- Freeradius-Users - lists.freeradius.org

Auth-Type :- Reject in users file matches inner tunnel request but sends Access-Accept
by Michael Gorven 13 Jun '12

13 Jun '12

Hi I have setup WPA2-EAP authentication using FreeRADIUS 2.1.8 on Ubuntu 10.04.4 with an OpenLDAP backend, and can successfully authenticate using PEAP/MSCHAPv2, TTLS/MSCHAPv2 and TTLS/PAP (both via the AP and using eapol_test). I am now trying to restrict access to specific SSIDs based on the LDAP groups which users belong to. From what I can gather, I need to add appropriate rules to /etc/freeradius/users which matches the SSID/group combinations, and rejects everything else. The problem I'm having is with the default reject, not the SSID/group matching. My first attempt was this: DEFAULT Ldap-Group == "employees" DEFAULT Auth-Type := Reject But this immediately rejects the Access-Request in the outer tunnel, because the "anonymous" user is not in the "employees" group. I then modified it to this so that it only matches inner tunnel requests: DEFAULT Ldap-Group == "employees" DEFAULT FreeRADIUS-Proxied-To == "127.0.0.1" Auth-Type := Reject, Reply-Message = "User does not belong to any groups which may access this SSID." The inner tunnel Access-Request is now sent and members of the "employees" group are accepted, but non-members are not actually rejected. I see the users entry being matched, and the Reply-Message is even set, but the server responds with Access-Accept and eapol_test reports SUCCESS. Debug: rlm_ldap::ldap_groupcmp: Group employees not found or user is not a member. Info: [files] users: Matched entry DEFAULT at line 209 Info: ++[files] returns ok ... Auth: Login OK: [mgorven] (from client test port 0 cli 02-00-00-00-00-01 via TLS tunnel) Info: WARNING: Empty section. Using default return values. ... Info: [peap] Got tunneled reply code 2 Auth-Type := Reject Reply-Message = "User does not belong to any groups which may access this SSID." ... Info: [peap] Got tunneled reply RADIUS code 2 Auth-Type := Reject Reply-Message = "User does not belong to any groups which may access this SSID." ... Info: [peap] Tunneled authentication was successful. Info: [peap] SUCCESS Info: [peap] Saving tunneled attributes for later ... Sending Access-Accept of id 11 to 172.16.2.44 port 60746 Reply-Message = "User does not belong to any groups which may access this SSID." User-Name = "mgorven" eapol_test receives an Access-Accept with the Reply-Message set. RADIUS message: code=2 (Access-Accept) identifier=11 length=233 Attribute 18 (Reply-Message) length=64 Value: 'User does not belong to any groups which may access this SSID.' Attribute 1 (User-Name) length=9 Value: 'mgorven' ... SUCCESS Behaviour is the same with PEAP/MSCHAPv2 and TTLS/PAP. I tried setting copy_request_to_tunnel and use_tunneled_reply to yes in the PEAP and TTLS sections, but this didn't make a difference. How do I actually reject an inner tunnel request? Michael -- http://michael.gorven.za.net PGP Key ID 1E016BE8

3 3

Re : Re: EAP processing
by Billot 13 Jun '12

13 Jun '12

Le 12/06/12, Alan DeKok <aland(a)deployingradius.com> a écrit : > Emmanuel BILLOT wrote: > > Could you explain what is the difference between the default file and > > the inner-tunnel file in /etc/raddb/site-enabled ? > > This is documented in the comments at the top of the files. > > The "default" virtual server handles normal RADIUS traffic. However, > some EAP types set up a TLS tunnel between the PC and the RADIUS server. > The data *inside* of the TLS tunnel has to be authenticated. > > So... it's run through the "inner-tunnel" virtual server. > Hi, Ok that's what i read from you on another post. > > > > When running in debug mode, i see sometimes > > # Executing section authorize from file /etc/raddb/sites-enabled/default > > and > > sometimes > > # Executing section authorize from file > > /etc/raddb/sites-enabled/inner-tunnel > > Not "sometimes". That is a very bad way to think about it. The debug > log shows *exactly* what the server is doing. Read it slowly, it will > make sense. > Sorry i didn't use correct words. I tried to follow each line in a radiusd -X output. It begins with a a complete request, and the authorize section. Parsing each authorize mechanism, only eap doesn't return "noops". A first question : the default file says eap { return ok } EAP request comes with EAP message and is so captured by the eap authorize section, right ? It returns an update of the original request with Auth-Type = EAP I can't understand why there is then one second authorize check. > > > > Is there any docs about the complete processing of EAP authentication ? > > Nope. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

3 2

Re: Eduroam PRoblem
by Alan Buxey 13 Jun '12

13 Jun '12

radiusd -X ?? alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0

Eduroam PRoblem
by Selcuk Yazar 13 Jun '12

13 Jun '12

Hi There, we installed eduroam network at our universty, it works perfect for local users. we tested remote user in radtest command everything is fine but secureW2 conneciton does'nt work. any idea ? -- Selçuk YAZAR

1 0

RE: EAP-PEAP + Windows 7 with SSO and Password change
by CD DD 13 Jun '12

13 Jun '12

Hi Phil, >> But i got from the ntlm_auth Error 691 which are send back to client. > >Please post full debugging output i.e. run "radiusd -X" and post the >output to the list. > >Better yet, gather the debug output and READ IT carefully first, to see >if you can spot the problem. > >The MSCHAP password change code looks for the string "Password expired" >in the output of the ntlm_auth command. If your ntlm_auth is printing >something different, it'll just assume it's a regular failure. Sure, here are the Debug output: FreeRADIUS Version 3.0.0, for host x86_64-portbld-freebsd9.0, built on Jun 12 2012 at 13:31:44 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/wimax including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/attr_rewrite including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/checkval including configuration file /usr/local/etc/raddb/mods-enabled/counter including configuration file /usr/local/etc/raddb/mods-enabled/cui including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/inner-eap including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/acct_unique including configuration file /usr/local/etc/raddb/mods-enabled/ldap including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/var" sbindir = "/usr/local/sbin" logdir = "/var/log" run_dir = "/var/run/radiusd" libdir = "/usr/local/lib/freeradius-3.0.0" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client AP { ipaddr = 10.0.5.100 netmask = 32 require_message_authenticator = no secret = "**********" shortname = "AP" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/mods-enabled/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/mods-enabled/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = no require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" passchange { ntlm_auth = "/usr/local/bin/ntlm_auth --helper-protocol=ntlm-change-password-1" ntlm_auth_username = "username: %{mschap:User-Name}" ntlm_auth_domain = "nt-domain: %{mschap:NT-Domain}" } allow_retry = no retry_msg = "Re-enter (or reset) the password" } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/mods-enabled/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_pwd Module: Instantiating eap-pwd pwd { group = 19 fragment_size = 1020 server_id = "theserver(a)example.com" virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.key" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 8 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } debug: Using cached TLS configuration from previous invocation Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } debug: Using cached TLS configuration from previous invocation Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Loading virtual module acct_unique Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { detailfile = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Loading virtual module remove_reply_message_if_eap Module: Linked to module rlm_always Module: Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } Module: Loading virtual module remove_reply_message_if_eap } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 max_pps = 0 } listen { type = "acct" ipaddr = * port = 0 max_pps = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 max_pps = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy address * port 1814 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=106, length=359 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF" Acct-Session-Id = "1d01db22-000000ea" NAS-Port = 218 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AccessPoint1" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x02750015015a4f4f504c55535c6173646631323334 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0xe153ae3481cd9424c23bf36b5f175aaf (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) group authorize { (0) - entering group authorize {...} (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : EAP packet type response id 117 length 21 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) Found Auth-Type = EAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) group authenticate { (0) - entering group authenticate {...} (0) eap : EAP Identity (0) eap : processing type peap (0) peap : Flushing SSL sessions (of #0) (0) peap : Initiate (0) peap : Start returned 1 (0) [eap] = handled Sending Access-Challenge of id 106 to 10.0.5.100 port 32783 EAP-Message = 0x017600061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x233fc17e2349d8f3e83a34544ff58a3c (0) Finished request 0. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=226, length=486 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF" Acct-Session-Id = "1d01db22-000000ea" NAS-Port = 218 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AccessPoint1" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x0276008219800000007816030100730100006f03014fd73824002ede6455fb6910c0084294967e65e18410e16d52d9926c80e67e5e000018002f00350005000ac013c014c009c00a00320038001300040100002eff010001000000001500130000107a6f6f706c75735c6173646631323334000a0006000400170018000b00020100 State = 0x233fc17e2349d8f3e83a34544ff58a3c Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0xc113cc579b9a44ae6f78cc78df61fe45 (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) group authorize { (1) - entering group authorize {...} (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) eap : EAP packet type response id 118 length 130 (1) eap : Continuing tunnel setup. (1) [eap] = ok (1) Found Auth-Type = EAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) group authenticate { (1) - entering group authenticate {...} (1) eap : Request found, released from the list (1) eap : EAP/peap (1) eap : processing type peap (1) peap : processing EAP-TLS TLS Length 120 (1) peap : Length Included (1) peap : eaptls_verify returned 11 (1) peap : (other): before/accept initialization (1) peap : TLS_accept: before/accept initialization (1) peap : <<< TLS 1.0 Handshake [length 0073], ClientHello (1) peap : TLS_accept: SSLv3 read client hello A (1) peap : >>> TLS 1.0 Handshake [length 0051], ServerHello (1) peap : TLS_accept: SSLv3 write server hello A (1) peap : >>> TLS 1.0 Handshake [length 0cc5], Certificate (1) peap : TLS_accept: SSLv3 write certificate A (1) peap : >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (1) peap : TLS_accept: SSLv3 write server done A (1) peap : TLS_accept: SSLv3 flush data (1) peap : TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode (1) peap : eaptls_process returned 13 (1) peap : FR_TLS_HANDLED (1) [eap] = handled Sending Access-Challenge of id 226 to 10.0.5.100 port 32783 EAP-Message = 0x017703ec19c000000d2916030100510200004d03014fd73898ff528088986ce611991705eb5a5f001acf69d93b17f1a9fa7cab3d0e20f3ed404d9531a40bbcad0cadbad4133c4ad48296899ea27022fc32535d459cf0002f000005ff010001001603010cc50b000cc1000cbe0007aa308207a63082068ea003020102020310004e300d06092a864886f70d01010405003081a3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c0603550403 EAP-Message = 0x1315777777706b692e7765622e7a6f6f706c75732e64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e6465301e170d3132303232383039323934315a170d3135303232383039323934315a3081c3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731293027060355040a13206639323232396139633932306238656464613063346563383830643865383362310b3009060355040b130249543121301f060355040313187a7072616469757330312e7a6f6f706c75732e6c6f63616c EAP-Message = 0x3120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e646530820222300d06092a864886f70d01010105000382020f003082020a0282020100df0e40f450e8633fdc375cb76ddca4885ce8cb275601f5b5e78a0ff8f4e8f13036c27a4e3c2e503e005d11e5c19a8b535e68a015b67f15b313d88a21df7b788ce45174c0137beadfb8186928e9acc169237805e0a00ea8f8245c7d4b1d64214e368339fe807dab5cc82c235823474903f76d8e363ff25a79094959af1edf13d4b23c4f9942467ffd088f91fd7072618e9e95d6360e44ede071785ce41f0899d4abe3e8d941f728ad204ad1e48f1fd12384ab392ed048d917b361 EAP-Message = 0x77efb35d76edcf6f6bf4518c46e53186e9c8ca7560481f8a87eb9cba46f56716fcff6a05ae25a1917ca1ede18c05640b41242465118dc66de1f3f22aa77598df0f0130070b95af02502eb9dd86f087502a2ce4ddf67dc94ccb60edba0f4e92e5f9ca75e950bc89a21671430395782d6d8fb78ba77b497ab6577e673acd4b9ebda8eb638d2aa6ba89798d0adc603a765c7b109f7b204abab14831b08fe1b34be34f3e1acb92bf878644e94f5de7381e3df2647f307d9343332112b978d68b02c63658d617268e610bf337d85f0a62a2e1a7b5a8fa1261e1835101920e3b37fd4e95e3fead50a5cac3239e57541679679824eacd1aa6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x233fc17e2248d8f3e83a34544ff58a3c (1) Finished request 1. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=207, length=362 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF" Acct-Session-Id = "1d01db22-000000ea" NAS-Port = 218 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AccessPoint1" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x027700061900 State = 0x233fc17e2248d8f3e83a34544ff58a3c Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x09aba499b093fc17f1b1ad231435c1dd (2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (2) group authorize { (2) - entering group authorize {...} (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (2) suffix : No such realm "NULL" (2) [suffix] = noop (2) eap : EAP packet type response id 119 length 6 (2) eap : Continuing tunnel setup. (2) [eap] = ok (2) Found Auth-Type = EAP (2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (2) group authenticate { (2) - entering group authenticate {...} (2) eap : Request found, released from the list (2) eap : EAP/peap (2) eap : processing type peap (2) peap : processing EAP-TLS (2) peap : Received TLS ACK (2) peap : Received TLS ACK (2) peap : ACK handshake fragment handler (2) peap : eaptls_verify returned 1 (2) peap : eaptls_process returned 13 (2) peap : FR_TLS_HANDLED (2) [eap] = handled Sending Access-Challenge of id 207 to 10.0.5.100 port 32783 EAP-Message = 0x017803e81940766385383e2cde4857beed6f5d0055147b933e7daa9922162c79d246e82182b9093f71aa15acaac374d5e514c545fde8d4246e4471d9ead260e06fc5a292a62aac5911d4b904b8015bf168d6c7022f8b8b0203010001a38202bf308202bb300c0603551d130101ff04023000300e0603551d0f0101ff0404030205a0301406096086480186f84201010101ff04040302064030160603551d250101ff040c300a06082b06010505070301301d0603551d0e0416041424e274626b9d850eb8eb9fd2a5d4e4555dccc3233081d80603551d230481d03081cd8014343094169c0bc40653b5ebaf41601f3b65d91227a181a9a481a63081a331 EAP-Message = 0x0b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c06035504031315777777706b692e7765622e7a6f6f706c75732e64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e64658209008f68987367f3a4b330360603551d11042f302d82187a7072616469757330312e7a6f6f706c75732e6c6f63616c811173797361646d407a6f6f706c75732e6465301c0603551d1204153013811173797361646d407a6f6f70 EAP-Message = 0x6c75732e6465304a0603551d1f04433041303fa03da03b8639687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f696e6465782e7068703f73746167653d646c5f63726c303906096086480186f842010d042c162a5048506b692f4f70656e53534c2047656e65726174656420536572766572204365727469666963617465303206096086480186f842010204251623687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f302306096086480186f8420103041616146e735f7265766f6b655f71756572792e7068703f303d06096086480186f84201080430162e687474703a2f EAP-Message = 0x2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f706f6c6963792e68746d6c300d06092a864886f70d01010405000382010100a9926e3eab9f9ed846e4d3618ab5df744295922b7393517c86a7e9e879ae6862200092525a365845841ed019acb8401c12057b4fd132a39fdb89eed85e85beb4ec203049f8dfd9c3038bee65de5bb59962b0a77e9a4d95b99340ed94d38845b185f1483898f18272d216f4d831bfe43f02df131b8445b7417677965db6f94676b0c7337240f09fbd8fd5755e0c0fe88469f12a0b4b929dcd4327517f0cdc4327432be87207cf40f81f60d90c16d7045566b611ee90 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x233fc17e2147d8f3e83a34544ff58a3c (2) Finished request 2. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=156, length=362 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF" Acct-Session-Id = "1d01db22-000000ea" NAS-Port = 218 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AccessPoint1" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x027800061900 State = 0x233fc17e2147d8f3e83a34544ff58a3c Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x46ddf4fb8e62864d34ee09b02240cac4 (3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (3) group authorize { (3) - entering group authorize {...} (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (3) suffix : No such realm "NULL" (3) [suffix] = noop (3) eap : EAP packet type response id 120 length 6 (3) eap : Continuing tunnel setup. (3) [eap] = ok (3) Found Auth-Type = EAP (3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (3) group authenticate { (3) - entering group authenticate {...} (3) eap : Request found, released from the list (3) eap : EAP/peap (3) eap : processing type peap (3) peap : processing EAP-TLS (3) peap : Received TLS ACK (3) peap : Received TLS ACK (3) peap : ACK handshake fragment handler (3) peap : eaptls_verify returned 1 (3) peap : eaptls_process returned 13 (3) peap : FR_TLS_HANDLED (3) [eap] = handled Sending Access-Challenge of id 156 to 10.0.5.100 port 32783 EAP-Message = 0x017903e81940dd918bae3094651e2d38da6cb6470e5a5705d04419ecc02984c06dd99d858684b4ffeea1f0049440d3542eb307f94b4e343a78ad2bf5d8dff067c49eed40825295fc525c89ffe00316ab9800050e3082050a308203f2a0030201020209008f68987367f3a4b3300d06092a864886f70d01010405003081a3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c06035504031315777777706b692e7765622e7a6f6f706c75732e EAP-Message = 0x64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e6465301e170d3039303331333134323030315a170d3134303331333134323030315a3081a3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c06035504031315777777706b692e7765622e7a6f6f706c75732e64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e646530820122300d06092a864886f70d0101010500 EAP-Message = 0x0382010f003082010a0282010100b53247f132a0563881dd2cd39b014fce9dd553316e5acfad692af9121c4144dd5518fddd97459ae4c5b58dde04746615af13ce199e492269694b7a90f39a0ee2abb1222fc5b966b75f04e7d5b3ea9855bea211c5fbbfcb8f9d9059034e2af246494ba7d21812bce51f716000309a2842a43b53b3d69ded50954cf1bf0259e32410074bdd61676dac3af823013cc07fecd18329dee9a0129ae38fe37db7cf2161b1a6a313a2e48f07c80a630467dae941cfa094df8eebd542b85275f6dc776d6eb96f28b879c1f3178fcae1c8c984e8aaec01cd18c3ccdf90a9fea7a1239b605bc2c3a4092dc2551e84007d9a047359 EAP-Message = 0xf47dda3aba5d94d2785f684b8bd95603410203010001a382013d30820139300c0603551d13040530030101ff300b0603551d0f040403020106301106096086480186f8420101040403020007301d0603551d0e04160414343094169c0bc40653b5ebaf41601f3b65d91227301c0603551d1104153013811173797361646d407a6f6f706c75732e6465304a0603551d1f04433041303fa03da03b8639687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f696e6465782e7068703f73746167653d646c5f63726c304106096086480186f842010d043416325048506b692f4f70656e53 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x233fc17e2046d8f3e83a34544ff58a3c (3) Finished request 3. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=11, length=362 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF" Acct-Session-Id = "1d01db22-000000ea" NAS-Port = 218 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AccessPoint1" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x027900061900 State = 0x233fc17e2046d8f3e83a34544ff58a3c Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0xec85e36dffa4447885ebfa7cfdb60897 (4) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (4) group authorize { (4) - entering group authorize {...} (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (4) suffix : No such realm "NULL" (4) [suffix] = noop (4) eap : EAP packet type response id 121 length 6 (4) eap : Continuing tunnel setup. (4) [eap] = ok (4) Found Auth-Type = EAP (4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (4) group authenticate { (4) - entering group authenticate {...} (4) eap : Request found, released from the list (4) eap : EAP/peap (4) eap : processing type peap (4) peap : processing EAP-TLS (4) peap : Received TLS ACK (4) peap : Received TLS ACK (4) peap : ACK handshake fragment handler (4) peap : eaptls_verify returned 1 (4) peap : eaptls_process returned 13 (4) peap : FR_TLS_HANDLED (4) [eap] = handled Sending Access-Challenge of id 11 to 10.0.5.100 port 32783 EAP-Message = 0x017a01891900534c2047656e65726174656420526f6f7420436572746966696361746520417574686f72697479303d06096086480186f84201080430162e687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f706f6c6963792e68746d6c300d06092a864886f70d010104050003820101009ebc1a5dd90c801d205cb2a90c8bc3ab00db1ecb7d733632e6c5cfc033ded56fe93dc9752096ea56f194ebc980b843d7b1444b46689baea6c180997eaa77ae4b5aed2657c924a0f160b64adeef2af57df3ea220a94dd1c6571213f432e0888abc037f9ad970406d797bce1163d31c9df848258296d336f929dadd33ba7 EAP-Message = 0xad9e6bd0a8e101e4514e569f64097e12bb6e05ae9e51a4170b056570bd14a33faa584075a9dfafa8dd979d4664f76f5730953903ce77c7b4e8e2e3356ed9be221fd6f872dab6451da6950f46893af28efb6df277e22169e81884cd3abe4c464523d7622dfe93d1a5f29b2d623292eca09b3bfe84fb67b6d4749ff6b61de2971388045316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x233fc17e2745d8f3e83a34544ff58a3c (4) Finished request 4. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=248, length=952 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF" Acct-Session-Id = "1d01db22-000000ea" NAS-Port = 218 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AccessPoint1" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x027a02501980000002461603010206100002020200acca8ade0f1fd58406607d426b60e70361405ebf04154b58b5e1d1a8389c062ca456d04c9774825a8758dea005093c8bc80926b15d45e95a23b1481627470e61f7c0ef7f76ad0f93dd48d7835f5f2a362dca360d8c98a50e40f928366a67d71d740a4840f7123a5c68ef91b870b60867a0231378d22c106f6f744631722ea7dce899d39f1781eb1dcb6f1ce8ded9303f276929c073691f32271ffd931e351170f37e3dcf441d3deabc91c6d98680f713694b8d99a360a7eeeb7db12f862c6e97d7d850cce98662d4635f6e231433e11abf8bac7139653682960981c85881a10a52570aa8ed0c0af6 EAP-Message = 0xe9bcf38e1699dc72aeb83b0d9c364511450e5ea5bb4f3eabf3461249af95b2adeddaf4feb70036f8f211f65b26caf7719100a035b64e9ef74dcb0831a724d41376aaab060eae667952bdbbc6e70f3908305e9351b9f23d9e9012aa7aeed7f0e35da736fb1b587d8dc0df9f7c490c4539fc95bdb28fc39fbe965700a18cba4b216b95ae74a170aff5cb7ad7ba8f2a95e542e53027d8bc1fe12894fc7519952633fef32543972883e7a66d8a6464d3a39f66631aebba43104d2976128a39b49c1b46a4fec4a48dd56b5e225414a83ebc2efc8742a5e99cbf9b12804c6680aebe25da8104c7996ae77f7e849b8f35febd7c52d8fd894ca5cd6423ac144771 EAP-Message = 0xcee2b19e48cfb074a1da7322d2afc1a62768444cb53ecb9a13dedc1403010001011603010030641a65b0a9a884ed3878189b2f7bbd64b715575e1d9895118cbd778b57b163d03c93e0a0f7f3e2133cbae51da4f73a55 State = 0x233fc17e2745d8f3e83a34544ff58a3c Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0xc9e0e7727d36281e317a5814ab7e34b0 (5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (5) group authorize { (5) - entering group authorize {...} (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (5) suffix : No such realm "NULL" (5) [suffix] = noop (5) eap : EAP packet type response id 122 length 253 (5) eap : Continuing tunnel setup. (5) [eap] = ok (5) Found Auth-Type = EAP (5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (5) group authenticate { (5) - entering group authenticate {...} (5) eap : Request found, released from the list (5) eap : EAP/peap (5) eap : processing type peap (5) peap : processing EAP-TLS TLS Length 582 (5) peap : Length Included (5) peap : eaptls_verify returned 11 (5) peap : <<< TLS 1.0 Handshake [length 0206], ClientKeyExchange (5) peap : TLS_accept: SSLv3 read client key exchange A (5) peap : <<< TLS 1.0 ChangeCipherSpec [length 0001] (5) peap : <<< TLS 1.0 Handshake [length 0010], Finished (5) peap : TLS_accept: SSLv3 read finished A (5) peap : >>> TLS 1.0 ChangeCipherSpec [length 0001] (5) peap : TLS_accept: SSLv3 write change cipher spec A (5) peap : >>> TLS 1.0 Handshake [length 0010], Finished (5) peap : TLS_accept: SSLv3 write finished A (5) peap : TLS_accept: SSLv3 flush data SSL: adding session f3ed404d9531a40bbcad0cadbad4133c4ad48296899ea27022fc32535d459cf0 to cache (5) peap : (other): SSL negotiation finished successfully SSL Connection Established (5) peap : eaptls_process returned 13 (5) peap : FR_TLS_HANDLED (5) [eap] = handled Sending Access-Challenge of id 248 to 10.0.5.100 port 32783 EAP-Message = 0x017b004119001403010001011603010030142a567a85a52fa32a1ccb3cabd673369805c95546236721bc294226ffb35a1b72a92cc5dacf5be8944ff2f5faf613e4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x233fc17e2644d8f3e83a34544ff58a3c (5) Finished request 5. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=236, length=362 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF" Acct-Session-Id = "1d01db22-000000ea" NAS-Port = 218 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AccessPoint1" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x027b00061900 State = 0x233fc17e2644d8f3e83a34544ff58a3c Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x110a13403df450de92653db8bdea68cf (6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (6) group authorize { (6) - entering group authorize {...} (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (6) suffix : No such realm "NULL" (6) [suffix] = noop (6) eap : EAP packet type response id 123 length 6 (6) eap : Continuing tunnel setup. (6) [eap] = ok (6) Found Auth-Type = EAP (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (6) group authenticate { (6) - entering group authenticate {...} (6) eap : Request found, released from the list (6) eap : EAP/peap (6) eap : processing type peap (6) peap : processing EAP-TLS (6) peap : Received TLS ACK (6) peap : Received TLS ACK (6) peap : ACK handshake is finished (6) peap : eaptls_verify returned 3 (6) peap : eaptls_process returned 3 (6) peap : FR_TLS_SUCCESS (6) peap : Session established. Decoding tunneled attributes. (6) peap : Peap state TUNNEL ESTABLISHED (6) [eap] = handled Sending Access-Challenge of id 236 to 10.0.5.100 port 32783 EAP-Message = 0x017c002b190017030100209d8662246db6c2b5ce090091cd7608392fa5e1865ac698f0d2d8955cc3f6a56b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x233fc17e2543d8f3e83a34544ff58a3c (6) Finished request 6. Waking up in 0.1 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=36, length=415 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF" Acct-Session-Id = "1d01db22-000000ea" NAS-Port = 218 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AccessPoint1" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x027c003b1900170301003088024a1842d558d7174d7b2bb36ef45d3b11f4e252f68af7c7d1a216e2ebf6b5a3e0adb89bd232b6f8f297e69d26256e State = 0x233fc17e2543d8f3e83a34544ff58a3c Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x6ea6ff20fdce1b56c97c6ac976f3223d (7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (7) group authorize { (7) - entering group authorize {...} (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) eap : EAP packet type response id 124 length 59 (7) eap : Continuing tunnel setup. (7) [eap] = ok (7) Found Auth-Type = EAP (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (7) group authenticate { (7) - entering group authenticate {...} (7) eap : Request found, released from the list (7) eap : EAP/peap (7) eap : processing type peap (7) peap : processing EAP-TLS (7) peap : eaptls_verify returned 7 (7) peap : Done initial handshake (7) peap : eaptls_process returned 7 (7) peap : FR_TLS_OK (7) peap : Session established. Decoding tunneled attributes. (7) peap : Peap state WAITING FOR INNER IDENTITY (7) peap : Identity - TEST\user1 (7) peap : Got inner identity 'TEST\user1' (7) peap : Setting default EAP type for tunneled EAP session. (7) peap : Got tunneled request EAP-Message = 0x027c0015015a4f4f504c55535c6173646631323334 server { (7) peap : Setting User-Name to TEST\user1 Sending tunneled request EAP-Message = 0x027c0015015a4f4f504c55535c6173646631323334 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "TEST\\user1" server inner-tunnel { (7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (7) group authorize { (7) - entering group authorize {...} (7) [chap] = noop (7) [mschap] = noop (7) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) update control { (7) } # update control = noop (7) eap : EAP packet type response id 124 length 21 (7) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (7) [eap] = ok (7) Found Auth-Type = EAP (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (7) group authenticate { (7) - entering group authenticate {...} (7) eap : EAP Identity (7) eap : processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge (7) [eap] = handled } # server inner-tunnel (7) peap : Got tunneled reply code 11 EAP-Message = 0x017d002a1a017d002510ee147dab7777ab81d08e6d124679316a5a4f4f504c55535c6173646631323334 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9d9cbe589de1a4d031f1fd4ff27cd0d2 (7) peap : Got tunneled reply RADIUS code 11 EAP-Message = 0x017d002a1a017d002510ee147dab7777ab81d08e6d124679316a5a4f4f504c55535c6173646631323334 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9d9cbe589de1a4d031f1fd4ff27cd0d2 (7) peap : Got tunneled Access-Challenge (7) [eap] = handled Sending Access-Challenge of id 36 to 10.0.5.100 port 32783 EAP-Message = 0x017d004b19001703010040c66cade655df6d537e10ca7520aed7f9ca846d289258b8b60963e2133992e1294c215ed5cfb4cf73f7a60a8d098ed7cb4cd1cb1552d29063812d1762af58465e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x233fc17e2442d8f3e83a34544ff58a3c (7) Finished request 7. Waking up in 0.1 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=254, length=463 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF" Acct-Session-Id = "1d01db22-000000ea" NAS-Port = 218 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AccessPoint1" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x027d006b19001703010060af1e4b00434bd2a75f4c3ccf0d8f189e6b2896f0adc6abd84d38260ec7cad6f927bfa09a70bde000d8ec160b763b57d71a9f103ff578c251f8bb9504f8c5a2fb5a9e64f7716940c33e5ce165519490a14575dcbc91eb2896ed1a4d9759d72148 State = 0x233fc17e2442d8f3e83a34544ff58a3c Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x50a2fdf665bde54e7aeeab93fc7a9138 (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (8) group authorize { (8) - entering group authorize {...} (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (8) suffix : No such realm "NULL" (8) [suffix] = noop (8) eap : EAP packet type response id 125 length 107 (8) eap : Continuing tunnel setup. (8) [eap] = ok (8) Found Auth-Type = EAP (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) group authenticate { (8) - entering group authenticate {...} (8) eap : Request found, released from the list (8) eap : EAP/peap (8) eap : processing type peap (8) peap : processing EAP-TLS (8) peap : eaptls_verify returned 7 (8) peap : Done initial handshake (8) peap : eaptls_process returned 7 (8) peap : FR_TLS_OK (8) peap : Session established. Decoding tunneled attributes. (8) peap : Peap state phase2 (8) peap : EAP type mschapv2 (8) peap : Got tunneled request EAP-Message = 0x027d004b1a027d004631664019e4cf68c221dd4265b9f41a569e00000000000000008aacee551ce230cd14d51c517b26780d896edf4c1026c24f005a4f4f504c55535c6173646631323334 server { (8) peap : Setting User-Name to TEST\user1 Sending tunneled request EAP-Message = 0x027d004b1a027d004631664019e4cf68c221dd4265b9f41a569e00000000000000008aacee551ce230cd14d51c517b26780d896edf4c1026c24f005a4f4f504c55535c6173646631323334 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "TEST\\user1" State = 0x9d9cbe589de1a4d031f1fd4ff27cd0d2 server inner-tunnel { (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) group authorize { (8) - entering group authorize {...} (8) [chap] = noop (8) [mschap] = noop (8) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (8) suffix : No such realm "NULL" (8) [suffix] = noop (8) update control { (8) } # update control = noop (8) eap : EAP packet type response id 125 length 75 (8) eap : No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) files : users: Matched entry DEFAULT at line 205 (8) [files] = ok (8) [expiration] = noop (8) [logintime] = noop (8) [pap] = noop (8) Found Auth-Type = EAP (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) group authenticate { (8) - entering group authenticate {...} (8) eap : Request found, released from the list (8) eap : EAP/mschapv2 (8) eap : processing type mschapv2 (8) mschapv2 : # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) mschapv2 : group MS-CHAP { (8) mschapv2 : - entering group MS-CHAP {...} (8) mschap : Creating challenge hash with username: asdf1234 (8) mschap : Told to do MS-CHAPv2 for asdf1234 with NT-Password (8) mschap : expand: %{Stripped-User-Name} -> (8) mschap : ... expanding second conditional (8) mschap : expand: %{User-Name} -> TEST\user1 (8) mschap : expand: %{%{User-Name}:-None} -> TEST\user1 (8) mschap : expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=TEST\user1 (8) mschap : Creating challenge hash with username: asdf1234 (8) mschap : expand: %{mschap:Challenge} -> 77bfad378970f10a (8) mschap : expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=77bfad378970f10a (8) mschap : expand: %{mschap:NT-Response} -> 8aacee551ce230cd14d51c517b26780d896edf4c1026c24f (8) mschap : expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=8aacee551ce230cd14d51c517b26780d896edf4c1026c24f Exec-Program output: Must change password (0xc0000224) Exec-Program-Wait: plaintext: Must change password (0xc0000224) Exec-Program: returned: 1 (8) mschap : External script failed. (8) mschap : FAILED: MS-CHAP2-Response is incorrect (8) [mschap] = reject rlm_eap_mschapv2: No MS-CHAPv2-Success or MS-CHAP-Error was found. (8) eap : Handler failed in EAP/mschapv2 (8) eap : Failed in EAP select (8) [eap] = invalid (8) Failed to authenticate the user. } # server inner-tunnel (8) peap : Got tunneled reply code 3 MS-CHAP-Error = "}E=691 R=0 C=9247f7d726bf93f281dae5fe1ec145cf V=3 M=Re-enter (or reset) the password" EAP-Message = 0x047d0004 Message-Authenticator = 0x00000000000000000000000000000000 (8) peap : Got tunneled reply RADIUS code 3 MS-CHAP-Error = "}E=691 R=0 C=9247f7d726bf93f281dae5fe1ec145cf V=3 M=Re-enter (or reset) the password" EAP-Message = 0x047d0004 Message-Authenticator = 0x00000000000000000000000000000000 (8) peap : Tunneled authentication was rejected. (8) peap : FAILURE (8) [eap] = handled Sending Access-Challenge of id 254 to 10.0.5.100 port 32783 EAP-Message = 0x017e002b190017030100202710abb6cdf56f18475467e64ec4624bf711475bf2c28ef0061b7084e195e0c0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x233fc17e2b41d8f3e83a34544ff58a3c (8) Finished request 8. Waking up in 0.1 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=202, length=399 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF" Acct-Session-Id = "1d01db22-000000ea" NAS-Port = 218 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AccessPoint1" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x027e002b19001703010020ce53a51bb41f504fab4bd8b2443460e86422697ed22c2e9680d9fb4a673fa6b1 State = 0x233fc17e2b41d8f3e83a34544ff58a3c Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0xd5a792fd0f47b601d1a818f1c3fe959f (9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (9) group authorize { (9) - entering group authorize {...} (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (9) suffix : No such realm "NULL" (9) [suffix] = noop (9) eap : EAP packet type response id 126 length 43 (9) eap : Continuing tunnel setup. (9) [eap] = ok (9) Found Auth-Type = EAP (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) group authenticate { (9) - entering group authenticate {...} (9) eap : Request found, released from the list (9) eap : EAP/peap (9) eap : processing type peap (9) peap : processing EAP-TLS (9) peap : eaptls_verify returned 7 (9) peap : Done initial handshake (9) peap : eaptls_process returned 7 (9) peap : FR_TLS_OK (9) peap : Session established. Decoding tunneled attributes. (9) peap : Peap state send tlv failure (9) peap : Received EAP-TLV response. (9) peap : The users session was previously rejected: returning reject (again.) (9) peap : *** This means you need to read the PREVIOUS messages in the debug output (9) peap : *** to find out the reason why the user was rejected. (9) peap : *** Look for "reject" or "fail". Those earlier messages will tell you. (9) peap : *** what went wrong, and how to fix the problem. SSL: Removing session f3ed404d9531a40bbcad0cadbad4133c4ad48296899ea27022fc32535d459cf0 from the cache (9) eap : Handler failed in EAP/peap (9) eap : Failed in EAP select (9) [eap] = invalid (9) Failed to authenticate the user. (9) Using Post-Auth-Type Reject (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) group REJECT { (9) - entering group REJECT {...} (9) attr_filter.access_reject : expand: %{User-Name} -> TEST\user1 (9) attr_filter.access_reject : Matched entry DEFAULT at line 11 (9) [attr_filter.access_reject] = updated (9) eap : Reply already contained an EAP-Message, not inserting EAP-Failure (9) [eap] = noop (9) policy remove_reply_message_if_eap { (9) - entering policy remove_reply_message_if_eap {...} (9) ? if (reply:EAP-Message && reply:Reply-Message) (9) ? Evaluating (reply:EAP-Message ) -> TRUE (9) ? Evaluating (reply:Reply-Message) -> FALSE (9) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE (9) else else { (9) - entering else else {...} (9) [noop] = noop (9) - else else returns noop (9) - policy remove_reply_message_if_eap returns noop (9) Finished request 9. Waking up in 0.6 seconds. (9) Sending delayed reject Sending Access-Reject of id 202 to 10.0.5.100 port 32783 EAP-Message = 0x047e0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. (0) Cleaning up request packet ID 106 with timestamp +7 (1) Cleaning up request packet ID 226 with timestamp +7 (2) Cleaning up request packet ID 207 with timestamp +7 (3) Cleaning up request packet ID 156 with timestamp +7 (4) Cleaning up request packet ID 11 with timestamp +7 (5) Cleaning up request packet ID 248 with timestamp +7 (6) Cleaning up request packet ID 236 with timestamp +7 (7) Cleaning up request packet ID 36 with timestamp +7 (8) Cleaning up request packet ID 254 with timestamp +7 Waking up in 1.0 seconds. (9) Cleaning up request packet ID 202 with timestamp +7 Ready to process requests. -- NEU: FreePhone 3-fach-Flat mit kostenlosem Smartphone! Jetzt informieren: http://mobile.1und1.de/?ac=OM.PW.PW003K20328T7073a

3 2

MySQL Backend
by Rampage 13 Jun '12

13 Jun '12

Hello everyone, I need a lil advice from you FreeRADIUS gurus, as i'm having a bit of trouble in understanding the database structure from the examples and schema available on the project wiki. Let's say i successfully managed to bind freeRADIUS to mysql, i can connect it and no errors are present, i created all proper tables, and database accounts to have freeRADIUS talk to mysql. the problem is.. ok but now, which informations do i put where? i'd start from a simple example.. let's say i have the user "testuser" "cleartext-password" := "testpassword" if i add this values in the radcheck table, i can successfully authenticate testuser from my NAS. Now let's say i'd like to limit the user for using the service for only 1 hour a day. if i recall correctly there is a parameter that says: Max-Daily-Session := 3600 (seconds) but, where do i have to add this value? still to the radcheck? or radreply? or where else? i also noticed that the radacct table contains one account for each time i perform a login for the specific user, is it normal? is there a table that contains usernames in a unique manner? so that i can eventually link it to another table containing further informations about the user (name, surname etc?) sorry if i ask here but really i couldn't understand this from the wiki :( thanks in advice.

3 3

EAP processing
by Emmanuel BILLOT 12 Jun '12

12 Jun '12

Hi, Could you explain what is the difference between the default file and the inner-tunnel file in /etc/raddb/site-enabled ? When running in debug mode, i see sometimes # Executing section authorize from file /etc/raddb/sites-enabled/default and sometimes # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel Is there any docs about the complete processing of EAP authentication ? BR, -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 1

Re: EAP-PEAP + Windows 7 with SSO and Password change
by CD DD 12 Jun '12

12 Jun '12

Hi Alan, >CD DD wrote: >> Hi Alan, >> >> >> i'm sorry to bother you again. >> >> I compiled now the "GIT" version (it's the same as download version), >and i got the same results. >> >> The FR is really 3.0.0. you can see that in the debug log. >> There is no differences in the results as before i did. >> >> So what's wrong ? >> I used also a cleaned config base (remove the old, and install the git >config). But all the time the same: > > Did you read raddb/mods-available/mschap? > > It contains instructions for configuring password changes. You need >to configure the "passchange" subsection with the right paths, and then >allow retries, and give it a retry message. > > Alan DeKok. Yes, as you can see in the mschap config the passchange subsection is configured, as well as the retry and retry message. send errors are also enabled in the mschapv2 config from eap section. But i got from the ntlm_auth Error 691 which are send back to client. Normaly there must be error core 648, or not ? regards, C. -- NEU: FreePhone 3-fach-Flat mit kostenlosem Smartphone! Jetzt informieren: http://mobile.1und1.de/?ac=OM.PW.PW003K20328T7073a

2 1

EAP-PEAP/TTLS and MAC filtering
by Emmanuel BILLOT 12 Jun '12

12 Jun '12

Hi, Could you explain what is the difference between the default file and the inner-tunnel file in /etc/raddb/site-enabled ? When running in debug mode, i see sometimes # Executing section authorize from file /etc/raddb/sites-enabled/default and sometimes # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel Is there any docs about the complete processing of EAP authentication ? BR, -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

1 0

RE: EAP-PEAP + Windows 7 with SSO and Password change
by CD DD 12 Jun '12

12 Jun '12

Hi Alan, i'm sorry to bother you again. I compiled now the "GIT" version (it's the same as download version), and i got the same results. The FR is really 3.0.0. you can see that in the debug log. There is no differences in the results as before i did. So what's wrong ? I used also a cleaned config base (remove the old, and install the git config). But all the time the same: Exec-Program output: Must change password (0xc0000224) Exec-Program-Wait: plaintext: Must change password (0xc0000224) Exec-Program: returned: 1 (8) mschap : External script failed. (8) mschap : FAILED: MS-CHAP2-Response is incorrect (8) [mschap] = reject rlm_eap_mschapv2: No MS-CHAPv2-Success or MS-CHAP-Error was found. (8) eap : Handler failed in EAP/mschapv2 (8) eap : Failed in EAP select (8) [eap] = invalid (8) Failed to authenticate the user. } # server inner-tunnel (8) peap : Got tunneled reply code 3 MS-CHAP-Error = "\271E=691 R=1" EAP-Message = 0x04b90004 : : And on the Client side i get failed login, and no Password Change window ! regards, C. >> well, i downloaded the zip file, because the server did not have git protocoll allowed per firewall. > > *Your* firewall is blocking git. > > You do realize that github allows HTTP replication, right? > > There's a button labelled "HTTP" on: > >https://github.com/alandekok/freeradius-server > > Click it. > >> But i checked the git version against the zip downloaded version, and it >is the same version. > > Then you need to fix that. Release 2.1.7 does NOT have the >functionality you want. I really don't know how else to say that. It >doesn't do MS-CHAP password changes. > > Only the "master" branch has it. It should take you all of 5 minutes >to go to github and download the master branch using HTTP. > > Alan DeKok. -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

2 1