February 2008 - Freeradius-Users - lists.freeradius.org

Re: Re: can't get WPA/2 and EAP-TTLS to work
by David Mitton 15 Feb '08

15 Feb '08

1 0

Re: can't get WPA/2 and EAP-TTLS to work
by William Bulley 15 Feb '08

15 Feb '08

According to A.L.M.Buxey(a)lboro.ac.uk: > > from what i can see, rubbish. freeradius as an AAA does not > ask NAs about their VLANs - dynamic or otherwise! there a re > few things wonky or wrong. I didn't think Cisco's VLAN concept was accurate, but I couldn't expect them to know anything about FreeRADIUS... > first , what version of FR are you using exactly? i would STRONGLY > recommend 2.0.2 as 1.1.x (you appear to be 1.1.7 with patches...) > isnt as configurable. I have been following that thread on the list here, and am in the process up upgrading my FreeBSD ports _INCLUDING_ FreeRADIUS, but the 2.0.2 version is not in the FreeBSD ports tree yet (as of 2/14). > secondly > > > foo User-Password == "password" > > foo Cleartext-Password := "password" > > (as clearly in the docs) And just as clearly, I missed that one - yep, thanks. > > Thu Feb 14 08:41:05 2008 : Debug: rlm_eap_tls: add_reply failed to create attribute MS-MPPE-Recv-Key: Unknown attribute > > "MS-MPPE-Recv-Key" > > Thu Feb 14 08:41:05 2008 : Debug: rlm_eap_tls: add_reply failed to create attribute MS-MPPE-Send-Key: Unknown attribute > > "MS-MPPE-Send-Key" > > this aint good. you've got to have these in your TTLS or things arent > going to work. dictionary files all okay and present and loaded? > you arent filtering attributes from my quick scan of the config...unless > you've not copied that part. I commented out the Micro$loth dictionary since I wasn't using anything from Redmond in this setup. I will uncomment this and see what happens. Thanks for all your help. Regards, web... -- William Bulley Email: web(a)umich.edu

1 0

can't get WPA/2 and EAP-TTLS to work
by William Bulley 15 Feb '08

15 Feb '08

The wpa_supplicant keeps looping looking for missing keys accordint to Jouni. I suspected my Cisco access point was not configured properly, but Cisco claims that FreeRADIUS is asking the access point about dynamic VLANs which aren't even configured in FreeRADIUS (see configurations below). +-----------------------------------+ | ThinkPad T42 with D-Link DWL-G660 | | (ath0) on FreeBSD 6.2-STABLE | | running wpa_supplicant 0.4.8 | +-----------------------------------+ ^ 802.1X | WPA/2 EAP-TTLS v +---------------------------------------+ | Cisco 1131AG 802.11a/b/g AP IOS 12.4 | +---------------------------------------+ ^ EAP-TTLS | RADIUS v +-----------------------------------+ | FreeRADIUS 1.1.7_2 on FreeBSD 7.0 | +-----------------------------------+ It almost works in that authentication succeeds (see debug log file output), but the complete 802.1x connection does not succeed, hence the looping behaviour... =*=*=*=*=*=*=*=*=*= wpa_supplicant.conf =*=*=*=*=*=*=*=*=*=*=*=*= ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=0 network={ ssid="testing" bssid=00:xx:yy:yy:zz:zz proto=RSN key_mgmt=WPA-EAP eap=TTLS anonymous_identity="anonymous" identity="foo" password="password" phase2="auth=MD5" } =*=*=*=*=*=*=*=*=*= FreeRADIUS eap.conf =*=*=*=*=*=*=*=*=*=*=*= eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = yes md5 { } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes cipher_list = "DEFAULT" } ttls { default_eap_type = md5 copy_request_to_tunnel = yes use_tunneled_reply = yes } } =*=*=*=*=*=*=*=*=*= FreeRADIUS users =*=*=*=*=*=*=*=*=*=*=*= foo User-Password == "password" =*=*=*=*=*=*=*=*= simplified radiusd.conf =*=*=*=*=*=*=*=*=*=*= [snip] less important stuff omitted [/snip] $INCLUDE ${confdir}/clients.conf $INCLUDE ${confdir}/eap.conf instantiate { } authorize { preprocess auth_log eap files pap } authenticate { Auth-Type PAP { pap } eap } preacct { preprocess acct_unique } accounting { detail } post-auth { reply_log } =*=*=*=*=*=*=*=*= -Xxx debug output snippet =*=*=*=*=*=*=*=*=*= Thu Feb 14 08:41:05 2008 : Debug: Processing the authorize section of radiusd.conf Thu Feb 14 08:41:05 2008 : Debug: modcall: entering group authorize for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall[authorize]: module "preprocess" returns ok for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 6 Thu Feb 14 08:41:05 2008 : Debug: radius_xlat: '/var/log/radacct/www.xxx.yyy.zzz/auth-20080214' Thu Feb 14 08:41:05 2008 : Debug: rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-%Y%m%d expands to /var/log/rada cct/www.xxx.yyy.zzz/auth-20080214 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall[authorize]: module "auth_log" returns ok for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 6 Thu Feb 14 08:41:05 2008 : Debug: rlm_eap: EAP packet type response id 7 length 112 Thu Feb 14 08:41:05 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall[authorize]: module "eap" returns updated for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall[authorize]: module "files" returns notfound for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 6 Thu Feb 14 08:41:05 2008 : Debug: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fai l because of this. Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall[authorize]: module "pap" returns noop for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall: leaving group authorize (returns updated) for request 6 Thu Feb 14 08:41:05 2008 : Debug: rad_check_password: Found Auth-Type EAP Thu Feb 14 08:41:05 2008 : Debug: auth: type "EAP" Thu Feb 14 08:41:05 2008 : Debug: Processing the authenticate section of radiusd.conf Thu Feb 14 08:41:05 2008 : Debug: modcall: entering group authenticate for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 6 Thu Feb 14 08:41:05 2008 : Debug: rlm_eap: Request found, released from the list Thu Feb 14 08:41:05 2008 : Debug: rlm_eap: EAP/ttls Thu Feb 14 08:41:05 2008 : Debug: rlm_eap: processing type ttls Thu Feb 14 08:41:05 2008 : Debug: rlm_eap_ttls: Authenticate Thu Feb 14 08:41:05 2008 : Debug: rlm_eap_tls: processing TLS Thu Feb 14 08:41:05 2008 : Debug: eaptls_verify returned 7 Thu Feb 14 08:41:05 2008 : Debug: rlm_eap_tls: Done initial handshake Thu Feb 14 08:41:05 2008 : Debug: eaptls_process returned 7 Thu Feb 14 08:41:05 2008 : Debug: rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. Thu Feb 14 08:41:05 2008 : Debug: TTLS: Adding old state with 29 1f Thu Feb 14 08:41:05 2008 : Debug: Processing the authorize section of radiusd.conf Thu Feb 14 08:41:05 2008 : Debug: modcall: entering group authorize for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall[authorize]: module "preprocess" returns ok for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 6 Thu Feb 14 08:41:05 2008 : Debug: radius_xlat: '/var/log/radacct/127.0.0.1/auth-20080214' Thu Feb 14 08:41:05 2008 : Debug: rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-%Y%m%d expands to /var/log/rada cct/127.0.0.1/auth-20080214 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall[authorize]: module "auth_log" returns ok for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 6 Thu Feb 14 08:41:05 2008 : Debug: rlm_eap: EAP packet type response id 7 length 22 Thu Feb 14 08:41:05 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall[authorize]: module "eap" returns updated for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 6 Thu Feb 14 08:41:05 2008 : Debug: users: Matched entry foo at line 217 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall[authorize]: module "files" returns ok for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 6 Thu Feb 14 08:41:05 2008 : Debug: rlm_pap: Found existing Auth-Type, not changing it. Thu Feb 14 08:41:05 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall[authorize]: module "pap" returns noop for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall: leaving group authorize (returns updated) for request 6 Thu Feb 14 08:41:05 2008 : Debug: rad_check_password: Found Auth-Type EAP Thu Feb 14 08:41:05 2008 : Debug: auth: type "EAP" Thu Feb 14 08:41:05 2008 : Debug: Processing the authenticate section of radiusd.conf Thu Feb 14 08:41:05 2008 : Debug: modcall: entering group authenticate for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 6 Thu Feb 14 08:41:05 2008 : Debug: rlm_eap: Request found, released from the list Thu Feb 14 08:41:05 2008 : Debug: rlm_eap: EAP/md5 Thu Feb 14 08:41:05 2008 : Debug: rlm_eap: processing type md5 Thu Feb 14 08:41:05 2008 : Debug: rlm_eap: Freeing handler Thu Feb 14 08:41:05 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall[authenticate]: module "eap" returns ok for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall: leaving group authenticate (returns ok) for request 6 Thu Feb 14 08:41:05 2008 : Error: Trying to look up name of unknown client 127.0.0.1. Thu Feb 14 08:41:05 2008 : Auth: Login OK: [foo/<no User-Password attribute>] (from client UNKNOWN-CLIENT port 262 cli 0 0-13-46-C1-7A-01) Thu Feb 14 08:41:05 2008 : Debug: Processing the post-auth section of radiusd.conf Thu Feb 14 08:41:05 2008 : Debug: modcall: entering group post-auth for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[post-auth]: calling reply_log (rlm_detail) for request 6 Thu Feb 14 08:41:05 2008 : Debug: radius_xlat: '/var/log/radacct/127.0.0.1/reply-detail-20080214' Thu Feb 14 08:41:05 2008 : Debug: rlm_detail: /var/log/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/ log/radacct/127.0.0.1/reply-detail-20080214 Thu Feb 14 08:41:05 2008 : Debug: modsingle[post-auth]: returned from reply_log (rlm_detail) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall[post-auth]: module "reply_log" returns ok for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall: leaving group post-auth (returns ok) for request 6 Thu Feb 14 08:41:05 2008 : Debug: TTLS: Got tunneled Access-Accept Thu Feb 14 08:41:05 2008 : Debug: rlm_eap_tls: add_reply failed to create attribute MS-MPPE-Recv-Key: Unknown attribute "MS-MPPE-Recv-Key" Thu Feb 14 08:41:05 2008 : Debug: rlm_eap_tls: add_reply failed to create attribute MS-MPPE-Send-Key: Unknown attribute "MS-MPPE-Send-Key" Thu Feb 14 08:41:05 2008 : Debug: rlm_eap: Freeing handler Thu Feb 14 08:41:05 2008 : Debug: TTLS: Freeing handler for user foo Thu Feb 14 08:41:05 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall[authenticate]: module "eap" returns ok for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall: leaving group authenticate (returns ok) for request 6 Thu Feb 14 08:41:05 2008 : Auth: Login OK: [anonymous/<no User-Password attribute>] (from client hotbox port 2 62 cli 00-xx-yy-yy-zz-zz) Thu Feb 14 08:41:05 2008 : Debug: Processing the post-auth section of radiusd.conf Thu Feb 14 08:41:05 2008 : Debug: modcall: entering group post-auth for request 6 Thu Feb 14 08:41:05 2008 : Debug: modsingle[post-auth]: calling reply_log (rlm_detail) for request 6 Thu Feb 14 08:41:05 2008 : Debug: radius_xlat: '/var/log/radacct/www.xxx.yyy.zzz/reply-detail-20080214' Thu Feb 14 08:41:05 2008 : Debug: rlm_detail: /var/log/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/ log/radacct/www.xxx.yyy.zzz/reply-detail-20080214 Thu Feb 14 08:41:05 2008 : Debug: modsingle[post-auth]: returned from reply_log (rlm_detail) for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall[post-auth]: module "reply_log" returns ok for request 6 Thu Feb 14 08:41:05 2008 : Debug: modcall: leaving group post-auth (returns ok) for request 6 Sending Access-Accept of id 42 to www.xxx.yyy.zzz port 1645 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "foo\000" EAP-Message = 0x03070004 <<<<===== this looks like success [EAP code == 3] Thu Feb 14 08:41:05 2008 : Debug: Finished request 6 Thu Feb 14 08:41:05 2008 : Debug: Going to the next request Thu Feb 14 08:41:05 2008 : Debug: Waking up in 6 seconds... =*=*=*=*=*=*=*=*= Cisco debug log snippet =*=*=*=*=*=*=*=*=*= Feb 14 13:40:56.976: dot11_auth_dot1x_run_rfsm: Executing Action(CLIENT_WAIT,CLIENT_REPLY) for 00xx.yyyy.zzzz Feb 14 13:40:56.976: dot11_auth_dot1x_send_response_to_server: Sending client 00xx.yyyy.zzzz data to server Feb 14 13:40:56.977: dot11_auth_dot1x_send_response_to_server: Started timer server_timeout 60 seconds Feb 14 13:40:56.990: dot11_auth_dot1x_parse_aaa_resp: Received server response: PASS Feb 14 13:40:56.990: dot11_auth_dot1x_parse_aaa_resp: found eap pak in server response Feb 14 13:40:56.990: dot11_auth_server_chk_ssid: Checking for SSID in server attributes Feb 14 13:40:56.990: dot11_auth_server_vlan_number: Checking for VLAN ID in server attributes Feb 14 13:40:56.990: dot11_auth_dot1x_run_rfsm: Executing Action(SERVER_WAIT,SERVER_PASS) for 00xx.yyyy.zzzz Feb 14 13:40:56.990: dot11_auth_dot1x_send_response_to_client: Forwarding server message to client 00xx.yyyy.zzzz Feb 14 13:40:56.990: EAPOL pak dump tx Feb 14 13:40:56.990: EAPOL Version: 0x1 type: 0x0 length: 0x0004 Feb 14 13:40:56.991: EAP code: 0x3 id: 0x7 length: 0x0004 <<<<<===== [EAP success code == 3] 01802DA0: 01000004 03070004 ........ Feb 14 13:40:56.991: dot11_auth_send_msg: sending data to requestor status 1 Feb 14 13:40:56.991: dot11_auth_send_msg: Sending EAPOL to requestor Feb 14 13:40:56.991: dot1x-registry:registry:dot1x_ether_macaddr called Feb 14 13:40:56.991: dot11_auth_dot1x_send_response_to_client: Started timer client_timeout 30 seconds Feb 14 13:40:56.991: dot11_auth_send_msg: sending data to requestor status 2 Feb 14 13:40:56.991: dot11_auth_send_msg: resp->nsk_len 0 resp->auth_key_len 0 Feb 14 13:40:56.992: dot11_auth_send_msg: client authenticated 00xx.yyyy.zzzz, node_type 64 for application 0x1 Feb 14 13:40:56.992: dot11_auth_delete_client_entry: 00xx.yyyy.zzzz is deleted for application 0x1 Feb 14 13:40:56.992: dot1x-registry:registry:dot1x_ether_macaddr called Feb 14 13:40:56.998: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on Dot11Radio0. Feb 14 13:40:56.998: dot1x-packet:dot1x_mgr_process_eapol_pak: queuing an EAPOL pkt on Authenticator Q Feb 14 13:40:57.092: dot1x-registry:registry:dot1x_ether_macaddr called Feb 14 13:40:57.093: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on Dot11Radio0. Feb 14 13:40:57.093: dot1x-packet:dot1x_mgr_process_eapol_pak: queuing an EAPOL pkt on Authenticator Q Feb 14 13:40:57.192: dot1x-registry:registry:dot1x_ether_macaddr called Feb 14 13:40:57.193: dot1x-ev:dot1x_mgr_pre_process_eapol_pak: Role determination not required on Dot11Radio0. Feb 14 13:40:57.193: dot1x-packet:dot1x_mgr_process_eapol_pak: queuing an EAPOL pkt on Authenticator Q Feb 14 08:40:57.292 -0500: %DOT11-7-AUTH_FAILED: Station 00xx.yyyy.zzzz Authentication failed ^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^ Clearly the access point isn't helping here... =*=*=*=*=*=*=*=*=*=*=*=*= wpa_supplicant "-dd" output =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= Initializing interface 'ath0' conf '/etc/wpa_supplicant.conf' driver 'default' ctrl_interface 'N/A' Configuration file '/etc/wpa_supplicant.conf' -> '/etc/wpa_supplicant.conf' Reading configuration file '/etc/wpa_supplicant.conf' ctrl_interface='/var/run/wpa_supplicant' ctrl_interface_group=0 (from group name 'wheel') Line: 7 - start of a new network block ssid - hexdump_ascii(len=7): 74 65 73 74 69 6e 67 testing BSSID - hexdump(len=6): 00 xx xx xx xx xx proto: 0x2 key_mgmt: 0x1 eap methods - hexdump(len=2): 15 00 anonymous_identity - hexdump_ascii(len=9): 61 6e 6f 6e 79 6d 6f 75 73 anonymous identity - hexdump_ascii(len=3): 66 6f 6f foo password - hexdump_ascii(len=8): [REMOVED] phase2 - hexdump_ascii(len=11): 61 75 74 68 65 61 70 3d 4d 44 35 autheap=MD5 Priority group 0 id=0 ssid='testing' Initializing interface (2) 'ath0' EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: KEY_RX entering state NO_KEY_RECEIVE EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED EAPOL: External notification - portEnabled=0 EAPOL: External notification - portValid=0 Own MAC address: 00:xx:xx:xx:xx:xx wpa_driver_bsd_set_wpa: enabled=1 wpa_driver_bsd_set_wpa_internal: wpa=3 privacy=1 wpa_driver_bsd_del_key: keyidx=0 wpa_driver_bsd_del_key: keyidx=1 wpa_driver_bsd_del_key: keyidx=2 wpa_driver_bsd_del_key: keyidx=3 wpa_driver_bsd_set_countermeasures: enabled=0 wpa_driver_bsd_set_drop_unencrypted: enabled=1 Setting scan request: 0 sec 100000 usec Added interface ath0 State: DISCONNECTED -> SCANNING Starting AP scan (broadcast SSID) Received 0 bytes of scan results (7 BSSes) Scan results: 7 Selecting BSS from priority group 0 0: 00:xx:xx:xx:xx:xx ssid='JoesROOM' wpa_ie_len=0 rsn_ie_len=22 caps=0x31 skip - SSID mismatch 1: 00:xx:xx:xx:xx:xx ssid='testing' wpa_ie_len=0 rsn_ie_len=22 caps=0x31 selected based on RSN IE Trying to associate with 00:xx:xx:xx:xx:xx (SSID='testing' freq=2442 MHz) Cancelling scan request WPA: clearing own WPA/RSN IE Automatic auth_alg selection: 0x1 wpa_driver_bsd_set_auth_alg alg 0x1 authmode 1 RSN: using IEEE 802.11i/D9.0 WPA: Selected cipher suites: group 16 pairwise 16 key_mgmt 1 WPA: clearing AP WPA IE WPA: set AP RSN IE - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ac 01 28 00 WPA: using GTK CCMP WPA: using PTK CCMP WPA: using KEY_MGMT 802.1X WPA: Set own WPA IE default - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ac 01 00 00 No keys have been configured - skip key clearing wpa_driver_bsd_set_drop_unencrypted: enabled=1 State: SCANNING -> ASSOCIATING wpa_driver_bsd_associate: ssid 'testing' wpa ie len 22 pairwise 3 group 3 key mgmt 0 wpa_driver_bsd_associate: set PRIVACY 1 Setting authentication timeout: 10 sec 0 usec EAPOL: External notification - portControl=Auto RSN: Ignored PMKID candidate without preauth flag State: ASSOCIATING -> ASSOCIATED Associated to a new BSS: BSSID=00:xx:xx:xx:xx:xx No keys have been configured - skip key clearing Associated with 00:xx:xx:xx:xx:xx WPA: Association event - clear replay counter EAPOL: External notification - portEnabled=0 EAPOL: External notification - portValid=0 EAPOL: External notification - portEnabled=1 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_BE entering state IDLE EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE Setting authentication timeout: 10 sec 0 usec RX EAPOL from 00:xx:xx:xx:xx:xx RX EAPOL - hexdump(len=48): 01 00 00 33 01 01 00 33 01 00 6e 65 74 77 6f 72 6b 69 64 3d 74 65 73 74 69 6e 67 2c 6e 61 73 69 64 3d 63 69 73 63 6f 2c 70 6f 72 74 69 64 3d 30 Setting authentication timeout: 70 sec 0 usec EAPOL: Received EAP-Packet frame EAPOL: SUPP_PAE entering state RESTART EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=1 id=1 EAP: EAP entering state IDENTITY CTRL-EVENT-EAP-STARTED EAP authentication started EAP: EAP-Request Identity data - hexdump_ascii(len=39): 00 6e 65 74 77 6f 72 6b 69 64 3d 74 65 73 74 69 _networkid=testi 6e 67 2c 6e 61 73 69 64 3d 63 69 73 63 6f 2c 70 ng,nasid=cisco,p 6f 72 74 69 64 3d 30 ortid=0 EAP: using anonymous identity - hexdump_ascii(len=9): 61 6e 6f 6e 79 6d 6f 75 73 anonymous EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=18): 01 00 00 18 02 01 00 18 01 61 6e 6f 6e 79 6d 6f 75 73 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:xx:xx:xx:xx:xx RX EAPOL - hexdump(len=46): 01 00 00 06 01 02 00 06 15 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=21 id=2 EAP: EAP entering state GET_METHOD EAP: initialize selected EAP method (21, TTLS) EAP-TTLS: Phase2 type: EAP EAP-TTLS: Phase2 EAP types - hexdump(len=1): 04 CTRL-EVENT-EAP-METHOD EAP method 21 (TTLS) selected EAP: EAP entering state METHOD SSL: Received packet(len=6) - Flags 0x20 EAP-TTLS: Start SSL: (where=0x10 ret=0x1) SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:before/connect initialization SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 write client hello A SSL: (where=0x1002 ret=0xffffffff) SSL: SSL_connect:error in SSLv3 read server hello A SSL: SSL_connect - want more data SSL: 100 bytes pending from ssl_out SSL: 100 bytes left to be sent out (of total 100 bytes) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=110): 01 00 00 6a 02 02 00 6a 15 00 16 03 01 00 5f 01 00 00 5b 03 01 47 a9 b1 f0 85 22 af ea 08 17 80 24 ee a6 61 19 34 ba 99 d9 94 9d 0e b6 d6 31 ff 6b 83 ac f9 a0 00 00 34 00 39 00 38 00 35 00 16 00 13 00 0a 00 33 00 32 00 2f 00 66 00 05 00 04 00 63 00 62 00 61 00 15 00 12 00 09 00 65 00 64 00 60 00 14 00 11 00 08 00 06 00 03 01 00 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:xx:xx:xx:xx:xx RX EAPOL - hexdump(len=1038): [deleted] EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=21 id=3 EAP: EAP entering state METHOD SSL: Received packet(len=1034) - Flags 0xc0 SSL: TLS Message Length: 2126 SSL: Need 1102 bytes more input data SSL: Building ACK EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=10): 01 00 00 06 02 03 00 06 15 00 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:xx:xx:xx:xx:xx RX EAPOL - hexdump(len=1038): [deleted] EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=21 id=4 EAP: EAP entering state METHOD SSL: Received packet(len=1034) - Flags 0xc0 SSL: TLS Message Length: 2126 SSL: Need 78 bytes more input data SSL: Building ACK EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=10): 01 00 00 06 02 04 00 06 15 00 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:xx:xx:xx:xx:xx RX EAPOL - hexdump(len=92): 01 00 00 58 01 05 00 58 15 80 00 00 08 4e 9e 69 96 15 00 d2 3a 5a a5 8a 72 56 25 f3 2e fe 2c 1c ac b1 88 a7 de a7 1d 18 94 5e ac 5a 1e 15 cc c6 3d 2d 98 96 87 4b 1e a6 4e 93 50 33 c5 c0 c0 ac 67 8b bc d3 fc 8d 8f 63 04 21 90 77 06 ec 1e 94 85 b6 a2 16 03 01 00 04 0e 00 00 00 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=21 id=5 EAP: EAP entering state METHOD SSL: Received packet(len=88) - Flags 0x80 SSL: TLS Message Length: 2126 SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 read server hello A SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 read server certificate A SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 read server key exchange A SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 read server done A SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 write client key exchange A SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 write change cipher spec A SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 write finished A SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 flush data SSL: (where=0x1002 ret=0xffffffff) SSL: SSL_connect:error in SSLv3 read finished A SSL: SSL_connect - want more data SSL: 134 bytes pending from ssl_out SSL: 134 bytes left to be sent out (of total 134 bytes) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=144): 01 00 00 8c 02 05 00 8c 15 00 16 03 01 00 46 10 00 00 42 00 40 82 45 b6 b2 83 6a 15 52 cb c1 d8 7c 57 05 4d da aa fd 65 d4 73 2c 86 fd d9 99 12 17 b2 a5 f1 de 68 80 81 6e df dd fc d2 3e 8e 2a fe 72 61 34 55 9d 92 85 3b 21 27 5e 72 e2 bc 2c 7c 21 61 e8 a1 14 03 01 00 01 01 16 03 01 00 30 be 1e 85 a3 09 4b 34 31 17 06 74 06 a8 18 0d 7d 91 08 75 66 9d 19 07 71 b0 2a 55 51 b3 fd 51 d9 41 08 54 c8 7d 7e b6 64 95 7d 28 89 97 18 02 7a EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:xx:xx:xx:xx:xx RX EAPOL - hexdump(len=73): 01 00 00 45 01 06 00 45 15 80 00 00 00 3b 14 03 01 00 01 01 16 03 01 00 30 4d 08 fa 7d 74 55 0c d1 da f0 32 ac f8 71 4e c6 1d a3 17 de de 23 fa 43 9d 09 aa 60 c9 e3 ff 59 c3 98 49 9c e5 54 0e 28 76 8e 25 a1 a7 96 7f 6e EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=21 id=6 EAP: EAP entering state METHOD SSL: Received packet(len=69) - Flags 0x80 SSL: TLS Message Length: 59 SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 read finished A SSL: (where=0x20 ret=0x1) SSL: (where=0x1002 ret=0x1) SSL: 0 bytes pending from ssl_out SSL: No data to be sent out EAP-TTLS: TLS done, proceed to Phase 2 EAP-TTLS: Derived key - hexdump(len=64): [REMOVED] EAP-TTLS: received 0 bytes encrypted data for Phase 2 EAP-TTLS: empty data in beginning of Phase 2 - use fake EAP-Request Identity EAP-TTLS: Phase 2 EAP Request: type=1 EAP: using real identity - hexdump_ascii(len=3): 66 6f 6f foo EAP-TTLS: AVP encapsulate EAP Response - hexdump(len=8): 02 06 00 08 01 66 6f 6f EAP-TTLS: Encrypting Phase 2 data - hexdump(len=16): [REMOVED] EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=100): 01 00 00 60 02 06 00 60 15 00 17 03 01 00 20 b5 05 8a a6 5e 78 16 9e e2 f6 fd 52 6e 86 d6 42 69 36 a7 3f 3b b1 80 12 13 6a 29 7f 91 8a b3 b0 17 03 01 00 30 b8 41 cc 87 65 b4 21 f6 ad b2 9e 1b d8 12 be f1 2f b0 60 ca ac 14 70 61 d6 93 4b 56 e0 de 32 40 4c b5 96 f4 92 08 ae 2b 34 42 63 6c d0 09 a8 f6 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:xx:xx:xx:xx:xx RX EAPOL - hexdump(len=83): 01 00 00 4f 01 07 00 4f 15 80 00 00 00 45 17 03 01 00 40 ea 30 50 29 6d a3 63 42 7f 47 0c 98 01 af 14 f3 f4 44 cc 76 a1 20 7d 85 47 42 de f3 76 16 48 79 ab 95 2d d5 c0 c4 ff 5a 3f 42 1c 6c 04 92 f7 f2 13 b8 12 8b 9b e1 49 d7 c7 4b 9a e2 23 42 60 8b EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=21 id=7 EAP: EAP entering state METHOD SSL: Received packet(len=79) - Flags 0x80 SSL: TLS Message Length: 69 EAP-TTLS: received 69 bytes encrypted data for Phase 2 EAP-TTLS: Decrypted Phase 2 AVPs - hexdump(len=32): 00 00 00 4f 40 00 00 1e 01 07 00 16 04 10 f0 7d 0e 84 ea da c9 80 d7 2b bd f0 76 2f 03 80 00 00 EAP-TTLS: AVP: code=79 flags=0x40 length=30 EAP-TTLS: AVP data - hexdump(len=22): 01 07 00 16 04 10 f0 7d 0e 84 ea da c9 80 d7 2b bd f0 76 2f 03 80 EAP-TTLS: AVP - EAP Message EAP-TTLS: Phase 2 EAP - hexdump(len=22): 01 07 00 16 04 10 f0 7d 0e 84 ea da c9 80 d7 2b bd f0 76 2f 03 80 EAP-TTLS: received Phase 2: code=1 identifier=7 length=22 EAP-TTLS: Phase 2 EAP Request: type=4 EAP-TTLS: Selected Phase 2 EAP method 4 EAP-MD5: Challenge - hexdump(len=16): f0 7d 0e 84 ea da c9 80 d7 2b bd f0 76 2f 03 80 EAP-MD5: generating Challenge Response EAP-MD5: Response - hexdump(len=16): 7a ba fd 26 e7 f0 62 3d c8 87 1d 1c bf 89 28 7e EAP-TTLS: AVP encapsulate EAP Response - hexdump(len=22): 02 07 00 16 04 10 7a ba fd 26 e7 f0 62 3d c8 87 1d 1c bf 89 28 7e EAP-TTLS: Encrypting Phase 2 data - hexdump(len=32): [REMOVED] EAP-TTLS: Authentication completed successfully EAP: method process -> ignore=FALSE methodState=DONE decision=UNCOND_SUCC EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=116): 01 00 00 70 02 07 00 70 15 00 17 03 01 00 20 47 89 49 56 e6 61 64 d4 ef 83 a2 87 80 6a 8c 6d c7 6e 75 75 59 17 1f f4 6b 29 73 25 6b ba dd 9f 17 03 01 00 40 de a7 87 c8 51 85 32 1b 58 6a 2b 40 24 2c 33 52 16 f5 82 40 00 d6 27 5a ca 41 4e 1c d1 99 20 cf 72 28 98 04 5c b6 18 7b f4 e8 86 6c d3 7b d1 ff d8 6a 0e fd d5 ab ad bd 75 08 f8 a8 a7 08 59 54 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:xx:xx:xx:xx:xx RX EAPOL - hexdump(len=46): 01 00 00 04 03 07 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Success EAP: EAP entering state SUCCESS CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully EAPOL: SUPP_BE entering state RECEIVE EAPOL: SUPP_BE entering state SUCCESS EAPOL: SUPP_BE entering state IDLE RX EAPOL from 00:xx:xx:xx:xx:xx RX EAPOL - hexdump(len=121): 02 03 00 75 02 00 8a 00 10 00 00 00 00 00 00 00 01 17 07 47 46 61 66 67 b9 96 02 eb b4 94 ce ed cc c7 33 13 1d 59 bb d6 6e 3b 59 08 ef e9 9c f5 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 42 4e 00 ff 53 4d 42 25 00 00 00 00 00 00 00 00 EAPOL: Ignoring WPA EAPOL-Key frame in EAPOL state machines IEEE 802.1X RX: version=2 type=3 length=117 EAPOL-Key type=2 WPA: RX EAPOL-Key - hexdump(len=121): 02 03 00 75 02 00 8a 00 10 00 00 00 00 00 00 00 01 17 07 47 46 61 66 67 b9 96 02 eb b4 94 ce ed cc c7 33 13 1d 59 bb d6 6e 3b 59 08 ef e9 9c f5 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 42 4e 00 ff 53 4d 42 25 00 00 00 00 00 00 00 00 State: ASSOCIATED -> 4WAY_HANDSHAKE WPA: RX message 1 of 4-Way Handshake from 00:xx:xx:xx:xx:xx (ver=2) RSN: msg 1/4 key data - hexdump(len=22): dd 14 00 0f ac 04 42 4e 00 ff 53 4d 42 25 00 00 00 00 00 00 00 00 RSN: PMKID from Authenticator - hexdump(len=16): 42 4e 00 ff 53 4d 42 25 00 00 00 00 00 00 00 00 RSN: no matching PMKID found WPA: PMK from EAPOL state machines - hexdump(len=32): [REMOVED] RSN: added PMKSA cache entry for 00:xx:xx:xx:xx:xx RSN: no PMKSA entry found - trigger full EAP authentication RX EAPOL from 00:xx:xx:xx:xx:xx RX EAPOL - hexdump(len=121): 02 03 00 75 02 00 8a 00 10 00 00 00 00 00 00 00 02 17 07 47 46 61 66 67 b9 96 02 eb b4 94 ce ed cc c7 33 13 1d 59 bb d6 6e 3b 59 08 ef e9 9c f5 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 43 41 42 4e 00 ff 53 4d 42 25 00 00 00 00 00 00 EAPOL: Ignoring WPA EAPOL-Key frame in EAPOL state machines IEEE 802.1X RX: version=2 type=3 length=117 EAPOL-Key type=2 WPA: RX EAPOL-Key - hexdump(len=121): 02 03 00 75 02 00 8a 00 10 00 00 00 00 00 00 00 02 17 07 47 46 61 66 67 b9 96 02 eb b4 94 ce ed cc c7 33 13 1d 59 bb d6 6e 3b 59 08 ef e9 9c f5 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 43 41 42 4e 00 ff 53 4d 42 25 00 00 00 00 00 00 State: 4WAY_HANDSHAKE -> 4WAY_HANDSHAKE WPA: RX message 1 of 4-Way Handshake from 00:xx:xx:xx:xx:xx (ver=2) RSN: msg 1/4 key data - hexdump(len=22): dd 14 00 0f ac 04 43 41 42 4e 00 ff 53 4d 42 25 00 00 00 00 00 00 RSN: PMKID from Authenticator - hexdump(len=16): 43 41 42 4e 00 ff 53 4d 42 25 00 00 00 00 00 00 RSN: no matching PMKID found WPA: PMK from EAPOL state machines - hexdump(len=32): [REMOVED] WPA: reusing previous PMKSA entry RSN: no PMKSA entry found - trigger full EAP authentication RX EAPOL from 00:xx:xx:xx:xx:xx RX EAPOL - hexdump(len=121): 02 03 00 75 02 00 8a 00 10 00 00 00 00 00 00 00 03 17 07 47 46 61 66 67 b9 96 02 eb b4 94 ce ed cc c7 33 13 1d 59 bb d6 6e 3b 59 08 ef e9 9c f5 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 42 4e 00 ff 53 4d 42 25 00 00 00 00 00 00 00 00 EAPOL: Ignoring WPA EAPOL-Key frame in EAPOL state machines IEEE 802.1X RX: version=2 type=3 length=117 EAPOL-Key type=2 WPA: RX EAPOL-Key - hexdump(len=121): 02 03 00 75 02 00 8a 00 10 00 00 00 00 00 00 00 03 17 07 47 46 61 66 67 b9 96 02 eb b4 94 ce ed cc c7 33 13 1d 59 bb d6 6e 3b 59 08 ef e9 9c f5 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 42 4e 00 ff 53 4d 42 25 00 00 00 00 00 00 00 00 State: 4WAY_HANDSHAKE -> 4WAY_HANDSHAKE WPA: RX message 1 of 4-Way Handshake from 00:xx:xx:xx:xx:xx (ver=2) RSN: msg 1/4 key data - hexdump(len=22): dd 14 00 0f ac 04 42 4e 00 ff 53 4d 42 25 00 00 00 00 00 00 00 00 RSN: PMKID from Authenticator - hexdump(len=16): 42 4e 00 ff 53 4d 42 25 00 00 00 00 00 00 00 00 RSN: no matching PMKID found WPA: PMK from EAPOL state machines - hexdump(len=32): [REMOVED] WPA: reusing previous PMKSA entry RSN: no PMKSA entry found - trigger full EAP authentication Setting scan request: 0 sec 100000 usec Added BSSID 00:xx:xx:xx:xx:xx into blacklist State: 4WAY_HANDSHAKE -> DISCONNECTED EAPOL: External notification - portEnabled=0 EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED EAPOL: External notification - portValid=0 CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys wpa_driver_bsd_del_key: keyidx=0 wpa_driver_bsd_del_key: keyidx=1 wpa_driver_bsd_del_key: keyidx=2 wpa_driver_bsd_del_key: keyidx=3 wpa_driver_bsd_del_key: addr=00:00:00:00:00:00 keyidx=0 State: DISCONNECTED -> SCANNING =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= When I contacted Cisco support, they said the two following lines which are from the above Cisco debug logs: Feb 14 13:40:56.990: dot11_auth_server_chk_ssid: Checking for SSID in server attributes Feb 14 13:40:56.990: dot11_auth_server_vlan_number: Checking for VLAN ID in server attributes indicated to them that FreeRADIUS was sending dynamic VLAN attributes to the access point. I do not have any VLAN or other tunnelling attributes set on the FreeRADIUS side. Jouni suggested that these lines from the wpa_supplicant "-dd" debug log above: RSN: PMKID from Authenticator - hexdump(len=16): 42 4e 00 ff 53 4d 42 25 00 00 00 00 00 00 00 00 RSN: no matching PMKID found WPA: PMK from EAPOL state machines - hexdump(len=32): [REMOVED] RSN: added PMKSA cache entry for 00:xx:xx:xx:xx:xx RSN: no PMKSA entry found - trigger full EAP authentication indicated that the access point is not sending the correct keys. I cannot understand whether my problems lie in the FreeRADIUS area (my misconfiguration of which) or in the Cisco access point (my misconfiguration of which). I would be happy to include all or parts of my Cisco running configuration if necessary, but this email message is already too long. Regards, web... -- William Bulley Email: web(a)umich.edu

2 1

PEAP MSCHAP Problem
by Grooz, Marc (regio iT) 15 Feb '08

15 Feb '08

Hello, can some please help. Hello, we have a strange problem with the PEAP MSCHAP authentication truh WLAN. We use freeradius 1.1.7 on debian etch. 1. If we auth a ActiveDirectory User with automatic sending of username and password to our wlan everthing is OK. No lan-cabel is connected. In my case the Username is DOMAIN\\GroozMarc. 2. If we auth the same user with a lan-cabel connected. the auth fails. In this case the Username is DOMAIN\\groozmarc 3. If we auth the user without automatic sending of username and password and enter DOMAIN\\groozmarc and have lan connected everthing fine. Her is an output from case 2: rad_recv: Access-Request packet from host x , id=11, length=303 User-Name = "DOMAIN\\groozmarc" Calling-Station-Id = "x" Called-Station-Id = "x" NAS-Port = 2 NAS-IP-Address = x NAS-Identifier = "x" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "27" EAP-Message = 0x020a006a1900170301005fca5e86c4de36db061ffe1fc7f358599fa78cd53e221d2899 73525b8ed1328424653bad8e457757c9ae67d167a60b6 0585b1c37d22ed1377e9ed39b37901e7cf213d6a306ef154326ca0f6c2aad68111681c24 4b1523668e9effcfd97e1a216 State = 0xc1c18b62ee37419ada28a725693523d4 Message-Authenticator = 0x8dd2ca9d8fc2a09f7dcaef11b100f2c6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 39 modcall[authorize]: module "preprocess" returns ok for request 39 modcall[authorize]: module "chap" returns noop for request 39 modcall[authorize]: module "mschap" returns noop for request 39 rlm_realm: No '@' in User-Name = "DOMAIN\groozmarc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 39 rlm_eap: EAP packet type response id 10 length 106 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 39 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 39 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 39 modcall: leaving group authorize (returns updated) for request 39 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 39 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020a00531a020a004e310d11f40d775fc5fcb45ad88a7c4435830000000000000000b8 28c2bcb15e3c9ddaba50c2e6933328d1849c510dc9251 000524547494f49542d41414348454e5c47726f6f7a4d617263 PEAP: Setting User-Name to DOMAIN\groozmarc PEAP: Adding old state with 6a 6f PEAP: Sending tunneled request EAP-Message = 0x020a00531a020a004e310d11f40d775fc5fcb45ad88a7c4435830000000000000000b8 28c2bcb15e3c9ddaba50c2e6933328d1849c510dc9251 000524547494f49542d41414348454e5c47726f6f7a4d617263 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "DOMAIN\\groozmarc" State = 0x6a6f2590246560c8fdcd054d188cbb3f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 39 modcall[authorize]: module "preprocess" returns ok for request 39 modcall[authorize]: module "chap" returns noop for request 39 modcall[authorize]: module "mschap" returns noop for request 39 rlm_realm: No '@' in User-Name = "DOMAIN\groozmarc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 39 rlm_eap: EAP packet type response id 10 length 83 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 39 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 39 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 39 modcall: leaving group authorize (returns updated) for request 39 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 39 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 39 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for groozmarc with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: '--domain=DOMAIN' radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=groozmarc' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: e9 radius_xlat: '--challenge=d5ab398544877442' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=b828c2bcb15e3c9ddaba50c2e6933328d1849c510dc92510' Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 39 modcall: leaving group MS-CHAP (returns reject) for request 39 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 39 modcall: leaving group authenticate (returns reject) for request 39 auth: Failed to validate the user. Login incorrect (rlm_mschap: Logon failure (0xc000006d)): [DOMAIN\\groozmarc/<no User-Password attribute>] (from client localhost p ort 0) PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x80148570 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 39 modcall: leaving group authenticate (returns handled) for request 39 hope you can help. thanks! Kind regards Marc Grooz

2 3

Including files in from the dictionary files
by Wesley Schwengle 15 Feb '08

15 Feb '08

All, I have a question regarding including files. In the radiusd.conf I can include a file: $INCLUDE /path/to/file $INCLUDE ${prefix}/file However, in the dictionary file I cannot use ${prefix}: Errors reading dictionary: dict_init: /opt/freeradius-1.1.5/etc/raddb/dictionary[6]: Couldn't open dictionary "${prefix}/share/freeradius/dictionary.erx": No such file or directory Error: Errors reading dictionary: dict_init: /opt/freeradius-1.1.7/etc/raddb/dictionary[6]: Couldn't open dictionary "${prefix}/share/freeradius/dictionary.erx": No such file or directory I guess this is normal behaviour, but can anyone explain me why this behaviour is present? Cheers, Wesley

2 1

copy acct to home server
by Alexandre Chapellon 15 Feb '08

15 Feb '08

Hello, I want to use freeradius 2.0.1 to do accouting for my DSL users. I would like to acheive the following setup: NASes send request to the first radius (SunOS radius) which only handles authentication request and proxies accouting request to Freeradius (v2.0.1). I'd like freeradius to do several things: 1 - Do accounting to a mysql database 2 - Send accounting responses to the first radius 3 - proxy/copy accouting data to severals home server (3 servers: 1 billing server and 2 content filtering servers) To do this I setup freeradius 2.0.1 with 1 default virtual server writing accouting to mysql and to a detail file and one other virtual server which listen the detail file ( listen { type = detail....} ) and proxies request The problem is that the proxying is done for one request and stops when the response has been received.... so others request that are in the detail file are not proxied! does anybody have an idea / use this kind of setup? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 8

accounting & Interim-Update's on freeradius
by Joao Miguel Ferreira 15 Feb '08

15 Feb '08

Hello all, I'm a bit confuse here..... 1) -------------------------------------------- is it possible for a freeradius setup, runnging on a NAS system, via some authentication module, determine the traffic produced by a given user and autonomouslly send the Start, Interim-Update and Stop records to some _other_ Accounting Radius server ? Something like this: user1 --\ user2 ------<-->--|NAS w/ freeradius|-<------>-[Internet, www, ...] user3 --/ \ \ \ traffic records \ \ |freeradius accounting| -------------------------------------------------------------------- 2) if that is not possible, is there any kind of freeradius API for Linux (C++/Perl... ?!) that one can use in order to send such traffic accounting records ? --------------------------------------------- Cheers joao

2 1

Calling-Station-Id in pam_radius_auth
by Stefan Winter 15 Feb '08

15 Feb '08

Hi, a somewhat sophisticated problem: in a mail server, we'd like to record the IP address of the client that triggered the IMAP authentication request. The IMAP server uses PAM, specifically pam_radius_auth. Is there a way to tell pam_radius_auth to send a value in Calling-Station-Id? Is there a way at all to send variables to PAM at all, to be used for setting Calling-Station-Id within pam_radius_auth? We could also live with getting the value into PAM and then setting it into client_id= if Calling-Station-Id is not possible; string mangling on the server side would do nicely. Something like client_id=@{SOME_STRANGE_PAM_ITEM_WHICH_CONTAINS_MY_DESIRED_VALUE} as an option to pam_radius_auth? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 3

FreeRadius integration with MS Active Directory
by Rutger Beyen 15 Feb '08

15 Feb '08

Hello all, I'm following the howto http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO to integrate FreeRadius with Microsoft's AD. However, I'm experiencing some troubles. My disto is Debian 4. I had to install some packages, like krb5-kdc, krb5-user and krb5-config, to have the file /etc/krb5.conf (It wasn't there in the first place). When I want to do a net join, I get a message saying that I have errors in my krb5.conf file. I removed the lines "dns_lookup_realm = false" and "dns_lookup_kdc = false" and then it worked. At least I think it did. I got the message: joined "PROJECT" to realm "PROJECT.LOCAL". When I then wanted to test this using wbinfo, I get the error code "NT_STATUS_NO_SUCH_USER" (should be normal according to the howto) and another one: "NT_STATUS_ACCESS_DENIED" Could not authenticate user myuser with challenge/response. A try with ntlm_auth is also negative "NT_STATUS_NO_SUCH_USER". Can somebody please help me with my problem? Am I overlooking something or what am I doing wrong? Thanks a million, Rutger Here are the 2 config files: smb.conf [global] ## Browsing/Identification ### workgroup = project server string = %h server dns proxy = no #### Debugging/Accounting #### log file = /var/log/samba/log.%m max log size = 1000 syslog = 0 panic action = /usr/share/samba/panic-action %d ####### Authentication ####### # "security = user" is always a good idea. This will require a Unix account # in this server for every user accessing the server. See # /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/ServerType.html # in the samba-doc package for details. security = ads # You may wish to use password encryption. See the section on # 'encrypt passwords' in the smb.conf(5) manpage before enabling. encrypt passwords = true # If you are using encrypted passwords, Samba will need to know what # password database type you are using. passdb backend = tdbsam obey pam restrictions = yes ; guest account = nobody invalid users = root passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* . # This boolean controls whether PAM will be used for password changes # when requested by an SMB client instead of the program listed in # 'passwd program'. The default is 'no'. ; pam password change = no ############ Misc ############ # Most people will find that this option gives better performance. # See smb.conf(5) and /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/speed.html # for details # You may want to add the following on a Linux system: # SO_RCVBUF=8192 SO_SNDBUF=8192 socket options = TCP_NODELAY # Some defaults for winbind (make sure you're not using the ranges # for something else.) idmap uid = 10000-20000 idmap gid = 10000-20000 template shell = /bin/bash winbind use default domain = no password server = project-ad.project.local realm = project.local #======================= Share Definitions ======================= [homes] comment = Home Directories browseable = no # By default, the home directories are exported read-only. Change next # parameter to 'yes' if you want to be able to write to them. writable = yes # File creation mask is set to 0700 for security reasons. If you want to # create files with group=rw permissions, set next parameter to 0775. create mask = 0700 # Directory creation mask is set to 0700 for security reasons. If you want to # create dirs. with group=rw permissions, set next parameter to 0775. directory mask = 0700 # Restrict access to home directories # to the one of the authenticated user # This might need tweaking when using external authentication schemes valid users = %S # Un-comment the following and create the netlogon directory for Domain Logons # (you need to configure Samba to act as a domain controller too.) ;[netlogon] ; comment = Network Logon Service ; path = /home/samba/netlogon ; guest ok = yes ; writable = no ; share modes = no krb5.conf [logging] default = FILE:/war/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = PROJECT.LOCAL # dns_lookup realm = false # dns_lookup_kdc = false # The following krb5.conf variables are only for MIT Kerberos. krb4_config = /etc/krb.conf krb4_realms = /etc/krb.realms kdc_timesync = 1 ccache_type = 4 forwardable = true proxiable = true # The following libdefaults parameters are only for Heimdal Kerberos. v4_instance_resolve = false v4_name_convert = { host = { rcmd = host ftp = ftp } plain = { something = something-else } } fcc-mit-ticketflags = true [realms] PROJECT.LOCAL = { kdc = project-ad.project.local:88 admin_server = project-ad.project.local default_domain = project.local } [domain_realm] .project.local = PROJECT.LOCAL project.local = PROJECT.LOCAL [kdc] profile = /var/kerberos/krb5kdc/kdc.conf [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } [login] krb4_convert = true krb4_get_tickets = false

2 1

EAP session matching the State variable.
by Norbert Wegener 14 Feb '08

14 Feb '08

With 2.0.0 sometimes I get this error message, that I have not seen before: rlm_eap: No EAP session matching the State variable. rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler ++[eap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT This does not sound good, as there is no real load on the server and the same client will be authenticated some time later without configurational changes. If neccessary, I can provide the long log. Norbert Wegener

8 32