Hi Alan,<br><br>I'm facing the issue with configuration EAP-TTLS, LDAP and Perl and using test client as "eapol_test".<br><br>Please find the debug logs below:<br><br>rad_recv: Access-Request packet from host 127.0.0.1 port 45673, id=0, length=206<br>
User-Name = "xxxxxxxx"<br> NAS-IP-Address = 127.0.0.1<br> Calling-Station-Id = "02-00-00-00-00-01"<br> Framed-MTU = 1400<br> NAS-Port-Type = Wireless-802.11<br> Connect-Info = "CONNECT 11Mbps 802.11b"<br>
EAP-Message = 0x020000360175736572317676746e746b6a6b636b76656469756366767672636e657563756b6c766465637475726a646a666b676e7267<br> Message-Authenticator = 0x065b1291e4b6cff7cecc69db3a9b5b83<br># Executing section authorize from file /etc/freeradius/sites-enabled/default<br>
+- entering group authorize {...}<br>++[preprocess] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br>[suffix] No '@' in User-Name = "xxxxxxxx", looking up realm NULL<br>[suffix] No such realm "NULL"<br>
++[suffix] returns noop<br>[eap] EAP packet type response id 0 length 54<br>[eap] No EAP Start, assuming it's an on-going EAP conversation<br>++[eap] returns updated<br>rlm_perl: Added pair NAS-Port-Type = Wireless-802.11<br>
rlm_perl: Added pair Calling-Station-Id = 02-00-00-00-00-01<br>rlm_perl: Added pair Message-Authenticator = 0x065b1291e4b6cff7cecc69db3a9b5b83<br>rlm_perl: Added pair User-Name = xxxxxxxx<br>rlm_perl: Added pair EAP-Message = 0x020000360175736572317676746e746b6a6b636b76656469756366767672636e657563756b6c766465637475726a646a666b676e7267<br>
rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b<br>rlm_perl: Added pair EAP-Type = Identity<br>rlm_perl: Added pair NAS-IP-Address = 127.0.0.1<br>rlm_perl: Added pair Framed-MTU = 1400<br>rlm_perl: Added pair Auth-Type = EAP<br>
++[perl] returns ok<br>++[files] returns noop<br>[ldap] performing user authorization for xxxxxxxx<br>[ldap] expand: %{Stripped-User-Name} -> <br>[ldap] ... expanding second conditional<br>[ldap] expand: %{User-Name} -> xxxxxxxx<br>
[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=xxxxxxxx)<br>[ldap] expand: dc=example,dc=com -> dc=example,dc=com<br> [ldap] ldap_get_conn: Checking Id: 0<br> [ldap] ldap_get_conn: Got Id: 0<br>
[ldap] attempting LDAP reconnection<br> [ldap] (re)connect to <a href="http://192.168.1.103:389">192.168.1.103:389</a>, authentication 0<br> [ldap] bind as cn=admin,dc=example,dc=com/xxxxxxxx to <a href="http://192.168.1.103:389">192.168.1.103:389</a><br>
[ldap] waiting for bind result ...<br> [ldap] Bind was successful<br> [ldap] performing search in dc=example,dc=com, with filter (uid=xxxxxxxx)<br>[ldap] No default NMAS login sequence<br>[ldap] looking for check items in directory...<br>
[ldap] userPassword -> Cleartext-Password == "xxxxxxxx"<br> [ldap] userPassword -> Password-With-Header == "xxxxxxxx"<br>[ldap] looking for reply items in directory...<br>[ldap] user xxxxxxxx authorized to use remote access<br>
[ldap] ldap_release_conn: Release Id: 0<br>++[ldap] returns ok<br>[pap] Config already contains "known good" password. Ignoring Password-With-Header<br>[pap] WARNING: Auth-Type already set. Not setting to PAP<br>
++[pap] returns noop<br>Found Auth-Type = EAP<br># Executing group from file /etc/freeradius/sites-enabled/default<br>+- entering group EAP {...}<br>rlm_perl: Added pair NAS-Port-Type = Wireless-802.11<br>rlm_perl: Added pair Calling-Station-Id = 02-00-00-00-00-01<br>
rlm_perl: Added pair Message-Authenticator = 0x065b1291e4b6cff7cecc69db3a9b5b83<br>rlm_perl: Added pair User-Name = xxxxxxxx<br>rlm_perl: Added pair EAP-Message = 0x020000360175736572317676746e746b6a6b636b76656469756366767672636e657563756b6c766465637475726a646a666b676e7267<br>
rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b<br>rlm_perl: Added pair EAP-Type = Identity<br>rlm_perl: Added pair NAS-IP-Address = 127.0.0.1<br>rlm_perl: Added pair Framed-MTU = 1400<br>rlm_perl: Added pair h323-credit-amount = 100<br>
rlm_perl: Added pair Cleartext-Password = xxxxxxxx<br>rlm_perl: Added pair Password-With-Header = xxxxxxxx<br>rlm_perl: Added pair Ldap-UserDn = uid=xxxxxxxx,ou=people,dc=example,dc=com<br>rlm_perl: Added pair Auth-Type = EAP<br>
++[perl] returns ok<br>[eap] EAP Identity<br>[eap] processing type tls<br>[tls] Initiate<br>[tls] Start returned 1<br>++[eap] returns handled<br>Sending Access-Challenge of id 0 to 127.0.0.1 port 45673<br> h323-credit-amount = "100"<br>
EAP-Message = 0x010100061520<br> Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0x2a7f4cbf2a7e5963e2206d31c110709d<br>Finished request 0.<br>Going to the next request<br>Waking up in 4.9 seconds.<br>
rad_recv: Access-Request packet from host 127.0.0.1 port 45673, id=1, length=271<br> User-Name = "xxxxxxxx"<br> NAS-IP-Address = 127.0.0.1<br> Calling-Station-Id = "02-00-00-00-00-01"<br> Framed-MTU = 1400<br>
NAS-Port-Type = Wireless-802.11<br> Connect-Info = "CONNECT 11Mbps 802.11b"<br> EAP-Message = 0x020100651500160301005a010000560301507c49a86cfabf980d6b3d94daf27fe3f600a2320dbc3427626ca4b918ad885f00002800390038003500160013000a00330032002f000500040015001200090014001100080006000300ff020100000400230000<br>
State = 0x2a7f4cbf2a7e5963e2206d31c110709d<br> Message-Authenticator = 0x7984af4d41a5bfd6c39d9a472fe0cc17<br># Executing section authorize from file /etc/freeradius/sites-enabled/default<br>+- entering group authorize {...}<br>
++[preprocess] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br>[suffix] No '@' in User-Name = "xxxxxxxx", looking up realm NULL<br>[suffix] No such realm "NULL"<br>++[suffix] returns noop<br>
[eap] EAP packet type response id 1 length 101<br>[eap] Continuing tunnel setup.<br>++[eap] returns ok<br>Found Auth-Type = EAP<br># Executing group from file /etc/freeradius/sites-enabled/default<br>+- entering group EAP {...}<br>
rlm_perl: Added pair NAS-Port-Type = Wireless-802.11<br>rlm_perl: Added pair State = 0x2a7f4cbf2a7e5963e2206d31c110709d<br>rlm_perl: Added pair Calling-Station-Id = 02-00-00-00-00-01<br>rlm_perl: Added pair Message-Authenticator = 0x7984af4d41a5bfd6c39d9a472fe0cc17<br>
rlm_perl: Added pair User-Name = xxxxxxxx<br>rlm_perl: Added pair EAP-Message = 0x020100651500160301005a010000560301507c49a86cfabf980d6b3d94daf27fe3f600a2320dbc3427626ca4b918ad885f00002800390038003500160013000a00330032002f000500040015001200090014001100080006000300ff020100000400230000<br>
rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b<br>rlm_perl: Added pair EAP-Type = EAP-TTLS<br>rlm_perl: Added pair NAS-IP-Address = 127.0.0.1<br>rlm_perl: Added pair Framed-MTU = 1400<br>rlm_perl: Added pair h323-credit-amount = 100<br>
rlm_perl: Added pair Auth-Type = EAP<br>++[perl] returns ok<br>[eap] Request found, released from the list<br>[eap] EAP/ttls<br>[eap] processing type ttls<br>[ttls] Authenticate<br>[ttls] processing EAP-TLS<br>[ttls] eaptls_verify returned 7 <br>
[ttls] Done initial handshake<br>[ttls] (other): before/accept initialization<br>[ttls] TLS_accept: before/accept initialization<br>[ttls] <<< TLS 1.0 Handshake [length 005a], ClientHello <br>[ttls] TLS_accept: SSLv3 read client hello A<br>
[ttls] >>> TLS 1.0 Handshake [length 0031], ServerHello <br>[ttls] TLS_accept: SSLv3 write server hello A<br>[ttls] >>> TLS 1.0 Handshake [length 02cd], Certificate <br>[ttls] TLS_accept: SSLv3 write certificate A<br>
[ttls] >>> TLS 1.0 Handshake [length 018d], ServerKeyExchange <br>[ttls] TLS_accept: SSLv3 write key exchange A<br>[ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone <br>[ttls] TLS_accept: SSLv3 write server done A<br>
[ttls] TLS_accept: SSLv3 flush data<br>[ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A<br>In SSL Handshake Phase <br>In SSL Accept mode <br>[ttls] eaptls_process returned 13 <br>++[eap] returns handled<br>
Sending Access-Challenge of id 1 to 127.0.0.1 port 45673<br> h323-credit-amount = "100"<br> EAP-Message = 0x0102040015c0000004a316030100310200002d0301507c49a876d497d9f77288e6caa927ae9f07fcb259dfeb517d0ddbfa14c671c3000039010005ff0100010016030102cd0b0002c90002c60002c3308202bf308202280209008b00025017ffafe4300d06092a864886f70d01010505003081a3310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e310c300a060355040b130378797a312830260603550403141f224578616d706c6520436572746966696361746520417574686f72697479223120301e06092a86<br>
EAP-Message = 0x4886f70d010901161161646d696e406578616d706c652e636f6d301e170d3132303931343136313931335a170d3133303931343136313931335a3081a3310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e310c300a060355040b130378797a312830260603550403141f224578616d706c6520436572746966696361746520417574686f72697479223120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100<br>
EAP-Message = 0xc3d1b3c57f4c72c389bb132649aea31dd2d59953c56dc5e6a9630e5bf0902e8fbf68719eac848433d850602060ebc642c7cf0e121703ba1c152e713977216eef5f764473beafa4c53f51c96df814b4ab3b9de7ea22ba81d9b638d6333300a3fec763da2ad7f78574ac58c496749cbd1b22a732116ee9a25ae1131ce99ea00d310203010001300d06092a864886f70d01010505000381810007b898f0f249f93acd6b72df3a831a47c0a50b974b73da77b1824a9d77e8ce517299175fdc0c5e1610da5ad53fe266a585f30b23db1c980cc717acacc6f50ada63ca95daebed12b1ee47b704e6ccc2a84a44b27b0a17e14f19036e703a18c93687bdbe2b7e<br>
EAP-Message = 0x78e990b1fb0ab9c489ccde5194eeee3974c42c7c3b0e3bfb5b2901160301018d0c0001890080c51c91cdb5dca84043ba6593725729e34c8db0986ef811b01d68d07c6f04b760bbc897fd296a98bce2a9e42f042c06074b2196d7eed711f388cab4e53eaac23a9f6b0244de91671659f446ce85bb8898dfd490c60e0d313ba5a59f7718c43a8b5864192b3edd5a3c4a696b93fa28559d52cc52de8db8dcbff46d809a46bf34c300010200804321e02ced80d60dbdce5f94fe118280f401a58c2a9841bf073318ec6ac528ddddf128849ad36365c3a60b90e234dc959e312c6ad8d02bb330e66686b6dafe243a8188d46b270abd9a30d3a6f6e7e4454dcc<br>
EAP-Message = 0xb3c45b3ea56942954e0dbb66<br> Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0x2a7f4cbf2b7d5963e2206d31c110709d<br>Finished request 1.<br>Going to the next request<br>Waking up in 4.9 seconds.<br>
rad_recv: Access-Request packet from host 127.0.0.1 port 45673, id=2, length=176<br> User-Name = "xxxxxxxx"<br> NAS-IP-Address = 127.0.0.1<br> Calling-Station-Id = "02-00-00-00-00-01"<br> Framed-MTU = 1400<br>
NAS-Port-Type = Wireless-802.11<br> Connect-Info = "CONNECT 11Mbps 802.11b"<br> EAP-Message = 0x020200061500<br> State = 0x2a7f4cbf2b7d5963e2206d31c110709d<br> Message-Authenticator = 0x4d08a46158ad21253a616e97ad9ded18<br>
# Executing section authorize from file /etc/freeradius/sites-enabled/default<br>+- entering group authorize {...}<br>++[preprocess] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br>[suffix] No '@' in User-Name = "xxxxxxxx", looking up realm NULL<br>
[suffix] No such realm "NULL"<br>++[suffix] returns noop<br>[eap] EAP packet type response id 2 length 6<br>[eap] Continuing tunnel setup.<br>++[eap] returns ok<br>Found Auth-Type = EAP<br># Executing group from file /etc/freeradius/sites-enabled/default<br>
+- entering group EAP {...}<br>rlm_perl: Added pair NAS-Port-Type = Wireless-802.11<br>rlm_perl: Added pair State = 0x2a7f4cbf2b7d5963e2206d31c110709d<br>rlm_perl: Added pair Calling-Station-Id = 02-00-00-00-00-01<br>rlm_perl: Added pair Message-Authenticator = 0x4d08a46158ad21253a616e97ad9ded18<br>
rlm_perl: Added pair User-Name = xxxxxxxx<br>rlm_perl: Added pair EAP-Message = 0x020200061500<br>rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b<br>rlm_perl: Added pair EAP-Type = EAP-TTLS<br>rlm_perl: Added pair NAS-IP-Address = 127.0.0.1<br>
rlm_perl: Added pair Framed-MTU = 1400<br>rlm_perl: Added pair h323-credit-amount = 100<br>rlm_perl: Added pair Auth-Type = EAP<br>++[perl] returns ok<br>[eap] Request found, released from the list<br>[eap] EAP/ttls<br>[eap] processing type ttls<br>
[ttls] Authenticate<br>[ttls] processing EAP-TLS<br>[ttls] Received TLS ACK<br>[ttls] ACK handshake fragment handler<br>[ttls] eaptls_verify returned 1 <br>[ttls] eaptls_process returned 13 <br>++[eap] returns handled<br>
Sending Access-Challenge of id 2 to 127.0.0.1 port 45673<br> h323-credit-amount = "100"<br> EAP-Message = 0x010300b71580000004a3f4da3a4fff56705c0118ee01841f0b363c07293ebcf69d05e1092c3e054bbdea541f00803a833293f40d96e86f2c849b5cdf9887eb868d3cac267e53b77c5ebe63b3a5e5989c08510c398b8dc3281bfdb5ae3578214cb26716be3557ca7f35d1a46a9a37b7b4d1eae9a10cace3b13dc194fb72249724b4b59c7dd62e66718bd50dcdb6ec376c57e4556cf4c44daa9c0adcf284e5c865714a7f71db352238d81e4207798016030100040e000000<br>
Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0x2a7f4cbf287c5963e2206d31c110709d<br>Finished request 2.<br>Going to the next request<br>Waking up in 4.9 seconds.<br>rad_recv: Access-Request packet from host 127.0.0.1 port 45673, id=3, length=374<br>
User-Name = "xxxxxxxx"<br> NAS-IP-Address = 127.0.0.1<br> Calling-Station-Id = "02-00-00-00-00-01"<br> Framed-MTU = 1400<br> NAS-Port-Type = Wireless-802.11<br> Connect-Info = "CONNECT 11Mbps 802.11b"<br>
EAP-Message = 0x020300cc1500160301008610000082008090fd20bda5d27eb2d4deee9e076d8f77a8b14a91f33c6620eb5a3896f8280acd0bbd5bb0da405e5b09a842867e6083d21ee749f7f0ba637c2dd89005b8b98bb354742b01d83c676aee9a014355fbeff4b546055a2e0c39fd5a43ddac2031b42f81902efe3f17199e8f8be74683d1b0e05f2f126d7650a084e2800d62f26ab50f1403010001011603010030ccdda6df2d462f7b0b12cc43b02ee696b4cde6befa312d4147968c9af09c1e95b3ee38f8bd2b2521d88f4ed09e2f6969<br>
State = 0x2a7f4cbf287c5963e2206d31c110709d<br> Message-Authenticator = 0x3cee3f55cea92deefa2591caaea03633<br># Executing section authorize from file /etc/freeradius/sites-enabled/default<br>+- entering group authorize {...}<br>
++[preprocess] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br>[suffix] No '@' in User-Name = "xxxxxxxx", looking up realm NULL<br>[suffix] No such realm "NULL"<br>++[suffix] returns noop<br>
[eap] EAP packet type response id 3 length 204<br>[eap] Continuing tunnel setup.<br>++[eap] returns ok<br>Found Auth-Type = EAP<br># Executing group from file /etc/freeradius/sites-enabled/default<br>+- entering group EAP {...}<br>
rlm_perl: Added pair NAS-Port-Type = Wireless-802.11<br>rlm_perl: Added pair State = 0x2a7f4cbf287c5963e2206d31c110709d<br>rlm_perl: Added pair Calling-Station-Id = 02-00-00-00-00-01<br>rlm_perl: Added pair Message-Authenticator = 0x3cee3f55cea92deefa2591caaea03633<br>
rlm_perl: Added pair User-Name = xxxxxxxx<br>rlm_perl: Added pair EAP-Message = 0x020300cc1500160301008610000082008090fd20bda5d27eb2d4deee9e076d8f77a8b14a91f33c6620eb5a3896f8280acd0bbd5bb0da405e5b09a842867e6083d21ee749f7f0ba637c2dd89005b8b98bb354742b01d83c676aee9a014355fbeff4b546055a2e0c39fd5a43ddac2031b42f81902efe3f17199e8f8be74683d1b0e05f2f126d7650a084e2800d62f26ab50f1403010001011603010030ccdda6df2d462f7b0b12cc43b02ee696b4cde6befa312d4147968c9af09c1e95b3ee38f8bd2b2521d88f4ed09e2f6969<br>
rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b<br>rlm_perl: Added pair EAP-Type = EAP-TTLS<br>rlm_perl: Added pair NAS-IP-Address = 127.0.0.1<br>rlm_perl: Added pair Framed-MTU = 1400<br>rlm_perl: Added pair h323-credit-amount = 100<br>
rlm_perl: Added pair Auth-Type = EAP<br>++[perl] returns ok<br>[eap] Request found, released from the list<br>[eap] EAP/ttls<br>[eap] processing type ttls<br>[ttls] Authenticate<br>[ttls] processing EAP-TLS<br>[ttls] eaptls_verify returned 7 <br>
[ttls] Done initial handshake<br>[ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange <br>[ttls] TLS_accept: SSLv3 read client key exchange A<br>[ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] <br>
[ttls] <<< TLS 1.0 Handshake [length 0010], Finished <br>[ttls] TLS_accept: SSLv3 read finished A<br>[ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] <br>[ttls] TLS_accept: SSLv3 write change cipher spec A<br>
[ttls] >>> TLS 1.0 Handshake [length 0010], Finished <br>[ttls] TLS_accept: SSLv3 write finished A<br>[ttls] TLS_accept: SSLv3 flush data<br>[ttls] (other): SSL negotiation finished successfully<br>SSL Connection Established <br>
[ttls] eaptls_process returned 13 <br>++[eap] returns handled<br>Sending Access-Challenge of id 3 to 127.0.0.1 port 45673<br> h323-credit-amount = "100"<br> EAP-Message = 0x0104004515800000003b140301000101160301003044e95766bb9308bc45e92fa37e082e248aa382cb961ee973693c1e7c695c35e664de49304756c6e6430fe00e640ea5c4<br>
Message-Authenticator = 0x00000000000000000000000000000000<br> State = 0x2a7f4cbf297b5963e2206d31c110709d<br>Finished request 3.<br>Going to the next request<br>Waking up in 4.9 seconds.<br>rad_recv: Access-Request packet from host 127.0.0.1 port 45673, id=4, length=394<br>
User-Name = "xxxxxxxx"<br> NAS-IP-Address = 127.0.0.1<br> Calling-Station-Id = "02-00-00-00-00-01"<br> Framed-MTU = 1400<br> NAS-Port-Type = Wireless-802.11<br> Connect-Info = "CONNECT 11Mbps 802.11b"<br>
EAP-Message = 0x020400e0150017030100207c1f492109c1413df90458ac8bc6e2a363b5f4ef4a1b6b8e7e722ce41b4ac2fa17030100b0d13c2711852a1deb05113832a62cce19b446645bda91d1e8cb46d1339a44896b5ea3eee06c87e3309539d37d19c3c3ffa1cf4f32273143254278ad1bfafca9aa36d7f01fef67759698d74aa1d4aacf8ed329a53e24196b1817b85710bec6030ab55b2c69ce39ea67d900e7d392948b935cac44d35fa78211a54d318e60f1653c05103fcf515aa61da4e66b4ae43b9d4db728d023a9fcd03d6d4fa2e315a78021974d7f8b6df36a6f75442e2f8fe33712<br>
State = 0x2a7f4cbf297b5963e2206d31c110709d<br> Message-Authenticator = 0x90ceee8718eb32ddcf5b3a9d56136a94<br># Executing section authorize from file /etc/freeradius/sites-enabled/default<br>+- entering group authorize {...}<br>
++[preprocess] returns ok<br>++[chap] returns noop<br>++[mschap] returns noop<br>[suffix] No '@' in User-Name = "xxxxxxxx", looking up realm NULL<br>[suffix] No such realm "NULL"<br>++[suffix] returns noop<br>
[eap] EAP packet type response id 4 length 224<br>[eap] Continuing tunnel setup.<br>++[eap] returns ok<br>Found Auth-Type = EAP<br># Executing group from file /etc/freeradius/sites-enabled/default<br>+- entering group EAP {...}<br>
rlm_perl: Added pair NAS-Port-Type = Wireless-802.11<br>rlm_perl: Added pair State = 0x2a7f4cbf297b5963e2206d31c110709d<br>rlm_perl: Added pair Calling-Station-Id = 02-00-00-00-00-01<br>rlm_perl: Added pair Message-Authenticator = 0x90ceee8718eb32ddcf5b3a9d56136a94<br>
rlm_perl: Added pair User-Name = xxxxxxxx<br>rlm_perl: Added pair EAP-Message = 0x020400e0150017030100207c1f492109c1413df90458ac8bc6e2a363b5f4ef4a1b6b8e7e722ce41b4ac2fa17030100b0d13c2711852a1deb05113832a62cce19b446645bda91d1e8cb46d1339a44896b5ea3eee06c87e3309539d37d19c3c3ffa1cf4f32273143254278ad1bfafca9aa36d7f01fef67759698d74aa1d4aacf8ed329a53e24196b1817b85710bec6030ab55b2c69ce39ea67d900e7d392948b935cac44d35fa78211a54d318e60f1653c05103fcf515aa61da4e66b4ae43b9d4db728d023a9fcd03d6d4fa2e315a78021974d7f8b6df36a6f75442e2f8fe33712<br>
rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b<br>rlm_perl: Added pair EAP-Type = EAP-TTLS<br>rlm_perl: Added pair NAS-IP-Address = 127.0.0.1<br>rlm_perl: Added pair Framed-MTU = 1400<br>rlm_perl: Added pair h323-credit-amount = 100<br>
rlm_perl: Added pair Auth-Type = EAP<br>++[perl] returns ok<br>[eap] Request found, released from the list<br>[eap] EAP/ttls<br>[eap] processing type ttls<br>[ttls] Authenticate<br>[ttls] processing EAP-TLS<br>[ttls] eaptls_verify returned 7 <br>
[ttls] Done initial handshake<br>[ttls] eaptls_process returned 7 <br>[ttls] Session established. Proceeding to decode tunneled attributes.<br>[ttls] Got tunneled request<br> User-Name = "xxxxxxxx"<br> MS-CHAP-Challenge = 0x059b04af3b71d9387b15f96b14a7a4c2<br>
MS-CHAP2-Response = 0x77005d91d477265941c389c2b9f9372a1a5000000000000000003459aea6d0b65a6173735fa334560fb0bb2190a33f9b3b88<br> FreeRADIUS-Proxied-To = 127.0.0.1<br>[ttls] Sending tunneled request<br> User-Name = "xxxxxxxx"<br>
MS-CHAP-Challenge = 0x059b04af3b71d9387b15f96b14a7a4c2<br> MS-CHAP2-Response = 0x77005d91d477265941c389c2b9f9372a1a5000000000000000003459aea6d0b65a6173735fa334560fb0bb2190a33f9b3b88<br> FreeRADIUS-Proxied-To = 127.0.0.1<br>
NAS-Port-Type = Wireless-802.11<br> Calling-Station-Id = "02-00-00-00-00-01"<br> Connect-Info = "CONNECT 11Mbps 802.11b"<br> NAS-IP-Address = 127.0.0.1<br> Framed-MTU = 1400<br>server inner-tunnel {<br>
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel<br>+- entering group authorize {...}<br>++[chap] returns noop<br>[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'<br>
++[mschap] returns ok<br>[suffix] No '@' in User-Name = "xxxxxxxx", looking up realm NULL<br>[suffix] No such realm "NULL"<br>++[suffix] returns noop<br>++[control] returns noop<br>[eap] No EAP-Message, not doing EAP<br>
++[eap] returns noop<br>rlm_perl: Added pair NAS-Port-Type = Wireless-802.11<br>rlm_perl: Added pair Calling-Station-Id = 02-00-00-00-00-01<br>rlm_perl: Added pair FreeRADIUS-Proxied-To = 127.0.0.1<br>rlm_perl: Added pair MS-CHAP-Challenge = 0x059b04af3b71d9387b15f96b14a7a4c2<br>
rlm_perl: Added pair User-Name = xxxxxxxx<br>rlm_perl: Added pair MS-CHAP2-Response = 0x77005d91d477265941c389c2b9f9372a1a5000000000000000003459aea6d0b65a6173735fa334560fb0bb2190a33f9b3b88<br>rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b<br>
rlm_perl: Added pair NAS-IP-Address = 127.0.0.1<br>rlm_perl: Added pair Framed-MTU = 1400<br>rlm_perl: Added pair Auth-Type = MSCHAP<br>rlm_perl: Added pair Proxy-To-Realm = LOCAL<br>++[perl] returns ok<br>++[files] returns noop<br>
[ldap] performing user authorization for xxxxxxxx<br>[ldap] expand: %{Stripped-User-Name} -> <br>[ldap] ... expanding second conditional<br>[ldap] expand: %{User-Name} -> xxxxxxxx<br>[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=xxxxxxxx)<br>
[ldap] expand: dc=example,dc=com -> dc=example,dc=com<br> [ldap] ldap_get_conn: Checking Id: 0<br> [ldap] ldap_get_conn: Got Id: 0<br> [ldap] performing search in dc=example,dc=com, with filter (uid=xxxxxxxx)<br>
[ldap] object not found<br>[ldap] search failed<br> [ldap] ldap_release_conn: Release Id: 0<br>++[ldap] returns notfound<br>++[pap] returns noop<br>Found Auth-Type = MSCHAP<br># Executing group from file /etc/freeradius/sites-enabled/inner-tunnel<br>
+- entering group MS-CHAP {...}<br>[mschap] No Cleartext-Password configured. Cannot create LM-Password.<br>[mschap] No Cleartext-Password configured. Cannot create NT-Password.<br>[mschap] Creating challenge hash with username: xxxxxxxx<br>
[mschap] Told to do MS-CHAPv2 for xxxxxxxx with NT-Password<br>[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.<br><span style="color:rgb(255,0,0)"><b>[mschap] FAILED: MS-CHAP2-Response is incorrect<br>
++[mschap] returns reject<br>Failed to authenticate the user.<br>} # server inner-tunnel<br>[ttls] Got tunneled reply code 3<br> MS-CHAP-Error = "wE=691 R=1"<br>[ttls] Got tunneled Access-Reject<br>[eap] Handler failed in EAP/ttls<br>
[eap] Failed in EAP select<br>++[eap] returns invalid<br>Failed to authenticate the user.</b></span><br>Using Post-Auth-Type Reject<br># Executing group from file /etc/freeradius/sites-enabled/default<br>+- entering group REJECT {...}<br>
[attr_filter.access_reject] expand: %{User-Name} -> xxxxxxxx<br> attr_filter: Matched entry DEFAULT at line 11<br>++[attr_filter.access_reject] returns updated<br>Delaying reject of request 4 for 1 seconds<br>Going to the next request<br>
Waking up in 0.2 seconds.<br>Sending delayed reject for request 4<br>Sending Access-Reject of id 4 to 127.0.0.1 port 45673<br> EAP-Message = 0x04040004<br> Message-Authenticator = 0x00000000000000000000000000000000<br>
Waking up in 3.9 seconds.<br>Cleaning up request 0 ID 0 with timestamp +2<br>Cleaning up request 1 ID 1 with timestamp +3<br>Cleaning up request 2 ID 2 with timestamp +3<br>Cleaning up request 3 ID 3 with timestamp +3<br>
Waking up in 1.0 seconds.<br>Cleaning up request 4 ID 4 with timestamp +3<br>Ready to process requests.<br><br>Thanks and best regards,<br>Nand.<br>