-Station-Id = "000e.35b5.eb8f"
Service-Type = Login-User
Message-Authenticator = 0xdbea76e625c3741e8a7a40e97aab42c3
EAP-Message = 0x020400061500
NAS-Port-Type = Wireless-802.11
NAS-Port = 5110
State = 0x2509db5459d6466c777ef4f8e39fe7bc
NAS-IP-Address = 192.168.1.249
NAS-Identifier = "freeradius1100"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 4
modcall[authorize]: module "preprocess" returns ok for request 4
radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
modcall[authorize]: module "auth_log" returns ok for request 4
modcall[authorize]: module "chap" returns noop for request 4
modcall[authorize]: module "mschap" returns noop for request 4
rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 4
rlm_eap: EAP packet type response id 4 length 6
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 4
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 4
modcall: group authorize returns updated for request 4
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 4
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
rlm_eap_tls: ack handshake fragment handler
eaptls_verify returned 1
eaptls_process returned 13
modcall[authenticate]: module "eap" returns handled for request 4
modcall: group authenticate returns handled for request 4
Sending Access-Challenge of id 208 to 192.168.1.249:1645
EAP-Message = 0x010500bb1580000004b1ffbc458a823a63300c0603551d13040530030101ff300d06092a864886f70d01010405000381810030b2ae584f5f190289bcf3451bc1d1bac6a0e9d7ad7d79857c1b68c4537677fc2cc9192f4e5a17b974bdbb514f94178847884da765e4b3f3e878e0d9083978cd799b434f25e6f7fa8047d6bef2f410919f2d54574a873f1adafb83a175ccc47d34c46113fbc80fa0942cc9b74fe4fbbfed0c632eea7a4ba04ab80913169a289216030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xb976af42b5c24fda517ca5a5094e5bd1
Finished request 4
Going to the next request
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=209, length=160
User-Name = "\\test"
Framed-MTU = 1400
Called-Station-Id = "0014.691e.dee0"
Calling-Station-Id = "000e.35b5.eb8f"
Service-Type = Login-User
Message-Authenticator = 0x1ed15ed6d0d7cefc891b19b23bee81de
EAP-Message = 0x0205001115800000000715030100020230
NAS-Port-Type = Wireless-802.11
NAS-Port = 5110
State = 0xb976af42b5c24fda517ca5a5094e5bd1
NAS-IP-Address = 192.168.1.249
NAS-Identifier = "freeradius1100"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 5
modcall[authorize]: module "preprocess" returns ok for request 5
radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
modcall[authorize]: module "auth_log" returns ok for request 5
modcall[authorize]: module "chap" returns noop for request 5
modcall[authorize]: module "mschap" returns noop for request 5
rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 5
rlm_eap: EAP packet type response id 5 length 17
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 5
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 5
modcall: group authorize returns updated for request 5
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 5
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Length Included
eaptls_verify returned 11
rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca
TLS Alert read:fatal:unknown CA
TLS_accept:failed in SSLv3 read client certificate A
74089:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48
74089:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837:
rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails.
In SSL Handshake Phase
In SSL Accept mode
rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails.
eaptls_process returned 13
rlm_eap: Freeing handler
modcall[authenticate]: module "eap" returns reject for request 5
modcall: group authenticate returns reject for request 5
auth: Failed to validate the user.
Login incorrect: [\\test/<no User-Password attribute>] (from client Aironet1100 port 5110 cli 000e.35b5.eb8f)
Delaying request 5 for 1 seconds
Finished request 5
Going to the next request
Waking up in 4 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 204 with timestamp 42ccc10c
Sending Access-Reject of id 209 to 192.168.1.249:1645
EAP-Message = 0x04050004
Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 2 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=210, length=135
User-Name = "\\test"
Framed-MTU = 1400
Called-Station-Id = "0014.691e.dee0"
Calling-Station-Id = "000e.35b5.eb8f"
Service-Type = Login-User
Message-Authenticator = 0x544e7a1be19c6f73f27f99568ad64107
EAP-Message = 0x0201000a015c74657374
NAS-Port-Type = Wireless-802.11
NAS-Port = 5111
NAS-IP-Address = 192.168.1.249
NAS-Identifier = "freeradius1100"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 6
modcall[authorize]: module "preprocess" returns ok for request 6
radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
modcall[authorize]: module "auth_log" returns ok for request 6
modcall[authorize]: module "chap" returns noop for request 6
modcall[authorize]: module "mschap" returns noop for request 6
rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 6
rlm_eap: EAP packet type response id 1 length 10
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 6
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 6
modcall: group authorize returns updated for request 6
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 6
rlm_eap: EAP Identity
rlm_eap: processing type md5
rlm_eap_md5: Issuing Challenge
modcall[authenticate]: module "eap" returns handled for request 6
modcall: group authenticate returns handled for request 6
Sending Access-Challenge of id 210 to 192.168.1.249:1645
EAP-Message = 0x0102001604102175e07d9aa780427053303ac2cde45c
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x63ae08507e7adbd6ec0a1b963ba8ac19
Finished request 6
Going to the next request
Waking up in 2 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=211, length=149
User-Name = "\\test"
Framed-MTU = 1400
Called-Station-Id = "0014.691e.dee0"
Calling-Station-Id = "000e.35b5.eb8f"
Service-Type = Login-User
Message-Authenticator = 0x9ca188d4e2c3bacf6951c2e146d7793b
EAP-Message = 0x020200060315
NAS-Port-Type = Wireless-802.11
NAS-Port = 5111
State = 0x63ae08507e7adbd6ec0a1b963ba8ac19
NAS-IP-Address = 192.168.1.249
NAS-Identifier = "freeradius1100"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 7
modcall[authorize]: module "preprocess" returns ok for request 7
radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
modcall[authorize]: module "auth_log" returns ok for request 7
modcall[authorize]: module "chap" returns noop for request 7
modcall[authorize]: module "mschap" returns noop for request 7
rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 7
rlm_eap: EAP packet type response id 2 length 6
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 7
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 7
modcall: group authorize returns updated for request 7
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 7
rlm_eap: Request found, released from the list
rlm_eap: EAP NAK
rlm_eap: EAP-NAK asked for EAP-Type/ttls
rlm_eap: processing type tls
rlm_eap_tls: Initiate
rlm_eap_tls: Start returned 1
modcall[authenticate]: module "eap" returns handled for request 7
modcall: group authenticate returns handled for request 7
Sending Access-Challenge of id 211 to 192.168.1.249:1645
EAP-Message = 0x010300061520
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xd9af635c0f0a743e30cb4b7cfcb6dbb3
Finished request 7
Going to the next request
Waking up in 2 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=212, length=249
User-Name = "\\test"
Framed-MTU = 1400
Called-Station-Id = "0014.691e.dee0"
Calling-Station-Id = "000e.35b5.eb8f"
Service-Type = Login-User
Message-Authenticator = 0xa6def1b9db8aef9d09c89013ae6291cd
EAP-Message = 0x0203006a158000000060160301005b01000057030142cd0f6ecc689e8295b1c859d9fa1226f5b025ac75bb01b1c1d27fc659c6a89500003000390038003500160013000a00330032002f0066000500040065006400630062006000150012000900140011000800030100
NAS-Port-Type = Wireless-802.11
NAS-Port = 5111
State = 0xd9af635c0f0a743e30cb4b7cfcb6dbb3
NAS-IP-Address = 192.168.1.249
NAS-Identifier = "freeradius1100"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 8
modcall[authorize]: module "preprocess" returns ok for request 8
radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
modcall[authorize]: module "auth_log" returns ok for request 8
modcall[authorize]: module "chap" returns noop for request 8
modcall[authorize]: module "mschap" returns noop for request 8
rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 8
rlm_eap: EAP packet type response id 3 length 106
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 8
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 8
modcall: group authorize returns updated for request 8
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 8
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Length Included
eaptls_verify returned 11
(other): before/accept initialization
TLS_accept: before/accept initialization
rlm_eap_tls: <<< TLS 1.0 Handshake [length 005b], ClientHello
TLS_accept: SSLv3 read client hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello
TLS_accept: SSLv3 write server hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0454], Certificate
TLS_accept: SSLv3 write certificate A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
TLS_accept: SSLv3 write server done A
TLS_accept: SSLv3 flush data
TLS_accept:error in SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
eaptls_process returned 13
modcall[authenticate]: module "eap" returns handled for request 8
modcall: group authenticate returns handled for request 8
Sending Access-Challenge of id 212 to 192.168.1.249:1645
EAP-Message = 0x0104040a15c0000004b1160301004a02000046030142ccc1121988c9add3c5d8fe81cf66d5b075cdd1eb288ce2abcaef53a530f9b5205b04e5b1f6ba59f700f87ecb2710de52422884b1f67ea9fefce9b3350df8c17f00350016030104540b00045000044d00044a30820446308203afa003020102020900b4ffbc458a823a63300d06092a864886f70d01010405003081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572
EAP-Message = 0x204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e656475301e170d3035303730363133353630335a170d3135303730343133353630335a3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504
EAP-Message = 0x031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e65647530819f300d06092a864886f70d010101050003818d0030818902818100952a6e25e986e7297e0fe23d8ab71a410a827faeed95c076d4bb558f46790b556c13bb40cb082da6776bcad9d70c884d7f831dce00b984cc2c1818a744c529c21a9fb708244e09ef55c7edc2c063659d0ab8f2948bcf9e98c862460023c17a5ce91ed97429e6a79e2726c11c8acbbf109f12f4a8d8efcea365a5831944dc14250203010001a38201323082012e301d0603551d
EAP-Message = 0x0e04160414166b7bb5824d8888245b04f718d44f9d85d631783081fe0603551d230481f63081f38014166b7bb5824d8888245b04f718d44f9d85d63178a181cfa481cc3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d69
EAP-Message = 0x6e40736f7574687765737465726e2e656475820900b4
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x164cf9a732e840475264604a9e01de91
Finished request 8
Going to the next request
Waking up in 2 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=213, length=149
User-Name = "\\test"
Framed-MTU = 1400
Called-Station-Id = "0014.691e.dee0"
Calling-Station-Id = "000e.35b5.eb8f"
Service-Type = Login-User
Message-Authenticator = 0x2709d031c3b73506b88e0453e2ec0c39
EAP-Message = 0x020400061500
NAS-Port-Type = Wireless-802.11
NAS-Port = 5111
State = 0x164cf9a732e840475264604a9e01de91
NAS-IP-Address = 192.168.1.249
NAS-Identifier = "freeradius1100"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 9
modcall[authorize]: module "preprocess" returns ok for request 9
radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
modcall[authorize]: module "auth_log" returns ok for request 9
modcall[authorize]: module "chap" returns noop for request 9
modcall[authorize]: module "mschap" returns noop for request 9
rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 9
rlm_eap: EAP packet type response id 4 length 6
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 9
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 9
modcall: group authorize returns updated for request 9
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 9
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
rlm_eap_tls: ack handshake fragment handler
eaptls_verify returned 1
eaptls_process returned 13
modcall[authenticate]: module "eap" returns handled for request 9
modcall: group authenticate returns handled for request 9
Sending Access-Challenge of id 213 to 192.168.1.249:1645
EAP-Message = 0x010500bb1580000004b1ffbc458a823a63300c0603551d13040530030101ff300d06092a864886f70d01010405000381810030b2ae584f5f190289bcf3451bc1d1bac6a0e9d7ad7d79857c1b68c4537677fc2cc9192f4e5a17b974bdbb514f94178847884da765e4b3f3e878e0d9083978cd799b434f25e6f7fa8047d6bef2f410919f2d54574a873f1adafb83a175ccc47d34c46113fbc80fa0942cc9b74fe4fbbfed0c632eea7a4ba04ab80913169a289216030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x473d358960d6204ce25ca24599a0f7f7
Finished request 9
Going to the next request
Waking up in 2 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=214, length=160
User-Name = "\\test"
Framed-MTU = 1400
Called-Station-Id = "0014.691e.dee0"
Calling-Station-Id = "000e.35b5.eb8f"
Service-Type = Login-User
Message-Authenticator = 0xe05d2ac8b90eacb717ad47ed3afe6f8c
EAP-Message = 0x0205001115800000000715030100020230
NAS-Port-Type = Wireless-802.11
NAS-Port = 5111
State = 0x473d358960d6204ce25ca24599a0f7f7
NAS-IP-Address = 192.168.1.249
NAS-Identifier = "freeradius1100"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 10
modcall[authorize]: module "preprocess" returns ok for request 10
radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
modcall[authorize]: module "auth_log" returns ok for request 10
modcall[authorize]: module "chap" returns noop for request 10
modcall[authorize]: module "mschap" returns noop for request 10
rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 10
rlm_eap: EAP packet type response id 5 length 17
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 10
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 10
modcall: group authorize returns updated for request 10
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 10
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Length Included
eaptls_verify returned 11
rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca
TLS Alert read:fatal:unknown CA
TLS_accept:failed in SSLv3 read client certificate A
74089:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48
74089:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837:
rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails.
In SSL Handshake Phase
In SSL Accept mode
rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails.
eaptls_process returned 13
rlm_eap: Freeing handler
modcall[authenticate]: module "eap" returns reject for request 10
modcall: group authenticate returns reject for request 10
auth: Failed to validate the user.
Login incorrect: [\\test/<no User-Password attribute>] (from client Aironet1100 port 5111 cli 000e.35b5.eb8f)
Delaying request 10 for 1 seconds
Finished request 10
Going to the next request
Waking up in 2 seconds...
--- Walking the entire request list ---
Cleaning up request 1 ID 205 with timestamp 42ccc10e
Cleaning up request 2 ID 206 with timestamp 42ccc10e
Cleaning up request 3 ID 207 with timestamp 42ccc10e
Cleaning up request 4 ID 208 with timestamp 42ccc10e
Cleaning up request 5 ID 209 with timestamp 42ccc10e
Sending Access-Reject of id 214 to 192.168.1.249:1645
EAP-Message = 0x04050004
Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=215, length=135
User-Name = "\\test"
Framed-MTU = 1400
Called-Station-Id = "0014.691e.dee0"
Calling-Station-Id = "000e.35b5.eb8f"
Service-Type = Login-User
Message-Authenticator = 0x9b1598a18cc60ddc9fd92daaf7b78b3b
EAP-Message = 0x0201000a015c74657374
NAS-Port-Type = Wireless-802.11
NAS-Port = 5112
NAS-IP-Address = 192.168.1.249
NAS-Identifier = "freeradius1100"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 11
modcall[authorize]: module "preprocess" returns ok for request 11
radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
modcall[authorize]: module "auth_log" returns ok for request 11
modcall[authorize]: module "chap" returns noop for request 11
modcall[authorize]: module "mschap" returns noop for request 11
rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 11
rlm_eap: EAP packet type response id 1 length 10
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 11
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 11
modcall: group authorize returns updated for request 11
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 11
rlm_eap: EAP Identity
rlm_eap: processing type md5
rlm_eap_md5: Issuing Challenge
modcall[authenticate]: module "eap" returns handled for request 11
modcall: group authenticate returns handled for request 11
Sending Access-Challenge of id 215 to 192.168.1.249:1645
EAP-Message = 0x010200160410ae56ef5b513719784eb029ef161e3834
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x47b6bb0eb7cb3629f5209d838c9cb2bb
Finished request 11
Going to the next request
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=216, length=149
User-Name = "\\test"
Framed-MTU = 1400
Called-Station-Id = "0014.691e.dee0"
Calling-Station-Id = "000e.35b5.eb8f"
Service-Type = Login-User
Message-Authenticator = 0xf8cbc78444e069e76dcfdc85d3d68e1c
EAP-Message = 0x020200060315
NAS-Port-Type = Wireless-802.11
NAS-Port = 5112
State = 0x47b6bb0eb7cb3629f5209d838c9cb2bb
NAS-IP-Address = 192.168.1.249
NAS-Identifier = "freeradius1100"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 12
modcall[authorize]: module "preprocess" returns ok for request 12
radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
modcall[authorize]: module "auth_log" returns ok for request 12
modcall[authorize]: module "chap" returns noop for request 12
modcall[authorize]: module "mschap" returns noop for request 12
rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 12
rlm_eap: EAP packet type response id 2 length 6
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 12
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 12
modcall: group authorize returns updated for request 12
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 12
rlm_eap: Request found, released from the list
rlm_eap: EAP NAK
rlm_eap: EAP-NAK asked for EAP-Type/ttls
rlm_eap: processing type tls
rlm_eap_tls: Initiate
rlm_eap_tls: Start returned 1
modcall[authenticate]: module "eap" returns handled for request 12
modcall: group authenticate returns handled for request 12
Sending Access-Challenge of id 216 to 192.168.1.249:1645
EAP-Message = 0x010300061520
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xcefd256444122da46c97de73b47f9968
Finished request 12
Going to the next request
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=217, length=249
User-Name = "\\test"
Framed-MTU = 1400
Called-Station-Id = "0014.691e.dee0"
Calling-Station-Id = "000e.35b5.eb8f"
Service-Type = Login-User
Message-Authenticator = 0xeee120ea8fb84b5b68ba7b01669c1a90
EAP-Message = 0x0203006a158000000060160301005b01000057030142cd0f70429a566d1ac989f1550ae3a440b7d4e9db1779f5e5288babe6e987cd00003000390038003500160013000a00330032002f0066000500040065006400630062006000150012000900140011000800030100
NAS-Port-Type = Wireless-802.11
NAS-Port = 5112
State = 0xcefd256444122da46c97de73b47f9968
NAS-IP-Address = 192.168.1.249
NAS-Identifier = "freeradius1100"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 13
modcall[authorize]: module "preprocess" returns ok for request 13
radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
modcall[authorize]: module "auth_log" returns ok for request 13
modcall[authorize]: module "chap" returns noop for request 13
modcall[authorize]: module "mschap" returns noop for request 13
rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 13
rlm_eap: EAP packet type response id 3 length 106
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 13
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 13
modcall: group authorize returns updated for request 13
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 13
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Length Included
eaptls_verify returned 11
(other): before/accept initialization
TLS_accept: before/accept initialization
rlm_eap_tls: <<< TLS 1.0 Handshake [length 005b], ClientHello
TLS_accept: SSLv3 read client hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello
TLS_accept: SSLv3 write server hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0454], Certificate
TLS_accept: SSLv3 write certificate A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
TLS_accept: SSLv3 write server done A
TLS_accept: SSLv3 flush data
TLS_accept:error in SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
eaptls_process returned 13
modcall[authenticate]: module "eap" returns handled for request 13
modcall: group authenticate returns handled for request 13
Sending Access-Challenge of id 217 to 192.168.1.249:1645
EAP-Message = 0x0104040a15c0000004b1160301004a02000046030142ccc114fe81831a72e96a50f4c01c76f5410e5a4bdd3403910a23fe69681500209efd56cbe5f05cf20e7379e49dcef61940bbda94da905fbc49ee2f9f955b579000350016030104540b00045000044d00044a30820446308203afa003020102020900b4ffbc458a823a63300d06092a864886f70d01010405003081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572
EAP-Message = 0x204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e656475301e170d3035303730363133353630335a170d3135303730343133353630335a3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504
EAP-Message = 0x031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e65647530819f300d06092a864886f70d010101050003818d0030818902818100952a6e25e986e7297e0fe23d8ab71a410a827faeed95c076d4bb558f46790b556c13bb40cb082da6776bcad9d70c884d7f831dce00b984cc2c1818a744c529c21a9fb708244e09ef55c7edc2c063659d0ab8f2948bcf9e98c862460023c17a5ce91ed97429e6a79e2726c11c8acbbf109f12f4a8d8efcea365a5831944dc14250203010001a38201323082012e301d0603551d
EAP-Message = 0x0e04160414166b7bb5824d8888245b04f718d44f9d85d631783081fe0603551d230481f63081f38014166b7bb5824d8888245b04f718d44f9d85d63178a181cfa481cc3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d69
EAP-Message = 0x6e40736f7574687765737465726e2e656475820900b4
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xab124225e8f965bd03e617abbd82f8fa
Finished request 13
Going to the next request
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=218, length=149
User-Name = "\\test"
Framed-MTU = 1400
Called-Station-Id = "0014.691e.dee0"
Calling-Station-Id = "000e.35b5.eb8f"
Service-Type = Login-User
Message-Authenticator = 0x0e840d4a507bc45feebe4dd29d555499
EAP-Message = 0x020400061500
NAS-Port-Type = Wireless-802.11
NAS-Port = 5112
State = 0xab124225e8f965bd03e617abbd82f8fa
NAS-IP-Address = 192.168.1.249
NAS-Identifier = "freeradius1100"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 14
modcall[authorize]: module "preprocess" returns ok for request 14
radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
modcall[authorize]: module "auth_log" returns ok for request 14
modcall[authorize]: module "chap" returns noop for request 14
modcall[authorize]: module "mschap" returns noop for request 14
rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 14
rlm_eap: EAP packet type response id 4 length 6
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 14
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 14
modcall: group authorize returns updated for request 14
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 14
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
rlm_eap_tls: ack handshake fragment handler
eaptls_verify returned 1
eaptls_process returned 13
modcall[authenticate]: module "eap" returns handled for request 14
modcall: group authenticate returns handled for request 14
Sending Access-Challenge of id 218 to 192.168.1.249:1645
EAP-Message = 0x010500bb1580000004b1ffbc458a823a63300c0603551d13040530030101ff300d06092a864886f70d01010405000381810030b2ae584f5f190289bcf3451bc1d1bac6a0e9d7ad7d79857c1b68c4537677fc2cc9192f4e5a17b974bdbb514f94178847884da765e4b3f3e878e0d9083978cd799b434f25e6f7fa8047d6bef2f410919f2d54574a873f1adafb83a175ccc47d34c46113fbc80fa0942cc9b74fe4fbbfed0c632eea7a4ba04ab80913169a289216030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xbb33623ddc8707a12f36fa8892364757
Finished request 14
Going to the next request
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=219, length=160
User-Name = "\\test"
Framed-MTU = 1400
Called-Station-Id = "0014.691e.dee0"
Calling-Station-Id = "000e.35b5.eb8f"
Service-Type = Login-User
Message-Authenticator = 0xf394bff1a421b25724d257be2378166e
EAP-Message = 0x0205001115800000000715030100020230
NAS-Port-Type = Wireless-802.11
NAS-Port = 5112
State = 0xbb33623ddc8707a12f36fa8892364757
NAS-IP-Address = 192.168.1.249
NAS-Identifier = "freeradius1100"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 15
modcall[authorize]: module "preprocess" returns ok for request 15
radius_xlat: '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
modcall[authorize]: module "auth_log" returns ok for request 15
modcall[authorize]: module "chap" returns noop for request 15
modcall[authorize]: module "mschap" returns noop for request 15
rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 15
rlm_eap: EAP packet type response id 5 length 17
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 15
users: Matched entry DEFAULT at line 155
modcall[authorize]: module "files" returns ok for request 15
modcall: group authorize returns updated for request 15
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 15
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Length Included
eaptls_verify returned 11
rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca
TLS Alert read:fatal:unknown CA
TLS_accept:failed in SSLv3 read client certificate A
74089:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48
74089:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837:
rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails.
In SSL Handshake Phase
In SSL Accept mode
rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails.
eaptls_process returned 13
rlm_eap: Freeing handler
modcall[authenticate]: module "eap" returns reject for request 15
modcall: group authenticate returns reject for request 15
auth: Failed to validate the user.
Login incorrect: [\\test/<no User-Password attribute>] (from client Aironet1100 port 5112 cli 000e.35b5.eb8f)
Delaying request 15 for 1 seconds
Finished request 15
Going to the next request
Waking up in 4 seconds...
---
My questions are the following:
- I choose EAP-TTLS because the client needs no additional certificates,
and it works well under Windows as it does under Mac.
User-Name = "\\test"
Why am I seeing \\username, instead of just username? Does this
have something to do with "Roaming Profile"? If it does, how do
I disable roaming profile from within the XP 802.1x authentication
dialog. Can this be corrected with a better understanding of how
to strip usernames?
Using radtest generates a Request-Accept packet, working fine.
- I created my SSL cert using CA.pl (prior use was with CA.all).
I am using a self signed cert. Why do I see the following:
TLS Alert read:fatal:unknown CA
TLS_accept:failed in SSLv3 read client certificate A
74089:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48
74089:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837:
rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails.
In SSL Handshake Phase
In SSL Accept mode
Is there a way to disable the validation of a CA in the built-in
XP supplicant 802.1x authentication dialog? Is that what is causing
my problem, a non-trusted CA certificate?
Sincerely,
--johnk
----- End forwarded message -----
--
More information about the Freeradius-Users
mailing list