August 2009 - Freeradius-Users - lists.freeradius.org

Wind XP supplicant Domain//Username
by Mark Saner 04 Aug '09

04 Aug '09

My current setup is Freeraidus 2.0.4 connecting to OpenLDAP with PEAP authentication. Currently I have it working with all of our Linux and Mac clients and to an extent our Windows clients. I am trying to make connecting as simple as possible for the user. I can get the Windows clients to work if I uncheck the "Automatically use my Windows logon name and password (and domain if any)" option on the XP supplicant under the configure button for the MSCHAP authentication method. I would like to leave that option checked however when I do so the rlm_ldap fails because it is looking up DOMAIN\5cUSER. I have searched around a found a few leads but most of the deal with authenticating with ActiveDirectory and even if I do try their suggestions it doesn't seem to work. Output is below any suggestions would be greatly appreciated. FreeRADIUS Version 2.0.4, for host x86_64-pc-linux-gnu, built on Jul 20 2009 at 11:25:51 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" user = "freerad" group = "freerad" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "ohlieF8A" nastype = "other" } client 192.168.0.0/16 { require_message_authenticator = no secret = "ohlieF8A" shortname = "private-network-2" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "ohlieF8A" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "directory.internal.hustlerturf.com" port = 389 password = "********" identity = "cn=admin,dc=excelhustler,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "ou=People,dc=excelhustler,dc=com" filter = "(uid=%u)" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr = "uid" access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = no } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnell-Private-Group conns: 0x1da46c0 Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.2.151 port 10002, id=1, length=156 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 EAP-Message = 0x02010010014c494e55585c7465737431 Message-Authenticator = 0x30e61dfe7f91ae35e8838442098099d5 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 1 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for LINUX\test1 expand: (uid=%u) -> (uid=LINUX\5ctest1) expand: ou=People,dc=excelhustler,dc=com -> ou=People,dc=excelhustler,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to directory.internal.hustlerturf.com:389, authentication 0 rlm_ldap: bind as cn=admin,dc=excelhustler,dc=com/******** to directory.internal.hustlerturf.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=People,dc=excelhustler,dc=com, with filter (uid=LINUX\5ctest1) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.2.151 port 10002 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd1a27d0bd183ebed244722aa89641b1 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10002, id=2, length=238 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0xbd1a27d0bd183ebed244722aa89641b1 EAP-Message = 0x0202005019800000004616030100410100003d03014a772e0aa387d178b5191c130073d49b1b0c63925dc110d4c9c4e45042e69a9d00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xe1b23065c3ea3a08b748254dd50c36cd +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 2 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 085e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 2 to 192.168.2.151 port 10002 EAP-Message = 0x0103040019c0000008bb160301004a0200004603014a772de15710e77e919a91345d791dcbfeccc296ed719f78b4c3cdedcdba11c7209a753776f6bd234c21eb46256816293ea610de552e068e635544cae3f468b5be000400160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126302406035504 EAP-Message = 0x03131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303732383135343032315a170d3130303732383135343032315a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c46a5c7395912e933ecd064d1cd85f9f00ae3de23f7af80c64146cb84190 EAP-Message = 0xe363dd63bfd42e2429c79cba72d3ac776dc3a1bb2dc02689f671222e3eaed2e773908c037305a05ca940b3d680e33bb910bbf48a23592f344d96c070e6cbc09696a47341fe95f476811d99a5644347f0e2bfd99fd60f419fca2eee5893b570d298872eea9e989d7957e171c5bb452735f6d19bd6edd8f805e1fa0594b1e203ac1396b520141817452b97c623d4d91be11570fef6835a808eb7fc002fded46cc7da16a38c2f35824681694a09f882a8acdae67909454f193174ba10a6dc102864b85fbbfd7cc81aef3a8e7585c4f62e32f4bfb17bb5aa40d0d9b261cb0151d59a415f0203010001a317301530130603551d25040c300a06082b06010505 EAP-Message = 0x070301300d06092a864886f70d010104050003820101008f71d306c7f12961903f993ff65b7dae4467b2e47749ca159a452c2df21a4edfa42d399198468fc06299bb34de225342dbddce5350c5d2059c39a27d12ef9ad8d9fb175311ed979408567079a7ee83131fee08d8563e0f23eff42aedd229ca26b4552c0c51c5eb07f9e2c54480ac953ce49ad8966d8bc13bf6323b376afa3df580810e8bb69d8f4bdd1f91ac988af96d9f9c8e79a859bb6187bdcbf105413cd9d19ed0f5bb75a3ebb9133e8e20be85d1adb35d6c942f0fda9ae4b1db05e71f7b60c145fa4df1504c6e78169e921a123aee80b3aa33618b52cd4219ba48def5a79bdb7d6dafdc EAP-Message = 0xb04fdd57077b70767f03b4fc Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd1a27d0bc193ebed244722aa89641b1 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10002, id=3, length=164 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0xbd1a27d0bc193ebed244722aa89641b1 EAP-Message = 0x020300061900 Message-Authenticator = 0x6aa33042e799826ed3a040760ea20615 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 3 to 192.168.2.151 port 10002 EAP-Message = 0x010403fc194054d3b6de88d892967e6b3eb495b00004ab308204a73082038fa003020102020900a5d663c9298e8fb0300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303732383135343032315a170d3039303832373135343032315a308193310b30090603 EAP-Message = 0x55040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c2eb6fff9e49393ed67eaa1054d0fdd7001143a7e27ac045a43b389aef7b32841a63c46321341cd775753a2f0965cb2a1a261abcd28132fbc43f95cb3f484e089b31d50fb1696513ee6239994c889d EAP-Message = 0x6345446eb47b48b3ffbdf8ec416b034615473d60d64aa8504b369688dfc813014b4008ff730b0bf52674d050c9c59d33097b970adadcfab05d90b89ff04ae0d80656d2666339440f54a5ab651feb8da3b4b2d5a5f6f9edb510a9e1d74739d8c58c635836152ca45178cd6e331177b542bc5e877d4968b54da34175e97c89e095c1b34ed6e14c4aab65d7de02030ec56f72e68aaf947f991836014c5aa581bf37aae15d0e4f377ff6e85ae306868bcbe7ff0203010001a381fb3081f8301d0603551d0e04160414f484fb9461975409a48e27d5971133a3b1ac434c3081c80603551d230481c03081bd8014f484fb9461975409a48e27d5971133a3b1ac EAP-Message = 0x434ca18199a48196308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900a5d663c9298e8fb0300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010039d8d1c6114c9497ecd419f8809e101d081bdc07bf09363da41ef75df1eace30f0cd9258577df16b9a9870a3318c3c652877 EAP-Message = 0xcc4abf6d8be9f208 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd1a27d0bf1e3ebed244722aa89641b1 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10002, id=4, length=164 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0xbd1a27d0bf1e3ebed244722aa89641b1 EAP-Message = 0x020400061900 Message-Authenticator = 0xe3f49e1dc1bd9a7cc2ba09d2cad8d052 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 4 to 192.168.2.151 port 10002 EAP-Message = 0x010500d51900e06682e06fa176b55d4a8a787748598eaa1eea7fe1d11533451b17faac2c41444e253ad37507bfdfb7b423bc382153641f5b0e67be423aad8df473f529cdeb66265a827cf14b5387861f4ea0bf6091147a7b5a4ee4f1afc85b095ca2697b5f334cf64afdba1235039992e7e01ea7ee74e4fdef141626955ecd6c272c3b2335742c5fa50909249272ea623f1fb0121b61498ad6b8752638808f3d23cbb5219c0d83a335d0c0c685f654b832578256a1fd6298bd27906c1ab639ec6901999887e998a74baf204716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd1a27d0be1f3ebed244722aa89641b1 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10002, id=5, length=480 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0xbd1a27d0be1f3ebed244722aa89641b1 EAP-Message = 0x02050140198000000136160301010610000102010003bcfe6edc5ac790dd2a536103a4f26d3644bf3b66e991ad039eef82ff27f3512cf07b0eb0fd969447cef83979da1b7721e18e20883a8f975f326bdaea9047f1b0cbf155ca101e3fa14570c25b41bc9c7eb944e97ca54666628b5632a6b30430e4dd0d31a524687eda83272ad2573e2fdc3f46a01b72025a79aac5754c66cf66aa48daf8c073ea112507e2a258404c472c16c2e41b8b7d044356a64d27a632258fe7c3d05fe72094c908984fe5ab9a1da6a3dc407525b18b95feb8877268324ae10ee90f8f0e932a300c1bfea21e91e879c234f04726e56a30e491adcf5cc11ce86f54bd9435492e EAP-Message = 0x59e5cc677765200f2ed65486aeb05e2db0057b8e2f414f25140301000101160301002045c5503fa36fdd40a41380ea90d1e1d0f8f0edee717bdb0cd4b1913cd3096b66 Message-Authenticator = 0x66d3f60b20559169104856b0f96a6474 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 5 length 253 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 310 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 5 to 192.168.2.151 port 10002 EAP-Message = 0x0106003119001403010001011603010020713afd5f53f16037dd03c3e9716b9484f3a9f65070722cb9ccdb3835bb0580d5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd1a27d0b91c3ebed244722aa89641b1 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10002, id=6, length=164 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0xbd1a27d0b91c3ebed244722aa89641b1 EAP-Message = 0x020600061900 Message-Authenticator = 0x446d642e8de6477c7ecd709ebc345d1e +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 6 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 6 to 192.168.2.151 port 10002 EAP-Message = 0x0107002019001703010015b2999f22d52c31d7b9114e49e8bbecc11adee42c0d Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd1a27d0b81d3ebed244722aa89641b1 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10002, id=7, length=197 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0xbd1a27d0b81d3ebed244722aa89641b1 EAP-Message = 0x020700271900170301001c737fd9d39009b1f542b5090f11a8eb437a03dd1a95b09675c132a588 Message-Authenticator = 0x3565f0cea538abec12291a62dbcf5f7b +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 7 length 39 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - LINUX\test1 PEAP: Got tunneled EAP-Message EAP-Message = 0x02070010014c494e55585c7465737431 PEAP: Got tunneled identity of LINUX\test1 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to LINUX\test1 PEAP: Sending tunneled request EAP-Message = 0x02070010014c494e55585c7465737431 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "LINUX\\test1" server inner-tunnel { +- entering group authorize ++[mschap] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 7 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for LINUX\test1 expand: (uid=%u) -> (uid=LINUX\5ctest1) expand: ou=People,dc=excelhustler,dc=com -> ou=People,dc=excelhustler,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,dc=excelhustler,dc=com, with filter (uid=LINUX\5ctest1) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010800251a0108002010a368f3908ef2a9921a8b7821bceeda874c494e55585c7465737431 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe6b55262e6bd4850d1efd72bdd823e7d PEAP: Processing from tunneled session code 0x1de2d40 11 EAP-Message = 0x010800251a0108002010a368f3908ef2a9921a8b7821bceeda874c494e55585c7465737431 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe6b55262e6bd4850d1efd72bdd823e7d PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 7 to 192.168.2.151 port 10002 EAP-Message = 0x0108003c19001703010031c26d17ad11110e31c7be6f94e9639bf457bbb848f0e6f1f40f1c471d706db311b207c6810a712d3bcdc9ea168a1b4d6c09 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd1a27d0bb123ebed244722aa89641b1 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10002, id=8, length=251 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0xbd1a27d0bb123ebed244722aa89641b1 EAP-Message = 0x0208005d190017030100527458ccc1710becb285441acde21dc551281ab103940d3227121369191f3a0a6a82dc58427020a338a06e07e0a87e05f28719ac710a9328dfefaa1646c5913d9e6150bfd3c6d032889a894f00629ecb4f4e88 Message-Authenticator = 0xe284c38150b6530357b2cc2f73c468d2 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 8 length 93 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x020800461a020800413144408d3d7f47d40bd23c9adc870f1ea500000000000000003eb0540d2770229837f2e685c2311f74fa65f01327a32be2004c494e55585c7465737431 PEAP: Setting User-Name to LINUX\test1 PEAP: Sending tunneled request EAP-Message = 0x020800461a020800413144408d3d7f47d40bd23c9adc870f1ea500000000000000003eb0540d2770229837f2e685c2311f74fa65f01327a32be2004c494e55585c7465737431 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "LINUX\\test1" State = 0xe6b55262e6bd4850d1efd72bdd823e7d server inner-tunnel { +- entering group authorize ++[mschap] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 8 length 70 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for LINUX\test1 expand: (uid=%u) -> (uid=LINUX\5ctest1) expand: ou=People,dc=excelhustler,dc=com -> ou=People,dc=excelhustler,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,dc=excelhustler,dc=com, with filter (uid=LINUX\5ctest1) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for test1 with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [LINUX\\test1/<via Auth-Type = EAP>] (from client private-network-2 port 0 via TLS tunnel) } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x1de1930 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE ++[eap] returns handled Sending Access-Challenge of id 8 to 192.168.2.151 port 10002 EAP-Message = 0x010900261900170301001bb5c8ec4ea7f7075d9002e64849d369c89e24f8269b10e16092fcc6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd1a27d0ba133ebed244722aa89641b1 Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10002, id=9, length=196 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0xbd1a27d0ba133ebed244722aa89641b1 EAP-Message = 0x020900261900170301001b4d66b45b673836cc47d4e7f5b03e3adf5d5192b9d90636029b5f52 Message-Authenticator = 0x7484b90d3715780775716007fb7dc660 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 9 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Had sent TLV failure. User was rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [LINUX\\test1/<via Auth-Type = EAP>] (from client private-network-2 port 1 cli 00:13:e8:b9:8c:b9) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> LINUX\test1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 9 to 192.168.2.151 port 10002 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10003, id=11, length=156 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 EAP-Message = 0x02010010014c494e55585c7465737431 Message-Authenticator = 0xf00d1284aa5548d655b47a1bac769f35 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 1 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for LINUX\test1 expand: (uid=%u) -> (uid=LINUX\5ctest1) expand: ou=People,dc=excelhustler,dc=com -> ou=People,dc=excelhustler,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,dc=excelhustler,dc=com, with filter (uid=LINUX\5ctest1) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 11 to 192.168.2.151 port 10003 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1000725f10026b765c42d054796fe3e0 Finished request 9. Going to the next request Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10003, id=12, length=238 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0x1000725f10026b765c42d054796fe3e0 EAP-Message = 0x0202005019800000004616030100410100003d03014a772e0b5f4f44389df63a380049523e1427757e2f0e8ba5347208098e3174ce00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xbd34cc45c69004c920bebfaedde64341 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 2 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 085e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 12 to 192.168.2.151 port 10003 EAP-Message = 0x0103040019c0000008bb160301004a0200004603014a772de259c8e79cf288f3170a4a34fdc1c2ba91acc7b3c4a29bd1886ed0833f20bdd2d1258b0ae45bc6805ee37aba433832075642210c7cb4fe4c61a45ca17801000400160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126302406035504 EAP-Message = 0x03131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303732383135343032315a170d3130303732383135343032315a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c46a5c7395912e933ecd064d1cd85f9f00ae3de23f7af80c64146cb84190 EAP-Message = 0xe363dd63bfd42e2429c79cba72d3ac776dc3a1bb2dc02689f671222e3eaed2e773908c037305a05ca940b3d680e33bb910bbf48a23592f344d96c070e6cbc09696a47341fe95f476811d99a5644347f0e2bfd99fd60f419fca2eee5893b570d298872eea9e989d7957e171c5bb452735f6d19bd6edd8f805e1fa0594b1e203ac1396b520141817452b97c623d4d91be11570fef6835a808eb7fc002fded46cc7da16a38c2f35824681694a09f882a8acdae67909454f193174ba10a6dc102864b85fbbfd7cc81aef3a8e7585c4f62e32f4bfb17bb5aa40d0d9b261cb0151d59a415f0203010001a317301530130603551d25040c300a06082b06010505 EAP-Message = 0x070301300d06092a864886f70d010104050003820101008f71d306c7f12961903f993ff65b7dae4467b2e47749ca159a452c2df21a4edfa42d399198468fc06299bb34de225342dbddce5350c5d2059c39a27d12ef9ad8d9fb175311ed979408567079a7ee83131fee08d8563e0f23eff42aedd229ca26b4552c0c51c5eb07f9e2c54480ac953ce49ad8966d8bc13bf6323b376afa3df580810e8bb69d8f4bdd1f91ac988af96d9f9c8e79a859bb6187bdcbf105413cd9d19ed0f5bb75a3ebb9133e8e20be85d1adb35d6c942f0fda9ae4b1db05e71f7b60c145fa4df1504c6e78169e921a123aee80b3aa33618b52cd4219ba48def5a79bdb7d6dafdc EAP-Message = 0xb04fdd57077b70767f03b4fc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1000725f11036b765c42d054796fe3e0 Finished request 10. Going to the next request Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10003, id=13, length=164 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0x1000725f11036b765c42d054796fe3e0 EAP-Message = 0x020300061900 Message-Authenticator = 0x0ac586525ddee0f50523d80d5f1ccfcb +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 13 to 192.168.2.151 port 10003 EAP-Message = 0x010403fc194054d3b6de88d892967e6b3eb495b00004ab308204a73082038fa003020102020900a5d663c9298e8fb0300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303732383135343032315a170d3039303832373135343032315a308193310b30090603 EAP-Message = 0x55040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c2eb6fff9e49393ed67eaa1054d0fdd7001143a7e27ac045a43b389aef7b32841a63c46321341cd775753a2f0965cb2a1a261abcd28132fbc43f95cb3f484e089b31d50fb1696513ee6239994c889d EAP-Message = 0x6345446eb47b48b3ffbdf8ec416b034615473d60d64aa8504b369688dfc813014b4008ff730b0bf52674d050c9c59d33097b970adadcfab05d90b89ff04ae0d80656d2666339440f54a5ab651feb8da3b4b2d5a5f6f9edb510a9e1d74739d8c58c635836152ca45178cd6e331177b542bc5e877d4968b54da34175e97c89e095c1b34ed6e14c4aab65d7de02030ec56f72e68aaf947f991836014c5aa581bf37aae15d0e4f377ff6e85ae306868bcbe7ff0203010001a381fb3081f8301d0603551d0e04160414f484fb9461975409a48e27d5971133a3b1ac434c3081c80603551d230481c03081bd8014f484fb9461975409a48e27d5971133a3b1ac EAP-Message = 0x434ca18199a48196308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900a5d663c9298e8fb0300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010039d8d1c6114c9497ecd419f8809e101d081bdc07bf09363da41ef75df1eace30f0cd9258577df16b9a9870a3318c3c652877 EAP-Message = 0xcc4abf6d8be9f208 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1000725f12046b765c42d054796fe3e0 Finished request 11. Going to the next request Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10003, id=14, length=164 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0x1000725f12046b765c42d054796fe3e0 EAP-Message = 0x020400061900 Message-Authenticator = 0xcfdcb541d6e3a4355eb5afaeb87e4c14 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 14 to 192.168.2.151 port 10003 EAP-Message = 0x010500d51900e06682e06fa176b55d4a8a787748598eaa1eea7fe1d11533451b17faac2c41444e253ad37507bfdfb7b423bc382153641f5b0e67be423aad8df473f529cdeb66265a827cf14b5387861f4ea0bf6091147a7b5a4ee4f1afc85b095ca2697b5f334cf64afdba1235039992e7e01ea7ee74e4fdef141626955ecd6c272c3b2335742c5fa50909249272ea623f1fb0121b61498ad6b8752638808f3d23cbb5219c0d83a335d0c0c685f654b832578256a1fd6298bd27906c1ab639ec6901999887e998a74baf204716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1000725f13056b765c42d054796fe3e0 Finished request 12. Going to the next request Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10003, id=15, length=480 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0x1000725f13056b765c42d054796fe3e0 EAP-Message = 0x020501401980000001361603010106100001020100345d365b87825e49a7aa390d04627c0ef1194ab7cb3d4ab5d172edb3242711d1122343e1031a1a5a62e73db3c5a86b029070d81a6e2c040122d522ad4d195888d0ca8c3813a9b0a4694b81b863baf681776fa7c07498885884f0928058df75ba611ef1211786332bdf3285eaa49eba5c4159a3dc1c6a94631e8b58c7d39eaa1eaa86476c1f3d0d8dec33be9c27f9b1ff039034479017c4727a3c659d2bbcc2ef78da61f253de259e004582b82da7d980cfa7a7bc06363771f6450c2497a60ef43a8bf8547076d73d651d5586dc1756f7eaec4027db70cfb9ed869b7e2a03f4957d8bfa8ceb15b3d8 EAP-Message = 0x00927fd5f0197cf5d6b16dbd05c3e7ab44cc117fad22f02f1403010001011603010020f80dc1cc42782053a99a2243d1df18e31c036d63402e436532debf8fe9ed93cc Message-Authenticator = 0x6fcea68d0057564ded0752c04ef0c0fd +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 5 length 253 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 310 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 15 to 192.168.2.151 port 10003 EAP-Message = 0x01060031190014030100010116030100209ab7d250d58427059024943814681e014d5f060c7ead503c7882dd866dbb4a62 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1000725f14066b765c42d054796fe3e0 Finished request 13. Going to the next request Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10003, id=16, length=164 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0x1000725f14066b765c42d054796fe3e0 EAP-Message = 0x020600061900 Message-Authenticator = 0xd1f5823f9c99d02acdfc60567c78f72c +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 6 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 16 to 192.168.2.151 port 10003 EAP-Message = 0x0107002019001703010015ea26434d92ecdfbfdb2220326ef6c3dee696356b40 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1000725f15076b765c42d054796fe3e0 Finished request 14. Going to the next request Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10003, id=17, length=197 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0x1000725f15076b765c42d054796fe3e0 EAP-Message = 0x020700271900170301001c55f75b143dea9783948e06e5b21148ef2f447fa06ba8a24e0672cf84 Message-Authenticator = 0xc16e46ee3683ef68ade437712ea6ded6 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 7 length 39 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - LINUX\test1 PEAP: Got tunneled EAP-Message EAP-Message = 0x02070010014c494e55585c7465737431 PEAP: Got tunneled identity of LINUX\test1 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to LINUX\test1 PEAP: Sending tunneled request EAP-Message = 0x02070010014c494e55585c7465737431 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "LINUX\\test1" server inner-tunnel { +- entering group authorize ++[mschap] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 7 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for LINUX\test1 expand: (uid=%u) -> (uid=LINUX\5ctest1) expand: ou=People,dc=excelhustler,dc=com -> ou=People,dc=excelhustler,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,dc=excelhustler,dc=com, with filter (uid=LINUX\5ctest1) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010800251a0108002010181aa22b76d10fbe6a329bdfd7f585dd4c494e55585c7465737431 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2bad37742ba52dd284335b0b93096851 PEAP: Processing from tunneled session code 0x1dbdf90 11 EAP-Message = 0x010800251a0108002010181aa22b76d10fbe6a329bdfd7f585dd4c494e55585c7465737431 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2bad37742ba52dd284335b0b93096851 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 17 to 192.168.2.151 port 10003 EAP-Message = 0x0108003c19001703010031cf6455ed48efd482d62600917d0ead4ec100f7ed7318dd606a1b162f22cab96ec1f0956639ec905581503e96019a9ed065 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1000725f16086b765c42d054796fe3e0 Finished request 15. Going to the next request Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10003, id=18, length=251 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0x1000725f16086b765c42d054796fe3e0 EAP-Message = 0x0208005d190017030100520bc6fe0b2aed4841e2c717c05dda389310be4e43074d4ebca2c6820f836a937e3c6d053fe049a99b0f80a268532161a1f2ce5a24c815df33c05c560d2422948bfaa06ed0f33a1f232de7926b6091b6cd29ed Message-Authenticator = 0xb331a1b177bb51369f9903ea6e5cc76f +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 8 length 93 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x020800461a02080041313d4c5a4317f4cd1b27363013aae1f25300000000000000003871a4fc65ac06c2d69f621df647a94d2a4eab1bda5882db004c494e55585c7465737431 PEAP: Setting User-Name to LINUX\test1 PEAP: Sending tunneled request EAP-Message = 0x020800461a02080041313d4c5a4317f4cd1b27363013aae1f25300000000000000003871a4fc65ac06c2d69f621df647a94d2a4eab1bda5882db004c494e55585c7465737431 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "LINUX\\test1" State = 0x2bad37742ba52dd284335b0b93096851 server inner-tunnel { +- entering group authorize ++[mschap] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 8 length 70 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for LINUX\test1 expand: (uid=%u) -> (uid=LINUX\5ctest1) expand: ou=People,dc=excelhustler,dc=com -> ou=People,dc=excelhustler,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,dc=excelhustler,dc=com, with filter (uid=LINUX\5ctest1) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for test1 with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [LINUX\\test1/<via Auth-Type = EAP>] (from client private-network-2 port 0 via TLS tunnel) } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x1dbdff0 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE ++[eap] returns handled Sending Access-Challenge of id 18 to 192.168.2.151 port 10003 EAP-Message = 0x010900261900170301001b11332ce4f2c596e0f647b83a5c894ae665c90b0c2a8425f3260c8e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1000725f17096b765c42d054796fe3e0 Finished request 16. Going to the next request Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10003, id=19, length=196 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0x1000725f17096b765c42d054796fe3e0 EAP-Message = 0x020900261900170301001bf586818b7529b417d82cc5d925f4e1904983409c2834325c24d200 Message-Authenticator = 0xa8ca7a4fcfaa86f696404e95c2f8ee4b +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 9 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Had sent TLV failure. User was rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [LINUX\\test1/<via Auth-Type = EAP>] (from client private-network-2 port 1 cli 00:13:e8:b9:8c:b9) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> LINUX\test1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 17 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 17 Sending Access-Reject of id 19 to 192.168.2.151 port 10003 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 2.7 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10004, id=21, length=156 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 EAP-Message = 0x02010010014c494e55585c7465737431 Message-Authenticator = 0xe812d7788548e10f5519e2b192993b9d +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 1 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for LINUX\test1 expand: (uid=%u) -> (uid=LINUX\5ctest1) expand: ou=People,dc=excelhustler,dc=com -> ou=People,dc=excelhustler,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,dc=excelhustler,dc=com, with filter (uid=LINUX\5ctest1) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 21 to 192.168.2.151 port 10004 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5c9aaff15c98b6268a6c68880037d65f Finished request 18. Going to the next request Waking up in 2.1 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10004, id=22, length=238 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0x5c9aaff15c98b6268a6c68880037d65f EAP-Message = 0x0202005019800000004616030100410100003d03014a772e0dc67cdfbe047b85c3dcb9e5e02778cfae851b82677c379829a871566c00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xf3a5cd46a4207946dbf86122158d31e8 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 2 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 085e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 22 to 192.168.2.151 port 10004 EAP-Message = 0x0103040019c0000008bb160301004a0200004603014a772de4368fc3d52986512cc24a802e55e1aec895b4fc5d5658dd5b6b712ddc205ed8e001a0925e8bfe5f762db0e5fae6c438df798dfb564a7989134090b10f3f000400160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126302406035504 EAP-Message = 0x03131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303732383135343032315a170d3130303732383135343032315a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c46a5c7395912e933ecd064d1cd85f9f00ae3de23f7af80c64146cb84190 EAP-Message = 0xe363dd63bfd42e2429c79cba72d3ac776dc3a1bb2dc02689f671222e3eaed2e773908c037305a05ca940b3d680e33bb910bbf48a23592f344d96c070e6cbc09696a47341fe95f476811d99a5644347f0e2bfd99fd60f419fca2eee5893b570d298872eea9e989d7957e171c5bb452735f6d19bd6edd8f805e1fa0594b1e203ac1396b520141817452b97c623d4d91be11570fef6835a808eb7fc002fded46cc7da16a38c2f35824681694a09f882a8acdae67909454f193174ba10a6dc102864b85fbbfd7cc81aef3a8e7585c4f62e32f4bfb17bb5aa40d0d9b261cb0151d59a415f0203010001a317301530130603551d25040c300a06082b06010505 EAP-Message = 0x070301300d06092a864886f70d010104050003820101008f71d306c7f12961903f993ff65b7dae4467b2e47749ca159a452c2df21a4edfa42d399198468fc06299bb34de225342dbddce5350c5d2059c39a27d12ef9ad8d9fb175311ed979408567079a7ee83131fee08d8563e0f23eff42aedd229ca26b4552c0c51c5eb07f9e2c54480ac953ce49ad8966d8bc13bf6323b376afa3df580810e8bb69d8f4bdd1f91ac988af96d9f9c8e79a859bb6187bdcbf105413cd9d19ed0f5bb75a3ebb9133e8e20be85d1adb35d6c942f0fda9ae4b1db05e71f7b60c145fa4df1504c6e78169e921a123aee80b3aa33618b52cd4219ba48def5a79bdb7d6dafdc EAP-Message = 0xb04fdd57077b70767f03b4fc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5c9aaff15d99b6268a6c68880037d65f Finished request 19. Going to the next request Waking up in 2.1 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10004, id=23, length=164 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0x5c9aaff15d99b6268a6c68880037d65f EAP-Message = 0x020300061900 Message-Authenticator = 0xdc805aa7b4e1b9c5185c16459e1fa75d +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 23 to 192.168.2.151 port 10004 EAP-Message = 0x010403fc194054d3b6de88d892967e6b3eb495b00004ab308204a73082038fa003020102020900a5d663c9298e8fb0300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303732383135343032315a170d3039303832373135343032315a308193310b30090603 EAP-Message = 0x55040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c2eb6fff9e49393ed67eaa1054d0fdd7001143a7e27ac045a43b389aef7b32841a63c46321341cd775753a2f0965cb2a1a261abcd28132fbc43f95cb3f484e089b31d50fb1696513ee6239994c889d EAP-Message = 0x6345446eb47b48b3ffbdf8ec416b034615473d60d64aa8504b369688dfc813014b4008ff730b0bf52674d050c9c59d33097b970adadcfab05d90b89ff04ae0d80656d2666339440f54a5ab651feb8da3b4b2d5a5f6f9edb510a9e1d74739d8c58c635836152ca45178cd6e331177b542bc5e877d4968b54da34175e97c89e095c1b34ed6e14c4aab65d7de02030ec56f72e68aaf947f991836014c5aa581bf37aae15d0e4f377ff6e85ae306868bcbe7ff0203010001a381fb3081f8301d0603551d0e04160414f484fb9461975409a48e27d5971133a3b1ac434c3081c80603551d230481c03081bd8014f484fb9461975409a48e27d5971133a3b1ac EAP-Message = 0x434ca18199a48196308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900a5d663c9298e8fb0300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010039d8d1c6114c9497ecd419f8809e101d081bdc07bf09363da41ef75df1eace30f0cd9258577df16b9a9870a3318c3c652877 EAP-Message = 0xcc4abf6d8be9f208 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5c9aaff15e9eb6268a6c68880037d65f Finished request 20. Going to the next request Waking up in 2.1 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10004, id=24, length=164 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0x5c9aaff15e9eb6268a6c68880037d65f EAP-Message = 0x020400061900 Message-Authenticator = 0xfee37471422fafe8fa9e1f462f308402 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 24 to 192.168.2.151 port 10004 EAP-Message = 0x010500d51900e06682e06fa176b55d4a8a787748598eaa1eea7fe1d11533451b17faac2c41444e253ad37507bfdfb7b423bc382153641f5b0e67be423aad8df473f529cdeb66265a827cf14b5387861f4ea0bf6091147a7b5a4ee4f1afc85b095ca2697b5f334cf64afdba1235039992e7e01ea7ee74e4fdef141626955ecd6c272c3b2335742c5fa50909249272ea623f1fb0121b61498ad6b8752638808f3d23cbb5219c0d83a335d0c0c685f654b832578256a1fd6298bd27906c1ab639ec6901999887e998a74baf204716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5c9aaff15f9fb6268a6c68880037d65f Finished request 21. Going to the next request Waking up in 2.1 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10004, id=25, length=480 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0x5c9aaff15f9fb6268a6c68880037d65f EAP-Message = 0x02050140198000000136160301010610000102010007b66382949332a91163b26b074fe7fd99b7dd70d3429dfeac39e79d44cfa482d903fb1fea82de8753af2340b2d7395d25dd0d2a0fef65d075d1e5204c5feaeabf905355ef71ac392490814750f69b222100da81267248447a70239f0dc414820fffc59ba4e1f32d46120a1b6d090d4924c0ee33ef360133e3b3a618f2e59a2e38e63afee4c843fc70290f592dbf1bdd8921a64c40dfa9024eaf50333740a6c282572cbc13467206117161b3252e1830e521d67a062a64752594fb9c3678c80b041a0f94972faaa8e7ccf538ff891e13c554fd0b8003f8d4594c36746e759056a1abf79bd9fc10df EAP-Message = 0xdc26fcc961cf2f3766955041d3ff0dfb5750bf34e2ba310b1403010001011603010020ec5ba6b42022de6c9a857a6867e2c0d88657840d05f6cd3aeb9c08cb55a973ae Message-Authenticator = 0x2126ff488f3f0520f70089e99213f66a +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 5 length 253 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 310 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 25 to 192.168.2.151 port 10004 EAP-Message = 0x010600311900140301000101160301002021eca22f5b0df438670391496204019817af31ccf9b9ba09d5ef1e0bc72542a6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5c9aaff1589cb6268a6c68880037d65f Finished request 22. Going to the next request Waking up in 2.1 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10004, id=26, length=164 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0x5c9aaff1589cb6268a6c68880037d65f EAP-Message = 0x020600061900 Message-Authenticator = 0x59fda3a9e1b134df0b68fb1ad4dc488e +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 6 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 26 to 192.168.2.151 port 10004 EAP-Message = 0x0107002019001703010015238eb713bba53e509541e6f6962180138fa50ad48d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5c9aaff1599db6268a6c68880037d65f Finished request 23. Going to the next request Waking up in 2.1 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10004, id=27, length=197 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0x5c9aaff1599db6268a6c68880037d65f EAP-Message = 0x020700271900170301001cbd99641f2e97b8f8b6c4733c29a1b18e60e7a4db45434e4eb09f954a Message-Authenticator = 0x3bfc85d5e79119058167b440852935f8 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 7 length 39 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - LINUX\test1 PEAP: Got tunneled EAP-Message EAP-Message = 0x02070010014c494e55585c7465737431 PEAP: Got tunneled identity of LINUX\test1 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to LINUX\test1 PEAP: Sending tunneled request EAP-Message = 0x02070010014c494e55585c7465737431 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "LINUX\\test1" server inner-tunnel { +- entering group authorize ++[mschap] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 7 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for LINUX\test1 expand: (uid=%u) -> (uid=LINUX\5ctest1) expand: ou=People,dc=excelhustler,dc=com -> ou=People,dc=excelhustler,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,dc=excelhustler,dc=com, with filter (uid=LINUX\5ctest1) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010800251a01080020109e9536ec642b4bae655f0a59e554cdca4c494e55585c7465737431 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8fa5dc688fadc6ebfe94f831548b3cb4 PEAP: Processing from tunneled session code 0x1dd69f0 11 EAP-Message = 0x010800251a01080020109e9536ec642b4bae655f0a59e554cdca4c494e55585c7465737431 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8fa5dc688fadc6ebfe94f831548b3cb4 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 27 to 192.168.2.151 port 10004 EAP-Message = 0x0108003c19001703010031b5eaed11e69075c510206a129829d5fa0b9a00e0e75071de04b49a8a1f1515f6f04ce4d37bf2cb6d809cca66b42b381806 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5c9aaff15a92b6268a6c68880037d65f Finished request 24. Going to the next request Waking up in 2.1 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10004, id=28, length=251 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0x5c9aaff15a92b6268a6c68880037d65f EAP-Message = 0x0208005d19001703010052d2b4b0b7431c3b4e01c2cbeb0b7bfc26452e5e348d76f897ea796573fdb29a30f8a741edc9ebb4ee44f6da3597d2704fd253c2221ba1d4dcf99d0be845fba56e63fc1b3c188b9107a225de465dc67f01f69e Message-Authenticator = 0x28baad3a912c6a18076ffee6d6d4446b +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 8 length 93 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x020800461a020800413185dc7fea07f6ef7ff746eb59e78f17760000000000000000807590a4317cb924686984ec30d82a57738cc88c897e3180004c494e55585c7465737431 PEAP: Setting User-Name to LINUX\test1 PEAP: Sending tunneled request EAP-Message = 0x020800461a020800413185dc7fea07f6ef7ff746eb59e78f17760000000000000000807590a4317cb924686984ec30d82a57738cc88c897e3180004c494e55585c7465737431 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "LINUX\\test1" State = 0x8fa5dc688fadc6ebfe94f831548b3cb4 server inner-tunnel { +- entering group authorize ++[mschap] returns noop ++[control] returns noop rlm_eap: EAP packet type response id 8 length 70 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for LINUX\test1 expand: (uid=%u) -> (uid=LINUX\5ctest1) expand: ou=People,dc=excelhustler,dc=com -> ou=People,dc=excelhustler,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,dc=excelhustler,dc=com, with filter (uid=LINUX\5ctest1) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for test1 with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [LINUX\\test1/<via Auth-Type = EAP>] (from client private-network-2 port 0 via TLS tunnel) } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x1dd6680 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE ++[eap] returns handled Sending Access-Challenge of id 28 to 192.168.2.151 port 10004 EAP-Message = 0x010900261900170301001bc3570c2e3433ff1dfcbfcce52348664f94ae2ec412eec02c68b19a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5c9aaff15b93b6268a6c68880037d65f Finished request 25. Going to the next request Waking up in 2.0 seconds. rad_recv: Access-Request packet from host 192.168.2.151 port 10004, id=29, length=196 User-Name = "LINUX\\test1" Called-Station-Id = "00:23:68:0f:7a:90" Calling-Station-Id = "00:13:e8:b9:8c:b9" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 NAS-IP-Address = 192.168.2.151 NAS-Identifier = "AP-51xx" Vendor-388-Attr-2 = 0x657863656c656170 State = 0x5c9aaff15b93b6268a6c68880037d65f EAP-Message = 0x020900261900170301001b534e55ceb744ccb3ba5c500e6896234c5941523ecda7b34e289e0d Message-Authenticator = 0x859d6bcd5df76246dc339b04047c507b +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_eap: EAP packet type response id 9 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Had sent TLV failure. User was rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [LINUX\\test1/<via Auth-Type = EAP>] (from client private-network-2 port 1 cli 00:13:e8:b9:8c:b9) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> LINUX\test1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 26 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 26 Sending Access-Reject of id 29 to 192.168.2.151 port 10004 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1.0 seconds. Cleaning up request 0 ID 1 with timestamp +12 Cleaning up request 1 ID 2 with timestamp +12 Cleaning up request 2 ID 3 with timestamp +12 Cleaning up request 3 ID 4 with timestamp +12 Cleaning up request 4 ID 5 with timestamp +12 Cleaning up request 5 ID 6 with timestamp +12 Cleaning up request 6 ID 7 with timestamp +12 Cleaning up request 7 ID 8 with timestamp +12 Waking up in 1.0 seconds. Cleaning up request 8 ID 9 with timestamp +12 Waking up in 0.1 seconds. Cleaning up request 9 ID 11 with timestamp +13 Cleaning up request 10 ID 12 with timestamp +13 Cleaning up request 11 ID 13 with timestamp +13 Cleaning up request 12 ID 14 with timestamp +13 Cleaning up request 13 ID 15 with timestamp +13 Cleaning up request 14 ID 16 with timestamp +13 Cleaning up request 15 ID 17 with timestamp +13 Cleaning up request 16 ID 18 with timestamp +13 Waking up in 1.0 seconds. Cleaning up request 17 ID 19 with timestamp +13 Waking up in 0.5 seconds. Cleaning up request 18 ID 21 with timestamp +15 Cleaning up request 19 ID 22 with timestamp +15 Cleaning up request 20 ID 23 with timestamp +15 Cleaning up request 21 ID 24 with timestamp +15 Cleaning up request 22 ID 25 with timestamp +15 Cleaning up request 23 ID 26 with timestamp +15 Cleaning up request 24 ID 27 with timestamp +15 Cleaning up request 25 ID 28 with timestamp +15 Waking up in 1.0 seconds. Cleaning up request 26 ID 29 with timestamp +15 Ready to process requests. -- Mark

3 5

Re: Decoupled accounting
by Devinder Singh 04 Aug '09

04 Aug '09

Hi Ivan Before i generate the certificates do i need to delete any files from /etc/raddb/certs folder Devinder 2009/8/4 Ivan Kalik <tnt(a)kalik.net>: >> Ok once i have made the changes shoud i repeat the steps in the >> >> /etc/raddb/README to generate the certs , server and client once again? > > Yes, make certificates again. > > Ivan Kalik > Kalik Informatika ISP > > -- Devinder

1 0

Re: WPA
by Devinder Singh 04 Aug '09

04 Aug '09

Hi Ivan These are the changes made to Makefile client.csr client.key: client.cnf openssl req -new -out client.csr -keyout client.key -config ./client.cnf client.crt: client.csr ca.pem ca.key index.txt serial openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key $(PASSWORD_CA) -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf client.p12: client.crt openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12 -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT) client.pem: client.p12 openssl pkcs12 -in client.p12 -out client.pem -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT) cp client.pem $(USER_NAME).pem .PHONY: server.vrfy client.vrfy: ca.pem client.pem c_rehash . openssl verify -CApath . client.pem Ok iam about to re do the certiicates do i need to delete any files from /certs directory? 2009/8/4 Devinder Singh <devinbhullar(a)gmail.com>: > Ok > > 2009/8/4 Ivan Kalik <tnt(a)kalik.net>: >>> Ok once i have made the changes shoud i repeat the steps in the >>> >>> /etc/raddb/README to generate the certs , server and client once again? >> >> Yes, make certificates again. >> >> Ivan Kalik >> Kalik Informatika ISP >> >> > > > > -- > Devinder > -- Devinder

1 0

Re: Decoupled accounting
by Devinder Singh 04 Aug '09

04 Aug '09

Ok once i have made the changes shoud i repeat the steps in the /etc/raddb/README to generate the certs , server and client once again? 2009/8/4 Ivan Kalik <tnt(a)kalik.net>: >> ok could you let me know what do i need to alter in the Make File. >> >> Just wanted to make sure i dont do something wrong here >> >> What are the steps that i need to take to do this. >> >> I can see a Makefile in /etc/raddb/certs > > I don't know much about makefiles. I have altered one using "hit and miss" > method. > > Alter the client section like this: > > client.csr client.key: client.cnf > openssl req -new -out client.csr -keyout client.key -config > ./client.cnf > > client.crt: client.csr ca.pem ca.key index.txt serial > openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr > -key $(PASSWORD_CA) -out client.crt -extensions xpclient_ext > -extfile xpextensions -config ./client.cnf > > client.p12: client.crt > openssl pkcs12 -export -in client.crt -inkey client.key -out > client.p12 -passin pass:$(PASSWORD_CLIENT) -passout > pass:$(PASSWORD_CLIENT) > > client.pem: client.p12 > openssl pkcs12 -in client.p12 -out client.pem -passin > pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT) > cp client.pem $(USER_NAME).pem > > .PHONY: server.vrfy > client.vrfy: ca.pem client.pem > c_rehash . > openssl verify -CApath . client.pem > > > Ivan Kalik > Kalik Informatika ISP > > -- Devinder

1 0

Re: Decoupled accounting
by Devinder Singh 04 Aug '09

04 Aug '09

Hi Ivan, ok could you let me know what do i need to alter in the Make File. Just wanted to make sure i dont do something wrong here What are the steps that i need to take to do this. I can see a Makefile in /etc/raddb/certs Thanks Devinder 2009/8/4 Ivan Kalik <tnt(a)kalik.net>: > OK, I think this is the issue where Windows refuses to accept server > certificate as the intermediate CA. You should alter Makefile in certs to > sign client certificates with CA and not server certificate. > > Ivan Kalik > Kalik Informatika ISP > >> Hi Ivan >> >> >> I still get the same error now >> >> >> Found Auth-Type = EAP >> +- entering group authenticate {...} >> [eap] Request found, released from the list >> [eap] EAP/tls >> [eap] processing type tls >> [tls] Authenticate >> [tls] processing EAP-TLS >> [tls] eaptls_verify returned 7 >> [tls] Done initial handshake >> [tls] <<< TLS 1.0 Handshake [length 03b2], Certificate >> --> verify error:num=20:unable to get local issuer certificate >> [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca >> TLS Alert write:fatal:unknown CA >> TLS_accept:error in SSLv3 read client certificate B >> rlm_eap: SSL error error:140890B2:SSL >> routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned >> SSL: SSL_read failed in a system call (-1), TLS session fails. >> TLS receive handshake failed during operation >> [tls] eaptls_process returned 4 >> [eap] Handler failed in EAP/tls >> [eap] Failed in EAP select >> ++[eap] returns invalid >> Failed to authenticate the user. >> Using Post-Auth-Type Reject >> +- entering group REJECT {...} >> [attr_filter.access_reject] expand: %{User-Name} -> >> devinder(a)palettemm.com >> attr_filter: Matched entry DEFAULT at line 11 >> ++[attr_filter.access_reject] returns updated >> Delaying reject of request 7 for 1 seconds >> Going to the next request >> Waking up in 0.9 seconds. >> Sending delayed reject for request 7 >> Sending Access-Reject of id 141 to 203.121.4.59 port 6001 >> EAP-Message = 0x04070004 >> Message-Authenticator = 0x00000000000000000000000000000000 >> Waking up in 3.8 seconds. >> Cleaning up request 1 ID 135 with timestamp +120 >> Cleaning up request 2 ID 136 with timestamp +120 >> Cleaning up request 3 ID 137 with timestamp +120 >> Cleaning up request 4 ID 138 with timestamp +120 >> Cleaning up request 5 ID 139 with timestamp +120 >> Cleaning up request 6 ID 140 with timestamp +120 >> Waking up in 1.0 seconds. >> Cleaning up request 7 ID 141 with timestamp +120 >> Ready to process requests. >> >> >> >> 2009/8/4 Devinder Singh <devinbhullar(a)gmail.com>: >>> Ok i took your advise and yes its a diffeenrent error now >>> >>> Listening on authentication address * port 1812 >>> Listening on accounting address * port 1813 >>> Listening on proxy address * port 1814 >>> Ready to process requests. >>> rad_recv: Access-Request packet from host 203.121.4.59 port 6001, >>> id=134, length=181 >>> User-Name = "devinder(a)palettemm.com" >>> NAS-IP-Address = 203.121.4.59 >>> Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" >>> Calling-Station-Id = "00-04-23-7b-56-b9" >>> NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" >>> Framed-MTU = 1400 >>> NAS-Port-Type = Wireless-802.11 >>> EAP-Message = >>> 0x0203001b01646576696e6465724070616c657474656d6d2e636f6d >>> Message-Authenticator = 0xb7f29ed2232abda7b5b24bb131883617 >>> +- entering group authorize {...} >>> ++[preprocess] returns ok >>> ++[chap] returns noop >>> ++[mschap] returns noop >>> [suffix] Looking up realm "palettemm.com" for User-Name = >>> "devinder(a)palettemm.com" >>> [suffix] No such realm "palettemm.com" >>> ++[suffix] returns noop >>> [eap] EAP packet type response id 3 length 27 >>> [eap] No EAP Start, assuming it's an on-going EAP conversation >>> ++[eap] returns updated >>> ++[unix] returns notfound >>> [files] users: Matched entry devinder(a)palettemm.com at line 94 >>> ++[files] returns ok >>> ++[expiration] returns noop >>> ++[logintime] returns noop >>> [pap] WARNING! No "known good" password found for the user. >>> Authentication may fail because of this. >>> ++[pap] returns noop >>> Found Auth-Type = EAP >>> +- entering group authenticate {...} >>> [eap] EAP Identity >>> [eap] processing type md5 >>> rlm_eap_md5: Issuing Challenge >>> ++[eap] returns handled >>> Sending Access-Challenge of id 134 to 203.121.4.59 port 6001 >>> EAP-Message = 0x010400160410edd3007f1e599b71120693ed62eaee7c >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x17b5db9117b1dfd16583cca5ed9db022 >>> Finished request 0. >>> Going to the next request >>> Waking up in 4.9 seconds. >>> Cleaning up request 0 ID 134 with timestamp +1 >>> Ready to process requests. >>> >>> >>> >>> >>> >>> 2009/8/4 Devinder Singh <devinbhullar(a)gmail.com>: >>>> HI Ivan >>>> >>>> Thanks. Yes i have double click on the ca.der file and client.p12 both >>>> were installed successfuly. >>>> >>>> I also manaed to set up my SSID palstaff and when i click on the SSID >>>> i see a pop up windows on my wireles LAN asking for my username on >>>> certificate and i selected >>>> >>>> devinder(a)palettemm.com from the combo drop down list and click OK >>>> >>>> when i click OK radius reports the following error >>>> >>>> TLS Alert write:fatal:unknown CA >>>> TLS_accept:error in SSLv3 read client certificate B >>>> rlm_eap: SSL error error:140890B2:SSL >>>> routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned >>>> SSL: SSL_read failed in a system call (-1), TLS session fails. >>>> TLS receive handshake failed during operation >>>> [tls] eaptls_process returned 4 >>>> [eap] Handler failed in EAP/tls >>>> [eap] Failed in EAP select >>>> ++[eap] returns invalid >>>> Failed to authenticate the user. >>>> Using Post-Auth-Type Reject >>>> +- entering group REJECT {...} >>>> [attr_filter.access_reject] expand: %{User-Name} -> >>>> devinder(a)palettemm.com >>>> attr_filter: Matched entry DEFAULT at line 11 >>>> ++[attr_filter.access_reject] returns updated >>>> Delaying reject of request 6 for 1 seconds >>>> Going to the next request >>>> Waking up in 0.9 seconds. >>>> Sending delayed reject for request 6 >>>> Sending Access-Reject of id 133 to 203.121.4.59 port 6001 >>>> EAP-Message = 0x040a0004 >>>> Message-Authenticator = 0x00000000000000000000000000000000 >>>> Waking up in 3.6 seconds. >>>> Cleaning up request 0 ID 127 with timestamp +18 >>>> Cleaning up request 1 ID 128 with timestamp +18 >>>> Cleaning up request 2 ID 129 with timestamp +18 >>>> Cleaning up request 3 ID 130 with timestamp +18 >>>> Cleaning up request 4 ID 131 with timestamp +18 >>>> Waking up in 0.2 seconds. >>>> Cleaning up request 5 ID 132 with timestamp +18 >>>> Waking up in 1.0 seconds. >>>> Cleaning up request 6 ID 133 with timestamp +19 >>>> Ready to process requests. >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> 2009/8/4 Ivan Kalik <tnt(a)kalik.net>: >>>>>> I mnaged to follow the steps in /etc/raddb/certs/README >>>>>> >>>>>> and copied ca.der and client.p12 to XP machine >>>>> >>>>> It looks like you have copied them but not installed them in the >>>>> certificate store. Double-click the certificates and install them >>>>> first. >>>>> >>>>> Ivan Kalik >>>>> Kalik Informatika ISP >>>>> >>>>> >>>> >>>> >>>> >>>> -- >>>> Devinder >>>> >>> >>> >>> >>> -- >>> Devinder >>> >> >> >> >> -- >> Devinder >> > > > -- Devinder

1 0

LDAP PEAPv0/MSCHAPv2 Authentication
by Nicholas Cappelletti 04 Aug '09

04 Aug '09

Hello Everyone, I know I'll probably be berated with this and be told to read the documentation and the debug messages, but I'm at my whits end with this and would like a little direction, even if it a man page or something in the debug messages I missed. Okay, 802.1x for wireless works great when I'm using the default config files. I use the automatically generated cert and create a few users in the users config file. Here is the debug of that user authenticating: rad_recv: Access-Request packet from host 192.168.30.4 port 3072, id=0, length=221 Cleaning up request 31 ID 0 with timestamp +213 User-Name = "nick" NAS-IP-Address = 192.168.30.4 Called-Station-Id = "001217aa3fb7" Calling-Station-Id = "001b6301f74e" NAS-Identifier = "001217aa3fb7" NAS-Port = 56 Framed-MTU = 1400 State = 0xac75dd7bab7cc420d50c8e10f23f3553 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0209005b19001703010050e718360d0f11185fd80d47ada34e743f15ee4fe717bd546fdb0905964163642ec8de6d49e13fdaee97c1777c7729e8041f34f305d47aaabc0fc4814e76a3e2e69252faad5440929c8acf736479c90437 Message-Authenticator = 0x9c1f8ace22588eebd7a7e207c67d2910 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "nick", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 91 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x0209003f1a0209003a3172435718fc889114f133ce5f13aa7e3a00000000000000008cacb226a61d81100b7f0313485b86d7fba9bedb93207397006e69636b server { PEAP: Setting User-Name to nick Sending tunneled request EAP-Message = 0x0209003f1a0209003a3172435718fc889114f133ce5f13aa7e3a00000000000000008cacb226a61d81100b7f0313485b86d7fba9bedb93207397006e69636b FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "nick" State = 0xa4d2ade0a4dbb70aa318d5923f95834c server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "nick", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 9 length 63 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry nick at line 60 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for nick with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010a00331a0309002e533d35363630433534303036413841374444344632424236373344374337413542324634464431333331 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa4d2ade0a5d8b70aa318d5923f95834c [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a00331a0309002e533d35363630433534303036413841374444344632424236373344374337413542324634464431333331 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa4d2ade0a5d8b70aa318d5923f95834c [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.30.4 port 3072 EAP-Message = 0x010a005b190017030100506b9a851f88d541fab50c47c1df1b0f06e628cea25b716609ff7d21ffebf29b985165fdd96ab6f1b3dc4c2d5840af2cf164d2239c46fe412099ed9a43c2b6a4671d194f2a97c8a71b46a2194d27b2b16b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xac75dd7ba47fc420d50c8e10f23f3553 Finished request 32. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.30.4 port 3072, id=0, length=173 Cleaning up request 32 ID 0 with timestamp +213 User-Name = "nick" NAS-IP-Address = 192.168.30.4 Called-Station-Id = "001217aa3fb7" Calling-Station-Id = "001b6301f74e" NAS-Identifier = "001217aa3fb7" NAS-Port = 56 Framed-MTU = 1400 State = 0xac75dd7ba47fc420d50c8e10f23f3553 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020a002b19001703010020851f2695f1f66ef9a35dcb76dfa176acd5c47a131a8580c47eba67a5df577f00 Message-Authenticator = 0xdf5e02143bd04f312f52bdd368e70e7a +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "nick", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020a00061a03 server { PEAP: Setting User-Name to nick Sending tunneled request EAP-Message = 0x020a00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "nick" State = 0xa4d2ade0a5d8b70aa318d5923f95834c server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "nick", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 10 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry nick at line 60 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok } # server inner-tunnel [peap] Got tunneled reply code 2 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "nick" [peap] Got tunneled reply RADIUS code 2 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "nick" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.30.4 port 3072 EAP-Message = 0x010b002b190017030100204c7bbda36687bbec748250a331403e85fcb9bc35f2a071afec4b072eb3cd8cc4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xac75dd7ba57ec420d50c8e10f23f3553 Finished request 33. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.30.4 port 3072, id=0, length=173 Cleaning up request 33 ID 0 with timestamp +214 User-Name = "nick" NAS-IP-Address = 192.168.30.4 Called-Station-Id = "001217aa3fb7" Calling-Station-Id = "001b6301f74e" NAS-Identifier = "001217aa3fb7" NAS-Port = 56 Framed-MTU = 1400 State = 0xac75dd7ba57ec420d50c8e10f23f3553 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020b002b1900170301002018ce02e38e6c00b421658c4aedcbaa9b965e8c1c089954ec6a1fcc992a1468f8 Message-Authenticator = 0x48b93f3e89b5fc5a91a3d77f26ae3f35 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "nick", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 0 to 192.168.30.4 port 3072 MS-MPPE-Recv-Key = 0xa65e123a8723dbf8daff315d9eeefead767d1bf58f191a8cd2f14a3202535776 MS-MPPE-Send-Key = 0xfc919ac8721cfbf8ce4e09f20a9da90f63e65645ece3c293a878c58d7ae41af2 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "nick" Finished request 34. Going to the next request Waking up in 4.9 seconds. Cleaning up request 34 ID 0 with timestamp +214 Ready to process requests. ------------------------------------ And here is is when I configure the modules/ldap. This is with LDAP enabled for authentication in the sites-enabled/inner-tunnel with nothing else changed: rad_recv: Access-Request packet from host 192.168.30.4 port 3072, id=0, length=121 User-Name = "zack" NAS-IP-Address = 192.168.30.4 Called-Station-Id = "001217aa3fb7" Calling-Station-Id = "001b6301f74e" NAS-Identifier = "001217aa3fb7" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000009017a61636b Message-Authenticator = 0xba6a39bbf4d30c64ad62ca8af7de1e40 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "zack", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.30.4 port 3072 EAP-Message = 0x0101001604103d559c382e7e5d5dedb960b8107f467e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7a53d4d47a52d007e61d2d43d148851e Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.30.4 port 3072, id=0, length=121 Cleaning up request 0 ID 0 with timestamp +34 User-Name = "zack" NAS-IP-Address = 192.168.30.4 Called-Station-Id = "001217aa3fb7" Calling-Station-Id = "001b6301f74e" NAS-Identifier = "001217aa3fb7" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000009017a61636b Message-Authenticator = 0x3fa8484f6dc6f4a9dab5fccb4646fcf5 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "zack", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.30.4 port 3072 EAP-Message = 0x01010016041082fa9d0faaabc4dbae49e8c8fd2b8081 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0b7341550b724572c83e07f2140503b9 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 0 with timestamp +35 Ready to process requests. ----------------------------------- Again, I'm prepared to be told to look here or look there. I just need some guidence. :) --Nick

3 5

Simutaneus Check Query in FR2?
by Deepak 04 Aug '09

04 Aug '09

Hi, Currently my "Simultaneous-Use" attribute is not working and I have few questions regarding this. Following are my setup: ================ OS: CentOS 5.3 freeradius2-2.1.6 MySQL 5.0.45 PERL 5.8.8 =============== I am consulting the FAQ checklist. Some are not applicable to me since I am doing everything from SQL. 1) FAQ says "uncheck the Simutaneus check query in sql.conf" but I couldn't find that in in my sql.conf. Where is this in FR2? 2) in "/etc/raddb/sites-enable/default" I noticed that "radutmp" is uncommented by default in "session" and "accounting" section. I tried disabling this but no effect on simultaneous use. Do I need to turn on "radutmp" for something else (like for "radwho"? (What I mean is does any other part the freeradius use this feature for session and accounting purpose? Is it necessary to turn on this feature if I am using SQL for my session and accounting?) 3) I am trying to use "radwho" and it is giving me the error ========== "radwho: Error reading /var/log/radius/sradutmp: No such file or directory". ========== It is looking for "sradutmp" instead of "radutmp" which is not there. I guess probably it has its historical reasons. May be I can solve this my renaming the "radutmp" to "sradutmp" but I am not sure if I want to do that. 4) What are the other things I need to look for to solve this problem? Some suggestions greatly appreciated Thanks -- ============================== Registered Linux User #460714 Currently Using Fedora 10, CentOS 5.3 ==============================

2 4

Re: Freeradius-Users Digest, Vol 52, Issue 21
by Gilbert Lo 04 Aug '09

04 Aug '09

Thank you for your message. I am away until August 7th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

Re: Decoupled accounting
by Devinder Singh 04 Aug '09

04 Aug '09

HI Ivan Thanks. Yes i have double click on the ca.der file and client.p12 both were installed successfuly. I also manaed to set up my SSID palstaff and when i click on the SSID i see a pop up windows on my wireles LAN asking for my username on certificate and i selected devinder(a)palettemm.com from the combo drop down list and click OK when i click OK radius reports the following error TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> devinder(a)palettemm.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 133 to 203.121.4.59 port 6001 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.6 seconds. Cleaning up request 0 ID 127 with timestamp +18 Cleaning up request 1 ID 128 with timestamp +18 Cleaning up request 2 ID 129 with timestamp +18 Cleaning up request 3 ID 130 with timestamp +18 Cleaning up request 4 ID 131 with timestamp +18 Waking up in 0.2 seconds. Cleaning up request 5 ID 132 with timestamp +18 Waking up in 1.0 seconds. Cleaning up request 6 ID 133 with timestamp +19 Ready to process requests. 2009/8/4 Ivan Kalik <tnt(a)kalik.net>: >> I mnaged to follow the steps in /etc/raddb/certs/README >> >> and copied ca.der and client.p12 to XP machine > > It looks like you have copied them but not installed them in the > certificate store. Double-click the certificates and install them first. > > Ivan Kalik > Kalik Informatika ISP > > -- Devinder

1 2

WPA Authentication
by Devinder Singh 04 Aug '09

04 Aug '09

Hi I have followed the instructions in /etc/raddb/certs to generate root server and client certificates . i copied root.der and client.p12 to XP machine and managed to install without any problems on XP i had configured Proxim AP 700 with WPA authentication When i click on SSID palstaff i get a pop up to select the client devinder(a)palettemm.com When i ran radisud -X i get some strange error in SSL Need you assistance on this. files] users: Matched entry devinder(a)palettemm.com at line 94 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 03b2], Certificate --> verify error:num=20:unable to get local issuer certificate [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> devinder(a)palettemm.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 126 to 203.121.4.59 port 6001 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 0 ID 120 with timestamp +781 Cleaning up request 1 ID 121 with timestamp +781 Cleaning up request 2 ID 122 with timestamp +781 Cleaning up request 3 ID 123 with timestamp +781 Cleaning up request 4 ID 124 with timestamp +781 Cleaning up request 5 ID 125 with timestamp +781 Waking up in 1.0 seconds. Cleaning up request 6 ID 126 with timestamp +781 Ready to process requests. Devinder

1 0