- Freeradius-Users - lists.freeradius.org

Re: EAP TLS testing using eapol_test
by Naunidh S Chadha 22 May '08

22 May '08

Hi All An update: I tried using OpenSSL version 9.8c, but got exact same issues. Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: Done initial handshake Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake [length 038d], Certificate Wed May 21 19:31:19 2008 : *Error: --> verify error:num=20:unable to get local issuer certificate* Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca Wed May 21 19:31:19 2008 : Error: TLS Alert write:fatal:unknown CA Wed May 21 19:31:19 2008 : Error: TLS_accept:error in SSLv3 read client certificate B Wed May 21 19:31:19 2008 : Error: rlm_eap: SS L error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Wed May 21 19:31:19 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Wed May 21 19:31:19 2008 : Debug: eaptls_process returned 13 On OpenSSL 9.8g, radiusd started giving segmentation fault (may be it's some conflict). I really need a breakthrough now, I don't think there is anything left that I can do now, may be use some other client or sever for my purpose :) - Naunidh ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 May 2008 20:15:06 +0530 From: "Naunidh S Chadha" <naunidh(a)gmail.com> Subject: EAP TLS testing using eapol_test To: freeradius-users(a)lists.freeradius.org Message-ID: <4b1838520805210745u1a014f31s79bad2914b8602fe(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi All I am attempting to authenticate an EAP-TLS using eapol_test tool against FreeRADIUS Version 2.0.3. >From last two days I am getting stumped by certificate issues. Currently I have the following error in my Freeradius log that seems to be the problem. Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: Done initial handshake Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake [length 038d], Certificate Wed May 21 19:31:19 2008 : *Error: --> verify error:num=20:unable to get local issuer certificate* Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca Wed May 21 19:31:19 2008 : Error: TLS Alert write:fatal:unknown CA Wed May 21 19:31:19 2008 : Error: TLS_accept:error in SSLv3 read client certificate B Wed May 21 19:31:19 2008 : Error: rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Wed May 21 19:31:19 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Wed May 21 19:31:19 2008 : Debug: eaptls_process returned 13 >From searching around the net I found that one issue could be that my SSL does not understand that server.pem is a trusted CA. To make that happen I created hashes using the following command, *ln -s client.pem `openssl x509 -hash -noout 5~-in client.pem`.0* for ca.pem/server.pem and client.pem. I then pasted the hashes and .pem files into /usr/share/ssl/certs folder too (out of desperation :) ). After this if I ran the command "openssl verify *.pem" in .../raddb/certs folder, it would return OK for all pem files. IMO this is the best to test that all certificates are in order. I also used the command "openssl verify -CApath . *.pem" (picked it up from Makefile) and it returned OK too. I must add here that my setup is totally as per the docs/config file explanations. The radiusd.conf is configured to use EAP as per the default config, and the certs are made by running the make command in raddb/certs folder. I commented out bootstrap for my exploration. I ran "make client.pem" to create client certificates. The supplicant client uses following configuration file: network={ ssid="1x-test" key_mgmt=WPA-EAP eap=TLS identity="user(a)example.com" ca_cert="/usr/local/etc/raddb/certs/ca.pem" client_cert="/usr/local/etc/raddb/certs/user(a)example.com.pem" private_key="/usr/local/etc/raddb/certs/client.key" private_key_passwd="whatever" eapol_flags=3 } Since the logs are big enough to be a torture for people reading in digest mode, I have put them at http://naunidh.googlepages.com/logs It has output of radiusd -XXX followed by logs of eapol_test tool. My OpenSSL version is 9.7a (supported by Freeradius), My next step would be to upgrade this but it does not look like an OpenSSL issue, Upgrading this would be a pain at the moment as lot of people are dependent on the setup, but this is the only recourse left from my side. Any help would be greatly appreciated. Sorry for the long mail, but I could not shorten it any more without missing something important. Thanks All - Naunidh

2 1

Freeradius and Active directory
by Tomáš Janeček 22 May '08

22 May '08

Hi. What am I trying to do: I would like to authenticate my Windows XP wireless clients against Active Directory server via Freeradius. What do I have: I'm using freeradius 1.1.6 (installed via emerge) on Gentoo, Windows XP Pro What works: [WinXP]-->[freeradius]-->[w2003server] 1.)I'm able to send requests from Windows XP to freeradius (using NTradping). (In an earlier testing phase I was able to authenticate against "radius users file") 2.)I'm able to authenticate against AD (ntlm_auth). What doesn't work: When I try to bind phase 1.) and 2.) (ie. send request from winXP to radius and let radius to authenticate against AD), it returns: ********************************************************************** rad_recv: Access-Request packet from host 1.2.3.4:1224, id=1, length=59 User-Name = "MYNTDOMAIN\\user" CHAP-Password = 0x6036fd239ead000176def7ade553072c87 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '\' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [user/<CHAP-Password>] (from client MYNETWORK port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- NTradping retunrs: Response: Access-Reject ********************************************************************* I see the problem in "No authenticate method...", but have no idea how to repair it:( Here is radiusd log: ********************************************************************* notes ~ # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/jaesrvkey.pem" tls: certificate_file = "/etc/raddb/certs/jaesrvcert.pem" tls: CA_file = "/etc/raddb/certs/jaecacert.pem" tls: private_key_password = "(null)" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel =no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = yes preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (ntdomain) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. ********************************************************************* I know there is something rotten in my configuration files, but can't find it. Thanks for any advice -- Tomáš Janeček

7 19

Re : Re : Dynamic VLAN and FreeRadius
by Joel MBA OYONE 22 May '08

22 May '08

Alan DeKok. wrote: > No. VLAN assignment is after SSID association, and after 802.1x > authentication. OK, is it possible to associate in SSID_1 and be assigned to a different VLAN than the we are associated in ? (exemple, when i am associated to SSID_1, which belongs to VLAN100, RADIUS sends me "Tunnel-Private-Group-ID = 200", which belongs to another SSID, what would happen and would authentication process success?) - if i am assigned to another couple of SSID/VLAN than the one i am connected now by RADIUS, would authentication process restart at the beginning? - is it possible to do EAP-TLS, EAP-PEAP and EAP-MD5 without the use of 802.1x when RADIUS is the authentication Server for a supplicant? thanx! List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

2 1

EAP-TTLS w/MS-CHAPv2
by Bram Matthys (Syzop) 22 May '08

22 May '08

Hi all, I'd like to use EAP-TTLS with MS-CHAP(v2), so I can use SecureW2 with Freeradius. To be more exact, I'd be using ntlm_auth, so that wireless users will be able to get on the wireless network using their usual windows username / password. I'm using FreeRadius 2.0.3. I've seen several tutorials regarding Freeradius 1, which help, but they are a bit outdated, and are often using a different authentication method or protocol (like PEAP). I'm stuck getting it to work, and it isn't even at the point of calling ntlm_auth yet (except for the first initial test, described later). I've verified ntlm_auth works on the command line. I've been following (among others) http://deployingradius.com/documents/configuration/active_directory.html which suggested to verify ntlm_auth in radius via this: exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=DOMAIN --username=%{mschap:User-Name } --password=%{User-Password}" } And adding this to the users file: Auth-Type := ntlm_auth Once this passed (i tested with radtest), I commented out both, because it was only for testing. Side note..I had set 'wait = no' previously, due to the tutorial mentioning that, but then the password was always correct even if I provided an incorrect one. I've also been reading http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO by the way, and while it did help they use PEAP (w/mschapv2) so hmm. Anyway, back on track: I've taken the default radius configuration files (as of v2.0.3), and editted them.. I hope I've pasted all relevant parts here, if not.. let me know: radiusd.conf: $INCLUDE eap.conf mschap { require_encryption = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challe nge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } I should also note that I have with_ntdomain_hack set to 'no' in preprocess{} (but to yes in mschap as pasted above), as I'll be using the realms module for that (or at least I try to). then the eap.conf: eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no ... ttls { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } } and sites-enabled/default: authorize { preprocess chap mschap ntdomain eap { ok = return } unix files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } And proxy.conf entry: realm DOMAIN { } This is what I get using the 'rad_eap_test' tool.. since i'm working remotely I cannot use securew2 at the moment (if someone has another suggestion on how to check eap ttls w/mschapv2, let me know.. it seems the radclient and radtest utils won't suffice because they don't do mschapv2): ./rad_eap_test -H 127.0.0.1 -P 1812 -S xxx -u 'DOMAIN\myuser' -p xxx -m WPA-EAP -e TTLS -v access-reject; 1 Radius log was a bit too large.. uploaded to: http://www.vulnscan.org/tmp/radius_log.txt I think this is the most relevant part: Wed May 21 15:09:43 2008 : Debug: +- entering group authorize Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 5 Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 5 Wed May 21 15:09:43 2008 : Debug: ++[preprocess] returns ok Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 5 Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 5 Wed May 21 15:09:43 2008 : Debug: ++[chap] returns noop Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 5 Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 5 Wed May 21 15:09:43 2008 : Debug: ++[mschap] returns noop Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: calling ntdomain (rlm_realm) for request 5 Wed May 21 15:09:43 2008 : Debug: rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN\myuser" Wed May 21 15:09:43 2008 : Debug: rlm_realm: Found realm "DOMAIN" Wed May 21 15:09:43 2008 : Debug: rlm_realm: Adding Stripped-User-Name = "myuser" Wed May 21 15:09:43 2008 : Debug: rlm_realm: Proxying request from user myuser to realm DOMAIN Wed May 21 15:09:43 2008 : Debug: rlm_realm: Adding Realm = "DOMAIN" Wed May 21 15:09:43 2008 : Debug: rlm_realm: Authentication realm is LOCAL. Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: returned from ntdomain (rlm_realm) for request 5 Wed May 21 15:09:43 2008 : Debug: ++[ntdomain] returns noop Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 5 Wed May 21 15:09:43 2008 : Debug: rlm_eap: EAP packet type response id 5 length 192 Wed May 21 15:09:43 2008 : Debug: rlm_eap: Continuing tunnel setup. Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 5 Wed May 21 15:09:43 2008 : Debug: ++[eap] returns ok Wed May 21 15:09:43 2008 : Debug: rad_check_password: Found Auth-Type EAP Wed May 21 15:09:43 2008 : Debug: auth: type "EAP" Wed May 21 15:09:43 2008 : Debug: +- entering group authenticate Wed May 21 15:09:43 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 5 Wed May 21 15:09:43 2008 : Debug: rlm_eap: Request found, released from the list Wed May 21 15:09:43 2008 : Debug: rlm_eap: EAP/ttls Wed May 21 15:09:43 2008 : Debug: rlm_eap: processing type ttls Wed May 21 15:09:43 2008 : Debug: rlm_eap_ttls: Authenticate Wed May 21 15:09:43 2008 : Debug: rlm_eap_tls: processing TLS Wed May 21 15:09:43 2008 : Debug: eaptls_verify returned 7 Wed May 21 15:09:43 2008 : Debug: rlm_eap_tls: Done initial handshake Wed May 21 15:09:43 2008 : Debug: eaptls_process returned 7 Wed May 21 15:09:43 2008 : Debug: rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. Wed May 21 15:09:43 2008 : Debug: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Wed May 21 15:09:43 2008 : Debug: auth: Failed to validate the user. Wed May 21 15:09:43 2008 : Auth: Login incorrect: [DOMAIN\\myuser/<no User-Password attribute>] (from client localhost port 0 cli 70-6F-6C-69-73-68) Wed May 21 15:09:43 2008 : Debug: TTLS: Got tunneled Access-Reject Wed May 21 15:09:43 2008 : Debug: rlm_eap: Handler failed in EAP/ttls Wed May 21 15:09:43 2008 : Debug: rlm_eap: Failed in EAP select Wed May 21 15:09:43 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 5 Wed May 21 15:09:43 2008 : Debug: ++[eap] returns invalid Wed May 21 15:09:43 2008 : Debug: auth: Failed to validate the user. Wed May 21 15:09:43 2008 : Auth: Login incorrect: [DOMAIN\\myuser/<via Auth-Type = EAP>] (from client localhost port 0 cli 70-6F-6C-69-73-68) Any help is very much welcomed :) Regards, Bram. -- Bram Matthys Software developer/IT consultant syzop(a)vulnscan.org PGP key: www.vulnscan.org/pubkey.asc PGP fp: 8DD4 437E 9BA8 09AA 0A8D 1811 E1C3 D65F E6ED 2AA2

2 2

How To Create Authentication Request Packet to pass as input to RADCLIENT
by Dana Blanaru 22 May '08

22 May '08

Hi, Does anyone know where can I find documentation about radclient? I am trying to figure out how to test EAP-MD5 using radclient. I want to use it to send Authentication Request packets to my AAA server where the authentication method is EAP-MD5. But I don't know how to create these packets (what attributes and values should be included). The EAP-Message attribute should be included but how do I emulate the correct value for it? Please help me with this. Thanks. Dana

2 3

Re: How To Create Authentication Request Packet to pass as input
by Naunidh S Chadha 22 May '08

22 May '08

Hi > I am trying to figure out how to test EAP-MD5 using radclient. I want to use > it to send Authentication Request packets to my AAA server where the > authentication method is EAP-MD5. I guess instead of changing rad-client use eapol_test by wpa_supplicant. It supports TTLS. _ Naunidh Message: 1 Date: Wed, 21 May 2008 12:11:17 +0200 From: "Dana Blanaru" <dana.blanaru(a)gmail.com> Subject: How To Create Authentication Request Packet to pass as input to RADCLIENT To: freeradius-users(a)lists.freeradius.org Message-ID: <cfffab400805210311qa6504eah37ac8c9b4235390f(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi, Does anyone know where can I find documentation about radclient? I am trying to figure out how to test EAP-MD5 using radclient. I want to use it to send Authentication Request packets to my AAA server where the authentication method is EAP-MD5. But I don't know how to create these packets (what attributes and values should be included). The EAP-Message attribute should be included but how do I emulate the correct value for it? Please help me with this. Thanks. Dana

2 1

FR not working with AD...
by Karthik R 22 May '08

22 May '08

I'm trying to configure freeradius2.0.3 to authenticate wireless users against AD. I followed the steps as mentioned in http://deployingradius.com/ and installation document still not working. The ntlm_auth command is success and it lists the users and groups from AD using wbinfo -u and wbinfo -g. Now i see new error message after reconfiguring freeradius server, issue with SSL. Installed CA.der certificate alone on the windows xp supplicant, i didnt generate individual client certificate as i dont want the users to be have less task to configure wireless . As per my understanding and in previous freeradius it worked this way installing root.der certificate alone and without individual supplicant certificate. I'm unable to authenticate the users against AD. can someone throw some light here. Attached the log message. snip => rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization TLS_accept: SSLv3 read client hello A TLS_accept: SSLv3 write server hello A TLS_accept: SSLv3 write certificate A TLS Alert write:fatal:handshake failure TLS_accept:error in SSLv3 write key exchange A rlm_eap: SSL error error:1409B0AC:SSL routines:SSL3_SEND_SERVER_KEY_EXCHANGE:missing tmp rsa key rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [DOMAIN\\kartthikr/<via Auth-Type = EAP>] (from client 10.20.0.0 port 60 cli 0014a526c319)

2 1

Re : Dynamic VLAN and FreeRadius
by Joel MBA OYONE 22 May '08

22 May '08

> for example, a Cisco device would want the tunnel medium type, type and > private group id Tunnel-Medium-Type = "IEEE-802" Tunnel-Type = "VLAN" Tunnel-Private-Group-Id = "100" > this would tell the NAS to put the user onto VLAN 100 So if SSID "friend" is assigned to VLAN 100, the end-user will associate with that SSID, right?? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

2 1

freeradius not working with AD
by Karthik R 21 May '08

21 May '08

I'm trying to configure freeradius to authenticate against AD for wireless users. Attached the entire log message for reference. I was able to narrow down the issue but could not fix it, can someone help me here. User-Name = "<domain\username>" NAS-IP-Address = 10.20.0.253 Called-Station-Id = "0014bf72d6be" Calling-Station-Id = "0014a526c319" NAS-Identifier = "0014bf72d6be" NAS-Port = 60 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200001301434f52505c6b6172747468696b72 Message-Authenticator = 0xbb9d83dd419b80f599579697d6b70bcd +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: No '@' in User-Name = "<domain\username>", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: Looking up realm "DOMAIN" for User-Name = "<domain\username>" rlm_realm: No such realm "DOMAIN" ++[ntdomain] returns noop ++[expiration] returns noop ++[logintime] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [<domain\\username>/<no User-Password attribute>] (from client <stripped> port 60 cli 0014a526c319) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> <domain\username> attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +55 Ready to process requests.

2 3

post-auth section entered twice?
by Martin v. Wittich 21 May '08

21 May '08

Hello, I'm trying to modify my radiusd.conf so that it will log Rejects and Accepts in a simple log that shall look like this: 2008-05-21 15:18:51 REJECT invalid.user 2008-05-21 15:19:44 ACCEPT valid.user 2008-05-21 15:25:23 ACCEPT another.user 2008-05-21 15:31:33 REJECT bad.guy To accomplish this, I've written a short shell script radius-log: #!/bin/sh echo "$(date "+%F %R:%S") $@" >> /var/log/freeradius/auth.log and two exec's in the radiusd.conf: exec log_accept { output_pairs = none wait = yes program = "/usr/lib/iserv/radius_log ACCEPT %{User-Name}" } exec log_reject { output_pairs = none wait = yes program = "/usr/lib/iserv/radius_log REJECT %{User-Name}" } Those are called in the post-auth section: post-auth { # rejected requests Post-Auth-Type REJECT { log_reject } # accepted requests log_accept } But unfortunately, post-auth seems to be entered twice, and the log looks like this: 2008-05-21 15:18:51 REJECT radius.test 2008-05-21 15:19:44 ACCEPT radius.test 2008-05-21 15:19:44 ACCEPT radius.test 2008-05-21 15:31:33 REJECT radius.test 2008-05-21 15:31:34 REJECT radius.test 2008-05-21 15:59:16 REJECT bla 2008-05-21 15:59:16 REJECT bla 2008-05-21 16:05:09 REJECT invalid.user 2008-05-21 16:05:09 REJECT invalid.user 2008-05-21 16:06:26 REJECT bad.guy 2008-05-21 16:06:26 REJECT bad.guy 2008-05-21 16:07:47 ACCEPT radius.test 2008-05-21 16:07:47 ACCEPT radius.test I thought about filtering the log through uniq before parsing it, but as line 4 and 5 show, this is not guaranteed to work. Is there any way to work around this so the log will only have one line per accepted/rejected request? The freeradius version used is the current Debian stable package, 1.1.3-3, extended by self-compiled EAP modules compiled from source. freeradius is used to authenticate Windows WLAN clients against the samba password file smbpasswd. Martin v. Wittich freeradius -X output of a session where one request was accepted, note the two lines "Exec-Program: /usr/lib/iserv/radius_log ACCEPT radius.test": Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "root" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = yes main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms listen: ipaddr = 192.168.90.13 IP address [192.168.90.13] listen: port = 0 listen: type = "auth" radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/certs/server.pem" tls: certificate_file = "/etc/freeradius/certs/server.pem" tls: CA_file = "/etc/freeradius/certs/ca.pem" tls: private_key_password = "RZOAaXWZvJ_zDwRLGMPrgn38T8g3tncZA06YjKAXMKmKCPbvAb2aN8xr1s7Lxz9y" tls: dh_file = "/etc/freeradius/certs/dh" tls: random_file = "/etc/freeradius/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "DEFAULT" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "prefix" realm: delimiter = "/" realm: ignore_default = no realm: ignore_null = yes Module: Instantiated realm (IPASS) realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = yes Module: Instantiated realm (suffix) realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = yes Module: Instantiated realm (ntdomain) realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (NULL) Module: Loaded passwd passwd: filename = "/etc/samba/smbpasswd" passwd: format = "*Stripped-User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::" passwd: authtype = "(null)" passwd: delimiter = ":" passwd: ignorenislike = no passwd: ignoreempty = yes passwd: allowmultiplekeys = no passwd: hashsize = 0 rlm_passwd: nfields: 7 keyfield 0(Stripped-User-Name) listable: no Module: Instantiated passwd (etc_smbpasswd) passwd: filename = "/etc/group" passwd: format = "~Group-Name:::*,User-Name" passwd: authtype = "(null)" passwd: delimiter = ":" passwd: ignorenislike = yes passwd: ignoreempty = yes passwd: allowmultiplekeys = yes passwd: hashsize = 0 rlm_passwd: nfields: 4 keyfield 3(User-Name) listable: yes Module: Instantiated passwd (etc_group) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded exec exec: wait = yes exec: program = "/usr/lib/iserv/radius_log REJECT %{User-Name}" exec: input_pairs = "request" exec: output_pairs = "none" exec: packet_type = "(null)" Module: Instantiated exec (log_reject) exec: wait = yes exec: program = "/usr/lib/iserv/radius_log ACCEPT %{User-Name}" exec: input_pairs = "request" exec: output_pairs = "none" exec: packet_type = "(null)" Module: Instantiated exec (log_accept) Listening on authentication 192.168.90.13:1812 Ready to process requests. rad_recv: Access-Request packet from host 192.168.90.99:3074, id=0, length=135 User-Name = "radius.test" NAS-IP-Address = 192.168.90.99 Called-Station-Id = "0018f8adf209" Calling-Station-Id = "000e351db86b" NAS-Identifier = "0018f8adf209" NAS-Port = 14 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000010017261646975732e74657374 Message-Authenticator = 0x503c8e7c3ce4585bf0aa78760ea6997f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '/' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "IPASS" returns noop for request 0 rlm_realm: No '@' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_realm: No '@' in User-Name = "radius.test", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "radius.test" rlm_realm: Proxying request from user radius.test to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "NULL" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 try to find in file rlm_passwd: Added LM-Password: '01FC5A6BE7BC6929AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: '0CB6948805F797BF2A82807973B89537' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items try to find in file modcall[authorize]: module "etc_smbpasswd" returns ok for request 0 try to find in file modcall[authorize]: module "etc_group" returns notfound for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.90.99 port 3074 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x91491508003cb277427a954d2097d76f Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.90.99:3074, id=0, length=217 User-Name = "radius.test" NAS-IP-Address = 192.168.90.99 Called-Station-Id = "0018f8adf209" Calling-Station-Id = "000e351db86b" NAS-Identifier = "0018f8adf209" NAS-Port = 14 Framed-MTU = 1400 State = 0x91491508003cb277427a954d2097d76f NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201005019800000004616030100410100003d030148342178def6efb1232d2bff6278bb1d1da5903981b502821af1dbcf0f55439d00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xc7a38a5340a37dbd72dc31047d1ec10a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '/' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "IPASS" returns noop for request 1 rlm_realm: No '@' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 1 rlm_realm: No '\' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "ntdomain" returns noop for request 1 rlm_realm: No '@' in User-Name = "radius.test", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "radius.test" rlm_realm: Proxying request from user radius.test to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "NULL" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 try to find in file rlm_passwd: Added LM-Password: '01FC5A6BE7BC6929AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: '0CB6948805F797BF2A82807973B89537' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items try to find in file modcall[authorize]: module "etc_smbpasswd" returns ok for request 1 try to find in file modcall[authorize]: module "etc_group" returns notfound for request 1 modcall[authorize]: module "files" returns notfound for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 07a0], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 0 to 192.168.90.99 port 3074 EAP-Message = 0x0102040a19c0000007fd160301004a0200004603014834216faa18dddd2f612972cfb884461bf6fbd3fb14fa5ac044c809c491a3d5208d4560b3a6142e1e8481466b8deece972ec724ea6b3dc3bba17b03fa7fcea90200040016030107a00b00079c0007990003623082035e30820246a003020102020101300d06092a864886f70d0101040500306c310b3009060355040613026465310a3008060355040813012e310a3008060355040713012e310a3008060355040a13012e3121301f06092a864886f70d0109011612726f6f7440646576322e69736572762e6575311630140603550403130d646576322e69736572762e6575301e170d30383034 EAP-Message = 0x31303134323231325a170d3039303431303134323231325a3060310b3009060355040613026465310a3008060355040813012e310a3008060355040a13012e311630140603550403130d646576322e69736572762e65753121301f06092a864886f70d0109011612726f6f7440646576322e69736572762e657530820122300d06092a864886f70d01010105000382010f003082010a0282010100dad25dca4d1f9f5c204e658b4563f45473286026aa0c3fbb1a54512f4d3565f92ef4864bc40b62844896bb61d29049902fb74ef70b4c3e112bd95f49cf4a4f51be93d51288612c5bb1f4637f14977ac99865cbcf1f8f913276c07e2f0659db7c5ce6 EAP-Message = 0xca5e4736a07cd1cdbcff45595ba3185c274fb59ed9d4649ca6be1ba5bdbef9ecc1fef98631bd416bb82580bfb8bf686fac168bafd2e0e4bdd081e730df79b57f0366fdb0b83add13844fec0faecd5c5f5911db45fdb1fc2e93fc6a5b5c6acfe5cec72cad5a1bfee550ef0ec840c0da48cac8167ddfb580ad31160296272c9ddfb6860b81f101febfe23f7f26f5bb856e91918650ecb5ed30a7b521e9c3410203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100bc4c19797581b1f7a5afaba1130946f5b362ad089907200fe70ac3c93c20a8366d2830f0a01088eedd3cf5601d EAP-Message = 0x1fa6557a780a20e8b34d43e78fd9a6e806a55b9899ef8a4ac0365f6413addbcfcf8ba221397230d8bec54455f1c7ce3ae5f48f5eb6b9456d9d8e65f33903e16b8d61ea3ded6f62129fa914164e0212a0f591c7f8ed7543493d2463706b3c526d149967489a3d049dad7a8f9a728822e96e713bca4aecda9b7878c2a1ef6cb9174e2879b425149bc8ca30f789fb92eac94ca0a492b438a0bf17c86842bf77ccbbe9881c936199ec99bc4e2ac4b1c703029d68cb19f7bd3c0f34f77a4952b0131817753e2fc0d494915412095e2d96793b363a5e0004313082042d30820315a003020102020900ab1f7a4cf1f05de8300d06092a864886f70d0101050500 EAP-Message = 0x306c310b3009060355040613026465310a3008060355 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaca6bb8087c1c2c3c5221ec30ceb2c16 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.90.99:3074, id=0, length=143 User-Name = "radius.test" NAS-IP-Address = 192.168.90.99 Called-Station-Id = "0018f8adf209" Calling-Station-Id = "000e351db86b" NAS-Identifier = "0018f8adf209" NAS-Port = 14 Framed-MTU = 1400 State = 0xaca6bb8087c1c2c3c5221ec30ceb2c16 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200061900 Message-Authenticator = 0xc2767ad82cd2b732b265bf70b277e023 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '/' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "IPASS" returns noop for request 2 rlm_realm: No '@' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 2 rlm_realm: No '\' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "ntdomain" returns noop for request 2 rlm_realm: No '@' in User-Name = "radius.test", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "radius.test" rlm_realm: Proxying request from user radius.test to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "NULL" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 try to find in file rlm_passwd: Added LM-Password: '01FC5A6BE7BC6929AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: '0CB6948805F797BF2A82807973B89537' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items try to find in file modcall[authorize]: module "etc_smbpasswd" returns ok for request 2 try to find in file modcall[authorize]: module "etc_group" returns notfound for request 2 modcall[authorize]: module "files" returns notfound for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 0 to 192.168.90.99 port 3074 EAP-Message = 0x010304031900040813012e310a3008060355040713012e310a3008060355040a13012e3121301f06092a864886f70d0109011612726f6f7440646576322e69736572762e6575311630140603550403130d646576322e69736572762e6575301e170d3038303431303134323231325a170d3038303531303134323231325a306c310b3009060355040613026465310a3008060355040813012e310a3008060355040713012e310a3008060355040a13012e3121301f06092a864886f70d0109011612726f6f7440646576322e69736572762e6575311630140603550403130d646576322e69736572762e657530820122300d06092a864886f70d010101 EAP-Message = 0x05000382010f003082010a0282010100e309c58b5da1007bd597f4500daf63671e1bf326eb20e659f4b42a0b93183e74e9a85b23b17211781dcc86d86193efe2dd6a4bc74225e1e6547ae32af02a377be57f0e51fff3924d9af0839dc3f997b2dd01bb4112536364c45e33ec225fcee553f3f9347a1486789048edc80747bc0c6ffb6006bb428e097cc2da21f052e50afcabb2102d0840fc8b8516b64c3f842ccfdd65da7f204d70dfe9752fc762965c57507b92ad5d4d286a810551e9ceb8de83c702b63e39cecee50626df3bab5474ed8132322dd504ba6c08cafd430e7b989a03332d1eb17265bfbcbaf7aea59aae6a7af98dbd3dc8510a567ae396 EAP-Message = 0x3d56b7bfce518dc8e78e79fd56b181826f7ffd0203010001a381d13081ce301d0603551d0e041604143cc663d140f71e715fb58b7bfb4ba32268dff0d730819e0603551d2304819630819380143cc663d140f71e715fb58b7bfb4ba32268dff0d7a170a46e306c310b3009060355040613026465310a3008060355040813012e310a3008060355040713012e310a3008060355040a13012e3121301f06092a864886f70d0109011612726f6f7440646576322e69736572762e6575311630140603550403130d646576322e69736572762e6575820900ab1f7a4cf1f05de8300c0603551d13040530030101ff300d06092a864886f70d01010505000382 EAP-Message = 0x0101003f09fcb47c0ba870a55464bd83e658c4b9c82d0a78da445630b099ae426cd5ce4b1b642ebe2cb23e060a48b3e6b032958477dc13e0d26b90250c2f08308905a1b0eccb48165c489269f958ecc9704c3d9c177e2dd6ee5690fa4b61e05ce9162e72d4159960d8a779184d9b4b088fd34037987ad5c0a9dc1d0c914fc5fad9f013cc5f0a5cc416159e5da53f9e26dc7e03f9a4e4fd7fd93536ba94a0b8be6497f1d54ca9f971e3f367f0d38b8b14fe5d1b3d232df9e8da30670390e52bc644bf6f1a752b11b6e0a611e2476e784ed6feeee6c8965c073192327e1d548214a35c50ccd07d4abffab79e42efe9d42442e272e5765020436e06b916df EAP-Message = 0x519efd0a44b416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3ca16efbbe60a8423fabc2a4a6a98324 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.90.99:3074, id=0, length=459 User-Name = "radius.test" NAS-IP-Address = 192.168.90.99 Called-Station-Id = "0018f8adf209" Calling-Station-Id = "000e351db86b" NAS-Identifier = "0018f8adf209" NAS-Port = 14 Framed-MTU = 1400 State = 0x3ca16efbbe60a8423fabc2a4a6a98324 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0203014019800000013616030101061000010201006c4aaebab568b3628e1071ee3dce5639e4e5cdca6877a0687137f15aaab01c91d4c9aa010b6614840fd7e6bdd5d5092777b5b3513f4d209694f2a1b939fc18d82bb4dbce461e3012a1d0c18ff6f96cbe74e020692355b56b2d36b5c613754d74f78fc45eda8d3f467d21b6c7b8ccd59254cd17662228ae843a118789e17ed6a65f3c8d2e98d65949173a9f2b547add10421b16454c8de9654dec666d1679a508325831da520e7dbc2b145bda768b043bbd8ea5b5ca16e7d08cf1e34e5cb0bb6ad89432c30eef9ae7df5eebb4589039e35f930ec4b0e66651def8b27bb8ee83496ba3184db59450ac EAP-Message = 0x27cf47bb3fd109a0ee0ae37a390d717fef827823e3ab913b1403010001011603010020681cfe49043ffb9693c7055a4c43399c542411fa5728c2e56df71e69be5b1dbd Message-Authenticator = 0xe0f1772b9ffde601e852d1e5e7a2c125 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '/' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "IPASS" returns noop for request 3 rlm_realm: No '@' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 3 rlm_realm: No '\' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "ntdomain" returns noop for request 3 rlm_realm: No '@' in User-Name = "radius.test", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "radius.test" rlm_realm: Proxying request from user radius.test to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "NULL" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 try to find in file rlm_passwd: Added LM-Password: '01FC5A6BE7BC6929AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: '0CB6948805F797BF2A82807973B89537' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items try to find in file modcall[authorize]: module "etc_smbpasswd" returns ok for request 3 try to find in file modcall[authorize]: module "etc_group" returns notfound for request 3 modcall[authorize]: module "files" returns notfound for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 0 to 192.168.90.99 port 3074 EAP-Message = 0x0104003119001403010001011603010020afc5ff95ec041dabd57928f051a048f56612d9ead2860ddadf63b7eb011aa310 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x40fbd71a1891f37fc89cf8b5f11375e4 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.90.99:3074, id=0, length=143 User-Name = "radius.test" NAS-IP-Address = 192.168.90.99 Called-Station-Id = "0018f8adf209" Calling-Station-Id = "000e351db86b" NAS-Identifier = "0018f8adf209" NAS-Port = 14 Framed-MTU = 1400 State = 0x40fbd71a1891f37fc89cf8b5f11375e4 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 Message-Authenticator = 0x89e38e6ee85c5a8ec34803cfdd00313d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '/' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "IPASS" returns noop for request 4 rlm_realm: No '@' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 4 rlm_realm: No '\' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "ntdomain" returns noop for request 4 rlm_realm: No '@' in User-Name = "radius.test", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "radius.test" rlm_realm: Proxying request from user radius.test to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "NULL" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 try to find in file rlm_passwd: Added LM-Password: '01FC5A6BE7BC6929AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: '0CB6948805F797BF2A82807973B89537' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items try to find in file modcall[authorize]: module "etc_smbpasswd" returns ok for request 4 try to find in file modcall[authorize]: module "etc_group" returns notfound for request 4 modcall[authorize]: module "files" returns notfound for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 0 to 192.168.90.99 port 3074 EAP-Message = 0x0105002019001703010015c8c468e0cda9739dceb5f453f3dfcb56ae322f6dcd Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb8321779987cf45090d58a84297fed1b Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.90.99:3074, id=0, length=176 User-Name = "radius.test" NAS-IP-Address = 192.168.90.99 Called-Station-Id = "0018f8adf209" Calling-Station-Id = "000e351db86b" NAS-Identifier = "0018f8adf209" NAS-Port = 14 Framed-MTU = 1400 State = 0xb8321779987cf45090d58a84297fed1b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500271900170301001c6d32866d9f77272f05ca4086d14341e1013e80df8fe6810217d58c9e Message-Authenticator = 0x1450903706f5678f95c3f6a913039f00 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '/' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "IPASS" returns noop for request 5 rlm_realm: No '@' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 5 rlm_realm: No '\' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "ntdomain" returns noop for request 5 rlm_realm: No '@' in User-Name = "radius.test", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "radius.test" rlm_realm: Proxying request from user radius.test to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "NULL" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 39 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 try to find in file rlm_passwd: Added LM-Password: '01FC5A6BE7BC6929AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: '0CB6948805F797BF2A82807973B89537' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items try to find in file modcall[authorize]: module "etc_smbpasswd" returns ok for request 5 try to find in file modcall[authorize]: module "etc_group" returns notfound for request 5 modcall[authorize]: module "files" returns notfound for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - radius.test rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x02050010017261646975732e74657374 PEAP: Got tunneled identity of radius.test PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to radius.test PEAP: Sending tunneled request EAP-Message = 0x02050010017261646975732e74657374 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "radius.test" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '/' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "IPASS" returns noop for request 5 rlm_realm: No '@' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 5 rlm_realm: No '\' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "ntdomain" returns noop for request 5 rlm_realm: No '@' in User-Name = "radius.test", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "radius.test" rlm_realm: Proxying request from user radius.test to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "NULL" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 try to find in file rlm_passwd: Added LM-Password: '01FC5A6BE7BC6929AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: '0CB6948805F797BF2A82807973B89537' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items try to find in file modcall[authorize]: module "etc_smbpasswd" returns ok for request 5 try to find in file modcall[authorize]: module "etc_group" returns notfound for request 5 modcall[authorize]: module "files" returns notfound for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010600251a01060020106f5ecf9995eca5dcf7830dac44edf57c7261646975732e74657374 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaf219783135a43979003d381f735eda7 PEAP: Processing from tunneled session code 0x8177458 11 EAP-Message = 0x010600251a01060020106f5ecf9995eca5dcf7830dac44edf57c7261646975732e74657374 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaf219783135a43979003d381f735eda7 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 0 to 192.168.90.99 port 3074 EAP-Message = 0x0106003c19001703010031f3762ae88cdc9a9c7d6b00ee50921fc1e19fa9b36a8a0b7f99a362f41bac2e3f2fde6b999c374ffe0c4ceae6f9d1ea7129 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2b65ba1a68bab25a22274b3370d7054b Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.90.99:3074, id=0, length=230 User-Name = "radius.test" NAS-IP-Address = 192.168.90.99 Called-Station-Id = "0018f8adf209" Calling-Station-Id = "000e351db86b" NAS-Identifier = "0018f8adf209" NAS-Port = 14 Framed-MTU = 1400 State = 0x2b65ba1a68bab25a22274b3370d7054b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0206005d19001703010052020db50d2ce3a87a83778c8a0a54944cdfa8296b000d9478846c1f77f76d9d913c90e5b217a0170e15f8654f9362a205109b7036546dc6568ce8ad11f7bae6fdfda01b7c2a67e1a00012516ac3e41b68fda1 Message-Authenticator = 0x3cbd9f44777bcb4193b39110cf81a3bb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '/' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "IPASS" returns noop for request 6 rlm_realm: No '@' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 6 rlm_realm: No '\' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "ntdomain" returns noop for request 6 rlm_realm: No '@' in User-Name = "radius.test", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "radius.test" rlm_realm: Proxying request from user radius.test to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "NULL" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 93 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 try to find in file rlm_passwd: Added LM-Password: '01FC5A6BE7BC6929AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: '0CB6948805F797BF2A82807973B89537' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items try to find in file modcall[authorize]: module "etc_smbpasswd" returns ok for request 6 try to find in file modcall[authorize]: module "etc_group" returns notfound for request 6 modcall[authorize]: module "files" returns notfound for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020600461a0206004131dcccc6474aeb98ae69bb63874a9447840000000000000000e8cc61af0b3f6d60f67763cdc0913e9f3b911907298aa424007261646975732e74657374 PEAP: Setting User-Name to radius.test PEAP: Adding old state with af 21 PEAP: Sending tunneled request EAP-Message = 0x020600461a0206004131dcccc6474aeb98ae69bb63874a9447840000000000000000e8cc61af0b3f6d60f67763cdc0913e9f3b911907298aa424007261646975732e74657374 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "radius.test" State = 0xaf219783135a43979003d381f735eda7 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '/' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "IPASS" returns noop for request 6 rlm_realm: No '@' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 6 rlm_realm: No '\' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "ntdomain" returns noop for request 6 rlm_realm: No '@' in User-Name = "radius.test", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "radius.test" rlm_realm: Proxying request from user radius.test to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "NULL" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 70 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 try to find in file rlm_passwd: Added LM-Password: '01FC5A6BE7BC6929AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: '0CB6948805F797BF2A82807973B89537' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items try to find in file modcall[authorize]: module "etc_smbpasswd" returns ok for request 6 try to find in file modcall[authorize]: module "etc_group" returns notfound for request 6 modcall[authorize]: module "files" returns notfound for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: Told to do MS-CHAPv2 for radius.test with NT-Password rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 6 modcall: leaving group MS-CHAP (returns ok) for request 6 MSCHAP Success modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 PEAP: Got tunneled reply RADIUS code 11 MS-CHAP2-Success = 0x06533d41424244314434333831363232414439393438383833333530423934313344433035413843324241 EAP-Message = 0x010700331a0306002e533d41424244314434333831363232414439393438383833333530423934313344433035413843324241 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfc028fd69bc7f8f8e458b02aa56318c0 PEAP: Processing from tunneled session code 0x8153b00 11 MS-CHAP2-Success = 0x06533d41424244314434333831363232414439393438383833333530423934313344433035413843324241 EAP-Message = 0x010700331a0306002e533d41424244314434333831363232414439393438383833333530423934313344433035413843324241 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfc028fd69bc7f8f8e458b02aa56318c0 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 0 to 192.168.90.99 port 3074 EAP-Message = 0x0107004a1900170301003f4cfb2c7590495fe0b63f51667a81688c1a47a7ea500fbdaa7d0ea4816a5f177ea7fdbcba8f125e7a3f3f32be7ef4c213d6b737c255ea7a41832ade358a800f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0d9baccbd7c88f417837920cd8da7736 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.90.99:3074, id=0, length=166 User-Name = "radius.test" NAS-IP-Address = 192.168.90.99 Called-Station-Id = "0018f8adf209" Calling-Station-Id = "000e351db86b" NAS-Identifier = "0018f8adf209" NAS-Port = 14 Framed-MTU = 1400 State = 0x0d9baccbd7c88f417837920cd8da7736 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0207001d1900170301001265ee22ebd957f0b698f64b1645f50be02753 Message-Authenticator = 0x9f2bb54bc99aef6bda5f662f6d15cf9f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '/' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "IPASS" returns noop for request 7 rlm_realm: No '@' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 7 rlm_realm: No '\' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "ntdomain" returns noop for request 7 rlm_realm: No '@' in User-Name = "radius.test", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "radius.test" rlm_realm: Proxying request from user radius.test to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "NULL" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 29 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 try to find in file rlm_passwd: Added LM-Password: '01FC5A6BE7BC6929AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: '0CB6948805F797BF2A82807973B89537' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items try to find in file modcall[authorize]: module "etc_smbpasswd" returns ok for request 7 try to find in file modcall[authorize]: module "etc_group" returns notfound for request 7 modcall[authorize]: module "files" returns notfound for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020700061a03 PEAP: Setting User-Name to radius.test PEAP: Adding old state with fc 02 PEAP: Sending tunneled request EAP-Message = 0x020700061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "radius.test" State = 0xfc028fd69bc7f8f8e458b02aa56318c0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '/' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "IPASS" returns noop for request 7 rlm_realm: No '@' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 7 rlm_realm: No '\' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "ntdomain" returns noop for request 7 rlm_realm: No '@' in User-Name = "radius.test", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "radius.test" rlm_realm: Proxying request from user radius.test to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "NULL" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 try to find in file rlm_passwd: Added LM-Password: '01FC5A6BE7BC6929AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: '0CB6948805F797BF2A82807973B89537' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items try to find in file modcall[authorize]: module "etc_smbpasswd" returns ok for request 7 try to find in file modcall[authorize]: module "etc_group" returns notfound for request 7 modcall[authorize]: module "files" returns notfound for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 7 modcall: leaving group authenticate (returns ok) for request 7 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 7 radius_xlat: '/usr/lib/iserv/radius_log ACCEPT radius.test' Exec-Program: /usr/lib/iserv/radius_log ACCEPT radius.test Exec-Program output: Exec-Program: returned: 0 modcall[post-auth]: module "log_accept" returns ok for request 7 modcall: leaving group post-auth (returns ok) for request 7 PEAP: Got tunneled reply RADIUS code 2 EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "radius.test" PEAP: Processing from tunneled session code 0x8177418 2 EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "radius.test" PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 0 to 192.168.90.99 port 3074 EAP-Message = 0x010800261900170301001b0ae1277a8dedb36bf8fa165654e128f46211a9dcaf2e81fa13f540 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9acdc78327e4cad45fadfe002171570e Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.90.99:3074, id=0, length=175 User-Name = "radius.test" NAS-IP-Address = 192.168.90.99 Called-Station-Id = "0018f8adf209" Calling-Station-Id = "000e351db86b" NAS-Identifier = "0018f8adf209" NAS-Port = 14 Framed-MTU = 1400 State = 0x9acdc78327e4cad45fadfe002171570e NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020800261900170301001bb9555e83c543a8d937051e34c4c534642a098890e77ca712ecf9da Message-Authenticator = 0xb76555f2125e8eb614045e9531545afd Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '/' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "IPASS" returns noop for request 8 rlm_realm: No '@' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 8 rlm_realm: No '\' in User-Name = "radius.test", skipping NULL due to config. modcall[authorize]: module "ntdomain" returns noop for request 8 rlm_realm: No '@' in User-Name = "radius.test", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "radius.test" rlm_realm: Proxying request from user radius.test to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "NULL" returns noop for request 8 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 try to find in file rlm_passwd: Added LM-Password: '01FC5A6BE7BC6929AAD3B435B51404EE' to config_items rlm_passwd: Added NT-Password: '0CB6948805F797BF2A82807973B89537' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[U ]' to config_items try to find in file modcall[authorize]: module "etc_smbpasswd" returns ok for request 8 try to find in file modcall[authorize]: module "etc_group" returns notfound for request 8 modcall[authorize]: module "files" returns notfound for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 8 modcall: leaving group authenticate (returns ok) for request 8 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 8 radius_xlat: '/usr/lib/iserv/radius_log ACCEPT radius.test' Exec-Program: /usr/lib/iserv/radius_log ACCEPT radius.test Exec-Program output: Exec-Program: returned: 0 modcall[post-auth]: module "log_accept" returns ok for request 8 modcall: leaving group post-auth (returns ok) for request 8 Sending Access-Accept of id 0 to 192.168.90.99 port 3074 MS-MPPE-Recv-Key = 0x78dc21b97545abd7c2ada43aa9ec6d177c9f4f4ca7bbe148b58e4341a64f0964 MS-MPPE-Send-Key = 0xc5e108121867476527cdda209f357f9bbdef022f54ed47ac83a204b331818375 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "radius.test" Finished request 8 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 8 ID 0 with timestamp 48342170 Nothing to do. Sleeping until we see a request.

3 2