September 2011 - Freeradius-Users - lists.freeradius.org

Re: rad_verify: Received Disconnect-ACK packet from home server with invalid signature! (Shared secret is incorrect.) for CoA, and PoD
by Alan DeKok 07 Sep '11

07 Sep '11

Martin wrote: > I forgot about radius -X. <sigh> If you're going to make it hard to help you, I'm just going to delete your posts. The debug output you posted is *useless*. You claimed it had problems when receiving packets. So to "help", you post a debug output... where it doesn't receive packets. > regarding the other AAA I don't have access to it. Then how do you know it works? Alan DeKok.

2 4

RADIUS Disconnect request support in free radius client -1.1.6
by vikraman.p36＠wipro.com 07 Sep '11

07 Sep '11

Hi , I am looking into Free radius client (freeradius-client-1.1.6) library code for using in our project. Please let me know if the Free radius client supports processing of the disconnect request message from RADIUS server which is defined in the RFC 5176. Thanks, Vikraman Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

rad_verify: Received Disconnect-ACK packet from home server with invalid signature! (Shared secret is incorrect.) for CoA, and PoD
by Martin 07 Sep '11

07 Sep '11

Hi, I am trying CoA and DM with Alvarion ASN-GW and all the time I see Shared secret is incorrect for the AcK/NaK messagess received from the ASN. With other AAA, based also on FR, it is not happeing. No. Time Source Destination Protocol Info 1 0.000000 192.168.60.28 192.168.60.122 RADIUS Disconnect-Request(40) (id=28, l=126) Frame 1: 168 bytes on wire (1344 bits), 168 bytes captured (1344 bits) Arrival Time: Sep 7, 2011 11:56:04.799904000 E. Europe Daylight Time Epoch Time: 1315385764.799904000 seconds [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 168 bytes (1344 bits) Capture Length: 168 bytes (1344 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:radius] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: IntelCor_3d:2f:ef (00:1b:21:3d:2f:ef), Dst: Cisco_82:0b:0c (00:23:33:82:0b:0c) Destination: Cisco_82:0b:0c (00:23:33:82:0b:0c) Address: Cisco_82:0b:0c (00:23:33:82:0b:0c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: IntelCor_3d:2f:ef (00:1b:21:3d:2f:ef) Address: IntelCor_3d:2f:ef (00:1b:21:3d:2f:ef) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.60.28 (192.168.60.28), Dst: 192.168.60.122 (192.168.60.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 154 Identification: 0xe708 (59144) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (17) Header checksum: 0x9963 [correct] [Good: True] [Bad: False] Source: 192.168.60.28 (192.168.60.28) Destination: 192.168.60.122 (192.168.60.122) User Datagram Protocol, Src Port: 44512 (44512), Dst Port: radius-dynauth (3799) Source port: 44512 (44512) Destination port: radius-dynauth (3799) Length: 134 Checksum: 0x46c1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Radius Protocol Code: Disconnect-Request (40) Packet identifier: 0x1c (28) Length: 126 Authenticator: d87a22f8d9e48cb34e67b846c34f78c7 [The response to this request is in frame 2] Attribute Value Pairs AVP: l=46 t=User-Name(1): 6323AFDFB8A0E5AAB2582D5F39DF038D(a)alvarion.ro User-Name: 6323AFDFB8A0E5AAB2582D5F39DF038D(a)alvarion.ro AVP: l=41 t=Vendor-Specific(26) v=WiMAX(24757) VSA: l=35 t=WiMAX-AAA-Session-Id(4) C=0x00: 313865643938336633633233373163366634626336393265... WiMAX-AAA-Session-Id: 313865643938336633633233373163366634626336393265... AVP: l=19 t=Calling-Station-Id(31): 00-17-c4-3d-41-ea Calling-Station-Id: 00-17-c4-3d-41-ea 0000 00 23 33 82 0b 0c 00 1b 21 3d 2f ef 08 00 45 00 .#3.....!=/...E. 0010 00 9a e7 08 00 00 40 11 99 63 c0 a8 3c 1c c0 a8 ......@..c..<... 0020 3c 7a ad e0 0e d7 00 86 46 c1 28 1c 00 7e d8 7a <z......F.(..~.z 0030 22 f8 d9 e4 8c b3 4e 67 b8 46 c3 4f 78 c7 01 2e ".....Ng.F.Ox... 0040 36 33 32 33 41 46 44 46 42 38 41 30 45 35 41 41 6323AFDFB8A0E5AA 0050 42 32 35 38 32 44 35 46 33 39 44 46 30 33 38 44 B2582D5F39DF038D 0060 40 61 6c 76 61 72 69 6f 6e 2e 72 6f 1a 29 00 00 @alvarion.ro.).. 0070 60 b5 04 23 00 31 38 65 64 39 38 33 66 33 63 32 `..#.18ed983f3c2 0080 33 37 31 63 36 66 34 62 63 36 39 32 65 30 63 38 371c6f4bc692e0c8 0090 39 64 66 66 65 1f 13 30 30 2d 31 37 2d 63 34 2d 9dffe..00-17-c4- 00a0 33 64 2d 34 31 2d 65 61 3d-41-ea No. Time Source Destination Protocol Info 2 0.006588 192.168.60.122 192.168.60.28 RADIUS Disconnect-ACK(41) (id=28, l=20) Frame 2: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) Arrival Time: Sep 7, 2011 11:56:04.806492000 E. Europe Daylight Time Epoch Time: 1315385764.806492000 seconds [Time delta from previous captured frame: 0.006588000 seconds] [Time delta from previous displayed frame: 0.006588000 seconds] [Time since reference or first frame: 0.006588000 seconds] Frame Number: 2 Frame Length: 62 bytes (496 bits) Capture Length: 62 bytes (496 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:radius] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_82:0b:0c (00:23:33:82:0b:0c), Dst: IntelCor_3d:2f:ef (00:1b:21:3d:2f:ef) Destination: IntelCor_3d:2f:ef (00:1b:21:3d:2f:ef) Address: IntelCor_3d:2f:ef (00:1b:21:3d:2f:ef) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_82:0b:0c (00:23:33:82:0b:0c) Address: Cisco_82:0b:0c (00:23:33:82:0b:0c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.60.122 (192.168.60.122), Dst: 192.168.60.28 (192.168.60.28) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 48 Identification: 0x0034 (52) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 63 Protocol: UDP (17) Header checksum: 0x41a2 [correct] [Good: True] [Bad: False] Source: 192.168.60.122 (192.168.60.122) Destination: 192.168.60.28 (192.168.60.28) User Datagram Protocol, Src Port: radius-dynauth (3799), Dst Port: 44512 (44512) Source port: radius-dynauth (3799) Destination port: 44512 (44512) Length: 28 Checksum: 0x9131 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Radius Protocol Code: Disconnect-ACK (41) Packet identifier: 0x1c (28) Length: 20 Authenticator: e175db63a6510f8f0e0319352deac6d8 [This is a response to a request in frame 1] [Time from request: 0.006588000 seconds] 0000 00 1b 21 3d 2f ef 00 23 33 82 0b 0c 08 00 45 00 ..!=/..#3.....E. 0010 00 30 00 34 40 00 3f 11 41 a2 c0 a8 3c 7a c0 a8 .0.4@.?.A...<z.. 0020 3c 1c 0e d7 ad e0 00 1c 91 31 29 1c 00 14 e1 75 <........1)....u 0030 db 63 a6 51 0f 8f 0e 03 19 35 2d ea c6 d8 .c.Q.....5-... Martin Ion

2 1

CoA proxying again
by Bjørn Mork 07 Sep '11

07 Sep '11

Hello, I am trying to setup CoA proxying to a number of Juniper MXes. These are a bit clumsy to configure as CoA servers: The CoA clients cannot be configured explicitly. Instead they reuse the auth/acct configuration, including secret, for CoA clients. So I have a few hundred CoA servers (NASes), and 3 radius servers authorized as CoA clients. Using FreeRADIUS to proxy CoA requests from ther real CoA clients looks like a perfect solution. My problem is that the configuration seems a bit clumsy, given that I cannot really change neither IP address nor secret from what's already there in the FreeRADIUS client definition. It would have been ideal to just add a flag or whatever, saying that "this client is also a CoA server", and allowing direct proxy to it using some virtual attribute. My current working configuration requires a separate static home_server and home_server_pool definition pointing to it for *each* NAS, as the only way I've found to redirect the CoA packets is by setting Home-Server-Pool. The documentation talks about Proxy-To-Realm as well, but I've been unable to find any parameter allowing me to configure a realm for CoA. realms only have auth{_pool,host} and acct{_pool,host} AFAICT. The per client CoA configuration doesn't look like anything I can use at all. If I understand it correctly, that's only for the *CoA clients*. Is this a correct view of the current (2.1.x) state of CoA proxying, or did I miss something? I believe I saw a request for dynamic home servers recently. Looks like that might be something for me as well. Bjørn

3 4

SQL IP Pool Control Attribute Placement
by Det Det 07 Sep '11

07 Sep '11

Hi, For the sqlippool, http://wiki.freeradius.org/Rlm_sqlippool, which table should the below control attribute be placed on? It says, it is not a reply attribute, does it then go to radcheck/radgroupcheck table? DEFAULT Pool-Name := main_pool Fall-Through = Yes thanks, det

2 1

Radius Access-Challenge and Apache
by Daniel Abels 07 Sep '11

07 Sep '11

Hi all, I have developed a rlm_perl script for FreeRadius to provide an Access-Challenge response upon an initial successful login (i.e. enter username & password, receive access-challenge, then enter a code.) I'm having some trouble getting the an access-challenge "reply message" to display on a web browser. I'm not sure if I have something configured incorrectly, or If my expectations of what the apache module (mod-auth-radius) should be doing is wrong. According to the documentation from the mod_auth_radius README, when the module receives an "Access-Challenge" response: "...you'll see your username displayed, along with the RADIUS Reply-Message at the top of the authentication window." But I see no such reply-message in the browser. It just displays the same Authentication Realm message ("Radius Authentication Test") for each prompt (tested in Firefox.) I was expecting the reply-message (which is "Please Enter Code") to be displayed instead, is that possible? Upon examining the source code for the module, there appears to be code to handle this. Using Wireshark, it also appears that this message is not returned to the browser. Anyway, if the user enters the correct code at this point, they can reach the web page successfully, so the authentication side of things is not a problem. The server is Debian (squeeze) with freeradius (2.1.10+dfsg-2), apache (2.2.16-6+squeeze1) and libapache2-mod-auth-radius (1.5.8-1) The important portion of my apache configuration is below: # Radius Server Authentication AddRadiusAuth localhost:1812 testing123 5 AddRadiusCookieValid 5 # Test Radius Authentication <Directory /var/www/test/> Options Indexes FollowSymLinks MultiViews AuthType Basic AuthName "Radius Authentication Test" AuthBasicAuthoritative Off AuthBasicProvider radius AuthRadiusAuthoritative On AuthRadiusActive On Require valid-user </Directory> I have performed other tests using a Cisco VPN concentrator and Cisco's VPN client on Windows 7, this works great - the "Access-Challenge" response works (It returns the message "Please Enter Code".) On the command line, this also works using radtest, see below: # radtest user testing localhost 10 testing123 Sending Access-Request of id 150 to 127.0.0.1 port 1812 User-Name = "user" User-Password = "testing" NAS-IP-Address = 127.0.1.1 NAS-Port = 10 rad_recv: Access-Challenge packet from host 127.0.0.1 port 1812, id=150, length=50 Reply-Message = "Please Enter Code" State = 0x6368616c6c656e6765 Any assistance on this matter would be greatly appreciated! Regards, Daniel Abels

2 3

problem with chillispot
by Frank Bonnet 07 Sep '11

07 Sep '11

Hello I'm in trouble using chillispot with freeradius on ubuntu 11.04 server freeradius works well with a LDAP backend but when I start chillispot I get that kind of error messages, the shared secret is OK on both sides as it is a testing install I haven't touch the famous "testing123" Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 56851, id=0, length=162 Received packet from 127.0.0.1 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 56851, id=1, length=162 Received packet from 127.0.0.1 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Going to the next request Thank you for any idea ...

6 8

Simultaneous Use Per Domain
by Det Det 07 Sep '11

07 Sep '11

Hi, Just want to get inputs on how simultaneous-use can be checked per domain not per user. That is limit mydomain.com to have simultaneous-use=x. radgroupcheck will have something like mydomain.com -- simultaneous-use -- x thanks! det

1 0

accounting based on message type
by Travis Dimmig 06 Sep '11

06 Sep '11

I use the jradius module for processing radius accounting packets, is there a way in freeRadius 1.X to specify that I only want to pass accounting start and stop packets to jradius? In 2.X it seems I can check out the packet's Acct-Status-Type in acct_users and set the Acct-Type attribute pair, and then use that to branch to different accounting modules. Since the acct_users file in 1.X seems to only allow me to specify an external executable, however, I can't seem to find a way to do this on the older version of freeRadius. Travis Dimmig Software Development Specialist Impulse Point www.impulse.com<http://www.impulse.com>

1 0

PEAP Authentication Problems with Windows Users
by Jacob Dawson 06 Sep '11

06 Sep '11

We're having an odd problem here, and I just can't pin down quite where to look to fix it. We use PEAP-MSCHAPv2 for authentication of our windows domain users on wireless. This is accomplished by terminating the TLS conversation at FreeRADIUS and sending along the MSCHAP conversation to an IAS server. We've tested this in the past, and it's worked fine, and we're doing a modified form of this in production, and it's working fine, but I've lately been unable to get it to work in our pre-production 2.1.11 environment. What's particularly odd is that it's only affecting the Windows clients. My OS X client doing PEAP with the same credentials is happy. What we're doing in production, which continues to work, is this: We terminate TLS at FreeRADIUS. This allows us to manage the wireless service certificate there, keeps the IAS operators from having to keep up with it. We proxy the MSCHAP conversation to our OpenRADIUS server (which is also running and interacting with TACACS). OpenRADIUS proxies the CHAP stuff to IAS. It may be tinkering with the MSCHAP fields from IAS to make them more compatible (basically changing out the secrets because it's standing in the middle). Successful authentication then percolates back through the chain and the user is happy. In pre-production, it looks like this: Request comes in from Windows client, is recognized to be a Domain authentication request, gets proxied to an FR virtual server. Said virtual server gets it, processes the TLS and terminates it, and proxies the MSCHAP conversation to IAS. IAS does its MSCHAP thing, accepts the user. Access-Accept percolates back up through the chain. We send an access challenge, the user sends an Access request, and FR says the user said something weird, so it's rejecting them. Request comes in from non-windows client, is recognized to be Domain authentication request, gets proxied to an FR virtual server Said virtual server gets it, processes the TLS and terminates it, and proxies the MSCHAP conversation to IAS. IAS does its MSCHAP thing, accepts the user. Access-Accept percolates back up through the chain. We send an access challenge, the user sends an Access request, and FR says everything's fine, user gets Access-Accept. Thoughts on where I need to look? I can't parse out what's happening to cause a response to be invalid for Windows users but not for, say, Mac users. Our initial guess here is that the Windows clients are looking at the MPPE keys, and are unhappy about them, whereas the Mac clients are not, though we suspect neither set of clients requires them. Posting relevant bits of debug output below. Thanks much, Jacob M. Dawson --------- Pre-production failure: rad_recv: Access-Request packet from host 198.82.171.153 port 32768, id=138, length=293 User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address = 198.82.171.153 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" EAP-Message = 0x020b005f19001703010054bdd79574acfa8744908880dfa66a9e861f5fff5d2b3b7e387679b867704afa60476df6cc1ac0f30d92a4dc753cebb4bc4e71f4e0bc4db75534ab2403ec993619f05ad02497597deaa193debe78641e14b4718e84 State = 0x5b4a8e485341972bae816e794759d3ea Message-Authenticator = 0xc234d7f3f04c9d023687fd78e4d5c9da (75) # Executing section authorize from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (75) group authorize { (75) - entering group authorize {...} (75) policy split_username_prefix { (75) - entering policy split_username_prefix {...} (75) ? if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) (75) ? Evaluating (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) -> TRUE (75) ? if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) -> TRUE (75) if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) { (75) - entering if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) {...} (75) update request { (75) expand: %{2} -> dawson (75) expand: %{1} -> HOKIES (75) } # update request = notfound (75) [updated] = updated (75) - if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) returns updated (75) ... skipping else for request 75: Preceding "if" was taken (75) - policy split_username_prefix returns updated (75) policy split_username_suffix { (75) - entering policy split_username_suffix {...} (75) ? if (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) (75) ? Evaluating (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) -> FALSE (75) ? if (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) -> FALSE (75) else else { (75) - entering else else {...} (75) [noop] = noop (75) - else else returns noop (75) - policy split_username_suffix returns noop (75) [preprocess] = ok (75) auth_log : expand: /usr/local/freeradius-2.1.11/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/freeradius-2.1.11/var/log/radius/radacct/198.82.171.153/auth-detail-20110823 (75) auth_log : /usr/local/freeradius-2.1.11/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/freeradius-2.1.11/var/log/radius/radacct/198.82.171.153/auth-detail-20110823 (75) auth_log : expand: %t -> Tue Aug 23 10:40:16 2011 (75) [auth_log] = ok rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Tunnel-Type = VLAN rlm_perl: Added pair State = 0x5b4a8e485341972bae816e794759d3ea rlm_perl: Added pair Called-Station-Id = 00-21-55-4d-c4-40:CNS-Test rlm_perl: Added pair Message-Authenticator = 0xc234d7f3f04c9d023687fd78e4d5c9da rlm_perl: Added pair Airespace-Wlan-Id = 17 rlm_perl: Added pair Stripped-User-Domain = HOKIES rlm_perl: Added pair NAS-IP-Address = 198.82.171.153 rlm_perl: Added pair Tunnel-Private-Group-Id = 1381 rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802 rlm_perl: Added pair Calling-Station-Id = 00-1d-e0-90-5f-db rlm_perl: Added pair User-Name = HOKIES\\dawson rlm_perl: Added pair NAS-Identifier = cas-6509-3.wsm8b rlm_perl: Added pair EAP-Message = 0x020b005f19001703010054bdd79574acfa8744908880dfa66a9e861f5fff5d2b3b7e387679b867704afa60476df6cc1ac0f30d92a4dc753cebb4bc4e71f4e0bc4db75534ab2403ec993619f05ad02497597deaa193debe78641e14b4718e84 rlm_perl: Added pair Stripped-User-Name = dawson rlm_perl: Added pair NAS-Port = 29 rlm_perl: Added pair Framed-MTU = 1300 (75) [perl] = noop (75) ? if ("%{Stripped-User-Domain}" != "HOKIES") (75) expand: %{Stripped-User-Domain} -> HOKIES (75) ? Evaluating ("%{Stripped-User-Domain}" != "HOKIES") -> FALSE (75) ? if ("%{Stripped-User-Domain}" != "HOKIES") -> FALSE (75) eap : EAP packet type response id 11 length 95 (75) eap : Continuing tunnel setup. (75) [eap] = ok (75) Found Auth-Type = ? (75) # Executing group from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (75) group authenticate { (75) - entering group authenticate {...} (75) eap : Request found, released from the list (75) eap : EAP/peap (75) eap : processing type peap (75) peap : processing EAP-TLS (75) peap : eaptls_verify returned 7 (75) peap : Done initial handshake (75) peap : eaptls_process returned 7 (75) peap : FR_TLS_OK (75) peap : Session established. Decoding tunneled attributes. (75) peap : Peap state phase2 (75) peap : EAP type mschapv2 (75) peap : Got tunneled request EAP-Message = 0x020b00481a020b004331bf4d439d3028cbdba8fff532c04f1cf60000000000000000bee44f94acbe708a682535adc0505e56a87462580576d06600484f4b4945535c646177736f6e server { (75) peap : Setting User-Name to HOKIES\dawson Sending tunneled request EAP-Message = 0x020b00481a020b004331bf4d439d3028cbdba8fff532c04f1cf60000000000000000bee44f94acbe708a682535adc0505e56a87462580576d06600484f4b4945535c646177736f6e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "HOKIES\\dawson" State = 0x21ebcfee21e0d5ab22fbf5cfb29bfd25 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Tunnel-Type:0 = VLAN Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-IP-Address = 198.82.171.153 Tunnel-Private-Group-Id:0 = "1381" Tunnel-Medium-Type:0 = IEEE-802 Calling-Station-Id = "00-1d-e0-90-5f-db" NAS-Identifier = "cas-6509-3.wsm8b" NAS-Port = 29 Framed-MTU = 1300 server proxy-inner-tunnel { (75) # Executing section authorize from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/proxy-inner-tunnel (75) group authorize { (75) - entering group authorize {...} (75) ? if ("%{User-Name}" =~ /^(host\/.*)$/) (75) expand: %{User-Name} -> HOKIES\dawson (75) ? Evaluating ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE (75) ? if ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE (75) else else { (75) - entering else else {...} (75) update control { (75) } # update control = notfound (75) - else else returns notfound } # server proxy-inner-tunnel (75) peap : Got tunneled reply code 0 PEAP: Calling authenticate in order to initiate tunneled EAP session. (75) # Executing group from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/proxy-inner-tunnel (75) group authenticate { (75) - entering group authenticate {...} (75) eap : Request found, released from the list (75) eap : EAP/mschapv2 (75) eap : processing type mschapv2 rlm_eap_mschapv2: cancelling authentication and letting it be proxied (75) eap : Not-EAP proxy set. Not composing EAP (75) [eap] = handled PEAP: Tunneled authentication will be proxied to DomainUser PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy. (75) eap : Tunneled session will be proxied. Not doing EAP. (75) [eap] = handled (75) WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 161 to 198.82.160.219 port 1812 User-Name = "HOKIES\\dawson" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Tunnel-Type:0 = VLAN Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-IP-Address = 198.82.171.153 Tunnel-Private-Group-Id:0 = "1381" Tunnel-Medium-Type:0 = IEEE-802 Calling-Station-Id = "00-1d-e0-90-5f-db" NAS-Identifier = "cas-6509-3.wsm8b" NAS-Port = 29 Framed-MTU = 1300 MS-CHAP-Challenge = 0xd3827513a357a99d4eb9a5c87a716418 MS-CHAP2-Response = 0x0b4fbf4d439d3028cbdba8fff532c04f1cf60000000000000000bee44f94acbe708a682535adc0505e56a87462580576d066 Proxy-State = 0x313338 (75) Proxying request to home server 198.82.160.219 port 1812 Sending Access-Request of id 161 to 198.82.160.219 port 1812 User-Name = "HOKIES\\dawson" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Tunnel-Type:0 = VLAN Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-IP-Address = 198.82.171.153 Tunnel-Private-Group-Id:0 = "1381" Tunnel-Medium-Type:0 = IEEE-802 Calling-Station-Id = "00-1d-e0-90-5f-db" NAS-Identifier = "cas-6509-3.wsm8b" NAS-Port = 29 Framed-MTU = 1300 MS-CHAP-Challenge = 0xd3827513a357a99d4eb9a5c87a716418 MS-CHAP2-Response = 0x0b4fbf4d439d3028cbdba8fff532c04f1cf60000000000000000bee44f94acbe708a682535adc0505e56a87462580576d066 Proxy-State = 0x313338 Waking up in 0.2 seconds. rad_recv: Access-Accept packet from host 198.82.160.219 port 1812, id=161, length=219 DEBUG: Compare b472204 to calculated digest f796ca40, secret temporaryS3CR3T Proxy-State = 0x313338 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x6538078a000001370001c652a0db01cc5476fe414ece0000000000004586 MS-MPPE-Recv-Key = 0x7208bb9a9555b125d123303ac3db12a1 MS-MPPE-Send-Key = 0x0cd6218a695a558ade111bcd7b05cfc2 MS-CHAP2-Success = 0x0b533d32434230433038364541464632333233453842414534314643443231333130453939354641454134 MS-CHAP-Domain = "\013HOKIES" (75) # Executing section post-proxy from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (75) group post-proxy { (75) - entering group post-proxy {...} (75) eap : Doing post-proxy callback (75) eap : Passing reply from proxy back into the tunnel. server proxy-inner-tunnel { (75) eap : Passing reply back for EAP-MS-CHAP-V2 (75) # Executing section post-proxy from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/proxy-inner-tunnel (75) group post-proxy { (75) - entering group post-proxy {...} (75) [eap] = noop (75) WARNING: Empty post-auth section. Using default return values. } # server proxy-inner-tunnel (75) eap : Final reply from tunneled session code 2 Proxy-State = 0x313338 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x6538078a000001370001c652a0db01cc5476fe414ece0000000000004586 MS-MPPE-Recv-Key = 0x7208bb9a9555b125d123303ac3db12a1 MS-MPPE-Send-Key = 0x0cd6218a695a558ade111bcd7b05cfc2 MS-CHAP2-Success = 0x0b533d32434230433038364541464632333233453842414534314643443231333130453939354641454134 MS-CHAP-Domain = "\013HOKIES" (75) eap : Got reply 2 (75) eap : Got tunneled reply RADIUS code 2 Proxy-State = 0x313338 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x6538078a000001370001c652a0db01cc5476fe414ece0000000000004586 MS-MPPE-Recv-Key = 0x7208bb9a9555b125d123303ac3db12a1 MS-MPPE-Send-Key = 0x0cd6218a695a558ade111bcd7b05cfc2 MS-CHAP2-Success = 0x0b533d32434230433038364541464632333233453842414534314643443231333130453939354641454134 MS-CHAP-Domain = "\013HOKIES" (75) eap : Tunneled authentication was successful. (75) eap : SUCCESS (75) eap : Reply was handled (75) [eap] = ok (75) Found Auth-Type = ? (75) Found Auth-Type = ? (75) Warning: Found 2 auth-types on request for user 'HOKIES\dawson' (75) Auth-Type = Accept, accepting the user (75) Login OK: [HOKIES\\dawson] (from client 198.82.171.153 port 29 cli 00-1d-e0-90-5f-db) (75) # Executing section post-auth from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (75) group post-auth { (75) - entering group post-auth {...} (75) [exec] = noop Sending Access-Challenge of id 138 to 198.82.171.153 port 32768 EAP-Message = 0x010c00261900170301001b0167b434a0313cb3f29b20e1f731efe3d173083c964cda1451135a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5b4a8e485246972bae816e794759d3ea (75) Finished request 75. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 198.82.171.153 port 32768, id=139, length=236 User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address = 198.82.171.153 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" EAP-Message = 0x020c00261900170301001b00dae368dd150e9d42e0c8888cb128e6ecc520b887a849a8a1d743 State = 0x5b4a8e485246972bae816e794759d3ea Message-Authenticator = 0x26b42d72271f1819599977a28920622f (76) # Executing section authorize from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (76) group authorize { (76) - entering group authorize {...} (76) policy split_username_prefix { (76) - entering policy split_username_prefix {...} (76) ? if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) (76) ? Evaluating (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) -> TRUE (76) ? if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) -> TRUE (76) if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) { (76) - entering if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) {...} (76) update request { (76) expand: %{2} -> dawson (76) expand: %{1} -> HOKIES (76) } # update request = notfound (76) [updated] = updated (76) - if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) returns updated (76) ... skipping else for request 76: Preceding "if" was taken (76) - policy split_username_prefix returns updated (76) policy split_username_suffix { (76) - entering policy split_username_suffix {...} (76) ? if (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) (76) ? Evaluating (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) -> FALSE (76) ? if (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) -> FALSE (76) else else { (76) - entering else else {...} (76) [noop] = noop (76) - else else returns noop (76) - policy split_username_suffix returns noop (76) [preprocess] = ok (76) auth_log : expand: /usr/local/freeradius-2.1.11/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/freeradius-2.1.11/var/log/radius/radacct/198.82.171.153/auth-detail-20110823 (76) auth_log : /usr/local/freeradius-2.1.11/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/freeradius-2.1.11/var/log/radius/radacct/198.82.171.153/auth-detail-20110823 (76) auth_log : expand: %t -> Tue Aug 23 10:40:16 2011 (76) [auth_log] = ok rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Tunnel-Type = VLAN rlm_perl: Added pair State = 0x5b4a8e485246972bae816e794759d3ea rlm_perl: Added pair Called-Station-Id = 00-21-55-4d-c4-40:CNS-Test rlm_perl: Added pair Message-Authenticator = 0x26b42d72271f1819599977a28920622f rlm_perl: Added pair Airespace-Wlan-Id = 17 rlm_perl: Added pair Stripped-User-Domain = HOKIES rlm_perl: Added pair NAS-IP-Address = 198.82.171.153 rlm_perl: Added pair Tunnel-Private-Group-Id = 1381 rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802 rlm_perl: Added pair Calling-Station-Id = 00-1d-e0-90-5f-db rlm_perl: Added pair User-Name = HOKIES\\dawson rlm_perl: Added pair NAS-Identifier = cas-6509-3.wsm8b rlm_perl: Added pair EAP-Message = 0x020c00261900170301001b00dae368dd150e9d42e0c8888cb128e6ecc520b887a849a8a1d743 rlm_perl: Added pair Stripped-User-Name = dawson rlm_perl: Added pair NAS-Port = 29 rlm_perl: Added pair Framed-MTU = 1300 (76) [perl] = noop (76) ? if ("%{Stripped-User-Domain}" != "HOKIES") (76) expand: %{Stripped-User-Domain} -> HOKIES (76) ? Evaluating ("%{Stripped-User-Domain}" != "HOKIES") -> FALSE (76) ? if ("%{Stripped-User-Domain}" != "HOKIES") -> FALSE (76) eap : EAP packet type response id 12 length 38 (76) eap : Continuing tunnel setup. (76) [eap] = ok (76) Found Auth-Type = ? (76) # Executing group from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (76) group authenticate { (76) - entering group authenticate {...} (76) eap : Request found, released from the list (76) eap : EAP/peap (76) eap : processing type peap (76) peap : processing EAP-TLS (76) peap : eaptls_verify returned 7 (76) peap : Done initial handshake (76) peap : eaptls_process returned 7 (76) peap : FR_TLS_OK (76) peap : Session established. Decoding tunneled attributes. (76) peap : Peap state send tlv success (76) peap : Received EAP-TLV response. (76) peap : Client rejected our response. The password is probably incorrect. (76) peap : We sent a success, but received something weird in return. (76) eap : Handler failed in EAP/peap (76) eap : Failed in EAP select (76) [eap] = invalid (76) Failed to authenticate the user. (76) Login incorrect: [HOKIES\\dawson] (from client 198.82.171.153 port 29 cli 00-1d-e0-90-5f-db) (76) Using Post-Auth-Type Reject (76) # Executing group from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (76) group REJECT { (76) - entering group REJECT {...} (76) attr_filter.access_reject : expand: %{User-Name} -> HOKIES\dawson attr_filter: Matched entry DEFAULT at line 11 (76) [attr_filter.access_reject] = updated (76) Finished request 76. Waking up in 0.2 seconds. Waking up in 0.6 seconds. (76) Sending delayed reject Sending Access-Reject of id 139 to 198.82.171.153 port 32768 EAP-Message = 0x040c0004 Message-Authenticator = 0x00000000000000000000000000000000 ----- Production Success: Waking up in 4.9 seconds. User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address = 198.82.171.153 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" EAP-Message = 0x020a005f1900170301005499a000fc4d08b0c067d3251047d61b836767466160c386b38d37d4b6c39b07ce3b09c85590c8a923419e6f0ae464ac472050214b71b4d641e06f8a439348319233d622cd7900f8f172726407b0010bcb54c6a1d6 State = 0x764462057e4e7bc59f1c525ed4400d40 Message-Authenticator = 0xd9566738adb17439ce7d7568c8bc8264 +- entering group authorize ++[mschap] returns noop rlm_eap: EAP packet type response id 10 length 95 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group EAP rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Setting User-Name to HOKIES\dawson +- entering group authorize ++? if ("%{User-Name}" =~ /^(host\/.*)$/) expand: %{User-Name} -> HOKIES\dawson ? Evaluating ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE ++? if ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE ++- entering else else +++[control] returns notfound ++- else else returns notfound PEAP: Calling authenticate in order to initiate tunneled EAP session. +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Not-EAP proxy set. Not composing EAP ++[eap] returns handled PEAP: Tunneled authentication will be proxied to openradius PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy. Tunneled session will be proxied. Not doing EAP. ++[eap] returns handled +- entering group pre-proxy preproxy_users: Matched entry DEFAULT at line 1 ++[files] returns ok User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address := 198.82.247.103 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type := Framed-User Framed-MTU = 1300 NAS-Port-Type := Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" MS-CHAP-Challenge = 0x20760eb105e545d6a131f324c1d30464 MS-CHAP2-Response = 0x0a4f84e590f059f31dc3ca5b621b238582190000000000000000385984c78f91f816edb8f1b279838a0a890bdd6573bac9f7 Proxy-State = 0x323433 Proxying request 9 to home server 198.82.247.67 port 1812 User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address := 198.82.247.103 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type := Framed-User Framed-MTU = 1300 NAS-Port-Type := Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" MS-CHAP-Challenge = 0x20760eb105e545d6a131f324c1d30464 MS-CHAP2-Response = 0x0a4f84e590f059f31dc3ca5b621b238582190000000000000000385984c78f91f816edb8f1b279838a0a890bdd6573bac9f7 Proxy-State = 0x323433 Going to the next request Waking up in 0.9 seconds. Framed-Protocol = PPP Service-Type = Framed-User MS-MPPE-Recv-Key = 0xe32365fe45921738025084f44fd7822a MS-MPPE-Send-Key = 0xf65c13fbcd70a80768ea868ec27085ff MS-CHAP2-Success = 0x0a533d46333146313034313438374339373131303542344546363341364339333146344135424141383434 MS-CHAP-Domain = "\nHOKIES" +- entering group post-proxy rlm_eap: Doing post-proxy callback PEAP: Passing reply from proxy back into the tunnel. PEAP: Passing reply back for EAP-MS-CHAP-V2 +- entering group post-proxy rlm_eap: Doing post-proxy callback rlm_eap_mschapv2: Passing reply from proxy back into the tunnel 0x1cd469a0 2. rlm_eap_mschapv2: Authentication succeeded. MSCHAP Success ++[eap] returns ok PEAP: Got reply 11 PEAP: Got tunneled Access-Challenge PEAP: Reply was handled ++[eap] returns ok EAP-Message = 0x010b004a1900170301003f084cf62c48fb9b9e951aa3801c9a88bbe2078c7a667df320929296299bdff2863bf8572a744dac5d9409953cda9855feca24aa24b8205677fbf3f7e3767f36 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x764462057f4f7bc59f1c525ed4400d40 Finished request 9. Going to the next request Waking up in 4.9 seconds. User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address = 198.82.171.153 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" EAP-Message = 0x020b001d19001703010012091d2f1089b72dd14c76daf331c2dc4de167 State = 0x764462057f4f7bc59f1c525ed4400d40 Message-Authenticator = 0xee39bc3d804727c33f69fc7d8172d2bf +- entering group authorize ++[mschap] returns noop rlm_eap: EAP packet type response id 11 length 29 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group EAP rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Setting User-Name to HOKIES\dawson +- entering group authorize ++? if ("%{User-Name}" =~ /^(host\/.*)$/) expand: %{User-Name} -> HOKIES\dawson ? Evaluating ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE ++? if ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE ++- entering else else +++[control] returns notfound ++- else else returns notfound PEAP: Calling authenticate in order to initiate tunneled EAP session. +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler ++[eap] returns ok PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS ++[eap] returns handled EAP-Message = 0x010c00261900170301001badffc5c8196273037ffc5ae8b421cb5a11d4cdbf3d67e521a2dd10 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x764462057c487bc59f1c525ed4400d40 Finished request 10. Going to the next request Waking up in 4.9 seconds. User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address = 198.82.171.153 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" EAP-Message = 0x020c00261900170301001be252b19386182f2a3d9b6255f0b51007da074f90f732568c1dfbb8 State = 0x764462057c487bc59f1c525ed4400d40 Message-Authenticator = 0xc04ab29e63cd60e30bfd3fed2ba3be09 +- entering group authorize ++[mschap] returns noop rlm_eap: EAP packet type response id 12 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group EAP rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Success rlm_eap: Freeing handler ++[eap] returns ok perl_pool: item 0x17a6e7a0 asigned new request. Handled so far: 1 found interpetator at address 0x17a6e7a0 rlm_perl: no serial number; assuming non-TLS authentication rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Tunnel-Type = VLAN rlm_perl: Added pair State = 0x764462057c487bc59f1c525ed4400d40 rlm_perl: Added pair Called-Station-Id = 00-21-55-4d-c4-40:CNS-Test rlm_perl: Added pair Message-Authenticator = 0xc04ab29e63cd60e30bfd3fed2ba3be09 rlm_perl: Added pair Airespace-Wlan-Id = 17 rlm_perl: Added pair EAP-Type = PEAP rlm_perl: Added pair NAS-IP-Address = 198.82.171.153 rlm_perl: Added pair Tunnel-Private-Group-Id = 1381 rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802 rlm_perl: Added pair Calling-Station-Id = 00-1d-e0-90-5f-db rlm_perl: Added pair User-Name = HOKIES\\dawson rlm_perl: Added pair NAS-Identifier = cas-6509-3.wsm8b rlm_perl: Added pair EAP-Message = 0x020c00261900170301001be252b19386182f2a3d9b6255f0b51007da074f90f732568c1dfbb8 rlm_perl: Added pair NAS-Port = 29 rlm_perl: Added pair Framed-MTU = 1300 rlm_perl: Added pair User-Name = HOKIES\\dawson rlm_perl: Added pair MS-MPPE-Recv-Key = 0x4e3e827b7fb173dbe293fadd607586b838cd55ae5261090fd483569509a070de rlm_perl: Added pair EAP-Message = 0x030c0004 rlm_perl: Added pair MS-MPPE-Send-Key = 0xb43ef9e36d44d66d205184ee8ca81f0f14e3a52cd254bd27268c7c99f58a18b0 rlm_perl: Added pair Message-Authenticator = 0x00000000000000000000000000000000 rlm_perl: Added pair Auth-Type = EAP perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x17a6e7a0 ++[perl] returns ok Login OK: [HOKIES\\\\dawson/<via Auth-Type = EAP>] (from client cas-6509-3.wsm8b port 29 cli 00-1d-e0-90-5f-db) User-Name = "HOKIES\\\\dawson" MS-MPPE-Recv-Key = 0x4e3e827b7fb173dbe293fadd607586b838cd55ae5261090fd483569509a070de EAP-Message = 0x030c0004 MS-MPPE-Send-Key = 0xb43ef9e36d44d66d205184ee8ca81f0f14e3a52cd254bd27268c7c99f58a18b0 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 11. Going to the next request Waking up in 4.9 seconds.

1 1