<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman,new york,times,serif;font-size:12pt"><div>Hello <br><br>I would like to authenticate my Windows XP wireless users with freeradius against a AD. Test with the local ntlm_auth against the AD worked fine as well radtest with a local user in the users file.<br><br>It seems to me that Problem ist somewhere here:<br><br>Found Auth-Type = EAP<br>+- entering group authenticate {...}<br>[eap] Request found, released from the list<br>[eap] EAP/mschapv2<br>[eap] processing type mschapv2<br>rlm_eap_mschapv2: Invalid response type 4<br>[eap] Handler failed in EAP/mschapv2<br>[eap] Failed in EAP select<br>++[eap] returns invalid<br>Failed to authenticate the user. <br><br>I have read in the archive that "Code 4 is MS-CHAP failure. It means that the client told the server
<br>it didn't like the previous packet"<br><br>But I have no idea what the server does not like.<br>The whole debug output is below<br>Any help it greatliy appreciated<br><br>regards<br><br>stefan<br><br><br>FreeRADIUS Version 2.1.0, for host i486-pc-linux-gnu, built on Sep 2 2009 at 13:59:26<br>Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. <br>There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A <br>PARTICULAR PURPOSE. <br>You may redistribute copies of FreeRADIUS under the terms of the <br>GNU General Public License v2. <br>Starting - reading configuration files ...<br>including configuration file /etc/freeradius/radiusd.conf<br>including configuration file /etc/freeradius/proxy.conf<br>including configuration file /etc/freeradius/clients.conf<br>including files in directory /etc/freeradius/modules/<br>including configuration file /etc/freeradius/modules/sql_log<br>including configuration file
/etc/freeradius/modules/ldap<br>including configuration file /etc/freeradius/modules/logintime<br>including configuration file /etc/freeradius/modules/ippool<br>including configuration file /etc/freeradius/modules/preprocess<br>including configuration file /etc/freeradius/modules/expr<br>including configuration file /etc/freeradius/modules/chap<br>including configuration file /etc/freeradius/modules/detail<br>including configuration file /etc/freeradius/modules/policy<br>including configuration file /etc/freeradius/modules/smbpasswd<br>including configuration file /etc/freeradius/modules/etc_group<br>including configuration file /etc/freeradius/modules/attr_filter<br>including configuration file /etc/freeradius/modules/detail.log<br>including configuration file /etc/freeradius/modules/always<br>including configuration file /etc/freeradius/modules/passwd<br>including configuration file /etc/freeradius/modules/counter<br>including configuration file
/etc/freeradius/modules/realm<br>including configuration file /etc/freeradius/modules/mac2vlan<br>including configuration file /etc/freeradius/modules/digest<br>including configuration file /etc/freeradius/modules/files<br>including configuration file /etc/freeradius/modules/sradutmp<br>including configuration file /etc/freeradius/modules/checkval<br>including configuration file /etc/freeradius/modules/radutmp<br>including configuration file /etc/freeradius/modules/inner-eap<br>including configuration file /etc/freeradius/modules/unix<br>including configuration file /etc/freeradius/modules/detail.example.com<br>including configuration file /etc/freeradius/modules/acct_unique<br>including configuration file /etc/freeradius/modules/attr_rewrite<br>including configuration file /etc/freeradius/modules/mac2ip<br>including configuration file /etc/freeradius/modules/wimax<br>including configuration file /etc/freeradius/modules/pap<br>including configuration
file /etc/freeradius/modules/echo<br>including configuration file /etc/freeradius/modules/expiration<br>including configuration file /etc/freeradius/modules/krb5<br>including configuration file /etc/freeradius/modules/pam<br>including configuration file /etc/freeradius/modules/linelog<br>including configuration file /etc/freeradius/modules/exec<br>including configuration file /etc/freeradius/modules/mschap<br>including configuration file /etc/freeradius/eap.conf<br>including configuration file /etc/freeradius/policy.conf<br>including files in directory /etc/freeradius/sites-enabled/<br>including configuration file /etc/freeradius/sites-enabled/default<br>including configuration file /etc/freeradius/sites-enabled/inner-tunnel<br>group = freerad<br>user = freerad<br>including dictionary file /etc/freeradius/dictionary<br>main {<br> prefix = "/usr"<br> localstatedir = "/var"<br> logdir =
"/var/log/freeradius"<br> libdir = "/usr/lib/freeradius"<br> radacctdir = "/var/log/freeradius/radacct"<br> hostname_lookups = no<br> max_request_time = 30<br> cleanup_delay = 5<br> max_requests = 1024<br> allow_core_dumps = no<br> pidfile = "/var/run/freeradius/freeradius.pid"<br> checkrad = "/usr/sbin/checkrad"<br> debug_level = 0<br> proxy_requests = yes<br> log {<br> stripped_names = no<br> auth = no<br> auth_badpass = no<br> auth_goodpass = no<br> }<br> security {<br> max_attributes = 200<br> reject_delay = 1<br> status_server = yes<br> }<br>}<br> client localhost {<br> ipaddr =
127.0.0.1<br> require_message_authenticator = no<br> secret = "testing123-1"<br> shortname = "localhost"<br> nastype = "other"<br> }<br> client 10.0.0.1 {<br> require_message_authenticator = no<br> secret = "testing123-1"<br> shortname = "wireless"<br> nastype = "others"<br> }<br>radiusd: #### Loading Realms and Home Servers ####<br> proxy server {<br> retry_delay = 5<br> retry_count = 3<br> default_fallback = no<br> dead_time = 120<br> wake_all_if_all_dead = no<br> }<br> home_server localhost {<br> ipaddr = 127.0.0.1<br> port = 1812<br> type = "auth"<br> secret = "testing123"<br> response_window =
20<br> max_outstanding = 65536<br> zombie_period = 40<br> status_check = "status-server"<br> ping_interval = 30<br> check_interval = 30<br> num_answers_to_alive = 3<br> num_pings_to_alive = 3<br> revive_interval = 120<br> status_check_timeout = 4<br> }<br> home_server_pool my_auth_failover {<br> type = fail-over<br> home_server = localhost<br> }<br> realm example.com {<br> auth_pool = my_auth_failover<br> }<br> realm LOCAL {<br> }<br>radiusd: #### Instantiating modules ####<br> instantiate {<br> Module: Linked to module rlm_exec<br> Module: Instantiating exec<br> exec {<br> wait = no<br> input_pairs = "request"<br> shell_escape =
yes<br> }<br> Module: Linked to module rlm_expr<br> Module: Instantiating expr<br> Module: Linked to module rlm_expiration<br> Module: Instantiating expiration<br> expiration {<br> reply-message = "Password Has Expired "<br> }<br> Module: Linked to module rlm_logintime<br> Module: Instantiating logintime<br> logintime {<br> reply-message = "You are calling outside your allowed timespan "<br> minimum-timeout = 60<br> }<br> }<br>radiusd: #### Loading Virtual Servers ####<br>server inner-tunnel {<br> modules {<br> Module: Checking authenticate {...} for more modules to load<br> Module: Linked to module rlm_pap<br> Module: Instantiating pap<br> pap {<br> encryption_scheme = "auto"<br> auto_header = no<br> }<br> Module: Linked to module
rlm_chap<br> Module: Instantiating chap<br> Module: Linked to module rlm_mschap<br> Module: Instantiating mschap<br> mschap {<br> use_mppe = no<br> require_encryption = yes<br> require_strong = yes<br> with_ntdomain_hack = yes<br> ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-mydomain:-mydomain} --username=%{mschap:User-Name:-None} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"<br> }<br> Module: Linked to module rlm_unix<br> Module: Instantiating unix<br> unix {<br> radwtmp = "/var/log/freeradius/radwtmp"<br> }<br> Module: Linked to module rlm_eap<br> Module: Instantiating eap<br> eap {<br> default_eap_type = "peap"<br> timer_expire = 60<br> ignore_unknown_eap_types =
no<br> cisco_accounting_username_bug = no<br> max_sessions = 2048<br> }<br> Module: Linked to sub-module rlm_eap_tls<br> Module: Instantiating eap-tls<br> tls {<br> rsa_key_exchange = no<br> dh_key_exchange = yes<br> rsa_key_length = 512<br> dh_key_length = 512<br> verify_depth = 0<br> pem_file_type = yes<br> private_key_file = "/etc/freeradius/certs/demoCA/nzzwire01-0.key"<br> certificate_file = "/etc/freeradius/certs/demoCA/nzzwire01-0.crt"<br> CA_file = "/etc/freeradius/certs/demoCA/CA_cert.crt"<br> private_key_password = "WireKey*!4"<br> dh_file = "/etc/freeradius/certs/dh"<br> random_file = "/etc/freeradius/certs/random"<br> fragment_size =
1024<br> include_length = yes<br> check_crl = no<br> cipher_list = "DEFAULT"<br> cache {<br> enable = no<br> lifetime = 24<br> max_entries = 255<br> }<br> }<br> Module: Linked to sub-module rlm_eap_peap<br> Module: Instantiating eap-peap<br> peap {<br> default_eap_type = "mschapv2"<br> copy_request_to_tunnel = yes<br> use_tunneled_reply = no<br> proxy_tunneled_request_as_eap = no<br> virtual_server = "inner-tunnel"<br> }<br> Module: Linked to sub-module rlm_eap_mschapv2<br> Module: Instantiating eap-mschapv2<br> mschapv2 {<br> with_ntdomain_hack = no<br> }<br> Module: Checking authorize {...} for more modules to
load<br> Module: Linked to module rlm_realm<br> Module: Instantiating suffix<br> realm suffix {<br> format = "suffix"<br> delimiter = "@"<br> ignore_default = no<br> ignore_null = no<br> }<br> Module: Linked to module rlm_files<br> Module: Instantiating files<br> files {<br> usersfile = "/etc/freeradius/users"<br> acctusersfile = "/etc/freeradius/acct_users"<br> preproxy_usersfile = "/etc/freeradius/preproxy_users"<br> compat = "no"<br> }<br> Module: Checking session {...} for more modules to load<br> Module: Linked to module rlm_radutmp<br> Module: Instantiating radutmp<br> radutmp {<br> filename = "/var/log/freeradius/radutmp"<br> username = "%{User-Name}"<br> case_sensitive =
yes<br> check_with_nas = yes<br> perm = 384<br> callerid = yes<br> }<br> Module: Checking post-proxy {...} for more modules to load<br> Module: Checking post-auth {...} for more modules to load<br> Module: Linked to module rlm_attr_filter<br> Module: Instantiating attr_filter.access_reject<br> attr_filter attr_filter.access_reject {<br> attrsfile = "/etc/freeradius/attrs.access_reject"<br> key = "%{User-Name}"<br> }<br> }<br>}<br> modules {<br> Module: Checking authenticate {...} for more modules to load<br> Module: Checking authorize {...} for more modules to load<br> Module: Linked to module rlm_preprocess<br> Module: Instantiating preprocess<br> preprocess {<br> huntgroups = "/etc/freeradius/huntgroups"<br> hints =
"/etc/freeradius/hints"<br> with_ascend_hack = no<br> ascend_channels_per_line = 23<br> with_ntdomain_hack = no<br> with_specialix_jetstream_hack = no<br> with_cisco_vsa_hack = no<br> with_alvarion_vsa_hack = no<br> }<br> Module: Checking preacct {...} for more modules to load<br> Module: Linked to module rlm_acct_unique<br> Module: Instantiating acct_unique<br> acct_unique {<br> key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"<br> }<br> Module: Checking accounting {...} for more modules to load<br> Module: Linked to module rlm_detail<br> Module: Instantiating detail<br> detail {<br> detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d"<br> header = "%t"<br> detailperm
= 384<br> dirperm = 493<br> locking = no<br> log_packet_header = no<br> }<br> Module: Instantiating attr_filter.accounting_response<br> attr_filter attr_filter.accounting_response {<br> attrsfile = "/etc/freeradius/attrs.accounting_response"<br> key = "%{User-Name}"<br> }<br> Module: Checking session {...} for more modules to load<br> Module: Checking post-proxy {...} for more modules to load<br> Module: Checking post-auth {...} for more modules to load<br> }<br>radiusd: #### Opening IP addresses and Ports ####<br>listen {<br> type = "auth"<br> ipaddr = *<br> port = 0<br>}<br>listen {<br> type = "acct"<br> ipaddr = *<br> port = 0<br>}<br>Listening on authentication address * port 1812<br>Listening on accounting
address * port 1813<br>Listening on proxy address * port 1814<br>Ready to process requests.<br>rad_recv: Access-Request packet from host 10.0.0.1 port 1645, id=104, length=145<br> User-Name = "mydomain\\user"<br> Framed-MTU = 1400<br> Called-Station-Id = "000d.2868.4801"<br> Calling-Station-Id = "000e.3560.3e95"<br> Service-Type = Login-User<br> Message-Authenticator = 0xa1f051e8488f5a50cb044187a8c4c674<br> EAP-Message = 0x02010010015a4830315c532e486f747a<br> NAS-Port-Type = Wireless-802.11<br> NAS-Port = 4392<br> NAS-IP-Address = 10.0.0.1<br> NAS-Identifier = "wireless"<br>+- entering group authorize {...}<br>++[preprocess] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br>[suffix] No '@' in User-Name = "mydomain\user", looking up realm
NULL<br>[suffix] No such realm "NULL"<br>++[suffix] returns noop<br>[eap] EAP packet type response id 1 length 16<br>[eap] No EAP Start, assuming it's an on-going EAP conversation<br>++[eap] returns updated<br>++[unix] returns notfound<br>++[files] returns noop<br>++[expiration] returns noop<br>++[logintime] returns noop<br>[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.<br>++[pap] returns noop<br>Found Auth-Type = EAP<br>+- entering group authenticate {...}<br>[eap] EAP Identity<br>[eap] processing type tls<br>[tls] Initiate<br>[tls] Start returned 1<br>++[eap] returns handled<br>Sending Access-Challenge of id 104 to 10.0.0.1 port 1645<br> EAP-Message = 0x010200061920<br> Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0x80e9682e80eb716d23cf4280d3865bd8<br>Finished request 0.<br>Going to the next request<br>Waking up
in 4.9 seconds.<br>rad_recv: Access-Request packet from host 10.0.0.1 port 1645, id=105, length=253<br> User-Name = "mydomain\\user"<br> Framed-MTU = 1400<br> Called-Station-Id = "000d.2868.4801"<br> Calling-Station-Id = "000e.3560.3e95"<br> Service-Type = Login-User<br> Message-Authenticator = 0x8ea63d676026bf116dc956f454e8088e<br> EAP-Message = 0x0202006a1900160301005f0100005b03014ab1f239fed58a9540ea7eeff0e2d184bfde52a76c671ae71e9ecf769581c7ff00003400390038003500160013000a00330032002f006600050004006500640063006200610060001500120009001400110008000600030100<br> NAS-Port-Type = Wireless-802.11<br> NAS-Port = 4392<br> State = 0x80e9682e80eb716d23cf4280d3865bd8<br> NAS-IP-Address = 10.0.0.1<br> NAS-Identifier = "wireless"<br>+- entering group
authorize {...}<br>++[preprocess] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br>[suffix] No '@' in User-Name = "mydomain\user", looking up realm NULL<br>[suffix] No such realm "NULL"<br>++[suffix] returns noop<br>[eap] EAP packet type response id 2 length 106<br>[eap] Continuing tunnel setup.<br>++[eap] returns ok<br>Found Auth-Type = EAP<br>+- entering group authenticate {...}<br>[eap] Request found, released from the list<br>[eap] EAP/peap<br>[eap] processing type peap<br>[peap] processing EAP-TLS<br>[peap] eaptls_verify returned 7 <br>[peap] Done initial handshake<br>[peap] (other): before/accept initialization <br>[peap] TLS_accept: before/accept initialization <br>[peap] <<< TLS 1.0 Handshake [length 005f], ClientHello <br>[peap] TLS_accept: SSLv3 read client hello A <br>[peap] >>> TLS 1.0 Handshake [length 002a], ServerHello
<br>[peap] TLS_accept: SSLv3 write server hello A <br>[peap] >>> TLS 1.0 Handshake [length 05ce], Certificate <br>[peap] TLS_accept: SSLv3 write certificate A <br>[peap] >>> TLS 1.0 Handshake [length 010d], ServerKeyExchange <br>[peap] TLS_accept: SSLv3 write key exchange A <br>[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone <br>[peap] TLS_accept: SSLv3 write server done A <br>[peap] TLS_accept: SSLv3 flush data <br>[peap] TLS_accept: Need to read more data: SSLv3 read client certificate A<br>In SSL Handshake Phase <br>In SSL Accept mode <br>[peap] eaptls_process returned 13 <br>[peap] EAPTLS_HANDLED<br>++[eap] returns handled<br>Sending Access-Challenge of id 105 to 10.0.0.1 port 1645<br> EAP-Message =
0x0103040019c00000071d160301002a0200002603014ab1f237fbca05f523e033ce4b7b8ef2489ee1d6fe7016bbe3ffc2f4ab5acb540000390016030105ce0b0005ca0005c7000302308202fe30820267a003020102020103300d06092a864886f70d0101040500304e310b3009060355040613026368310b3009060355040813027a68310f300d060355040713067a7572696368310c300a060355040a13036e7a7a31133011060355040b130a696e666f726d6174696b301e170d3038313230343037333630395a170d3133313230333037333630395a3066310b3009060355040613026368310b3009060355040813027a68310c300a060355040a13<br> EAP-Message =
0x036e7a7a31133011060355040b130a696e666f726d6174696b312730250603550403131e6e7a7a7769726530312d302e7a6830312e6e7a7a6772757070652e6e657430819f300d06092a864886f70d010101050003818d0030818902818100bf2852a1be32bc65d8a6bf27c34453b53ae9a378b98943a31b5d4cffd28e96dd9b0fe69212027623d91a92682a238cd190adecad171cee0a76a5c264efd4e159242c850c78c1e8ec9acc7d222c3970510dd21a06596b40b25001fcb62b617d02a3c2cba3821cafd6b656e9eeca3c84a5e4c271b3786a2089de9ce97b9d894b630203010001a381d33081d030090603551d1304023000302c060960864801<br> EAP-Message =
0x86f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e04160414c93199967c5bdf132d1d5ab3fa15ac9b72ecc78530760603551d23046f306d8014727ea255965d8fbf177009121c46c0ca5c761743a152a450304e310b3009060355040613026368310b3009060355040813027a68310f300d060355040713067a7572696368310c300a060355040a13036e7a7a31133011060355040b130a696e666f726d6174696b820100300d06092a864886f70d0101040500038181002f9130e3625335befa4741b20897377a22f325d6436e1c36f9be24facaf7d1eb54deaa81edb224429c0854f0f6<br> EAP-Message =
0x9e6475e665843ce0370b2c4dcfa7fd912d359404dbc1b027aadf3de96180dba9be61bf82785b63a41ec73f7f6b84bcd80990704441a9a84945a2ba2f68c77c8c56880b191482c87285bb22fc9351db0fed03c40002bf308202bb30820224a003020102020100300d06092a864886f70d0101040500304e310b3009060355040613026368310b3009060355040813027a68310f300d060355040713067a7572696368310c300a060355040a13036e7a7a31133011060355040b130a696e666f726d6174696b301e170d3038313230333135343235395a170d3138313230313135343235395a304e310b3009060355040613026368310b30090603550408<br> EAP-Message = 0x13027a68310f300d06035504<br> Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0x80e9682e81ea716d23cf4280d3865bd8<br>Finished request 1.<br>Going to the next request<br>Waking up in 4.9 seconds.<br>rad_recv: Access-Request packet from host 10.0.0.1 port 1645, id=106, length=153<br> User-Name = "mydomain\\user"<br> Framed-MTU
= 1400<br> Called-Station-Id = "000d.2868.4801"<br> Calling-Station-Id = "000e.3560.3e95"<br> Service-Type = Login-User<br> Message-Authenticator = 0x918316a7a500e443230e4bbc47d5ad7d<br> EAP-Message = 0x020300061900<br> NAS-Port-Type = Wireless-802.11<br> NAS-Port = 4392<br> State = 0x80e9682e81ea716d23cf4280d3865bd8<br> NAS-IP-Address = 10..0.0.1<br> NAS-Identifier = "wireless"<br>+- entering group authorize {...}<br>++[preprocess] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br>[suffix] No '@' in User-Name = "mydomain\user", looking up realm NULL<br>[suffix] No such realm "NULL"<br>++[suffix] returns noop<br>[eap] EAP packet type response id 3 length 6<br>[eap] Continuing tunnel setup.<br>++[eap] returns ok<br>Found Auth-Type = EAP<br>+- entering group
authenticate {...}<br>[eap] Request found, released from the list<br>[eap] EAP/peap<br>[eap] processing type peap<br>[peap] processing EAP-TLS<br>[peap] Received TLS ACK<br>[peap] ACK handshake fragment handler<br>[peap] eaptls_verify returned 1 <br>[peap] eaptls_process returned 13 <br>[peap] EAPTLS_HANDLED<br>++[eap] returns handled<br>Sending Access-Challenge of id 106 to 10.0.0.1 port 1645<br> EAP-Message = 0x0104032d19000713067a7572696368310c300a060355040a13036e7a7a31133011060355040b130a696e666f726d6174696b30819f300d06092a864886f70d010101050003818d0030818902818100c6c1ffce3fe668d765c1dd77d608b27ae5168f1f7316dfe1a61a51fecf6f027c376b13047d11e34eaefd6ed682d3a580106b2b085f78571cdf1c97d02fff9db2b45ecff5512bf42627b38bb49fcf492066930dd04d889258035bd804da3b43e36fb19fd3c6ade9dc1010b9f2d0886c90a26b5f9d22cd17a296867ecc4c709bab0203010001a381a83081a5301d0603551d0e04160414727ea255965d8fbf177009121c46c0ca5c76174330760603<br>
EAP-Message = 0x551d23046f306d8014727ea255965d8fbf177009121c46c0ca5c761743a152a450304e310b3009060355040613026368310b3009060355040813027a68310f300d060355040713067a7572696368310c300a060355040a13036e7a7a31133011060355040b130a696e666f726d6174696b820100300c0603551d13040530030101ff300d06092a864886f70d0101040500038181009b2b4c150f7620aaf113a2855c0750f0f50f3265f6dc9fd8fc45c87192e5989f36e2b223cce00d9c2e289c59d7f552348f1befc5041ea840047c8c51b742070d2038a1d8f30d149f97b4cbfc136bfa0953625647d75e1865d30c12c56cd30417e427107d7ac14ab8<br> EAP-Message =
0xc3a50f63708713e4de5f2a257c536d7c8ec6401d29067103160301010d0c0001090040bc35b1fa5e7e1a1ac57b7f4b1d4bdb2aa0c090840cf3995df0fd2a2125315aeab4113d78cdd6f01841f720a3f51032069994b119ac5e013e6d1c1bdb60055c0b0001020040bb26e792b1a9496427dd930c8f921185af6d0b1301223b7bfff07ab237f63ecd5152d2a79716c1f6d95317f4105666565fc951027f12bdce2a6fec51a49ffa880080562d6f74e16994a4a2757f46b77009569a38e063190ba54e6d395c04837f42a48cb81baee48328a2844d446293b40effd6fa3ba3f2ab86032c5e5d3310ad86eb11ae0eab3c4b922b461f833c66b44a39f19b4b<br> EAP-Message = 0x1fee35da981a6e3f4939e5c3e0187867094c41b1e6bf6da839f737f42dfefea18aa18718509de0791f15edde5316030100040e000000<br> Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0x80e9682e82ed716d23cf4280d3865bd8<br>Finished request 2.<br>Going to the next request<br>Waking up in 4.9 seconds.<br>rad_recv: Access-Request packet from host 10.0.0.1 port 1645, id=107,
length=287<br> User-Name = "mydomain\\user"<br> Framed-MTU = 1400<br> Called-Station-Id = "000d.2868.4801"<br> Calling-Station-Id = "000e.3560.3e95"<br> Service-Type = Login-User<br> Message-Authenticator = 0xf6e713150b71eaf618f12fde46e3bcbb<br> EAP-Message = 0x0204008c190016030100461000004200401c3ab7dc1a753b6ae3020d96d1d144cadf21b5f3422a6783f77bc954b33441514b12044ddacd7ca955d4e1c23c8fc697df9f9e4cdd9361aca2ed8f9ac3f1e04314030100010116030100309180e1b3bc25f45e673fbe76685a95ecc6440b1b0309c47624f75142ae6c9ada63fa12674301b56444c21b450c6b32e7<br> NAS-Port-Type = Wireless-802.11<br> NAS-Port = 4392<br> State = 0x80e9682e82ed716d23cf4280d3865bd8<br> NAS-IP-Address = 10.0.0.1<br> NAS-Identifier = "wireless"<br>+- entering group authorize
{...}<br>++[preprocess] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br>[suffix] No '@' in User-Name = "mydomain\user", looking up realm NULL<br>[suffix] No such realm "NULL"<br>++[suffix] returns noop<br>[eap] EAP packet type response id 4 length 140<br>[eap] Continuing tunnel setup.<br>++[eap] returns ok<br>Found Auth-Type = EAP<br>+- entering group authenticate {...}<br>[eap] Request found, released from the list<br>[eap] EAP/peap<br>[eap] processing type peap<br>[peap] processing EAP-TLS<br>[peap] eaptls_verify returned 7 <br>[peap] Done initial handshake<br>[peap] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange <br>[peap] TLS_accept: SSLv3 read client key exchange A <br>[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] <br>[peap] <<< TLS 1.0 Handshake [length 0010], Finished <br>[peap] TLS_accept: SSLv3 read finished A <br>[peap]
>>> TLS 1.0 ChangeCipherSpec [length 0001] <br>[peap] TLS_accept: SSLv3 write change cipher spec A <br>[peap] >>> TLS 1.0 Handshake [length 0010], Finished <br>[peap] TLS_accept: SSLv3 write finished A <br>[peap] TLS_accept: SSLv3 flush data <br>[peap] (other): SSL negotiation finished successfully <br>SSL Connection Established <br>[peap] eaptls_process returned 13 <br>[peap] EAPTLS_HANDLED<br>++[eap] returns handled<br>Sending Access-Challenge of id 107 to 10.0.0.1 port 1645<br> EAP-Message = 0x010500411900140301000101160301003020196b841f13a063342315f0272e8781d4be5a2e7147e5bdbbfbdc21aeef3d4ea2affdacf672abbd8534b15150719e00<br> Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0x80e9682e83ec716d23cf4280d3865bd8<br>Finished request 3.<br>Going to the next
request<br>Waking up in 4.9 seconds.<br>rad_recv: Access-Request packet from host 10.0.0.1 port 1645, id=108, length=153<br> User-Name = "mydomain\\user"<br> Framed-MTU = 1400<br> Called-Station-Id = "000d.2868.4801"<br> Calling-Station-Id = "000e.3560.3e95"<br> Service-Type = Login-User<br> Message-Authenticator = 0x4e257a44e0eb615236e7e6132d5d661f<br> EAP-Message = 0x020500061900<br> NAS-Port-Type = Wireless-802.11<br> NAS-Port = 4392<br> State = 0x80e9682e83ec716d23cf4280d3865bd8<br> NAS-IP-Address = 10.0.0.1<br> NAS-Identifier = "wireless"<br>+- entering group authorize {...}<br>++[preprocess] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br>[suffix] No '@' in User-Name = "mydomain\user", looking up realm
NULL<br>[suffix] No such realm "NULL"<br>++[suffix] returns noop<br>[eap] EAP packet type response id 5 length 6<br>[eap] Continuing tunnel setup.<br>++[eap] returns ok<br>Found Auth-Type = EAP<br>+- entering group authenticate {...}<br>[eap] Request found, released from the list<br>[eap] EAP/peap<br>[eap] processing type peap<br>[peap] processing EAP-TLS<br>[peap] Received TLS ACK<br>[peap] ACK handshake is finished<br>[peap] eaptls_verify returned 3 <br>[peap] eaptls_process returned 3 <br>[peap] EAPTLS_SUCCESS<br>++[eap] returns handled<br>Sending Access-Challenge of id 108 to 10.0.0.1 port 1645<br> EAP-Message = 0x0106002b190017030100204ac0995a7016dc6e2823fe58aa1a8ff6714e685167aa9168e2a18516a34ce6d6<br> Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0x80e9682e84ef716d23cf4280d3865bd8<br>Finished request 4.<br>Going to the next request<br>Waking up in 4.8
seconds.<br>rad_recv: Access-Request packet from host 10.0.0.1 port 1645, id=109, length=243<br> User-Name = "mydomain\\user"<br> Framed-MTU = 1400<br> Called-Station-Id = "000d.2868.4801"<br> Calling-Station-Id = "000e.3560.3e95"<br> Service-Type = Login-User<br> Message-Authenticator = 0xa1c6ce6def0c9de02466b5c65e1cf9c3<br> EAP-Message = 0x0206006019001703010020d89c686f3a414d7446d857dee8506108223b5dc794ab421d80fb05f03f0a2bd21703010030de672b9ad28edfa510afb0379d769393b37e8de8f1cc4e4f7e9153bc4b7c4b9ccae6f4b26cc5a1bf7fcdc31537a79ea0<br> NAS-Port-Type = Wireless-802.11<br> NAS-Port = 4392<br> State = 0x80e9682e84ef716d23cf4280d3865bd8<br> NAS-IP-Address = 10.0.0.1<br> NAS-Identifier = "wireless"<br>+- entering group authorize
{...}<br>++[preprocess] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br>[suffix] No '@' in User-Name = "mydomain\user", looking up realm NULL<br>[suffix] No such realm "NULL"<br>++[suffix] returns noop<br>[eap] EAP packet type response id 6 length 96<br>[eap] Continuing tunnel setup.<br>++[eap] returns ok<br>Found Auth-Type = EAP<br>+- entering group authenticate {...}<br>[eap] Request found, released from the list<br>[eap] EAP/peap<br>[eap] processing type peap<br>[peap] processing EAP-TLS<br>[peap] eaptls_verify returned 7 <br>[peap] Done initial handshake<br>[peap] eaptls_process returned 7 <br>[peap] EAPTLS_OK<br>[peap] Session established. Decoding tunneled attributes.<br>[peap] Identity - mydomain\user<br>[peap] Got tunnled request<br> EAP-Message = 0x02060010017a6830315c732e686f747a<br>server (null) {<br> PEAP: Got tunneled identity of mydomain\user<br> PEAP: Setting default EAP type for
tunneled EAP session.<br> PEAP: Setting User-Name to mydomain\user<br>Sending tunneled request<br> EAP-Message = 0x02060010017a6830315c732e686f747a<br> FreeRADIUS-Proxied-To = 127.0.0.1<br> User-Name = "mydomain\\user"<br> Framed-MTU = 1400<br> Called-Station-Id = "000d.2868.4801"<br> Calling-Station-Id = "000e.3560.3e95"<br> Service-Type = Login-User<br> NAS-Port-Type = Wireless-802.11<br> NAS-Port = 4392<br> NAS-IP-Address = 10.0.0.1<br> NAS-Identifier = "wireless"<br>server inner-tunnel {<br>+- entering group authorize {...}<br>++[chap] returns noop<br>++[mschap] returns noop<br>++[unix] returns notfound<br>[suffix] No '@' in User-Name = "mydomain\user", looking up realm NULL<br>[suffix] No such realm "NULL"<br>++[suffix] returns noop<br>++[control]
returns noop<br>[eap] EAP packet type response id 6 length 16<br>[eap] No EAP Start, assuming it's an on-going EAP conversation<br>++[eap] returns updated<br>++[files] returns noop<br>++[expiration] returns noop<br>++[logintime] returns noop<br>++[pap] returns noop<br>Found Auth-Type = EAP<br>+- entering group authenticate {...}<br>[eap] EAP Identity<br>[eap] processing type mschapv2<br>rlm_eap_mschapv2: Issuing Challenge<br>++[eap] returns handled<br>} # server inner-tunnel<br>[peap] Got tunneled reply code 11<br> EAP-Message = 0x010700251a0107002010c508956d066adc8e3bc9b92127fb2fe27a6830315c732e686f747a<br> Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0x03371cd203300629664a8ed6dcdcbe2d<br>[peap] Got tunneled reply RADIUS code 11<br> EAP-Message = 0x010700251a0107002010c508956d066adc8e3bc9b92127fb2fe27a6830315c732e686f747a<br>
Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0x03371cd203300629664a8ed6dcdcbe2d<br>[peap] Got tunneled Access-Challenge<br>++[eap] returns handled<br>Sending Access-Challenge of id 109 to 10.0.0.1 port 1645<br> EAP-Message = 0x0107004b19001703010040fd04cc1b4a2605a649d63355aabdeb2632f6f349527cb4013d00d87573592aab6137e23b1f600379195c551950397cce371207f6be612863a7984b38637b9992<br> Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0x80e9682e85ee716d23cf4280d3865bd8<br>Finished request 5.<br>Going to the next request<br>Waking up in 4.8 seconds.<br>rad_recv: Access-Request packet from host 10.0.0.1 port 1645, id=110, length=291<br> User-Name = "mydomain\\user"<br> Framed-MTU = 1400<br> Called-Station-Id = "000d.2868.4801"<br> Calling-Station-Id =
"000e.3560.3e95"<br> Service-Type = Login-User<br> Message-Authenticator = 0x1cd29e39402a6e840e8f6556bf46928e<br> EAP-Message = 0x0207009019001703010020bd76d0b1af16c027e5a9da101b14ee7fe6ff2cf97814650047851242be007a711703010060c32b500bc499db805ab72b291f00d4005f04d993d16bb7061e2d52b47c7d9556b3c7c11b69878df2bb9d162d0785d085987181a73a81d9315139e4662efa7b54369921d174a6047bb7746897a46c93a795a8ebc3c4856481f9e1323ad8bcbdb5<br> NAS-Port-Type = Wireless-802.11<br> NAS-Port = 4392<br> State = 0x80e9682e85ee716d23cf4280d3865bd8<br> NAS-IP-Address = 10.0.0.1<br> NAS-Identifier = "wireless"<br>+- entering group authorize {...}<br>++[preprocess] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br>[suffix] No '@' in User-Name = "mydomain\user", looking up realm NULL<br>[suffix] No such realm "NULL"<br>++[suffix]
returns noop<br>[eap] EAP packet type response id 7 length 144<br>[eap] Continuing tunnel setup.<br>++[eap] returns ok<br>Found Auth-Type = EAP<br>+- entering group authenticate {...}<br>[eap] Request found, released from the list<br>[eap] EAP/peap<br>[eap] processing type peap<br>[peap] processing EAP-TLS<br>[peap] eaptls_verify returned 7 <br>[peap] Done initial handshake<br>[peap] eaptls_process returned 7 <br>[peap] EAPTLS_OK<br>[peap] Session established. Decoding tunneled attributes.<br>[peap] EAP type mschapv2<br>[peap] Got tunnled request<br> EAP-Message = 0x020700461a0207004131f57076f6190b1451606d6ed9d3c3b80f0000000000000000758dee0f5cf4b7ea3cd150fa32ff165723887bae940074c4007a6830315c732e686f747a<br>server (null) {<br> PEAP: Setting User-Name to mydomain\user<br>Sending tunneled request<br> EAP-Message =
0x020700461a0207004131f57076f6190b1451606d6ed9d3c3b80f0000000000000000758dee0f5cf4b7ea3cd150fa32ff165723887bae940074c4007a6830315c732e686f747a<br> FreeRADIUS-Proxied-To = 127.0.0.1<br> User-Name = "mydomain\\user"<br> State = 0x03371cd203300629664a8ed6dcdcbe2d<br> Framed-MTU = 1400<br> Called-Station-Id = "000d.2868.4801"<br> Calling-Station-Id = "000e.3560.3e95"<br> Service-Type = Login-User<br> NAS-Port-Type = Wireless-802.11<br> NAS-Port = 4392<br> NAS-IP-Address = 10.0.0.1<br> NAS-Identifier = "wireless"<br>server inner-tunnel {<br>+- entering group authorize {...}<br>++[chap] returns noop<br>++[mschap] returns noop<br>++[unix] returns notfound<br>[suffix] No '@' in User-Name = "mydomain\user", looking up realm NULL<br>[suffix] No such realm
"NULL"<br>++[suffix] returns noop<br>++[control] returns noop<br>[eap] EAP packet type response id 7 length 70<br>[eap] No EAP Start, assuming it's an on-going EAP conversation<br>++[eap] returns updated<br>++[files] returns noop<br>++[expiration] returns noop<br>++[logintime] returns noop<br>++[pap] returns noop<br>Found Auth-Type = EAP<br>+- entering group authenticate {...}<br>[eap] Request found, released from the list<br>[eap] EAP/mschapv2<br>[eap] processing type mschapv2<br>[mschapv2] +- entering group MS-CHAP {...}<br>[mschap] No Cleartext-Password configured. Cannot create LM-Password.<br>[mschap] No Cleartext-Password configured. Cannot create NT-Password.<br>[mschap] Told to do MS-CHAPv2 for user with NT-Password<br> expand: --domain=%{mschap:NT-mydomain:-mydomain} -> --domain=mydomain<br> expand: --username=%{mschap:User-Name:-None} -> --username=user<br>[mschap] mschap2:
c5<br> expand: --challenge=%{mschap:Challenge:-00} -> --challenge=8660dea0f174464c<br> expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=758dee0f5cf4b7ea3cd150fa32ff165723887bae940074c4<br>Exec-Program output: NT_KEY: B9C1923227672CF3D5079723D78E41A0 <br>Exec-Program-Wait: plaintext: NT_KEY: B9C1923227672CF3D5079723D78E41A0 <br>Exec-Program: returned: 0<br>++[mschap] returns ok<br>MSCHAP Success <br>++[eap] returns handled<br>} # server inner-tunnel<br>[peap] Got tunneled reply code 11<br> EAP-Message = 0x010800331a0307002e533d32423538443738374433374635314433313846413736343432333539463034384645433535353044<br> Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0x03371cd2023f0629664a8ed6dcdcbe2d<br>[peap] Got tunneled reply RADIUS code 11<br> EAP-Message =
0x010800331a0307002e533d32423538443738374433374635314433313846413736343432333539463034384645433535353044<br> Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0x03371cd2023f0629664a8ed6dcdcbe2d<br>[peap] Got tunneled Access-Challenge<br>++[eap] returns handled<br>Sending Access-Challenge of id 110 to 10.0.0.1 port 1645<br> EAP-Message = 0x0108005b1900170301005055895bdec32accf23e83a028b4dacbd15c004660b5f7894904db99814756478b5e75b0d7784be8499937b31e7b49ac566dea2f9ffcfec48f52c6187290e8531f7f1f1227f27d7b589aea4033a7d24ea9<br> Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0x80e9682e86e1716d23cf4280d3865bd8<br>Finished request 6.<br>Going to the next request<br>Waking up in 4..8 seconds.<br>rad_recv: Access-Request packet from host 10.0.0.1 port 1645, id=111, length=227<br> User-Name =
"mydomain\\user"<br> Framed-MTU = 1400<br> Called-Station-Id = "000d.2868.4801"<br> Calling-Station-Id = "000e.3560.3e95"<br> Service-Type = Login-User<br> Message-Authenticator = 0xca25c9fefffe68fb16b7540330f886cd<br> EAP-Message = 0x0208005019001703010020218fcc3ddf31542a1f4561375cb7b54f876cad08360a35bbee7cffcc512cd1a1170301002029173c496b16779ef3bb3d5172702d36c240bd8357def389fac4eb3212046f6e<br> NAS-Port-Type = Wireless-802.11<br> NAS-Port = 4392<br> State = 0x80e9682e86e1716d23cf4280d3865bd8<br> NAS-IP-Address = 10.0.0.1<br> NAS-Identifier = "wireless"<br>+- entering group authorize {...}<br>++[preprocess] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br>[suffix] No '@' in User-Name = "mydomain\user", looking up realm NULL<br>[suffix] No
such realm "NULL"<br>++[suffix] returns noop<br>[eap] EAP packet type response id 8 length 80<br>[eap] Continuing tunnel setup.<br>++[eap] returns ok<br>Found Auth-Type = EAP<br>+- entering group authenticate {...}<br>[eap] Request found, released from the list<br>[eap] EAP/peap<br>[eap] processing type peap<br>[peap] processing EAP-TLS<br>[peap] eaptls_verify returned 7 <br>[peap] Done initial handshake<br>[peap] eaptls_process returned 7 <br>[peap] EAPTLS_OK<br>[peap] Session established. Decoding tunneled attributes.<br>[peap] EAP type mschapv2<br>[peap] Got tunnled request<br> EAP-Message = 0x020800061a04<br>server (null) {<br> PEAP: Setting User-Name to mydomain\user<br>Sending tunneled request<br> EAP-Message = 0x020800061a04<br> FreeRADIUS-Proxied-To = 127.0.0.1<br> User-Name = "mydomain\\user"<br> State =
0x03371cd2023f0629664a8ed6dcdcbe2d<br> Framed-MTU = 1400<br> Called-Station-Id = "000d.2868.4801"<br> Calling-Station-Id = "000e.3560.3e95"<br> Service-Type = Login-User<br> NAS-Port-Type = Wireless-802.11<br> NAS-Port = 4392<br> NAS-IP-Address = 10.0.0.1<br> NAS-Identifier = "wireless"<br>server inner-tunnel {<br>+- entering group authorize {...}<br>++[chap] returns noop<br>++[mschap] returns noop<br>++[unix] returns notfound<br>[suffix] No '@' in User-Name = "mydomain\user", looking up realm NULL<br>[suffix] No such realm "NULL"<br>++[suffix] returns noop<br>++[control] returns noop<br>[eap] EAP packet type response id 8 length 6<br>[eap] No EAP Start, assuming it's an on-going EAP conversation<br>++[eap] returns updated<br>++[files] returns noop<br>++[expiration] returns noop<br>++[logintime] returns
noop<br>++[pap] returns noop<br>Found Auth-Type = EAP<br>+- entering group authenticate {...}<br>[eap] Request found, released from the list<br>[eap] EAP/mschapv2<br>[eap] processing type mschapv2<br>rlm_eap_mschapv2: Invalid response type 4<br>[eap] Handler failed in EAP/mschapv2<br>[eap] Failed in EAP select<br>++[eap] returns invalid<br>Failed to authenticate the user.<br>} # server inner-tunnel<br>[peap] Got tunneled reply code 3<br> EAP-Message = 0x04080004<br> Message-Authenticator = 0x00000000000000000000000000000000<br>[peap] Got tunneled reply RADIUS code 3<br> EAP-Message = 0x04080004<br> Message-Authenticator = 0x00000000000000000000000000000000<br>[peap] Tunneled authentication was rejected.<br>[peap] FAILURE<br>++[eap] returns handled<br>Sending Access-Challenge of id 111 to 10.0.0.1 port 1645<br> EAP-Message =
0x0109002b19001703010020b12908003d5c6d7d90cd3130cf111d70753d81ca7757744970195793cf356978<br> Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0x80e9682e87e0716d23cf4280d3865bd8<br>Finished request 7.<br>Going to the next request<br>Waking up in 4.7 seconds.<br>rad_recv: Access-Request packet from host 10.0.0.1 port 1645, id=112, length=227<br> User-Name = "mydomain\\user"<br> Framed-MTU = 1400<br> Called-Station-Id = "000d.2868.4801"<br> Calling-Station-Id = "000e.3560.3e95"<br> Service-Type = Login-User<br> Message-Authenticator = 0x508935028611f6b0a47361317bf28b8f<br> EAP-Message = 0x02090050190017030100203ce39908b6bbd121e3b74f1b47e4df5e0a3b29c6bad8add51bdfad7e96ecb35917030100208618b9c909461c0afd54c4187f4fc76076ec42ed2d702e7cdd3e3099dc3b0f6b<br>
NAS-Port-Type = Wireless-802.11<br> NAS-Port = 4392<br> State = 0x80e9682e87e0716d23cf4280d3865bd8<br> NAS-IP-Address = 10.0.0.1<br> NAS-Identifier = "wireless"<br>+- entering group authorize {...}<br>++[preprocess] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br>[suffix] No '@' in User-Name = "mydomain\user", looking up realm NULL<br>[suffix] No such realm "NULL"<br>++[suffix] returns noop<br>[eap] EAP packet type response id 9 length 80<br>[eap] Continuing tunnel setup.<br>++[eap] returns ok<br>Found Auth-Type = EAP<br>+- entering group authenticate {...}<br>[eap] Request found, released from the list<br>[eap] EAP/peap<br>[eap] processing type peap<br>[peap] processing EAP-TLS<br>[peap] eaptls_verify returned 7 <br>[peap] Done initial handshake<br>[peap] eaptls_process returned 7 <br>[peap] EAPTLS_OK<br>[peap] Session established. Decoding tunneled
attributes.<br>[peap] Received EAP-TLV response.<br>[peap] Had sent TLV failure. User was rejected earlier in this session.<br>[eap] Handler failed in EAP/peap<br>[eap] Failed in EAP select<br>++[eap] returns invalid<br>Failed to authenticate the user.<br>Using Post-Auth-Type Reject<br>+- entering group REJECT {...}<br> expand: %{User-Name} -> mydomain\user<br> attr_filter: Matched entry DEFAULT at line 11<br>++[attr_filter.access_reject] returns updated<br>Delaying reject of request 8 for 1 seconds<br>Going to the next request<br>Waking up in 0.9 seconds..<br>Sending delayed reject for request 8<br>Sending Access-Reject of id 112 to 10.0.0.1 port 1645<br> EAP-Message = 0x04090004<br> Message-Authenticator = 0x00000000000000000000000000000000<br>Waking up in 3.4 seconds.<br><br></div></div><br>
</body></html>