Problem with eap-peap

19 Feb 2010

      Thank in advance and sorry for my english.

Realy I have spend several day reading from internet
(wiki.freeradius.org, deployingradius.com and google)
Itry all the thing, including apply a hotfix from microsoft
but I can't make it work.

I use a debian backport version of freeradius

radius-2:/etc/freeradius# freeradius -v
freeradius: FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu,
built on Jan 3 2010 at 14:14:04
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License.
For more information about these matters, see the file named COPYRIGHT.

my files are:

radius-2:/etc/freeradius# cat eap.conf
# -*- text -*-
##
## eap.conf -- Configuration for EAP types (PEAP, TTLS, etc.)
##
## $Id$

#######################################################################
eap {
 default_eap_type = peap
 timer_expire = 60
 ignore_unknown_eap_types = no
 max_sessions = 4096

 tls {
 certdir = ${confdir}/certs
 cadir = ${confdir}/certs
 private_key_password = *****
 private_key_file = ${certdir}/server.key
 certificate_file = ${certdir}/server.pem
 CA_file = ${cadir}/ca.pem
 dh_file = ${certdir}/dh
 random_file = ${certdir}/random
 cipher_list = "DEFAULT"
 cache {
 enable = no
 lifetime = 24 # hours
 max_entries = 255
 }
 }

 peap {
 default_eap_type = mschapv2
 copy_request_to_tunnel = no
 use_tunneled_reply = no
 virtual_server = "inner-tunnel"
 }
 mschapv2 {
 }
}
-----------------------------------------------
radius-2:/etc/freeradius# cat modules/mschap
# -*- text -*-
#
# $Id$

# Microsoft CHAP authentication
#
# This module supports MS-CHAP and MS-CHAPv2 authentication.
# It also enforces the SMB-Account-Ctrl attribute.
#
mschap {
 use_mppe = yes
 require_encryption = yes
 require_strong = yes
 with_ntdomain_hack = yes
 authtype = MS-CHAP
 ntlm_auth = "/usr/bin/ntlm_auth \
 --request-nt-key \
 --username=%{mschap:User-Name:-None} \
 --domain=%{mschap:NT-Domain:-HUVN} \
 --challenge=%{mschap:Challenge:-00} \
 --nt-response=%{mschap:NT-Response:-00}"
}
--------------------------------------------
radius-2:/etc/freeradius# cat
sites-enabled/default 
###################################################################### 
# 
# As of 2.0.0, FreeRADIUS supports virtual hosts using
the 
# "server" section, and configuration
directives. 
# 
# Virtual hosts should be put into the
"sites-available" 
# directory. Soft links should be created in the
"sites-enabled" 
# directory to these files. This is done in a normal
installation. 
# 
# $Id
$ 
# 
###################################################################### 
authorize
{ 
#ntlm_auth 

preprocess 
#chap 

mschap 

suffix 
#ntdomain 
# eap { 
# ok = return 
# } 

eap 
#unix 
#files 
#expiration 
#logintime 
#pap 
} 

authenticate {
 Auth-Type MS-CHAP {
 mschap 
 } 
 eap 
} 

#
# Pre-accounting. Decide which accounting type to use.
# 
preacct { 
 preprocess 
 acct_unique 
 suffix 
# ntdomain
# files
}

#
# Accounting. Log the accounting data.
#
accounting {
 detail
 radutmp
# sql
 attr_filter.accounting_response
}

session {
 radutmp
# sql
}

post-auth {
 exec
# Post-Auth-Type REJECT {
# attr_filter.access_reject
# }
}

pre-proxy {
}

post-proxy {
 eap
}

---------------------------------------------------
The output of a debug session:

 Linux radius-2 2.6.26-2-amd64 #1 SMP Tue Jan 12 22:12:20 UTC 2010 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Feb 18 09:17:57 2010 from 10.104.24.54

radius-2:~# freeradius -X
FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu, built on Jan 3 2010 at 14:14:04
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2.
Starting - reading configuration
files ... 
including configuration file /etc/freeradius/radiusd.conf
including configuration file /etc/freeradius/proxy.conf
including configuration file /etc/freeradius/clients.conf
including files in directory /etc/freeradius/modules/
including configuration file /etc/freeradius/modules/acct_unique
including configuration file /etc/freeradius/modules/expr
including configuration file /etc/freeradius/modules/attr_filter
including configuration file /etc/freeradius/modules/mschap
including configuration file /etc/freeradius/modules/pam
including configuration file /etc/freeradius/modules/digest
including configuration file /etc/freeradius/modules/mac2vlan
including configuration file /etc/freeradius/modules/perl
including configuration file /etc/freeradius/modules/chap
including configuration file /etc/freeradius/modules/mac2ip
including configuration file /etc/freeradius/modules/wimax
including configuration file /etc/freeradius/modules/expiration
including configuration file /etc/freeradius/modules/counter
including configuration file /etc/freeradius/modules/checkval
including configuration file /etc/freeradius/modules/attr_rewrite
including configuration file /etc/freeradius/modules/always
including configuration file /etc/freeradius/modules/unix
including configuration file /etc/freeradius/modules/sql_log
including configuration file /etc/freeradius/modules/preprocess
including configuration file /etc/freeradius/modules/smsotp
including configuration file /etc/freeradius/modules/policy
including configuration file /etc/freeradius/modules/logintime
including configuration file /etc/freeradius/modules/ldap
including configuration file /etc/freeradius/modules/passwd
including configuration file /etc/freeradius/modules/files
including configuration file /etc/freeradius/modules/linelog
including configuration file /etc/freeradius/modules/inner-eap
including configuration file /etc/freeradius/modules/otp
including configuration file /etc/freeradius/modules/smbpasswd
including configuration file /etc/freeradius/modules/detail.log
including configuration file /etc/freeradius/modules/radutmp
including configuration file /etc/freeradius/modules/realm
including configuration file /etc/freeradius/modules/krb5
including configuration file /etc/freeradius/modules/ippool
including configuration file /etc/freeradius/modules/echo
including configuration file /etc/freeradius/modules/detail.example.com
including configuration file /etc/freeradius/modules/exec
including configuration file /etc/freeradius/modules/pap
including configuration file /etc/freeradius/modules/etc_group
including configuration file /etc/freeradius/modules/detail
including configuration file /etc/freeradius/modules/cui
including configuration file /etc/freeradius/modules/sradutmp
including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login
including configuration file /etc/freeradius/modules/ntlm_auth
including configuration file /etc/freeradius/eap.conf
including configuration file /etc/freeradius/policy.conf
including files in directory /etc/freeradius/sites-enabled/
including configuration file /etc/freeradius/sites-enabled/default
including configuration file /etc/freeradius/sites-enabled/inner-tunnel
main {
 user = "freerad"
 group = "freerad"
 allow_core_dumps = no
}
including dictionary file /etc/freeradius/dictionary
main {
 prefix = "/usr"
 localstatedir = "/var"
 logdir = "/var/log/freeradius"
 libdir = "/usr/lib/freeradius"
 radacctdir = "/var/log/freeradius/radacct"
 hostname_lookups = no
 max_request_time = 30
 cleanup_delay = 5
 max_requests = 1024
 pidfile = "/var/run/freeradius/freeradius.pid"
 checkrad = "/usr/sbin/checkrad"
 debug_level = 0
 proxy_requests = yes
 log {
  stripped_names = no
  auth = no
  auth_badpass = no
  auth_goodpass = no
 }
 security {
  max_attributes = 200
  reject_delay = 1
  status_server = yes
 }
}
radiusd: #### Loading Realms and Home Servers ####
 proxy server {
  retry_delay = 5
  retry_count = 3
  default_fallback = no
  dead_time = 120
  wake_all_if_all_dead = no
 }
 home_server localhost {
  ipaddr = 127.0.0.1
  port = 1812
  type = "auth"
  secret = "testing123"
  response_window = 20
  max_outstanding = 65536
  require_message_authenticator = no
  zombie_period = 40
  status_check = "status-server"
  ping_interval = 30
  check_interval = 30
  num_answers_to_alive = 3
  num_pings_to_alive = 3
  revive_interval = 120
  status_check_timeout = 4
  irt = 2
  mrt = 16
  mrc = 5
  mrd = 30
 }
 home_server_pool my_auth_failover {
  type = fail-over
  home_server = localhost
 }
 realm example.com { 
  auth_pool = my_auth_failover
 } 
 realm LOCAL{ 
 }
radiusd: #### Loading Clients #### 
 client localhost {
  ipaddr = 127.0.0.1
  require_message_authenticator = no
  secret = "*******"
  nastype = "other"
 }
 client 10.104.16.128 {
  ipaddr = 10.104.16.128
  require_message_authenticator = no
  secret = "******"
  shortname = "Nostracom"
  nastype = "other"
 }
 client 192.168.69.1 {
  ipaddr = 192.168.69.1
  require_message_authenticator = no
  secret = "******"
  shortname = "Nostracom"
  nastype = "other"
 }
 radiusd: #### Instantiating modules ####
 instantiate {
  Module: Linked to module rlm_exec 
  Module: Instantiating exec 
 exec {
  wait = no
  input_pairs = "request"
  shell_escape = yes
 } 
 Module: Linked to module rlm_expr
 Module: Instantiating expr
 Module: Linked to module rlm_expiration
 Module: Instantiating expiration
 expiration {
  reply-message = "Password Has Expired"
 }
 Module: Linked to module rlm_logintime
 Module: Instantiating logintime
 logintime {
  reply-message = "You are calling outside your allowed timespan "
  minimum-timeout = 60
 }
 }
radiusd: #### Loading Virtual Servers ####
server inner-tunnel {
 modules {
  Module: Checking authenticate {...} for more modules to load
  Module: Linked to module rlm_pap
  Module: Instantiating pap
  pap {
   encryption_scheme = "auto"
   auto_header = no
  } 
 Module: Linked to module rlm_mschap
 Module: Instantiating mschap
 mschap {
  use_mppe = yes
  require_encryption = yes
  require_strong = yes
  with_ntdomain_hack = yes
  ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-HUVN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
 }
 Module: Linked to module rlm_eap 
 Module: Instantiating eap 
 eap {
  default_eap_type = "peap"
  timer_expire = 60
  ignore_unknown_eap_types = no
  cisco_accounting_username_bug = no
  max_sessions = 4096
 }
 Module: Linked to sub-module rlm_eap_tls 
 Module: Instantiating eap-tls 
 tls { 
  rsa_key_exchange = no
  dh_key_exchange = yes
  rsa_key_length = 512
  dh_key_length = 512
  verify_depth = 0
  pem_file_type = yes
  private_key_file = "/etc/freeradius/certs/server.key"
  certificate_file = "/etc/freeradius/certs/server.pem"
  CA_file = "/etc/freeradius/certs/ca.pem"
  private_key_password = "*****"
  dh_file = "/etc/freeradius/certs/dh"
  random_file = "/etc/freeradius/certs/random"
  fragment_size = 1024
  include_length = yes
  check_crl = no
  cipher_list = "DEFAULT"
  cache {
   enable = no
   lifetime = 24
   max_entries = 255
  }
 }
 Module: Linked to sub-module rlm_eap_peap
 Module: Instantiating eap-peap
 peap {
  default_eap_type = "mschapv2" 
  copy_request_to_tunnel = no 
  use_tunneled_reply = no 
  proxy_tunneled_request_as_eap = yes 
  virtual_server = "inner-tunnel" 
 }
 Module: Linked to sub-module rlm_eap_mschapv2 
 Module: Instantiating eap-mschapv2 
 mschapv2 { 
  with_ntdomain_hack = no 
 } 
 Module: Checking authorize {...} for more modules to load 
 Module: Linked to module rlm_realm 
 Module: Instantiating suffix 
 realm suffix { 
  format = "suffix" 
  delimiter = "@" 
  ignore_default = no 
  ignore_null = no 
 } 
 Module: Checking session {...} for more modules to load 
 Module: Linked to module rlm_radutmp 
 Module: Instantiating radutmp 
 radutmp { 
  filename = "/var/log/freeradius/radutmp" 
  username = "%{User-Name}" 
  case_sensitive = yes 
  check_with_nas = yes 
  perm = 384 
  callerid = yes 
 } 
 Module: Checking post-proxy {...} for more modules to load 
 Module: Checking post-auth {...} for more modules to load 
 Module: Linked to module rlm_attr_filter 
 Module: Instantiating attr_filter.access_reject 
 attr_filter attr_filter.access_reject { 
  attrsfile = "/etc/freeradius/attrs.access_reject" 
  key = "%{User-Name}" 
 } 
 } # modules 
} # server 
server { 
 modules { 
 Module: Checking authenticate {...} for more modules to load 
 Module: Checking authorize {...} for more modules to load 
 Module: Linked to module rlm_preprocess 
 Module: Instantiating preprocess 
 preprocess { 
  huntgroups = "/etc/freeradius/huntgroups" 
  hints = "/etc/freeradius/hints" 
  with_ascend_hack = no 
  ascend_channels_per_line = 23 
  with_ntdomain_hack = no 
  with_specialix_jetstream_hack = no 
  with_cisco_vsa_hack = no 
  with_alvarion_vsa_hack = no 
 } 
 Module: Checking preacct {...} for more modules to load 
 Module: Linked to module rlm_acct_unique 
 Module: Instantiating acct_unique 
 acct_unique { 
  key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" 
 } 
 Module: Checking accounting {...} for more modules to load 
 Module: Linked to module rlm_detail 
 Module: Instantiating detail 
 detail { 
  detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" 
  header = "%t" 
  detailperm = 384 
  dirperm = 493 
  locking = no 
  log_packet_header = no 
 } 
 Module: Instantiating attr_filter.accounting_response 
 attr_filter attr_filter.accounting_response { 
  attrsfile = "/etc/freeradius/attrs.accounting_response" 
  key = "%{User-Name}" 
 } 
 Module: Checking session {...} for more modules to load 
 Module: Checking post-proxy {...} for more modules to load 
 Module: Checking post-auth {...} for more modules to load 
 } # modules 
} # server 
radiusd: #### Opening IP addresses and Ports #### 
listen { 
 type = "auth" 
 ipaddr = * 
 port = 0 
} 
listen { 
 type = "acct" 
 ipaddr = * 
 port = 0 
} 
Listening on authentication address * port 1812 
Listening on accounting address * port 1813 
Listening on proxy address * port 1814 
Ready to process requests.

rad_recv: Access-Request packet from host 10.104.16.128 port 45236,
id=43, length=163 
 User-Name = "HUVN\\gdxtrujo" 
 NAS-IP-Address = 192.168.69.1 
 NAS-Port = 8193 
 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" 
 Calling-Station-Id = "00-15-AF-DC-45-2E" 
 Framed-MTU = 900 
 NAS-Port-Type = Wireless-802.11 
 Connect-Info = "CONNECT 802.11g" 
 EAP-Message = 0x02010012014855564e5c6764787472756a6f 
 Message-Authenticator = 0x7a690fbe4e69ed232adb1afdd61eb451 
+- entering group authorize {...} 
++[preprocess] returns ok 
++[mschap] returns noop 
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL 
[suffix] No such realm "NULL" 
++[suffix] returns noop 
[eap] EAP packet type response id 1 length 18 
[eap] No EAP Start, assuming it's an on-going EAP conversation 
++[eap] returns updated 
Found Auth-Type = EAP 
+- entering group authenticate {...} 
[eap] EAP Identity 
[eap] processing type tls 
[tls] Initiate 
[tls] Start returned 1 
++[eap] returns handled 
Sending Access-Challenge of id 43 to 10.104.16.128 port 45236 
 EAP-Message = 0x010200061920 
 Message-Authenticator = 0x00000000000000000000000000000000 
 State = 0x3cd4450c3cd65c57a4c67a935e13b1f8 
Finished request 0. 
Going to the next request 
Waking up in 4.9 seconds. 
rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=44, length=243 
 User-Name = "HUVN\\gdxtrujo" 
 NAS-IP-Address = 192.168.69.1 
 NAS-Port = 8193 
 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" 
 Calling-Station-Id = "00-15-AF-DC-45-2E" 
 Framed-MTU = 900 
 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11g" 
 EAP-Message = 0x0202005019800000004616030100410100003d03014b7d355f9bf52e8c1779e6d1ef7add93b63615a7468de75e9cedc37734cb42ea00001600040005000a000900640062000300060013001200630100 
 State = 0x3cd4450c3cd65c57a4c67a935e13b1f8 
 Message-Authenticator = 0xb8c94b0c183743721d148fd2cc54e118 
+- entering group authorize {...} 
++[preprocess] returns ok 
++[mschap] returns noop 
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL 
[suffix] No such realm "NULL" 
++[suffix] returns noop 
[eap] EAP packet type response id 2 length 80 
[eap] Continuing tunnel setup. 
++[eap] returns ok 
Found Auth-Type = EAP 
+- entering group authenticate {...} 
[eap] Request found, released from the list 
[eap] EAP/peap 
[eap] processing type peap 
[peap] processing EAP-TLS 
 TLS Length 70 
[peap] Length Included 
[peap] eaptls_verify returned 11 
[peap] (other): before/accept initialization 
[peap] TLS_accept: before/accept initialization 
[peap] <<< TLS 1.0 Handshake [length 0041], ClientHello 
[peap] TLS_accept: SSLv3 read client hello A 
[peap] >>> TLS 1.0 Handshake [length 002a], ServerHello 
[peap] TLS_accept: SSLv3 write server hello A 
[peap] >>> TLS 1.0 Handshake [length 08a0], Certificate 
[peap] TLS_accept: SSLv3 write certificate A 
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone 
[peap] TLS_accept: SSLv3 write server done A 
[peap] TLS_accept: SSLv3 flush data 
[peap] TLS_accept: Need to read more data: SSLv3 read client certificate A 
In SSL Handshake Phase 
In SSL Accept mode 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED 
++[eap] returns handled 
Sending Access-Challenge of id 44 to 10.104.16.128 port 45236 
 EAP-Message = 0x0103038019c0000008dd160301002a0200002603014b7d3535617b3f06c7d3d6ee649ea0649f5c4514f3c355a63851a62eae88fcef0000040016030108a00b00089c0008990003ce308203ca308202b2a003020102020101300d06092a864886f70d010104050030819b310b30090603550406130245533112301006035504081309416e64616c756369613110300e060355040713074772616e616461310d300b060355040a13044855564e3130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e6573312530230603550403131c436572746966696361646f20696e7465726e6f20 
 EAP-Message = 0x64656c204855564e301e170d3130303231383131303535385a170d3131303231383131303535385a30819b310b30090603550406130245533112301006035504081309416e64616c75636961310d300b060355040a13044855564e313730350603550403132e70756572746168766e312e6875766e2e6469726179612e737370612e6a756e74612d616e64616c756369612e65733130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e657330820122300d06092a864886f70d01010105000382010f003082010a0282010100c9a0f9e752a29d36e20366b97df6d8bbae1c6b11c248 
 EAP-Message = 0x4e8a7ea13dbcdbb3397cc3551bca4317b8679c538ea5779bb256455ec5d26c8f96667cd42451ffadffe085cf807acd4f6766e6a50587a3e606921a657932f28bc4caf1b8b20de5da7dbbfc656cdbe70048743959573e6e2621131f1a6a7dd4284284d6425844a914165aa0f340b7f544d9faf5508acd1160671dce2c69d2a35d9398714c449bddd3ca981500b414c4b0b49f0995311ace024ba7eb5e266b6140d233aea138ec151c41e6c06085ac04837a5471e11274af01de2c5734d172dafc1cfaea87304ade8cecbf330204e702806cb5d562bd2656f43dc67bb3a36000ce69357bbbb4fe104fe6790203010001a317301530130603551d25040c30 
 EAP-Message = 0x0a06082b06010505070301300d06092a864886f70d01010405000382010100c8c0f7f55aa25c2518202181dd228e722a9890093284585289c10f6e1865f026114a38b545b2b8b39e11db1f4c4fb58053362835f18116ffd8800b21bef9197b1864ed09029c7edf3b18de94dc9ce886d83173962c156299079207020051552ef31d5735718832c9bdd3 
 Message-Authenticator = 0x00000000000000000000000000000000 
 State = 0x3cd4450c3dd75c57a4c67a935e13b1f8 
Finished request 1. 
Going to the next request 
Waking up in 4.9 seconds. 
rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=45, length=169 
 User-Name = "HUVN\\gdxtrujo" 
 NAS-IP-Address = 192.168.69.1 
 NAS-Port = 8193 
 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" 
 Calling-Station-Id = "00-15-AF-DC-45-2E" 
 Framed-MTU = 900 
 NAS-Port-Type = Wireless-802.11 
 Connect-Info = "CONNECT802.11g" 
 EAP-Message = 0x020300061900 
 State = 0x3cd4450c3dd75c57a4c67a935e13b1f8 
 Message-Authenticator = 0x0d2248a94a51fd9be68bca50c67b8429 
+- entering group authorize {...} 
++[preprocess] returns ok 
++[mschap] returns noop 
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL 
[suffix] No such realm "NULL" 
++[suffix] returns noop 
[eap] EAP packet type response id 3 length 6 
[eap] Continuing tunnel setup. 
++[eap] returns ok 
Found Auth-Type = EAP 
+- entering group authenticate {...} 
[eap] Request found, released from the list 
[eap] EAP/peap 
[eap] processing type peap 
[peap] processing EAP-TLS 
[peap] Received TLS ACK 
[peap] ACK handshake fragment handler 
[peap] eaptls_verify returned 1 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED 
++[eap] returns handled 
Sending Access-Challenge of id 45 to 10.104.16.128 port 45236 
 EAP-Message = 0x0104037c1940407a2d7aaa916a7af56d6e11f0f2122fb35582b8c6d9fadcfb531363fb6c9178e625574622c8210d6d0d9688b73435c60e6d01daee7d8bdbe6b6e56d965a49efcf5019bea2bf61a8ea2753e7c33dd1c2149d96e83ecd56311111e3a9f4a0c264f82e85e1074b496f03fff45f273cbab792fab85804deb8b4026fd343b2a98849f4ed25ef76f19b38837c804620091ba9022ca4ac8a9d0004c5308204c1308203a9a0030201020209008235595e0380a483300d06092a864886f70d010105050030819b310b30090603550406130245533112301006035504081309416e64616c756369613110300e060355040713074772616e61646131 
 EAP-Message = 0x0d300b060355040a13044855564e3130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e6573312530230603550403131c436572746966696361646f20696e7465726e6f2064656c204855564e301e170d3130303231383131303535385a170d3130303332303131303535385a30819b310b30090603550406130245533112301006035504081309416e64616c756369613110300e060355040713074772616e616461310d300b060355040a13044855564e3130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e65 
 EAP-Message = 0x73312530230603550403131c436572746966696361646f20696e7465726e6f2064656c204855564e30820122300d06092a864886f70d01010105000382010f003082010a0282010100d64bbd4ad1ec76d41f2ace6c442099ec85b405735600b46a821906475dc357b59c3edb22d05c5c22e7be1d99b1b847b30b95ec137d93bf8d652f6c14c3bf0665b702fee14eb64636fc50e3886483e3aacc75080d73f920da50529bb5103bb0de9c15d51c506c8920c1f8bcb3154b1359f6c00268940a7bfa3450bc9a0153cf04fddd5dc4f46067ec8f5183d3790f814570781e7c9d02f6f9e301e0b828f55edae4fc84390cdd3470b2f1f9a8558f28856ff253e9 
 EAP-Message = 0x5822c9ff96244b5e236006154a32c754fc01cdc883745964901b0e39f3ac6135a2a76dd351e9c4049e658ae2501f6221619b4a41d4acbf0c7f618168f6c04b5352d5b246ef2243fb63d359310203010001a382010430820100301d0603551d0e0416041454f9c12706d36e7282442b9838fce221ba5f26183081d00603551d230481c83081 
 Message-Authenticator = 0x00000000000000000000000000000000 
 State = 0x3cd4450c3ed05c57a4c67a935e13b1f8 
Finished request 2. 
Going to the next request 
Waking up in 4.9 seconds. 
rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=46, length=169 
 User-Name = "HUVN\\gdxtrujo" 
 NAS-IP-Address = 192.168.69.1 
 NAS-Port = 8193 
 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" 
 Calling-Station-Id = "00-15-AF-DC-45-2E" 
 Framed-MTU = 900 
 NAS-Port-Type = Wireless-802.11 
 Connect-Info = "CONNECT 802.11g" 
 EAP-Message = 0x020400061900 
 State = 0x3cd4450c3ed05c57a4c67a935e13b1f8 
 Message-Authenticator = 0xe7a8886894f56a15a4e5dac3576cd04b 
+- entering group authorize {...} 
++[preprocess] returns ok 
++[mschap] returns noop 
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL 
[suffix] No such realm "NULL" 
++[suffix] returns noop 
[eap] EAP packet type response id 4 length 6 
[eap] Continuing tunnel setup. 
++[eap] returns ok 
Found Auth-Type = EAP 
+- entering group authenticate {...} 
[eap] Request found, released from the list 
[eap] EAP/peap 
[eap] processing type peap 
[peap] processing EAP-TLS 
[peap] Received TLS ACK 
[peap] ACK handshake fragment handler 
[peap] eaptls_verify returned 1 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED 
++[eap] returns handled 
Sending Access-Challenge of id 46 to 10.104.16.128 port 45236 
 EAP-Message = 0x010501f71900c5801454f9c12706d36e7282442b9838fce221ba5f2618a181a1a4819e30819b310b30090603550406130245533112301006035504081309416e64616c756369613110300e060355040713074772616e616461310d300b060355040a13044855564e3130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e6573312530230603550403131c436572746966696361646f20696e7465726e6f2064656c204855564e8209008235595e0380a483300c0603551d13040530030101ff300d06092a864886f70d010105050003820101005f562f88b85ff6fceaa39f3938ebe6 
 EAP-Message = 0x049eb9de52b47377c7896a46e87d244df4286d48d7f639856078ab9667b2bcee73921d017f66aeeee584acf6e5632a1b9ee18adc3a30679034580f348992803cfc4f7c8b49d518cab99093ba00db3e04ce612a01379a7443c8f38662f98801f58fc56bb574f6cb93314838c70f48d6089e2b03ca5efd96425a6d1205e244277ebf2856910f94e8027b681df32bb4e6247ce879c21ad5216fc7336aaec9dfd871e1f9690783c77dbfea0673c22a7bb282548be147de3f59074e1c21efbf586c07934fd3ae71e331b7c31fb5e15c83fdd52f44d6ee4a1d533a0c29a5f122610d4fbde8b8de8e361e6c79298aec559912533316030100040e000000 
 Message-Authenticator = 0x00000000000000000000000000000000 
 State = 0x3cd4450c3fd15c57a4c67a935e13b1f8 
Finished request 3. 
Going to the next request 
Waking up in 4.9 seconds. 
rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=47, length=485 
 User-Name = "HUVN\\gdxtrujo" 
 NAS-IP-Address = 192.168.69.1 
 NAS-Port = 8193 
 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" 
 Calling-Station-Id = "00-15-AF-DC-45-2E" 
 Framed-MTU = 900 
 NAS-Port-Type = Wireless-802.11 
 Connect-Info = "CONNECT 802.11g" 
 EAP-Message = 0x020501401980000001361603010106100001020100057a7c049e1e45ae4cdf01e672f90cdea597c9c86bf6f864a9b01e477f5d556b25c47bd19f8f22ef5905b86745dde3e454fd5aaa6c02379e47fdd9b2b0ac4d0777d8bcfc3e0e7c79986fac80eefc8bd9f9718229f4acd8bb53aa7d6e227f8aff3626cba1b13c1ca516ff8277e47a4291aa57c8da1381336cfaae51108058ca1d5e4c580fc242e1a9d5a35c2e37edc49063865fd29768d7952279c47fb9c8c17925e546e1723e10c781a9593d3e0c109d543462b2070930dfeb6dc3489259d73db520da2197ff47a960415b0c3a65db7837b980664e6ea5badf19ab9b0aa734a79bd73bb657bdf065 
 EAP-Message = 0x3da16cc050dde37f18a3011e5892db6e9f23a31aee647ed51403010001011603010020fc7cb78c3fcff4257432f413651ff1a68a331daa44063ee1ba7357d53c5c721f 
 State = 0x3cd4450c3fd15c57a4c67a935e13b1f8 
 Message-Authenticator = 0xa0b751cab837d32aaade6144d6f08f2e 
+- entering group authorize {...} 
++[preprocess] returns ok 
++[mschap] returns noop 
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL 
[suffix] No such realm "NULL" 
++[suffix] returns noop 
[eap] EAP packet type response id 5 length 253 
[eap] Continuing tunnel setup. 
++[eap] returns ok 
Found Auth-Type = EAP 
+- entering group authenticate {...} 
[eap] Request found, released from the list 
[eap] EAP/peap 
[eap] processing type peap 
[peap] processing EAP-TLS 
 TLS Length 310 
[peap] Length Included 
[peap] eaptls_verify returned 11 
[peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange 
[peap] TLS_accept: SSLv3 read client key exchange A 
[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] 
[peap] <<< TLS 1.0 Handshake [length 0010], Finished 
[peap] TLS_accept: SSLv3 read finished A 
[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] 
[peap] TLS_accept: SSLv3 write change cipher spec A 
[peap] >>> TLS 1.0 Handshake [length 0010], Finished 
[peap] TLS_accept: SSLv3 write finished A 
[peap] TLS_accept: SSLv3 flush data 
[peap] (other): SSL negotiation finished successfully 
SSL Connection Established 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED 
++[eap] returns handled 
Sending Access-Challenge of id 47 to 10.104.16.128 port 45236 
 EAP-Message = 0x010600311900140301000101160301002072ff86ea6e4c6cfc190a9297cf07fd15083137cd2f67edea5dd2f18e75102f06 
 Message-Authenticator = 0x00000000000000000000000000000000 
 State = 0x3cd4450c38d25c57a4c67a935e13b1f8 
Finished request 4. 
Going to the next request 
Waking up in 4.9 seconds. 
rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=48, length=169 
 User-Name = "HUVN\\gdxtrujo" 
 NAS-IP-Address = 192.168.69.1 
 NAS-Port = 8193 
 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" 
 Calling-Station-Id = "00-15-AF-DC-45-2E" 
 Framed-MTU = 900 
 NAS-Port-Type = Wireless-802.11 
 Connect-Info = "CONNECT 802.11g" 
 EAP-Message = 0x020600061900 
 State = 0x3cd4450c38d25c57a4c67a935e13b1f8 
 Message-Authenticator = 0xc3f2a00bcc6e4f986a6aa4d573441d6a 
+- entering group authorize {...} 
++[preprocess] returns ok 
++[mschap] returns noop 
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL 
[suffix] No such realm "NULL" 
++[suffix] returns noop 
[eap] EAP packet type response id 6 length 6 
[eap] Continuing tunnel setup. 
++[eap] returns ok 
Found Auth-Type = EAP 
+- entering group authenticate {...} 
[eap] Request found, released from the list 
[eap] EAP/peap 
[eap] processing type peap 
[peap] processing EAP-TLS 
[peap] Received TLS ACK 
[peap] ACK handshake is finished 
[peap] eaptls_verify returned 3 
[peap] eaptls_process returned 3 
[peap] EAPTLS_SUCCESS 
++[eap] returns handled 
Sending Access-Challenge of id 48 to 10.104.16.128 port 45236 
 EAP-Message = 0x0107002019001703010015832012a10a36559544d2d55db5f540a35b44d27aa0 
 Message-Authenticator = 0x00000000000000000000000000000000 
 State = 0x3cd4450c39d35c57a4c67a935e13b1f8 
Finished request 5. 
Going to the next request 
Waking up in 4.9 seconds. 
rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=49, length=204 
 User-Name = "HUVN\\gdxtrujo" 
 NAS-IP-Address = 192.168.69.1 
 NAS-Port = 8193 
 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" 
 Calling-Station-Id = "00-15-AF-DC-45-2E" 
 Framed-MTU = 900 
 NAS-Port-Type = Wireless-802.11 
 Connect-Info = "CONNECT 802.11g" 
 EAP-Message = 0x020700291900170301001e2acbee97084e2e33afc6ef6db5c15e21dc7840292d08f56549fa5f953b01 
 State = 0x3cd4450c39d35c57a4c67a935e13b1f8 
 Message-Authenticator = 0x917540a49ced99b1188e2bc396e9b16b 
+- entering group authorize {...} 
++[preprocess] returns ok 
++[mschap] returns noop 
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL 
[suffix] No such realm "NULL" 
++[suffix] returns noop 
[eap] EAP packet type response id 7 length 41 
[eap] Continuing tunnel setup. 
++[eap] returns ok 
Found Auth-Type = EAP 
+- entering group authenticate {...} 
[eap] Request found, released from the list 
[eap] EAP/peap 
[eap] processing type peap 
[peap] processing EAP-TLS 
[peap] eaptls_verify returned 7 
[peap] Done initial handshake 
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK 
[peap] Session established. Decoding tunneled attributes. 
[peap] Identity - HUVN\gdxtrujo 
[peap] Got tunneled request 
 EAP-Message = 0x02070012014855564e5c6764787472756a6f 
server { 
 PEAP: Got tunneled identity of HUVN\gdxtrujo 
 PEAP: Setting default EAP type for tunneled EAP session. 
 PEAP: Setting User-Name to HUVN\gdxtrujo 
Sending tunneled request 
 EAP-Message = 0x02070012014855564e5c6764787472756a6f 
 FreeRADIUS-Proxied-To = 127.0.0.1 
 User-Name = "HUVN\\gdxtrujo" 
server inner-tunnel { 
+- entering group authorize {...} 
++[mschap] returns noop 
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL 
[suffix] No such realm "NULL" 
++[suffix] returns noop 
++[control] returns noop 
[eap] EAP packet type response id 7 length 18 
[eap] No EAP Start, assuming it's an on-going EAP conversation 
++[eap] returns updated 
++[expiration] returns noop 
++[logintime] returns noop 
++[pap] returns noop 
Found Auth-Type = EAP 
+- entering group authenticate {...} 
[eap] EAP Identity 
[eap] processing type mschapv2 
rlm_eap_mschapv2: Issuing Challenge 
++[eap] returns handled 
} # server inner-tunnel 
[peap] Got tunneled reply code 11 
 EAP-Message = 0x010800271a0108002210108d0360de57661511ac8e07d44d5fa54855564e5c6764787472756a6f 
 Message-Authenticator = 0x00000000000000000000000000000000 
 State = 0xe3f15a23e3f94029084a6a7e3a6f63f8 
[peap] Got tunneled reply RADIUS code 11 
 EAP-Message = 0x010800271a0108002210108d0360de57661511ac8e07d44d5fa54855564e5c6764787472756a6f 
 Message-Authenticator = 0x00000000000000000000000000000000 
 State = 0xe3f15a23e3f94029084a6a7e3a6f63f8 
[peap] Got tunneled Access-Challenge 
++[eap] returns handled 
Sending Access-Challenge of id 49 to 10.104.16.128 port 45236 
 EAP-Message = 0x0108003e19001703010033d2f9963fe2a7c1570b905e3678ce7c0cc342fd75dee75aeef1fab414d1c6bc9087f988a525c3046586add694814100e03271cc 
 Message-Authenticator = 0x00000000000000000000000000000000 
 State = 0x3cd4450c3adc5c57a4c67a935e13b1f8 
Finished request 6. 
Going to the next request 
Waking up in 4.9 seconds. 
rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=50, length=258 
 User-Name = "HUVN\\gdxtrujo" 
 NAS-IP-Address = 192.168.69.1 
 NAS-Port = 8193 
 Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS" 
 Calling-Station-Id = "00-15-AF-DC-45-2E" 
 Framed-MTU = 900 
 NAS-Port-Type = Wireless-802.11 
 Connect-Info = "CONNECT 802.11g" 
 EAP-Message = 0x0208005f190017030100543af645994c32ed46321e5112cff49a097d65e4a8c10596daba1d5514e2fcebedeba22162932f16450175f7488236bcd243aeb981cebf39d532e62916477ef5555ab630072f0bc847a80ce9975b4051a215abe698 
 State = 0x3cd4450c3adc5c57a4c67a935e13b1f8 
 Message-Authenticator = 0x180916b71df70e8ab7d54867f9c22baa 
+- entering group authorize {...} 
++[preprocess] returns ok 
++[mschap] returns noop 
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL 
[suffix] No such realm "NULL" 
++[suffix] returns noop 
[eap] EAP packet type response id 8 length 95 
[eap] Continuing tunnel setup. 
++[eap] returns ok 
Found Auth-Type = EAP 
+- entering group authenticate {...} 
[eap] Request found, released from the list 
[eap] EAP/peap 
[eap] processing type peap 
[peap] processing EAP-TLS 
[peap] eaptls_verify returned 7 
[peap] Done initial handshake 
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK 
[peap] Session established. Decoding tunneled attributes. 
[peap] EAP type mschapv2 
[peap] Got tunneled request 
 EAP-Message = 0x020800481a020800433138fec6ce84b614e4f6a3957becea631b00000000000000003e1277f2d4835fc8a8de7dfae71b2890c6ef6d3841140af2004855564e5c6764787472756a6f 
server { 
 PEAP: Setting User-Name to HUVN\gdxtrujo 
Sending tunneled request 
 EAP-Message = 0x020800481a020800433138fec6ce84b614e4f6a3957becea631b00000000000000003e1277f2d4835fc8a8de7dfae71b2890c6ef6d3841140af2004855564e5c6764787472756a6f 
 FreeRADIUS-Proxied-To = 127.0.0.1 
 User-Name = "HUVN\\gdxtrujo" 
 State = 0xe3f15a23e3f94029084a6a7e3a6f63f8 
server inner-tunnel { 
+- entering group authorize {...} 
++[mschap] returns noop 
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL 
[suffix] No such realm "NULL" 
++[suffix] returns noop 
++[control] returns noop 
[eap] EAP packet type response id 8 length 72 
[eap] No EAP Start, assuming it's an on-going EAP conversation 
++[eap] returns updated 
++[expiration] returns noop 
++[logintime] returns noop 
++[pap] returns noop 
Found Auth-Type = EAP 
+- entering group authenticate {...} 
[eap] Request found, released from the list 
[eap] EAP/mschapv2 
[eap] processing type mschapv2 
[mschapv2] +- entering group MS-CHAP {...} 
[mschap] Told to do MS-CHAPv2 for gdxtrujo with NT-Password 
[mschap] expand: --username=%{mschap:User-Name:-None} -> --username=gdxtrujo 
[mschap] expand: --domain=%{mschap:NT-Domain:-HUVN} -> --domain=HUVN 
[mschap] mschap2: 10 
[mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=cacf5023c11e7ea7 
[mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=3e1277f2d4835fc8a8de7dfae71b2890c6ef6d3841140af2 
Exec-Program output: NT_KEY: 2A28DA9AD2160A673F22F87D37D8E9BC 
Exec-Program-Wait: plaintext: NT_KEY: 2A28DA9AD2160A673F22F87D37D8E9BC 
Exec-Program: returned: 0 
[mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok
MSCHAP Success ++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
 EAP-Message = 0x010900331a0308002e533d36453744323533424634333934323345424634454132444141413038424441414534373235363644
 Message-Authenticator = 0x00000000000000000000000000000000
 State = 0xe3f15a23e2f84029084a6a7e3a6f63f8
[peap] Got tunneled reply RADIUS code 11
 EAP-Message = 0x010900331a0308002e533d36453744323533424634333934323345424634454132444141413038424441414534373235363644
 Message-Authenticator = 0x00000000000000000000000000000000
 State = 0xe3f15a23e2f84029084a6a7e3a6f63f8
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 50 to 10.104.16.128 port 45236
 EAP-Message = 0x0109004a1900170301003f27dd660624182f35234bd9f80b3c7ad5c4ca8c538fc86c6bae1ba3991e4d3fd17f1a934ac2f7453801032ca9894b0d4a8687ceccbb61bb439c4c9fc642d244
 Message-Authenticator = 0x00000000000000000000000000000000
 State = 0x3cd4450c3bdd5c57a4c67a935e13b1f8
Finished request 7.
Going to the next request
Waking up in 4.8 seconds.
Cleaning up request 0 ID 43 with timestamp +35
Cleaning up request 1 ID 44 with timestamp +35
Cleaning up request 2 ID 45 with timestamp +35
Cleaning up request 3 ID 46 with timestamp +35
Cleaning up request 4 ID 47 with timestamp +35
Cleaning up request 5 ID 48 with timestamp +35
Cleaning up request 6 ID 49 with timestamp +35
Cleaning up request 7 ID 50 with timestamp +35
Ready to process requests.

-- 
Por favor, NO utilice formatos  de archivo  propietarios para el
intercambio de  documentos, como DOC y XLS, sino HTML, RTF, TXT,
CSV o cualquier otro que no obligue a utilizar un programa de un
fabricante  concreto para tratar la información contenida en él.
SALUD.

Problem with eap-peap

Trujillo Carmona, Antonio