I'll post the full log. It should be pulling from OpenLDAP. I had to censor the log in a few places, including the IP of the system I'm using to test, which I changed to 6.6.6.6 Thanks for helping me with this. FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Nov 14 2010 at 21:12:30 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "-removed-" shortname = "localhost" client 6.6.6.6 { ipaddr = 6.6.6.6 require_message_authenticator = no secret = "testing123" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/radiusd.conf exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/radiusd.conf Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/radiusd.conf expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/radiusd.conf logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/radiusd.conf pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/radiusd.conf Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/radiusd.conf mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/radiusd.conf unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/-company-.key" certificate_file = "/etc/freeradius/certs/-company-.crt" CA_file = "/etc/ssl/certs/-company-_ca.crt" private_key_password = "-removed-" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/radiusd.conf realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/radiusd.conf files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/radiusd.conf radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/radiusd.conf attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/radiusd.conf preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_ldap Module: Instantiating module "ldap" from file /etc/freeradius/radiusd.conf ldap { server = "localhost" port = 389 password = "jajol3" identity = "cn=mailnet,dc=-company-,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "ou=People,dc=-company-,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=posixAccount)" password_attribute = "userPassword" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = no } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x1d590f0 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/radiusd.conf acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/radiusd.conf detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/radiusd.conf attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 6.6.6.6 port 37880, id=0, length=119 User-Name = "test" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "70-6F-6C-69-73-68" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "rad_eap_test + eapol_test" EAP-Message = 0x020000090174657374 Message-Authenticator = 0xcfdd7846ad5afe2989a9f95268623b3a # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated ++[files] returns noop [ldap] performing user authorization for test [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> test [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=test) [ldap] expand: ou=People,dc=-company-,dc=com -> ou=People,dc=-company-,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to localhost:389, authentication 0 [ldap] bind as cn=mailnet,dc=-company-,dc=com/jajol3 to localhost:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=People,dc=-company-,dc=com, with filter (uid=test) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user test authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 6.6.6.6 port 37880 EAP-Message = 0x010100061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb8e744d2b8e6512586ca358443ebedd9 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 6.6.6.6 port 37880, id=1, length=221 User-Name = "test" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "70-6F-6C-69-73-68" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "rad_eap_test + eapol_test" EAP-Message = 0x0201005d150016030100520100004e03014fb11b438e0877f1e9c421589b99047fe00b8fc1d2d788894b86d392a0bd5b8500002600390038003500160013000a00330032002f0005000400150012000900140011000800060003020100 State = 0xb8e744d2b8e6512586ca358443ebedd9 Message-Authenticator = 0x6b1438d07991cdb0b85b80ab8a1a06f0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 93 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0052], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 04bc], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 6.6.6.6 port 37880 EAP-Message = 0x0102040015c00000070b160301002a0200002603014fb11b430b856912bddd3828f0fa48e7534ff3b94cbaca674eb93fb65d847f430000390116030104bc0b0004b80004b50004b2308204ae3082029602011a300d06092a864886f70d01010505003081a5310b30090603550406130255533111300f06035504081308496c6c696e6f69733110300e060355040713074368696361676f31193017060355040a13106f6e53686f7265204e6574776f726b73310c300a060355040b13034e4f43312830260603550403131f6f6e53686f726520436572746966696361746520417574686f726974792032311e301c06092a864886f70d010901160f6e6f EAP-Message = 0x63406f6e73686f72652e636f6d301e170d3130303531303136353130365a170d3132303530393136353130365a308193310b30090603550406130255533111300f06035504081308496c6c696e6f69733110300e060355040713074368696361676f31193017060355040a13106f6e53686f7265204e6574776f726b73310c300a060355040b13034e4f43311630140603550403140d2a2e6f6e73686f72652e636f6d311e301c06092a864886f70d010901160f6e6f63406f6e73686f72652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100bb0fbe4d48432f2a6c5755c5110fb093aed41cfe3addf51e77 EAP-Message = 0x59210a2595039824736d6964b4d927ca7deb7e3e2076143b6c1b0f599f6cc5d16c9bb2b6dab7e4b5b4566cea345d352739b0b40f41a82e17ab1438f996984d75baa4c812287eb171e9debbe5c996a325486ac26184b8b26e2e9930f6f8ecf691631eb1e3739bd95145846d8784b0131a78ab002509d47030da9359d99650613fa1e5d3f27511451b7e47c52e72a2d76d18f274f9c6f54531eb9d3bc34d73ed7daa178ba5e8460076b6e59ae33c32445d142930b5a97a6705ea95b5137e86c5a3f3f5420c527879963d9c2389ac3d4e28e6f1ec5e19b6e265d1142e495eca99fe8f1504fd76558b0203010001300d06092a864886f70d01010505000382 EAP-Message = 0x02010073d7768d817f3ea27e24f66ab7aa9d4432029343faddb79d4f7065e11b3f357f51398d4025cb897e771440b0296d7371f29157ccff12fa31a318e4804a128fd960867a0fde30e29eb679127a390625f8720243cf555128d58ff7790c510ad3a28322eb6940e73106b97553cb89efeaa0259892347bcddcaf3a679f1f29db9c861da5c0ca9080fd01f62a5198419fafa0c1f0cdb02348a06c00ae2f08d465a81f11824763806c2bb106e9b8ff5ffc9bee5da6d7b312c9d64845b24dc18546a5eae4aa7d32fdf0116aa4fea5bbbfdc61e30231867d85c5d93400f6d3d392cda0bdee6d496b6ad338f8d1df209344d96767015d1aeaf0f565d1fb31 EAP-Message = 0xd4aa0effb55cbe1d1d0855e5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb8e744d2b9e5512586ca358443ebedd9 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 6.6.6.6 port 37880, id=2, length=134 User-Name = "test" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "70-6F-6C-69-73-68" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "rad_eap_test + eapol_test" EAP-Message = 0x020200061500 State = 0xb8e744d2b9e5512586ca358443ebedd9 Message-Authenticator = 0xa88dcf7659c37f16f4089bab0fe8c06f # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 2 to 6.6.6.6 port 37880 EAP-Message = 0x0103031f15800000070b2217e0f200669ddc9ff4b9381a2b5f6f8e8d6d7c58da01b3e66eaae9ccafc14091bf368b555a6303480bd438d2ff9f134ca9e022694b8bb6af556f028cc2be02147af1cc1687503624fe5c3e387fb1f8486e5543cdd61408927ff51a8ec5ee7ad44f28d1e738daea7038e507885af3c1fb47c4d6ddbcf86a0e0d72d71f24084daf305d6b7f778882527d79956aef5d2543ddbf99c50983439fdca0c4fe19d6d30d6fbd6a96688937fafb76904f982929c65e90cb918cdaf032f90d4ec38e266af9528fb919c533c18c3a1a406a1e6b36f9329ea3cd5ab99a162f5a2d5b6a1837335673a9619212dd18518e64e7d6fed9c1a3ed EAP-Message = 0x7dbc9870af7595160301020d0c0002090080b52fb0019c41b4ded3d72c6a9619520bd617f8cd4ed4538f0042d9315427d64fb7eb73a2711a2bad495619fbeffe34a97115a8a879068961db66e311d54f7dcf99af511a270e842640696c0a81bb8dc30e820c65f56c405c5223e5fd3cde3fff6026a788d22069dd08990ddef39b51bf9ef7ca58b8a3e3177107fceeaaf61e0b000102008035296cef92e0d9986d2a65127d06352c7b7a61bc68dae0b08f1e8c81403c589f900f4710c758d5f58ca45687ed2061ea6a78c75a00ec66189138d7778bf51fea999a4bfed4abfa9e26f194060c159f1834c43dbe061411f7eec4f2ead875f38cc0e1b0ea7d83 EAP-Message = 0x7f3dfc4e70771465b62042270f9d122f06f0ece466605c6127f401008e365da2b289cd4068c45628af4f789a54ea06b3aef08164efa6e20de9414c64c1c64a139795d73394136c289769f822aebadc1e1cb637f33beaad99b48b74d69df8c1957bd2e2aeccfcf20b56bafda3df3f291968a95aa6fb86709e50ccd0ef7c29f4b0b10e8e57eecb68288cc5257922a619695cefd3f3efe44d30bf7ef1a11c756c8ae5cd4fd9eabf7d2876b4443cd8d2a90d12fe29fa35c53592d7dc52bd6219161fe2252aaec8942bf5cf1920b30421448439ee6b04bf5f821698e1d221f64cade692eeb539e59d3eb2b6a56186debb889ba8fc80afa60850d71b464fb7be EAP-Message = 0xac101dc4e4d22ea2374a85783b2881ba0982336eb488802f539f8b248b5c9916030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb8e744d2bae4512586ca358443ebedd9 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 6.6.6.6 port 37880, id=3, length=332 User-Name = "test" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "70-6F-6C-69-73-68" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "rad_eap_test + eapol_test" EAP-Message = 0x020300cc15001603010086100000820080333be0ce3b64552a01e630488fc361fbf000e2a5886bbb1affe090542631a93dd3ed36a9b5c12fca6068cd77501e5fd4572ad0df3639ede82640e00c93c2ffa835396339126239b134fc9efc1dd4a3cdf4bc2521f24c565ea87f2dcec3eb8323bbc6440c32fbd5cfa87c174e9e422980c4e01e7b331bd791d54d1b492fe59562140301000101160301003098739db445adb06b4f618257f4b93083abe461dfe8d7f074cf9c2674af87fcb6cff7b53d3a7856fce591e0d32ccd5cbb State = 0xb8e744d2bae4512586ca358443ebedd9 Message-Authenticator = 0xe9808c3761c45ed0a39aa2f5f43edfcf # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 204 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 3 to 6.6.6.6 port 37880 EAP-Message = 0x0104004515800000003b1403010001011603010030e99df1915cf1d46a4e55e9794ceaf8d5ad367374f4ffcfb68fc932314653fe0aec21c6883437b8422ffd9b7fbfc848f4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb8e744d2bbe3512586ca358443ebedd9 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 6.6.6.6 port 37880, id=4, length=240 User-Name = "test" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "70-6F-6C-69-73-68" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "rad_eap_test + eapol_test" EAP-Message = 0x02040070150017030100200efb8f893414c4d6a6ff5b39b378deb66bf4633f693d5dfd1d9b5a8efcd6c34d170301004043d02fac92995bbb9e8727814cf68bb0eccbddb77efd7b2f02fa1ed4d6ca547f88c1d927db79d0af791ac260cea141d1f0e30e9abce51cd4b260b2f74faa0c98 State = 0xb8e744d2bbe3512586ca358443ebedd9 Message-Authenticator = 0x4575c39e8df86de1d0777b9fac0ee347 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 112 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "test" User-Password = "test123" FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "test" User-Password = "test123" FreeRADIUS-Proxied-To = 127.0.0.1 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[control] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group PAP {...} [pap] login attempt with password "test123" [pap] Using CRYPT password "*" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Login incorrect (rlm_pap: CRYPT password check failed): [test] (from client 6.6.6.6 port 0 via TLS tunnel) } # server inner-tunnel [ttls] Got tunneled reply code 3 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [test] (from client 6.6.6.6 port 0 cli 70-6F-6C-69-73-68) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 4 to 6.6.6.6 port 37880 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 0 with timestamp +4 Cleaning up request 1 ID 1 with timestamp +4 Cleaning up request 2 ID 2 with timestamp +4 Cleaning up request 3 ID 3 with timestamp +4 Waking up in 1.0 seconds. Cleaning up request 4 ID 4 with timestamp +4 Ready to process requests. On Mon, May 14, 2012 at 9:29 AM, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 14/05/12 15:07, Steve Hopps wrote:
We are using the correct password. There must be something broken causing the passwords not to match. That is what I'm looking for help to determine.
Send a full debug "radiusd -X". The trimmed debug doesn't show enough info.
However, at a guess, this line:
[pap] Using CRYPT password "*"
...suggests you are pulling a password from somewhere, possibly the "/etc/passwd" file via the "unix" module. Disable that module in your FreeRADIUS config.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html