<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 10/08/2014 12:29 PM,
<a class="moz-txt-link-abbreviated" href="mailto:A.L.M.Buxey@lboro.ac.uk">A.L.M.Buxey@lboro.ac.uk</a> wrote:<br>
</div>
<blockquote cite="mid:20141008092911.GA9889@lboro.ac.uk" type="cite">
<pre wrap="">Hi,
</pre>
<blockquote type="cite">
<pre wrap="">Could someone give me advices or info why it happened?
stages how eap-md5 should work in innner-tunnel?
I saw <a class="moz-txt-link-freetext" href="http://wiki.freeradius.org/guide/EAPMD5-HOWTO">http://wiki.freeradius.org/guide/EAPMD5-HOWTO</a> but it's not
enough in my scenario.
</pre>
</blockquote>
<pre wrap="">
radiusd -X form the start, not just the bit you feel like cheers :-)
alan
</pre>
</blockquote>
ok, full radiusd -X<br>
<br>
<i><span style="text-align: left;">Received Access-Request Id 177
from 127.0.0.1:53526 to 127.0.0.1:1812 length 152<br>
User-Name = '<a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a>'<br>
NAS-Port-Type = Virtual<br>
Service-Type = Framed-User<br>
NAS-Port = 72<br>
NAS-Port-Id = 'rw-eap'<br>
NAS-IP-Address = 10.20.9.12<br>
Called-Station-Id = '10.20.9.12[4500]'<br>
Calling-Station-Id = '10.20.9.8[4500]'<br>
EAP-Message = 0x02000012017374754073756d69782e636f6d<br>
NAS-Identifier = 'strongSwan'<br>
Message-Authenticator = 0x41257dcc2d17ce493aa3b9e17e8d1171<br>
(0) Received Access-Request packet from host 127.0.0.1 port
53526, id=177, length=152<br>
(0) User-Name = '<a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a>'<br>
(0) NAS-Port-Type = Virtual<br>
(0) Service-Type = Framed-User<br>
(0) NAS-Port = 72<br>
(0) NAS-Port-Id = 'rw-eap'<br>
(0) NAS-IP-Address = 10.20.9.12<br>
(0) Called-Station-Id = '10.20.9.12[4500]'<br>
(0) Calling-Station-Id = '10.20.9.8[4500]'<br>
(0) EAP-Message = 0x02000012017374754073756d69782e636f6d<br>
(0) NAS-Identifier = 'strongSwan'<br>
(0) Message-Authenticator =
0x41257dcc2d17ce493aa3b9e17e8d1171<br>
(0) # Executing section authorize from file
/etc/raddb/sites-enabled/default<br>
(0) authorize {<br>
(0) suffix : Checking for suffix after "@"<br>
(0) suffix : Looking up realm "sumix.com" for User-Name =
<a class="moz-txt-link-rfc2396E" href="mailto:stu@sumix.com">"stu@sumix.com"</a><br>
(0) suffix : Found realm "sumix.com"<br>
(0) suffix : Adding Stripped-User-Name = "stu"<br>
(0) suffix : Adding Realm = "sumix.com"<br>
(0) suffix : Authentication realm is LOCAL<br>
(0) [suffix] = ok<br>
(0) eap : Peer sent code Response (2) ID 0 length 18<br>
(0) eap : EAP-Identity reply, returning 'ok' so we can
short-circuit the rest of authorize<br>
(0) [eap] = ok<br>
(0) } # authorize = ok<br>
(0) Found Auth-Type = EAP<br>
(0) # Executing group from file /etc/raddb/sites-enabled/default<br>
(0) authenticate {<br>
(0) eap : Peer sent method Identity (1)<br>
(0) eap : Calling eap_ttls to process EAP data<br>
(0) eap_ttls : Flushing SSL sessions (of #0)<br>
(0) eap_ttls : Initiate<br>
(0) eap_ttls : Start returned 1<br>
(0) eap : New EAP session, adding 'State' attribute to reply
0xb955db71b954ce9f<br>
(0) [eap] = handled<br>
(0) } # authenticate = handled<br>
(0) Sending Access-Challenge packet to host 127.0.0.1 port
53526, id=177, length=0<br>
(0) EAP-Message = 0x010100061520<br>
(0) Message-Authenticator =
0x00000000000000000000000000000000<br>
(0) State = 0xb955db71b954ce9f198457e8e66f50f6<br>
Sending Access-Challenge Id 177 from 127.0.0.1:1812 to
127.0.0.1:53526<br>
EAP-Message = 0x010100061520<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
State = 0xb955db71b954ce9f198457e8e66f50f6<br>
(0) Finished request<br>
Waking up in 0.3 seconds.<br>
Received Access-Request Id 178 from 127.0.0.1:53526 to
127.0.0.1:1812 length 250<br>
User-Name = '<a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a>'<br>
NAS-Port-Type = Virtual<br>
Service-Type = Framed-User<br>
NAS-Port = 72<br>
NAS-Port-Id = 'rw-eap'<br>
NAS-IP-Address = 10.20.9.12<br>
Called-Station-Id = '10.20.9.12[4500]'<br>
Calling-Station-Id = '10.20.9.8[4500]'<br>
EAP-Message =
0x0201006215800000005816030300530100004f0303543504e19f976a5871b17461d745bee0aa23d75a49a7d9a7b4fcdbe0158eac28000014003300670039006b0016002f003c0035003d000a01000012000d000e000c040105010601030102010101<br>
NAS-Identifier = 'strongSwan'<br>
State = 0xb955db71b954ce9f198457e8e66f50f6<br>
Message-Authenticator = 0x8da8b4a05292ef97b74e152d1b4d8b83<br>
(1) Received Access-Request packet from host 127.0.0.1 port
53526, id=178, length=250<br>
(1) User-Name = '<a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a>'<br>
(1) NAS-Port-Type = Virtual<br>
(1) Service-Type = Framed-User<br>
(1) NAS-Port = 72<br>
(1) NAS-Port-Id = 'rw-eap'<br>
(1) NAS-IP-Address = 10.20.9.12<br>
(1) Called-Station-Id = '10.20.9.12[4500]'<br>
(1) Calling-Station-Id = '10.20.9.8[4500]'<br>
(1) EAP-Message =
0x0201006215800000005816030300530100004f0303543504e19f976a5871b17461d745bee0aa23d75a49a7d9a7b4fcdbe0158eac28000014003300670039006b0016002f003c0035003d000a01000012000d000e000c040105010601030102010101<br>
(1) NAS-Identifier = 'strongSwan'<br>
(1) State = 0xb955db71b954ce9f198457e8e66f50f6<br>
(1) Message-Authenticator =
0x8da8b4a05292ef97b74e152d1b4d8b83<br>
(1) # Executing section authorize from file
/etc/raddb/sites-enabled/default<br>
(1) authorize {<br>
(1) suffix : Checking for suffix after "@"<br>
(1) suffix : Looking up realm "sumix.com" for User-Name =
<a class="moz-txt-link-rfc2396E" href="mailto:stu@sumix.com">"stu@sumix.com"</a><br>
(1) suffix : Found realm "sumix.com"<br>
(1) suffix : Adding Stripped-User-Name = "stu"<br>
(1) suffix : Adding Realm = "sumix.com"<br>
(1) suffix : Authentication realm is LOCAL<br>
(1) [suffix] = ok<br>
(1) eap : Peer sent code Response (2) ID 1 length 98<br>
(1) eap : Continuing tunnel setup<br>
(1) [eap] = ok<br>
(1) } # authorize = ok<br>
(1) Found Auth-Type = EAP<br>
(1) # Executing group from file /etc/raddb/sites-enabled/default<br>
(1) authenticate {<br>
(1) eap : Expiring EAP session with state 0xb955db71b954ce9f<br>
(1) eap : Finished EAP session with state 0xb955db71b954ce9f<br>
(1) eap : Previous EAP request found for state
0xb955db71b954ce9f, released from the list<br>
(1) eap : Peer sent method TTLS (21)<br>
(1) eap : EAP TTLS (21)<br>
(1) eap : Calling eap_ttls to process EAP data<br>
(1) eap_ttls : Authenticate<br>
(1) eap_ttls : processing EAP-TLS<br>
TLS Length 88<br>
(1) eap_ttls : Length Included<br>
(1) eap_ttls : eaptls_verify returned 11 <br>
(1) eap_ttls : (other): before/accept initialization<br>
(1) eap_ttls : TLS_accept: before/accept initialization<br>
(1) eap_ttls : <<< TLS 1.0 Handshake [length 0053],
ClientHello <br>
(1) eap_ttls : TLS_accept: SSLv3 read client hello A<br>
(1) eap_ttls : >>> TLS 1.0 Handshake [length 004a],
ServerHello <br>
(1) eap_ttls : TLS_accept: SSLv3 write server hello A<br>
(1) eap_ttls : >>> TLS 1.0 Handshake [length 03d3],
Certificate <br>
(1) eap_ttls : TLS_accept: SSLv3 write certificate A<br>
(1) eap_ttls : >>> TLS 1.0 Handshake [length 020d],
ServerKeyExchange <br>
(1) eap_ttls : TLS_accept: SSLv3 write key exchange A<br>
(1) eap_ttls : >>> TLS 1.0 Handshake [length 0004],
ServerHelloDone <br>
(1) eap_ttls : TLS_accept: SSLv3 write server done A<br>
(1) eap_ttls : TLS_accept: SSLv3 flush data<br>
(1) eap_ttls : TLS_accept: Need to read more data: SSLv3 read
client certificate A<br>
In SSL Handshake Phase <br>
In SSL Accept mode <br>
(1) eap_ttls : eaptls_process returned 13 <br>
(1) eap : New EAP session, adding 'State' attribute to reply
0xb955db71b857ce9f<br>
(1) [eap] = handled<br>
(1) } # authenticate = handled<br>
(1) Sending Access-Challenge packet to host 127.0.0.1 port
53526, id=178, length=0<br>
(1) EAP-Message =
0x010203ec15c000000642160301004a020000460301543504e1248026fe90c4f1d4c591f06203871a3dca3d7c2abde9d88ff89ffce220ca08d8b5178eaffc349e3972b298a27b98df16b1832e503c5390ab0d4f712a6600330016030103d30b0003cf0003cc0003c9308203c5308202ada003020102020101300d06092a864886f70d0101050500308186310b3009060355040613025541310f300d06035504081306526164697573310d300b060355040713044b69657631133011060355040a130a53756d697820496e632e311c301a06092a864886f70d010901160d6161654073756d69782e636f6d312430220603550403131b53756d697820436572746966696361746520417574686f72697479301e170d3134313030333039353734355a170d3134313230323039353734355a3074310b3009060355040613025541310f300d0603550408130652616469757331133011060355040a130a53756d697820496e632e3121301f0603550403131853756d697820536572766572204365727469666963617465311c301a06092a864886f70d010901160d6161654073756d69782e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100a653008d510c3ae6faa5cae07b04988d706e8b3cbafb56659636501675bef7639fea37e28e1406
89aca254
f
066197b82<br>
(1) Message-Authenticator =
0x00000000000000000000000000000000<br>
(1) State = 0xb955db71b857ce9f198457e8e66f50f6<br>
Sending Access-Challenge Id 178 from 127.0.0.1:1812 to
127.0.0.1:53526<br>
EAP-Message =
0x010203ec15c000000642160301004a020000460301543504e1248026fe90c4f1d4c591f06203871a3dca3d7c2abde9d88ff89ffce220ca08d8b5178eaffc349e3972b298a27b98df16b1832e503c5390ab0d4f712a6600330016030103d30b0003cf0003cc0003c9308203c5308202ada003020102020101300d06092a864886f70d0101050500308186310b3009060355040613025541310f300d06035504081306526164697573310d300b060355040713044b69657631133011060355040a130a53756d697820496e632e311c301a06092a864886f70d010901160d6161654073756d69782e636f6d312430220603550403131b53756d697820436572746966696361746520417574686f72697479301e170d3134313030333039353734355a170d3134313230323039353734355a3074310b3009060355040613025541310f300d0603550408130652616469757331133011060355040a130a53756d697820496e632e3121301f0603550403131853756d697820536572766572204365727469666963617465311c301a06092a864886f70d010901160d6161654073756d69782e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100a653008d510c3ae6faa5cae07b04988d706e8b3cbafb56659636501675bef7639fea37e28e1406
89aca254
f
066197b8<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
State = 0xb955db71b857ce9f198457e8e66f50f6<br>
(1) Finished request<br>
Waking up in 0.2 seconds.<br>
Received Access-Request Id 179 from 127.0.0.1:53526 to
127.0.0.1:1812 length 158<br>
User-Name = '<a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a>'<br>
NAS-Port-Type = Virtual<br>
Service-Type = Framed-User<br>
NAS-Port = 72<br>
NAS-Port-Id = 'rw-eap'<br>
NAS-IP-Address = 10.20.9.12<br>
Called-Station-Id = '10.20.9.12[4500]'<br>
Calling-Station-Id = '10.20.9.8[4500]'<br>
EAP-Message = 0x020200061500<br>
NAS-Identifier = 'strongSwan'<br>
State = 0xb955db71b857ce9f198457e8e66f50f6<br>
Message-Authenticator = 0xd836132a96421a71b12b25b882f44065<br>
(2) Received Access-Request packet from host 127.0.0.1 port
53526, id=179, length=158<br>
(2) User-Name = '<a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a>'<br>
(2) NAS-Port-Type = Virtual<br>
(2) Service-Type = Framed-User<br>
(2) NAS-Port = 72<br>
(2) NAS-Port-Id = 'rw-eap'<br>
(2) NAS-IP-Address = 10.20.9.12<br>
(2) Called-Station-Id = '10.20.9.12[4500]'<br>
(2) Calling-Station-Id = '10.20.9.8[4500]'<br>
(2) EAP-Message = 0x020200061500<br>
(2) NAS-Identifier = 'strongSwan'<br>
(2) State = 0xb955db71b857ce9f198457e8e66f50f6<br>
(2) Message-Authenticator =
0xd836132a96421a71b12b25b882f44065<br>
(2) # Executing section authorize from file
/etc/raddb/sites-enabled/default<br>
(2) authorize {<br>
(2) suffix : Checking for suffix after "@"<br>
(2) suffix : Looking up realm "sumix.com" for User-Name =
<a class="moz-txt-link-rfc2396E" href="mailto:stu@sumix.com">"stu@sumix.com"</a><br>
(2) suffix : Found realm "sumix.com"<br>
(2) suffix : Adding Stripped-User-Name = "stu"<br>
(2) suffix : Adding Realm = "sumix.com"<br>
(2) suffix : Authentication realm is LOCAL<br>
(2) [suffix] = ok<br>
(2) eap : Peer sent code Response (2) ID 2 length 6<br>
(2) eap : Continuing tunnel setup<br>
(2) [eap] = ok<br>
(2) } # authorize = ok<br>
(2) Found Auth-Type = EAP<br>
(2) # Executing group from file /etc/raddb/sites-enabled/default<br>
(2) authenticate {<br>
(2) eap : Expiring EAP session with state 0xb955db71b857ce9f<br>
(2) eap : Finished EAP session with state 0xb955db71b857ce9f<br>
(2) eap : Previous EAP request found for state
0xb955db71b857ce9f, released from the list<br>
(2) eap : Peer sent method TTLS (21)<br>
(2) eap : EAP TTLS (21)<br>
(2) eap : Calling eap_ttls to process EAP data<br>
(2) eap_ttls : Authenticate<br>
(2) eap_ttls : processing EAP-TLS<br>
(2) eap_ttls : Received TLS ACK<br>
(2) eap_ttls : Received TLS ACK<br>
(2) eap_ttls : ACK handshake fragment handler<br>
(2) eap_ttls : eaptls_verify returned 1 <br>
(2) eap_ttls : eaptls_process returned 13 <br>
(2) eap : New EAP session, adding 'State' attribute to reply
0xb955db71bb56ce9f<br>
(2) [eap] = handled<br>
(2) } # authenticate = handled<br>
(2) Sending Access-Challenge packet to host 127.0.0.1 port
53526, id=179, length=0<br>
(2) EAP-Message =
0x0103026a158000000642a317ffccd0776df5b7990707c6d71d5e030585c85de43d46b15139605c315ea7cf2ca3022e854a0bbb38dd9539c81dccb967b27a8e84bb0f21e80ce6ec67dd3ce528ac4044160301020d0c0002090080cc92e713074cdd998fce384c110ab6cf8d0ec5073be9131aaae92c6999d1ab5798081c90c3d16d5fc8c26ab41df81d579b89f90490f677c682316e55ff727c41155071985ba46207506faeef575064dc075d40848087a92ff39cb130829cd918ed7c1db61a5b7340b218e50859d8139cbc177b15584096baaaf6ed3154cc716b0001020080a01ca6515cfdffd22e3dca3c806c8a7efb59fd0a9572c5edd89fc49a8857d876d04789f5c735b02b544341ff15cb5a2ddbd1758071c0457fcba7ccd8dad4aeb09c9c913dbe760d40b8dc2672f4ccea49e4445c5a934da63e279778a1c301bbbaf6414e1f9bde5a410e7f6b0b589b2c3bdce079d2eb6b00aa30b7e82fe36c3ec8010057d203bb32ac0231e9e2fc97d90c8ba0a9887074b20ef7e6f24647b2a759d1e11d2d25df6e737bd29fd37f8b260231c214e0de64da92a03eca99c1f40403f0e062cf99ec25ab20a41f7449e49e1ce50fc5685471e3429ec315375556766ff304f01f1f884925e6e4b2036dd56a3a0ca35bd89f4a87d6b4da6c0f74198413e92eee6f4625a8f69d80176bd9dcfc
33016a20
c
920a646e8<br>
(2) Message-Authenticator =
0x00000000000000000000000000000000<br>
(2) State = 0xb955db71bb56ce9f198457e8e66f50f6<br>
Sending Access-Challenge Id 179 from 127.0.0.1:1812 to
127.0.0.1:53526<br>
EAP-Message =
0x0103026a158000000642a317ffccd0776df5b7990707c6d71d5e030585c85de43d46b15139605c315ea7cf2ca3022e854a0bbb38dd9539c81dccb967b27a8e84bb0f21e80ce6ec67dd3ce528ac4044160301020d0c0002090080cc92e713074cdd998fce384c110ab6cf8d0ec5073be9131aaae92c6999d1ab5798081c90c3d16d5fc8c26ab41df81d579b89f90490f677c682316e55ff727c41155071985ba46207506faeef575064dc075d40848087a92ff39cb130829cd918ed7c1db61a5b7340b218e50859d8139cbc177b15584096baaaf6ed3154cc716b0001020080a01ca6515cfdffd22e3dca3c806c8a7efb59fd0a9572c5edd89fc49a8857d876d04789f5c735b02b544341ff15cb5a2ddbd1758071c0457fcba7ccd8dad4aeb09c9c913dbe760d40b8dc2672f4ccea49e4445c5a934da63e279778a1c301bbbaf6414e1f9bde5a410e7f6b0b589b2c3bdce079d2eb6b00aa30b7e82fe36c3ec8010057d203bb32ac0231e9e2fc97d90c8ba0a9887074b20ef7e6f24647b2a759d1e11d2d25df6e737bd29fd37f8b260231c214e0de64da92a03eca99c1f40403f0e062cf99ec25ab20a41f7449e49e1ce50fc5685471e3429ec315375556766ff304f01f1f884925e6e4b2036dd56a3a0ca35bd89f4a87d6b4da6c0f74198413e92eee6f4625a8f69d80176bd9dcfc
33016a20
c
920a646e<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
State = 0xb955db71bb56ce9f198457e8e66f50f6<br>
(2) Finished request<br>
Waking up in 0.2 seconds.<br>
Received Access-Request Id 180 from 127.0.0.1:53526 to
127.0.0.1:1812 length 360<br>
User-Name = '<a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a>'<br>
NAS-Port-Type = Virtual<br>
Service-Type = Framed-User<br>
NAS-Port = 72<br>
NAS-Port-Id = 'rw-eap'<br>
NAS-IP-Address = 10.20.9.12<br>
Called-Station-Id = '10.20.9.12[4500]'<br>
Calling-Station-Id = '10.20.9.8[4500]'<br>
EAP-Message =
0x020300d01580000000c616030100861000008200801bbd376230baee45d7adf7ef3b8ff4125a18d8f43e3df9de7f0ecc721f3e5edb817b914d9df8d8225faa5d48c9374ed312c267b3f7be35eeead2379c94dbb5783f9067c38c65ea0b7dcaea5ca15004d65f250e9b2931f247c5980f2af6e6456845a498faa147e5783de8ae82cde42a1e266223e12fff018148473e323cd7d11114030100010116030100301a532b83c967341b29452202cc5e22a8883f2b8edb7fa17866f93bef78f59a27378085cdb4ba9f10b16a831f9d6451e2<br>
NAS-Identifier = 'strongSwan'<br>
State = 0xb955db71bb56ce9f198457e8e66f50f6<br>
Message-Authenticator = 0x4ca4d4427eb4a0f4fa21d953d65b6490<br>
(3) Received Access-Request packet from host 127.0.0.1 port
53526, id=180, length=360<br>
(3) User-Name = '<a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a>'<br>
(3) NAS-Port-Type = Virtual<br>
(3) Service-Type = Framed-User<br>
(3) NAS-Port = 72<br>
(3) NAS-Port-Id = 'rw-eap'<br>
(3) NAS-IP-Address = 10.20.9.12<br>
(3) Called-Station-Id = '10.20.9.12[4500]'<br>
(3) Calling-Station-Id = '10.20.9.8[4500]'<br>
(3) EAP-Message =
0x020300d01580000000c616030100861000008200801bbd376230baee45d7adf7ef3b8ff4125a18d8f43e3df9de7f0ecc721f3e5edb817b914d9df8d8225faa5d48c9374ed312c267b3f7be35eeead2379c94dbb5783f9067c38c65ea0b7dcaea5ca15004d65f250e9b2931f247c5980f2af6e6456845a498faa147e5783de8ae82cde42a1e266223e12fff018148473e323cd7d11114030100010116030100301a532b83c967341b29452202cc5e22a8883f2b8edb7fa17866f93bef78f59a27378085cdb4ba9f10b16a831f9d6451e2<br>
(3) NAS-Identifier = 'strongSwan'<br>
(3) State = 0xb955db71bb56ce9f198457e8e66f50f6<br>
(3) Message-Authenticator =
0x4ca4d4427eb4a0f4fa21d953d65b6490<br>
(3) # Executing section authorize from file
/etc/raddb/sites-enabled/default<br>
(3) authorize {<br>
(3) suffix : Checking for suffix after "@"<br>
(3) suffix : Looking up realm "sumix.com" for User-Name =
<a class="moz-txt-link-rfc2396E" href="mailto:stu@sumix.com">"stu@sumix.com"</a><br>
(3) suffix : Found realm "sumix.com"<br>
(3) suffix : Adding Stripped-User-Name = "stu"<br>
(3) suffix : Adding Realm = "sumix.com"<br>
(3) suffix : Authentication realm is LOCAL<br>
(3) [suffix] = ok<br>
(3) eap : Peer sent code Response (2) ID 3 length 208<br>
(3) eap : Continuing tunnel setup<br>
(3) [eap] = ok<br>
(3) } # authorize = ok<br>
(3) Found Auth-Type = EAP<br>
(3) # Executing group from file /etc/raddb/sites-enabled/default<br>
(3) authenticate {<br>
(3) eap : Expiring EAP session with state 0xb955db71bb56ce9f<br>
(3) eap : Finished EAP session with state 0xb955db71bb56ce9f<br>
(3) eap : Previous EAP request found for state
0xb955db71bb56ce9f, released from the list<br>
(3) eap : Peer sent method TTLS (21)<br>
(3) eap : EAP TTLS (21)<br>
(3) eap : Calling eap_ttls to process EAP data<br>
(3) eap_ttls : Authenticate<br>
(3) eap_ttls : processing EAP-TLS<br>
TLS Length 198<br>
(3) eap_ttls : Length Included<br>
(3) eap_ttls : eaptls_verify returned 11 <br>
(3) eap_ttls : <<< TLS 1.0 Handshake [length 0086],
ClientKeyExchange <br>
(3) eap_ttls : TLS_accept: SSLv3 read client key exchange A<br>
(3) eap_ttls : <<< TLS 1.0 ChangeCipherSpec [length
0001] <br>
(3) eap_ttls : <<< TLS 1.0 Handshake [length 0010],
Finished <br>
(3) eap_ttls : TLS_accept: SSLv3 read finished A<br>
(3) eap_ttls : >>> TLS 1.0 ChangeCipherSpec [length
0001] <br>
(3) eap_ttls : TLS_accept: SSLv3 write change cipher spec A<br>
(3) eap_ttls : >>> TLS 1.0 Handshake [length 0010],
Finished <br>
(3) eap_ttls : TLS_accept: SSLv3 write finished A<br>
(3) eap_ttls : TLS_accept: SSLv3 flush data<br>
SSL: adding session
ca08d8b5178eaffc349e3972b298a27b98df16b1832e503c5390ab0d4f712a66
to cache<br>
(3) eap_ttls : (other): SSL negotiation finished successfully<br>
SSL Connection Established <br>
(3) eap_ttls : eaptls_process returned 13 <br>
(3) eap : New EAP session, adding 'State' attribute to reply
0xb955db71ba51ce9f<br>
(3) [eap] = handled<br>
(3) } # authenticate = handled<br>
(3) Sending Access-Challenge packet to host 127.0.0.1 port
53526, id=180, length=0<br>
(3) EAP-Message =
0x0104004515800000003b1403010001011603010030605b0355d43aa174d8372a38a8f8fbe4e1cc4a1c76f985aa4c1a733db1cbe6fe7049a1836fc4f4ca7a979b6bcf33d46f<br>
(3) Message-Authenticator =
0x00000000000000000000000000000000<br>
(3) State = 0xb955db71ba51ce9f198457e8e66f50f6<br>
Sending Access-Challenge Id 180 from 127.0.0.1:1812 to
127.0.0.1:53526<br>
EAP-Message =
0x0104004515800000003b1403010001011603010030605b0355d43aa174d8372a38a8f8fbe4e1cc4a1c76f985aa4c1a733db1cbe6fe7049a1836fc4f4ca7a979b6bcf33d46f<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
State = 0xb955db71ba51ce9f198457e8e66f50f6<br>
(3) Finished request<br>
Waking up in 0.2 seconds.<br>
Received Access-Request Id 181 from 127.0.0.1:53526 to
127.0.0.1:1812 length 231<br>
User-Name = '<a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a>'<br>
NAS-Port-Type = Virtual<br>
Service-Type = Framed-User<br>
NAS-Port = 72<br>
NAS-Port-Id = 'rw-eap'<br>
NAS-IP-Address = 10.20.9.12<br>
Called-Station-Id = '10.20.9.12[4500]'<br>
Calling-Station-Id = '10.20.9.8[4500]'<br>
EAP-Message =
0x0204004f15800000004517030100405cd863f406852d3aa4401fc49c497b6ea8a891fbea3b414c2c879efa53a1f75168988f9d8fe07378a162dff2b94b19d09e6341226d0e9eb418fff84f52bc0695<br>
NAS-Identifier = 'strongSwan'<br>
State = 0xb955db71ba51ce9f198457e8e66f50f6<br>
Message-Authenticator = 0xceec60943d84e141d8ac64ac4fff3ab3<br>
(4) Received Access-Request packet from host 127.0.0.1 port
53526, id=181, length=231<br>
(4) User-Name = '<a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a>'<br>
(4) NAS-Port-Type = Virtual<br>
(4) Service-Type = Framed-User<br>
(4) NAS-Port = 72<br>
(4) NAS-Port-Id = 'rw-eap'<br>
(4) NAS-IP-Address = 10.20.9.12<br>
(4) Called-Station-Id = '10.20.9.12[4500]'<br>
(4) Calling-Station-Id = '10.20.9.8[4500]'<br>
(4) EAP-Message =
0x0204004f15800000004517030100405cd863f406852d3aa4401fc49c497b6ea8a891fbea3b414c2c879efa53a1f75168988f9d8fe07378a162dff2b94b19d09e6341226d0e9eb418fff84f52bc0695<br>
(4) NAS-Identifier = 'strongSwan'<br>
(4) State = 0xb955db71ba51ce9f198457e8e66f50f6<br>
(4) Message-Authenticator =
0xceec60943d84e141d8ac64ac4fff3ab3<br>
(4) # Executing section authorize from file
/etc/raddb/sites-enabled/default<br>
(4) authorize {<br>
(4) suffix : Checking for suffix after "@"<br>
(4) suffix : Looking up realm "sumix.com" for User-Name =
<a class="moz-txt-link-rfc2396E" href="mailto:stu@sumix.com">"stu@sumix.com"</a><br>
(4) suffix : Found realm "sumix.com"<br>
(4) suffix : Adding Stripped-User-Name = "stu"<br>
(4) suffix : Adding Realm = "sumix.com"<br>
(4) suffix : Authentication realm is LOCAL<br>
(4) [suffix] = ok<br>
(4) eap : Peer sent code Response (2) ID 4 length 79<br>
(4) eap : Continuing tunnel setup<br>
(4) [eap] = ok<br>
(4) } # authorize = ok<br>
(4) Found Auth-Type = EAP<br>
(4) # Executing group from file /etc/raddb/sites-enabled/default<br>
(4) authenticate {<br>
(4) eap : Expiring EAP session with state 0xb955db71ba51ce9f<br>
(4) eap : Finished EAP session with state 0xb955db71ba51ce9f<br>
(4) eap : Previous EAP request found for state
0xb955db71ba51ce9f, released from the list<br>
(4) eap : Peer sent method TTLS (21)<br>
(4) eap : EAP TTLS (21)<br>
(4) eap : Calling eap_ttls to process EAP data<br>
(4) eap_ttls : Authenticate<br>
(4) eap_ttls : processing EAP-TLS<br>
TLS Length 69<br>
(4) eap_ttls : Length Included<br>
(4) eap_ttls : eaptls_verify returned 11 <br>
(4) eap_ttls : eaptls_process returned 7 <br>
(4) eap_ttls : Session established. Proceeding to decode
tunneled attributes<br>
(4) eap_ttls : Got tunneled request<br>
EAP-Message = 0x02000012017374754073756d69782e636f6d<br>
(4) eap_ttls : Got tunneled identity of <a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a><br>
(4) eap_ttls : Setting default EAP type for tunneled EAP
session<br>
(4) eap_ttls : Sending tunneled request<br>
(4) server inner-tunnel {<br>
(4) Request:<br>
EAP-Message = 0x02000012017374754073756d69782e636f6d<br>
User-Name = '<a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a>'<br>
(4) # Executing section authorize from file
/etc/raddb/sites-enabled/inner-tunnel<br>
(4) authorize {<br>
(4) eap : Peer sent code Response (2) ID 0 length 18<br>
(4) eap : EAP-Identity reply, returning 'ok' so we can
short-circuit the rest of authorize<br>
(4) [eap] = ok<br>
(4) } # authorize = ok<br>
(4) Found Auth-Type = EAP<br>
(4) # Executing group from file
/etc/raddb/sites-enabled/inner-tunnel<br>
(4) authenticate {<br>
(4) eap : Peer sent method Identity (1)<br>
(4) eap : Calling eap_md5 to process EAP data<br>
(4) eap_md5 : Issuing MD5 Challenge<br>
(4) eap : New EAP session, adding 'State' attribute to reply
0x2a5805682a59014a<br>
(4) [eap] = handled<br>
(4) } # authenticate = handled<br>
(4) Reply:<br>
EAP-Message = 0x0101001604103a78132fcb2897f6a7f85e8f1359a1b8<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
State = 0x2a5805682a59014a69aedaddefad98a4<br>
(4) } # server inner-tunnel<br>
(4) eap_ttls : Got tunneled Access-Challenge<br>
(4) eap : New EAP session, adding 'State' attribute to reply
0xb955db71bd50ce9f<br>
(4) [eap] = handled<br>
(4) } # authenticate = handled<br>
(4) Sending Access-Challenge packet to host 127.0.0.1 port
53526, id=181, length=0<br>
(4) EAP-Message =
0x0105004f1580000000451703010040390c24d5904b15b8b2b9c01c1b1294a8fec8aebf4f28fccd133148d410760a463a5e11077227b057c6619935cd9f9e9dcc8209f4432c7c5f1518c8f83dc9f4b5<br>
(4) Message-Authenticator =
0x00000000000000000000000000000000<br>
(4) State = 0xb955db71bd50ce9f198457e8e66f50f6<br>
Sending Access-Challenge Id 181 from 127.0.0.1:1812 to
127.0.0.1:53526<br>
EAP-Message =
0x0105004f1580000000451703010040390c24d5904b15b8b2b9c01c1b1294a8fec8aebf4f28fccd133148d410760a463a5e11077227b057c6619935cd9f9e9dcc8209f4432c7c5f1518c8f83dc9f4b5<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
State = 0xb955db71bd50ce9f198457e8e66f50f6<br>
(4) Finished request<br>
Waking up in 0.2 seconds.<br>
Received Access-Request Id 182 from 127.0.0.1:53526 to
127.0.0.1:1812 length 231<br>
User-Name = '<a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a>'<br>
NAS-Port-Type = Virtual<br>
Service-Type = Framed-User<br>
NAS-Port = 72<br>
NAS-Port-Id = 'rw-eap'<br>
NAS-IP-Address = 10.20.9.12<br>
Called-Station-Id = '10.20.9.12[4500]'<br>
Calling-Station-Id = '10.20.9.8[4500]'<br>
EAP-Message =
0x0205004f15800000004517030100405b5acf43e5169c4f2cd97dd4dd54f7e1ba4f1280bb26034f493c6163b40ced9f291017cd305a9ca6a0725b19f534da7f64d243cb9ab6eac01f8a0de9cc179f5d<br>
NAS-Identifier = 'strongSwan'<br>
State = 0xb955db71bd50ce9f198457e8e66f50f6<br>
Message-Authenticator = 0x6c6eafc5e75ae5bb67174d8f0c14c948<br>
(5) Received Access-Request packet from host 127.0.0.1 port
53526, id=182, length=231<br>
(5) User-Name = '<a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a>'<br>
(5) NAS-Port-Type = Virtual<br>
(5) Service-Type = Framed-User<br>
(5) NAS-Port = 72<br>
(5) NAS-Port-Id = 'rw-eap'<br>
(5) NAS-IP-Address = 10.20.9.12<br>
(5) Called-Station-Id = '10.20.9.12[4500]'<br>
(5) Calling-Station-Id = '10.20.9.8[4500]'<br>
(5) EAP-Message =
0x0205004f15800000004517030100405b5acf43e5169c4f2cd97dd4dd54f7e1ba4f1280bb26034f493c6163b40ced9f291017cd305a9ca6a0725b19f534da7f64d243cb9ab6eac01f8a0de9cc179f5d<br>
(5) NAS-Identifier = 'strongSwan'<br>
(5) State = 0xb955db71bd50ce9f198457e8e66f50f6<br>
(5) Message-Authenticator =
0x6c6eafc5e75ae5bb67174d8f0c14c948<br>
(5) # Executing section authorize from file
/etc/raddb/sites-enabled/default<br>
(5) authorize {<br>
(5) suffix : Checking for suffix after "@"<br>
(5) suffix : Looking up realm "sumix.com" for User-Name =
<a class="moz-txt-link-rfc2396E" href="mailto:stu@sumix.com">"stu@sumix.com"</a><br>
(5) suffix : Found realm "sumix.com"<br>
(5) suffix : Adding Stripped-User-Name = "stu"<br>
(5) suffix : Adding Realm = "sumix.com"<br>
(5) suffix : Authentication realm is LOCAL<br>
(5) [suffix] = ok<br>
(5) eap : Peer sent code Response (2) ID 5 length 79<br>
(5) eap : Continuing tunnel setup<br>
(5) [eap] = ok<br>
(5) } # authorize = ok<br>
(5) Found Auth-Type = EAP<br>
(5) # Executing group from file /etc/raddb/sites-enabled/default<br>
(5) authenticate {<br>
(5) eap : Expiring EAP session with state 0x2a5805682a59014a<br>
(5) eap : Finished EAP session with state 0xb955db71bd50ce9f<br>
(5) eap : Previous EAP request found for state
0xb955db71bd50ce9f, released from the list<br>
(5) eap : Peer sent method TTLS (21)<br>
(5) eap : EAP TTLS (21)<br>
(5) eap : Calling eap_ttls to process EAP data<br>
(5) eap_ttls : Authenticate<br>
(5) eap_ttls : processing EAP-TLS<br>
TLS Length 69<br>
(5) eap_ttls : Length Included<br>
(5) eap_ttls : eaptls_verify returned 11 <br>
(5) eap_ttls : eaptls_process returned 7 <br>
(5) eap_ttls : Session established. Proceeding to decode
tunneled attributes<br>
(5) eap_ttls : Got tunneled request<br>
EAP-Message = 0x02010016041074f572db9bcb6f7cc2084efc64d87351<br>
(5) eap_ttls : Sending tunneled request<br>
(5) server inner-tunnel {<br>
(5) Request:<br>
EAP-Message = 0x02010016041074f572db9bcb6f7cc2084efc64d87351<br>
User-Name = '<a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a>'<br>
State = 0x2a5805682a59014a69aedaddefad98a4<br>
(5) # Executing section authorize from file
/etc/raddb/sites-enabled/inner-tunnel<br>
(5) authorize {<br>
(5) eap : Peer sent code Response (2) ID 1 length 22<br>
(5) eap : No EAP Start, assuming it's an on-going EAP
conversation<br>
(5) [eap] = updated<br>
(5) [files] = noop<br>
(5) } # authorize = updated<br>
(5) Found Auth-Type = EAP<br>
(5) # Executing group from file
/etc/raddb/sites-enabled/inner-tunnel<br>
(5) authenticate {<br>
(5) eap : Expiring EAP session with state 0x2a5805682a59014a<br>
(5) eap : Finished EAP session with state 0x2a5805682a59014a<br>
(5) eap : Previous EAP request found for state
0x2a5805682a59014a, released from the list<br>
(5) eap : Peer sent method MD5 (4)<br>
(5) eap : EAP MD5 (4)<br>
(5) eap : Calling eap_md5 to process EAP data<br>
(5) eap_md5 : Cleartext-Password is required for EAP-MD5
authentication<br>
(5) ERROR: eap : Failed continuing EAP MD5 (4) session. EAP
sub-module failed<br>
(5) eap : Failed in EAP select<br>
(5) [eap] = invalid<br>
(5) } # authenticate = invalid<br>
(5) Failed to authenticate the user<br>
(5) Login incorrect (eap: Failed continuing EAP MD5 (4)
session. EAP sub-module failed): [<a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com/">stu@sumix.com/</a><via
Auth-Type = EAP>] (from client aae-vm port 0 via TLS tunnel)<br>
(5) Using Post-Auth-Type Reject<br>
(5) # Executing group from file
/etc/raddb/sites-enabled/inner-tunnel<br>
(5) Post-Auth-Type REJECT {<br>
(5) attr_filter.access_reject : EXPAND %{User-Name}<br>
(5) attr_filter.access_reject : --> <a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a><br>
(5) attr_filter.access_reject : Matched entry DEFAULT at line
11<br>
(5) [attr_filter.access_reject] = updated<br>
(5) } # Post-Auth-Type REJECT = updated<br>
(5) Reply:<br>
EAP-Message = 0x04010004<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
(5) } # server inner-tunnel<br>
(5) eap_ttls : Got tunneled Access-Reject<br>
SSL: Removing session
ca08d8b5178eaffc349e3972b298a27b98df16b1832e503c5390ab0d4f712a66
from the cache<br>
(5) ERROR: eap : Failed continuing EAP TTLS (21) session. EAP
sub-module failed<br>
(5) eap : Failed in EAP select<br>
(5) [eap] = invalid<br>
(5) } # authenticate = invalid<br>
(5) Failed to authenticate the user<br>
(5) Login incorrect (eap: Failed continuing EAP TTLS (21)
session. EAP sub-module failed): [<a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com/">stu@sumix.com/</a><via
Auth-Type = EAP>] (from client aae-vm port 72 cli
10.20.9.8[4500])<br>
(5) Using Post-Auth-Type Reject<br>
(5) # Executing group from file /etc/raddb/sites-enabled/default<br>
(5) Post-Auth-Type REJECT {<br>
(5) attr_filter.access_reject : EXPAND %{User-Name}<br>
(5) attr_filter.access_reject : --> <a class="moz-txt-link-abbreviated" href="mailto:stu@sumix.com">stu@sumix.com</a><br>
(5) attr_filter.access_reject : Matched entry DEFAULT at line
11<br>
(5) [attr_filter.access_reject] = updated<br>
(5) } # Post-Auth-Type REJECT = updated<br>
(5) Delaying response for 1 seconds<br>
Waking up in 0.2 seconds.<br>
Waking up in 0.6 seconds.<br>
(5) Sending delayed response<br>
(5) Sending Access-Reject packet to host 127.0.0.1 port 53526,
id=182, length=0<br>
(5) EAP-Message = 0x04050004<br>
(5) Message-Authenticator =
0x00000000000000000000000000000000<br>
Sending Access-Reject Id 182 from 127.0.0.1:1812 to
127.0.0.1:53526<br>
EAP-Message = 0x04050004<br>
Message-Authenticator = 0x00000000000000000000000000000000<br>
Waking up in 3.9 seconds.<br>
(0) Cleaning up request packet ID 177 with timestamp +7<br>
(1) Cleaning up request packet ID 178 with timestamp +7<br>
(2) Cleaning up request packet ID 179 with timestamp +7<br>
(3) Cleaning up request packet ID 180 with timestamp +7<br>
(4) Cleaning up request packet ID 181 with timestamp +7<br>
(5) Cleaning up request packet ID 182 with timestamp +7<br>
Ready to process requests<br>
<br>
</span></i>
</body>
</html>