On 10/08/2014 12:29 PM, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
Could someone give me advices or info why it happened? stages how eap-md5 should work in innner-tunnel? I saw http://wiki.freeradius.org/guide/EAPMD5-HOWTO but it's not enough in my scenario. radiusd -X form the start, not just the bit you feel like cheers :-)
alan ok, full radiusd -X
/Received Access-Request Id 177 from 127.0.0.1:53526 to 127.0.0.1:1812 length 152 User-Name = 'stu@sumix.com' NAS-Port-Type = Virtual Service-Type = Framed-User NAS-Port = 72 NAS-Port-Id = 'rw-eap' NAS-IP-Address = 10.20.9.12 Called-Station-Id = '10.20.9.12[4500]' Calling-Station-Id = '10.20.9.8[4500]' EAP-Message = 0x02000012017374754073756d69782e636f6d NAS-Identifier = 'strongSwan' Message-Authenticator = 0x41257dcc2d17ce493aa3b9e17e8d1171 (0) Received Access-Request packet from host 127.0.0.1 port 53526, id=177, length=152 (0) User-Name = 'stu@sumix.com' (0) NAS-Port-Type = Virtual (0) Service-Type = Framed-User (0) NAS-Port = 72 (0) NAS-Port-Id = 'rw-eap' (0) NAS-IP-Address = 10.20.9.12 (0) Called-Station-Id = '10.20.9.12[4500]' (0) Calling-Station-Id = '10.20.9.8[4500]' (0) EAP-Message = 0x02000012017374754073756d69782e636f6d (0) NAS-Identifier = 'strongSwan' (0) Message-Authenticator = 0x41257dcc2d17ce493aa3b9e17e8d1171 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) suffix : Checking for suffix after "@" (0) suffix : Looking up realm "sumix.com" for User-Name = "stu@sumix.com" (0) suffix : Found realm "sumix.com" (0) suffix : Adding Stripped-User-Name = "stu" (0) suffix : Adding Realm = "sumix.com" (0) suffix : Authentication realm is LOCAL (0) [suffix] = ok (0) eap : Peer sent code Response (2) ID 0 length 18 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) eap : Peer sent method Identity (1) (0) eap : Calling eap_ttls to process EAP data (0) eap_ttls : Flushing SSL sessions (of #0) (0) eap_ttls : Initiate (0) eap_ttls : Start returned 1 (0) eap : New EAP session, adding 'State' attribute to reply 0xb955db71b954ce9f (0) [eap] = handled (0) } # authenticate = handled (0) Sending Access-Challenge packet to host 127.0.0.1 port 53526, id=177, length=0 (0) EAP-Message = 0x010100061520 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xb955db71b954ce9f198457e8e66f50f6 Sending Access-Challenge Id 177 from 127.0.0.1:1812 to 127.0.0.1:53526 EAP-Message = 0x010100061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb955db71b954ce9f198457e8e66f50f6 (0) Finished request Waking up in 0.3 seconds. Received Access-Request Id 178 from 127.0.0.1:53526 to 127.0.0.1:1812 length 250 User-Name = 'stu@sumix.com' NAS-Port-Type = Virtual Service-Type = Framed-User NAS-Port = 72 NAS-Port-Id = 'rw-eap' NAS-IP-Address = 10.20.9.12 Called-Station-Id = '10.20.9.12[4500]' Calling-Station-Id = '10.20.9.8[4500]' EAP-Message = 0x0201006215800000005816030300530100004f0303543504e19f976a5871b17461d745bee0aa23d75a49a7d9a7b4fcdbe0158eac28000014003300670039006b0016002f003c0035003d000a01000012000d000e000c040105010601030102010101 NAS-Identifier = 'strongSwan' State = 0xb955db71b954ce9f198457e8e66f50f6 Message-Authenticator = 0x8da8b4a05292ef97b74e152d1b4d8b83 (1) Received Access-Request packet from host 127.0.0.1 port 53526, id=178, length=250 (1) User-Name = 'stu@sumix.com' (1) NAS-Port-Type = Virtual (1) Service-Type = Framed-User (1) NAS-Port = 72 (1) NAS-Port-Id = 'rw-eap' (1) NAS-IP-Address = 10.20.9.12 (1) Called-Station-Id = '10.20.9.12[4500]' (1) Calling-Station-Id = '10.20.9.8[4500]' (1) EAP-Message = 0x0201006215800000005816030300530100004f0303543504e19f976a5871b17461d745bee0aa23d75a49a7d9a7b4fcdbe0158eac28000014003300670039006b0016002f003c0035003d000a01000012000d000e000c040105010601030102010101 (1) NAS-Identifier = 'strongSwan' (1) State = 0xb955db71b954ce9f198457e8e66f50f6 (1) Message-Authenticator = 0x8da8b4a05292ef97b74e152d1b4d8b83 (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) suffix : Checking for suffix after "@" (1) suffix : Looking up realm "sumix.com" for User-Name = "stu@sumix.com" (1) suffix : Found realm "sumix.com" (1) suffix : Adding Stripped-User-Name = "stu" (1) suffix : Adding Realm = "sumix.com" (1) suffix : Authentication realm is LOCAL (1) [suffix] = ok (1) eap : Peer sent code Response (2) ID 1 length 98 (1) eap : Continuing tunnel setup (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = EAP (1) # Executing group from file /etc/raddb/sites-enabled/default (1) authenticate { (1) eap : Expiring EAP session with state 0xb955db71b954ce9f (1) eap : Finished EAP session with state 0xb955db71b954ce9f (1) eap : Previous EAP request found for state 0xb955db71b954ce9f, released from the list (1) eap : Peer sent method TTLS (21) (1) eap : EAP TTLS (21) (1) eap : Calling eap_ttls to process EAP data (1) eap_ttls : Authenticate (1) eap_ttls : processing EAP-TLS TLS Length 88 (1) eap_ttls : Length Included (1) eap_ttls : eaptls_verify returned 11 (1) eap_ttls : (other): before/accept initialization (1) eap_ttls : TLS_accept: before/accept initialization (1) eap_ttls : <<< TLS 1.0 Handshake [length 0053], ClientHello (1) eap_ttls : TLS_accept: SSLv3 read client hello A (1) eap_ttls : >>> TLS 1.0 Handshake [length 004a], ServerHello (1) eap_ttls : TLS_accept: SSLv3 write server hello A (1) eap_ttls : >>> TLS 1.0 Handshake [length 03d3], Certificate (1) eap_ttls : TLS_accept: SSLv3 write certificate A (1) eap_ttls : >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange (1) eap_ttls : TLS_accept: SSLv3 write key exchange A (1) eap_ttls : >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (1) eap_ttls : TLS_accept: SSLv3 write server done A (1) eap_ttls : TLS_accept: SSLv3 flush data (1) eap_ttls : TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode (1) eap_ttls : eaptls_process returned 13 (1) eap : New EAP session, adding 'State' attribute to reply 0xb955db71b857ce9f (1) [eap] = handled (1) } # authenticate = handled (1) Sending Access-Challenge packet to host 127.0.0.1 port 53526, id=178, length=0 (1) EAP-Message = 0x010203ec15c000000642160301004a020000460301543504e1248026fe90c4f1d4c591f06203871a3dca3d7c2abde9d88ff89ffce220ca08d8b5178eaffc349e3972b298a27b98df16b1832e503c5390ab0d4f712a6600330016030103d30b0003cf0003cc0003c9308203c5308202ada003020102020101300d06092a864886f70d0101050500308186310b3009060355040613025541310f300d06035504081306526164697573310d300b060355040713044b69657631133011060355040a130a53756d697820496e632e311c301a06092a864886f70d010901160d6161654073756d69782e636f6d312430220603550403131b53756d697820436572746966696361746520417574686f72697479301e170d3134313030333039353734355a170d3134313230323039353734355a3074310b3009060355040613025541310f300d0603550408130652616469757331133011060355040a130a53756d697820496e632e3121301f0603550403131853756d697820536572766572204365727469666963617465311c301a06092a864886f70d010901160d6161654073756d69782e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100a653008d510c3ae6faa5cae07b04988d706e8b3cbafb56659636501675bef7639fea37e28e140689aca254f066197b82 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0xb955db71b857ce9f198457e8e66f50f6 Sending Access-Challenge Id 178 from 127.0.0.1:1812 to 127.0.0.1:53526 EAP-Message = 0x010203ec15c000000642160301004a020000460301543504e1248026fe90c4f1d4c591f06203871a3dca3d7c2abde9d88ff89ffce220ca08d8b5178eaffc349e3972b298a27b98df16b1832e503c5390ab0d4f712a6600330016030103d30b0003cf0003cc0003c9308203c5308202ada003020102020101300d06092a864886f70d0101050500308186310b3009060355040613025541310f300d06035504081306526164697573310d300b060355040713044b69657631133011060355040a130a53756d697820496e632e311c301a06092a864886f70d010901160d6161654073756d69782e636f6d312430220603550403131b53756d697820436572746966696361746520417574686f72697479301e170d3134313030333039353734355a170d3134313230323039353734355a3074310b3009060355040613025541310f300d0603550408130652616469757331133011060355040a130a53756d697820496e632e3121301f0603550403131853756d697820536572766572204365727469666963617465311c301a06092a864886f70d010901160d6161654073756d69782e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100a653008d510c3ae6faa5cae07b04988d706e8b3cbafb56659636501675bef7639fea37e28e140689aca254f066197b8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb955db71b857ce9f198457e8e66f50f6 (1) Finished request Waking up in 0.2 seconds. Received Access-Request Id 179 from 127.0.0.1:53526 to 127.0.0.1:1812 length 158 User-Name = 'stu@sumix.com' NAS-Port-Type = Virtual Service-Type = Framed-User NAS-Port = 72 NAS-Port-Id = 'rw-eap' NAS-IP-Address = 10.20.9.12 Called-Station-Id = '10.20.9.12[4500]' Calling-Station-Id = '10.20.9.8[4500]' EAP-Message = 0x020200061500 NAS-Identifier = 'strongSwan' State = 0xb955db71b857ce9f198457e8e66f50f6 Message-Authenticator = 0xd836132a96421a71b12b25b882f44065 (2) Received Access-Request packet from host 127.0.0.1 port 53526, id=179, length=158 (2) User-Name = 'stu@sumix.com' (2) NAS-Port-Type = Virtual (2) Service-Type = Framed-User (2) NAS-Port = 72 (2) NAS-Port-Id = 'rw-eap' (2) NAS-IP-Address = 10.20.9.12 (2) Called-Station-Id = '10.20.9.12[4500]' (2) Calling-Station-Id = '10.20.9.8[4500]' (2) EAP-Message = 0x020200061500 (2) NAS-Identifier = 'strongSwan' (2) State = 0xb955db71b857ce9f198457e8e66f50f6 (2) Message-Authenticator = 0xd836132a96421a71b12b25b882f44065 (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) authorize { (2) suffix : Checking for suffix after "@" (2) suffix : Looking up realm "sumix.com" for User-Name = "stu@sumix.com" (2) suffix : Found realm "sumix.com" (2) suffix : Adding Stripped-User-Name = "stu" (2) suffix : Adding Realm = "sumix.com" (2) suffix : Authentication realm is LOCAL (2) [suffix] = ok (2) eap : Peer sent code Response (2) ID 2 length 6 (2) eap : Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = EAP (2) # Executing group from file /etc/raddb/sites-enabled/default (2) authenticate { (2) eap : Expiring EAP session with state 0xb955db71b857ce9f (2) eap : Finished EAP session with state 0xb955db71b857ce9f (2) eap : Previous EAP request found for state 0xb955db71b857ce9f, released from the list (2) eap : Peer sent method TTLS (21) (2) eap : EAP TTLS (21) (2) eap : Calling eap_ttls to process EAP data (2) eap_ttls : Authenticate (2) eap_ttls : processing EAP-TLS (2) eap_ttls : Received TLS ACK (2) eap_ttls : Received TLS ACK (2) eap_ttls : ACK handshake fragment handler (2) eap_ttls : eaptls_verify returned 1 (2) eap_ttls : eaptls_process returned 13 (2) eap : New EAP session, adding 'State' attribute to reply 0xb955db71bb56ce9f (2) [eap] = handled (2) } # authenticate = handled (2) Sending Access-Challenge packet to host 127.0.0.1 port 53526, id=179, length=0 (2) EAP-Message = 0x0103026a158000000642a317ffccd0776df5b7990707c6d71d5e030585c85de43d46b15139605c315ea7cf2ca3022e854a0bbb38dd9539c81dccb967b27a8e84bb0f21e80ce6ec67dd3ce528ac4044160301020d0c0002090080cc92e713074cdd998fce384c110ab6cf8d0ec5073be9131aaae92c6999d1ab5798081c90c3d16d5fc8c26ab41df81d579b89f90490f677c682316e55ff727c41155071985ba46207506faeef575064dc075d40848087a92ff39cb130829cd918ed7c1db61a5b7340b218e50859d8139cbc177b15584096baaaf6ed3154cc716b0001020080a01ca6515cfdffd22e3dca3c806c8a7efb59fd0a9572c5edd89fc49a8857d876d04789f5c735b02b544341ff15cb5a2ddbd1758071c0457fcba7ccd8dad4aeb09c9c913dbe760d40b8dc2672f4ccea49e4445c5a934da63e279778a1c301bbbaf6414e1f9bde5a410e7f6b0b589b2c3bdce079d2eb6b00aa30b7e82fe36c3ec8010057d203bb32ac0231e9e2fc97d90c8ba0a9887074b20ef7e6f24647b2a759d1e11d2d25df6e737bd29fd37f8b260231c214e0de64da92a03eca99c1f40403f0e062cf99ec25ab20a41f7449e49e1ce50fc5685471e3429ec315375556766ff304f01f1f884925e6e4b2036dd56a3a0ca35bd89f4a87d6b4da6c0f74198413e92eee6f4625a8f69d80176bd9dcfc33016a20c920a646e8 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xb955db71bb56ce9f198457e8e66f50f6 Sending Access-Challenge Id 179 from 127.0.0.1:1812 to 127.0.0.1:53526 EAP-Message = 0x0103026a158000000642a317ffccd0776df5b7990707c6d71d5e030585c85de43d46b15139605c315ea7cf2ca3022e854a0bbb38dd9539c81dccb967b27a8e84bb0f21e80ce6ec67dd3ce528ac4044160301020d0c0002090080cc92e713074cdd998fce384c110ab6cf8d0ec5073be9131aaae92c6999d1ab5798081c90c3d16d5fc8c26ab41df81d579b89f90490f677c682316e55ff727c41155071985ba46207506faeef575064dc075d40848087a92ff39cb130829cd918ed7c1db61a5b7340b218e50859d8139cbc177b15584096baaaf6ed3154cc716b0001020080a01ca6515cfdffd22e3dca3c806c8a7efb59fd0a9572c5edd89fc49a8857d876d04789f5c735b02b544341ff15cb5a2ddbd1758071c0457fcba7ccd8dad4aeb09c9c913dbe760d40b8dc2672f4ccea49e4445c5a934da63e279778a1c301bbbaf6414e1f9bde5a410e7f6b0b589b2c3bdce079d2eb6b00aa30b7e82fe36c3ec8010057d203bb32ac0231e9e2fc97d90c8ba0a9887074b20ef7e6f24647b2a759d1e11d2d25df6e737bd29fd37f8b260231c214e0de64da92a03eca99c1f40403f0e062cf99ec25ab20a41f7449e49e1ce50fc5685471e3429ec315375556766ff304f01f1f884925e6e4b2036dd56a3a0ca35bd89f4a87d6b4da6c0f74198413e92eee6f4625a8f69d80176bd9dcfc33016a20c920a646e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb955db71bb56ce9f198457e8e66f50f6 (2) Finished request Waking up in 0.2 seconds. Received Access-Request Id 180 from 127.0.0.1:53526 to 127.0.0.1:1812 length 360 User-Name = 'stu@sumix.com' NAS-Port-Type = Virtual Service-Type = Framed-User NAS-Port = 72 NAS-Port-Id = 'rw-eap' NAS-IP-Address = 10.20.9.12 Called-Station-Id = '10.20.9.12[4500]' Calling-Station-Id = '10.20.9.8[4500]' EAP-Message = 0x020300d01580000000c616030100861000008200801bbd376230baee45d7adf7ef3b8ff4125a18d8f43e3df9de7f0ecc721f3e5edb817b914d9df8d8225faa5d48c9374ed312c267b3f7be35eeead2379c94dbb5783f9067c38c65ea0b7dcaea5ca15004d65f250e9b2931f247c5980f2af6e6456845a498faa147e5783de8ae82cde42a1e266223e12fff018148473e323cd7d11114030100010116030100301a532b83c967341b29452202cc5e22a8883f2b8edb7fa17866f93bef78f59a27378085cdb4ba9f10b16a831f9d6451e2 NAS-Identifier = 'strongSwan' State = 0xb955db71bb56ce9f198457e8e66f50f6 Message-Authenticator = 0x4ca4d4427eb4a0f4fa21d953d65b6490 (3) Received Access-Request packet from host 127.0.0.1 port 53526, id=180, length=360 (3) User-Name = 'stu@sumix.com' (3) NAS-Port-Type = Virtual (3) Service-Type = Framed-User (3) NAS-Port = 72 (3) NAS-Port-Id = 'rw-eap' (3) NAS-IP-Address = 10.20.9.12 (3) Called-Station-Id = '10.20.9.12[4500]' (3) Calling-Station-Id = '10.20.9.8[4500]' (3) EAP-Message = 0x020300d01580000000c616030100861000008200801bbd376230baee45d7adf7ef3b8ff4125a18d8f43e3df9de7f0ecc721f3e5edb817b914d9df8d8225faa5d48c9374ed312c267b3f7be35eeead2379c94dbb5783f9067c38c65ea0b7dcaea5ca15004d65f250e9b2931f247c5980f2af6e6456845a498faa147e5783de8ae82cde42a1e266223e12fff018148473e323cd7d11114030100010116030100301a532b83c967341b29452202cc5e22a8883f2b8edb7fa17866f93bef78f59a27378085cdb4ba9f10b16a831f9d6451e2 (3) NAS-Identifier = 'strongSwan' (3) State = 0xb955db71bb56ce9f198457e8e66f50f6 (3) Message-Authenticator = 0x4ca4d4427eb4a0f4fa21d953d65b6490 (3) # Executing section authorize from file /etc/raddb/sites-enabled/default (3) authorize { (3) suffix : Checking for suffix after "@" (3) suffix : Looking up realm "sumix.com" for User-Name = "stu@sumix.com" (3) suffix : Found realm "sumix.com" (3) suffix : Adding Stripped-User-Name = "stu" (3) suffix : Adding Realm = "sumix.com" (3) suffix : Authentication realm is LOCAL (3) [suffix] = ok (3) eap : Peer sent code Response (2) ID 3 length 208 (3) eap : Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = EAP (3) # Executing group from file /etc/raddb/sites-enabled/default (3) authenticate { (3) eap : Expiring EAP session with state 0xb955db71bb56ce9f (3) eap : Finished EAP session with state 0xb955db71bb56ce9f (3) eap : Previous EAP request found for state 0xb955db71bb56ce9f, released from the list (3) eap : Peer sent method TTLS (21) (3) eap : EAP TTLS (21) (3) eap : Calling eap_ttls to process EAP data (3) eap_ttls : Authenticate (3) eap_ttls : processing EAP-TLS TLS Length 198 (3) eap_ttls : Length Included (3) eap_ttls : eaptls_verify returned 11 (3) eap_ttls : <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange (3) eap_ttls : TLS_accept: SSLv3 read client key exchange A (3) eap_ttls : <<< TLS 1.0 ChangeCipherSpec [length 0001] (3) eap_ttls : <<< TLS 1.0 Handshake [length 0010], Finished (3) eap_ttls : TLS_accept: SSLv3 read finished A (3) eap_ttls : >>> TLS 1.0 ChangeCipherSpec [length 0001] (3) eap_ttls : TLS_accept: SSLv3 write change cipher spec A (3) eap_ttls : >>> TLS 1.0 Handshake [length 0010], Finished (3) eap_ttls : TLS_accept: SSLv3 write finished A (3) eap_ttls : TLS_accept: SSLv3 flush data SSL: adding session ca08d8b5178eaffc349e3972b298a27b98df16b1832e503c5390ab0d4f712a66 to cache (3) eap_ttls : (other): SSL negotiation finished successfully SSL Connection Established (3) eap_ttls : eaptls_process returned 13 (3) eap : New EAP session, adding 'State' attribute to reply 0xb955db71ba51ce9f (3) [eap] = handled (3) } # authenticate = handled (3) Sending Access-Challenge packet to host 127.0.0.1 port 53526, id=180, length=0 (3) EAP-Message = 0x0104004515800000003b1403010001011603010030605b0355d43aa174d8372a38a8f8fbe4e1cc4a1c76f985aa4c1a733db1cbe6fe7049a1836fc4f4ca7a979b6bcf33d46f (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0xb955db71ba51ce9f198457e8e66f50f6 Sending Access-Challenge Id 180 from 127.0.0.1:1812 to 127.0.0.1:53526 EAP-Message = 0x0104004515800000003b1403010001011603010030605b0355d43aa174d8372a38a8f8fbe4e1cc4a1c76f985aa4c1a733db1cbe6fe7049a1836fc4f4ca7a979b6bcf33d46f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb955db71ba51ce9f198457e8e66f50f6 (3) Finished request Waking up in 0.2 seconds. Received Access-Request Id 181 from 127.0.0.1:53526 to 127.0.0.1:1812 length 231 User-Name = 'stu@sumix.com' NAS-Port-Type = Virtual Service-Type = Framed-User NAS-Port = 72 NAS-Port-Id = 'rw-eap' NAS-IP-Address = 10.20.9.12 Called-Station-Id = '10.20.9.12[4500]' Calling-Station-Id = '10.20.9.8[4500]' EAP-Message = 0x0204004f15800000004517030100405cd863f406852d3aa4401fc49c497b6ea8a891fbea3b414c2c879efa53a1f75168988f9d8fe07378a162dff2b94b19d09e6341226d0e9eb418fff84f52bc0695 NAS-Identifier = 'strongSwan' State = 0xb955db71ba51ce9f198457e8e66f50f6 Message-Authenticator = 0xceec60943d84e141d8ac64ac4fff3ab3 (4) Received Access-Request packet from host 127.0.0.1 port 53526, id=181, length=231 (4) User-Name = 'stu@sumix.com' (4) NAS-Port-Type = Virtual (4) Service-Type = Framed-User (4) NAS-Port = 72 (4) NAS-Port-Id = 'rw-eap' (4) NAS-IP-Address = 10.20.9.12 (4) Called-Station-Id = '10.20.9.12[4500]' (4) Calling-Station-Id = '10.20.9.8[4500]' (4) EAP-Message = 0x0204004f15800000004517030100405cd863f406852d3aa4401fc49c497b6ea8a891fbea3b414c2c879efa53a1f75168988f9d8fe07378a162dff2b94b19d09e6341226d0e9eb418fff84f52bc0695 (4) NAS-Identifier = 'strongSwan' (4) State = 0xb955db71ba51ce9f198457e8e66f50f6 (4) Message-Authenticator = 0xceec60943d84e141d8ac64ac4fff3ab3 (4) # Executing section authorize from file /etc/raddb/sites-enabled/default (4) authorize { (4) suffix : Checking for suffix after "@" (4) suffix : Looking up realm "sumix.com" for User-Name = "stu@sumix.com" (4) suffix : Found realm "sumix.com" (4) suffix : Adding Stripped-User-Name = "stu" (4) suffix : Adding Realm = "sumix.com" (4) suffix : Authentication realm is LOCAL (4) [suffix] = ok (4) eap : Peer sent code Response (2) ID 4 length 79 (4) eap : Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = EAP (4) # Executing group from file /etc/raddb/sites-enabled/default (4) authenticate { (4) eap : Expiring EAP session with state 0xb955db71ba51ce9f (4) eap : Finished EAP session with state 0xb955db71ba51ce9f (4) eap : Previous EAP request found for state 0xb955db71ba51ce9f, released from the list (4) eap : Peer sent method TTLS (21) (4) eap : EAP TTLS (21) (4) eap : Calling eap_ttls to process EAP data (4) eap_ttls : Authenticate (4) eap_ttls : processing EAP-TLS TLS Length 69 (4) eap_ttls : Length Included (4) eap_ttls : eaptls_verify returned 11 (4) eap_ttls : eaptls_process returned 7 (4) eap_ttls : Session established. Proceeding to decode tunneled attributes (4) eap_ttls : Got tunneled request EAP-Message = 0x02000012017374754073756d69782e636f6d (4) eap_ttls : Got tunneled identity of stu@sumix.com (4) eap_ttls : Setting default EAP type for tunneled EAP session (4) eap_ttls : Sending tunneled request (4) server inner-tunnel { (4) Request: EAP-Message = 0x02000012017374754073756d69782e636f6d User-Name = 'stu@sumix.com' (4) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (4) authorize { (4) eap : Peer sent code Response (2) ID 0 length 18 (4) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = EAP (4) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (4) authenticate { (4) eap : Peer sent method Identity (1) (4) eap : Calling eap_md5 to process EAP data (4) eap_md5 : Issuing MD5 Challenge (4) eap : New EAP session, adding 'State' attribute to reply 0x2a5805682a59014a (4) [eap] = handled (4) } # authenticate = handled (4) Reply: EAP-Message = 0x0101001604103a78132fcb2897f6a7f85e8f1359a1b8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2a5805682a59014a69aedaddefad98a4 (4) } # server inner-tunnel (4) eap_ttls : Got tunneled Access-Challenge (4) eap : New EAP session, adding 'State' attribute to reply 0xb955db71bd50ce9f (4) [eap] = handled (4) } # authenticate = handled (4) Sending Access-Challenge packet to host 127.0.0.1 port 53526, id=181, length=0 (4) EAP-Message = 0x0105004f1580000000451703010040390c24d5904b15b8b2b9c01c1b1294a8fec8aebf4f28fccd133148d410760a463a5e11077227b057c6619935cd9f9e9dcc8209f4432c7c5f1518c8f83dc9f4b5 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0xb955db71bd50ce9f198457e8e66f50f6 Sending Access-Challenge Id 181 from 127.0.0.1:1812 to 127.0.0.1:53526 EAP-Message = 0x0105004f1580000000451703010040390c24d5904b15b8b2b9c01c1b1294a8fec8aebf4f28fccd133148d410760a463a5e11077227b057c6619935cd9f9e9dcc8209f4432c7c5f1518c8f83dc9f4b5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb955db71bd50ce9f198457e8e66f50f6 (4) Finished request Waking up in 0.2 seconds. Received Access-Request Id 182 from 127.0.0.1:53526 to 127.0.0.1:1812 length 231 User-Name = 'stu@sumix.com' NAS-Port-Type = Virtual Service-Type = Framed-User NAS-Port = 72 NAS-Port-Id = 'rw-eap' NAS-IP-Address = 10.20.9.12 Called-Station-Id = '10.20.9.12[4500]' Calling-Station-Id = '10.20.9.8[4500]' EAP-Message = 0x0205004f15800000004517030100405b5acf43e5169c4f2cd97dd4dd54f7e1ba4f1280bb26034f493c6163b40ced9f291017cd305a9ca6a0725b19f534da7f64d243cb9ab6eac01f8a0de9cc179f5d NAS-Identifier = 'strongSwan' State = 0xb955db71bd50ce9f198457e8e66f50f6 Message-Authenticator = 0x6c6eafc5e75ae5bb67174d8f0c14c948 (5) Received Access-Request packet from host 127.0.0.1 port 53526, id=182, length=231 (5) User-Name = 'stu@sumix.com' (5) NAS-Port-Type = Virtual (5) Service-Type = Framed-User (5) NAS-Port = 72 (5) NAS-Port-Id = 'rw-eap' (5) NAS-IP-Address = 10.20.9.12 (5) Called-Station-Id = '10.20.9.12[4500]' (5) Calling-Station-Id = '10.20.9.8[4500]' (5) EAP-Message = 0x0205004f15800000004517030100405b5acf43e5169c4f2cd97dd4dd54f7e1ba4f1280bb26034f493c6163b40ced9f291017cd305a9ca6a0725b19f534da7f64d243cb9ab6eac01f8a0de9cc179f5d (5) NAS-Identifier = 'strongSwan' (5) State = 0xb955db71bd50ce9f198457e8e66f50f6 (5) Message-Authenticator = 0x6c6eafc5e75ae5bb67174d8f0c14c948 (5) # Executing section authorize from file /etc/raddb/sites-enabled/default (5) authorize { (5) suffix : Checking for suffix after "@" (5) suffix : Looking up realm "sumix.com" for User-Name = "stu@sumix.com" (5) suffix : Found realm "sumix.com" (5) suffix : Adding Stripped-User-Name = "stu" (5) suffix : Adding Realm = "sumix.com" (5) suffix : Authentication realm is LOCAL (5) [suffix] = ok (5) eap : Peer sent code Response (2) ID 5 length 79 (5) eap : Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = EAP (5) # Executing group from file /etc/raddb/sites-enabled/default (5) authenticate { (5) eap : Expiring EAP session with state 0x2a5805682a59014a (5) eap : Finished EAP session with state 0xb955db71bd50ce9f (5) eap : Previous EAP request found for state 0xb955db71bd50ce9f, released from the list (5) eap : Peer sent method TTLS (21) (5) eap : EAP TTLS (21) (5) eap : Calling eap_ttls to process EAP data (5) eap_ttls : Authenticate (5) eap_ttls : processing EAP-TLS TLS Length 69 (5) eap_ttls : Length Included (5) eap_ttls : eaptls_verify returned 11 (5) eap_ttls : eaptls_process returned 7 (5) eap_ttls : Session established. Proceeding to decode tunneled attributes (5) eap_ttls : Got tunneled request EAP-Message = 0x02010016041074f572db9bcb6f7cc2084efc64d87351 (5) eap_ttls : Sending tunneled request (5) server inner-tunnel { (5) Request: EAP-Message = 0x02010016041074f572db9bcb6f7cc2084efc64d87351 User-Name = 'stu@sumix.com' State = 0x2a5805682a59014a69aedaddefad98a4 (5) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (5) authorize { (5) eap : Peer sent code Response (2) ID 1 length 22 (5) eap : No EAP Start, assuming it's an on-going EAP conversation (5) [eap] = updated (5) [files] = noop (5) } # authorize = updated (5) Found Auth-Type = EAP (5) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (5) authenticate { (5) eap : Expiring EAP session with state 0x2a5805682a59014a (5) eap : Finished EAP session with state 0x2a5805682a59014a (5) eap : Previous EAP request found for state 0x2a5805682a59014a, released from the list (5) eap : Peer sent method MD5 (4) (5) eap : EAP MD5 (4) (5) eap : Calling eap_md5 to process EAP data (5) eap_md5 : Cleartext-Password is required for EAP-MD5 authentication (5) ERROR: eap : Failed continuing EAP MD5 (4) session. EAP sub-module failed (5) eap : Failed in EAP select (5) [eap] = invalid (5) } # authenticate = invalid (5) Failed to authenticate the user (5) Login incorrect (eap: Failed continuing EAP MD5 (4) session. EAP sub-module failed): [stu@sumix.com/<via Auth-Type = EAP>] (from client aae-vm port 0 via TLS tunnel) (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject : EXPAND %{User-Name} (5) attr_filter.access_reject : --> stu@sumix.com (5) attr_filter.access_reject : Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated (5) } # Post-Auth-Type REJECT = updated (5) Reply: EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 (5) } # server inner-tunnel (5) eap_ttls : Got tunneled Access-Reject SSL: Removing session ca08d8b5178eaffc349e3972b298a27b98df16b1832e503c5390ab0d4f712a66 from the cache (5) ERROR: eap : Failed continuing EAP TTLS (21) session. EAP sub-module failed (5) eap : Failed in EAP select (5) [eap] = invalid (5) } # authenticate = invalid (5) Failed to authenticate the user (5) Login incorrect (eap: Failed continuing EAP TTLS (21) session. EAP sub-module failed): [stu@sumix.com/<via Auth-Type = EAP>] (from client aae-vm port 72 cli 10.20.9.8[4500]) (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/raddb/sites-enabled/default (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject : EXPAND %{User-Name} (5) attr_filter.access_reject : --> stu@sumix.com (5) attr_filter.access_reject : Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated (5) } # Post-Auth-Type REJECT = updated (5) Delaying response for 1 seconds Waking up in 0.2 seconds. Waking up in 0.6 seconds. (5) Sending delayed response (5) Sending Access-Reject packet to host 127.0.0.1 port 53526, id=182, length=0 (5) EAP-Message = 0x04050004 (5) Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Reject Id 182 from 127.0.0.1:1812 to 127.0.0.1:53526 EAP-Message = 0x04050004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 177 with timestamp +7 (1) Cleaning up request packet ID 178 with timestamp +7 (2) Cleaning up request packet ID 179 with timestamp +7 (3) Cleaning up request packet ID 180 with timestamp +7 (4) Cleaning up request packet ID 181 with timestamp +7 (5) Cleaning up request packet ID 182 with timestamp +7 Ready to process requests /