Hi Phil, Alan,

Ok. ntlm_auth is returning something different to what I saw in testing. Have you set the "must change password at next login" bit, as opposed to "expired" bit?

Try this:

1. Edit src/modules/rlm_mschap/rlm_mschap.c about line 1100, where it says:

if (strstr(buffer, "Password expired")) {

...to read:

if (strstr(buffer, "Password expired") || strstr(buffer, "Must change password")) {

2. Re-compile and re-install

3. Test again

There's no great way to parse the output of ntlm_auth. I guess we could make the string a regexp comparison against the output, and at least make it an item in the config file (with a sensible default) so that if more such cases come up, or Samba change their output, it can be fixed without a recompile.

i changed the source src/modules/rlm_mschap/rlm_mschap.c, recompiled and re-installed it. But it still not working. Why the passchange part will not handled ? Here is the debug output: FreeRADIUS Version 3.0.0, for host x86_64-portbld-freebsd9.0, built on Jun 13 2012 at 10:06:56 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/wimax including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/attr_rewrite including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/checkval including configuration file /usr/local/etc/raddb/mods-enabled/counter including configuration file /usr/local/etc/raddb/mods-enabled/cui including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/inner-eap including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/acct_unique including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/var" sbindir = "/usr/local/sbin" logdir = "/var/log" run_dir = "/var/run/radiusd" libdir = "/usr/local/lib/freeradius-3.0.0" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client AP { ipaddr = 10.0.5.100 netmask = 32 require_message_authenticator = no secret = "**************" shortname = "AP" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/mods-enabled/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/mods-enabled/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" passchange { ntlm_auth = "/usr/local/bin/ntlm_auth --helper-protocol=ntlm-change-password-1" ntlm_auth_username = "username: %{mschap:User-Name}" ntlm_auth_domain = "nt-domain: %{mschap:NT-Domain}" local_cpw = "%{exec:/path/to/script %{mschap:User-Name} %{MS-CHAP-New-Cleartext-Password}}" } allow_retry = yes retry_msg = "Re-enter (or reset) the password" } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/mods-enabled/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_pwd Module: Instantiating eap-pwd pwd { group = 19 fragment_size = 1020 server_id = "theserver@example.com" virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.key" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } debug: Using cached TLS configuration from previous invocation Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } debug: Using cached TLS configuration from previous invocation Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Loading virtual module acct_unique Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { detailfile = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Loading virtual module remove_reply_message_if_eap Module: Linked to module rlm_always Module: Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } Module: Loading virtual module remove_reply_message_if_eap } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Creating Post-Proxy-Type = Fail Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { detailfile = "/var/log/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 max_pps = 0 } listen { type = "acct" ipaddr = * port = 0 max_pps = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 max_pps = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy address * port 1814 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=201, length=359 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x024b0015015a4f4f504c55535c6173646631323334 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x8c7ada2e1d18cc1f23c9920c78d3aca8 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) group authorize { (0) - entering group authorize {...} (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : EAP packet type response id 75 length 21 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) Found Auth-Type = EAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) group authenticate { (0) - entering group authenticate {...} (0) eap : EAP Identity (0) eap : processing type peap (0) peap : Flushing SSL sessions (of #0) (0) peap : Initiate (0) peap : Start returned 1 (0) [eap] = handled Sending Access-Challenge of id 201 to 10.0.5.100 port 32783 EAP-Message = 0x014c00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f9340379d95095c27e471c371 (0) Finished request 0. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=219, length=486 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x024c008219800000007816030100730100006f03014fd85561ec74aceb37fdd54e7985c3dac0333a03256e4c822ecc40ac227a5e93000018002f00350005000ac013c014c009c00a00320038001300040100002eff010001000000001500130000107a6f6f706c75735c6173646631323334000a0006000400170018000b00020100 State = 0x930c2e1f9340379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x05df0aead4255d6ea51dde0c23afb31c (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) group authorize { (1) - entering group authorize {...} (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) eap : EAP packet type response id 76 length 130 (1) eap : Continuing tunnel setup. (1) [eap] = ok (1) Found Auth-Type = EAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) group authenticate { (1) - entering group authenticate {...} (1) eap : Request found, released from the list (1) eap : EAP/peap (1) eap : processing type peap (1) peap : processing EAP-TLS TLS Length 120 (1) peap : Length Included (1) peap : eaptls_verify returned 11 (1) peap : (other): before/accept initialization (1) peap : TLS_accept: before/accept initialization (1) peap : <<< TLS 1.0 Handshake [length 0073], ClientHello (1) peap : TLS_accept: SSLv3 read client hello A (1) peap : >>> TLS 1.0 Handshake [length 0051], ServerHello (1) peap : TLS_accept: SSLv3 write server hello A (1) peap : >>> TLS 1.0 Handshake [length 0cc5], Certificate (1) peap : TLS_accept: SSLv3 write certificate A (1) peap : >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (1) peap : TLS_accept: SSLv3 write server done A (1) peap : TLS_accept: SSLv3 flush data (1) peap : TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode (1) peap : eaptls_process returned 13 (1) peap : FR_TLS_HANDLED (1) [eap] = handled Sending Access-Challenge of id 219 to 10.0.5.100 port 32783 EAP-Message = 0x014d03ec19c000000d2916030100510200004d03014fd855f89cbf46621ff862e29a11a62efe9fe9c274fe8c1c7b03051753a3a701202c54374903787f84edf1c20ee8cf8a71bb39c8c63f30e574697b821577436c1b002f000005ff010001001603010cc50b000cc1000cbe0007aa308207a63082068ea003020102020310004e300d06092a864886f70d01010405003081a3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c0603550403 EAP-Message = 0x1315777777706b692e7765622e7a6f6f706c75732e64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e6465301e170d3132303232383039323934315a170d3135303232383039323934315a3081c3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731293027060355040a13206639323232396139633932306238656464613063346563383830643865383362310b3009060355040b130249543121301f060355040313187a7072616469757330312e7a6f6f706c75732e6c6f63616c EAP-Message = 0x3120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e646530820222300d06092a864886f70d01010105000382020f003082020a0282020100df0e40f450e8633fdc375cb76ddca4885ce8cb275601f5b5e78a0ff8f4e8f13036c27a4e3c2e503e005d11e5c19a8b535e68a015b67f15b313d88a21df7b788ce45174c0137beadfb8186928e9acc169237805e0a00ea8f8245c7d4b1d64214e368339fe807dab5cc82c235823474903f76d8e363ff25a79094959af1edf13d4b23c4f9942467ffd088f91fd7072618e9e95d6360e44ede071785ce41f0899d4abe3e8d941f728ad204ad1e48f1fd12384ab392ed048d917b361 EAP-Message = 0x77efb35d76edcf6f6bf4518c46e53186e9c8ca7560481f8a87eb9cba46f56716fcff6a05ae25a1917ca1ede18c05640b41242465118dc66de1f3f22aa77598df0f0130070b95af02502eb9dd86f087502a2ce4ddf67dc94ccb60edba0f4e92e5f9ca75e950bc89a21671430395782d6d8fb78ba77b497ab6577e673acd4b9ebda8eb638d2aa6ba89798d0adc603a765c7b109f7b204abab14831b08fe1b34be34f3e1acb92bf878644e94f5de7381e3df2647f307d9343332112b978d68b02c63658d617268e610bf337d85f0a62a2e1a7b5a8fa1261e1835101920e3b37fd4e95e3fead50a5cac3239e57541679679824eacd1aa6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f9241379d95095c27e471c371 (1) Finished request 1. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=186, length=362 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x024d00061900 State = 0x930c2e1f9241379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x6466c7912ccfa79c06a36fc1af9f6467 (2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (2) group authorize { (2) - entering group authorize {...} (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (2) suffix : No such realm "NULL" (2) [suffix] = noop (2) eap : EAP packet type response id 77 length 6 (2) eap : Continuing tunnel setup. (2) [eap] = ok (2) Found Auth-Type = EAP (2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (2) group authenticate { (2) - entering group authenticate {...} (2) eap : Request found, released from the list (2) eap : EAP/peap (2) eap : processing type peap (2) peap : processing EAP-TLS (2) peap : Received TLS ACK (2) peap : Received TLS ACK (2) peap : ACK handshake fragment handler (2) peap : eaptls_verify returned 1 (2) peap : eaptls_process returned 13 (2) peap : FR_TLS_HANDLED (2) [eap] = handled Sending Access-Challenge of id 186 to 10.0.5.100 port 32783 EAP-Message = 0x014e03e81940766385383e2cde4857beed6f5d0055147b933e7daa9922162c79d246e82182b9093f71aa15acaac374d5e514c545fde8d4246e4471d9ead260e06fc5a292a62aac5911d4b904b8015bf168d6c7022f8b8b0203010001a38202bf308202bb300c0603551d130101ff04023000300e0603551d0f0101ff0404030205a0301406096086480186f84201010101ff04040302064030160603551d250101ff040c300a06082b06010505070301301d0603551d0e0416041424e274626b9d850eb8eb9fd2a5d4e4555dccc3233081d80603551d230481d03081cd8014343094169c0bc40653b5ebaf41601f3b65d91227a181a9a481a63081a331 EAP-Message = 0x0b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c06035504031315777777706b692e7765622e7a6f6f706c75732e64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e64658209008f68987367f3a4b330360603551d11042f302d82187a7072616469757330312e7a6f6f706c75732e6c6f63616c811173797361646d407a6f6f706c75732e6465301c0603551d1204153013811173797361646d407a6f6f70 EAP-Message = 0x6c75732e6465304a0603551d1f04433041303fa03da03b8639687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f696e6465782e7068703f73746167653d646c5f63726c303906096086480186f842010d042c162a5048506b692f4f70656e53534c2047656e65726174656420536572766572204365727469666963617465303206096086480186f842010204251623687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f302306096086480186f8420103041616146e735f7265766f6b655f71756572792e7068703f303d06096086480186f84201080430162e687474703a2f EAP-Message = 0x2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f706f6c6963792e68746d6c300d06092a864886f70d01010405000382010100a9926e3eab9f9ed846e4d3618ab5df744295922b7393517c86a7e9e879ae6862200092525a365845841ed019acb8401c12057b4fd132a39fdb89eed85e85beb4ec203049f8dfd9c3038bee65de5bb59962b0a77e9a4d95b99340ed94d38845b185f1483898f18272d216f4d831bfe43f02df131b8445b7417677965db6f94676b0c7337240f09fbd8fd5755e0c0fe88469f12a0b4b929dcd4327517f0cdc4327432be87207cf40f81f60d90c16d7045566b611ee90 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f9142379d95095c27e471c371 (2) Finished request 2. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=210, length=362 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x024e00061900 State = 0x930c2e1f9142379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0xc6bf7d0a64ded4d427400730c9f64a00 (3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (3) group authorize { (3) - entering group authorize {...} (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (3) suffix : No such realm "NULL" (3) [suffix] = noop (3) eap : EAP packet type response id 78 length 6 (3) eap : Continuing tunnel setup. (3) [eap] = ok (3) Found Auth-Type = EAP (3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (3) group authenticate { (3) - entering group authenticate {...} (3) eap : Request found, released from the list (3) eap : EAP/peap (3) eap : processing type peap (3) peap : processing EAP-TLS (3) peap : Received TLS ACK (3) peap : Received TLS ACK (3) peap : ACK handshake fragment handler (3) peap : eaptls_verify returned 1 (3) peap : eaptls_process returned 13 (3) peap : FR_TLS_HANDLED (3) [eap] = handled Sending Access-Challenge of id 210 to 10.0.5.100 port 32783 EAP-Message = 0x014f03e81940dd918bae3094651e2d38da6cb6470e5a5705d04419ecc02984c06dd99d858684b4ffeea1f0049440d3542eb307f94b4e343a78ad2bf5d8dff067c49eed40825295fc525c89ffe00316ab9800050e3082050a308203f2a0030201020209008f68987367f3a4b3300d06092a864886f70d01010405003081a3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c06035504031315777777706b692e7765622e7a6f6f706c75732e EAP-Message = 0x64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e6465301e170d3039303331333134323030315a170d3134303331333134323030315a3081a3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c06035504031315777777706b692e7765622e7a6f6f706c75732e64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e646530820122300d06092a864886f70d0101010500 EAP-Message = 0x0382010f003082010a0282010100b53247f132a0563881dd2cd39b014fce9dd553316e5acfad692af9121c4144dd5518fddd97459ae4c5b58dde04746615af13ce199e492269694b7a90f39a0ee2abb1222fc5b966b75f04e7d5b3ea9855bea211c5fbbfcb8f9d9059034e2af246494ba7d21812bce51f716000309a2842a43b53b3d69ded50954cf1bf0259e32410074bdd61676dac3af823013cc07fecd18329dee9a0129ae38fe37db7cf2161b1a6a313a2e48f07c80a630467dae941cfa094df8eebd542b85275f6dc776d6eb96f28b879c1f3178fcae1c8c984e8aaec01cd18c3ccdf90a9fea7a1239b605bc2c3a4092dc2551e84007d9a047359 EAP-Message = 0xf47dda3aba5d94d2785f684b8bd95603410203010001a382013d30820139300c0603551d13040530030101ff300b0603551d0f040403020106301106096086480186f8420101040403020007301d0603551d0e04160414343094169c0bc40653b5ebaf41601f3b65d91227301c0603551d1104153013811173797361646d407a6f6f706c75732e6465304a0603551d1f04433041303fa03da03b8639687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f696e6465782e7068703f73746167653d646c5f63726c304106096086480186f842010d043416325048506b692f4f70656e53 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f9043379d95095c27e471c371 (3) Finished request 3. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=64, length=362 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x024f00061900 State = 0x930c2e1f9043379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0xdf19c2e6d02c9dc91e86aaa3922e4797 (4) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (4) group authorize { (4) - entering group authorize {...} (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (4) suffix : No such realm "NULL" (4) [suffix] = noop (4) eap : EAP packet type response id 79 length 6 (4) eap : Continuing tunnel setup. (4) [eap] = ok (4) Found Auth-Type = EAP (4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (4) group authenticate { (4) - entering group authenticate {...} (4) eap : Request found, released from the list (4) eap : EAP/peap (4) eap : processing type peap (4) peap : processing EAP-TLS (4) peap : Received TLS ACK (4) peap : Received TLS ACK (4) peap : ACK handshake fragment handler (4) peap : eaptls_verify returned 1 (4) peap : eaptls_process returned 13 (4) peap : FR_TLS_HANDLED (4) [eap] = handled Sending Access-Challenge of id 64 to 10.0.5.100 port 32783 EAP-Message = 0x015001891900534c2047656e65726174656420526f6f7420436572746966696361746520417574686f72697479303d06096086480186f84201080430162e687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f706f6c6963792e68746d6c300d06092a864886f70d010104050003820101009ebc1a5dd90c801d205cb2a90c8bc3ab00db1ecb7d733632e6c5cfc033ded56fe93dc9752096ea56f194ebc980b843d7b1444b46689baea6c180997eaa77ae4b5aed2657c924a0f160b64adeef2af57df3ea220a94dd1c6571213f432e0888abc037f9ad970406d797bce1163d31c9df848258296d336f929dadd33ba7 EAP-Message = 0xad9e6bd0a8e101e4514e569f64097e12bb6e05ae9e51a4170b056570bd14a33faa584075a9dfafa8dd979d4664f76f5730953903ce77c7b4e8e2e3356ed9be221fd6f872dab6451da6950f46893af28efb6df277e22169e81884cd3abe4c464523d7622dfe93d1a5f29b2d623292eca09b3bfe84fb67b6d4749ff6b61de2971388045316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f975c379d95095c27e471c371 (4) Finished request 4. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=60, length=952 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x025002501980000002461603010206100002020200309897ca72ca8c5c64c113ad383216b0131678f5050e5775dd6bd2fab48640b9db094b7d7e4db6d45e067cbd69d46c27de3e6bbbb7b8b1914dba63cb4ab3a9f69b7320ddc37a0d5c19aa1a23298b024faa6e63c1a2c1a90a2b20263f83a6b76504ef01e2c955bb2d539b762e7929fb0248b1c59b0338a481aa87069d3f53de5dca8fc996771af0576a056a52016d7bb48d12bf9c4a524efcb45b59fde15a2370249f2440a777627c2b367438a648435f6e86e91536e260c24a7ff2a857e9a5a7e62f72746043cb815cc41ff1d8d0e622f9cd4446fdabcb0f2fe6520293280a2d75598437b6caa18d EAP-Message = 0xb81872487e9af91e30148211a5241926410132ae15aa19ea3f89e8d8b17410b2f4aeb832840ad33cbc2c9c6889de1ff0b39bb0931e1767b64df862541373026ce1acbcc96a0073e9f4c0ac43da5262af1754af7ebe8e71b5f665dc249eacf8240233cdf9ad50a976bde939058e3107e87ae36798bee9362c121d31dbe144e06abb0c12451f6815220a954badf5e64d6db6fd5d790d71c2591ef900648764003d55028d2a04a84262bca9fcbad62b512aca739f772dc2999e2c9eb142840bc75bc17aab9891076f166a3794fc9b0a9ef70ed8cdac493ba2f584588eed62c6c9b8456a53707b91c4cff00e4cfe2e9fdcf2cdeea548d50699cb7505b1b041 EAP-Message = 0x05ccd32355f6b0502ce405c48693f9a14270993aabd9a07438499c14030100010116030100301fa06a5058a700bd21307760604ca7fbf39f6e2c7e5bc730ddb4d7a7e54c415957a88cfd7910e4d9cec812d88bf2c48a State = 0x930c2e1f975c379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0xf7328527ad83d2d65ae600cee18db09c (5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (5) group authorize { (5) - entering group authorize {...} (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (5) suffix : No such realm "NULL" (5) [suffix] = noop (5) eap : EAP packet type response id 80 length 253 (5) eap : Continuing tunnel setup. (5) [eap] = ok (5) Found Auth-Type = EAP (5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (5) group authenticate { (5) - entering group authenticate {...} (5) eap : Request found, released from the list (5) eap : EAP/peap (5) eap : processing type peap (5) peap : processing EAP-TLS TLS Length 582 (5) peap : Length Included (5) peap : eaptls_verify returned 11 (5) peap : <<< TLS 1.0 Handshake [length 0206], ClientKeyExchange (5) peap : TLS_accept: SSLv3 read client key exchange A (5) peap : <<< TLS 1.0 ChangeCipherSpec [length 0001] (5) peap : <<< TLS 1.0 Handshake [length 0010], Finished (5) peap : TLS_accept: SSLv3 read finished A (5) peap : >>> TLS 1.0 ChangeCipherSpec [length 0001] (5) peap : TLS_accept: SSLv3 write change cipher spec A (5) peap : >>> TLS 1.0 Handshake [length 0010], Finished (5) peap : TLS_accept: SSLv3 write finished A (5) peap : TLS_accept: SSLv3 flush data SSL: adding session 2c54374903787f84edf1c20ee8cf8a71bb39c8c63f30e574697b821577436c1b to cache (5) peap : (other): SSL negotiation finished successfully SSL Connection Established (5) peap : eaptls_process returned 13 (5) peap : FR_TLS_HANDLED (5) [eap] = handled Sending Access-Challenge of id 60 to 10.0.5.100 port 32783 EAP-Message = 0x0151004119001403010001011603010030f6aa4ff160c5f9b19e7120e24cd4a464b3ccc46aa829cf6d04735641949509bbddafb18c85d8ecc9b9c13ce4d9be6acb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f965d379d95095c27e471c371 (5) Finished request 5. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=136, length=362 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x025100061900 State = 0x930c2e1f965d379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x258bd54678fdab223698ae4e86af97a5 (6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (6) group authorize { (6) - entering group authorize {...} (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (6) suffix : No such realm "NULL" (6) [suffix] = noop (6) eap : EAP packet type response id 81 length 6 (6) eap : Continuing tunnel setup. (6) [eap] = ok (6) Found Auth-Type = EAP (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (6) group authenticate { (6) - entering group authenticate {...} (6) eap : Request found, released from the list (6) eap : EAP/peap (6) eap : processing type peap (6) peap : processing EAP-TLS (6) peap : Received TLS ACK (6) peap : Received TLS ACK (6) peap : ACK handshake is finished (6) peap : eaptls_verify returned 3 (6) peap : eaptls_process returned 3 (6) peap : FR_TLS_SUCCESS (6) peap : Session established. Decoding tunneled attributes. (6) peap : Peap state TUNNEL ESTABLISHED (6) [eap] = handled Sending Access-Challenge of id 136 to 10.0.5.100 port 32783 EAP-Message = 0x0152002b19001703010020f55fb6c5caa3a2f060a22bdbb38b9d10cbc036d5ab0917a9c3e286e7114685b4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f955e379d95095c27e471c371 (6) Finished request 6. Waking up in 0.1 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=168, length=415 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x0252003b190017030100301f80985ec72756e184b2749ffaadbad99bacae6260b0e902544c14a0a32ac8462345c78966b49be0890162adc850fc69 State = 0x930c2e1f955e379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x62f97908b69011a30e4a5e669ce06722 (7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (7) group authorize { (7) - entering group authorize {...} (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) eap : EAP packet type response id 82 length 59 (7) eap : Continuing tunnel setup. (7) [eap] = ok (7) Found Auth-Type = EAP (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (7) group authenticate { (7) - entering group authenticate {...} (7) eap : Request found, released from the list (7) eap : EAP/peap (7) eap : processing type peap (7) peap : processing EAP-TLS (7) peap : eaptls_verify returned 7 (7) peap : Done initial handshake (7) peap : eaptls_process returned 7 (7) peap : FR_TLS_OK (7) peap : Session established. Decoding tunneled attributes. (7) peap : Peap state WAITING FOR INNER IDENTITY (7) peap : Identity - TEST\user1 (7) peap : Got inner identity 'TEST\user1' (7) peap : Setting default EAP type for tunneled EAP session. (7) peap : Got tunneled request EAP-Message = 0x02520015015a4f4f504c55535c6173646631323334 server { (7) peap : Setting User-Name to TEST\user1 Sending tunneled request EAP-Message = 0x02520015015a4f4f504c55535c6173646631323334 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "TEST\\user1" server inner-tunnel { (7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (7) group authorize { (7) - entering group authorize {...} (7) [chap] = noop (7) [mschap] = noop (7) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) update control { (7) } # update control = noop (7) eap : EAP packet type response id 82 length 21 (7) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (7) [eap] = ok (7) Found Auth-Type = EAP (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (7) group authenticate { (7) - entering group authenticate {...} (7) eap : EAP Identity (7) eap : processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge (7) [eap] = handled } # server inner-tunnel (7) peap : Got tunneled reply code 11 EAP-Message = 0x0153002a1a01530025100138f26de51fe8877ff61f134946da9a5a4f4f504c55535c6173646631323334 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8abb48828ae852f8102b63fc437692fc (7) peap : Got tunneled reply RADIUS code 11 EAP-Message = 0x0153002a1a01530025100138f26de51fe8877ff61f134946da9a5a4f4f504c55535c6173646631323334 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8abb48828ae852f8102b63fc437692fc (7) peap : Got tunneled Access-Challenge (7) [eap] = handled Sending Access-Challenge of id 168 to 10.0.5.100 port 32783 EAP-Message = 0x0153004b19001703010040ea858820fac13721de9038841c4e86bf9161eccaf99ee6e9dac2d2dde316259fbd0b0b1f0a23db379a96544d6fedc5bc8265eb396da9a5d8dd96fc162e1a36d0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f945f379d95095c27e471c371 (7) Finished request 7. Waking up in 0.1 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=99, length=463 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x0253006b19001703010060a3dc72b8efb48dc8c146899dc9630574e40f2ce3e7522dd7ede7e9773a93da740c378ec97534753bc00eae72a62d57337c455740b3ee8727f0d42343dd9c6be9af6952283e953c1433f7438e629bcf0dfd361db0ad4d16dfe2340e598396ce90 State = 0x930c2e1f945f379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x3732ac156e76595657a5221130446fab (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (8) group authorize { (8) - entering group authorize {...} (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (8) suffix : No such realm "NULL" (8) [suffix] = noop (8) eap : EAP packet type response id 83 length 107 (8) eap : Continuing tunnel setup. (8) [eap] = ok (8) Found Auth-Type = EAP (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) group authenticate { (8) - entering group authenticate {...} (8) eap : Request found, released from the list (8) eap : EAP/peap (8) eap : processing type peap (8) peap : processing EAP-TLS (8) peap : eaptls_verify returned 7 (8) peap : Done initial handshake (8) peap : eaptls_process returned 7 (8) peap : FR_TLS_OK (8) peap : Session established. Decoding tunneled attributes. (8) peap : Peap state phase2 (8) peap : EAP type mschapv2 (8) peap : Got tunneled request EAP-Message = 0x0253004b1a02530046319b261aedb04447e6f33644abcb83415b0000000000000000e3426708aea6af13c9ba6ca1af31212f460cd1a834482660005a4f4f504c55535c6173646631323334 server { (8) peap : Setting User-Name to TEST\user1 Sending tunneled request EAP-Message = 0x0253004b1a02530046319b261aedb04447e6f33644abcb83415b0000000000000000e3426708aea6af13c9ba6ca1af31212f460cd1a834482660005a4f4f504c55535c6173646631323334 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "TEST\\user1" State = 0x8abb48828ae852f8102b63fc437692fc server inner-tunnel { (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) group authorize { (8) - entering group authorize {...} (8) [chap] = noop (8) [mschap] = noop (8) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (8) suffix : No such realm "NULL" (8) [suffix] = noop (8) update control { (8) } # update control = noop (8) eap : EAP packet type response id 83 length 75 (8) eap : No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) [pap] = noop (8) Found Auth-Type = EAP (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) group authenticate { (8) - entering group authenticate {...} (8) eap : Request found, released from the list (8) eap : EAP/mschapv2 (8) eap : processing type mschapv2 (8) mschapv2 : # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) mschapv2 : group MS-CHAP { (8) mschapv2 : - entering group MS-CHAP {...} (8) mschap : Creating challenge hash with username: test1 (8) mschap : Told to do MS-CHAPv2 for test1 with NT-Password (8) mschap : expand: %{Stripped-User-Name} -> (8) mschap : ... expanding second conditional (8) mschap : expand: %{User-Name} -> TEST\user1 (8) mschap : expand: %{%{User-Name}:-None} -> TEST\user1 (8) mschap : expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=TEST\user1 (8) mschap : Creating challenge hash with username: user1 (8) mschap : expand: %{mschap:Challenge} -> 05ac8b071ffed031 (8) mschap : expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=05ac8b071ffed031 (8) mschap : expand: %{mschap:NT-Response} -> e3426708aea6af13c9ba6ca1af31212f460cd1a834482660 (8) mschap : expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=e3426708aea6af13c9ba6ca1af31212f460cd1a834482660 Exec-Program output: Must change password (0xc0000224) Exec-Program-Wait: plaintext: Must change password (0xc0000224) Exec-Program: returned: 1 (8) mschap : ntlm_auth says password must change (8) [mschap] = reject rlm_eap_mschapv2: No MS-CHAPv2-Success or MS-CHAP-Error was found. (8) eap : Handler failed in EAP/mschapv2 (8) eap : Failed in EAP select (8) [eap] = invalid (8) Failed to authenticate the user. } # server inner-tunnel (8) peap : Got tunneled reply code 3 MS-CHAP-Error = "SE=648 R=0 C=9b268dcbbfadefbba4138c2b12f90353 V=3 M=Password Expired" EAP-Message = 0x04530004 Message-Authenticator = 0x00000000000000000000000000000000 (8) peap : Got tunneled reply RADIUS code 3 MS-CHAP-Error = "SE=648 R=0 C=9b268dcbbfadefbba4138c2b12f90353 V=3 M=Password Expired" EAP-Message = 0x04530004 Message-Authenticator = 0x00000000000000000000000000000000 (8) peap : Tunneled authentication was rejected. (8) peap : FAILURE (8) [eap] = handled Sending Access-Challenge of id 99 to 10.0.5.100 port 32783 EAP-Message = 0x0154002b19001703010020014b48b95de643020707b13524faf7b1a23f4ba34ee63c2c2a260b9335c74e35 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x930c2e1f9b58379d95095c27e471c371 (8) Finished request 8. Waking up in 0.1 seconds. rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=44, length=399 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "cf76c8d5-000000fc" NAS-Port = 236 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 User-Name = "TEST\\user1" Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Message = 0x0254002b19001703010020fdf63531aebd5e4de6cb29edf9a3fc7aace323aaba3853272fb46f862d7479aa State = 0x930c2e1f9b58379d95095c27e471c371 Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167 Attr-26.8744.250 = 0x00000003 Attr-26.8744.249 = 0xc0a81489 Message-Authenticator = 0x6f7dc3389c985148f3853c3f8e6644a3 (9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (9) group authorize { (9) - entering group authorize {...} (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL (9) suffix : No such realm "NULL" (9) [suffix] = noop (9) eap : EAP packet type response id 84 length 43 (9) eap : Continuing tunnel setup. (9) [eap] = ok (9) Found Auth-Type = EAP (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) group authenticate { (9) - entering group authenticate {...} (9) eap : Request found, released from the list (9) eap : EAP/peap (9) eap : processing type peap (9) peap : processing EAP-TLS (9) peap : eaptls_verify returned 7 (9) peap : Done initial handshake (9) peap : eaptls_process returned 7 (9) peap : FR_TLS_OK (9) peap : Session established. Decoding tunneled attributes. (9) peap : Peap state send tlv failure (9) peap : Received EAP-TLV response. (9) peap : The users session was previously rejected: returning reject (again.) (9) peap : *** This means you need to read the PREVIOUS messages in the debug output (9) peap : *** to find out the reason why the user was rejected. (9) peap : *** Look for "reject" or "fail". Those earlier messages will tell you. (9) peap : *** what went wrong, and how to fix the problem. SSL: Removing session 2c54374903787f84edf1c20ee8cf8a71bb39c8c63f30e574697b821577436c1b from the cache (9) eap : Handler failed in EAP/peap (9) eap : Failed in EAP select (9) [eap] = invalid (9) Failed to authenticate the user. (9) Using Post-Auth-Type Reject (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) group REJECT { (9) - entering group REJECT {...} (9) attr_filter.access_reject : expand: %{User-Name} -> TEST\user1 (9) attr_filter.access_reject : Matched entry DEFAULT at line 11 (9) [attr_filter.access_reject] = updated (9) eap : Reply already contained an EAP-Message, not inserting EAP-Failure (9) [eap] = noop (9) policy remove_reply_message_if_eap { (9) - entering policy remove_reply_message_if_eap {...} (9) ? if (reply:EAP-Message && reply:Reply-Message) (9) ? Evaluating (reply:EAP-Message ) -> TRUE (9) ? Evaluating (reply:Reply-Message) -> FALSE (9) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE (9) else else { (9) - entering else else {...} (9) [noop] = noop (9) - else else returns noop (9) - policy remove_reply_message_if_eap returns noop (9) Finished request 9. Waking up in 0.6 seconds. (9) Sending delayed reject Sending Access-Reject of id 44 to 10.0.5.100 port 32783 EAP-Message = 0x04540004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. (0) Cleaning up request packet ID 201 with timestamp +12 (1) Cleaning up request packet ID 219 with timestamp +12 (2) Cleaning up request packet ID 186 with timestamp +12 (3) Cleaning up request packet ID 210 with timestamp +12 (4) Cleaning up request packet ID 64 with timestamp +12 (5) Cleaning up request packet ID 60 with timestamp +12 (6) Cleaning up request packet ID 136 with timestamp +12 (7) Cleaning up request packet ID 168 with timestamp +12 (8) Cleaning up request packet ID 99 with timestamp +12 Waking up in 1.0 seconds. (9) Cleaning up request packet ID 44 with timestamp +12 Ready to process requests. -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de