ntlm_auth - rlm_mschap: No User-Password configured. Cannot create NT-Password.
Peter de Groot
peter.de.groot at det.wa.edu.au
Fri Jul 14 02:46:08 CEST 2006
Please help ........ I cannot see the problem after a day of reading the
lists and googling... hopefully a fresh pair of eyes ????
I am trying to authorize to the network via an ntlm_auth lookup against
winbind using PEAP and MS-CHAP v2 etc etc
Doing an ntlm_auth on the command line returns success... but on my
radius server does not want to authenticate.
I am fairly sure I have the certificates ok ??
Samba is joined to the windows domain o.k.
I am trying to autheticate against a different domain that than the
samba server is joined to.. should be ok ??
[root at curric4182-05 raddb]# ntlm_auth --request-nt-key
--domain=admin4182 --username=e2052982
password:
NT_STATUS_OK: Success (0x0)
[root at curric4182-05 raddb]#
.
.
.
.
my "stuff" is
XP-SP2
Fedora Core 5
Samba 3.0.22-1
Freeradius 1.1.2
Windows 2003 Server AD
Cisco Aironet 1100 series
.
.
.
Error message is
modcall: entering group MS-CHAP for request 7
rlm_mschap: No User-Password configured. Cannot create LM-Password.
rlm_mschap: No User-Password configured. Cannot create NT-Password.
rlm_mschap: Told to do MS-CHAPv2 for e2052982 with NT-Password
radius_xlat: Running registered xlat function of module mschap for
string 'User-Name'
radius_xlat: Running registered xlat function of module mschap for
string 'NT-Domain'
radius_xlat: Running registered xlat function of module mschap for
string 'Challenge'
mschap2: d6
radius_xlat: Running registered xlat function of module mschap for
string 'NT-Response'
radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=e2052982
--domain=ADMIN4182 --challenge=7801a84637ef5c68
--nt-response=4f77faa8137d60ae186c5f910fea83f936dbd827ac54f757'
Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=e2052982
--domain=ADMIN4182 --challenge=7801a84637ef5c68
--nt-response=4f77faa8137d60ae186c5f910fea83f936dbd827ac54f757
Exec-Program output: Logon failure (0xc000006d)
Exec-Program-Wait: plaintext: Logon failure (0xc000006d)
Exec-Program: returned: 1
rlm_mschap: External script failed.
rlm_mschap: FAILED: MS-CHAP2-Response is incorrect
modcall[authenticate]: module "mschap" returns reject for request 7
.
.
.
radius -X dump follows .... sorry about the length .. trimmed after
first error.
TIA
Peter
Peter de Groot
Windows Re-Installation Engineer
Eastern Goldfields College
Ph 08) 90801800 Fax 08) 90801866 Mob 0418915312
http://egshs.wa.edu.au
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config: including file: /usr/local/etc/raddb/proxy.conf
Config: including file: /usr/local/etc/raddb/clients.conf
Config: including file: /usr/local/etc/raddb/snmp.conf
Config: including file: /usr/local/etc/raddb/eap.conf
Config: including file: /usr/local/etc/raddb/sql.conf
main: prefix = "/usr/local"
main: localstatedir = "/usr/local/var"
main: logdir = "/usr/local/var/log/radius"
main: libdir = "/usr/local/lib"
main: radacctdir = "/usr/local/var/log/radius/radacct"
main: hostname_lookups = no
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 0
main: allow_core_dumps = no
main: log_stripped_names = no
main: log_file = "/usr/local/var/log/radius/radius.log"
main: log_auth = no
main: log_auth_badpass = no
main: log_auth_goodpass = no
main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid"
main: user = "(null)"
main: group = "(null)"
main: usercollide = no
main: lower_user = "no"
main: lower_pass = "no"
main: nospace_user = "no"
main: nospace_pass = "no"
main: checkrad = "/usr/local/sbin/checkrad"
main: proxy_requests = yes
proxy: retry_delay = 5
proxy: retry_count = 3
proxy: synchronous = no
proxy: default_fallback = yes
proxy: dead_time = 120
proxy: post_proxy_authorize = no
proxy: wake_all_if_all_dead = no
security: max_attributes = 200
security: reject_delay = 1
security: status_server = no
main: debug_level = 0
read_config_files: reading dictionary
read_config_files: reading naslist
Using deprecated naslist file. Support for this will go away soon.
read_config_files: reading clients
read_config_files: reading realms
radiusd: entering modules setup
Module: Library search path is /usr/local/lib
Module: Loaded exec
exec: wait = yes
exec: program = "(null)"
exec: input_pairs = "request"
exec: output_pairs = "(null)"
exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded PAP
pap: encryption_scheme = "crypt"
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded MS-CHAP
mschap: use_mppe = yes
mschap: require_encryption = no
mschap: require_strong = no
mschap: with_ntdomain_hack = yes
mschap: passwd = "(null)"
mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
--username=%{mschap:User-Name} --domain=%{mschap:NT-Domain}
--challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}"
Module: Instantiated mschap (mschap)
Module: Loaded System
unix: cache = no
unix: passwd = "(null)"
unix: shadow = "(null)"
unix: group = "(null)"
unix: radwtmp = "/usr/local/var/log/radius/radwtmp"
unix: usegroup = no
unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded eap
eap: default_eap_type = "peap"
eap: timer_expire = 60
eap: ignore_unknown_eap_types = no
eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
gtc: challenge = "Password: "
gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
tls: rsa_key_exchange = no
tls: dh_key_exchange = yes
tls: rsa_key_length = 512
tls: dh_key_length = 512
tls: verify_depth = 0
tls: CA_path = "(null)"
tls: pem_file_type = yes
tls: private_key_file = "/usr/local/etc/raddb/certs/curric4182-05-cert.pem"
tls: certificate_file = "/usr/local/etc/raddb/certs/curric4182-05-cert.pem"
tls: CA_file = "/usr/local/etc/raddb/certs/EGC-cacert.pem"
tls: private_key_password = "blah-blahk"
tls: dh_file = "/usr/local/etc/raddb/certs/dh"
tls: random_file = "/dev/urandom"
tls: fragment_size = 1024
tls: include_length = yes
tls: check_crl = no
tls: check_cert_cn = "(null)"
tls: cipher_list = "(null)"
tls: check_cert_issuer = "(null)"
rlm_eap_tls: Loading the certificate file as a chain
rlm_eap: Loaded and initialized type tls
peap: default_eap_type = "mschapv2"
peap: copy_request_to_tunnel = no
peap: use_tunneled_reply = no
peap: proxy_tunneled_request_as_eap = yes
rlm_eap: Loaded and initialized type peap
mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups"
preprocess: hints = "/usr/local/etc/raddb/hints"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line = 23
preprocess: with_ntdomain_hack = no
preprocess: with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
realm: format = "suffix"
realm: delimiter = "@"
realm: ignore_default = no
realm: ignore_null = no
Module: Instantiated realm (suffix)
Module: Loaded files
files: usersfile = "/usr/local/etc/raddb/users"
files: acctusersfile = "/usr/local/etc/raddb/acct_users"
files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"
files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address,
Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
detail: detailfile =
"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename = "/usr/local/var/log/radius/radutmp"
radutmp: username = "%{User-Name}"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.
rad_recv: Access-Request packet from host 10.251.20.20:1645, id=236,
length=154
User-Name = "ADMIN4182\\e2052982"
Framed-MTU = 1400
Called-Station-Id = "0017.5aa1.9520"
Calling-Station-Id = "0011.5066.6e61"
Service-Type = Login-User
Message-Authenticator = 0xe11606b2cec3600fff69002a34d3c5ce
EAP-Message = 0x020200170141444d494e343138325c6532303532393832
NAS-Port-Type = Wireless-802.11
NAS-Port = 366
NAS-IP-Address = 10.251.20.20
NAS-Identifier = "EGC-AP1"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module "preprocess" returns ok for request 0
modcall[authorize]: module "chap" returns noop for request 0
modcall[authorize]: module "mschap" returns noop for request 0
rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up
realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 0
rlm_eap: EAP packet type response id 2 length 23
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 0
users: Matched entry DEFAULT at line 152
modcall[authorize]: module "files" returns ok for request 0
modcall: leaving group authorize (returns updated) for request 0
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
rlm_eap: EAP Identity
rlm_eap: processing type tls
rlm_eap_tls: Initiate
rlm_eap_tls: Start returned 1
modcall[authenticate]: module "eap" returns handled for request 0
modcall: leaving group authenticate (returns handled) for request 0
Sending Access-Challenge of id 236 to 10.251.20.20 port 1645
EAP-Message = 0x010300061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xd474c0e53a0b58913df6a8463f681310
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 10.251.20.20:1645, id=237,
length=229
User-Name = "ADMIN4182\\e2052982"
Framed-MTU = 1400
Called-Station-Id = "0017.5aa1.9520"
Calling-Station-Id = "0011.5066.6e61"
Service-Type = Login-User
Message-Authenticator = 0x08066899804ab07de6e77f4699f1aa83
EAP-Message =
0x0203005019800000004616030100410100003d030144b60c0f0ad558b9ba802bc7e5262d89eef41c42b99e1b2586f2674e6c13b4d200001600040005000a000900640062000300060013001200630100
NAS-Port-Type = Wireless-802.11
NAS-Port = 366
State = 0xd474c0e53a0b58913df6a8463f681310
NAS-IP-Address = 10.251.20.20
NAS-Identifier = "EGC-AP1"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
modcall[authorize]: module "preprocess" returns ok for request 1
modcall[authorize]: module "chap" returns noop for request 1
modcall[authorize]: module "mschap" returns noop for request 1
rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up
realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 1
rlm_eap: EAP packet type response id 3 length 80
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 1
users: Matched entry DEFAULT at line 152
modcall[authorize]: module "files" returns ok for request 1
modcall: leaving group authorize (returns updated) for request 1
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 1
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Length Included
eaptls_verify returned 11
(other): before/accept initialization
TLS_accept: before/accept initialization
rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello
TLS_accept: SSLv3 read client hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello
TLS_accept: SSLv3 write server hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0927], Certificate
TLS_accept: SSLv3 write certificate A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
TLS_accept: SSLv3 write server done A
TLS_accept: SSLv3 flush data
TLS_accept:error in SSLv3 read client certificate A
rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0)
In SSL Handshake Phase
In SSL Accept mode
eaptls_process returned 13
rlm_eap_peap: EAPTLS_HANDLED
modcall[authenticate]: module "eap" returns handled for request 1
modcall: leaving group authenticate (returns handled) for request 1
Sending Access-Challenge of id 237 to 10.251.20.20 port 1645
EAP-Message =
0x0104040a19c000000984160301004a02000046030144b60c6efb4a889fffbb7a1040fa321fed2f98d15922ba81f97720e9bf91222320e869084b36650b68cdb4f4448d3065f4c7e377e45b0a954fb72ee565850327fc00040016030109270b0009230009200004a33082049f30820408a003020102020101300d06092a864886f70d01010505003081ab310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20476f6c646669656c647320436f6c6c656765310b3009060355040b13024954310c30
EAP-Message =
0x0a06035504031303454743312b302906092a864886f70d010901161c70657465722e64652e67726f6f74406465742e77612e6564752e6175301e170d3036303731333036313435305a170d3037303731333036313435305a3081ba310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20476f6c646669656c647320436f6c6c656765310b3009060355040b13024954311630140603550403130d637572726963343138322d30353130302e06092a864886f70d0109011621637572726963343138
EAP-Message =
0x322d30352e637572726963343138322e696e7465726e616c30819f300d06092a864886f70d010101050003818d0030818902818100bcf987fa92038c5aa5258da59449a17ec88d0f6e74cd57a6a60d164878cd19cc41114bb9219fc9589b596dfc8bd29dcfad5a07dbb902ed55e4aacabb896bb66fa7e4cd8a91a59a4da8ce7fde59da64a5b41a847ce049a84434f7ff66c82131d483823a6fcc75e87c4bf0ac50afe9ce76fc31c249377e588cf0e8a600873119490203010001a38201c0308201bc30090603551d1304023000301106096086480186f8420101040403020640302b06096086480186f842010d041e161c54696e7943412047656e6572
EAP-Message =
0x61746564204365727469666963617465301d0603551d0e0416041401407fe6428a641a57e2635f01914af69a50b8673081e00603551d230481d83081d58014c4425cf4ef64fc9ccb4fd2bcf3e4d1807424c623a181b1a481ae3081ab310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20476f6c646669656c647320436f6c6c656765310b3009060355040b13024954310c300a06035504031303454743312b302906092a864886f70d010901161c70657465722e64652e67726f6f7440646574
EAP-Message = 0x2e77612e6564752e617582090093e8cb38c994b33630
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xcb5b324f80946972d9dc9a23642def96
Finished request 1
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 10.251.20.20:1645, id=238,
length=155
User-Name = "ADMIN4182\\e2052982"
Framed-MTU = 1400
Called-Station-Id = "0017.5aa1.9520"
Calling-Station-Id = "0011.5066.6e61"
Service-Type = Login-User
Message-Authenticator = 0xd2bcd6f014b60cf655218dedefae808e
EAP-Message = 0x020400061900
NAS-Port-Type = Wireless-802.11
NAS-Port = 366
State = 0xcb5b324f80946972d9dc9a23642def96
NAS-IP-Address = 10.251.20.20
NAS-Identifier = "EGC-AP1"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 2
modcall[authorize]: module "preprocess" returns ok for request 2
modcall[authorize]: module "chap" returns noop for request 2
modcall[authorize]: module "mschap" returns noop for request 2
rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up
realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 2
rlm_eap: EAP packet type response id 4 length 6
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 2
users: Matched entry DEFAULT at line 152
modcall[authorize]: module "files" returns ok for request 2
modcall: leaving group authorize (returns updated) for request 2
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 2
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
rlm_eap_tls: ack handshake fragment handler
eaptls_verify returned 1
eaptls_process returned 13
rlm_eap_peap: EAPTLS_HANDLED
modcall[authenticate]: module "eap" returns handled for request 2
modcall: leaving group authenticate (returns handled) for request 2
Sending Access-Challenge of id 238 to 10.251.20.20 port 1645
EAP-Message =
0x010504061940270603551d120420301e811c70657465722e64652e67726f6f74406465742e77612e6564752e6175302c0603551d11042530238121637572726963343138322d30352e637572726963343138322e696e7465726e616c30160603551d250101ff040c300a06082b06010505070301300d06092a864886f70d0101050500038181000c02343214413546cb4ab2027fd6af5df023ed1ce47222a67e973b312e935480866898ca3c2fe7709e8e7ba889fc55f7738f6ecc80a6bf2821c11a5a479cc2a790415b7566d94bf95f9216f8026f130b5a6f6fe447aab9728363e57b9feb4dbf189615446f7265b702016e117cfc8cb03640cb1f2f0d
EAP-Message =
0xb6aa78b4dddd66df23a900047730820473308203dca00302010202090093e8cb38c994b336300d06092a864886f70d01010505003081ab310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20476f6c646669656c647320436f6c6c656765310b3009060355040b13024954310c300a06035504031303454743312b302906092a864886f70d010901161c70657465722e64652e67726f6f74406465742e77612e6564752e6175301e170d3036303731333036313234395a170d3136303731303036
EAP-Message =
0x313234395a3081ab310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20476f6c646669656c647320436f6c6c656765310b3009060355040b13024954310c300a06035504031303454743312b302906092a864886f70d010901161c70657465722e64652e67726f6f74406465742e77612e6564752e617530819f300d06092a864886f70d010101050003818d0030818902818100a67e2366b0427ae2c7dab4cef1a303895c9f5ecaecf41dca705e1ae01dc9fa60866dbc7b1727ed2394fb4b02cc
EAP-Message =
0x25398c9720c8f8db1e9d1ab70b224e334bc05346153a021b51fd929b073823b12fec849c442b0ca0ccfe0c691f992369d959f24435e04f657ff3ff023ba0adc554dabca8106ea86298892463f0ff3c1be161510203010001a382019b30820197301d0603551d0e04160414c4425cf4ef64fc9ccb4fd2bcf3e4d1807424c6233081e00603551d230481d83081d58014c4425cf4ef64fc9ccb4fd2bcf3e4d1807424c623a181b1a481ae3081ab310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20
EAP-Message = 0x476f6c646669656c647320436f6c6c656765
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xf469ad941f526e94ec1351410d1ff22c
Finished request 2
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 10.251.20.20:1645, id=239,
length=155
User-Name = "ADMIN4182\\e2052982"
Framed-MTU = 1400
Called-Station-Id = "0017.5aa1.9520"
Calling-Station-Id = "0011.5066.6e61"
Service-Type = Login-User
Message-Authenticator = 0x299168c635a6458965c93d093b864675
EAP-Message = 0x020500061900
NAS-Port-Type = Wireless-802.11
NAS-Port = 366
State = 0xf469ad941f526e94ec1351410d1ff22c
NAS-IP-Address = 10.251.20.20
NAS-Identifier = "EGC-AP1"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 3
modcall[authorize]: module "preprocess" returns ok for request 3
modcall[authorize]: module "chap" returns noop for request 3
modcall[authorize]: module "mschap" returns noop for request 3
rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up
realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 3
rlm_eap: EAP packet type response id 5 length 6
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 3
users: Matched entry DEFAULT at line 152
modcall[authorize]: module "files" returns ok for request 3
modcall: leaving group authorize (returns updated) for request 3
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 3
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
rlm_eap_tls: ack handshake fragment handler
eaptls_verify returned 1
eaptls_process returned 13
rlm_eap_peap: EAPTLS_HANDLED
modcall[authenticate]: module "eap" returns handled for request 3
modcall: leaving group authenticate (returns handled) for request 3
Sending Access-Challenge of id 239 to 10.251.20.20 port 1645
EAP-Message =
0x0106018a1900310b3009060355040b13024954310c300a06035504031303454743312b302906092a864886f70d010901161c70657465722e64652e67726f6f74406465742e77612e6564752e617582090093e8cb38c994b336300f0603551d130101ff040530030101ff301106096086480186f842010104040302010630090603551d1204023000302b06096086480186f842010d041e161c54696e7943412047656e65726174656420436572746966696361746530270603551d110420301e811c70657465722e64652e67726f6f74406465742e77612e6564752e6175300e0603551d0f0101ff040403020106300d06092a864886f70d0101050500
EAP-Message =
0x03818100798ce3529751d1c0f5255a9ad4e083fe1748a50b633ed1f7cf22e644900e6eba42faae43d7476f486949d0169bda6336338a223b8a529af38c2b4118e933a7ddcda9560b47aaa7ef684b3cd850f961d6f2a75c2fb608dc5dbf49f24f0e6ab33c875ec6df3cccf92177beff8374764aa9d32d59917cbfd0a772295c6165d37bd716030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x834ab11b4b0532b9f3d7d32909e2f097
Finished request 3
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 10.251.20.20:1645, id=240,
length=341
User-Name = "ADMIN4182\\e2052982"
Framed-MTU = 1400
Called-Station-Id = "0017.5aa1.9520"
Calling-Station-Id = "0011.5066.6e61"
Service-Type = Login-User
Message-Authenticator = 0x11c2e6a099432e32221ecf243b2c342e
EAP-Message =
0x020600c01980000000b6160301008610000082008068ea556a9d5bcff59d96209d732af9caba7c63c152206d7199be1a1b8723bde99b893065593eab9245bf98d712fbab31dc2aa5c2263bfa02bac2cbba65fe22b052bda4ce12163f452d40f88a927b37332c1d46081ae1255645b054d1e84761a15b75a1d3d3232a3d022625bed50921834c664db630a1f477ed7e35fa481cf96e1403010001011603010020e0786671da68ad577ac671807db1b1e35e0dd5e202baf00b0a9b9b30399b8200
NAS-Port-Type = Wireless-802.11
NAS-Port = 366
State = 0x834ab11b4b0532b9f3d7d32909e2f097
NAS-IP-Address = 10.251.20.20
NAS-Identifier = "EGC-AP1"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 4
modcall[authorize]: module "preprocess" returns ok for request 4
modcall[authorize]: module "chap" returns noop for request 4
modcall[authorize]: module "mschap" returns noop for request 4
rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up
realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 4
rlm_eap: EAP packet type response id 6 length 192
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 4
users: Matched entry DEFAULT at line 152
modcall[authorize]: module "files" returns ok for request 4
modcall: leaving group authorize (returns updated) for request 4
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 4
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Length Included
eaptls_verify returned 11
rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange
TLS_accept: SSLv3 read client key exchange A
rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001]
rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished
TLS_accept: SSLv3 read finished A
rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001]
TLS_accept: SSLv3 write change cipher spec A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished
TLS_accept: SSLv3 write finished A
TLS_accept: SSLv3 flush data
(other): SSL negotiation finished successfully
rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0)
SSL Connection Established
eaptls_process returned 13
rlm_eap_peap: EAPTLS_HANDLED
modcall[authenticate]: module "eap" returns handled for request 4
modcall: leaving group authenticate (returns handled) for request 4
Sending Access-Challenge of id 240 to 10.251.20.20 port 1645
EAP-Message =
0x0107003119001403010001011603010020931e9dc13b975a6087224dba25c64077e2ad548c12975f883faa74b60b0bda93
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x4f1d96b5b26ae63457b22012f66e7fad
Finished request 4
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 10.251.20.20:1645, id=241,
length=155
User-Name = "ADMIN4182\\e2052982"
Framed-MTU = 1400
Called-Station-Id = "0017.5aa1.9520"
Calling-Station-Id = "0011.5066.6e61"
Service-Type = Login-User
Message-Authenticator = 0x032b0a3a7ca860bc528ba8041fcb2485
EAP-Message = 0x020700061900
NAS-Port-Type = Wireless-802.11
NAS-Port = 366
State = 0x4f1d96b5b26ae63457b22012f66e7fad
NAS-IP-Address = 10.251.20.20
NAS-Identifier = "EGC-AP1"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 5
modcall[authorize]: module "preprocess" returns ok for request 5
modcall[authorize]: module "chap" returns noop for request 5
modcall[authorize]: module "mschap" returns noop for request 5
rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up
realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 5
rlm_eap: EAP packet type response id 7 length 6
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 5
users: Matched entry DEFAULT at line 152
modcall[authorize]: module "files" returns ok for request 5
modcall: leaving group authorize (returns updated) for request 5
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 5
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
rlm_eap_tls: ack handshake is finished
eaptls_verify returned 3
eaptls_process returned 3
rlm_eap_peap: EAPTLS_SUCCESS
modcall[authenticate]: module "eap" returns handled for request 5
modcall: leaving group authenticate (returns handled) for request 5
Sending Access-Challenge of id 241 to 10.251.20.20 port 1645
EAP-Message =
0x01080020190017030100156d61b9bad1cd18772d3a5bc4d047f8edd052218d92
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8db2c26675d6c8643212f191f157aa61
Finished request 5
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 10.251.20.20:1645, id=242,
length=195
User-Name = "ADMIN4182\\e2052982"
Framed-MTU = 1400
Called-Station-Id = "0017.5aa1.9520"
Calling-Station-Id = "0011.5066.6e61"
Service-Type = Login-User
Message-Authenticator = 0xd5a8bdda87761e1572459a716f6d98d8
EAP-Message =
0x0208002e19001703010023141a817d827fa5e32dd020ac8a82e5874da2e7b6a35a0a432fa6f07ecd70ccc98942a7
NAS-Port-Type = Wireless-802.11
NAS-Port = 366
State = 0x8db2c26675d6c8643212f191f157aa61
NAS-IP-Address = 10.251.20.20
NAS-Identifier = "EGC-AP1"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 6
modcall[authorize]: module "preprocess" returns ok for request 6
modcall[authorize]: module "chap" returns noop for request 6
modcall[authorize]: module "mschap" returns noop for request 6
rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up
realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 6
rlm_eap: EAP packet type response id 8 length 46
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 6
users: Matched entry DEFAULT at line 152
modcall[authorize]: module "files" returns ok for request 6
modcall: leaving group authorize (returns updated) for request 6
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 6
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
eaptls_process returned 7
rlm_eap_peap: EAPTLS_OK
rlm_eap_peap: Session established. Decoding tunneled attributes.
rlm_eap_peap: Identity - ADMIN4182\e2052982
rlm_eap_peap: Tunneled data is valid.
PEAP: Got tunneled identity of ADMIN4182\e2052982
PEAP: Setting default EAP type for tunneled EAP session.
PEAP: Setting User-Name to ADMIN4182\e2052982
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 6
modcall[authorize]: module "preprocess" returns ok for request 6
modcall[authorize]: module "chap" returns noop for request 6
modcall[authorize]: module "mschap" returns noop for request 6
rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up
realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 6
rlm_eap: EAP packet type response id 8 length 23
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 6
users: Matched entry DEFAULT at line 152
modcall[authorize]: module "files" returns ok for request 6
modcall: leaving group authorize (returns updated) for request 6
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 6
rlm_eap: EAP Identity
rlm_eap: processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
modcall[authenticate]: module "eap" returns handled for request 6
modcall: leaving group authenticate (returns handled) for request 6
PEAP: Got tunneled Access-Challenge
modcall[authenticate]: module "eap" returns handled for request 6
modcall: leaving group authenticate (returns handled) for request 6
Sending Access-Challenge of id 242 to 10.251.20.20 port 1645
EAP-Message =
0x01090043190017030100387d28ca432366b4c61627e8742dbb54a2458802449ee7d043cee54f7eb37e93b0955ba755da5aad5b9017551c02f8999c9ea8c49246b6efe7
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xefa5735fb3f5cab0b3b468b08df9b103
Finished request 6
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 10.251.20.20:1645, id=243,
length=249
User-Name = "ADMIN4182\\e2052982"
Framed-MTU = 1400
Called-Station-Id = "0017.5aa1.9520"
Calling-Station-Id = "0011.5066.6e61"
Service-Type = Login-User
Message-Authenticator = 0xd750ebb3d82173907aa54efb998772f0
EAP-Message =
0x0209006419001703010059e30c5f2d9def3e92ee697f3a3368ccf2c1637832a6b78bf9323db95a014d9b5f34bf64f8c9ce48c0f6ba94251fd4c35a8e40ed06e5be206baeef83a40b311e0647348acebbf588ac25b4ee4f2382dc59066fea3516f94cf09f
NAS-Port-Type = Wireless-802.11
NAS-Port = 366
State = 0xefa5735fb3f5cab0b3b468b08df9b103
NAS-IP-Address = 10.251.20.20
NAS-Identifier = "EGC-AP1"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 7
modcall[authorize]: module "preprocess" returns ok for request 7
modcall[authorize]: module "chap" returns noop for request 7
modcall[authorize]: module "mschap" returns noop for request 7
rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up
realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 7
rlm_eap: EAP packet type response id 9 length 100
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 7
users: Matched entry DEFAULT at line 152
modcall[authorize]: module "files" returns ok for request 7
modcall: leaving group authorize (returns updated) for request 7
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 7
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
eaptls_process returned 7
rlm_eap_peap: EAPTLS_OK
rlm_eap_peap: Session established. Decoding tunneled attributes.
rlm_eap_peap: EAP type mschapv2
rlm_eap_peap: Tunneled data is valid.
PEAP: Setting User-Name to ADMIN4182\e2052982
PEAP: Adding old state with 5d 21
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 7
modcall[authorize]: module "preprocess" returns ok for request 7
modcall[authorize]: module "chap" returns noop for request 7
modcall[authorize]: module "mschap" returns noop for request 7
rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up
realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 7
rlm_eap: EAP packet type response id 9 length 77
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 7
users: Matched entry DEFAULT at line 152
modcall[authorize]: module "files" returns ok for request 7
modcall: leaving group authorize (returns updated) for request 7
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 7
rlm_eap: Request found, released from the list
rlm_eap: EAP/mschapv2
rlm_eap: processing type mschapv2
Processing the authenticate section of radiusd.conf
modcall: entering group MS-CHAP for request 7
rlm_mschap: No User-Password configured. Cannot create LM-Password.
rlm_mschap: No User-Password configured. Cannot create NT-Password.
rlm_mschap: Told to do MS-CHAPv2 for e2052982 with NT-Password
radius_xlat: Running registered xlat function of module mschap for
string 'User-Name'
radius_xlat: Running registered xlat function of module mschap for
string 'NT-Domain'
radius_xlat: Running registered xlat function of module mschap for
string 'Challenge'
mschap2: d6
radius_xlat: Running registered xlat function of module mschap for
string 'NT-Response'
radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=e2052982
--domain=ADMIN4182 --challenge=7801a84637ef5c68
--nt-response=4f77faa8137d60ae186c5f910fea83f936dbd827ac54f757'
Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=e2052982
--domain=ADMIN4182 --challenge=7801a84637ef5c68
--nt-response=4f77faa8137d60ae186c5f910fea83f936dbd827ac54f757
Exec-Program output: Logon failure (0xc000006d)
Exec-Program-Wait: plaintext: Logon failure (0xc000006d)
Exec-Program: returned: 1
rlm_mschap: External script failed.
rlm_mschap: FAILED: MS-CHAP2-Response is incorrect
modcall[authenticate]: module "mschap" returns reject for request 7
modcall: leaving group MS-CHAP (returns reject) for request 7
rlm_eap: Freeing handler
modcall[authenticate]: module "eap" returns reject for request 7
modcall: leaving group authenticate (returns reject) for request 7
auth: Failed to validate the user.
PEAP: Tunneled authentication was rejected.
rlm_eap_peap: FAILURE
modcall[authenticate]: module "eap" returns handled for request 7
modcall: leaving group authenticate (returns handled) for request 7
Sending Access-Challenge of id 243 to 10.251.20.20 port 1645
EAP-Message =
0x010a00261900170301001b592ffa55de5d78f799afd27bcf5bbeda4180630d0a453e5b1433eb
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x9fae1d986c18c5f2cdbabbfbfe4796ce
Finished request 7
Going to the next request
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 10.251.20.20:1645, id=244,
length=187
User-Name = "ADMIN4182\\e2052982"
Framed-MTU = 1400
Called-Station-Id = "0017.5aa1.9520"
Calling-Station-Id = "0011.5066.6e61"
Service-Type = Login-User
Peter de Groot
Windows Re-Installation Engineer
Eastern Goldfields College
Ph 08) 90801800 Fax 08) 90801866 Mob 0418915312
http://egshs.wa.edu.au
More information about the Freeradius-Users
mailing list