- Freeradius-Users - lists.freeradius.org

Limiting Wifi Access
by Roy Kartadinata 25 Jun '08

25 Jun '08

Hi guys, We're trying to centralize our corporate wifi authentication using freeradius. So far, I was able to get user to authenticate based on NAS IP (I got access to multiple NAS working as well) and Mac Address. Is it possible to also limit their access per SSID? The reason for this is because one of our locations, our HQ, has 3 SSID and only certain people have access to certain SSID but I'm not sure if this will conflict with already working NAS checking. Our HQ is using Cisco Wireless LAN Controller so all 3 SSID will connect to radius using the same NAS IP. Cheers, Roy Kartadinata

4 4

Goodbye SNMP, hello statistics.
by Alan DeKok 24 Jun '08

24 Jun '08

I've commited some code (~1K LoC) to CVS head that will go into 2.0.6. In short, there's no point in using SNMP any more. The good news is that the Status-Server packet is overloaded to get all sorts of statistics that weren't available in SNMP. For more information, see: share/dictionary.freeradius Some comments: - the statistics can ONLY be queried from localhost. This will not be changed. - You can ask for ALL auth statistics (across all "listen" sockets) - Or, specify a socket IP/port, and it will return the stats for that socket. - You can do this for auth/acct sockets independently - you can query statistics for one client, and optionally specify the server IP/port (if the "listen" section has it's own clients) - you can ask for total auth/acct packets that are proxied to home servers - you can ask for total auth/acct packets that are sent to individual home servers. - you can tell when a home server was marked dead / alive, and how many requests have been sent, but not responded to. - you can ask for stats on the internal queues in the server (e.g. if it's busy, there will be many packets waiting, and all of the child threads will be doing work) The end result is that it's simpler to implement than SNMP, has fewer issues, and returns more data than the SNMP statistics would return. Enjoy. Alan DeKok.

6 12

Re: tnc server with libtnc
by Ingo Bente 24 Jun '08

24 Jun '08

> Fernando wrote: >> Alan DeKok wrote: >>> Fernando wrote: >>> >>>> I have read in list that, *Steffen Bartsch *was planning to develop a >>>> module for a TNC server linking freeradius with libtnc. (in 2007) >>>> >>>> Does someone know something about it? >>>> >>> Download the latest version of the server. Look for the TNC module. >>> >>> >> The last version works with libtnc? > callTNCS = (ExchangeTNCCSMessagePointer) getProcAddress(handle, > "exchangeTNCCSMessages"); > This is the link to perform a dialog between Freeradius and the > TNCS? The EAP-TNC method was developed by the TNC@FHH project. The current EAP-method that is part of FreeRADIUS is outdated. See http://tnc.inform.fh-hannover.de for further information. You will need to download - the latest FreeRADIUS EAP-TNC patch - TNC@FHH packages As TNC client, I suggest that you use wpa_supplicant. Considering libtnc: TNC@FHH and the FreeRADIUS EAP-TNC patch don't use libtnc. But TNC@FHH works with libtnc. That is, you can write your own IMCs/IMVs based on libtnc and use them together with TNC@FHH, FreeRADIUS and wpa_supplicant. Ingo Sorry for sending this twice. Forgot to change the subject in the first place.

1 0

Re: Bind socket?
by ELOM ETSE 24 Jun '08

24 Jun '08

I have removed the directory /usr/local/etc/raddb and rebooted the computer. After this i reinstalled freeradiusd not from cvs but with downloaded packet 2.0.5 Then when i called radiusd -X, all went well. The little probem is that i can't add ipaddr in section listen. Here is the result: root@pio-desktop:~# /usr/local/sbin/radiusd -X FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu, built on Jun 23 2008 at 18:59:26 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. Now what must i do? --- En date de : Mar 24.6.08, Jelle Langbroek <jml(a)orkz.net> a écrit : De: Jelle Langbroek <jml(a)orkz.net> Objet: Re: Bind socket? À: infomario_007(a)yahoo.fr Date: Mardi 24 Juin 2008, 15h30 Have you read the documentation in radiusd.conf regarding the listening address and port? This part: listen { type = auth ipaddr = * port = 1812 interface = eth0 } Try to play with these settings. set ipaddr to * or to the real ip address of the interface (like you have set now). Try with port "0" or "1812" and try to bind it to the correct interface. Try different settings and combinations. Also make sure you have your interface (eth0 or eth1) configured the right way. Check with command: # ifconfig Your problem must lie in the listen{} part. If it still doesn't work, please post me your entire log of "radiusd -X". Good luck! gr, jelle 2008/6/24 ELOM ETSE <infomario_007(a)yahoo.fr>: Hello! I am Sorry for the delay of my answer. When i used the command ./configure>configure.log in radiusd directory this is what i have: root@pio-desktop:/home/pio/radiusd# ./configure > configure.log config.status: WARNING: ./Make.inc.in seems to ignore the --datarootdir setting config.status: WARNING: ./src/include/build-radpaths-h.in seems to ignore the --datarootdir setting configure: WARNING: the TNCS library isn't found! configure: WARNING: silently not building rlm_eap_tnc. configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. configure: WARNING: silently not building rlm_eap_ikev2. configure: WARNING: FAILURE: rlm_eap_ikev2 requires: libeap-ikev2 EAPIKEv2/connector.h. configure: WARNING: silently not building rlm_pam. configure: WARNING: FAILURE: rlm_pam requires: libpam. So the rlm_exec library was compiled. Now when i boot with radiusd -X this is the result: ERROR: Failed to open socket: cannot bind socket: Cannot assign requested address /usr/local/etc/raddb/radiusd.conf[236]: Error binding to port for 192.168.2.15 port 1817 Please, What must i do? --- En date de : Lun 23.6.08, Jelle Langbroek <jml(a)orkz.net> a écrit : De: Jelle Langbroek <jml(a)orkz.net> Objet: Re: Bind socket? À: infomario_007(a)yahoo.fr Date: Lundi 23 Juin 2008, 21h23 Well, your first problem is that you don't have the module rlm_exec installed. Please recompile freeradius and look at the output from ./configure (e.g: # ./configure > configure.log) for compile errors because of dependency problems. Make sure everything that you want, is compiled with it. At least rlm_exec should be in the logs. Furthermore, make sure that you bind radiusd to the right interface before starting it. The default config should immediatly work for you. Make sure the first time you run it, you do it with the default certicate. It generates a new one for you. ...If the default config doesn't work, you've compiled it wrong. Check dependencies! yours, jelle 2008/6/23 ELOM ETSE <infomario_007(a)yahoo.fr>: I have stopped it as you say by rebooting the computer but no good result. Is there another way to resolv this problem? --- En date de : Lun 23.6.08, Jelle Langbroek <jml(a)orkz.net> a écrit : De: Jelle Langbroek <jml(a)orkz.net> Objet: Re: Bind socket? À: infomario_007(a)yahoo.fr, "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Lundi 23 Juin 2008, 19h56 Your radiusd is still running. Stop it first before you start another pid. jelle 2008/6/23 ELOM ETSE <infomario_007(a)yahoo.fr>: While i was resolving the problem of lib rlm_exec, i meet whith this another problem. ERROR: Failed to open socket: cannot bind socket: Cannot assign requested address /usr/local/etc/raddb/radiusd.conf[236]: Error binding to port for 192.168.2.15 port 1812 I try to get a suitable answer on web but unfortunately i did not. Can you help me please? Envoyé avec Yahoo! Mail. Une boite mail plus intelligente. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Envoyé avec Yahoo! Mail. Une boite mail plus intelligente. Envoyé avec Yahoo! Mail. Une boite mail plus intelligente. _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

EAP/TLS/CHAP versus open SSH
by Sudarshan Soma 24 Jun '08

24 Jun '08

Hi, Iam planning to secure telnet/http connections from any linux/windows box. for this iam using pam_opie PAM module which basically is one form of OTP(one time passwd) authentication module. The authenticator is a linux box, so should i go for open ssh or PPP protocol like OTP (using pam_opie PAM module). open SSH also has Challenge response implemented. But it might be slower due to asymmetric encryption. I think in my use case, the authenticator has TCP/IP stack i should go for SSH or SSL with http instead of PPP protocols. Please let me know your comments/suggestions. Regards, Sudarshan

1 0

Solutions: Various certificate issues with MACOSX (TLS Errors)
by Jelle Langbroek 24 Jun '08

24 Jun '08

Hi, I'm posting this to the list just for future reference. Though this may not seem a freeRadius issue, it still had a lot to do with it. Probably people with the same issues will look in this list for answers. I've been struggling with various freeRadius certificate issues the past year. Mainly Apple's OSX had problems with connecting. The problem got more complicated because different OSX versions reacted differently and had to be configured differently. The errors that kept popping up in the freeRadius logs (and because of which authentication failed) where: Tue Jun 24 16:18:26 2008 : Error: TLS Alert read:warning:close notify Tue Jun 24 16:18:26 2008 : Auth: Login incorrect: [UserX/<via Auth-Type = EAP>] (from client NAS-name port 62 cli 001d4ffdebe8) The error on the OSX client was something like "802.1x Authentication has failed" or it gives a "TLS error". I recently found how to solve the problem on all Apple OSX clients. Looking backward it seems obvious, but I struggled with it for a long time nevertheless. Configuration: * Server: freeRadius 2.0.5 using PEAP without client certificates. !Server certificate is self-signed! * AP: Linksys WAP54G, WPA-Enterprise, AES * Client: Apple MacOSX (tested with 10.3x 10.4x and 10.5x) Problem: * The Airport was configured as follows: - Created new 802.1x connection and set Configuration: "Disable 802.1x login", set username, password and network and set ONLY PEAP (for what I use on my WLAN). - Now connect to the network with WPA-Enterprise, username, password and 802.1x authentication. What will happen is that either you get a popup window regarding the self-signed servercertificate and you should push 'Continue' or authentication will fail. When you get the popup window, push 'Continue' and the Airport will connect correctly. Make sure you DON'T set the trust settings regarding the certificate to "Always trust" because then authentication will fail in the future. I don't know why this is the case, it just is... It means your users will always have to push the 'Continue' button when connecting. When authentication fails without a certificate popup, you probably already have a certificate installed (OSX did that itself) that refers to your freeRadius server. Could be the test certificate when freeRadius was launched for the first time. To resolve the problem on the OSX client go to "Programms - Utilities - Keychain access" and look for certificates regarding your radius-server. Now delete them or, if the certificates are the right ones, set the 'trust settings' to "Ask (every time)". The main problem here is how OSX deals with self-signed certificates. It somehow needs to ask the user for accepting the certificate every time it connects to freeRadius. When OSX is set to always trust it, it fails to send the right credentials or authentication information. I will try it with a certificate from a Certified CA. OSX should accept that one immediately. More on that later. If anybody has more/other information on this, I'm happy to read that! :) Yours, Jelle

2 1

Re: Freeradius-Users Digest, Vol 38, Issue 132
by Ingo Bente 24 Jun '08

24 Jun '08

> Fernando wrote: >> Alan DeKok wrote: >>> Fernando wrote: >>> >>>> I have read in list that, *Steffen Bartsch *was planning to develop a >>>> module for a TNC server linking freeradius with libtnc. (in 2007) >>>> >>>> Does someone know something about it? >>>> >>> Download the latest version of the server. Look for the TNC module. >>> >>> >> The last version works with libtnc? > callTNCS = (ExchangeTNCCSMessagePointer) getProcAddress(handle, > "exchangeTNCCSMessages"); > This is the link to perform a dialog between Freeradius and the > TNCS? The EAP-TNC method was developed by the TNC@FHH project. The current EAP-method that is part of FreeRADIUS is outdated. See http://tnc.inform.fh-hannover.de for further information. You will need to download - the latest FreeRADIUS EAP-TNC patch - TNC@FHH packages As TNC client, I suggest that you use wpa_supplicant. Considering libtnc: TNC@FHH and the FreeRADIUS EAP-TNC patch don't use libtnc. But TNC@FHH works with libtnc. That is, you can write your own IMCs/IMVs based on libtnc and use them together with TNC@FHH, FreeRADIUS and wpa_supplicant. Ingo

1 0

Redundancy duplicate ip address (update perviuos email )
by Asaad 24 Jun '08

24 Jun '08

sorry for the previous email that contains spilling errors :( I use LNS with freeradius, and I have two separate radius servers , the LNS support primary and secondary radius server The radius server use standalone database server to auth and accut And using rlm_ippool files to handle and store assigned IPS If we enabled the secondary radius server in this case, may it will assign duplicate IP Address, that primary radius was assigned them before Please any hint to fix this problem or any better scenario Thanks Earn cashback on your purchases with Live Search - the search that pays you back! Learn More _________________________________________________________________ Introducing Live Search cashback . It's search that pays you back! http://search.live.com/cashback/?&pkw=form=MIJAAF/publ=HMTGL/crea=introsrch…

2 3

Compiling FreeRADIUS 2.0.x on Solaris 10u4 x86
by john zx 24 Jun '08

24 Jun '08

When running 'configure' on a Solaris 10u4 x86 container, with version 2.0.4 or 2.0.5, the modules rlm_krb5 and rlm_python do not get configured - with either Sun Studio 12 ou GCC 3.4.6, and even using CPPFLAGS or --with-rlm-FOO-etc. Also, where can I find reasonable information about how make the rlm_eap_ikev2? Thank you for any advice. _____________________ checking for DH_new in -lcrypto... yes checking for set_com_err_hook in -lcom_err... no configure: WARNING: the comm_err library isn't found! checking for krb5_init_context in -lkrb5... yes configure: WARNING: silently not building rlm_krb5. configure: WARNING: FAILURE: rlm_krb5 requires: krb5.h. checking for Py_Initialize in -lpython2.3... no configure: WARNING: silently not building rlm_python. configure: WARNING: FAILURE: rlm_python requires: Python.h libpython2.3. _____________________

4 3

Samba NT & LM hashes with PEAP
by Juraj Hrubša 24 Jun '08

24 Jun '08

Hello I want to use an existing LDAP database for authentication of WIFI users using EAP-PEAP. I am already using LDAP as a backend for samba, so I have NT and LM hashes stored. The problem is I am still getting errors: rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: Told to do MS-CHAPv2 for lolo with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 rlm_eap: Freeing handler I have generated NT and LM hashes for test user lolo like this: # smbencrypt hoho LM Hash NT Hash -------------------------------- -------------------------------- E7B56BC6A10F5E88AAD3B435B51404EE C32F64F9BD0708A6A055812D83B085E2 I have tried ntdomain hack on and off without any result... From radiusd.conf: # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. I have tried this, but I cannot set LDAP attributes to anything like that, as I understand from samba ldap scheme. attributetype ( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'LanManager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'MD4 hash of the unicode password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) Do I have to add other attributes, or is it possible to add "0x" via some freeradius configuration? I have added complete output as an attachment for your convenience. Thanks in advance... Juraj Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = no mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "uid=manager,ou=accounts,dc=testing,dc=sk" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "hoho" ldap: basedn = "dc=testing,dc=sk" ldap: filter = "(uid=%u)" ldap: base_filter = "(objectclass=sambaSamAccount)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x8143b30 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/certs/crt.pem" tls: certificate_file = "/etc/freeradius/certs/crt.pem" tls: CA_file = "/etc/freeradius/certs/ca.pem" tls: private_key_password = "(null)" tls: dh_file = "/etc/freeradius/certs/dh" tls: random_file = "/etc/freeradius/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = yes preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1:2048, id=0, length=121 User-Name = "lolo" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "001731e75a28" Calling-Station-Id = "0012f072663d" NAS-Identifier = "001731e75a28" NAS-Port = 41 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000009016c6f6c6f Message-Authenticator = 0x8a34d789cb2a1f8fa9bbf7a983a9b1b4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for lolo radius_xlat: '(uid=lolo)' radius_xlat: 'dc=testing,dc=sk' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as uid=manager,ou=accounts,dc=testing,dc=sk/hoho to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=testing,dc=sk, with filter (uid=lolo) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNTPassword as NT-Password, value 35839254E3956535CC205CE6223DF0B8 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value EF4B8C4F3BA6EA26104F64A3BCB3B38F & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user lolo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.1.1 port 2048 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6a0adc2acdb86142933a3bb4add13e04 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.1:2048, id=0, length=210 User-Name = "lolo" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "001731e75a28" Calling-Station-Id = "0012f072663d" NAS-Identifier = "001731e75a28" NAS-Port = 41 Framed-MTU = 1400 State = 0x6a0adc2acdb86142933a3bb4add13e04 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201005019800000004616030100410100003d0301485fa74b9246694ca897541068b3eadf53fb7d700d8fb1e927ffe19bb80041a100001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x3d65cee79491e6bf1d721f58dd64eec2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for lolo radius_xlat: '(uid=lolo)' radius_xlat: 'dc=testing,dc=sk' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=testing,dc=sk, with filter (uid=lolo) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNTPassword as NT-Password, value 35839254E3956535CC205CE6223DF0B8 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value EF4B8C4F3BA6EA26104F64A3BCB3B38F & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user lolo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 06de], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 0 to 192.168.1.1 port 2048 EAP-Message = 0x0102040a19c00000073b160301004a020000460301485fc28baa06c5f6354b0f516be365ff5a06edfc5cd30b068870431be2eab08b20f9a5a989b1cb4b0af4b49a5a751915a9d3e624c7d875a77c8d113b9ef66823fa00040016030106de0b0006da0006d700037e3082037a308202e3a003020102020101300d06092a864886f70d01010405003079310b3009060355040613024b47310b3009060355040813024e413110300e06035504071307424953484b454b31153013060355040a130c4f70656e56504e2d544553543111300f0603550403130872616469757363613121301f06092a864886f70d01090116126d65406d79686f73742e6d7964 EAP-Message = 0x6f6d61696e301e170d3038303632333039353731325a170d3138303632313039353731325a3065310b3009060355040613024b47310b3009060355040813024e4131153013060355040a130c4f70656e56504e2d54455354310f300d060355040313067261646975733121301f06092a864886f70d01090116126d65406d79686f73742e6d79646f6d61696e30819f300d06092a864886f70d010101050003818d0030818902818100d80065fa3c5bfb6352060c475145c0c318f2c6ed76435dc3bb34bae3a2bb81228ed6b8244d08633d5c1739910f1c91c05a8483341e58531efe74286502e1852dd918fdf0c0da4cae5522f393fed3db05e667d295 EAP-Message = 0x1796793972dc04f4580b008984e9c3d331187aa39665fb955091c74b2bcaec343b423c71bf15a9471661ce7d0203010001a38201243082012030090603551d1304023000301106096086480186f8420101040403020640303306096086480186f842010d042616244f70656e53534c2047656e65726174656420536572766572204365727469666963617465301d0603551d0e04160414d6fa58f761732b76075e5bae9f5b8cfd8755a4df3081ab0603551d230481a33081a080145d12b931b777e3248837715277100634928b5881a17da47b3079310b3009060355040613024b47310b3009060355040813024e413110300e06035504071307424953 EAP-Message = 0x484b454b31153013060355040a130c4f70656e56504e2d544553543111300f0603550403130872616469757363613121301f06092a864886f70d01090116126d65406d79686f73742e6d79646f6d61696e820900bf14476493d21f34300d06092a864886f70d010104050003818100609dff2d623f30f50d8ef23b56da19ee6fffb1dc84c27a056862ed988e7825d6f778f0eef283139d1c4d9adb7ca2b1a1dbc37c388d5042dbee484d06a575760f957c5905c79e123d8b730a85cf927e04ee8c50574c56af5aacddb6befe6bf45928b7d9db149762a12937207d745860d8f04783a4344b6e1e63c55cdf18fb43b00003533082034f308202b8a00302 EAP-Message = 0x0102020900bf14476493d21f34300d06092a864886f7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfdc1c1cde03a155db044fa59add5b8bf Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.1:2048, id=0, length=136 User-Name = "lolo" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "001731e75a28" Calling-Station-Id = "0012f072663d" NAS-Identifier = "001731e75a28" NAS-Port = 41 Framed-MTU = 1400 State = 0xfdc1c1cde03a155db044fa59add5b8bf NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200061900 Message-Authenticator = 0x346d96ff515b4a7a06982bcd91e01b3f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for lolo radius_xlat: '(uid=lolo)' radius_xlat: 'dc=testing,dc=sk' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=testing,dc=sk, with filter (uid=lolo) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNTPassword as NT-Password, value 35839254E3956535CC205CE6223DF0B8 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value EF4B8C4F3BA6EA26104F64A3BCB3B38F & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user lolo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 0 to 192.168.1.1 port 2048 EAP-Message = 0x0103034119000d01010505003079310b3009060355040613024b47310b3009060355040813024e413110300e06035504071307424953484b454b31153013060355040a130c4f70656e56504e2d544553543111300f0603550403130872616469757363613121301f06092a864886f70d01090116126d65406d79686f73742e6d79646f6d61696e301e170d3038303632333039353635355a170d3138303632313039353635355a3079310b3009060355040613024b47310b3009060355040813024e413110300e06035504071307424953484b454b31153013060355040a130c4f70656e56504e2d544553543111300f06035504031308726164697573 EAP-Message = 0x63613121301f06092a864886f70d01090116126d65406d79686f73742e6d79646f6d61696e30819f300d06092a864886f70d010101050003818d0030818902818100c3edbc66850d2720e45dffa37f0b208926a0a1a3754a64105940ad3bc4062053225b969f51b0c3fa79cc09a2e1b18183697c79b062c8e74296931939692ab38308a474da7030b5cadefa5f03470a1e22eea6e8c0946d918a95943f9297e345e86cbb7b40d3258dd7a1473e620188237952849c9f942373960ae621c0c260b3150203010001a381de3081db301d0603551d0e041604145d12b931b777e3248837715277100634928b58813081ab0603551d230481a33081a080145d EAP-Message = 0x12b931b777e3248837715277100634928b5881a17da47b3079310b3009060355040613024b47310b3009060355040813024e413110300e06035504071307424953484b454b31153013060355040a130c4f70656e56504e2d544553543111300f0603550403130872616469757363613121301f06092a864886f70d01090116126d65406d79686f73742e6d79646f6d61696e820900bf14476493d21f34300c0603551d13040530030101ff300d06092a864886f70d0101050500038181002e9d355c8f8ec1bd9b3b678bc98594b0ed56d0531e2247c418a72e8ece04d496f9ac3e9dffcdaa686479cce66c8e732bd137c1e88e61b873a53fc3f8768ce2 EAP-Message = 0x5818531a7a2d39d9084d855c9dcbf86fcf8650507a8fe183f9252628a9bafcacb16be1ee6fd30a388ae72acb0d2900297950c3e20a47fb7cca042a69f414aa4b1816030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xae968455e5720ca7da392bda06d9f55b Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.1:2048, id=0, length=322 User-Name = "lolo" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "001731e75a28" Calling-Station-Id = "0012f072663d" NAS-Identifier = "001731e75a28" NAS-Port = 41 Framed-MTU = 1400 State = 0xae968455e5720ca7da392bda06d9f55b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300c01980000000b616030100861000008200805fd4aad85c735732f34e64c70a2589cbfcd58e4af26f6008167c5f08321d243cb79610bdf83149198ff40be17520f320a895f0eb77a2ee92fb8aa351ba50bfc2372f1a8a8a5df673531d4052b6cc9e8689b07eaad8f3478dfedcc0be61bd7db0edb3cd292ba750974aa792ab4ea87c9cf378caf278e6d08b092cf9d90658b9ee1403010001011603010020e7a6da4013775d928478d49d02c1c718e969a9a19046a46d34fc3fcc5bfe5e64 Message-Authenticator = 0xdb00b1aec34d5bb60a0cb2f871ed680d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for lolo radius_xlat: '(uid=lolo)' radius_xlat: 'dc=testing,dc=sk' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=testing,dc=sk, with filter (uid=lolo) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNTPassword as NT-Password, value 35839254E3956535CC205CE6223DF0B8 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value EF4B8C4F3BA6EA26104F64A3BCB3B38F & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user lolo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 0 to 192.168.1.1 port 2048 EAP-Message = 0x010400311900140301000101160301002081dd6fa342d02fecdf8ecd8c60ea369408d303918aa488de0520493486b2e706 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe952aabe2222ed0d84ac572718c449ee Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.1:2048, id=0, length=136 User-Name = "lolo" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "001731e75a28" Calling-Station-Id = "0012f072663d" NAS-Identifier = "001731e75a28" NAS-Port = 41 Framed-MTU = 1400 State = 0xe952aabe2222ed0d84ac572718c449ee NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 Message-Authenticator = 0xf0a87d638db2248c77a459faf5ee561e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for lolo radius_xlat: '(uid=lolo)' radius_xlat: 'dc=testing,dc=sk' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=testing,dc=sk, with filter (uid=lolo) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNTPassword as NT-Password, value 35839254E3956535CC205CE6223DF0B8 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value EF4B8C4F3BA6EA26104F64A3BCB3B38F & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user lolo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 0 to 192.168.1.1 port 2048 EAP-Message = 0x0105002019001703010015321f02523fd309139621700d45a268f50a3938c431 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb53579b10c9b11d91cd204a8d53f507c Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.1:2048, id=0, length=162 User-Name = "lolo" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "001731e75a28" Calling-Station-Id = "0012f072663d" NAS-Identifier = "001731e75a28" NAS-Port = 41 Framed-MTU = 1400 State = 0xb53579b10c9b11d91cd204a8d53f507c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02050020190017030100152a5d1a5cf8572cd02f150927a9a36e2ab3d96c0468 Message-Authenticator = 0x050a22428ab9547fa02dd7dfb05fc186 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 32 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for lolo radius_xlat: '(uid=lolo)' radius_xlat: 'dc=testing,dc=sk' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=testing,dc=sk, with filter (uid=lolo) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNTPassword as NT-Password, value 35839254E3956535CC205CE6223DF0B8 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value EF4B8C4F3BA6EA26104F64A3BCB3B38F & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user lolo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - lolo rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x02050009016c6f6c6f PEAP: Got tunneled identity of lolo PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to lolo PEAP: Sending tunneled request EAP-Message = 0x02050009016c6f6c6f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "lolo" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for lolo radius_xlat: '(uid=lolo)' radius_xlat: 'dc=testing,dc=sk' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=testing,dc=sk, with filter (uid=lolo) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNTPassword as NT-Password, value 35839254E3956535CC205CE6223DF0B8 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value EF4B8C4F3BA6EA26104F64A3BCB3B38F & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user lolo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x0106001e1a01060019101cf5cb2bda1329ef21761e15dbe71a4c6c6f6c6f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf25ab07f3e8383d1c1a2841a813462c7 PEAP: Processing from tunneled session code 0x81826c8 11 EAP-Message = 0x0106001e1a01060019101cf5cb2bda1329ef21761e15dbe71a4c6c6f6c6f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf25ab07f3e8383d1c1a2841a813462c7 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 0 to 192.168.1.1 port 2048 EAP-Message = 0x010600351900170301002a738d385e9dbfd237a1a58a392bb60db3c319cb141bb6749bb795c76013d270e0ae40b32f68de2fa133cf Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1203a6d1bd4cc2a59fe19e2e031418bb Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.1:2048, id=0, length=216 User-Name = "lolo" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "001731e75a28" Calling-Station-Id = "0012f072663d" NAS-Identifier = "001731e75a28" NAS-Port = 41 Framed-MTU = 1400 State = 0x1203a6d1bd4cc2a59fe19e2e031418bb NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600561900170301004b8d4ffbc98e89a3ab0e3ae6249d7ad4cb8bbb90829712c9c6bfdaa4f1428fbf6be3132b4c3b7918ef2360b4b5664a848803b6afcc4ef943931e5d2f416eab036a8ca80879de3987ef1e5cf7 Message-Authenticator = 0x1e2fac525d5478ff5ad095588c0b5d2a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 86 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for lolo radius_xlat: '(uid=lolo)' radius_xlat: 'dc=testing,dc=sk' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=testing,dc=sk, with filter (uid=lolo) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNTPassword as NT-Password, value 35839254E3956535CC205CE6223DF0B8 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value EF4B8C4F3BA6EA26104F64A3BCB3B38F & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user lolo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0206003f1a0206003a3139cf6286a0aac740fc8468a7d84a3c6e00000000000000009eb2070d7d00d04774d0fc35604e5f535c1387aa7bbfc3a3006c6f6c6f PEAP: Setting User-Name to lolo PEAP: Adding old state with f2 5a PEAP: Sending tunneled request EAP-Message = 0x0206003f1a0206003a3139cf6286a0aac740fc8468a7d84a3c6e00000000000000009eb2070d7d00d04774d0fc35604e5f535c1387aa7bbfc3a3006c6f6c6f FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "lolo" State = 0xf25ab07f3e8383d1c1a2841a813462c7 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 63 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for lolo radius_xlat: '(uid=lolo)' radius_xlat: 'dc=testing,dc=sk' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=testing,dc=sk, with filter (uid=lolo) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNTPassword as NT-Password, value 35839254E3956535CC205CE6223DF0B8 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value EF4B8C4F3BA6EA26104F64A3BCB3B38F & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user lolo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: Told to do MS-CHAPv2 for lolo with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: leaving group authenticate (returns reject) for request 6 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x8182708 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 0 to 192.168.1.1 port 2048 EAP-Message = 0x010700261900170301001b896bc9057816688fdf9d9412cb0277bdb72c744c671a1509337361 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe251e2258090dcea27f12e13f96d3f24 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.1:2048, id=0, length=168 User-Name = "lolo" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "001731e75a28" Calling-Station-Id = "0012f072663d" NAS-Identifier = "001731e75a28" NAS-Port = 41 Framed-MTU = 1400 State = 0xe251e2258090dcea27f12e13f96d3f24 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700261900170301001b331e49138a0033983e6a9de431cdb9407bfd6ad215ea22454d22c5 Message-Authenticator = 0xf8ba384f81221b23050be0469f50166c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 7 rlm_ldap: - authorize rlm_ldap: performing user authorization for lolo radius_xlat: '(uid=lolo)' radius_xlat: 'dc=testing,dc=sk' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=testing,dc=sk, with filter (uid=lolo) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaNTPassword as NT-Password, value 35839254E3956535CC205CE6223DF0B8 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value EF4B8C4F3BA6EA26104F64A3BCB3B38F & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user lolo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.1.1 port 2048 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 7 ID 0 with timestamp 485fc28b Nothing to do. Sleeping until we see a request.

2 1