Trying to configure eap ttls with mschapv2 using Freeradius version
Version 1.1.3 in Redhat enterprise Linux 5.
I have configured everything and gotten free radius to authenticate off
/etc/samba/smbpasswd via the etc_smbpasswd module. The problem I have
run into is when I switch the securew2 windows xp eap-ttls client to use
the current logged on user credentials. Then, SecureW2 sends the
username in the format of DOMAIN/user (which in this case is HTN/josh).
Authentication then fails because of this extra domain part in the user.
Ok fine, I first enable the nt_domain_hack in the mschap module then I
configured realm ntdomain and simply set a default realm in proxy.conf
to strip off the domain part. Nope, that fails (output will be included
below). I also tried nostrip but that also fails obviously. Also tried
silently stripping the domain in pre-process in radiusd.conf. Auth is
successful but finally rejected because the user doesnt match the
original HTN/josh user sent.
Finally I simply added the username and password I was testing to the
users file. It works there. My default realm strips the domain, proxies
it back to localhost, authenticates of the users file and is successful.
Arrg what Im I doing wrong. I really need to use the etc_smbpasswd
module as I cant get ntlm_auth to work. It says no logon servers found.
I think its because I am running it on the actual samba server I want to
auth off of.
Anyways, anyone know of how to get etc_smbpasswd module to work. I dont
want to use the users file (blech) even though it does work when I put
the user in there, and again, if I just supply the username and password
(and leave the domain part blank in SecureW2 ttls client) authentication
does work of /etc/samba/smbpasswd.
Here is the /usr/sbin/radiusd -X output. Sorry its long. Below that I
will put the relevant lines of config. Thanks a ton for any help. -Josh
[root@file raddb]# /usr/sbin/radiusd -s -X
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config: including file: /etc/raddb/proxy.conf
Config: including file: /etc/raddb/clients.conf
Config: including file: /etc/raddb/snmp.conf
Config: including file: /etc/raddb/eap.conf
main: prefix = "/usr"
main: localstatedir = "/var"
main: logdir = "/var/log/radius"
main: libdir = "/usr/lib"
main: radacctdir = "/var/log/radius/radacct"
main: hostname_lookups = no
main: snmp = no
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 0
main: allow_core_dumps = no
main: log_stripped_names = no
main: log_file = "/var/log/radius/radius.log"
main: log_auth = no
main: log_auth_badpass = no
main: log_auth_goodpass = no
main: pidfile = "/var/run/radiusd/radiusd.pid"
main: user = "(null)"
main: group = "(null)"
main: usercollide = no
main: lower_user = "no"
main: lower_pass = "no"
main: nospace_user = "no"
main: nospace_pass = "no"
main: checkrad = "/usr/sbin/checkrad"
main: proxy_requests = yes
proxy: retry_delay = 5
proxy: retry_count = 3
proxy: synchronous = no
proxy: default_fallback = yes
proxy: dead_time = 120
proxy: post_proxy_authorize = no
proxy: wake_all_if_all_dead = no
security: max_attributes = 200
security: reject_delay = 1
security: status_server = no
main: debug_level = 0
read_config_files: reading dictionary
read_config_files: reading naslist
Using deprecated naslist file. Support for this will go away soon.
read_config_files: reading clients
read_config_files: reading realms
radiusd: entering modules setup
Module: Library search path is /usr/lib
Module: Loaded exec
exec: wait = yes
exec: program = "(null)"
exec: input_pairs = "request"
exec: output_pairs = "(null)"
exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded PAP
pap: encryption_scheme = "crypt"
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded MS-CHAP
mschap: use_mppe = yes
mschap: require_encryption = yes
mschap: require_strong = no
mschap: with_ntdomain_hack = yes
mschap: passwd = "(null)"
mschap: ntlm_auth = "(null)"
Module: Instantiated mschap (mschap)
Module: Loaded System
unix: cache = no
unix: passwd = "(null)"
unix: shadow = "/etc/shadow"
unix: group = "(null)"
unix: radwtmp = "/var/log/radius/radwtmp"
unix: usegroup = no
unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded eap
eap: default_eap_type = "ttls"
eap: timer_expire = 60
eap: ignore_unknown_eap_types = no
eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
gtc: challenge = "Password: "
gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
tls: rsa_key_exchange = no
tls: dh_key_exchange = yes
tls: rsa_key_length = 512
tls: dh_key_length = 512
tls: verify_depth = 0
tls: CA_path = "(null)"
tls: pem_file_type = yes
tls: private_key_file = "/etc/raddb/certs/server_key.pem"
tls: certificate_file = "/etc/raddb/certs/server_cert.pem"
tls: CA_file = "/etc/raddb/certs/cacert.pem"
tls: private_key_password = "serverH08ght0n23kip"
tls: dh_file = "/etc/raddb/certs/dh"
tls: random_file = "/etc/raddb/certs/random"
tls: fragment_size = 1024
tls: include_length = yes
tls: check_crl = no
tls: check_cert_cn = "(null)"
tls: cipher_list = "(null)"
tls: check_cert_issuer = "(null)"
rlm_eap_tls: Loading the certificate file as a chain
rlm_eap: Loaded and initialized type tls
ttls: default_eap_type = "mschapv2"
ttls: copy_request_to_tunnel = no
ttls: use_tunneled_reply = no
rlm_eap: Loaded and initialized type ttls
peap: default_eap_type = "mschapv2"
peap: copy_request_to_tunnel = no
peap: use_tunneled_reply = no
peap: proxy_tunneled_request_as_eap = yes
rlm_eap: Loaded and initialized type peap
mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
preprocess: huntgroups = "/etc/raddb/huntgroups"
preprocess: hints = "/etc/raddb/hints"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line = 23
preprocess: with_ntdomain_hack = no
preprocess: with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack = no
preprocess: with_alvarion_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
realm: format = "suffix"
realm: delimiter = "@"
realm: ignore_default = no
realm: ignore_null = yes
Module: Instantiated realm (suffix)
realm: format = "prefix"
realm: delimiter = "\"
realm: ignore_default = no
realm: ignore_null = yes
Module: Instantiated realm (ntdomain)
Module: Loaded passwd
passwd: filename = "/etc/samba/smbpasswd"
passwd: format =
"*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::"
passwd: authtype = "MS-CHAP"
passwd: delimiter = ":"
passwd: ignorenislike = no
passwd: ignoreempty = yes
passwd: allowmultiplekeys = no
passwd: hashsize = 100
rlm_passwd: nfields: 7 keyfield 0(User-Name) listable: no
Module: Instantiated passwd (etc_smbpasswd)
passwd: filename = "/etc/group"
passwd: format = "=Group-Name:::*,User-Name"
passwd: authtype = "(null)"
passwd: delimiter = ":"
passwd: ignorenislike = yes
passwd: ignoreempty = yes
passwd: allowmultiplekeys = yes
passwd: hashsize = 50
rlm_passwd: nfields: 4 keyfield 3(User-Name) listable: yes
Module: Instantiated passwd (etc_group)
Module: Loaded files
files: usersfile = "/etc/raddb/users"
files: acctusersfile = "/etc/raddb/acct_users"
files: preproxy_usersfile = "/etc/raddb/preproxy_users"
files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address,
Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
detail: detailfile =
"/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename = "/var/log/radius/radutmp"
radutmp: username = "%{User-Name}"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.
rad_recv: Access-Request packet from host 10.100.13.12:19527, id=104,
length=202
User-Name = "HTN\\josh"
Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff"
Calling-Station-Id = "00-0E-35-B6-74-AF"
NAS-Port = 1
NAS-Port-Type = Wireless-802.11
Framed-MTU = 1400
Service-Type = Framed-User
NAS-IP-Address = 10.100.13.12
NAS-Identifier = "Houghton Wireless Services"
NAS-Port-Id = "HTNStaff"
Connect-Info = "CONNECT 54Mbps 802.11g"
EAP-Message = 0x0201000d0148544e5c6a6f7368
Message-Authenticator = 0xdf195f238143503d49244d6203620b10
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module "preprocess" returns ok for request 0
modcall[authorize]: module "chap" returns noop for request 0
rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to
config.
modcall[authorize]: module "suffix" returns noop for request 0
rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh"
rlm_realm: Found realm "DEFAULT"
rlm_realm: Adding Stripped-User-Name = "josh"
rlm_realm: Proxying request from user josh to realm DEFAULT
rlm_realm: Adding Realm = "DEFAULT"
rlm_realm: Authentication realm is LOCAL.
modcall[authorize]: module "ntdomain" returns noop for request 0
rlm_eap: EAP packet type response id 1 length 13
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 0
modcall[authorize]: module "etc_smbpasswd" returns notfound for request 0
modcall[authorize]: module "etc_group" returns notfound for request 0
users: Matched entry DEFAULT at line 175
modcall[authorize]: module "files" returns ok for request 0
modcall[authorize]: module "mschap" returns noop for request 0
modcall: leaving group authorize (returns updated) for request 0
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
rlm_eap: EAP Identity
rlm_eap: processing type tls
rlm_eap_tls: Initiate
rlm_eap_tls: Start returned 1
modcall[authenticate]: module "eap" returns handled for request 0
modcall: leaving group authenticate (returns handled) for request 0
Sending Access-Challenge of id 104 to 10.100.13.12 port 19527
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message = 0x010200061520
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x61bf2476da0a8dbee700d7b52748377c
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 10.100.13.12:19527, id=105,
length=263
User-Name = "HTN\\josh"
Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff"
Calling-Station-Id = "00-0E-35-B6-74-AF"
NAS-Port = 1
NAS-Port-Type = Wireless-802.11
Framed-MTU = 1400
Service-Type = Framed-User
NAS-IP-Address = 10.100.13.12
NAS-Identifier = "Houghton Wireless Services"
NAS-Port-Id = "HTNStaff"
Connect-Info = "CONNECT 54Mbps 802.11g"
State = 0x61bf2476da0a8dbee700d7b52748377c
EAP-Message =
0x020200381500160301002d010000290301e9a07acc81410bcdf08077330d07ad8f018e56a6641624ec64a66da3f79bd121000002000a0100
Message-Authenticator = 0x0334fb063e9a6d53bd8682ba37d0620e
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
modcall[authorize]: module "preprocess" returns ok for request 1
modcall[authorize]: module "chap" returns noop for request 1
rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to
config.
modcall[authorize]: module "suffix" returns noop for request 1
rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh"
rlm_realm: Found realm "DEFAULT"
rlm_realm: Adding Stripped-User-Name = "josh"
rlm_realm: Proxying request from user josh to realm DEFAULT
rlm_realm: Adding Realm = "DEFAULT"
rlm_realm: Authentication realm is LOCAL.
modcall[authorize]: module "ntdomain" returns noop for request 1
rlm_eap: EAP packet type response id 2 length 56
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 1
modcall[authorize]: module "etc_smbpasswd" returns notfound for request 1
modcall[authorize]: module "etc_group" returns notfound for request 1
users: Matched entry DEFAULT at line 175
modcall[authorize]: module "files" returns ok for request 1
modcall[authorize]: module "mschap" returns noop for request 1
modcall: leaving group authorize (returns updated) for request 1
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 1
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
(other): before/accept initialization
TLS_accept: before/accept initialization
rlm_eap_tls: <<< TLS 1.0 Handshake [length 002d], ClientHello
TLS_accept: SSLv3 read client hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello
TLS_accept: SSLv3 write server hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 03d2], Certificate
TLS_accept: SSLv3 write certificate A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
TLS_accept: SSLv3 write server done A
TLS_accept: SSLv3 flush data
TLS_accept:error in SSLv3 read client certificate A
rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0)
In SSL Handshake Phase
In SSL Accept mode
eaptls_process returned 13
modcall[authenticate]: module "eap" returns handled for request 1
modcall: leaving group authenticate (returns handled) for request 1
Sending Access-Challenge of id 105 to 10.100.13.12 port 19527
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message =
0x0103040a15c00000042f160301004a02000046030149642f7ba9e448ca30ab30a9b6ed817c8aff8c408e4023e6940c762c1f36a6de20e1a7c54190eaf152b7593b2b138e0c050f4d101a4e1791b3f21981bd0acbe
EAP-Message =
0x092a864886f70d010901161972656d637374616666406c697374732e72656d63312e6e6574301e170d3038313231353230323332365a170d3138313231333230323332365a308198310b300906035504061302555
EAP-Message =
0x82010100a721638f80275c7d8c29f90e3669da66da29a4dcb0e6d18b17c9349bd6eb88e205da76218efdf67065ee07977b86ccfbc278e1c229e5f9f32340cc2a04dc418528588e667ccb783bc13133bc15a0a0936
EAP-Message =
0xd5652a17fa2f1b0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038201010064900d552e6d98d35cde88dc41403c05fb45c2a2bdb2f5d6f9f0fdc
EAP-Message = 0x21eaab40c755b46a6e7892ae526d055d6da3c8c3190a
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x60ab04b8fd2e304f5d42050b620e1513
Finished request 1
Going to the next request
--- Walking the entire request list ---
Waking up in 5 seconds...
rad_recv: Access-Request packet from host 10.100.13.12:19527, id=106,
length=213
User-Name = "HTN\\josh"
Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff"
Calling-Station-Id = "00-0E-35-B6-74-AF"
NAS-Port = 1
NAS-Port-Type = Wireless-802.11
Framed-MTU = 1400
Service-Type = Framed-User
NAS-IP-Address = 10.100.13.12
NAS-Identifier = "Houghton Wireless Services"
NAS-Port-Id = "HTNStaff"
Connect-Info = "CONNECT 54Mbps 802.11g"
State = 0x60ab04b8fd2e304f5d42050b620e1513
EAP-Message = 0x020300061500
Message-Authenticator = 0x85c0f98d60c740ec669de9a9c7da4986
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 2
modcall[authorize]: module "preprocess" returns ok for request 2
modcall[authorize]: module "chap" returns noop for request 2
rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to
config.
modcall[authorize]: module "suffix" returns noop for request 2
rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh"
rlm_realm: Found realm "DEFAULT"
rlm_realm: Adding Stripped-User-Name = "josh"
rlm_realm: Proxying request from user josh to realm DEFAULT
rlm_realm: Adding Realm = "DEFAULT"
rlm_realm: Authentication realm is LOCAL.
modcall[authorize]: module "ntdomain" returns noop for request 2
rlm_eap: EAP packet type response id 3 length 6
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 2
modcall[authorize]: module "etc_smbpasswd" returns notfound for request 2
modcall[authorize]: module "etc_group" returns notfound for request 2
users: Matched entry DEFAULT at line 175
modcall[authorize]: module "files" returns ok for request 2
modcall[authorize]: module "mschap" returns noop for request 2
modcall: leaving group authorize (returns updated) for request 2
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 2
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
rlm_eap_tls: ack handshake fragment handler
eaptls_verify returned 1
eaptls_process returned 13
modcall[authenticate]: module "eap" returns handled for request 2
modcall: leaving group authenticate (returns handled) for request 2
Sending Access-Challenge of id 106 to 10.100.13.12 port 19527
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message =
0x0104003915800000042f639f242a6f6541ec7b1afbb86af1958c2e4ed1ab48a226b2d15b08e4b7887f25691e005162bd16030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xabc302506c895702968419cddb2c0be9
Finished request 2
Going to the next request
Waking up in 5 seconds...
rad_recv: Access-Request packet from host 10.100.13.12:19527, id=107,
length=533
User-Name = "HTN\\josh"
Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff"
Calling-Station-Id = "00-0E-35-B6-74-AF"
NAS-Port = 1
NAS-Port-Type = Wireless-802.11
Framed-MTU = 1400
Service-Type = Framed-User
NAS-IP-Address = 10.100.13.12
NAS-Identifier = "Houghton Wireless Services"
NAS-Port-Id = "HTNStaff"
Connect-Info = "CONNECT 54Mbps 802.11g"
State = 0xabc302506c895702968419cddb2c0be9
EAP-Message =
0x020401441500160301010610000102010037c452398dbb3df5559e7ef631f93adac1c31949e8b2e189e656c42563825fedb650c87be7a05cfa2b6ab6d25b111dfb5ed36ceafc6a81c2d90982bc4b9514fc25cca8f
EAP-Message =
0xb50e2ba24d87acf465b6923ae7229fe4e011258f1403010001011603010028faee95c6e785c7a0c1f7794e71c76e67ff5ba2f4006e2aa188af3b9da28d6e2419833ca0820678c1
Message-Authenticator = 0xc0ff62f05516e184511c415d87cbbc2c
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 3
modcall[authorize]: module "preprocess" returns ok for request 3
modcall[authorize]: module "chap" returns noop for request 3
rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to
config.
modcall[authorize]: module "suffix" returns noop for request 3
rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh"
rlm_realm: Found realm "DEFAULT"
rlm_realm: Adding Stripped-User-Name = "josh"
rlm_realm: Proxying request from user josh to realm DEFAULT
rlm_realm: Adding Realm = "DEFAULT"
rlm_realm: Authentication realm is LOCAL.
modcall[authorize]: module "ntdomain" returns noop for request 3
rlm_eap: EAP packet type response id 4 length 253
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 3
modcall[authorize]: module "etc_smbpasswd" returns notfound for request 3
modcall[authorize]: module "etc_group" returns notfound for request 3
users: Matched entry DEFAULT at line 175
modcall[authorize]: module "files" returns ok for request 3
modcall[authorize]: module "mschap" returns noop for request 3
modcall: leaving group authorize (returns updated) for request 3
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 3
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange
TLS_accept: SSLv3 read client key exchange A
rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001]
rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished
TLS_accept: SSLv3 read finished A
rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001]
TLS_accept: SSLv3 write change cipher spec A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished
TLS_accept: SSLv3 write finished A
TLS_accept: SSLv3 flush data
(other): SSL negotiation finished successfully
rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0)
SSL Connection Established
eaptls_process returned 13
modcall[authenticate]: module "eap" returns handled for request 3
modcall: leaving group authenticate (returns handled) for request 3
Sending Access-Challenge of id 107 to 10.100.13.12 port 19527
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message =
0x0105003d1580000000331403010001011603010028721fb19555db97969e579863ff1f6fce4169183c7a0abb3ea443be416f722adbc21b355b7ac01a45
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xe4bddc9ecec467abc03da29934752e16
Finished request 3
Going to the next request
Waking up in 5 seconds...
rad_recv: Access-Request packet from host 10.100.13.12:19527, id=108,
length=290
User-Name = "HTN\\josh"
Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff"
Calling-Station-Id = "00-0E-35-B6-74-AF"
NAS-Port = 1
NAS-Port-Type = Wireless-802.11
Framed-MTU = 1400
Service-Type = Framed-User
NAS-IP-Address = 10.100.13.12
NAS-Identifier = "Houghton Wireless Services"
NAS-Port-Id = "HTNStaff"
Connect-Info = "CONNECT 54Mbps 802.11g"
State = 0xe4bddc9ecec467abc03da29934752e16
EAP-Message =
0x02050053150017030100485562de8771e70ff92e34bb96bf0f6c24b6e6aca70841355cc05a96146c524e1c2b177149e577817012b73f9bb41d96639692cbab41f711878b16e20d5a7c04b16bc67577457b2d47
Message-Authenticator = 0x37c5fec48b0fa7f5c14dddc680e8c4f2
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 4
modcall[authorize]: module "preprocess" returns ok for request 4
modcall[authorize]: module "chap" returns noop for request 4
rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to
config.
modcall[authorize]: module "suffix" returns noop for request 4
rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh"
rlm_realm: Found realm "DEFAULT"
rlm_realm: Adding Stripped-User-Name = "josh"
rlm_realm: Proxying request from user josh to realm DEFAULT
rlm_realm: Adding Realm = "DEFAULT"
rlm_realm: Authentication realm is LOCAL.
modcall[authorize]: module "ntdomain" returns noop for request 4
rlm_eap: EAP packet type response id 5 length 83
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 4
modcall[authorize]: module "etc_smbpasswd" returns notfound for request 4
modcall[authorize]: module "etc_group" returns notfound for request 4
users: Matched entry DEFAULT at line 175
modcall[authorize]: module "files" returns ok for request 4
modcall[authorize]: module "mschap" returns noop for request 4
modcall: leaving group authorize (returns updated) for request 4
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 4
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
eaptls_process returned 7
rlm_eap_ttls: Session established. Proceeding to decode tunneled
attributes.
TTLS: Got tunneled request
EAP-Message = 0x0200000d0148544e5c6a6f7368
Message-Authenticator = 0x00000000000000000000000000000000
FreeRADIUS-Proxied-To = 127.0.0.1
TTLS: Got tunneled identity of HTN\josh
TTLS: Setting default EAP type for tunneled EAP session.
TTLS: Sending tunneled request
EAP-Message = 0x0200000d0148544e5c6a6f7368
Message-Authenticator = 0x00000000000000000000000000000000
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "HTN\\josh"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 4
modcall[authorize]: module "preprocess" returns ok for request 4
modcall[authorize]: module "chap" returns noop for request 4
rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to
config.
modcall[authorize]: module "suffix" returns noop for request 4
rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh"
rlm_realm: Found realm "DEFAULT"
rlm_realm: Adding Stripped-User-Name = "josh"
rlm_realm: Proxying request from user josh to realm DEFAULT
rlm_realm: Adding Realm = "DEFAULT"
rlm_realm: Authentication realm is LOCAL.
modcall[authorize]: module "ntdomain" returns noop for request 4
rlm_eap: EAP packet type response id 0 length 13
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 4
modcall[authorize]: module "etc_smbpasswd" returns notfound for request 4
modcall[authorize]: module "etc_group" returns notfound for request 4
modcall[authorize]: module "files" returns notfound for request 4
modcall[authorize]: module "mschap" returns noop for request 4
modcall: leaving group authorize (returns updated) for request 4
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 4
rlm_eap: EAP Identity
rlm_eap: processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
modcall[authenticate]: module "eap" returns handled for request 4
modcall: leaving group authenticate (returns handled) for request 4
TTLS: Got tunneled reply RADIUS code 11
EAP-Message =
0x010100221a0101001d1023197ffb3fbee0431fa33dd4ffe6ee4848544e5c6a6f7368
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x9023e8d5cfb89d9eedf0b95ea0ea8077
TTLS: Got tunneled Access-Challenge
modcall[authenticate]: module "eap" returns handled for request 4
modcall: leaving group authenticate (returns handled) for request 4
Sending Access-Challenge of id 108 to 10.100.13.12 port 19527
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
EAP-Message =
0x0106007415800000006a170301001869103bd6a2fc06d853c018dec840fcee432f605b3bbd5c7b170301004882ddab817db15367d699b45444ae600ef8afaba3ca3c2eae0b4be817885fde9ab28ecedeca71e5371
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xc1a3900bb47d4eeed37494a4af610f6a
Finished request 4
Going to the next request
Waking up in 5 seconds...
rad_recv: Access-Request packet from host 10.100.13.12:19527, id=109,
length=346
User-Name = "HTN\\josh"
Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff"
Calling-Station-Id = "00-0E-35-B6-74-AF"
NAS-Port = 1
NAS-Port-Type = Wireless-802.11
Framed-MTU = 1400
Service-Type = Framed-User
NAS-IP-Address = 10.100.13.12
NAS-Identifier = "Houghton Wireless Services"
NAS-Port-Id = "HTNStaff"
Connect-Info = "CONNECT 54Mbps 802.11g"
State = 0xc1a3900bb47d4eeed37494a4af610f6a
EAP-Message =
0x0206008b15001703010080ec308e1a81a20c80b07a9399135ce92cb9856ea5b98bf1d18e5b53c8959c899f7e0a5ac3cb31cd966591961318eb728dc0cdc95c3a09318920c6f9fba21b88827380f0ca91a8b66b9da
Message-Authenticator = 0x24e4740de40c15633d63d47b2e2dcc5e
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 5
modcall[authorize]: module "preprocess" returns ok for request 5
modcall[authorize]: module "chap" returns noop for request 5
rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to
config.
modcall[authorize]: module "suffix" returns noop for request 5
rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh"
rlm_realm: Found realm "DEFAULT"
rlm_realm: Adding Stripped-User-Name = "josh"
rlm_realm: Proxying request from user josh to realm DEFAULT
rlm_realm: Adding Realm = "DEFAULT"
rlm_realm: Authentication realm is LOCAL.
modcall[authorize]: module "ntdomain" returns noop for request 5
rlm_eap: EAP packet type response id 6 length 139
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 5
modcall[authorize]: module "etc_smbpasswd" returns notfound for request 5
modcall[authorize]: module "etc_group" returns notfound for request 5
users: Matched entry DEFAULT at line 175
modcall[authorize]: module "files" returns ok for request 5
modcall[authorize]: module "mschap" returns noop for request 5
modcall: leaving group authorize (returns updated) for request 5
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 5
rlm_eap: Request found, released from the list
rlm_eap: EAP/ttls
rlm_eap: processing type ttls
rlm_eap_ttls: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
eaptls_process returned 7
rlm_eap_ttls: Session established. Proceeding to decode tunneled
attributes.
TTLS: Got tunneled request
EAP-Message =
0x020100431a0201003e310fc0026c362449dfb52a48226b9bf58e000000000000000055a52026985b92247cf83d076fd500b15479fccd5f204f5f0048544e5c6a6f7368
Message-Authenticator = 0x00000000000000000000000000000000
FreeRADIUS-Proxied-To = 127.0.0.1
TTLS: Adding old state with 90 23
TTLS: Sending tunneled request
EAP-Message =
0x020100431a0201003e310fc0026c362449dfb52a48226b9bf58e000000000000000055a52026985b92247cf83d076fd500b15479fccd5f204f5f0048544e5c6a6f7368
Message-Authenticator = 0x00000000000000000000000000000000
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "HTN\\josh"
State = 0x9023e8d5cfb89d9eedf0b95ea0ea8077
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 5
modcall[authorize]: module "preprocess" returns ok for request 5
modcall[authorize]: module "chap" returns noop for request 5
rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to
config.
modcall[authorize]: module "suffix" returns noop for request 5
rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh"
rlm_realm: Found realm "DEFAULT"
rlm_realm: Adding Stripped-User-Name = "josh"
rlm_realm: Proxying request from user josh to realm DEFAULT
rlm_realm: Adding Realm = "DEFAULT"
rlm_realm: Authentication realm is LOCAL.
modcall[authorize]: module "ntdomain" returns noop for request 5
rlm_eap: EAP packet type response id 1 length 67
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 5
modcall[authorize]: module "etc_smbpasswd" returns notfound for request 5
modcall[authorize]: module "etc_group" returns notfound for request 5
modcall[authorize]: module "files" returns notfound for request 5
modcall[authorize]: module "mschap" returns noop for request 5
modcall: leaving group authorize (returns updated) for request 5
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 5
rlm_eap: Request found, released from the list
rlm_eap: EAP/mschapv2
rlm_eap: processing type mschapv2
Processing the authenticate section of radiusd.conf
modcall: entering group MS-CHAP for request 5
rlm_mschap: No User-Password configured. Cannot create LM-Password.
rlm_mschap: No User-Password configured. Cannot create NT-Password.
rlm_mschap: Told to do MS-CHAPv2 for josh with NT-Password
rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication.
rlm_mschap: FAILED: MS-CHAP2-Response is incorrect
modcall[authenticate]: module "mschap" returns reject for request 5
modcall: leaving group MS-CHAP (returns reject) for request 5
rlm_eap: Freeing handler
modcall[authenticate]: module "eap" returns reject for request 5
modcall: leaving group authenticate (returns reject) for request 5
auth: Failed to validate the user.
TTLS: Got tunneled reply RADIUS code 3
MS-CHAP-Error = "\001E=691 R=1"
EAP-Message = 0x04010004
Message-Authenticator = 0x00000000000000000000000000000000
TTLS: Got tunneled Access-Reject
rlm_eap: Handler failed in EAP/ttls
TTLS: Freeing handler for user HTN\josh
rlm_eap: Failed in EAP select
modcall[authenticate]: module "eap" returns invalid for request 5
modcall: leaving group authenticate (returns invalid) for request 5
auth: Failed to validate the user.
Delaying request 5 for 1 seconds
Finished request 5
Going to the next request
Waking up in 5 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 104 with timestamp 49642f7a
Sending Access-Reject of id 109 to 10.100.13.12 port 19527
EAP-Message = 0x04060004
Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 1 seconds...
[root@file raddb]#
Relevent lines of config (all else is default pretty much)
proxy.conf
realm DEFAULT {
type = radius
authhost = LOCAL
accthost = LOCAL
# authhost = radius.company.com:1600
# accthost = radius.company.com:1601
secret = testing123
# nostrip
}
In radiusd.conf here is my etc_smbpasswd section
passwd etc_smbpasswd {
filename = /etc/samba/smbpasswd
format =
"*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::"
authtype = MS-CHAP
hashsize = 100
ignorenislike = no
allowmultiplekeys = no
}
My ntdomain realm definition
realm ntdomain {
format = prefix
delimiter = "\\"
ignore_default = no
ignore_null = yes
}
