June 2012 - Freeradius-Users - lists.freeradius.org

reject reason logged in radius.log. Possible?
by Daniele Albrizio 14 Jun '12

14 Jun '12

I recently set up a banned mac address database to reject authentication from proved compromised clients. I'd like to have a significant record in freeradius logfile for connection debugging reasons. Ways I use to implement this results in ambiguous "Invalid user" or "Login incorrect" misleading messages in radius.log . Users are in effect valid and correct, but their equipment is not. Does anybody know how this scenario can be improved? ----------- Relevant lines of default virtual server authorize section are: authorize { if ( "%{Calling-Station-Id}" =~ /([a-fA-F0-9]{2}.?){6}/ && "%{sql: SELECT 1 FROM callingstidbanlist WHERE mac='%{Calling-Station-Id}'}" == 1 ) { update reply { # Select ban reason from radgroupreply Port-Message attribute related to the ban group Reply-Message := "Access forbidden from this terminal ( %{sql: SELECT value FROM radgroupreply WHERE attribute = 'Port-Message' AND groupname IN (SELECT bangroup FROM callingstidbanlist WHERE mac = '%{Calling-Station-Id}' ) ; } ) ." } #update control { # Auth-Type := Reject #} # Line in radius.log: # Auth: Login incorrect: [myusername] (from client wall1-wigate1 port 122 cli 00-1C-CC-C3-C7-1A) reject # Line in radius.log: # Auth: Invalid user: [myusername] (from client wall1-wigate1 port 122 cli 00-1C-CC-C3-C7-1A) } } -- Daniele ALBRIZIO - albrizio(a)univ.trieste.it Tel. +39-040.558.3319 UNIVERSITY OF TRIESTE - Network Services Divisione V - Infrastrutture e Servizi Informativi via Alfonso Valerio, 12 I-34127 Trieste, Italy Sezione Infrastrutture Informatiche e Telematiche

2 1

Re: EAP-PEAP + Windows 7 with SSO and Password change
by CD DD 14 Jun '12

14 Jun '12

Hi Phil, > src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c: > > about line 741, maybe this: > > pairmove2(&response, &handler->request->reply->vps, > PW_MSCHAP_ERROR, 0); > > ...should be: > > pairmove2(&response, &handler->request->reply->vps, > PW_MSCHAP_ERROR, VENDORSPEC_MICROSOFT); > > ? > > I don't understand though; I tested this as working, so > > Unfortunately my testbed is no longer assembled :o( your fix works perfectly. But it have to be: > PW_MSCHAP_ERROR, VENDORPEC_MICROSOFT); instead > PW_MSCHAP_ERROR, VENDORSPEC_MICROSOFT); <snip> : Exec-Program output: Must change password (0xc0000224) Exec-Program-Wait: plaintext: Must change password (0xc0000224) Exec-Program: returned: 1 (8) mschap : ntlm_auth says password must change (8) [mschap] = reject MSCHAP-Error: ?E=648 R=0 C=07cc36ab334ac36c8af4bc87201b552a V=3 M=Password Expired Found new challenge from MS-CHAP-Error: err=648 retry=0 challenge=07cc36ab334ac36c8af4bc87201b552a : </snip> The windows client get now the password change Window. But i still have one issue: the new passphrase will not changed. I got: MS-CHAP-NT-Enc-PW with invalid format here are the output from debug: <snip> : (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (9) group authenticate { (9) - entering group authenticate {...} (9) eap : Request found, released from the list (9) eap : EAP/mschapv2 (9) eap : processing type mschapv2 rlm_eap_mschapv2: password change packet received rlm_eap_mschapv2: built change password packet EAP-Message = 0x020f024f1a070f024a7979c8bf7d1f48b508f3a77a6cf40c3b323e89bcd5407e2e5cb01cc46a4b647d1e8fe79e297aa65d676f10889d59b1c80cd7a3298d0c534821973b09 0992bae04d4d23a9d5d8f07f27cb11d98d0d4826d32098afc30bf72d9144cf7eb48961880421962a26877e3a12250621d8121e26041120ce25774a0a4671d1df838f83efb44072540349c518d1679ed8c31782d104b9e8fd27da45f0b130d9b0af78ff02021ce997841fd0bbcd91aaa610575f9a6212b842563b710cb0c8410f47d51a38b3a6d1818909d2fb4735346c8b611b3ba0dde0cf6efa446c2605975e5016c24b30888d918e0b0a03352d7a51d2eee48f14b77b0d EAP-Message = 0x4a085ae945764de443cd775041a3138f227f90600ec3d8b2cc9648a5144dcb10918bc499d5c939677d1c15fadfbe9761da908e0fe8a864e8e4631b92f26d2ec3f98ba74263bac7072037c42b609f6e163176bafba7f25c5d1e9f4418a517e4d1179701510116215825d33a639a1e83fecf8835482f3f1dcd909fad60c03bd8b6bd7c557df2bcea320a1339dc01f028f0901d10e30119bf2a2b417cb69ab37d5e5223bb02bc506bbc21993f7a659000d12ec6c58153a4fa90679feb094bace85de10626834f59f5c751cf82f8854f862eb850759d4304b64490e752f6ab27b6bfcb90f9eb92559f3b584dca6fd0b77aff1220cbf491fd3c3f6d9b29ed6f EAP-Message = 0x6220d11763505a3f83f3ba6b811924ec987ba0515d6f99d4b584888d36ab9af03e3f2120bb50aa142cd1843d1b8c6975777c150000000000000000f32ed76d7f602a6fba828238448651148ebe123062e60af10000 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "TEST\\user1" State = 0x42f25dad43fd47b2696e125eaff8db99 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "b82ba75a-00000133" NAS-Port = 291 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Type = MS-CHAP-V2 MS-CHAP-Challenge = 0x07cc36db334dc36c8af4bc87201b552a MS-CHAP2-CPW = 0x070f515d6f99d4b584888d36ab9af03a3f2120bc50aa142cd1843d1b8c6975777c150000000000000000f32ed76d7f602a6fba828238448651148ebe123062e60af10000 MS-CHAP-NT-Enc-PW += 0x060f00017979c8bf7d1f48b508f3a56a6cf40c3b323e89bcd5407e2e5fb01cc46a4b647d1e8fe79e297aa65d676f10889d59b1c80cd7a3298d0c534821973b090992a7e04d4d23a9d5d8f07f27cb11d98d0d4826d32098afc30bf72d9144cf7eb48961880421962a26877e3a12250621d8121e26041120ce25774a0a4671d1df838f83efb44072540349c518d1679ed8c31782d104b9e8fd27da45f0b130d9b0af78ff02021ce997841fd0bbcd91aaa610575f9a6212b842563b710cb0c8410f47d51a38b3a6d1818909d2fb4735346c8b611b3ba0dde0cf6efa446c2605975e5016c24b30888d918e0b0a03352d7a51d2eee48f14b77b MS-CHAP-NT-Enc-PW += 0x060f00020d4a085ae945764de443cd775041a3138f211f90600ec3d8b2cc9648a5144dcb10918bc499d5c939677d1c15fadfbe9761da908e0fe8a864e8e4631b92f26d2ec3f98ba74263bac7072037c42b609f6e163176bafba7f25c5d1e9f4418a517e4d1179701510116215825d33a639a1e83fecf8835482f3f1dcd909fad60c03bd8b6bd7c557df2bcea320a1339dc01f028f0901d10e30119bf2a2b417cb69ab37d5e5223bb02bc506bbc21993f7a659000d12ec6c58153a4fa90679feb094bace85de10626834f59f5c751cf82f8854f862eb850759d4304b64490e752f6ab27b6bfcb90f9eb92559f3b584dca6fd0b77aff1220 MS-CHAP-NT-Enc-PW += 0x060f0003cbf491ad3c3f6d9b29ed6f6220d11763505a3f83f3ba6b811924ec987ba0 (9) mschapv2 : # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (9) mschapv2 : group MS-CHAP { (9) mschapv2 : - entering group MS-CHAP {...} (9) mschap : MS-CHAPv2 password change request received (9) mschap : MS-CHAP-NT-Enc-PW with invalid format (9) [mschap] = invalid rlm_eap_mschapv2: No MS-CHAPv2-Success or MS-CHAP-Error was found. (9) eap : Handler failed in EAP/mschapv2 (9) eap : Failed in EAP select (9) [eap] = invalid (9) Failed to authenticate the user. : </snip> thanks, C. -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

2 1

WING-ASN throwing error - Mandatory HA Mode parameter
by Rathod Subhashchandra 14 Jun '12

14 Jun '12

Dear All, I am using WING-ASN and AAA(Radius server) to test EAP-TLS authentication mechanism. WING-ASN is throwing following error. 08.06.2012(12:16.50.249.739) [ASN C Plane] Mandatory HA Mode parameter (HA_RK_Lifetime, HA_RK_SPI, HA_RK_KEY, Duration Quota, MN_HA_SPI, HA_IP_ADDR, MN_HA_KEY) I did not find all above attributes in AAA. Can anybody tell me how to add above attributes and also their values? Thanks! Rathod.

5 11

Behavior on LDAP outage
by Jethro Carr 14 Jun '12

14 Jun '12

hi all, I had an issue today where an LDAP server being relied upon by FreeRadius was unreachable, however FreeRadius returned the default authentication status for the user. The problem is, the NAS authenticating the users against FreeRadius considered the default authentication response (reject) to be a sign that FreeRadius on the server was OK and didn't fail over to the secondary server. I was expecting it to return unreachable or just time out, instead of running the default auth behavior, but maybe I've missed a configuration option or have incorrect assumptions. The setup is 2x servers, each running Radius and LDAP with LDAP replication in place. If the primary server is entirely unreachable, the NASes being used have no issue failing over to the secondary. It only didn't fail over because the NAS believed that the primary was working. :-( Example of a test run when the LDAP server on the host is stopped: # radtest test test123 127.0.0.1 0 testing1234 Sending Access-Request of id 108 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test123" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=108, length=108 Reply-Message = "Authentication denied - user does not belong to any suitable groups to access this NAS" End of the users file, showing the default reject behavior defined: # tail /etc/raddb/users DEFAULT Huntgroup-Name == admins, Ldap-Group == "cn=admins,ou=Group,dc=example,dc=com", User-Profile := "cn=admins,ou=Group,dc=example,dc=com" Fall-Through = no DEFAULT Auth-Type := Reject Reply-Message = "Authentication denied - user does not belong to any suitable groups to access this NAS" And of course, relevant radius logs: # tail /var/log/radius/radius.log Wed Jun 13 11:33:14 2012 : Auth: Invalid user: [test] (from client localhost port 0) Wed Jun 13 11:34:48 2012 : Error: [ldap] could not start TLS Can't contact LDAP server Wed Jun 13 11:34:48 2012 : Error: [ldap] (re)connection attempt failed Wed Jun 13 11:34:48 2012 : Error: [ldap] could not start TLS Can't contact LDAP server Wed Jun 13 11:34:48 2012 : Error: [ldap] (re)connection attempt failed Aside from "make sure your LDAP server doesn't die", ;-) can anyone make any recommendations around the best approach to take, so that in event of an LDAP outage on one host, FreeRadius returns a result (or nothing at all) that causes the NAS to fail over to the secondary host? Using FreeRadius 2.1.12. many thanks, jethro -- Jethro Carr www.jethrocarr.com

3 3

Re: Behavior on LDAP outage
by Alan Buxey 14 Jun '12

14 Jun '12

Ok, here is probably a use case for silently dropping rejects. That way your NAS will behave okay....but you only want to do this if the LDAP is down...so need to base it on that condition. That's if you want to keep it all in the server, you could have an external cronjob or such that checks LDAP and stops/starts the radius daemon alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

3 2

buffer overflow on mschap reject
by Matt Richards 13 Jun '12

13 Jun '12

Hello, I have got radius setup to authenticate wireless clients using MS-CHAP and everything works correctly if the entered user / pass is correct. If the password is wrong, however, I get a buffer overflow error and radiusd dies. I get the follow on the console when this happens ... > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/mschapv2 > [eap] processing type mschapv2 > [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel > [mschapv2] +- entering group MS-CHAP {...} > [mschap] Creating challenge hash with username: rer > [mschap] Told to do MS-CHAPv2 for rer with NT-Password > [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=rer > [mschap] No NT-Domain was found in the User-Name. > [mschap] expand: %{mschap:NT-Domain} -> > [mschap] ... expanding second conditional > [mschap] expand: --domain=%{%{mschap:NT-Domain}:-WC1} -> --domain=WC1 > [mschap] mschap2: 5f > [mschap] Creating challenge hash with username: rer > [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=a20a6c5d363dd4b6 > [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=5182a275d21751ab7007e8de241d8d516215a95d3384ccf9 > Exec-Program output: Logon failure (0xc000006d) > Exec-Program-Wait: plaintext: Logon failure (0xc000006d) > Exec-Program: returned: 1 > [mschap] External script failed. > [mschap] FAILED: MS-CHAP2-Response is incorrect > *** buffer overflow detected ***: radiusd terminated > ======= Backtrace: ========= > /lib/libc.so.6(__fortify_fail+0x37)[0x7fea6d97c427] > /lib/libc.so.6(+0xe8150)[0x7fea6d97a150] > /lib/libc.so.6(+0xe76eb)[0x7fea6d9796eb] > /lib/libc.so.6(__snprintf_chk+0x7b)[0x7fea6d9795bb] > /usr/lib64/freeradius/rlm_mschap-2.1.11.so(+0x31bb)[0x7fea6c24a1bb] > radiusd(modcall+0xb4b)[0x41c4bb] > radiusd(indexed_modcall+0xd3)[0x418b53] > /usr/lib64/freeradius/rlm_eap_mschapv2-2.1.11.so(+0x166a)[0x7fea696d366a] > /usr/lib64/freeradius/rlm_eap-2.1.11.so(+0x2f76)[0x7fea6bc39f76] > /usr/lib64/freeradius/rlm_eap-2.1.11.so(eaptype_select+0x176)[0x7fea6bc3a926] > /usr/lib64/freeradius/rlm_eap-2.1.11.so(+0x2739)[0x7fea6bc39739] > radiusd(modcall+0xb4b)[0x41c4bb] > radiusd(indexed_modcall+0xd3)[0x418b53] > radiusd(rad_authenticate+0x985)[0x40a075] > /usr/lib64/freeradius/rlm_eap_peap-2.1.11.so(eappeap_process+0x976)[0x7fea698d8f26] > /usr/lib64/freeradius/rlm_eap_peap-2.1.11.so(+0x1825)[0x7fea698d7825] > /usr/lib64/freeradius/rlm_eap-2.1.11.so(+0x2f76)[0x7fea6bc39f76] > /usr/lib64/freeradius/rlm_eap-2.1.11.so(eaptype_select+0x176)[0x7fea6bc3a926] > /usr/lib64/freeradius/rlm_eap-2.1.11.so(+0x2739)[0x7fea6bc39739] > radiusd(modcall+0xb4b)[0x41c4bb] > radiusd(indexed_modcall+0xd3)[0x418b53] > radiusd(rad_authenticate+0x985)[0x40a075] > radiusd(radius_handle_request+0x52)[0x424d42] > radiusd(thread_pool_addrequest+0x9)[0x425039] > radiusd[0x4269e6] > /usr/lib/libfreeradius-radius-2.1.11.so(fr_event_loop+0x33b)[0x7fea6e04860b] > radiusd(main+0x55a)[0x41cd2a] > /lib/libc.so.6(__libc_start_main+0xe6)[0x7fea6d8b0ba6] > radiusd[0x408fe9] The version of freeradius i'm running is ... FreeRADIUS Version 2.1.11, for host x86_64-pc-linux-gnu, built on Jun 11 2012 at 11:10:29 I can replicate this issue with radtest. Does anybody know why this might be happening? If you require any additional info please let me know. One thing I was thinking about trying it going back a few versions of ntlm_auth and tring again. Its interesting how I don't seem to be able to find any information relating to this on the Internet. Thanks, Matt.

3 6

Split authorization / authentication
by Emmanuel BILLOT 13 Jun '12

13 Jun '12

Hi, Is it possible to split authorization step as follow : - Considering we want to authorize user using EAP and MAC adresses - http://wiki.freeradius.org/Mac-Auth works fine, but is it possible to do EAP with one radius server and MAC address auth with another one ? BR, -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 4

Re: EAP-PEAP + Windows 7 with SSO and Password change
by CD DD 13 Jun '12

13 Jun '12

Hi Phil, Alan, >Ok. ntlm_auth is returning something different to what I saw in testing. >Have you set the "must change password at next login" bit, as opposed to >"expired" bit? > >Try this: > > 1. Edit src/modules/rlm_mschap/rlm_mschap.c about line 1100, where it >says: > > if (strstr(buffer, "Password expired")) { > >...to read: > > if (strstr(buffer, "Password expired") || > strstr(buffer, "Must change password")) { > > 2. Re-compile and re-install > > 3. Test again > >There's no great way to parse the output of ntlm_auth. I guess we could >make the string a regexp comparison against the output, and at least >make it an item in the config file (with a sensible default) so that if >more such cases come up, or Samba change their output, it can be fixed >without a recompile. i changed the source src/modules/rlm_mschap/rlm_mschap.c, recompiled and re-installed it. But it still not working. Why the passchange part will not handled ? Here is the debug output: FreeRADIUS Version 3.0.0, for host x86_64-portbld-freebsd9.0, built on Jun 13 2012 at 10:06:56 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/wimax including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/attr_rewrite including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/checkval including configuration file /usr/local/etc/raddb/mods-enabled/counter including configuration file /usr/local/etc/raddb/mods-enabled/cui including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/inner-eap including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/acct_unique including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/var" sbindir = "/usr/local/sbin" logdir = "/var/log" run_dir = "/var/run/radiusd" libdir = "/usr/local/lib/freeradius-3.0.0" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client AP { ipaddr = 10.0.5.100 netmask = 32 require_message_authenticator = no secret = "**************" shortname = "AP" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/mods-enabled/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/mods-enabled/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" passchange { ntlm_auth = "/usr/local/bin/ntlm_auth --helper-protocol=ntlm-change-password-1" ntlm_auth_username = "username: %{mschap:User-Name}" ntlm_auth_domain = "nt-domain: %{mschap:NT-Domain}" local_cpw = "%{exec:/path/to/script %{mschap:User-Name} %{MS-CHAP-New-Cleartext-Password}}" } allow_retry = yes retry_msg = "Re-enter (or reset) the password" } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/mods-enabled/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_pwd Module: Instantiating eap-pwd pwd { group = 19 fragment_size = 1020 server_id = "theserver(a)example.com" virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.key" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } debug: Using cached TLS configuration from previous invocation Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } debug: Using cached TLS configuration from previous invocation Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Loading virtual module acct_unique Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { detailfile = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Loading virtual module remove_reply_message_if_eap Module: Linked to module rlm_always Module: Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } Module: Loading virtual module remove_reply_message_if_eap } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Creating Post-Proxy-Type = Fail Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { detailfile = "/var/log/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 max_pps = 0 } listen { type = "acct" ipaddr = * port = 0 max_pps = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 max_pps = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy address * port 1814 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=201, length=359 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x024b0015015a4f4f504c55535c6173646631323334 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x8c7ada2e1d18cc1f23c9920c78d3aca8 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) group authorize { (0) - entering group authorize {...} (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : EAP packet type response id 75 length 21 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) Found Auth-Type = EAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) group authenticate { (0) - entering group authenticate {...} (0) eap : EAP Identity (0) eap : processing type peap (0) peap : Flushing SSL sessions (of #0) (0) peap : Initiate (0) peap : Start returned 1 (0) [eap] = handled Sending Access-Challenge of id 201 to 10.0.5.100 port 32783 EAP-Message = 0x014c00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f9340379d95095c27e471c371 (0) Finished request 0. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=219, length=486 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x024c008219800000007816030100730100006f03014fd85561ec74aceb37fdd54e7985c3dac0333a03256e4c822ecc40ac227a5e93000018002f00350005000ac013c014c009c00a00320038001300040100002eff010001000000001500130000107a6f6f706c75735c6173646631323334000a0006000400170018000b00020100 State = 0x930c2e1f9340379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x05df0aead4255d6ea51dde0c23afb31c (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) group authorize { (1) - entering group authorize {...} (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) eap : EAP packet type response id 76 length 130 (1) eap : Continuing tunnel setup. (1) [eap] = ok (1) Found Auth-Type = EAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) group authenticate { (1) - entering group authenticate {...} (1) eap : Request found, released from the list (1) eap : EAP/peap (1) eap : processing type peap (1) peap : processing EAP-TLS TLS Length 120 (1) peap : Length Included (1) peap : eaptls_verify returned 11 (1) peap : (other): before/accept initialization (1) peap : TLS_accept: before/accept initialization (1) peap : <<< TLS 1.0 Handshake [length 0073], ClientHello (1) peap : TLS_accept: SSLv3 read client hello A (1) peap : >>> TLS 1.0 Handshake [length 0051], ServerHello (1) peap : TLS_accept: SSLv3 write server hello A (1) peap : >>> TLS 1.0 Handshake [length 0cc5], Certificate (1) peap : TLS_accept: SSLv3 write certificate A (1) peap : >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (1) peap : TLS_accept: SSLv3 write server done A (1) peap : TLS_accept: SSLv3 flush data (1) peap : TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode (1) peap : eaptls_process returned 13 (1) peap : FR_TLS_HANDLED (1) [eap] = handled Sending Access-Challenge of id 219 to 10.0.5.100 port 32783 EAP-Message = 0x014d03ec19c000000d2916030100510200004d03014fd855f89cbf46621ff862e29a11a62efe9fe9c274fe8c1c7b03051753a3a701202c54374903787f84edf1c20ee8cf8a71bb39c8c63f30e574697b821577436c1b002f000005ff010001001603010cc50b000cc1000cbe0007aa308207a63082068ea003020102020310004e300d06092a864886f70d01010405003081a3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c0603550403 EAP-Message = 0x1315777777706b692e7765622e7a6f6f706c75732e64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e6465301e170d3132303232383039323934315a170d3135303232383039323934315a3081c3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731293027060355040a13206639323232396139633932306238656464613063346563383830643865383362310b3009060355040b130249543121301f060355040313187a7072616469757330312e7a6f6f706c75732e6c6f63616c EAP-Message = 0x3120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e646530820222300d06092a864886f70d01010105000382020f003082020a0282020100df0e40f450e8633fdc375cb76ddca4885ce8cb275601f5b5e78a0ff8f4e8f13036c27a4e3c2e503e005d11e5c19a8b535e68a015b67f15b313d88a21df7b788ce45174c0137beadfb8186928e9acc169237805e0a00ea8f8245c7d4b1d64214e368339fe807dab5cc82c235823474903f76d8e363ff25a79094959af1edf13d4b23c4f9942467ffd088f91fd7072618e9e95d6360e44ede071785ce41f0899d4abe3e8d941f728ad204ad1e48f1fd12384ab392ed048d917b361 EAP-Message = 0x77efb35d76edcf6f6bf4518c46e53186e9c8ca7560481f8a87eb9cba46f56716fcff6a05ae25a1917ca1ede18c05640b41242465118dc66de1f3f22aa77598df0f0130070b95af02502eb9dd86f087502a2ce4ddf67dc94ccb60edba0f4e92e5f9ca75e950bc89a21671430395782d6d8fb78ba77b497ab6577e673acd4b9ebda8eb638d2aa6ba89798d0adc603a765c7b109f7b204abab14831b08fe1b34be34f3e1acb92bf878644e94f5de7381e3df2647f307d9343332112b978d68b02c63658d617268e610bf337d85f0a62a2e1a7b5a8fa1261e1835101920e3b37fd4e95e3fead50a5cac3239e57541679679824eacd1aa6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f9241379d95095c27e471c371 (1) Finished request 1. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=186, length=362 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x024d00061900 State = 0x930c2e1f9241379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x6466c7912ccfa79c06a36fc1af9f6467 (2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (2) group authorize { (2) - entering group authorize {...} (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (2) suffix : No such realm "NULL" (2) [suffix] = noop (2) eap : EAP packet type response id 77 length 6 (2) eap : Continuing tunnel setup. (2) [eap] = ok (2) Found Auth-Type = EAP (2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (2) group authenticate { (2) - entering group authenticate {...} (2) eap : Request found, released from the list (2) eap : EAP/peap (2) eap : processing type peap (2) peap : processing EAP-TLS (2) peap : Received TLS ACK (2) peap : Received TLS ACK (2) peap : ACK handshake fragment handler (2) peap : eaptls_verify returned 1 (2) peap : eaptls_process returned 13 (2) peap : FR_TLS_HANDLED (2) [eap] = handled Sending Access-Challenge of id 186 to 10.0.5.100 port 32783 EAP-Message = 0x014e03e81940766385383e2cde4857beed6f5d0055147b933e7daa9922162c79d246e82182b9093f71aa15acaac374d5e514c545fde8d4246e4471d9ead260e06fc5a292a62aac5911d4b904b8015bf168d6c7022f8b8b0203010001a38202bf308202bb300c0603551d130101ff04023000300e0603551d0f0101ff0404030205a0301406096086480186f84201010101ff04040302064030160603551d250101ff040c300a06082b06010505070301301d0603551d0e0416041424e274626b9d850eb8eb9fd2a5d4e4555dccc3233081d80603551d230481d03081cd8014343094169c0bc40653b5ebaf41601f3b65d91227a181a9a481a63081a331 EAP-Message = 0x0b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c06035504031315777777706b692e7765622e7a6f6f706c75732e64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e64658209008f68987367f3a4b330360603551d11042f302d82187a7072616469757330312e7a6f6f706c75732e6c6f63616c811173797361646d407a6f6f706c75732e6465301c0603551d1204153013811173797361646d407a6f6f70 EAP-Message = 0x6c75732e6465304a0603551d1f04433041303fa03da03b8639687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f696e6465782e7068703f73746167653d646c5f63726c303906096086480186f842010d042c162a5048506b692f4f70656e53534c2047656e65726174656420536572766572204365727469666963617465303206096086480186f842010204251623687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f302306096086480186f8420103041616146e735f7265766f6b655f71756572792e7068703f303d06096086480186f84201080430162e687474703a2f EAP-Message = 0x2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f706f6c6963792e68746d6c300d06092a864886f70d01010405000382010100a9926e3eab9f9ed846e4d3618ab5df744295922b7393517c86a7e9e879ae6862200092525a365845841ed019acb8401c12057b4fd132a39fdb89eed85e85beb4ec203049f8dfd9c3038bee65de5bb59962b0a77e9a4d95b99340ed94d38845b185f1483898f18272d216f4d831bfe43f02df131b8445b7417677965db6f94676b0c7337240f09fbd8fd5755e0c0fe88469f12a0b4b929dcd4327517f0cdc4327432be87207cf40f81f60d90c16d7045566b611ee90 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f9142379d95095c27e471c371 (2) Finished request 2. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=210, length=362 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x024e00061900 State = 0x930c2e1f9142379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0xc6bf7d0a64ded4d427400730c9f64a00 (3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (3) group authorize { (3) - entering group authorize {...} (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (3) suffix : No such realm "NULL" (3) [suffix] = noop (3) eap : EAP packet type response id 78 length 6 (3) eap : Continuing tunnel setup. (3) [eap] = ok (3) Found Auth-Type = EAP (3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (3) group authenticate { (3) - entering group authenticate {...} (3) eap : Request found, released from the list (3) eap : EAP/peap (3) eap : processing type peap (3) peap : processing EAP-TLS (3) peap : Received TLS ACK (3) peap : Received TLS ACK (3) peap : ACK handshake fragment handler (3) peap : eaptls_verify returned 1 (3) peap : eaptls_process returned 13 (3) peap : FR_TLS_HANDLED (3) [eap] = handled Sending Access-Challenge of id 210 to 10.0.5.100 port 32783 EAP-Message = 0x014f03e81940dd918bae3094651e2d38da6cb6470e5a5705d04419ecc02984c06dd99d858684b4ffeea1f0049440d3542eb307f94b4e343a78ad2bf5d8dff067c49eed40825295fc525c89ffe00316ab9800050e3082050a308203f2a0030201020209008f68987367f3a4b3300d06092a864886f70d01010405003081a3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c06035504031315777777706b692e7765622e7a6f6f706c75732e EAP-Message = 0x64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e6465301e170d3039303331333134323030315a170d3134303331333134323030315a3081a3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c06035504031315777777706b692e7765622e7a6f6f706c75732e64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e646530820122300d06092a864886f70d0101010500 EAP-Message = 0x0382010f003082010a0282010100b53247f132a0563881dd2cd39b014fce9dd553316e5acfad692af9121c4144dd5518fddd97459ae4c5b58dde04746615af13ce199e492269694b7a90f39a0ee2abb1222fc5b966b75f04e7d5b3ea9855bea211c5fbbfcb8f9d9059034e2af246494ba7d21812bce51f716000309a2842a43b53b3d69ded50954cf1bf0259e32410074bdd61676dac3af823013cc07fecd18329dee9a0129ae38fe37db7cf2161b1a6a313a2e48f07c80a630467dae941cfa094df8eebd542b85275f6dc776d6eb96f28b879c1f3178fcae1c8c984e8aaec01cd18c3ccdf90a9fea7a1239b605bc2c3a4092dc2551e84007d9a047359 EAP-Message = 0xf47dda3aba5d94d2785f684b8bd95603410203010001a382013d30820139300c0603551d13040530030101ff300b0603551d0f040403020106301106096086480186f8420101040403020007301d0603551d0e04160414343094169c0bc40653b5ebaf41601f3b65d91227301c0603551d1104153013811173797361646d407a6f6f706c75732e6465304a0603551d1f04433041303fa03da03b8639687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f696e6465782e7068703f73746167653d646c5f63726c304106096086480186f842010d043416325048506b692f4f70656e53 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f9043379d95095c27e471c371 (3) Finished request 3. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=64, length=362 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x024f00061900 State = 0x930c2e1f9043379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0xdf19c2e6d02c9dc91e86aaa3922e4797 (4) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (4) group authorize { (4) - entering group authorize {...} (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (4) suffix : No such realm "NULL" (4) [suffix] = noop (4) eap : EAP packet type response id 79 length 6 (4) eap : Continuing tunnel setup. (4) [eap] = ok (4) Found Auth-Type = EAP (4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (4) group authenticate { (4) - entering group authenticate {...} (4) eap : Request found, released from the list (4) eap : EAP/peap (4) eap : processing type peap (4) peap : processing EAP-TLS (4) peap : Received TLS ACK (4) peap : Received TLS ACK (4) peap : ACK handshake fragment handler (4) peap : eaptls_verify returned 1 (4) peap : eaptls_process returned 13 (4) peap : FR_TLS_HANDLED (4) [eap] = handled Sending Access-Challenge of id 64 to 10.0.5.100 port 32783 EAP-Message = 0x015001891900534c2047656e65726174656420526f6f7420436572746966696361746520417574686f72697479303d06096086480186f84201080430162e687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f706f6c6963792e68746d6c300d06092a864886f70d010104050003820101009ebc1a5dd90c801d205cb2a90c8bc3ab00db1ecb7d733632e6c5cfc033ded56fe93dc9752096ea56f194ebc980b843d7b1444b46689baea6c180997eaa77ae4b5aed2657c924a0f160b64adeef2af57df3ea220a94dd1c6571213f432e0888abc037f9ad970406d797bce1163d31c9df848258296d336f929dadd33ba7 EAP-Message = 0xad9e6bd0a8e101e4514e569f64097e12bb6e05ae9e51a4170b056570bd14a33faa584075a9dfafa8dd979d4664f76f5730953903ce77c7b4e8e2e3356ed9be221fd6f872dab6451da6950f46893af28efb6df277e22169e81884cd3abe4c464523d7622dfe93d1a5f29b2d623292eca09b3bfe84fb67b6d4749ff6b61de2971388045316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f975c379d95095c27e471c371 (4) Finished request 4. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=60, length=952 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x025002501980000002461603010206100002020200309897ca72ca8c5c64c113ad383216b0131678f5050e5775dd6bd2fab48640b9db094b7d7e4db6d45e067cbd69d46c27de3e6bbbb7b8b1914dba63cb4ab3a9f69b7320ddc37a0d5c19aa1a23298b024faa6e63c1a2c1a90a2b20263f83a6b76504ef01e2c955bb2d539b762e7929fb0248b1c59b0338a481aa87069d3f53de5dca8fc996771af0576a056a52016d7bb48d12bf9c4a524efcb45b59fde15a2370249f2440a777627c2b367438a648435f6e86e91536e260c24a7ff2a857e9a5a7e62f72746043cb815cc41ff1d8d0e622f9cd4446fdabcb0f2fe6520293280a2d75598437b6caa18d EAP-Message = 0xb81872487e9af91e30148211a5241926410132ae15aa19ea3f89e8d8b17410b2f4aeb832840ad33cbc2c9c6889de1ff0b39bb0931e1767b64df862541373026ce1acbcc96a0073e9f4c0ac43da5262af1754af7ebe8e71b5f665dc249eacf8240233cdf9ad50a976bde939058e3107e87ae36798bee9362c121d31dbe144e06abb0c12451f6815220a954badf5e64d6db6fd5d790d71c2591ef900648764003d55028d2a04a84262bca9fcbad62b512aca739f772dc2999e2c9eb142840bc75bc17aab9891076f166a3794fc9b0a9ef70ed8cdac493ba2f584588eed62c6c9b8456a53707b91c4cff00e4cfe2e9fdcf2cdeea548d50699cb7505b1b041 EAP-Message = 0x05ccd32355f6b0502ce405c48693f9a14270993aabd9a07438499c14030100010116030100301fa06a5058a700bd21307760604ca7fbf39f6e2c7e5bc730ddb4d7a7e54c415957a88cfd7910e4d9cec812d88bf2c48a State = 0x930c2e1f975c379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0xf7328527ad83d2d65ae600cee18db09c (5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (5) group authorize { (5) - entering group authorize {...} (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (5) suffix : No such realm "NULL" (5) [suffix] = noop (5) eap : EAP packet type response id 80 length 253 (5) eap : Continuing tunnel setup. (5) [eap] = ok (5) Found Auth-Type = EAP (5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (5) group authenticate { (5) - entering group authenticate {...} (5) eap : Request found, released from the list (5) eap : EAP/peap (5) eap : processing type peap (5) peap : processing EAP-TLS TLS Length 582 (5) peap : Length Included (5) peap : eaptls_verify returned 11 (5) peap : <<< TLS 1.0 Handshake [length 0206], ClientKeyExchange (5) peap : TLS_accept: SSLv3 read client key exchange A (5) peap : <<< TLS 1.0 ChangeCipherSpec [length 0001] (5) peap : <<< TLS 1.0 Handshake [length 0010], Finished (5) peap : TLS_accept: SSLv3 read finished A (5) peap : >>> TLS 1.0 ChangeCipherSpec [length 0001] (5) peap : TLS_accept: SSLv3 write change cipher spec A (5) peap : >>> TLS 1.0 Handshake [length 0010], Finished (5) peap : TLS_accept: SSLv3 write finished A (5) peap : TLS_accept: SSLv3 flush data SSL: adding session 2c54374903787f84edf1c20ee8cf8a71bb39c8c63f30e574697b821577436c1b to cache (5) peap : (other): SSL negotiation finished successfully SSL Connection Established (5) peap : eaptls_process returned 13 (5) peap : FR_TLS_HANDLED (5) [eap] = handled Sending Access-Challenge of id 60 to 10.0.5.100 port 32783 EAP-Message = 0x0151004119001403010001011603010030f6aa4ff160c5f9b19e7120e24cd4a464b3ccc46aa829cf6d04735641949509bbddafb18c85d8ecc9b9c13ce4d9be6acb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f965d379d95095c27e471c371 (5) Finished request 5. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=136, length=362 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x025100061900 State = 0x930c2e1f965d379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x258bd54678fdab223698ae4e86af97a5 (6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (6) group authorize { (6) - entering group authorize {...} (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (6) suffix : No such realm "NULL" (6) [suffix] = noop (6) eap : EAP packet type response id 81 length 6 (6) eap : Continuing tunnel setup. (6) [eap] = ok (6) Found Auth-Type = EAP (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (6) group authenticate { (6) - entering group authenticate {...} (6) eap : Request found, released from the list (6) eap : EAP/peap (6) eap : processing type peap (6) peap : processing EAP-TLS (6) peap : Received TLS ACK (6) peap : Received TLS ACK (6) peap : ACK handshake is finished (6) peap : eaptls_verify returned 3 (6) peap : eaptls_process returned 3 (6) peap : FR_TLS_SUCCESS (6) peap : Session established. Decoding tunneled attributes. (6) peap : Peap state TUNNEL ESTABLISHED (6) [eap] = handled Sending Access-Challenge of id 136 to 10.0.5.100 port 32783 EAP-Message = 0x0152002b19001703010020f55fb6c5caa3a2f060a22bdbb38b9d10cbc036d5ab0917a9c3e286e7114685b4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f955e379d95095c27e471c371 (6) Finished request 6. Waking up in 0.1 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=168, length=415 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x0252003b190017030100301f80985ec72756e184b2749ffaadbad99bacae6260b0e902544c14a0a32ac8462345c78966b49be0890162adc850fc69 State = 0x930c2e1f955e379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x62f97908b69011a30e4a5e669ce06722 (7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (7) group authorize { (7) - entering group authorize {...} (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) eap : EAP packet type response id 82 length 59 (7) eap : Continuing tunnel setup. (7) [eap] = ok (7) Found Auth-Type = EAP (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (7) group authenticate { (7) - entering group authenticate {...} (7) eap : Request found, released from the list (7) eap : EAP/peap (7) eap : processing type peap (7) peap : processing EAP-TLS (7) peap : eaptls_verify returned 7 (7) peap : Done initial handshake (7) peap : eaptls_process returned 7 (7) peap : FR_TLS_OK (7) peap : Session established. Decoding tunneled attributes. (7) peap : Peap state WAITING FOR INNER IDENTITY (7) peap : Identity - TEST\user1 (7) peap : Got inner identity 'TEST\user1' (7) peap : Setting default EAP type for tunneled EAP session. (7) peap : Got tunneled request EAP-Message = 0x02520015015a4f4f504c55535c6173646631323334 server { (7) peap : Setting User-Name to TEST\user1 Sending tunneled request EAP-Message = 0x02520015015a4f4f504c55535c6173646631323334 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "TEST\\user1" server inner-tunnel { (7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (7) group authorize { (7) - entering group authorize {...} (7) [chap] = noop (7) [mschap] = noop (7) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) update control { (7) } # update control = noop (7) eap : EAP packet type response id 82 length 21 (7) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (7) [eap] = ok (7) Found Auth-Type = EAP (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (7) group authenticate { (7) - entering group authenticate {...} (7) eap : EAP Identity (7) eap : processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge (7) [eap] = handled } # server inner-tunnel (7) peap : Got tunneled reply code 11 EAP-Message = 0x0153002a1a01530025100138f26de51fe8877ff61f134946da9a5a4f4f504c55535c6173646631323334 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8abb48828ae852f8102b63fc437692fc (7) peap : Got tunneled reply RADIUS code 11 EAP-Message = 0x0153002a1a01530025100138f26de51fe8877ff61f134946da9a5a4f4f504c55535c6173646631323334 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8abb48828ae852f8102b63fc437692fc (7) peap : Got tunneled Access-Challenge (7) [eap] = handled Sending Access-Challenge of id 168 to 10.0.5.100 port 32783 EAP-Message = 0x0153004b19001703010040ea858820fac13721de9038841c4e86bf9161eccaf99ee6e9dac2d2dde316259fbd0b0b1f0a23db379a96544d6fedc5bc8265eb396da9a5d8dd96fc162e1a36d0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f945f379d95095c27e471c371 (7) Finished request 7. Waking up in 0.1 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=99, length=463 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x0253006b19001703010060a3dc72b8efb48dc8c146899dc9630574e40f2ce3e7522dd7ede7e9773a93da740c378ec97534753bc00eae72a62d57337c455740b3ee8727f0d42343dd9c6be9af6952283e953c1433f7438e629bcf0dfd361db0ad4d16dfe2340e598396ce90 State = 0x930c2e1f945f379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x3732ac156e76595657a5221130446fab (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (8) group authorize { (8) - entering group authorize {...} (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (8) suffix : No such realm "NULL" (8) [suffix] = noop (8) eap : EAP packet type response id 83 length 107 (8) eap : Continuing tunnel setup. (8) [eap] = ok (8) Found Auth-Type = EAP (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) group authenticate { (8) - entering group authenticate {...} (8) eap : Request found, released from the list (8) eap : EAP/peap (8) eap : processing type peap (8) peap : processing EAP-TLS (8) peap : eaptls_verify returned 7 (8) peap : Done initial handshake (8) peap : eaptls_process returned 7 (8) peap : FR_TLS_OK (8) peap : Session established. Decoding tunneled attributes. (8) peap : Peap state phase2 (8) peap : EAP type mschapv2 (8) peap : Got tunneled request EAP-Message = 0x0253004b1a02530046319b261aedb04447e6f33644abcb83415b0000000000000000e3426708aea6af13c9ba6ca1af31212f460cd1a834482660005a4f4f504c55535c6173646631323334 server { (8) peap : Setting User-Name to TEST\user1 Sending tunneled request EAP-Message = 0x0253004b1a02530046319b261aedb04447e6f33644abcb83415b0000000000000000e3426708aea6af13c9ba6ca1af31212f460cd1a834482660005a4f4f504c55535c6173646631323334 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "TEST\\user1" State = 0x8abb48828ae852f8102b63fc437692fc server inner-tunnel { (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) group authorize { (8) - entering group authorize {...} (8) [chap] = noop (8) [mschap] = noop (8) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (8) suffix : No such realm "NULL" (8) [suffix] = noop (8) update control { (8) } # update control = noop (8) eap : EAP packet type response id 83 length 75 (8) eap : No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) [pap] = noop (8) Found Auth-Type = EAP (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) group authenticate { (8) - entering group authenticate {...} (8) eap : Request found, released from the list (8) eap : EAP/mschapv2 (8) eap : processing type mschapv2 (8) mschapv2 : # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) mschapv2 : group MS-CHAP { (8) mschapv2 : - entering group MS-CHAP {...} (8) mschap : Creating challenge hash with username: test1 (8) mschap : Told to do MS-CHAPv2 for test1 with NT-Password (8) mschap : expand: %{Stripped-User-Name} -> (8) mschap : ... expanding second conditional (8) mschap : expand: %{User-Name} -> TEST\user1 (8) mschap : expand: %{%{User-Name}:-None} -> TEST\user1 (8) mschap : expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=TEST\user1 (8) mschap : Creating challenge hash with username: user1 (8) mschap : expand: %{mschap:Challenge} -> 05ac8b071ffed031 (8) mschap : expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=05ac8b071ffed031 (8) mschap : expand: %{mschap:NT-Response} -> e3426708aea6af13c9ba6ca1af31212f460cd1a834482660 (8) mschap : expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=e3426708aea6af13c9ba6ca1af31212f460cd1a834482660 Exec-Program output: Must change password (0xc0000224) Exec-Program-Wait: plaintext: Must change password (0xc0000224) Exec-Program: returned: 1 (8) mschap : ntlm_auth says password must change (8) [mschap] = reject rlm_eap_mschapv2: No MS-CHAPv2-Success or MS-CHAP-Error was found. (8) eap : Handler failed in EAP/mschapv2 (8) eap : Failed in EAP select (8) [eap] = invalid (8) Failed to authenticate the user. } # server inner-tunnel (8) peap : Got tunneled reply code 3 MS-CHAP-Error = "SE=648 R=0 C=9b268dcbbfadefbba4138c2b12f90353 V=3 M=Password Expired" EAP-Message = 0x04530004 Message-Authenticator = 0x00000000000000000000000000000000 (8) peap : Got tunneled reply RADIUS code 3 MS-CHAP-Error = "SE=648 R=0 C=9b268dcbbfadefbba4138c2b12f90353 V=3 M=Password Expired" EAP-Message = 0x04530004 Message-Authenticator = 0x00000000000000000000000000000000 (8) peap : Tunneled authentication was rejected. (8) peap : FAILURE (8) [eap] = handled Sending Access-Challenge of id 99 to 10.0.5.100 port 32783 EAP-Message = 0x0154002b19001703010020014b48b95de643020707b13524faf7b1a23f4ba34ee63c2c2a260b9335c74e35 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f9b58379d95095c27e471c371 (8) Finished request 8. Waking up in 0.1 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=44, length=399 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x0254002b19001703010020fdf63531aebd5e4de6cb29edf9a3fc7aace323aaba3853272fb46f862d7479aa State = 0x930c2e1f9b58379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x6f7dc3389c985148f3853c3f8e6644a3 (9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (9) group authorize { (9) - entering group authorize {...} (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (9) suffix : No such realm "NULL" (9) [suffix] = noop (9) eap : EAP packet type response id 84 length 43 (9) eap : Continuing tunnel setup. (9) [eap] = ok (9) Found Auth-Type = EAP (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) group authenticate { (9) - entering group authenticate {...} (9) eap : Request found, released from the list (9) eap : EAP/peap (9) eap : processing type peap (9) peap : processing EAP-TLS (9) peap : eaptls_verify returned 7 (9) peap : Done initial handshake (9) peap : eaptls_process returned 7 (9) peap : FR_TLS_OK (9) peap : Session established. Decoding tunneled attributes. (9) peap : Peap state send tlv failure (9) peap : Received EAP-TLV response. (9) peap : The users session was previously rejected: returning reject (again.) (9) peap : *** This means you need to read the PREVIOUS messages in the debug output (9) peap : *** to find out the reason why the user was rejected. (9) peap : *** Look for "reject" or "fail". Those earlier messages will tell you. (9) peap : *** what went wrong, and how to fix the problem. SSL: Removing session 2c54374903787f84edf1c20ee8cf8a71bb39c8c63f30e574697b821577436c1b from the cache (9) eap : Handler failed in EAP/peap (9) eap : Failed in EAP select (9) [eap] = invalid (9) Failed to authenticate the user. (9) Using Post-Auth-Type Reject (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) group REJECT { (9) - entering group REJECT {...} (9) attr_filter.access_reject : expand: %{User-Name} -> TEST\user1 (9) attr_filter.access_reject : Matched entry DEFAULT at line 11 (9) [attr_filter.access_reject] = updated (9) eap : Reply already contained an EAP-Message, not inserting EAP-Failure (9) [eap] = noop (9) policy remove_reply_message_if_eap { (9) - entering policy remove_reply_message_if_eap {...} (9) ? if (reply:EAP-Message && reply:Reply-Message) (9) ? Evaluating (reply:EAP-Message ) -> TRUE (9) ? Evaluating (reply:Reply-Message) -> FALSE (9) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE (9) else else { (9) - entering else else {...} (9) [noop] = noop (9) - else else returns noop (9) - policy remove_reply_message_if_eap returns noop (9) Finished request 9. Waking up in 0.6 seconds. (9) Sending delayed reject Sending Access-Reject of id 44 to 10.0.5.100 port 32783 EAP-Message = 0x04540004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. (0) Cleaning up request packet ID 201 with timestamp +12 (1) Cleaning up request packet ID 219 with timestamp +12 (2) Cleaning up request packet ID 186 with timestamp +12 (3) Cleaning up request packet ID 210 with timestamp +12 (4) Cleaning up request packet ID 64 with timestamp +12 (5) Cleaning up request packet ID 60 with timestamp +12 (6) Cleaning up request packet ID 136 with timestamp +12 (7) Cleaning up request packet ID 168 with timestamp +12 (8) Cleaning up request packet ID 99 with timestamp +12 Waking up in 1.0 seconds. (9) Cleaning up request packet ID 44 with timestamp +12 Ready to process requests. -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

3 3

EAP processing again
by Emmanuel BILLOT 13 Jun '12

13 Jun '12

Hi, Ok i read all of the debug output, and i think i can understand mechanism. However could you confirm (or not) what i understand ? In case of an EAP/TTLS connexion : - Freeradius get a request, with a particular attribut : EAP-Message - Entering authorize section, only EAP one matches because of EAP attribut => Auth-Type is set to EAP - Entering authenticate section, Freeradius sent a challenge to client - Client answer - Freeradius get a new request with attribut EAP-Message, State and a new Message-Authenticator - Entering authorize section, EAP matches - Entering authenticate section. EAP matches (Auth-Type = EAP). Freeradius sent response to client (negociating ?) - Client answer - Freeradius get a new request with attribut EAP-Message, State and new Message-Authenticator - Entering authorize section, EAP matches, tunnel setup is set - Entering authenticate section. EAP matches (Auth-Type = EAP). TTLS type found, beginning with TLS. SSL working, sending response to client - Client answer - Freeradius get a new request with attribut EAP-Message, State and new Message-Authenticator - Entering authorize section, EAP matches, tunnel continues - Entering authenticate section. EAP matches (Auth-Type = EAP). Negociating SSL, sending response to client - Client answer - Freeradius get a new request with attribut EAP-Message, State and new Message-Authenticator - Entering authorize section, EAP matches, tunnel continues - Entering authenticate section. EAP matches (Auth-Type = EAP). SSL tunnel negociated, sending response to client - Client answer - Freeradius get a new request with attribut EAP-Message, State and new Message-Authenticator - Entering authorize section, EAP matches, tunnel continues - Entering authenticate section. EAP matches (Auth-Type = EAP). SSL tunnel negociated, session establisshed, sending response to client - Client answer - Freeradius get a new request with attribut EAP-Message, State and new Message-Authenticator - Entering authorize section, EAP matches, tunnel continues - Entering authenticate section. EAP matches (Auth-Type = EAP). Session establisshed, entering inner-tunnel section. A this time, no more EAP request/send, only new authorise/authenticate in the tunnel. - Entering inner-tunnel authorize section, LDAP matches - Entering LDAP section : bind successful, login is authenticated - Access-Accept is send to client If i'm right, i'm asking some questions : - in the first step of the connexion, what is exactly the job of authorize section ? Does it only set auth-type when finding any "clue" in the request ? - when connexion is in the tunnel step, a "reduced" request is sent ( without EAP attributes). This request is checked by the inner-tunnel authorize section which will set the auth-type, right ? Here the auth-type found is LDAP. If i follow the entire log, i can see - entering authorize - finding Ldap Auth - entering LDAP section, and then bind... But i can't see entering authenticate section as we can see in the firt step with EAP It's quite hard to explain, but * Outside tunnel : request -> authorize section -> Foudn type EAP -> authenticate section -> EAP working * Inside tunnel : request -> authorize section -> Foudn type LDAP -> LDAP working Why is there an "authenticate section" for EAP and a direct use of LDAP section for LDAP ? -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 3

Auth-Type :- Reject in users file matches inner tunnel request but sends Access-Accept
by Michael Gorven 13 Jun '12

13 Jun '12

Hi I have setup WPA2-EAP authentication using FreeRADIUS 2.1.8 on Ubuntu 10.04.4 with an OpenLDAP backend, and can successfully authenticate using PEAP/MSCHAPv2, TTLS/MSCHAPv2 and TTLS/PAP (both via the AP and using eapol_test). I am now trying to restrict access to specific SSIDs based on the LDAP groups which users belong to. From what I can gather, I need to add appropriate rules to /etc/freeradius/users which matches the SSID/group combinations, and rejects everything else. The problem I'm having is with the default reject, not the SSID/group matching. My first attempt was this: DEFAULT Ldap-Group == "employees" DEFAULT Auth-Type := Reject But this immediately rejects the Access-Request in the outer tunnel, because the "anonymous" user is not in the "employees" group. I then modified it to this so that it only matches inner tunnel requests: DEFAULT Ldap-Group == "employees" DEFAULT FreeRADIUS-Proxied-To == "127.0.0.1" Auth-Type := Reject, Reply-Message = "User does not belong to any groups which may access this SSID." The inner tunnel Access-Request is now sent and members of the "employees" group are accepted, but non-members are not actually rejected. I see the users entry being matched, and the Reply-Message is even set, but the server responds with Access-Accept and eapol_test reports SUCCESS. Debug: rlm_ldap::ldap_groupcmp: Group employees not found or user is not a member. Info: [files] users: Matched entry DEFAULT at line 209 Info: ++[files] returns ok ... Auth: Login OK: [mgorven] (from client test port 0 cli 02-00-00-00-00-01 via TLS tunnel) Info: WARNING: Empty section. Using default return values. ... Info: [peap] Got tunneled reply code 2 Auth-Type := Reject Reply-Message = "User does not belong to any groups which may access this SSID." ... Info: [peap] Got tunneled reply RADIUS code 2 Auth-Type := Reject Reply-Message = "User does not belong to any groups which may access this SSID." ... Info: [peap] Tunneled authentication was successful. Info: [peap] SUCCESS Info: [peap] Saving tunneled attributes for later ... Sending Access-Accept of id 11 to 172.16.2.44 port 60746 Reply-Message = "User does not belong to any groups which may access this SSID." User-Name = "mgorven" eapol_test receives an Access-Accept with the Reply-Message set. RADIUS message: code=2 (Access-Accept) identifier=11 length=233 Attribute 18 (Reply-Message) length=64 Value: 'User does not belong to any groups which may access this SSID.' Attribute 1 (User-Name) length=9 Value: 'mgorven' ... SUCCESS Behaviour is the same with PEAP/MSCHAPv2 and TTLS/PAP. I tried setting copy_request_to_tunnel and use_tunneled_reply to yes in the PEAP and TTLS sections, but this didn't make a difference. How do I actually reject an inner tunnel request? Michael -- http://michael.gorven.za.net PGP Key ID 1E016BE8

3 3