EAP-TTLS w/ files - cert and username issues

7 Jul 2005

      List,

I am experiencing several barriers in getting the FreeRadius 1.0.2 port
to work, in FreeBSD 5.4-RELEASE.  The supplicant is XP SP2, requesting through
a Cisco 1100 AP NAS. 

Included is my startup, along with a couple of supplicant requests.

In the past I have used sql authorization.  I now use files, and am taking 
baby-steps (with http://www.alphacore.net/spipen/article.php3?id_article=4 as
my guide). 

When I can get everything working with the built-in XP 802.1x
authentcation client, I would like to enable multiple VLAN support into my
radius config.  

My questions can be found at the bottom of this post.

---
/usr/local/sbin/radiusd -X -A -y -z

Starting - reading configuration files ...
reread_config:  reading radiusd.conf
Config:   including file: /usr/local/etc/raddb/proxy.conf
Config:   including file: /usr/local/etc/raddb/clients.conf
Config:   including file: /usr/local/etc/raddb/snmp.conf
Config:   including file: /usr/local/etc/raddb/eap.conf
Config:   including file: /usr/local/etc/raddb/sql.conf
 main: prefix = "/usr/local"
 main: localstatedir = "/var"
 main: logdir = "/var/log"
 main: libdir = "/usr/local/lib"
 main: radacctdir = "/var/log/radacct"
 main: hostname_lookups = yes
 main: snmp = no
 main: max_request_time = 30
 main: cleanup_delay = 5
 main: max_requests = 1024
 main: delete_blocked_requests = 0
 main: port = 1645
 main: allow_core_dumps = no
 main: log_stripped_names = yes
 main: log_file = "/var/log/radius.log"
 main: log_auth = yes
 main: log_auth_badpass = yes
 main: log_auth_goodpass = yes
 main: pidfile = "/var/run/radiusd/radiusd.pid"
 main: user = "nobody"
 main: group = "nobody"
 main: usercollide = no
 main: lower_user = "no"
 main: lower_pass = "no"
 main: nospace_user = "no"
 main: nospace_pass = "no"
 main: checkrad = "/usr/local/sbin/checkrad"
 main: proxy_requests = yes
 proxy: retry_delay = 5
 proxy: retry_count = 3
 proxy: synchronous = no
 proxy: default_fallback = yes
 proxy: dead_time = 120
 proxy: post_proxy_authorize = yes
 proxy: wake_all_if_all_dead = no
 security: max_attributes = 200
 security: reject_delay = 1
 security: status_server = no
 main: debug_level = 0
read_config_files:  reading dictionary
read_config_files:  reading naslist
Using deprecated naslist file.  Support for this will go away soon.
read_config_files:  reading clients
read_config_files:  reading realms
radiusd:  entering modules setup
Module: Library search path is /usr/local/lib
Module: Loaded exec 
 exec: wait = yes
 exec: program = "(null)"
 exec: input_pairs = "request"
 exec: output_pairs = "(null)"
 exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec) 
Module: Loaded expr 
Module: Instantiated expr (expr) 
Module: Loaded PAP 
 pap: encryption_scheme = "crypt"
Module: Instantiated pap (pap) 
Module: Loaded CHAP 
Module: Instantiated chap (chap) 
Module: Loaded MS-CHAP 
 mschap: use_mppe = yes
 mschap: require_encryption = no
 mschap: require_strong = no
 mschap: with_ntdomain_hack = no
 mschap: passwd = "(null)"
 mschap: authtype = "MS-CHAP"
 mschap: ntlm_auth = "(null)"
Module: Instantiated mschap (mschap) 
Module: Loaded System 
 unix: cache = no
 unix: passwd = "(null)"
 unix: shadow = "(null)"
 unix: group = "(null)"
 unix: radwtmp = "/var/log/radwtmp"
 unix: usegroup = no
 unix: cache_reload = 600
Module: Instantiated unix (unix) 
Module: Loaded eap 
 eap: default_eap_type = "md5"
 eap: timer_expire = 60
 eap: ignore_unknown_eap_types = no
 eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
 gtc: challenge = "Password: "
 gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
 tls: rsa_key_exchange = no
 tls: dh_key_exchange = yes
 tls: rsa_key_length = 512
 tls: dh_key_length = 512
 tls: verify_depth = 0
 tls: CA_path = "(null)"
 tls: pem_file_type = yes
 tls: private_key_file = "/usr/local/etc/raddb/certs/demoCA/private/cakey.pem"
 tls: certificate_file = "/usr/local/etc/raddb/certs/cacert.pem"
 tls: CA_file = "/usr/local/etc/raddb/certs/cacert.pem"
 tls: private_key_password = "xXxXxX"
 tls: dh_file = "/usr/local/etc/raddb/certs/dh"
 tls: random_file = "/usr/local/etc/raddb/certs/random"
 tls: fragment_size = 1024
 tls: include_length = yes
 tls: check_crl = no
 tls: check_cert_cn = "(null)"
rlm_eap: Loaded and initialized type tls
 ttls: default_eap_type = "md5"
 ttls: copy_request_to_tunnel = yes
 ttls: use_tunneled_reply = yes
rlm_eap: Loaded and initialized type ttls
 mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap) 
Module: Loaded preprocess 
 preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups"
 preprocess: hints = "/usr/local/etc/raddb/hints"
 preprocess: with_ascend_hack = no
 preprocess: ascend_channels_per_line = 23
 preprocess: with_ntdomain_hack = no
 preprocess: with_specialix_jetstream_hack = no
 preprocess: with_cisco_vsa_hack = no
Module: Instantiated preprocess (preprocess) 
Module: Loaded detail 
 detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d"
 detail: detailperm = 384
 detail: dirperm = 493
 detail: locking = no
Module: Instantiated detail (auth_log) 
Module: Loaded realm 
 realm: format = "suffix"
 realm: delimiter = "@"
 realm: ignore_default = no
 realm: ignore_null = no
Module: Instantiated realm (suffix) 
Module: Loaded files 
 files: usersfile = "/usr/local/etc/raddb/users"
 files: acctusersfile = "/usr/local/etc/raddb/acct_users"
 files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"
 files: compat = "no"
Module: Instantiated files (files) 
Module: Loaded Acct-Unique-Session-Id 
 acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique) 
 detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d"
 detail: detailperm = 384
 detail: dirperm = 493
 detail: locking = no
Module: Instantiated detail (detail) 
Module: Loaded radutmp 
 radutmp: filename = "/var/log/radutmp"
 radutmp: username = "%{User-Name}"
 radutmp: case_sensitive = yes
 radutmp: check_with_nas = yes
 radutmp: perm = 384
 radutmp: callerid = yes
Module: Instantiated radutmp (radutmp) 
Listening on authentication *:1645
Listening on accounting *:1646
Listening on proxy *:1647
Ready to process requests.
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=204, length=160
	User-Name = "\\test"
	Framed-MTU = 1400
	Called-Station-Id = "0014.691e.dee0"
	Calling-Station-Id = "000e.35b5.eb8f"
	Service-Type = Login-User
	Message-Authenticator = 0x238c744d504314eab835667ae645baac
	EAP-Message = 0x0205001115800000000715030100020230
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 5109
	State = 0x9b473d358960d6200af1bc554cb69e61
	NAS-IP-Address = 192.168.1.249
	NAS-Identifier = "freeradius1100"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
  modcall[authorize]: module "preprocess" returns ok for request 0
radius_xlat:  '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
  modcall[authorize]: module "auth_log" returns ok for request 0
  modcall[authorize]: module "chap" returns noop for request 0
  modcall[authorize]: module "mschap" returns noop for request 0
    rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 0
  rlm_eap: EAP packet type response id 5 length 17
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 0
    users: Matched entry DEFAULT at line 155
  modcall[authorize]: module "files" returns ok for request 0
modcall: group authorize returns updated for request 0
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
  rlm_eap: Request not found in the list
rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request
  rlm_eap: Failed in handler
  modcall[authenticate]: module "eap" returns invalid for request 0
modcall: group authenticate returns invalid for request 0
auth: Failed to validate the user.
Login incorrect: [\\test/<no User-Password attribute>] (from client Aironet1100 port 5109 cli 000e.35b5.eb8f)
Delaying request 0 for 1 seconds
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Sending Access-Reject of id 204 to 192.168.1.249:1645
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=205, length=135
	User-Name = "\\test"
	Framed-MTU = 1400
	Called-Station-Id = "0014.691e.dee0"
	Calling-Station-Id = "000e.35b5.eb8f"
	Service-Type = Login-User
	Message-Authenticator = 0x8fa769b77767a6d40c0f4368065836f7
	EAP-Message = 0x0201000a015c74657374
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 5110
	NAS-IP-Address = 192.168.1.249
	NAS-Identifier = "freeradius1100"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
  modcall[authorize]: module "preprocess" returns ok for request 1
radius_xlat:  '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
  modcall[authorize]: module "auth_log" returns ok for request 1
  modcall[authorize]: module "chap" returns noop for request 1
  modcall[authorize]: module "mschap" returns noop for request 1
    rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 1
  rlm_eap: EAP packet type response id 1 length 10
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 1
    users: Matched entry DEFAULT at line 155
  modcall[authorize]: module "files" returns ok for request 1
modcall: group authorize returns updated for request 1
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 1
  rlm_eap: EAP Identity
  rlm_eap: processing type md5
rlm_eap_md5: Issuing Challenge
  modcall[authenticate]: module "eap" returns handled for request 1
modcall: group authenticate returns handled for request 1
Sending Access-Challenge of id 205 to 192.168.1.249:1645
	EAP-Message = 0x010200160410f8699c142f2b04174aa12d7ba7e1acb3
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0xefbab3f23eae914a7e7e787f980a33ea
Finished request 1
Going to the next request
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=206, length=149
	User-Name = "\\test"
	Framed-MTU = 1400
	Called-Station-Id = "0014.691e.dee0"
	Calling-Station-Id = "000e.35b5.eb8f"
	Service-Type = Login-User
	Message-Authenticator = 0x028ca873c46d637a9313e8a7c400e9f9
	EAP-Message = 0x020200060315
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 5110
	State = 0xefbab3f23eae914a7e7e787f980a33ea
	NAS-IP-Address = 192.168.1.249
	NAS-Identifier = "freeradius1100"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 2
  modcall[authorize]: module "preprocess" returns ok for request 2
radius_xlat:  '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
  modcall[authorize]: module "auth_log" returns ok for request 2
  modcall[authorize]: module "chap" returns noop for request 2
  modcall[authorize]: module "mschap" returns noop for request 2
    rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 2
  rlm_eap: EAP packet type response id 2 length 6
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 2
    users: Matched entry DEFAULT at line 155
  modcall[authorize]: module "files" returns ok for request 2
modcall: group authorize returns updated for request 2
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 2
  rlm_eap: Request found, released from the list
  rlm_eap: EAP NAK
 rlm_eap: EAP-NAK asked for EAP-Type/ttls
  rlm_eap: processing type tls
  rlm_eap_tls: Initiate
  rlm_eap_tls: Start returned 1
  modcall[authenticate]: module "eap" returns handled for request 2
modcall: group authenticate returns handled for request 2
Sending Access-Challenge of id 206 to 192.168.1.249:1645
	EAP-Message = 0x010300061520
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x92217acdcb66585c00578271b16e607a
Finished request 2
Going to the next request
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=207, length=249
	User-Name = "\\test"
	Framed-MTU = 1400
	Called-Station-Id = "0014.691e.dee0"
	Calling-Station-Id = "000e.35b5.eb8f"
	Service-Type = Login-User
	Message-Authenticator = 0x2720f14be41136a09d19c7eccb60cfe9
	EAP-Message = 0x0203006a158000000060160301005b01000057030142cd0f6a8f09262c8c4b8acc2ac7d156e44e412a5860a00d23512d0ea279941000003000390038003500160013000a00330032002f0066000500040065006400630062006000150012000900140011000800030100
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 5110
	State = 0x92217acdcb66585c00578271b16e607a
	NAS-IP-Address = 192.168.1.249
	NAS-Identifier = "freeradius1100"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 3
  modcall[authorize]: module "preprocess" returns ok for request 3
radius_xlat:  '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
  modcall[authorize]: module "auth_log" returns ok for request 3
  modcall[authorize]: module "chap" returns noop for request 3
  modcall[authorize]: module "mschap" returns noop for request 3
    rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 3
  rlm_eap: EAP packet type response id 3 length 106
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 3
    users: Matched entry DEFAULT at line 155
  modcall[authorize]: module "files" returns ok for request 3
modcall: group authorize returns updated for request 3
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 3
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/ttls
  rlm_eap: processing type ttls
  rlm_eap_ttls: Authenticate
  rlm_eap_tls: processing TLS
rlm_eap_tls:  Length Included
  eaptls_verify returned 11 
    (other): before/accept initialization 
    TLS_accept: before/accept initialization 
  rlm_eap_tls: <<< TLS 1.0 Handshake [length 005b], ClientHello  
    TLS_accept: SSLv3 read client hello A 
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello  
    TLS_accept: SSLv3 write server hello A 
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 0454], Certificate  
    TLS_accept: SSLv3 write certificate A 
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone  
    TLS_accept: SSLv3 write server done A 
    TLS_accept: SSLv3 flush data 
    TLS_accept:error in SSLv3 read client certificate A 
In SSL Handshake Phase 
In SSL Accept mode  
  eaptls_process returned 13 
  modcall[authenticate]: module "eap" returns handled for request 3
modcall: group authenticate returns handled for request 3
Sending Access-Challenge of id 207 to 192.168.1.249:1645
	EAP-Message = 0x0104040a15c0000004b1160301004a02000046030142ccc10ed21fab0d59b10e6188e109574dae7147d68ffb41d3d2023030eeda75207f4a0ac74177d7255e411ecedbe3ebc5db188d491a11923c4cffb6354b0b32fb00350016030104540b00045000044d00044a30820446308203afa003020102020900b4ffbc458a823a63300d06092a864886f70d01010405003081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572
	EAP-Message = 0x204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e656475301e170d3035303730363133353630335a170d3135303730343133353630335a3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504
	EAP-Message = 0x031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e65647530819f300d06092a864886f70d010101050003818d0030818902818100952a6e25e986e7297e0fe23d8ab71a410a827faeed95c076d4bb558f46790b556c13bb40cb082da6776bcad9d70c884d7f831dce00b984cc2c1818a744c529c21a9fb708244e09ef55c7edc2c063659d0ab8f2948bcf9e98c862460023c17a5ce91ed97429e6a79e2726c11c8acbbf109f12f4a8d8efcea365a5831944dc14250203010001a38201323082012e301d0603551d
	EAP-Message = 0x0e04160414166b7bb5824d8888245b04f718d44f9d85d631783081fe0603551d230481f63081f38014166b7bb5824d8888245b04f718d44f9d85d63178a181cfa481cc3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d69
	EAP-Message = 0x6e40736f7574687765737465726e2e656475820900b4
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x2509db5459d6466c777ef4f8e39fe7bc
Finished request 3
Going to the next request
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=208, length=149
	User-Name = "\\test"
	Framed-MTU = 1400
	Called-Station-Id = "0014.691e.dee0"
	Calling-Station-Id = "000e.35b5.eb8f"
	Service-Type = Login-User
	Message-Authenticator = 0xdbea76e625c3741e8a7a40e97aab42c3
	EAP-Message = 0x020400061500
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 5110
	State = 0x2509db5459d6466c777ef4f8e39fe7bc
	NAS-IP-Address = 192.168.1.249
	NAS-Identifier = "freeradius1100"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 4
  modcall[authorize]: module "preprocess" returns ok for request 4
radius_xlat:  '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
  modcall[authorize]: module "auth_log" returns ok for request 4
  modcall[authorize]: module "chap" returns noop for request 4
  modcall[authorize]: module "mschap" returns noop for request 4
    rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 4
  rlm_eap: EAP packet type response id 4 length 6
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 4
    users: Matched entry DEFAULT at line 155
  modcall[authorize]: module "files" returns ok for request 4
modcall: group authorize returns updated for request 4
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 4
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/ttls
  rlm_eap: processing type ttls
  rlm_eap_ttls: Authenticate
  rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
  rlm_eap_tls: ack handshake fragment handler
  eaptls_verify returned 1 
  eaptls_process returned 13 
  modcall[authenticate]: module "eap" returns handled for request 4
modcall: group authenticate returns handled for request 4
Sending Access-Challenge of id 208 to 192.168.1.249:1645
	EAP-Message = 0x010500bb1580000004b1ffbc458a823a63300c0603551d13040530030101ff300d06092a864886f70d01010405000381810030b2ae584f5f190289bcf3451bc1d1bac6a0e9d7ad7d79857c1b68c4537677fc2cc9192f4e5a17b974bdbb514f94178847884da765e4b3f3e878e0d9083978cd799b434f25e6f7fa8047d6bef2f410919f2d54574a873f1adafb83a175ccc47d34c46113fbc80fa0942cc9b74fe4fbbfed0c632eea7a4ba04ab80913169a289216030100040e000000
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0xb976af42b5c24fda517ca5a5094e5bd1
Finished request 4
Going to the next request
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=209, length=160
	User-Name = "\\test"
	Framed-MTU = 1400
	Called-Station-Id = "0014.691e.dee0"
	Calling-Station-Id = "000e.35b5.eb8f"
	Service-Type = Login-User
	Message-Authenticator = 0x1ed15ed6d0d7cefc891b19b23bee81de
	EAP-Message = 0x0205001115800000000715030100020230
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 5110
	State = 0xb976af42b5c24fda517ca5a5094e5bd1
	NAS-IP-Address = 192.168.1.249
	NAS-Identifier = "freeradius1100"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 5
  modcall[authorize]: module "preprocess" returns ok for request 5
radius_xlat:  '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
  modcall[authorize]: module "auth_log" returns ok for request 5
  modcall[authorize]: module "chap" returns noop for request 5
  modcall[authorize]: module "mschap" returns noop for request 5
    rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 5
  rlm_eap: EAP packet type response id 5 length 17
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 5
    users: Matched entry DEFAULT at line 155
  modcall[authorize]: module "files" returns ok for request 5
modcall: group authorize returns updated for request 5
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 5
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/ttls
  rlm_eap: processing type ttls
  rlm_eap_ttls: Authenticate
  rlm_eap_tls: processing TLS
rlm_eap_tls:  Length Included
  eaptls_verify returned 11 
  rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca  
TLS Alert read:fatal:unknown CA 
    TLS_accept:failed in SSLv3 read client certificate A 
74089:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48
74089:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837:
rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails.
In SSL Handshake Phase 
In SSL Accept mode  
rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails.
  eaptls_process returned 13 
  rlm_eap: Freeing handler
  modcall[authenticate]: module "eap" returns reject for request 5
modcall: group authenticate returns reject for request 5
auth: Failed to validate the user.
Login incorrect: [\\test/<no User-Password attribute>] (from client Aironet1100 port 5110 cli 000e.35b5.eb8f)
Delaying request 5 for 1 seconds
Finished request 5
Going to the next request
Waking up in 4 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 204 with timestamp 42ccc10c
Sending Access-Reject of id 209 to 192.168.1.249:1645
	EAP-Message = 0x04050004
	Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 2 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=210, length=135
	User-Name = "\\test"
	Framed-MTU = 1400
	Called-Station-Id = "0014.691e.dee0"
	Calling-Station-Id = "000e.35b5.eb8f"
	Service-Type = Login-User
	Message-Authenticator = 0x544e7a1be19c6f73f27f99568ad64107
	EAP-Message = 0x0201000a015c74657374
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 5111
	NAS-IP-Address = 192.168.1.249
	NAS-Identifier = "freeradius1100"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 6
  modcall[authorize]: module "preprocess" returns ok for request 6
radius_xlat:  '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
  modcall[authorize]: module "auth_log" returns ok for request 6
  modcall[authorize]: module "chap" returns noop for request 6
  modcall[authorize]: module "mschap" returns noop for request 6
    rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 6
  rlm_eap: EAP packet type response id 1 length 10
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 6
    users: Matched entry DEFAULT at line 155
  modcall[authorize]: module "files" returns ok for request 6
modcall: group authorize returns updated for request 6
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 6
  rlm_eap: EAP Identity
  rlm_eap: processing type md5
rlm_eap_md5: Issuing Challenge
  modcall[authenticate]: module "eap" returns handled for request 6
modcall: group authenticate returns handled for request 6
Sending Access-Challenge of id 210 to 192.168.1.249:1645
	EAP-Message = 0x0102001604102175e07d9aa780427053303ac2cde45c
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x63ae08507e7adbd6ec0a1b963ba8ac19
Finished request 6
Going to the next request
Waking up in 2 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=211, length=149
	User-Name = "\\test"
	Framed-MTU = 1400
	Called-Station-Id = "0014.691e.dee0"
	Calling-Station-Id = "000e.35b5.eb8f"
	Service-Type = Login-User
	Message-Authenticator = 0x9ca188d4e2c3bacf6951c2e146d7793b
	EAP-Message = 0x020200060315
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 5111
	State = 0x63ae08507e7adbd6ec0a1b963ba8ac19
	NAS-IP-Address = 192.168.1.249
	NAS-Identifier = "freeradius1100"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 7
  modcall[authorize]: module "preprocess" returns ok for request 7
radius_xlat:  '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
  modcall[authorize]: module "auth_log" returns ok for request 7
  modcall[authorize]: module "chap" returns noop for request 7
  modcall[authorize]: module "mschap" returns noop for request 7
    rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 7
  rlm_eap: EAP packet type response id 2 length 6
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 7
    users: Matched entry DEFAULT at line 155
  modcall[authorize]: module "files" returns ok for request 7
modcall: group authorize returns updated for request 7
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 7
  rlm_eap: Request found, released from the list
  rlm_eap: EAP NAK
 rlm_eap: EAP-NAK asked for EAP-Type/ttls
  rlm_eap: processing type tls
  rlm_eap_tls: Initiate
  rlm_eap_tls: Start returned 1
  modcall[authenticate]: module "eap" returns handled for request 7
modcall: group authenticate returns handled for request 7
Sending Access-Challenge of id 211 to 192.168.1.249:1645
	EAP-Message = 0x010300061520
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0xd9af635c0f0a743e30cb4b7cfcb6dbb3
Finished request 7
Going to the next request
Waking up in 2 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=212, length=249
	User-Name = "\\test"
	Framed-MTU = 1400
	Called-Station-Id = "0014.691e.dee0"
	Calling-Station-Id = "000e.35b5.eb8f"
	Service-Type = Login-User
	Message-Authenticator = 0xa6def1b9db8aef9d09c89013ae6291cd
	EAP-Message = 0x0203006a158000000060160301005b01000057030142cd0f6ecc689e8295b1c859d9fa1226f5b025ac75bb01b1c1d27fc659c6a89500003000390038003500160013000a00330032002f0066000500040065006400630062006000150012000900140011000800030100
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 5111
	State = 0xd9af635c0f0a743e30cb4b7cfcb6dbb3
	NAS-IP-Address = 192.168.1.249
	NAS-Identifier = "freeradius1100"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 8
  modcall[authorize]: module "preprocess" returns ok for request 8
radius_xlat:  '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
  modcall[authorize]: module "auth_log" returns ok for request 8
  modcall[authorize]: module "chap" returns noop for request 8
  modcall[authorize]: module "mschap" returns noop for request 8
    rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 8
  rlm_eap: EAP packet type response id 3 length 106
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 8
    users: Matched entry DEFAULT at line 155
  modcall[authorize]: module "files" returns ok for request 8
modcall: group authorize returns updated for request 8
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 8
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/ttls
  rlm_eap: processing type ttls
  rlm_eap_ttls: Authenticate
  rlm_eap_tls: processing TLS
rlm_eap_tls:  Length Included
  eaptls_verify returned 11 
    (other): before/accept initialization 
    TLS_accept: before/accept initialization 
  rlm_eap_tls: <<< TLS 1.0 Handshake [length 005b], ClientHello  
    TLS_accept: SSLv3 read client hello A 
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello  
    TLS_accept: SSLv3 write server hello A 
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 0454], Certificate  
    TLS_accept: SSLv3 write certificate A 
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone  
    TLS_accept: SSLv3 write server done A 
    TLS_accept: SSLv3 flush data 
    TLS_accept:error in SSLv3 read client certificate A 
In SSL Handshake Phase 
In SSL Accept mode  
  eaptls_process returned 13 
  modcall[authenticate]: module "eap" returns handled for request 8
modcall: group authenticate returns handled for request 8
Sending Access-Challenge of id 212 to 192.168.1.249:1645
	EAP-Message = 0x0104040a15c0000004b1160301004a02000046030142ccc1121988c9add3c5d8fe81cf66d5b075cdd1eb288ce2abcaef53a530f9b5205b04e5b1f6ba59f700f87ecb2710de52422884b1f67ea9fefce9b3350df8c17f00350016030104540b00045000044d00044a30820446308203afa003020102020900b4ffbc458a823a63300d06092a864886f70d01010405003081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572
	EAP-Message = 0x204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e656475301e170d3035303730363133353630335a170d3135303730343133353630335a3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504
	EAP-Message = 0x031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e65647530819f300d06092a864886f70d010101050003818d0030818902818100952a6e25e986e7297e0fe23d8ab71a410a827faeed95c076d4bb558f46790b556c13bb40cb082da6776bcad9d70c884d7f831dce00b984cc2c1818a744c529c21a9fb708244e09ef55c7edc2c063659d0ab8f2948bcf9e98c862460023c17a5ce91ed97429e6a79e2726c11c8acbbf109f12f4a8d8efcea365a5831944dc14250203010001a38201323082012e301d0603551d
	EAP-Message = 0x0e04160414166b7bb5824d8888245b04f718d44f9d85d631783081fe0603551d230481f63081f38014166b7bb5824d8888245b04f718d44f9d85d63178a181cfa481cc3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d69
	EAP-Message = 0x6e40736f7574687765737465726e2e656475820900b4
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x164cf9a732e840475264604a9e01de91
Finished request 8
Going to the next request
Waking up in 2 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=213, length=149
	User-Name = "\\test"
	Framed-MTU = 1400
	Called-Station-Id = "0014.691e.dee0"
	Calling-Station-Id = "000e.35b5.eb8f"
	Service-Type = Login-User
	Message-Authenticator = 0x2709d031c3b73506b88e0453e2ec0c39
	EAP-Message = 0x020400061500
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 5111
	State = 0x164cf9a732e840475264604a9e01de91
	NAS-IP-Address = 192.168.1.249
	NAS-Identifier = "freeradius1100"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 9
  modcall[authorize]: module "preprocess" returns ok for request 9
radius_xlat:  '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
  modcall[authorize]: module "auth_log" returns ok for request 9
  modcall[authorize]: module "chap" returns noop for request 9
  modcall[authorize]: module "mschap" returns noop for request 9
    rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 9
  rlm_eap: EAP packet type response id 4 length 6
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 9
    users: Matched entry DEFAULT at line 155
  modcall[authorize]: module "files" returns ok for request 9
modcall: group authorize returns updated for request 9
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 9
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/ttls
  rlm_eap: processing type ttls
  rlm_eap_ttls: Authenticate
  rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
  rlm_eap_tls: ack handshake fragment handler
  eaptls_verify returned 1 
  eaptls_process returned 13 
  modcall[authenticate]: module "eap" returns handled for request 9
modcall: group authenticate returns handled for request 9
Sending Access-Challenge of id 213 to 192.168.1.249:1645
	EAP-Message = 0x010500bb1580000004b1ffbc458a823a63300c0603551d13040530030101ff300d06092a864886f70d01010405000381810030b2ae584f5f190289bcf3451bc1d1bac6a0e9d7ad7d79857c1b68c4537677fc2cc9192f4e5a17b974bdbb514f94178847884da765e4b3f3e878e0d9083978cd799b434f25e6f7fa8047d6bef2f410919f2d54574a873f1adafb83a175ccc47d34c46113fbc80fa0942cc9b74fe4fbbfed0c632eea7a4ba04ab80913169a289216030100040e000000
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x473d358960d6204ce25ca24599a0f7f7
Finished request 9
Going to the next request
Waking up in 2 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=214, length=160
	User-Name = "\\test"
	Framed-MTU = 1400
	Called-Station-Id = "0014.691e.dee0"
	Calling-Station-Id = "000e.35b5.eb8f"
	Service-Type = Login-User
	Message-Authenticator = 0xe05d2ac8b90eacb717ad47ed3afe6f8c
	EAP-Message = 0x0205001115800000000715030100020230
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 5111
	State = 0x473d358960d6204ce25ca24599a0f7f7
	NAS-IP-Address = 192.168.1.249
	NAS-Identifier = "freeradius1100"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 10
  modcall[authorize]: module "preprocess" returns ok for request 10
radius_xlat:  '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
  modcall[authorize]: module "auth_log" returns ok for request 10
  modcall[authorize]: module "chap" returns noop for request 10
  modcall[authorize]: module "mschap" returns noop for request 10
    rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 10
  rlm_eap: EAP packet type response id 5 length 17
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 10
    users: Matched entry DEFAULT at line 155
  modcall[authorize]: module "files" returns ok for request 10
modcall: group authorize returns updated for request 10
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 10
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/ttls
  rlm_eap: processing type ttls
  rlm_eap_ttls: Authenticate
  rlm_eap_tls: processing TLS
rlm_eap_tls:  Length Included
  eaptls_verify returned 11 
  rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca  
TLS Alert read:fatal:unknown CA 
    TLS_accept:failed in SSLv3 read client certificate A 
74089:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48
74089:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837:
rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails.
In SSL Handshake Phase 
In SSL Accept mode  
rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails.
  eaptls_process returned 13 
  rlm_eap: Freeing handler
  modcall[authenticate]: module "eap" returns reject for request 10
modcall: group authenticate returns reject for request 10
auth: Failed to validate the user.
Login incorrect: [\\test/<no User-Password attribute>] (from client Aironet1100 port 5111 cli 000e.35b5.eb8f)
Delaying request 10 for 1 seconds
Finished request 10
Going to the next request
Waking up in 2 seconds...
--- Walking the entire request list ---
Cleaning up request 1 ID 205 with timestamp 42ccc10e
Cleaning up request 2 ID 206 with timestamp 42ccc10e
Cleaning up request 3 ID 207 with timestamp 42ccc10e
Cleaning up request 4 ID 208 with timestamp 42ccc10e
Cleaning up request 5 ID 209 with timestamp 42ccc10e
Sending Access-Reject of id 214 to 192.168.1.249:1645
	EAP-Message = 0x04050004
	Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=215, length=135
	User-Name = "\\test"
	Framed-MTU = 1400
	Called-Station-Id = "0014.691e.dee0"
	Calling-Station-Id = "000e.35b5.eb8f"
	Service-Type = Login-User
	Message-Authenticator = 0x9b1598a18cc60ddc9fd92daaf7b78b3b
	EAP-Message = 0x0201000a015c74657374
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 5112
	NAS-IP-Address = 192.168.1.249
	NAS-Identifier = "freeradius1100"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 11
  modcall[authorize]: module "preprocess" returns ok for request 11
radius_xlat:  '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
  modcall[authorize]: module "auth_log" returns ok for request 11
  modcall[authorize]: module "chap" returns noop for request 11
  modcall[authorize]: module "mschap" returns noop for request 11
    rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 11
  rlm_eap: EAP packet type response id 1 length 10
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 11
    users: Matched entry DEFAULT at line 155
  modcall[authorize]: module "files" returns ok for request 11
modcall: group authorize returns updated for request 11
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 11
  rlm_eap: EAP Identity
  rlm_eap: processing type md5
rlm_eap_md5: Issuing Challenge
  modcall[authenticate]: module "eap" returns handled for request 11
modcall: group authenticate returns handled for request 11
Sending Access-Challenge of id 215 to 192.168.1.249:1645
	EAP-Message = 0x010200160410ae56ef5b513719784eb029ef161e3834
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x47b6bb0eb7cb3629f5209d838c9cb2bb
Finished request 11
Going to the next request
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=216, length=149
	User-Name = "\\test"
	Framed-MTU = 1400
	Called-Station-Id = "0014.691e.dee0"
	Calling-Station-Id = "000e.35b5.eb8f"
	Service-Type = Login-User
	Message-Authenticator = 0xf8cbc78444e069e76dcfdc85d3d68e1c
	EAP-Message = 0x020200060315
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 5112
	State = 0x47b6bb0eb7cb3629f5209d838c9cb2bb
	NAS-IP-Address = 192.168.1.249
	NAS-Identifier = "freeradius1100"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 12
  modcall[authorize]: module "preprocess" returns ok for request 12
radius_xlat:  '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
  modcall[authorize]: module "auth_log" returns ok for request 12
  modcall[authorize]: module "chap" returns noop for request 12
  modcall[authorize]: module "mschap" returns noop for request 12
    rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 12
  rlm_eap: EAP packet type response id 2 length 6
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 12
    users: Matched entry DEFAULT at line 155
  modcall[authorize]: module "files" returns ok for request 12
modcall: group authorize returns updated for request 12
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 12
  rlm_eap: Request found, released from the list
  rlm_eap: EAP NAK
 rlm_eap: EAP-NAK asked for EAP-Type/ttls
  rlm_eap: processing type tls
  rlm_eap_tls: Initiate
  rlm_eap_tls: Start returned 1
  modcall[authenticate]: module "eap" returns handled for request 12
modcall: group authenticate returns handled for request 12
Sending Access-Challenge of id 216 to 192.168.1.249:1645
	EAP-Message = 0x010300061520
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0xcefd256444122da46c97de73b47f9968
Finished request 12
Going to the next request
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=217, length=249
	User-Name = "\\test"
	Framed-MTU = 1400
	Called-Station-Id = "0014.691e.dee0"
	Calling-Station-Id = "000e.35b5.eb8f"
	Service-Type = Login-User
	Message-Authenticator = 0xeee120ea8fb84b5b68ba7b01669c1a90
	EAP-Message = 0x0203006a158000000060160301005b01000057030142cd0f70429a566d1ac989f1550ae3a440b7d4e9db1779f5e5288babe6e987cd00003000390038003500160013000a00330032002f0066000500040065006400630062006000150012000900140011000800030100
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 5112
	State = 0xcefd256444122da46c97de73b47f9968
	NAS-IP-Address = 192.168.1.249
	NAS-Identifier = "freeradius1100"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 13
  modcall[authorize]: module "preprocess" returns ok for request 13
radius_xlat:  '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
  modcall[authorize]: module "auth_log" returns ok for request 13
  modcall[authorize]: module "chap" returns noop for request 13
  modcall[authorize]: module "mschap" returns noop for request 13
    rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 13
  rlm_eap: EAP packet type response id 3 length 106
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 13
    users: Matched entry DEFAULT at line 155
  modcall[authorize]: module "files" returns ok for request 13
modcall: group authorize returns updated for request 13
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 13
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/ttls
  rlm_eap: processing type ttls
  rlm_eap_ttls: Authenticate
  rlm_eap_tls: processing TLS
rlm_eap_tls:  Length Included
  eaptls_verify returned 11 
    (other): before/accept initialization 
    TLS_accept: before/accept initialization 
  rlm_eap_tls: <<< TLS 1.0 Handshake [length 005b], ClientHello  
    TLS_accept: SSLv3 read client hello A 
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello  
    TLS_accept: SSLv3 write server hello A 
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 0454], Certificate  
    TLS_accept: SSLv3 write certificate A 
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone  
    TLS_accept: SSLv3 write server done A 
    TLS_accept: SSLv3 flush data 
    TLS_accept:error in SSLv3 read client certificate A 
In SSL Handshake Phase 
In SSL Accept mode  
  eaptls_process returned 13 
  modcall[authenticate]: module "eap" returns handled for request 13
modcall: group authenticate returns handled for request 13
Sending Access-Challenge of id 217 to 192.168.1.249:1645
	EAP-Message = 0x0104040a15c0000004b1160301004a02000046030142ccc114fe81831a72e96a50f4c01c76f5410e5a4bdd3403910a23fe69681500209efd56cbe5f05cf20e7379e49dcef61940bbda94da905fbc49ee2f9f955b579000350016030104540b00045000044d00044a30820446308203afa003020102020900b4ffbc458a823a63300d06092a864886f70d01010405003081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572
	EAP-Message = 0x204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e656475301e170d3035303730363133353630335a170d3135303730343133353630335a3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504
	EAP-Message = 0x031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d696e40736f7574687765737465726e2e65647530819f300d06092a864886f70d010101050003818d0030818902818100952a6e25e986e7297e0fe23d8ab71a410a827faeed95c076d4bb558f46790b556c13bb40cb082da6776bcad9d70c884d7f831dce00b984cc2c1818a744c529c21a9fb708244e09ef55c7edc2c063659d0ab8f2948bcf9e98c862460023c17a5ce91ed97429e6a79e2726c11c8acbbf109f12f4a8d8efcea365a5831944dc14250203010001a38201323082012e301d0603551d
	EAP-Message = 0x0e04160414166b7bb5824d8888245b04f718d44f9d85d631783081fe0603551d230481f63081f38014166b7bb5824d8888245b04f718d44f9d85d63178a181cfa481cc3081c9310b3009060355040613025553310e300c060355040813055465786173311330110603550407130a47656f726765746f776e3120301e060355040a1317536f7574687765737465726e20556e6976657273697479311e301c060355040b1315495453202d20536572766572204469766973696f6e3129302706035504031320536f7574687765737465726e20556e6976657273697479202d205241444955533128302606092a864886f70d010901161973797361646d69
	EAP-Message = 0x6e40736f7574687765737465726e2e656475820900b4
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0xab124225e8f965bd03e617abbd82f8fa
Finished request 13
Going to the next request
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=218, length=149
	User-Name = "\\test"
	Framed-MTU = 1400
	Called-Station-Id = "0014.691e.dee0"
	Calling-Station-Id = "000e.35b5.eb8f"
	Service-Type = Login-User
	Message-Authenticator = 0x0e840d4a507bc45feebe4dd29d555499
	EAP-Message = 0x020400061500
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 5112
	State = 0xab124225e8f965bd03e617abbd82f8fa
	NAS-IP-Address = 192.168.1.249
	NAS-Identifier = "freeradius1100"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 14
  modcall[authorize]: module "preprocess" returns ok for request 14
radius_xlat:  '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
  modcall[authorize]: module "auth_log" returns ok for request 14
  modcall[authorize]: module "chap" returns noop for request 14
  modcall[authorize]: module "mschap" returns noop for request 14
    rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 14
  rlm_eap: EAP packet type response id 4 length 6
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 14
    users: Matched entry DEFAULT at line 155
  modcall[authorize]: module "files" returns ok for request 14
modcall: group authorize returns updated for request 14
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 14
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/ttls
  rlm_eap: processing type ttls
  rlm_eap_ttls: Authenticate
  rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
  rlm_eap_tls: ack handshake fragment handler
  eaptls_verify returned 1 
  eaptls_process returned 13 
  modcall[authenticate]: module "eap" returns handled for request 14
modcall: group authenticate returns handled for request 14
Sending Access-Challenge of id 218 to 192.168.1.249:1645
	EAP-Message = 0x010500bb1580000004b1ffbc458a823a63300c0603551d13040530030101ff300d06092a864886f70d01010405000381810030b2ae584f5f190289bcf3451bc1d1bac6a0e9d7ad7d79857c1b68c4537677fc2cc9192f4e5a17b974bdbb514f94178847884da765e4b3f3e878e0d9083978cd799b434f25e6f7fa8047d6bef2f410919f2d54574a873f1adafb83a175ccc47d34c46113fbc80fa0942cc9b74fe4fbbfed0c632eea7a4ba04ab80913169a289216030100040e000000
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0xbb33623ddc8707a12f36fa8892364757
Finished request 14
Going to the next request
Waking up in 4 seconds...
rad_recv: Access-Request packet from host 192.168.1.249:1645, id=219, length=160
	User-Name = "\\test"
	Framed-MTU = 1400
	Called-Station-Id = "0014.691e.dee0"
	Calling-Station-Id = "000e.35b5.eb8f"
	Service-Type = Login-User
	Message-Authenticator = 0xf394bff1a421b25724d257be2378166e
	EAP-Message = 0x0205001115800000000715030100020230
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 5112
	State = 0xbb33623ddc8707a12f36fa8892364757
	NAS-IP-Address = 192.168.1.249
	NAS-Identifier = "freeradius1100"
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 15
  modcall[authorize]: module "preprocess" returns ok for request 15
radius_xlat:  '/var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707'
rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/slc-int-1-249.southwestern.edu/auth-detail-20050707
  modcall[authorize]: module "auth_log" returns ok for request 15
  modcall[authorize]: module "chap" returns noop for request 15
  modcall[authorize]: module "mschap" returns noop for request 15
    rlm_realm: No '@' in User-Name = "\test", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 15
  rlm_eap: EAP packet type response id 5 length 17
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
  modcall[authorize]: module "eap" returns updated for request 15
    users: Matched entry DEFAULT at line 155
  modcall[authorize]: module "files" returns ok for request 15
modcall: group authorize returns updated for request 15
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 15
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/ttls
  rlm_eap: processing type ttls
  rlm_eap_ttls: Authenticate
  rlm_eap_tls: processing TLS
rlm_eap_tls:  Length Included
  eaptls_verify returned 11 
  rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca  
TLS Alert read:fatal:unknown CA 
    TLS_accept:failed in SSLv3 read client certificate A 
74089:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48
74089:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837:
rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails.
In SSL Handshake Phase 
In SSL Accept mode  
rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails.
  eaptls_process returned 13 
  rlm_eap: Freeing handler
  modcall[authenticate]: module "eap" returns reject for request 15
modcall: group authenticate returns reject for request 15
auth: Failed to validate the user.
Login incorrect: [\\test/<no User-Password attribute>] (from client Aironet1100 port 5112 cli 000e.35b5.eb8f)
Delaying request 15 for 1 seconds
Finished request 15
Going to the next request
Waking up in 4 seconds...
---

My questions are the following:

- 	I choose EAP-TTLS because the client needs no additional certificates,
	and it works well under Windows as it does under Mac.

User-Name = "\\test"

	Why am I seeing \\username, instead of just username?  Does this 
	have something to do with "Roaming Profile"?  If it does, how do
	I disable roaming profile from within the XP 802.1x authentication
	dialog.  Can this be corrected with a better understanding of how
	to strip usernames?

	Using radtest generates a Request-Accept packet, working fine.

-	I created my SSL cert using CA.pl (prior use was with CA.all).
	I am using a self signed cert.  Why do I see the following:

TLS Alert read:fatal:unknown CA
TLS_accept:failed in SSLv3 read client certificate A
74089:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48
74089:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837:
rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails.
In SSL Handshake Phase
In SSL Accept mode

	Is there a way to disable the validation of a CA in the built-in
	XP supplicant 802.1x authentication dialog?  Is that what is causing
	my problem, a non-trusted CA certificate?

Sincerely,
--johnk

----- End forwarded message -----

--

EAP-TTLS w/ files - cert and username issues

jck-freeradius＠southwestern.edu