After my first install of FR (2.1.10) I quickly got into a twisty maze of config files, all different. I resolved, after quite a bit of research and poking around, to wipe the install clean and start over. Which I did. So now I've got, by carefully following the help pages on the site, the ability to login and enable on my switches using our Active Directory credentials, and the ability to do port authorization using the same credentials - provided that the user information is cached on the workstation of course. I generated the certificates and installed the root cert on the clients and they appear to be working correctly. I'm really quite happy with the results so far. What I'm looking for now is the last step, authenticating the hosts so that AD users whose credentials haven't been cached can still log in and then port authorize. Like the man says, other people are doing it so I know it's not impossible. What seems to be happening from reading the debug is that domain/user requests are coming in using EAP, doing the TLS interchange, then using MSCHAPv2 to verify the credentials. The host requests, on the other hand, do the TLS side but never seem to progress to the mschap portion. I've gone mildly crosseyed reading the debugs but I don't see where it is that I've gone wrong. I'm very new to RADIUS but I've been doing Linux and Windows for a while so I know that this *should* work. The configuration is: AD 2008 with a Slackware Linux server running the lastest Samba and Kerberos as well as obviously FR. The client is a Windows XP box with the latest service pack. Below is a mildly sanitized copy of radiusd -X with both failed machine logins (LP-0010 is the host) and a successful user (myuser) login. Thanks for having a look at this. =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2011.04.18 15:25:43 =~=~=~=~=~=~=~=~=~=~=~= rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=190, length=237 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "host/LP-0010.myorg.org" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" EAP-Message = 0x0201001b01686f73742f4c502d303031302e70666663752e6f7267 Message-Authenticator = 0x9b19fa15e960a41e27e211d8f1b33a10 # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:26:38 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "/LP-0010.myorg.org", looking up realm NULL [suffix] Found realm "NULL" [suffix] Setting Stripped-User-Name = "/LP-0010.myorg.org" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 1 length 27 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 176 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 190 to 192.168.999.7 port 4815 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4f47b7a34f45aeed84d0f0a572607961 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=191, length=315 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "host/LP-0010.myorg.org" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x4f47b7a34f45aeed84d0f0a572607961 EAP-Message = 0x0202005719800000004d16030100480100004403014dac90982dabda3d66a5f26d5da94e79cd801480e05dc321acbf9a30f85fe45000001600040005000a0009006400620003000600130012006301000005ff01000100 Message-Authenticator = 0xc430c8a708ade14f4e3e71aefbaba831 # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:26:38 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "/LP-0010.myorg.org", looking up realm NULL [suffix] Found realm "NULL" [suffix] Setting Stripped-User-Name = "/LP-0010.myorg.org" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 2 length 87 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 77 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0048], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0883], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 191 to 192.168.999.7 port 4815 EAP-Message = 0x0103040019c0000008c0160301002a0200002603014dac906e63451b67f59266bd8f3c0b11c93f0e91e1379a7c5fef9506ed97dcf30000040016030108830b00087f00087c0003b5308203b130820299a003020102020102300d06092a864886f70d010104050030819a310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311530130603550407130c5068696c6164656c70686961311c301a060355040a1313506f6c69636520616e642046697265204643553123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f7267311a3018060355040313116d6966666c696e2e7066 EAP-Message = 0x6663752e6f7267301e170d3131303431383136313132345a170d3132303431373136313132345a308183310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311c301a060355040a1313506f6c69636520616e64204669726520464355311a3018060355040313116d6966666c696e2e70666663752e6f72673123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100ad3cc6d602bac5213757cd07b59881ae01cfb16ce8f0affd755a2e2ea0dbcd1a60fb5142fe4288b48b96c07498e569 EAP-Message = 0xab2601b42a73a161b0e171d2957d082cabffde39e5e6e9058e958f7b32349efb8765425bc3822ad39287bef9cb5b67369f886d1439c1876e15f057c6a329a52d2f9e23625678497d6945485768447b5903a84a9b2c6c6287291b1b60366ae4e3f0809c8d38f24ea9c040692c2bbd117eeda78fac45695a9e3b8b4a85b3b7fa9f8c7a19d7ad77fe40dbf573c6c573866f926d1a9ca4391ad47d1489526504ea76893c1a39b033ec72a59cad35f9a8e749a0259e787c03cec0df7d7c7763565afeafd06f450afdc881115dcb2f77f3fdb5cb0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405 EAP-Message = 0x000382010100cd1bcf97d2ab9635403f1732591d98606e95cc939882656b198bf7b7bf585e159f950e7db747b25720ea1e4b05d91fa6a8bc7b367ed21d749731a803f726438a4942d49bb298322f278163435b6ec5ef9f810f5195ab021dd0aac53cc53494cccf30e6ed6186e9d32cd9cd41c2953173a01e7a7c82998ac7bf0f30451887dd5c0b8750d8bd6afac032a70eab0ea2704f277a0067f102b9e5ad68f9723a3ad65e439f90b782e5cdf2c2a21e5e1ac9ebf1e0d4fdeb370dec3538bd91f4cb925c2b52639e4fcd260462a10b54dc5e04e4110a94bd9fe6a3fe16b28abfb3370aa23b378d60f6fbf461f0e22ce4d988603f88b160210ed7a1e8 EAP-Message = 0xcdc08eb134ef355d3f0004c1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4f47b7a34e44aeed84d0f0a572607961 Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=192, length=234 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "host/LP-0010.myorg.org" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x4f47b7a34e44aeed84d0f0a572607961 EAP-Message = 0x020300061900 Message-Authenticator = 0x68ae528241948aee7a09919d712b4b26 # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:26:38 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "/LP-0010.myorg.org", looking up realm NULL [suffix] Found realm "NULL" [suffix] Setting Stripped-User-Name = "/LP-0010.myorg.org" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 192 to 192.168.999.7 port 4815 EAP-Message = 0x010403fc1940308204bd308203a5a003020102020900ad8d39f4fcae271a300d06092a864886f70d010105050030819a310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311530130603550407130c5068696c6164656c70686961311c301a060355040a1313506f6c69636520616e642046697265204643553123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f7267311a3018060355040313116d6966666c696e2e70666663752e6f7267301e170d3131303431383136313132345a170d3132303431373136313132345a30819a310b3009060355040613025553311530 EAP-Message = 0x130603550408130c50656e6e73796c76616e6961311530130603550407130c5068696c6164656c70686961311c301a060355040a1313506f6c69636520616e642046697265204643553123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f7267311a3018060355040313116d6966666c696e2e70666663752e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100e43cf5fcf5abf3d6beec6062d1709cd3ccf6bd5d6ba2f54c0f9ec9fa708defdaec3974d3315737519d86b114191dcda2811b89e9b8d2d7ca7ea04002c8c934cde3d550d3bf018f1583026bab19a4a38c5ae5 EAP-Message = 0xa53548a0a1652dc0908a9e06f58d9c473ec7ec55fcefa9c443311684ad6e9dd09ea14cb3d9fcb04a2429f9d1995c062f5b215658143eafdd0116334b0f1849cfef9a24579ea1d6ca31421f52b70d9d00a961408f747f2f2066231124d83c63c3c8b1d69b6f4b5ea50588b2f33b8a40ba8781455db36472bd9b4e85f81f1b82ebf326cd3ac504eb2dea1c5a9e7496f485a62d63d11bead3a4b79ce85453d6617c8b8fca4e1d3e5bb0c68c041c948f0203010001a38201023081ff301d0603551d0e041604146fb361c7649ba640bdf6ea8870cac051daeb9a9e3081cf0603551d230481c73081c480146fb361c7649ba640bdf6ea8870cac051daeb9a9e EAP-Message = 0xa181a0a4819d30819a310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311530130603550407130c5068696c6164656c70686961311c301a060355040a1313506f6c69636520616e642046697265204643553123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f7267311a3018060355040313116d6966666c696e2e70666663752e6f7267820900ad8d39f4fcae271a300c0603551d13040530030101ff300d06092a864886f70d010105050003820101008584a10eba26e3bac7f3a37b0250a525185f77e4cbe920d0d0e3a617dfe22e62954eb79a73d781e27f55c5e1b7 EAP-Message = 0x3c6900c0e5fd63fc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4f47b7a34d43aeed84d0f0a572607961 Finished request 8. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=193, length=234 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "host/LP-0010.myorg.org" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x4f47b7a34d43aeed84d0f0a572607961 EAP-Message = 0x020400061900 Message-Authenticator = 0x8eb6e8c023218ae06d7e860ea6207ee4 # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:26:38 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "/LP-0010.myorg.org", looking up realm NULL [suffix] Found realm "NULL" [suffix] Setting Stripped-User-Name = "/LP-0010.myorg.org" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 193 to 192.168.999.7 port 4815 EAP-Message = 0x010500da190000e668530fe5cdedf1fff694c02a985e9dbdaaaaf9915bb3b297c4ddf1ee0601670f0ad3a6b34f9b5959d25b8624147171fc575436a01288e78f2d4344841dd5307a83e6c1d553dbc0731016c4bb35ef324e49b727ccfe896f56ef9603188886b9cf2c7423c77fd441bfa16636772db885276f42a39801d6a334fc20074352933ff6cecfa79ed4b11493ed5a2db327e4b421c3c7fac2f636766698ba79a0cef62a2413ad01d9c31ff9599414e30b6d9d974f2d5430117e202bda0b60bbd6c920c65f7ed6bd1e87e7513d9f16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4f47b7a34c42aeed84d0f0a572607961 Finished request 9. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=194, length=234 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "host/LP-0010.myorg.org" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x4f47b7a34c42aeed84d0f0a572607961 EAP-Message = 0x020500061900 Message-Authenticator = 0xc3110d80e879e2d17c0e27c3579b7ffa # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:26:38 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "/LP-0010.myorg.org", looking up realm NULL [suffix] Found realm "NULL" [suffix] Setting Stripped-User-Name = "/LP-0010.myorg.org" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 194 to 192.168.999.7 port 4815 EAP-Message = 0x010600061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4f47b7a34b41aeed84d0f0a572607961 Finished request 10. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=195, length=221 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "myorg\\myuser" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" EAP-Message = 0x020100130150464643555c69732d61646d696e Message-Authenticator = 0x499c467deab737e75c9aeb71373291f0 # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:26:38 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "myorg\myuser", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myorg\myuser" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 1 length 19 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 176 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 195 to 192.168.999.7 port 4815 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d92c46b3d90dd76a0f8adddfc0e8388 Finished request 11. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=196, length=307 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "myorg\\myuser" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x3d92c46b3d90dd76a0f8adddfc0e8388 EAP-Message = 0x0202005719800000004d16030100480100004403014dac9098bb5794a6b42e6acdac8cc80598817ec40f55e96ca15c25849e70539f00001600040005000a0009006400620003000600130012006301000005ff01000100 Message-Authenticator = 0x432a5b1dba6a2d810a407f4446ec9607 # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:26:38 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "myorg\myuser", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myorg\myuser" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 2 length 87 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 77 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0048], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0883], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 196 to 192.168.999.7 port 4815 EAP-Message = 0x0103040019c0000008c0160301002a0200002603014dac906ee7a8c363c834c5e2a9317a2844710cf666f003ae6244e933862998960000040016030108830b00087f00087c0003b5308203b130820299a003020102020102300d06092a864886f70d010104050030819a310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311530130603550407130c5068696c6164656c70686961311c301a060355040a1313506f6c69636520616e642046697265204643553123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f7267311a3018060355040313116d6966666c696e2e7066 EAP-Message = 0x6663752e6f7267301e170d3131303431383136313132345a170d3132303431373136313132345a308183310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311c301a060355040a1313506f6c69636520616e64204669726520464355311a3018060355040313116d6966666c696e2e70666663752e6f72673123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100ad3cc6d602bac5213757cd07b59881ae01cfb16ce8f0affd755a2e2ea0dbcd1a60fb5142fe4288b48b96c07498e569 EAP-Message = 0xab2601b42a73a161b0e171d2957d082cabffde39e5e6e9058e958f7b32349efb8765425bc3822ad39287bef9cb5b67369f886d1439c1876e15f057c6a329a52d2f9e23625678497d6945485768447b5903a84a9b2c6c6287291b1b60366ae4e3f0809c8d38f24ea9c040692c2bbd117eeda78fac45695a9e3b8b4a85b3b7fa9f8c7a19d7ad77fe40dbf573c6c573866f926d1a9ca4391ad47d1489526504ea76893c1a39b033ec72a59cad35f9a8e749a0259e787c03cec0df7d7c7763565afeafd06f450afdc881115dcb2f77f3fdb5cb0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405 EAP-Message = 0x000382010100cd1bcf97d2ab9635403f1732591d98606e95cc939882656b198bf7b7bf585e159f950e7db747b25720ea1e4b05d91fa6a8bc7b367ed21d749731a803f726438a4942d49bb298322f278163435b6ec5ef9f810f5195ab021dd0aac53cc53494cccf30e6ed6186e9d32cd9cd41c2953173a01e7a7c82998ac7bf0f30451887dd5c0b8750d8bd6afac032a70eab0ea2704f277a0067f102b9e5ad68f9723a3ad65e439f90b782e5cdf2c2a21e5e1ac9ebf1e0d4fdeb370dec3538bd91f4cb925c2b52639e4fcd260462a10b54dc5e04e4110a94bd9fe6a3fe16b28abfb3370aa23b378d60f6fbf461f0e22ce4d988603f88b160210ed7a1e8 EAP-Message = 0xcdc08eb134ef355d3f0004c1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d92c46b3c91dd76a0f8adddfc0e8388 Finished request 12. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=197, length=226 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "myorg\\myuser" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x3d92c46b3c91dd76a0f8adddfc0e8388 EAP-Message = 0x020300061900 Message-Authenticator = 0x62380d61685d98ab29fbcaf67d069608 # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:26:38 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "myorg\myuser", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myorg\myuser" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 197 to 192.168.999.7 port 4815 EAP-Message = 0x010403fc1940308204bd308203a5a003020102020900ad8d39f4fcae271a300d06092a864886f70d010105050030819a310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311530130603550407130c5068696c6164656c70686961311c301a060355040a1313506f6c69636520616e642046697265204643553123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f7267311a3018060355040313116d6966666c696e2e70666663752e6f7267301e170d3131303431383136313132345a170d3132303431373136313132345a30819a310b3009060355040613025553311530 EAP-Message = 0x130603550408130c50656e6e73796c76616e6961311530130603550407130c5068696c6164656c70686961311c301a060355040a1313506f6c69636520616e642046697265204643553123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f7267311a3018060355040313116d6966666c696e2e70666663752e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100e43cf5fcf5abf3d6beec6062d1709cd3ccf6bd5d6ba2f54c0f9ec9fa708defdaec3974d3315737519d86b114191dcda2811b89e9b8d2d7ca7ea04002c8c934cde3d550d3bf018f1583026bab19a4a38c5ae5 EAP-Message = 0xa53548a0a1652dc0908a9e06f58d9c473ec7ec55fcefa9c443311684ad6e9dd09ea14cb3d9fcb04a2429f9d1995c062f5b215658143eafdd0116334b0f1849cfef9a24579ea1d6ca31421f52b70d9d00a961408f747f2f2066231124d83c63c3c8b1d69b6f4b5ea50588b2f33b8a40ba8781455db36472bd9b4e85f81f1b82ebf326cd3ac504eb2dea1c5a9e7496f485a62d63d11bead3a4b79ce85453d6617c8b8fca4e1d3e5bb0c68c041c948f0203010001a38201023081ff301d0603551d0e041604146fb361c7649ba640bdf6ea8870cac051daeb9a9e3081cf0603551d230481c73081c480146fb361c7649ba640bdf6ea8870cac051daeb9a9e EAP-Message = 0xa181a0a4819d30819a310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311530130603550407130c5068696c6164656c70686961311c301a060355040a1313506f6c69636520616e642046697265204643553123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f7267311a3018060355040313116d6966666c696e2e70666663752e6f7267820900ad8d39f4fcae271a300c0603551d13040530030101ff300d06092a864886f70d010105050003820101008584a10eba26e3bac7f3a37b0250a525185f77e4cbe920d0d0e3a617dfe22e62954eb79a73d781e27f55c5e1b7 EAP-Message = 0x3c6900c0e5fd63fc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d92c46b3f96dd76a0f8adddfc0e8388 Finished request 13. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=198, length=226 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "myorg\\myuser" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x3d92c46b3f96dd76a0f8adddfc0e8388 EAP-Message = 0x020400061900 Message-Authenticator = 0xbe92f79b327d12d9b52860a6da585020 # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:26:38 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "myorg\myuser", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myorg\myuser" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 198 to 192.168.999.7 port 4815 EAP-Message = 0x010500da190000e668530fe5cdedf1fff694c02a985e9dbdaaaaf9915bb3b297c4ddf1ee0601670f0ad3a6b34f9b5959d25b8624147171fc575436a01288e78f2d4344841dd5307a83e6c1d553dbc0731016c4bb35ef324e49b727ccfe896f56ef9603188886b9cf2c7423c77fd441bfa16636772db885276f42a39801d6a334fc20074352933ff6cecfa79ed4b11493ed5a2db327e4b421c3c7fac2f636766698ba79a0cef62a2413ad01d9c31ff9599414e30b6d9d974f2d5430117e202bda0b60bbd6c920c65f7ed6bd1e87e7513d9f16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d92c46b3e97dd76a0f8adddfc0e8388 Finished request 14. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=199, length=542 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "myorg\\myuser" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x3d92c46b3e97dd76a0f8adddfc0e8388 EAP-Message = 0x0205014019800000013616030101061000010201006f3085720008d8d84e3e49acdfdb2edec1b2139b24961fe1b740b3dfa7dd3876317b31dc7d7dcf506c896db4e566f7b6f55a1a825b3008c0c636394b3632598f21c2007deeae355a9dd4620a77497b690af33e80ceee1858d0c7e22c4127351a232ebf2945cb67c1453d7821c0fbe4c43ab16dd9ee4548b47b88543d6446c937607906643e5e493cdf71cf314ce118067defa2699f3f526d434fd35738d7ceea27c5c81dbe467121ae4c0211b01125ae5cd69c1fa072b55555cc88ba5ef88d36b5dffd61f3910d33d03ae34a98f6cdf8464450246091f0476ba2f23fa508cbb5fd6d8af78bcb8340 EAP-Message = 0xb20cc9d052c17e90a85a712c54bbccc60db4d3b1143c0def1403010001011603010020c2a4b53b6f7ae074212b6efafa58fca2e7159d0ec9ad7fb722fd656cee822266 Message-Authenticator = 0xc4d2b44c19f412c19124768f90452aeb # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:26:38 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "myorg\myuser", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myorg\myuser" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 5 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 199 to 192.168.999.7 port 4815 EAP-Message = 0x010600311900140301000101160301002011bb05ad7601c21b044169fdeaeb8b742d8c77b1f3a0e1d6aa0ca99275d8e4fd Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d92c46b3994dd76a0f8adddfc0e8388 Finished request 15. Going to the next request Waking up in 4.5 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=200, length=226 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "myorg\\myuser" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x3d92c46b3994dd76a0f8adddfc0e8388 EAP-Message = 0x020600061900 Message-Authenticator = 0x1441f574c8d8fe4deb67ac4c93b1c97b # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:26:38 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "myorg\myuser", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myorg\myuser" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 200 to 192.168.999.7 port 4815 EAP-Message = 0x0107002019001703010015438cdf4b76ee410201b7404f9201ba2ab57b21c23e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d92c46b3895dd76a0f8adddfc0e8388 Finished request 16. Going to the next request Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=201, length=262 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "myorg\\myuser" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x3d92c46b3895dd76a0f8adddfc0e8388 EAP-Message = 0x0207002a1900170301001ffd2903eef345b285a1ea830ae034d81b0c82d07536e6d1910d73f6ca91ae35 Message-Authenticator = 0xfc42b5e789ca1adf1799d547666a52df # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:26:38 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "myorg\myuser", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myorg\myuser" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 7 length 42 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - myorg\myuser [peap] Got inner identity 'myorg\myuser' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x020700130150464643555c69732d61646d696e server { PEAP: Setting User-Name to myorg\myuser Sending tunneled request EAP-Message = 0x020700130150464643555c69732d61646d696e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "myorg\\myuser" server inner-tunnel { # Executing section authorize from file /etc//raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "myorg\myuser", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myorg\myuser" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok ++[control] returns ok [eap] EAP packet type response id 7 length 19 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010800281a01080023104f51f22477b092be11ff22d4cd5c6abd50464643555c69732d61646d696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x151e107415160ab1898b0ca5f8a4a93e [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010800281a01080023104f51f22477b092be11ff22d4cd5c6abd50464643555c69732d61646d696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x151e107415160ab1898b0ca5f8a4a93e [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 201 to 192.168.999.7 port 4815 EAP-Message = 0x0108003f19001703010034c0b213ed0ee5b7a85bc3b1a2795bbd8fa105c03e75258645b4842b0e0a65cdec603d3a4db1b16449aad6f7fde592a34c05cb2746 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d92c46b3b9add76a0f8adddfc0e8388 Finished request 17. Going to the next request Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=202, length=316 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "myorg\\myuser" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x3d92c46b3b9add76a0f8adddfc0e8388 EAP-Message = 0x0208006019001703010055e80d55e2567140412faecb44f85ce51c49c6ce3e2c3e8b73ba60ed0b7cf182f53da766607dfe9d409a74fb5275d5bb81ed88c916b8fa6afb2e28282a9c177cc338508dcc51ddb71938d39fd37e23e8e43ecf831f15 Message-Authenticator = 0x89540286b863857c3664ed55104b225d # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:26:38 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "myorg\myuser", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myorg\myuser" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 8 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020800491a0208004431eae3cd7d62cb47eca74974d095ae9da70000000000000000dfeddce5e49617ac7128b51bef69ce9e271abaa6ac3b7dae0050464643555c69732d61646d696e server { PEAP: Setting User-Name to myorg\myuser Sending tunneled request EAP-Message = 0x020800491a0208004431eae3cd7d62cb47eca74974d095ae9da70000000000000000dfeddce5e49617ac7128b51bef69ce9e271abaa6ac3b7dae0050464643555c69732d61646d696e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "myorg\\myuser" State = 0x151e107415160ab1898b0ca5f8a4a93e server inner-tunnel { # Executing section authorize from file /etc//raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "myorg\myuser", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myorg\myuser" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok ++[control] returns ok [eap] EAP packet type response id 8 length 73 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc//raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: myuser [mschap] Told to do MS-CHAPv2 for myuser with NT-Password [mschap] expand: %{Stripped-User-Name} -> myorg\myuser [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} -> --username=myorg\myuser [mschap] mschap2: 4f [mschap] Creating challenge hash with username: myuser [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=82b995da529436e0 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=dfeddce5e49617ac7128b51bef69ce9e271abaa6ac3b7dae Exec-Program output: NT_KEY: 1BAAAFEF1E3822F616E15241938525DC Exec-Program-Wait: plaintext: NT_KEY: 1BAAAFEF1E3822F616E15241938525DC Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010900331a0308002e533d36443436343830433435353933413732323439383332373641363141323339374233313539413132 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x151e107414170ab1898b0ca5f8a4a93e [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010900331a0308002e533d36443436343830433435353933413732323439383332373641363141323339374233313539413132 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x151e107414170ab1898b0ca5f8a4a93e [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 202 to 192.168.999.7 port 4815 EAP-Message = 0x0109004a1900170301003f4f528fe339896d23fe771e1f9f7fe77d6b4d695277a8f1585ff0cf3e256516785532dc7dfd9aaa3c8c7b940757cb6ecbe2d743c5e381501f2ba957eb8ee213 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d92c46b3a9bdd76a0f8adddfc0e8388 Finished request 18. Going to the next request Waking up in 4.2 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=203, length=249 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "myorg\\myuser" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x3d92c46b3a9bdd76a0f8adddfc0e8388 EAP-Message = 0x0209001d19001703010012c68330f131d90e4af9f81e2a224a8c358e08 Message-Authenticator = 0x3a7b6a277e150a15ef3f5951c1b9c313 # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:26:38 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "myorg\myuser", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myorg\myuser" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 9 length 29 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020900061a03 server { PEAP: Setting User-Name to myorg\myuser Sending tunneled request EAP-Message = 0x020900061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "myorg\\myuser" State = 0x151e107414170ab1898b0ca5f8a4a93e server inner-tunnel { # Executing section authorize from file /etc//raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "myorg\myuser", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myorg\myuser" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok ++[control] returns ok [eap] EAP packet type response id 9 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /etc//raddb/sites-enabled/inner-tunnel } # server inner-tunnel [peap] Got tunneled reply code 2 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x9e6cb700b77e844276069b269d3c1b37 MS-MPPE-Recv-Key = 0xc82905aec792709a3642047a3d62838d EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "myorg\\myuser" [peap] Got tunneled reply RADIUS code 2 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x9e6cb700b77e844276069b269d3c1b37 MS-MPPE-Recv-Key = 0xc82905aec792709a3642047a3d62838d EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "myorg\\myuser" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 203 to 192.168.999.7 port 4815 EAP-Message = 0x010a00261900170301001b207b604ded7004ba0319fd90d80c86b17cdf338926b80d306d8521 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d92c46b3598dd76a0f8adddfc0e8388 Finished request 19. Going to the next request Waking up in 4.2 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=204, length=258 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "myorg\\myuser" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x3d92c46b3598dd76a0f8adddfc0e8388 EAP-Message = 0x020a00261900170301001b989382337853c33578978735c0d8632c85d97f0a686d6f3a70597b Message-Authenticator = 0xe244ae36d26ee73331bd16e5a793bd0a # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:26:38 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "myorg\myuser", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myorg\myuser" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 10 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc//raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 204 to 192.168.999.7 port 4815 MS-MPPE-Recv-Key = 0xb5a4c3987e6371edff7724448002a092d5ad569107fbabc158e48b9b1fb43373 MS-MPPE-Send-Key = 0xef43cb62397ba7304927b0679072f3289ff3bf10e1ec22b8789fea4d2c608490 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "myorg\\myuser" Finished request 20. Going to the next request Waking up in 4.2 seconds. Cleaning up request 6 ID 190 with timestamp +439 Cleaning up request 7 ID 191 with timestamp +439 Cleaning up request 8 ID 192 with timestamp +439 Cleaning up request 9 ID 193 with timestamp +439 Cleaning up request 10 ID 194 with timestamp +439 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x4f47b7a34b41aeed did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Waking up in 0.2 seconds. Cleaning up request 11 ID 195 with timestamp +439 Cleaning up request 12 ID 196 with timestamp +439 Cleaning up request 13 ID 197 with timestamp +439 Cleaning up request 14 ID 198 with timestamp +439 Waking up in 0.1 seconds. Cleaning up request 15 ID 199 with timestamp +439 Waking up in 0.1 seconds. Cleaning up request 16 ID 200 with timestamp +439 Cleaning up request 17 ID 201 with timestamp +439 Cleaning up request 18 ID 202 with timestamp +439 Cleaning up request 19 ID 203 with timestamp +439 Cleaning up request 20 ID 204 with timestamp +439 Ready to process requests. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=205, length=237 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "host/LP-0010.myorg.org" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" EAP-Message = 0x020b001b01686f73742f4c502d303031302e70666663752e6f7267 Message-Authenticator = 0x3f05cfc6636623f2cfe8900c91dd38b5 # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:27:04 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "/LP-0010.myorg.org", looking up realm NULL [suffix] Found realm "NULL" [suffix] Setting Stripped-User-Name = "/LP-0010.myorg.org" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 11 length 27 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 176 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 205 to 192.168.999.7 port 4815 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010c00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaab75260aabb4bbc8e4a8681cc46cd51 Finished request 21. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=206, length=315 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "host/LP-0010.myorg.org" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0xaab75260aabb4bbc8e4a8681cc46cd51 EAP-Message = 0x020c005719800000004d16030100480100004403014dac90b3dbf3a100e9cc156249c13486d33b8d5f8cd231a33e07d153b72fb80200001600040005000a0009006400620003000600130012006301000005ff01000100 Message-Authenticator = 0xf19c20fbafcc270b34c45415b946fd6b # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:27:04 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "/LP-0010.myorg.org", looking up realm NULL [suffix] Found realm "NULL" [suffix] Setting Stripped-User-Name = "/LP-0010.myorg.org" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 12 length 87 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 77 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0048], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0883], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 206 to 192.168.999.7 port 4815 EAP-Message = 0x010d040019c0000008c0160301002a0200002603014dac9088e0ca376ad4cff92b3b099dccd4c9469795ef1a8703b5201389c5771c0000040016030108830b00087f00087c0003b5308203b130820299a003020102020102300d06092a864886f70d010104050030819a310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311530130603550407130c5068696c6164656c70686961311c301a060355040a1313506f6c69636520616e642046697265204643553123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f7267311a3018060355040313116d6966666c696e2e7066 EAP-Message = 0x6663752e6f7267301e170d3131303431383136313132345a170d3132303431373136313132345a308183310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311c301a060355040a1313506f6c69636520616e64204669726520464355311a3018060355040313116d6966666c696e2e70666663752e6f72673123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100ad3cc6d602bac5213757cd07b59881ae01cfb16ce8f0affd755a2e2ea0dbcd1a60fb5142fe4288b48b96c07498e569 EAP-Message = 0xab2601b42a73a161b0e171d2957d082cabffde39e5e6e9058e958f7b32349efb8765425bc3822ad39287bef9cb5b67369f886d1439c1876e15f057c6a329a52d2f9e23625678497d6945485768447b5903a84a9b2c6c6287291b1b60366ae4e3f0809c8d38f24ea9c040692c2bbd117eeda78fac45695a9e3b8b4a85b3b7fa9f8c7a19d7ad77fe40dbf573c6c573866f926d1a9ca4391ad47d1489526504ea76893c1a39b033ec72a59cad35f9a8e749a0259e787c03cec0df7d7c7763565afeafd06f450afdc881115dcb2f77f3fdb5cb0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405 EAP-Message = 0x000382010100cd1bcf97d2ab9635403f1732591d98606e95cc939882656b198bf7b7bf585e159f950e7db747b25720ea1e4b05d91fa6a8bc7b367ed21d749731a803f726438a4942d49bb298322f278163435b6ec5ef9f810f5195ab021dd0aac53cc53494cccf30e6ed6186e9d32cd9cd41c2953173a01e7a7c82998ac7bf0f30451887dd5c0b8750d8bd6afac032a70eab0ea2704f277a0067f102b9e5ad68f9723a3ad65e439f90b782e5cdf2c2a21e5e1ac9ebf1e0d4fdeb370dec3538bd91f4cb925c2b52639e4fcd260462a10b54dc5e04e4110a94bd9fe6a3fe16b28abfb3370aa23b378d60f6fbf461f0e22ce4d988603f88b160210ed7a1e8 EAP-Message = 0xcdc08eb134ef355d3f0004c1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaab75260abba4bbc8e4a8681cc46cd51 Finished request 22. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=207, length=234 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "host/LP-0010.myorg.org" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0xaab75260abba4bbc8e4a8681cc46cd51 EAP-Message = 0x020d00061900 Message-Authenticator = 0x7ba4454596896d7ff8ba0314a9c3d05e # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:27:04 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "/LP-0010.myorg.org", looking up realm NULL [suffix] Found realm "NULL" [suffix] Setting Stripped-User-Name = "/LP-0010.myorg.org" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 13 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 207 to 192.168.999.7 port 4815 EAP-Message = 0x010e03fc1940308204bd308203a5a003020102020900ad8d39f4fcae271a300d06092a864886f70d010105050030819a310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311530130603550407130c5068696c6164656c70686961311c301a060355040a1313506f6c69636520616e642046697265204643553123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f7267311a3018060355040313116d6966666c696e2e70666663752e6f7267301e170d3131303431383136313132345a170d3132303431373136313132345a30819a310b3009060355040613025553311530 EAP-Message = 0x130603550408130c50656e6e73796c76616e6961311530130603550407130c5068696c6164656c70686961311c301a060355040a1313506f6c69636520616e642046697265204643553123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f7267311a3018060355040313116d6966666c696e2e70666663752e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100e43cf5fcf5abf3d6beec6062d1709cd3ccf6bd5d6ba2f54c0f9ec9fa708defdaec3974d3315737519d86b114191dcda2811b89e9b8d2d7ca7ea04002c8c934cde3d550d3bf018f1583026bab19a4a38c5ae5 EAP-Message = 0xa53548a0a1652dc0908a9e06f58d9c473ec7ec55fcefa9c443311684ad6e9dd09ea14cb3d9fcb04a2429f9d1995c062f5b215658143eafdd0116334b0f1849cfef9a24579ea1d6ca31421f52b70d9d00a961408f747f2f2066231124d83c63c3c8b1d69b6f4b5ea50588b2f33b8a40ba8781455db36472bd9b4e85f81f1b82ebf326cd3ac504eb2dea1c5a9e7496f485a62d63d11bead3a4b79ce85453d6617c8b8fca4e1d3e5bb0c68c041c948f0203010001a38201023081ff301d0603551d0e041604146fb361c7649ba640bdf6ea8870cac051daeb9a9e3081cf0603551d230481c73081c480146fb361c7649ba640bdf6ea8870cac051daeb9a9e EAP-Message = 0xa181a0a4819d30819a310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311530130603550407130c5068696c6164656c70686961311c301a060355040a1313506f6c69636520616e642046697265204643553123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f7267311a3018060355040313116d6966666c696e2e70666663752e6f7267820900ad8d39f4fcae271a300c0603551d13040530030101ff300d06092a864886f70d010105050003820101008584a10eba26e3bac7f3a37b0250a525185f77e4cbe920d0d0e3a617dfe22e62954eb79a73d781e27f55c5e1b7 EAP-Message = 0x3c6900c0e5fd63fc Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaab75260a8b94bbc8e4a8681cc46cd51 Finished request 23. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=208, length=234 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "host/LP-0010.myorg.org" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0xaab75260a8b94bbc8e4a8681cc46cd51 EAP-Message = 0x020e00061900 Message-Authenticator = 0xc294987d5f65ce57c6fb1a37ba5b158d # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:27:04 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "/LP-0010.myorg.org", looking up realm NULL [suffix] Found realm "NULL" [suffix] Setting Stripped-User-Name = "/LP-0010.myorg.org" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 14 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 208 to 192.168.999.7 port 4815 EAP-Message = 0x010f00da190000e668530fe5cdedf1fff694c02a985e9dbdaaaaf9915bb3b297c4ddf1ee0601670f0ad3a6b34f9b5959d25b8624147171fc575436a01288e78f2d4344841dd5307a83e6c1d553dbc0731016c4bb35ef324e49b727ccfe896f56ef9603188886b9cf2c7423c77fd441bfa16636772db885276f42a39801d6a334fc20074352933ff6cecfa79ed4b11493ed5a2db327e4b421c3c7fac2f636766698ba79a0cef62a2413ad01d9c31ff9599414e30b6d9d974f2d5430117e202bda0b60bbd6c920c65f7ed6bd1e87e7513d9f16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaab75260a9b84bbc8e4a8681cc46cd51 Finished request 24. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=209, length=234 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "host/LP-0010.myorg.org" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0xaab75260a9b84bbc8e4a8681cc46cd51 EAP-Message = 0x020f00061900 Message-Authenticator = 0x22fb3754a0bb3845bde16f0734b7ff6a # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:27:04 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "/LP-0010.myorg.org", looking up realm NULL [suffix] Found realm "NULL" [suffix] Setting Stripped-User-Name = "/LP-0010.myorg.org" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 15 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 209 to 192.168.999.7 port 4815 EAP-Message = 0x011000061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xaab75260aea74bbc8e4a8681cc46cd51 Finished request 25. Going to the next request Waking up in 4.8 seconds. Cleaning up request 21 ID 205 with timestamp +465 Cleaning up request 22 ID 206 with timestamp +465 Cleaning up request 23 ID 207 with timestamp +465 Cleaning up request 24 ID 208 with timestamp +465 Cleaning up request 25 ID 209 with timestamp +465 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xaab75260aea74bbc did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=210, length=237 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "host/LP-0010.myorg.org" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" EAP-Message = 0x0201001b01686f73742f4c502d303031302e70666663752e6f7267 Message-Authenticator = 0x7f18b5ce40762fc7ce1336cd53901e5e # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:28:03 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "/LP-0010.myorg.org", looking up realm NULL [suffix] Found realm "NULL" [suffix] Setting Stripped-User-Name = "/LP-0010.myorg.org" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 1 length 27 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 176 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 210 to 192.168.999.7 port 4815 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5fa5dbd85fa7c2ccdff397606527fb6f Finished request 26. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=211, length=315 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "host/LP-0010.myorg.org" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x5fa5dbd85fa7c2ccdff397606527fb6f EAP-Message = 0x0202005719800000004d16030100480100004403014dac90edd5d5ae7aeae2db199e6027cd395ca67651fa8010563678a47f88f5de00001600040005000a0009006400620003000600130012006301000005ff01000100 Message-Authenticator = 0xdf0705f30f8684c3201167c51a249414 # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:28:03 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "/LP-0010.myorg.org", looking up realm NULL [suffix] Found realm "NULL" [suffix] Setting Stripped-User-Name = "/LP-0010.myorg.org" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 2 length 87 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 77 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0048], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0883], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 211 to 192.168.999.7 port 4815 EAP-Message = 0x0103040019c0000008c0160301002a0200002603014dac90c37120de69c11067791b75cad05959a3ab5ceaf8cc0d64f51ed3f833600000040016030108830b00087f00087c0003b5308203b130820299a003020102020102300d06092a864886f70d010104050030819a310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311530130603550407130c5068696c6164656c70686961311c301a060355040a1313506f6c69636520616e642046697265204643553123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f7267311a3018060355040313116d6966666c696e2e7066 EAP-Message = 0x6663752e6f7267301e170d3131303431383136313132345a170d3132303431373136313132345a308183310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311c301a060355040a1313506f6c69636520616e64204669726520464355311a3018060355040313116d6966666c696e2e70666663752e6f72673123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100ad3cc6d602bac5213757cd07b59881ae01cfb16ce8f0affd755a2e2ea0dbcd1a60fb5142fe4288b48b96c07498e569 EAP-Message = 0xab2601b42a73a161b0e171d2957d082cabffde39e5e6e9058e958f7b32349efb8765425bc3822ad39287bef9cb5b67369f886d1439c1876e15f057c6a329a52d2f9e23625678497d6945485768447b5903a84a9b2c6c6287291b1b60366ae4e3f0809c8d38f24ea9c040692c2bbd117eeda78fac45695a9e3b8b4a85b3b7fa9f8c7a19d7ad77fe40dbf573c6c573866f926d1a9ca4391ad47d1489526504ea76893c1a39b033ec72a59cad35f9a8e749a0259e787c03cec0df7d7c7763565afeafd06f450afdc881115dcb2f77f3fdb5cb0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405 EAP-Message = 0x000382010100cd1bcf97d2ab9635403f1732591d98606e95cc939882656b198bf7b7bf585e159f950e7db747b25720ea1e4b05d91fa6a8bc7b367ed21d749731a803f726438a4942d49bb298322f278163435b6ec5ef9f810f5195ab021dd0aac53cc53494cccf30e6ed6186e9d32cd9cd41c2953173a01e7a7c82998ac7bf0f30451887dd5c0b8750d8bd6afac032a70eab0ea2704f277a0067f102b9e5ad68f9723a3ad65e439f90b782e5cdf2c2a21e5e1ac9ebf1e0d4fdeb370dec3538bd91f4cb925c2b52639e4fcd260462a10b54dc5e04e4110a94bd9fe6a3fe16b28abfb3370aa23b378d60f6fbf461f0e22ce4d988603f88b160210ed7a1e8 EAP-Message = 0xcdc08eb134ef355d3f0004c1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5fa5dbd85ea6c2ccdff397606527fb6f Finished request 27. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=212, length=234 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "host/LP-0010.myorg.org" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x5fa5dbd85ea6c2ccdff397606527fb6f EAP-Message = 0x020300061900 Message-Authenticator = 0x08975501af22ecabb6af227dd54fd96e # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:28:03 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "/LP-0010.myorg.org", looking up realm NULL [suffix] Found realm "NULL" [suffix] Setting Stripped-User-Name = "/LP-0010.myorg.org" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 212 to 192.168.999.7 port 4815 EAP-Message = 0x010403fc1940308204bd308203a5a003020102020900ad8d39f4fcae271a300d06092a864886f70d010105050030819a310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311530130603550407130c5068696c6164656c70686961311c301a060355040a1313506f6c69636520616e642046697265204643553123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f7267311a3018060355040313116d6966666c696e2e70666663752e6f7267301e170d3131303431383136313132345a170d3132303431373136313132345a30819a310b3009060355040613025553311530 EAP-Message = 0x130603550408130c50656e6e73796c76616e6961311530130603550407130c5068696c6164656c70686961311c301a060355040a1313506f6c69636520616e642046697265204643553123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f7267311a3018060355040313116d6966666c696e2e70666663752e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100e43cf5fcf5abf3d6beec6062d1709cd3ccf6bd5d6ba2f54c0f9ec9fa708defdaec3974d3315737519d86b114191dcda2811b89e9b8d2d7ca7ea04002c8c934cde3d550d3bf018f1583026bab19a4a38c5ae5 EAP-Message = 0xa53548a0a1652dc0908a9e06f58d9c473ec7ec55fcefa9c443311684ad6e9dd09ea14cb3d9fcb04a2429f9d1995c062f5b215658143eafdd0116334b0f1849cfef9a24579ea1d6ca31421f52b70d9d00a961408f747f2f2066231124d83c63c3c8b1d69b6f4b5ea50588b2f33b8a40ba8781455db36472bd9b4e85f81f1b82ebf326cd3ac504eb2dea1c5a9e7496f485a62d63d11bead3a4b79ce85453d6617c8b8fca4e1d3e5bb0c68c041c948f0203010001a38201023081ff301d0603551d0e041604146fb361c7649ba640bdf6ea8870cac051daeb9a9e3081cf0603551d230481c73081c480146fb361c7649ba640bdf6ea8870cac051daeb9a9e EAP-Message = 0xa181a0a4819d30819a310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311530130603550407130c5068696c6164656c70686961311c301a060355040a1313506f6c69636520616e642046697265204643553123302106092a864886f70d0109011614706f73746d61737465724070666663752e6f7267311a3018060355040313116d6966666c696e2e70666663752e6f7267820900ad8d39f4fcae271a300c0603551d13040530030101ff300d06092a864886f70d010105050003820101008584a10eba26e3bac7f3a37b0250a525185f77e4cbe920d0d0e3a617dfe22e62954eb79a73d781e27f55c5e1b7 EAP-Message = 0x3c6900c0e5fd63fc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5fa5dbd85da1c2ccdff397606527fb6f Finished request 28. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=213, length=234 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "host/LP-0010.myorg.org" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x5fa5dbd85da1c2ccdff397606527fb6f EAP-Message = 0x020400061900 Message-Authenticator = 0x2879f66153ca0f29f077d7ee441341e6 # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:28:03 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "/LP-0010.myorg.org", looking up realm NULL [suffix] Found realm "NULL" [suffix] Setting Stripped-User-Name = "/LP-0010.myorg.org" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 213 to 192.168.999.7 port 4815 EAP-Message = 0x010500da190000e668530fe5cdedf1fff694c02a985e9dbdaaaaf9915bb3b297c4ddf1ee0601670f0ad3a6b34f9b5959d25b8624147171fc575436a01288e78f2d4344841dd5307a83e6c1d553dbc0731016c4bb35ef324e49b727ccfe896f56ef9603188886b9cf2c7423c77fd441bfa16636772db885276f42a39801d6a334fc20074352933ff6cecfa79ed4b11493ed5a2db327e4b421c3c7fac2f636766698ba79a0cef62a2413ad01d9c31ff9599414e30b6d9d974f2d5430117e202bda0b60bbd6c920c65f7ed6bd1e87e7513d9f16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5fa5dbd85ca0c2ccdff397606527fb6f Finished request 29. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.999.7 port 4815, id=214, length=234 Framed-MTU = 1480 NAS-IP-Address = 192.168.999.7 NAS-Identifier = "myorg-bnew" User-Name = "host/LP-0010.myorg.org" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 61 NAS-Port-Type = Ethernet NAS-Port-Id = "C13" Called-Station-Id = "00-19-bb-a7-7e-43" Calling-Station-Id = "00-1b-78-b5-f7-a0" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "12" State = 0x5fa5dbd85ca0c2ccdff397606527fb6f EAP-Message = 0x020500061900 Message-Authenticator = 0x3b40bb8b2b7e40c2b99ea8b4202b9c17 # Executing section authorize from file /etc//raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.999.7/auth-detail-20110418 [auth_log] expand: %t -> Mon Apr 18 15:28:03 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "/LP-0010.myorg.org", looking up realm NULL [suffix] Found realm "NULL" [suffix] Setting Stripped-User-Name = "/LP-0010.myorg.org" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc//raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 214 to 192.168.999.7 port 4815 EAP-Message = 0x010600061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5fa5dbd85ba3c2ccdff397606527fb6f Finished request 30. Going to the next request Waking up in 4.8 seconds. Cleaning up request 26 ID 210 with timestamp +524 Cleaning up request 27 ID 211 with timestamp +524 Cleaning up request 28 ID 212 with timestamp +524 Cleaning up request 29 ID 213 with timestamp +524 Waking up in 0.1 seconds. Cleaning up request 30 ID 214 with timestamp +524 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x5fa5dbd85ba3c2cc did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. This E-mail, along with any attachments, is considered confidential and may well be legally privileged. If you have received it in error, you are on notice of its status. Please notify us immediately by reply e-mail or call 215-931-0300 / 800-228-8801 and then delete this message from your system. Please do not copy it or use it for any purposes, or disclose its contents to any other person. Thank you for your cooperation.