Some help with etc_smbpasswd auth and eap ttls

7 Jan 2009

      Trying to configure eap ttls with mschapv2 using Freeradius version 
Version 1.1.3 in Redhat enterprise Linux 5.

I have configured everything and gotten free radius to authenticate off 
/etc/samba/smbpasswd via the etc_smbpasswd module. The problem I have 
run into is when I switch the securew2 windows xp eap-ttls client to use 
the current logged on user credentials. Then, SecureW2 sends the 
username in the format of DOMAIN/user (which in this case is HTN/josh). 
Authentication then fails because of this extra domain part in the user. 
Ok fine, I first enable the nt_domain_hack in the mschap module then I 
configured realm ntdomain and simply set a default realm in proxy.conf 
to strip off the domain part. Nope, that fails (output will be included 
below). I also tried nostrip but that also fails obviously. Also tried 
silently stripping the domain in pre-process in radiusd.conf. Auth is 
successful but finally rejected because the user doesnt match the 
original HTN/josh user sent.

Finally I simply added the username and password I was testing to the 
users file. It works there. My default realm strips the domain, proxies 
it back to localhost, authenticates of the users file and is successful. 
Arrg what Im I doing wrong. I really need to use the etc_smbpasswd 
module as I cant get ntlm_auth to work. It says no logon servers found. 
I think its because I am running it on the actual samba server I want to 
auth off of.

Anyways, anyone know of how to get etc_smbpasswd module to work. I dont 
want to use the users file (blech) even though it does work when I put 
the user in there, and again, if I just supply the username and password 
(and leave the domain part blank in SecureW2 ttls client) authentication 
does work of /etc/samba/smbpasswd.

Here is the /usr/sbin/radiusd -X output. Sorry its long. Below that I 
will put the relevant lines of config. Thanks a ton for any help. -Josh

[root@file raddb]# /usr/sbin/radiusd -s -X
Starting - reading configuration files ...
reread_config:  reading radiusd.conf
Config:   including file: /etc/raddb/proxy.conf
Config:   including file: /etc/raddb/clients.conf
Config:   including file: /etc/raddb/snmp.conf
Config:   including file: /etc/raddb/eap.conf
 main: prefix = "/usr"
 main: localstatedir = "/var"
 main: logdir = "/var/log/radius"
 main: libdir = "/usr/lib"
 main: radacctdir = "/var/log/radius/radacct"
 main: hostname_lookups = no
 main: snmp = no
 main: max_request_time = 30
 main: cleanup_delay = 5
 main: max_requests = 1024
 main: delete_blocked_requests = 0
 main: port = 0
 main: allow_core_dumps = no
 main: log_stripped_names = no
 main: log_file = "/var/log/radius/radius.log"
 main: log_auth = no
 main: log_auth_badpass = no
 main: log_auth_goodpass = no
 main: pidfile = "/var/run/radiusd/radiusd.pid"
 main: user = "(null)"
 main: group = "(null)"
 main: usercollide = no
 main: lower_user = "no"
 main: lower_pass = "no"
 main: nospace_user = "no"
 main: nospace_pass = "no"
 main: checkrad = "/usr/sbin/checkrad"
 main: proxy_requests = yes
 proxy: retry_delay = 5
 proxy: retry_count = 3
 proxy: synchronous = no
 proxy: default_fallback = yes
 proxy: dead_time = 120
 proxy: post_proxy_authorize = no
 proxy: wake_all_if_all_dead = no
 security: max_attributes = 200
 security: reject_delay = 1
 security: status_server = no
 main: debug_level = 0
read_config_files:  reading dictionary
read_config_files:  reading naslist
Using deprecated naslist file.  Support for this will go away soon.
read_config_files:  reading clients
read_config_files:  reading realms
radiusd:  entering modules setup
Module: Library search path is /usr/lib
Module: Loaded exec
 exec: wait = yes
 exec: program = "(null)"
 exec: input_pairs = "request"
 exec: output_pairs = "(null)"
 exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded PAP
 pap: encryption_scheme = "crypt"
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded MS-CHAP
 mschap: use_mppe = yes
 mschap: require_encryption = yes
 mschap: require_strong = no
 mschap: with_ntdomain_hack = yes
 mschap: passwd = "(null)"
 mschap: ntlm_auth = "(null)"
Module: Instantiated mschap (mschap)
Module: Loaded System
 unix: cache = no
 unix: passwd = "(null)"
 unix: shadow = "/etc/shadow"
 unix: group = "(null)"
 unix: radwtmp = "/var/log/radius/radwtmp"
 unix: usegroup = no
 unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded eap
 eap: default_eap_type = "ttls"
 eap: timer_expire = 60
 eap: ignore_unknown_eap_types = no
 eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
 gtc: challenge = "Password: "
 gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
 tls: rsa_key_exchange = no
 tls: dh_key_exchange = yes
 tls: rsa_key_length = 512
 tls: dh_key_length = 512
 tls: verify_depth = 0
 tls: CA_path = "(null)"
 tls: pem_file_type = yes
 tls: private_key_file = "/etc/raddb/certs/server_key.pem"
 tls: certificate_file = "/etc/raddb/certs/server_cert.pem"
 tls: CA_file = "/etc/raddb/certs/cacert.pem"
 tls: private_key_password = "serverH08ght0n23kip"
 tls: dh_file = "/etc/raddb/certs/dh"
 tls: random_file = "/etc/raddb/certs/random"
 tls: fragment_size = 1024
 tls: include_length = yes
 tls: check_crl = no
 tls: check_cert_cn = "(null)"
 tls: cipher_list = "(null)"
 tls: check_cert_issuer = "(null)"
rlm_eap_tls: Loading the certificate file as a chain
rlm_eap: Loaded and initialized type tls
 ttls: default_eap_type = "mschapv2"
 ttls: copy_request_to_tunnel = no
 ttls: use_tunneled_reply = no
rlm_eap: Loaded and initialized type ttls
 peap: default_eap_type = "mschapv2"
 peap: copy_request_to_tunnel = no
 peap: use_tunneled_reply = no
 peap: proxy_tunneled_request_as_eap = yes
rlm_eap: Loaded and initialized type peap
 mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
 preprocess: huntgroups = "/etc/raddb/huntgroups"
 preprocess: hints = "/etc/raddb/hints"
 preprocess: with_ascend_hack = no
 preprocess: ascend_channels_per_line = 23
 preprocess: with_ntdomain_hack = no
 preprocess: with_specialix_jetstream_hack = no
 preprocess: with_cisco_vsa_hack = no
 preprocess: with_alvarion_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
 realm: format = "suffix"
 realm: delimiter = "@"
 realm: ignore_default = no
 realm: ignore_null = yes
Module: Instantiated realm (suffix)
 realm: format = "prefix"
 realm: delimiter = "\"
 realm: ignore_default = no
 realm: ignore_null = yes
Module: Instantiated realm (ntdomain)
Module: Loaded passwd
 passwd: filename = "/etc/samba/smbpasswd"
 passwd: format = 
"*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::"
 passwd: authtype = "MS-CHAP"
 passwd: delimiter = ":"
 passwd: ignorenislike = no
 passwd: ignoreempty = yes
 passwd: allowmultiplekeys = no
 passwd: hashsize = 100
rlm_passwd: nfields: 7 keyfield 0(User-Name) listable: no
Module: Instantiated passwd (etc_smbpasswd)
 passwd: filename = "/etc/group"
 passwd: format = "=Group-Name:::*,User-Name"
 passwd: authtype = "(null)"
 passwd: delimiter = ":"
 passwd: ignorenislike = yes
 passwd: ignoreempty = yes
 passwd: allowmultiplekeys = yes
 passwd: hashsize = 50
rlm_passwd: nfields: 4 keyfield 3(User-Name) listable: yes
Module: Instantiated passwd (etc_group)
Module: Loaded files
 files: usersfile = "/etc/raddb/users"
 files: acctusersfile = "/etc/raddb/acct_users"
 files: preproxy_usersfile = "/etc/raddb/preproxy_users"
 files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
 acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, 
Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
 detail: detailfile = 
"/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
 detail: detailperm = 384
 detail: dirperm = 493
 detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
 radutmp: filename = "/var/log/radius/radutmp"
 radutmp: username = "%{User-Name}"
 radutmp: case_sensitive = yes
 radutmp: check_with_nas = yes
 radutmp: perm = 384
 radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.
rad_recv: Access-Request packet from host 10.100.13.12:19527, id=104, 
length=202
    User-Name = "HTN\\josh"
    Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff"
    Calling-Station-Id = "00-0E-35-B6-74-AF"
    NAS-Port = 1
    NAS-Port-Type = Wireless-802.11
    Framed-MTU = 1400
    Service-Type = Framed-User
    NAS-IP-Address = 10.100.13.12
    NAS-Identifier = "Houghton Wireless Services"
    NAS-Port-Id = "HTNStaff"
    Connect-Info = "CONNECT 54Mbps 802.11g"
    EAP-Message = 0x0201000d0148544e5c6a6f7368
    Message-Authenticator = 0xdf195f238143503d49244d6203620b10
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
  modcall[authorize]: module "preprocess" returns ok for request 0
  modcall[authorize]: module "chap" returns noop for request 0
    rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to 
config.
  modcall[authorize]: module "suffix" returns noop for request 0
    rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh"
    rlm_realm: Found realm "DEFAULT"
    rlm_realm: Adding Stripped-User-Name = "josh"
    rlm_realm: Proxying request from user josh to realm DEFAULT
    rlm_realm: Adding Realm = "DEFAULT"
    rlm_realm: Authentication realm is LOCAL.
  modcall[authorize]: module "ntdomain" returns noop for request 0
  rlm_eap: EAP packet type response id 1 length 13
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 0
  modcall[authorize]: module "etc_smbpasswd" returns notfound for request 0
  modcall[authorize]: module "etc_group" returns notfound for request 0
    users: Matched entry DEFAULT at line 175
  modcall[authorize]: module "files" returns ok for request 0
  modcall[authorize]: module "mschap" returns noop for request 0
modcall: leaving group authorize (returns updated) for request 0
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
  rlm_eap: EAP Identity
  rlm_eap: processing type tls
  rlm_eap_tls: Initiate
  rlm_eap_tls: Start returned 1
  modcall[authenticate]: module "eap" returns handled for request 0
modcall: leaving group authenticate (returns handled) for request 0
Sending Access-Challenge of id 104 to 10.100.13.12 port 19527
    Framed-IP-Address = 255.255.255.254
    Framed-MTU = 576
    Service-Type = Framed-User
    EAP-Message = 0x010200061520
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x61bf2476da0a8dbee700d7b52748377c
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 10.100.13.12:19527, id=105, 
length=263
    User-Name = "HTN\\josh"
    Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff"
    Calling-Station-Id = "00-0E-35-B6-74-AF"
    NAS-Port = 1
    NAS-Port-Type = Wireless-802.11
    Framed-MTU = 1400
    Service-Type = Framed-User
    NAS-IP-Address = 10.100.13.12
    NAS-Identifier = "Houghton Wireless Services"
    NAS-Port-Id = "HTNStaff"
    Connect-Info = "CONNECT 54Mbps 802.11g"
    State = 0x61bf2476da0a8dbee700d7b52748377c
    EAP-Message = 
0x020200381500160301002d010000290301e9a07acc81410bcdf08077330d07ad8f018e56a6641624ec64a66da3f79bd121000002000a0100
    Message-Authenticator = 0x0334fb063e9a6d53bd8682ba37d0620e
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
  modcall[authorize]: module "preprocess" returns ok for request 1
  modcall[authorize]: module "chap" returns noop for request 1
    rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to 
config.
  modcall[authorize]: module "suffix" returns noop for request 1
    rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh"
    rlm_realm: Found realm "DEFAULT"
    rlm_realm: Adding Stripped-User-Name = "josh"
    rlm_realm: Proxying request from user josh to realm DEFAULT
    rlm_realm: Adding Realm = "DEFAULT"
    rlm_realm: Authentication realm is LOCAL.
  modcall[authorize]: module "ntdomain" returns noop for request 1
  rlm_eap: EAP packet type response id 2 length 56
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 1
  modcall[authorize]: module "etc_smbpasswd" returns notfound for request 1
  modcall[authorize]: module "etc_group" returns notfound for request 1
    users: Matched entry DEFAULT at line 175
  modcall[authorize]: module "files" returns ok for request 1
  modcall[authorize]: module "mschap" returns noop for request 1
modcall: leaving group authorize (returns updated) for request 1
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 1
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/ttls
  rlm_eap: processing type ttls
  rlm_eap_ttls: Authenticate
  rlm_eap_tls: processing TLS
  eaptls_verify returned 7
  rlm_eap_tls: Done initial handshake
    (other): before/accept initialization
    TLS_accept: before/accept initialization
  rlm_eap_tls: <<< TLS 1.0 Handshake [length 002d], ClientHello 
    TLS_accept: SSLv3 read client hello A
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello 
    TLS_accept: SSLv3 write server hello A
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 03d2], Certificate 
    TLS_accept: SSLv3 write certificate A
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone 
    TLS_accept: SSLv3 write server done A
    TLS_accept: SSLv3 flush data
    TLS_accept:error in SSLv3 read client certificate A
rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0)
In SSL Handshake Phase
In SSL Accept mode 
  eaptls_process returned 13
  modcall[authenticate]: module "eap" returns handled for request 1
modcall: leaving group authenticate (returns handled) for request 1
Sending Access-Challenge of id 105 to 10.100.13.12 port 19527
    Framed-IP-Address = 255.255.255.254
    Framed-MTU = 576
    Service-Type = Framed-User
    EAP-Message = 
0x0103040a15c00000042f160301004a02000046030149642f7ba9e448ca30ab30a9b6ed817c8aff8c408e4023e6940c762c1f36a6de20e1a7c54190eaf152b7593b2b138e0c050f4d101a4e1791b3f21981bd0acbe
    EAP-Message = 
0x092a864886f70d010901161972656d637374616666406c697374732e72656d63312e6e6574301e170d3038313231353230323332365a170d3138313231333230323332365a308198310b300906035504061302555
    EAP-Message = 
0x82010100a721638f80275c7d8c29f90e3669da66da29a4dcb0e6d18b17c9349bd6eb88e205da76218efdf67065ee07977b86ccfbc278e1c229e5f9f32340cc2a04dc418528588e667ccb783bc13133bc15a0a0936
    EAP-Message = 
0xd5652a17fa2f1b0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038201010064900d552e6d98d35cde88dc41403c05fb45c2a2bdb2f5d6f9f0fdc
    EAP-Message = 0x21eaab40c755b46a6e7892ae526d055d6da3c8c3190a
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x60ab04b8fd2e304f5d42050b620e1513
Finished request 1
Going to the next request
--- Walking the entire request list ---
Waking up in 5 seconds...
rad_recv: Access-Request packet from host 10.100.13.12:19527, id=106, 
length=213
    User-Name = "HTN\\josh"
    Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff"
    Calling-Station-Id = "00-0E-35-B6-74-AF"
    NAS-Port = 1
    NAS-Port-Type = Wireless-802.11
    Framed-MTU = 1400
    Service-Type = Framed-User
    NAS-IP-Address = 10.100.13.12
    NAS-Identifier = "Houghton Wireless Services"
    NAS-Port-Id = "HTNStaff"
    Connect-Info = "CONNECT 54Mbps 802.11g"
    State = 0x60ab04b8fd2e304f5d42050b620e1513
    EAP-Message = 0x020300061500
    Message-Authenticator = 0x85c0f98d60c740ec669de9a9c7da4986
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 2
  modcall[authorize]: module "preprocess" returns ok for request 2
  modcall[authorize]: module "chap" returns noop for request 2
    rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to 
config.
  modcall[authorize]: module "suffix" returns noop for request 2
    rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh"
    rlm_realm: Found realm "DEFAULT"
    rlm_realm: Adding Stripped-User-Name = "josh"
    rlm_realm: Proxying request from user josh to realm DEFAULT
    rlm_realm: Adding Realm = "DEFAULT"
    rlm_realm: Authentication realm is LOCAL.
  modcall[authorize]: module "ntdomain" returns noop for request 2
  rlm_eap: EAP packet type response id 3 length 6
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 2
  modcall[authorize]: module "etc_smbpasswd" returns notfound for request 2
  modcall[authorize]: module "etc_group" returns notfound for request 2
    users: Matched entry DEFAULT at line 175
  modcall[authorize]: module "files" returns ok for request 2
  modcall[authorize]: module "mschap" returns noop for request 2
modcall: leaving group authorize (returns updated) for request 2
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 2
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/ttls
  rlm_eap: processing type ttls
  rlm_eap_ttls: Authenticate
  rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
  rlm_eap_tls: ack handshake fragment handler
  eaptls_verify returned 1
  eaptls_process returned 13
  modcall[authenticate]: module "eap" returns handled for request 2
modcall: leaving group authenticate (returns handled) for request 2
Sending Access-Challenge of id 106 to 10.100.13.12 port 19527
    Framed-IP-Address = 255.255.255.254
    Framed-MTU = 576
    Service-Type = Framed-User
    EAP-Message = 
0x0104003915800000042f639f242a6f6541ec7b1afbb86af1958c2e4ed1ab48a226b2d15b08e4b7887f25691e005162bd16030100040e000000
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xabc302506c895702968419cddb2c0be9
Finished request 2
Going to the next request
Waking up in 5 seconds...
rad_recv: Access-Request packet from host 10.100.13.12:19527, id=107, 
length=533
    User-Name = "HTN\\josh"
    Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff"
    Calling-Station-Id = "00-0E-35-B6-74-AF"
    NAS-Port = 1
    NAS-Port-Type = Wireless-802.11
    Framed-MTU = 1400
    Service-Type = Framed-User
    NAS-IP-Address = 10.100.13.12
    NAS-Identifier = "Houghton Wireless Services"
    NAS-Port-Id = "HTNStaff"
    Connect-Info = "CONNECT 54Mbps 802.11g"
    State = 0xabc302506c895702968419cddb2c0be9
    EAP-Message = 
0x020401441500160301010610000102010037c452398dbb3df5559e7ef631f93adac1c31949e8b2e189e656c42563825fedb650c87be7a05cfa2b6ab6d25b111dfb5ed36ceafc6a81c2d90982bc4b9514fc25cca8f
    EAP-Message = 
0xb50e2ba24d87acf465b6923ae7229fe4e011258f1403010001011603010028faee95c6e785c7a0c1f7794e71c76e67ff5ba2f4006e2aa188af3b9da28d6e2419833ca0820678c1
    Message-Authenticator = 0xc0ff62f05516e184511c415d87cbbc2c
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 3
  modcall[authorize]: module "preprocess" returns ok for request 3
  modcall[authorize]: module "chap" returns noop for request 3
    rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to 
config.
  modcall[authorize]: module "suffix" returns noop for request 3
    rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh"
    rlm_realm: Found realm "DEFAULT"
    rlm_realm: Adding Stripped-User-Name = "josh"
    rlm_realm: Proxying request from user josh to realm DEFAULT
    rlm_realm: Adding Realm = "DEFAULT"
    rlm_realm: Authentication realm is LOCAL.
  modcall[authorize]: module "ntdomain" returns noop for request 3
  rlm_eap: EAP packet type response id 4 length 253
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 3
  modcall[authorize]: module "etc_smbpasswd" returns notfound for request 3
  modcall[authorize]: module "etc_group" returns notfound for request 3
    users: Matched entry DEFAULT at line 175
  modcall[authorize]: module "files" returns ok for request 3
  modcall[authorize]: module "mschap" returns noop for request 3
modcall: leaving group authorize (returns updated) for request 3
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 3
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/ttls
  rlm_eap: processing type ttls
  rlm_eap_ttls: Authenticate
  rlm_eap_tls: processing TLS
  eaptls_verify returned 7
  rlm_eap_tls: Done initial handshake
  rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange 
    TLS_accept: SSLv3 read client key exchange A
  rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] 
  rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished 
    TLS_accept: SSLv3 read finished A
  rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] 
    TLS_accept: SSLv3 write change cipher spec A
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished 
    TLS_accept: SSLv3 write finished A
    TLS_accept: SSLv3 flush data
    (other): SSL negotiation finished successfully
rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0)
SSL Connection Established
  eaptls_process returned 13
  modcall[authenticate]: module "eap" returns handled for request 3
modcall: leaving group authenticate (returns handled) for request 3
Sending Access-Challenge of id 107 to 10.100.13.12 port 19527
    Framed-IP-Address = 255.255.255.254
    Framed-MTU = 576
    Service-Type = Framed-User
    EAP-Message = 
0x0105003d1580000000331403010001011603010028721fb19555db97969e579863ff1f6fce4169183c7a0abb3ea443be416f722adbc21b355b7ac01a45
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xe4bddc9ecec467abc03da29934752e16
Finished request 3
Going to the next request
Waking up in 5 seconds...
rad_recv: Access-Request packet from host 10.100.13.12:19527, id=108, 
length=290
    User-Name = "HTN\\josh"
    Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff"
    Calling-Station-Id = "00-0E-35-B6-74-AF"
    NAS-Port = 1
    NAS-Port-Type = Wireless-802.11
    Framed-MTU = 1400
    Service-Type = Framed-User
    NAS-IP-Address = 10.100.13.12
    NAS-Identifier = "Houghton Wireless Services"
    NAS-Port-Id = "HTNStaff"
    Connect-Info = "CONNECT 54Mbps 802.11g"
    State = 0xe4bddc9ecec467abc03da29934752e16
    EAP-Message = 
0x02050053150017030100485562de8771e70ff92e34bb96bf0f6c24b6e6aca70841355cc05a96146c524e1c2b177149e577817012b73f9bb41d96639692cbab41f711878b16e20d5a7c04b16bc67577457b2d47
    Message-Authenticator = 0x37c5fec48b0fa7f5c14dddc680e8c4f2
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 4
  modcall[authorize]: module "preprocess" returns ok for request 4
  modcall[authorize]: module "chap" returns noop for request 4
    rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to 
config.
  modcall[authorize]: module "suffix" returns noop for request 4
    rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh"
    rlm_realm: Found realm "DEFAULT"
    rlm_realm: Adding Stripped-User-Name = "josh"
    rlm_realm: Proxying request from user josh to realm DEFAULT
    rlm_realm: Adding Realm = "DEFAULT"
    rlm_realm: Authentication realm is LOCAL.
  modcall[authorize]: module "ntdomain" returns noop for request 4
  rlm_eap: EAP packet type response id 5 length 83
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 4
  modcall[authorize]: module "etc_smbpasswd" returns notfound for request 4
  modcall[authorize]: module "etc_group" returns notfound for request 4
    users: Matched entry DEFAULT at line 175
  modcall[authorize]: module "files" returns ok for request 4
  modcall[authorize]: module "mschap" returns noop for request 4
modcall: leaving group authorize (returns updated) for request 4
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 4
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/ttls
  rlm_eap: processing type ttls
  rlm_eap_ttls: Authenticate
  rlm_eap_tls: processing TLS
  eaptls_verify returned 7
  rlm_eap_tls: Done initial handshake
  eaptls_process returned 7
  rlm_eap_ttls: Session established.  Proceeding to decode tunneled 
attributes.
  TTLS: Got tunneled request
    EAP-Message = 0x0200000d0148544e5c6a6f7368
    Message-Authenticator = 0x00000000000000000000000000000000
    FreeRADIUS-Proxied-To = 127.0.0.1
  TTLS: Got tunneled identity of HTN\josh
  TTLS: Setting default EAP type for tunneled EAP session.
  TTLS: Sending tunneled request
    EAP-Message = 0x0200000d0148544e5c6a6f7368
    Message-Authenticator = 0x00000000000000000000000000000000
    FreeRADIUS-Proxied-To = 127.0.0.1
    User-Name = "HTN\\josh"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 4
  modcall[authorize]: module "preprocess" returns ok for request 4
  modcall[authorize]: module "chap" returns noop for request 4
    rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to 
config.
  modcall[authorize]: module "suffix" returns noop for request 4
    rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh"
    rlm_realm: Found realm "DEFAULT"
    rlm_realm: Adding Stripped-User-Name = "josh"
    rlm_realm: Proxying request from user josh to realm DEFAULT
    rlm_realm: Adding Realm = "DEFAULT"
    rlm_realm: Authentication realm is LOCAL.
  modcall[authorize]: module "ntdomain" returns noop for request 4
  rlm_eap: EAP packet type response id 0 length 13
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 4
  modcall[authorize]: module "etc_smbpasswd" returns notfound for request 4
  modcall[authorize]: module "etc_group" returns notfound for request 4
  modcall[authorize]: module "files" returns notfound for request 4
  modcall[authorize]: module "mschap" returns noop for request 4
modcall: leaving group authorize (returns updated) for request 4
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 4
  rlm_eap: EAP Identity
  rlm_eap: processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
  modcall[authenticate]: module "eap" returns handled for request 4
modcall: leaving group authenticate (returns handled) for request 4
  TTLS: Got tunneled reply RADIUS code 11
    EAP-Message = 
0x010100221a0101001d1023197ffb3fbee0431fa33dd4ffe6ee4848544e5c6a6f7368
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x9023e8d5cfb89d9eedf0b95ea0ea8077
  TTLS: Got tunneled Access-Challenge
  modcall[authenticate]: module "eap" returns handled for request 4
modcall: leaving group authenticate (returns handled) for request 4
Sending Access-Challenge of id 108 to 10.100.13.12 port 19527
    Framed-IP-Address = 255.255.255.254
    Framed-MTU = 576
    Service-Type = Framed-User
    EAP-Message = 
0x0106007415800000006a170301001869103bd6a2fc06d853c018dec840fcee432f605b3bbd5c7b170301004882ddab817db15367d699b45444ae600ef8afaba3ca3c2eae0b4be817885fde9ab28ecedeca71e5371
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xc1a3900bb47d4eeed37494a4af610f6a
Finished request 4
Going to the next request
Waking up in 5 seconds...
rad_recv: Access-Request packet from host 10.100.13.12:19527, id=109, 
length=346
    User-Name = "HTN\\josh"
    Called-Station-Id = "00-17-A4-9C-00-AF:HTNStaff"
    Calling-Station-Id = "00-0E-35-B6-74-AF"
    NAS-Port = 1
    NAS-Port-Type = Wireless-802.11
    Framed-MTU = 1400
    Service-Type = Framed-User
    NAS-IP-Address = 10.100.13.12
    NAS-Identifier = "Houghton Wireless Services"
    NAS-Port-Id = "HTNStaff"
    Connect-Info = "CONNECT 54Mbps 802.11g"
    State = 0xc1a3900bb47d4eeed37494a4af610f6a
    EAP-Message = 
0x0206008b15001703010080ec308e1a81a20c80b07a9399135ce92cb9856ea5b98bf1d18e5b53c8959c899f7e0a5ac3cb31cd966591961318eb728dc0cdc95c3a09318920c6f9fba21b88827380f0ca91a8b66b9da
    Message-Authenticator = 0x24e4740de40c15633d63d47b2e2dcc5e
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 5
  modcall[authorize]: module "preprocess" returns ok for request 5
  modcall[authorize]: module "chap" returns noop for request 5
    rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to 
config.
  modcall[authorize]: module "suffix" returns noop for request 5
    rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh"
    rlm_realm: Found realm "DEFAULT"
    rlm_realm: Adding Stripped-User-Name = "josh"
    rlm_realm: Proxying request from user josh to realm DEFAULT
    rlm_realm: Adding Realm = "DEFAULT"
    rlm_realm: Authentication realm is LOCAL.
  modcall[authorize]: module "ntdomain" returns noop for request 5
  rlm_eap: EAP packet type response id 6 length 139
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 5
  modcall[authorize]: module "etc_smbpasswd" returns notfound for request 5
  modcall[authorize]: module "etc_group" returns notfound for request 5
    users: Matched entry DEFAULT at line 175
  modcall[authorize]: module "files" returns ok for request 5
  modcall[authorize]: module "mschap" returns noop for request 5
modcall: leaving group authorize (returns updated) for request 5
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 5
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/ttls
  rlm_eap: processing type ttls
  rlm_eap_ttls: Authenticate
  rlm_eap_tls: processing TLS
  eaptls_verify returned 7
  rlm_eap_tls: Done initial handshake
  eaptls_process returned 7
  rlm_eap_ttls: Session established.  Proceeding to decode tunneled 
attributes.
  TTLS: Got tunneled request
    EAP-Message = 
0x020100431a0201003e310fc0026c362449dfb52a48226b9bf58e000000000000000055a52026985b92247cf83d076fd500b15479fccd5f204f5f0048544e5c6a6f7368
    Message-Authenticator = 0x00000000000000000000000000000000
    FreeRADIUS-Proxied-To = 127.0.0.1
  TTLS: Adding old state with 90 23
  TTLS: Sending tunneled request
    EAP-Message = 
0x020100431a0201003e310fc0026c362449dfb52a48226b9bf58e000000000000000055a52026985b92247cf83d076fd500b15479fccd5f204f5f0048544e5c6a6f7368
    Message-Authenticator = 0x00000000000000000000000000000000
    FreeRADIUS-Proxied-To = 127.0.0.1
    User-Name = "HTN\\josh"
    State = 0x9023e8d5cfb89d9eedf0b95ea0ea8077
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 5
  modcall[authorize]: module "preprocess" returns ok for request 5
  modcall[authorize]: module "chap" returns noop for request 5
    rlm_realm: No '@' in User-Name = "HTN\josh", skipping NULL due to 
config.
  modcall[authorize]: module "suffix" returns noop for request 5
    rlm_realm: Looking up realm "HTN" for User-Name = "HTN\josh"
    rlm_realm: Found realm "DEFAULT"
    rlm_realm: Adding Stripped-User-Name = "josh"
    rlm_realm: Proxying request from user josh to realm DEFAULT
    rlm_realm: Adding Realm = "DEFAULT"
    rlm_realm: Authentication realm is LOCAL.
  modcall[authorize]: module "ntdomain" returns noop for request 5
  rlm_eap: EAP packet type response id 1 length 67
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 5
  modcall[authorize]: module "etc_smbpasswd" returns notfound for request 5
  modcall[authorize]: module "etc_group" returns notfound for request 5
  modcall[authorize]: module "files" returns notfound for request 5
  modcall[authorize]: module "mschap" returns noop for request 5
modcall: leaving group authorize (returns updated) for request 5
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 5
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/mschapv2
  rlm_eap: processing type mschapv2
  Processing the authenticate section of radiusd.conf
modcall: entering group MS-CHAP for request 5
  rlm_mschap: No User-Password configured.  Cannot create LM-Password.
  rlm_mschap: No User-Password configured.  Cannot create NT-Password.
  rlm_mschap: Told to do MS-CHAPv2 for josh with NT-Password
  rlm_mschap: FAILED: No NT/LM-Password.  Cannot perform authentication.
  rlm_mschap: FAILED: MS-CHAP2-Response is incorrect
  modcall[authenticate]: module "mschap" returns reject for request 5
modcall: leaving group MS-CHAP (returns reject) for request 5
  rlm_eap: Freeing handler
  modcall[authenticate]: module "eap" returns reject for request 5
modcall: leaving group authenticate (returns reject) for request 5
auth: Failed to validate the user.
  TTLS: Got tunneled reply RADIUS code 3
    MS-CHAP-Error = "\001E=691 R=1"
    EAP-Message = 0x04010004
    Message-Authenticator = 0x00000000000000000000000000000000
  TTLS: Got tunneled Access-Reject
 rlm_eap: Handler failed in EAP/ttls
  TTLS: Freeing handler for user HTN\josh
  rlm_eap: Failed in EAP select
  modcall[authenticate]: module "eap" returns invalid for request 5
modcall: leaving group authenticate (returns invalid) for request 5
auth: Failed to validate the user.
Delaying request 5 for 1 seconds
Finished request 5
Going to the next request
Waking up in 5 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 104 with timestamp 49642f7a
Sending Access-Reject of id 109 to 10.100.13.12 port 19527
    EAP-Message = 0x04060004
    Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 1 seconds...

[root@file raddb]#

Relevent lines of config (all else is default pretty much)

proxy.conf

realm DEFAULT {
        type            = radius
        authhost        = LOCAL
     accthost        = LOCAL
#       authhost        = radius.company.com:1600
#       accthost        = radius.company.com:1601
     secret          = testing123
#       nostrip
}

In radiusd.conf here is my etc_smbpasswd section
passwd etc_smbpasswd {
             filename = /etc/samba/smbpasswd
             format = 
"*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::"
             authtype = MS-CHAP
          hashsize = 100
                ignorenislike = no
                allowmultiplekeys = no
        }

My ntdomain realm definition
        realm ntdomain {
                format = prefix
                delimiter = "\\"
                ignore_default = no
                ignore_null = yes
        }

Some help with etc_smbpasswd auth and eap ttls

Josh Hiner