"King, Michael" <MKing@bridgew.edu> wrote:

So we've been using FreeRADIUS talking to ActiveDirectory to authenticate our WinXP clients (Over 2000) for over a year now. Along comes Vista. Of COURSE it doesn't work. Microsoft changed something, and it broke a working config. Arrg.

Try: http://www.striker.ottawa.on.ca/~aland/vista.patch You'll have to re-build & re-install the EAP module (you don't need to touch the rest of the server). It won't help, but it will print out a little more information. We'll probably have to do a few cycles before it's tracked down, though.

My (amatuer) analyis, (Aka my gut) is that Vista is Doing something in TLS, not PEAP. (I don't see my mschap module fire).

The TLS tunnel is set up, BUT vista is doing something slightly different that confuses FreeRADIUS, so FreeRADIUS doesn't continue the EAP conversation. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

Hi,

How do I "re-build & re-install the EAP module"? I originally installed from a self-made debian package.

apply the patch to the source code that you built your self-made debian package from and then redo the package build. it'll build freeradius with the new code in the EAP module. alan

Just to double check that I didn't cut paste wrong, I wget'd the file from your server, repatched, recompiled, and reinstalled. Same seg fault, at same place. rlm_eap_tls: Start returned 1 VISTA[eap_compose:475]: reply->id 6 VISTA[eap_compose:476]: reply->code 1 VISTA[eap_compose:514]: eap->request->code 1 VISTA[eap_compose:515]: eap->request->type.type 0 VISTA[eap_compose:522]: Setting EAP type to 25 VISTA[eap_compose:526]: eap->request->code 1 VISTA[eap_compose:527]: eap->request->type.type 25 Segmentation fault

Just reading thru the deployingradius.com pages.... On page: http://deployingradius.com/documents/configuration/active_directory.html You reference the krb5.conf file like this: [realms] ... realm.company.com = { kdc = nt-server-hostname.company.com } ... However, someone on the list once pointed out that this is a more robust approach (assuming your DNS infrastructure is solid). The objective is to have the server lookup the realms via DNS as opposed to having a statically linked server (that could be taken offline for maintenance) # more krb5.conf [libdefaults] default_realm = EXAMPLE.COM dns_lookup_kdc = on [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM # And like wise, the smb.conf file would changed as well. # Change this for the workgroup/NT-domain name your Samba server will part of workgroup = EXAMPLE #Domain ShortName if different realm = EXAMPLE.COM #Server string is the equivalent of the NT Description field server string = %h server (Samba %v) security = ADS encrypt passwords = true password server = * Granted, the above configs are for a single domain authentication source. (utilizing the default realm, I believe, instead of a named realm) But the concept of DNS resolving the password-server should apply.

"King, Michael" <MKing@bridgew.edu> wrote:

Not to rude, have you had a chance to poke that Patch again?

Reload it from the same URL as last time. If it still crashes, see doc/bugs. I don't see how it can crash at all, so the crash looks like a symptom of another issue. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

Hi On 10/10/06, King, Michael <MKing@bridgew.edu> wrote:

I'm assuming it built it that way.

Anways, here's what I got following those direcitons (Which is what leads me to think the symbols go stripped)

If you look at or around line 188, there should be dh_strip, which normally does live up to its name, i.e. stripping binaries off what it considers "unneeded symbols". For building a "debugging" package let DEB_BUILD_OPTIONS contain "nostrip". Uh, on a side note the ifeq/endif construct around seems unneeded to me, as dh_strip should honor "nostrip" internally. regards K. Hoercher

Sometimes, the answer in not on the first 5 pages of google.... http://lists.cistron.nl/pipermail/freeradius-devel/2004-May/007186.html Raimund Sacherer wrote:

is there an easy way to create a package (i use the debian package management) with the files for debugging instead of the stripped once?

Copy the following line in your shell: DEB_BUILD_OPTIONS=nostrip fakeroot dpkg-buildpackage -- Nicolas Baradakis -----Original Message----- From: freeradius-users-bounces+mking=bridgew.edu@lists.freeradius.org [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freeradius.org] On Behalf Of K. Hoercher Sent: Wednesday, October 11, 2006 2:06 AM To: FreeRadius users mailing list Subject: Re: Windows Vista doing PEAP Hi On 10/10/06, King, Michael <MKing@bridgew.edu> wrote:

I'm assuming it built it that way.

Anways, here's what I got following those direcitons (Which is what leads me to think the symbols go stripped)

If you look at or around line 188, there should be dh_strip, which normally does live up to its name, i.e. stripping binaries off what it considers "unneeded symbols". For building a "debugging" package let DEB_BUILD_OPTIONS contain "nostrip". Uh, on a side note the ifeq/endif construct around seems unneeded to me, as dh_strip should honor "nostrip" internally. regards K. Hoercher - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

I got the same results as below with RC2. -----Original Message----- From: freeradius-users-bounces+mking=bridgew.edu@lists.freeradius.org [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freeradius.org] On Behalf Of King, Michael Sent: Wednesday, October 11, 2006 1:56 PM To: FreeRadius users mailing list Subject: RE: Windows Vista doing PEAP Alan, here is your requested capture. This was with RC1 I will be reattempting with RC2 in a little bit. rad2:~# gdb /usr/sbin/freeradius GNU gdb 6.4.90-debian Copyright (C) 2006 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i486-linux-gnu"...Using host libthread_db library "/lib/tls/libthread_db.so.1". (gdb) set logging file gdb-radiusd.log (gdb) set logging on Copying output to gdb-radiusd.log. (gdb) set args -X (gdb) run Starting program: /usr/sbin/freeradius -X [Thread debugging using libthread_db enabled] [New Thread 1077729984 (LWP 5747)] Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1280000 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response} " Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/certs/rad2.campus.bridgew.edu.privkey.pem" tls: certificate_file = "/etc/freeradius/certs/rad2.campus.bridgew.edu.cer" tls: CA_file = "/etc/freeradius/certs/IPS-IPSCABUNDLE.CRT" tls: private_key_password = "(null)" tls: dh_file = "/etc/freeradius/certs/dh" tls: random_file = "/etc/freeradius/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.0.1.12:32769, id=5, length=179 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.12 NAS-Identifier = "BUWISM1-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x0207000e014253435c6d6b696e67 Message-Authenticator = 0x18f6d0ae922dccd017b54b43a311261e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "BSC\mking", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 7 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 VISTA[eap_authenticate:341]: here VISTA[eap_compose:475]: reply->id 7 VISTA[eap_compose:476]: reply->code 1 VISTA[eap_compose:514]: eap->request->code 1 VISTA[eap_compose:515]: eap->request->type.type 0 VISTA[eap_compose:516]: handler->eap_type 25 VISTA[eap_compose:523]: Setting EAP type Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1077729984 (LWP 5747)] 0x4018675b in strlen () from /lib/tls/libc.so.6 (gdb) Quit (gdb) info threads * 1 Thread 1077729984 (LWP 5747) 0x4018675b in strlen () from /lib/tls/libc.so.6 (gdb) thread apply all bt full Thread 1 (Thread 1077729984 (LWP 5747)): #0 0x4018675b in strlen () from /lib/tls/libc.so.6 No symbol table info available. #1 0x4015a064 in vfprintf () from /lib/tls/libc.so.6 No symbol table info available. #2 0x40178161 in vsnprintf () from /lib/tls/libc.so.6 No symbol table info available. #3 0x08051805 in vradlog (lvl=-1073760262, fmt=0x40405cdf "VISTA[%s:%d]: rcode %d", ap=0xbfffd824 "\003") at log.c:132 s = <value optimized out> timeval = 1160589116 msgfd = (FILE *) 0xbfffb6ac p = <value optimized out> buffer = "Wed Oct 11 13:51:56 2006\n: Debug: VISTA[eap_compose:523]: Setting EAP type\n\00025\n\000e 0\n\000ct 11 13:51:56 2006 : Debug: VISTA[eap_authenticate:341]: here\n\000\200\001@=¹ÿ¿4¯\027@ô\217$@ \223$@ÀÚ<@¨¸ÿ¿ô\217$@ \223$@¨¸ÿ¿\002\005\027@ \223$@È\204\006\b"... #4 0x08051a4f in log_debug (msg=0x40405cdf "VISTA[%s:%d]: rcode %d") at log.c:205 ap = 0xbfffd824 "\003" r = 3 #5 0x40403a08 in eap_compose (handler=0x8165ee0) at eap.c:610 eap_len = 0 len = <value optimized out> eap_msg = <value optimized out> vp = <value optimized out> eap_packet = <value optimized out> ptr = (unsigned char *) 0x8176758 "\001\b" request = (REQUEST *) 0x81641a8 eap_ds = <value optimized out> reply = (EAP_PACKET *) 0x8165f60 rcode = 3 __FUNCTION__ = "eap_compose" #6 0x40402cbc in eap_authenticate (instance=0x814ddd8, request=0x81641a8) at rlm_eap.c:342 vp = <value optimized out> handler = (EAP_HANDLER *) 0x8165ee0 eap_packet = (eap_packet_t *) 0x0 rcode = <value optimized out> __FUNCTION__ = "eap_authenticate" #7 0x08055ad8 in modcall (component=0, c=0x815ea00, request=0x81641a8) at modcall.c:236 myresult = 0 #8 0x0805617c in call_one (component=3, p=0x40157393, request=0x3, priority=0xbfffd974, result=0xbfffd978) at modcall.c:269 r = <value optimized out> #9 0x08055cca in modcall (component=0, c=0x815e6a8, request=0x81641a8) at modcall.c:324 g = (modgroup *) 0x815e6a8 myresult = 0 #10 0x08053d2e in indexed_modcall (comp=0, idx=1075147667, request=0x81641a8) at modules.c:469 this = (indexed_modcallable *) 0x8159710 #11 0x0804ce93 in rad_check_password (request=0x81641a8) at auth.c:367 dval = (DICT_VALUE *) 0x3 auth_type_pair = <value optimized out> cur_config_item = <value optimized out> password_pair = (VALUE_PAIR *) 0x0 auth_item = <value optimized out> string = "\005\bðP\006\b\005@\006\b@w\a\bàL\006\b\000\000\000\000ô_\001@¡º\022@\000\000\000\000¨b\004@\002\000\000\000\aVF@ `\001@ô_\001@¡º\022@</-EÈ\204\006\b\nM\006\bÐu\a\bXÚÿ¿O\032\005\b\001\000\000\000PP\006\bdÚÿ¿|a\005\b\001\000\000\000H\025\026\b¨A\026\bÈ\204\006\bdÚÿ¿È\204\006\b¸Úÿ¿\\]\005\bPP\006\bk6\006\bÐu\a\b\nM\006\b\000\000\000\000|f\000@</-E¨Úÿ¿¤Úÿ¿\b\000\000\000¸Úÿ¿\220\221\025\b\001\000\000\000,H\006\b\000\000\000\000ô_\001@`m\004@\004\000"... auth_type = 6 result = <value optimized out> ---Type <return> to continue, or q <return> to quit--- auth_type_count = 1 #12 0x0804d3bf in rad_authenticate (request=0x81641a8) at auth.c:662 check_item = <value optimized out> vp = (VALUE_PAIR *) 0x40157393 namepair = (VALUE_PAIR *) 0x8164298 check_item = <value optimized out> reply_item = <value optimized out> auth_item = (VALUE_PAIR *) 0x0 module_msg = <value optimized out> tmp = (VALUE_PAIR *) 0x0 result = 3 r = <value optimized out> umsg = "çÿ¿çz\000@ çÿ¿Pf\001@\004\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\001\000\000\000ô\217$@<\000\000\000 \223$@´æÿ¿\037¨\027@\n\000\000\000Øæÿ¿(±\027@ \223$@`çÿ¿ød\001@ ¡\004\b$É\b\b \227$\000\000\000\000\000\bçÿ¿-2\006@ð@\026\b\024\000\000\000hï\006@ \223$@\bçÿ¿9|\027@ \223$@hï\006@ \227$@\210T\026\b\210çÿ¿¶a\006@ð@\026\b\024\000\000\000\020\000\000\000\002\000\000\000D\232\005@¨b\004@ô_\001@ød\001@\001\000\000\000pçÿ¿é²\000@¤f\001@\000"... user_msg = <value optimized out> exec_program = <value optimized out> exec_wait = <value optimized out> seen_callback_id = <value optimized out> buf = "äúÿ¿\002\000\000\000\000\000\000\000ô_\001@üÿÿÿ\b\000\000\000¨ßÿ¿%¹\000@ðúÿ¿ÀgG@\000\000\000\000`m\004@äúÿ¿\002\000\000\000`;\026\b¨hG@äd\001@\b\000\000\000\213¸\000@ô\217$@À\\\001@`;\026\b\030àÿ¿\a¿!@ðúÿ¿\f=\026\b\001\000\000\000\000\000\000\000\b\211t$°´\000@\000\000\000\000ð\210\000@\223Ñ\027@¸:\026\b\001\000\000\200Nò\026@`åÿ¿`åÿ¿\000\000\000\000ô\217$@:È\006@\000\000\000\000ôåÿ¿\037o\025@\020æÿ¿:È\006@", '\0' <repeats 12 times>, " `\001@èj"... logstr = "`;\026\b\203fG@\000ãÿ¿\025\000\000\000\214Ûÿ¿\223Ñ\027@\000ãÿ¿\210T\026\bNò\026@¼È\006@¼È\006@\000\000\000\000ô\217$@»È\006@\001\000\000\000\210áÿ¿\037o\025@¬áÿ¿»È\006@\001\000\000\000\000\000\000\000\004\000\000\000`;\026\bèj\025@ø¨$@\020:\026\b`áÿ¿)\000\000\000ø¤$@ôàÿ¿@\"\000\000dÛ\000@\000\000\000\000\005\000\000\000\0000\000\000\000@\000\000\000\000\000\000Ð4\000\000@âÿ¿(\216$@â?\026\b-\000\000\000$Üÿ¿\223Ñ\027@â?\026\b\000\000\000\000ÿÿÿÿ\030\000\000\000¼È\006@¶È\006@"... autz_retry = 0 '\0' autz_type = <value optimized out> #13 0x08057347 in rad_respond (request=0x81641a8, fun=0x804d150 <rad_authenticate>) at radiusd.c:1653 rcode = <value optimized out> packet = <value optimized out> original = <value optimized out> secret = 0x81641cc "d0wnh1ll" finished = <value optimized out> reprocess = <value optimized out> #14 0x080591f6 in main (argc=2, argv=0xbffffae4) at radiusd.c:1427 cl = <value optimized out> fun = (RAD_REQUEST_FUNP) 0x804d150 <rad_authenticate> request = (REQUEST *) 0x81641a8 packet = (RADIUS_PACKET *) 0x81640b0 secret = (u_char *) 0x81454c0 "d0wnh1ll" buffer = "*", '\0' <repeats 651 times>, "\221ü\000@", '\0' <repeats 12 times>, "\221ü\000@\000\000\000\000\000\220;@èëÿ¿0Î<@,íÿ¿åQ\000@,Î<@\000\000\000\000\004\000\000\000\022\b\000\000\a\000\000\000\000 \001\000\001\000\000\000ød\001@øëÿ¿û\206\000@ ¸'@°µ'@\023\000\000\000\001\000\000\000\\Ù)@°µ'@\000\000\000\000\0000\001\000d+\001\000d+\001\000\000\000\000\000\005\000\000\000\0000\001\000\000@\001\000,>\001\0000>\001\000,íÿ\000¨l\004@\034ìÿ¿YÀ\000@\211\233;@´l\004@ô_\001@hj\004@lH\021@\234îÿ¿|f\000"... readfds = {fds_bits = {128, 0 <repeats 31 times>}} argval = <value optimized out> pid = <value optimized out> max_fd = <value optimized out> status = <value optimized out> tv = (struct timeval *) 0x0 act = {__sigaction_handler = {sa_handler = 0x8057100 <sig_fatal>, sa_sigaction = 0x8057100 <sig_fatal>}, sa_mask = {__val = { 0 <repeats 32 times>}}, sa_flags = 0, sa_restorer = 0} listener = <value optimized out> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Here we are: I did it twice. Funny it sent an access reject the second time. rad2:/home/mking# /usr/sbin/freeradius -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls rlm_eap: Loaded and initialized type ttls rlm_eap: Loaded and initialized type peap rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.0.1.12:32769, id=37, length=179 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.12 NAS-Identifier = "BUWISM1-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x0206000e014253435c6d6b696e67 Message-Authenticator = 0xd86aa0b0694586d016ce8de479a5df3d Sending Access-Challenge of id 37 to 10.0.1.12 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010700061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x69ccaa28bda899693a071dbb5766bb67 rad_recv: Access-Request packet from host 10.0.1.12:32769, id=38, length=303 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.12 NAS-Identifier = "BUWISM1-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x0207007819800000006e16030100690100006503014536b7440a2cfc7f2553bb613d14 8a50aee2b084dba6c0e069cdd49c1ba25e38000018002f00350005000ac009c00ac013c0 140032003800130004010000240000000e000c0000096273635c6d6b696e67000a000800 06001700180019000b00020100 State = 0x69ccaa28bda899693a071dbb5766bb67 Message-Authenticator = 0x77b7071561e8f89f2292714822c97c81 TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Sending Access-Challenge of id 38 to 10.0.1.12 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0108040a19c000000f9f160301004a0200004603014536b744459cc67caa3c275338cf 89ec322fe3fd145b616a5d6f5053244f3e64202b564bd9b017fe5f134fefac96d0f4018f 5aafda4f05d68e58d7d8f45e4e8c85002f001603010f420b000f3e000f3b00068d308206 89308205f2a0030201020203009187300d06092a864886f70d010105050030820112310b 3009060355040613024553311230100603550408130942617263656c6f6e613112301006 03550407130942617263656c6f6e6131293027060355040a132049505320436572746966 69636174696f6e20417574686f7269747920732e6c2e312e302c060355040a142567656e 6572 EAP-Message = 0x616c4069707363612e636f6d20432e492e462e2020422d423632323130363935312e30 2c060355040b1325697073434120434c41534541312043657274696669636174696f6e20 417574686f72697479312e302c06035504031325697073434120434c4153454131204365 7274696669636174696f6e20417574686f726974793120301e06092a864886f70d010901 161167656e6572616c4069707363612e636f6d301e170d3036303530343232313331345a 170d3038303530333232313331345a3081c3310b30090603550406130255533116301406 03550408130d4d617373616368757365747473311430120603550407130b427269646765 7761 EAP-Message = 0x74657231223020060355040a1319427269646765776174657220537461746520436f6c 6c656765311b3019060355040b131254656c65636f6d6d756e69636174696f6e73312030 1e06035504031317726164322e63616d7075732e627269646765772e6564753123302106 092a864886f70d010901161474656c65636f6d6d40627269646765772e65647530819f30 0d06092a864886f70d010101050003818d0030818902818100bafacc8f16e6686769b809 7698e2aeef926367d3d91ab2eb0110ca80f484c9c0ca3ce4eb11e92ffc968e9b585444c9 557738f9ae5839a7b1d10ece940548abb5def53f18be41dc5a5c83a0011481450cfeafcd 7a7e EAP-Message = 0xd7ff87eb7e1ca346ee2a361e8093b98ba19c272f43d213c7d3f58847e6709ef86714eb f0736a01d0f4c44d0203010001a38203373082033330090603551d130402300030110609 6086480186f8420101040403020640300b0603551d0f0404030203f830130603551d2504 0c300a06082b06010505070301301d0603551d0e04160414788bb22abb6e8a41d4a35b01 66a8047f0746d9b7301f0603551d230418301680140e0760d439c91b5b5d907b23c8d234 9d4a9a4639301f0603551d1104183016811474656c65636f6d6d40627269646765772e65 6475301c0603551d1204153013811167656e6572616c4069707363612e636f6d30720609 6086 EAP-Message = 0x480186f842010d046516634f7267616e697a6174696f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb0e7b24bb6a549f703e6650340d92a4c rad_recv: Access-Request packet from host 10.0.1.12:32769, id=39, length=189 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.12 NAS-Identifier = "BUWISM1-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x020800061900 State = 0xb0e7b24bb6a549f703e6650340d92a4c Message-Authenticator = 0x7ffa22c6238e953e88a2b69e3c86ebb5 Sending Access-Challenge of id 39 to 10.0.1.12 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0109040619406e20496e666f726d6174696f6e204e4f542056414c4944415445442e20 434c41534541312053657276657220436572746966696361746520697373756564206279 2068747470733a2f2f7777772e69707363612e636f6d2f302f06096086480186f8420102 0422162068747470733a2f2f7777772e69707363612e636f6d2f6970736361323030322f 304306096086480186f84201040436163468747470733a2f2f7777772e69707363612e63 6f6d2f6970736361323030322f697073636132303032434c41534541312e63726c304606 096086480186f84201030439163768747470733a2f2f7777772e69707363612e636f6d2f 6970 EAP-Message = 0x736361323030322f7265766f636174696f6e434c41534541312e68746d6c3f30430609 6086480186f84201070436163468747470733a2f2f7777772e69707363612e636f6d2f69 70736361323030322f72656e6577616c434c41534541312e68746d6c3f30410609608648 0186f84201080434163268747470733a2f2f7777772e69707363612e636f6d2f69707363 61323030322f706f6c696379434c41534541312e68746d6c3081830603551d1f047c307a 3039a037a0358633687474703a2f2f7777772e69707363612e636f6d2f69707363613230 30322f697073636132303032434c41534541312e63726c303da03ba0398637687474703a 2f2f EAP-Message = 0x7777776261636b2e69707363612e636f6d2f6970736361323030322f69707363613230 3032434c41534541312e63726c303206082b0601050507010104263024302206082b0601 05050730018616687474703a2f2f6f6373702e69707363612e636f6d2f300d06092a8648 86f70d0101050500038181002f3dd42c1e10181bdd0c69894e19e045c958fd430fc2fd52 9a6c0c19db08b7df43ee5b948d26f7dbcfe04d0ae488f7ecee9dbedc296722a33c0d0291 c1244aa67c913c4e2fe2cae9087971f71e42f5da2fb52f5288ed6d4ed3e5b47165d4ba89 fd3a37d2fd6de04ad2ac3bb0873f97626c50338a20d91ea129be3539037cf4e80005ea30 8205 EAP-Message = 0xe63082054fa0030201020203009018300d06092a864886f70d01010505003081a3310b 3009060355040613024553311230100603550408130942415243454c4f4e413112301006 03550407130942415243454c4f4e4131193017060355040a131049505320536567757269 64616420434131183016060355040b130f43657274696669636163696f6e657331173015 0603550403130e495053205345525649444f524553311e301c06092a864886f70d010901 160f697073406d61696c2e6970732e6573301e170d3031313233303133333631315a170d 3235313232393133333631315a30820112310b3009060355040613024553311230100603 5504 EAP-Message = 0x08130942617263656c6f6e61311230100603 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8357e0ccc642d5dab7a0b32d125f5fa7 rad_recv: Access-Request packet from host 10.0.1.12:32769, id=40, length=189 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.12 NAS-Identifier = "BUWISM1-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x020900061900 State = 0x8357e0ccc642d5dab7a0b32d125f5fa7 Message-Authenticator = 0x2938e33032fff8ed5bd77da0a6bc94ae Sending Access-Challenge of id 40 to 10.0.1.12 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010a04061940550407130942617263656c6f6e6131293027060355040a132049505320 43657274696669636174696f6e20417574686f7269747920732e6c2e312e302c06035504 0a142567656e6572616c4069707363612e636f6d20432e492e462e2020422d4236323231 30363935312e302c060355040b1325697073434120434c41534541312043657274696669 636174696f6e20417574686f72697479312e302c06035504031325697073434120434c41 534541312043657274696669636174696f6e20417574686f726974793120301e06092a86 4886f70d010901161167656e6572616c4069707363612e636f6d30819f300d06092a8648 86f7 EAP-Message = 0x0d010101050003818d0030818902818100a6f57366361da32f4fad2ad8ef0ca64befa7 1bacf7f246171bb202ab3e11898c6aa80fd8631499d71fbcb22768026ef43089ebadeb41 dcb44206fa481f138c64df872dc714d4a783e4723b32ead34d793165050933812b6ee636 ad211133362b68cabe432c37b73d69163be59dbe32a7d5df4a80fcda7370aad928822f68 bbb10203010001a38202b4308202b0300c0603551d13040530030101ff30110609608648 0186f8420101040403020007300c0603551d0f0405030307ff80306b0603551d25046430 6206082b0601050507030106082b0601050507030206082b0601050507030306082b0601 0505 EAP-Message = 0x07030406082b06010505070308060a2b060104018237020115060a2b06010401823702 0116060a2b0601040182370a0301060a2b0601040182370a0304301d0603551d0e041604 140e0760d439c91b5b5d907b23c8d2349d4a9a46393081ba0603551d230481b23081afa1 81a9a481a63081a3310b3009060355040613024553311230100603550408130942415243 454c4f4e41311230100603550407130942415243454c4f4e4131193017060355040a1310 4950532053656775726964616420434131183016060355040b130f436572746966696361 63696f6e6573311730150603550403130e495053205345525649444f524553311e301c06 092a EAP-Message = 0x864886f70d010901160f697073406d61696c2e6970732e6573820100301c0603551d11 04153013811167656e6572616c4069707363612e636f6d30090603551d12040230003043 06096086480186f842010d04361634434c41534541312043412043657274696669636174 65206973737565642062792068747470733a2f2f7777772e6970732e65732f3022060960 86480186f84201020415161368747470733a2f2f7777772e6970732e65732f3073060355 1d1f046c306a3031a02fa02d862b68747470733a2f2f7777772e6970732e65732f63726c 2f6970735345525649444f52455363726c2e63726c3035a033a031862f68747470733a2f 2f77 EAP-Message = 0x77776261636b2e6970732e65732f63726c2f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x27772332b97662d44eab925226b00a00 rad_recv: Access-Request packet from host 10.0.1.12:32769, id=41, length=189 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.12 NAS-Identifier = "BUWISM1-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x020a00061900 State = 0x27772332b97662d44eab925226b00a00 Message-Authenticator = 0x7ff27de94c0993b8c54e1a52a8327424 Sending Access-Challenge of id 41 to 10.0.1.12 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010b03a519006970735345525649444f52455363726c2e63726c302f06082b06010505 07010104233021301f06082b060105050730018613687474703a2f2f6f6373702e697073 2e45532f300d06092a864886f70d01010505000381810027054a0c74c9145dc875c8deee 890c631e1f0184c702cb19d791c8dd3ecfb0c8f3f592b5548254621f32eb80a17d56f1e4 e7285926a47df0ca2d31c6c9f3709dc1cf5e26a4efb212e788e81985ed80e43902688763 a9133c6cf5456a22ce9656075fa6a3ee370a6e928b9e40de143019289390b7f3fcb54ef2 f7960ebb1094d40002bb308202b730820220020100300d06092a864886f70d0101040500 3081 EAP-Message = 0xa3310b3009060355040613024553311230100603550408130942415243454c4f4e4131 1230100603550407130942415243454c4f4e4131193017060355040a1310495053205365 6775726964616420434131183016060355040b130f43657274696669636163696f6e6573 311730150603550403130e495053205345525649444f524553311e301c06092a864886f7 0d010901160f697073406d61696c2e6970732e6573301e170d3938303130313233323130 375a170d3039313232393233323130375a3081a3310b3009060355040613024553311230 100603550408130942415243454c4f4e41311230100603550407130942415243454c4f4e 4131 EAP-Message = 0x193017060355040a13104950532053656775726964616420434131183016060355040b 130f43657274696669636163696f6e6573311730150603550403130e4950532053455256 49444f524553311e301c06092a864886f70d010901160f697073406d61696c2e6970732e 657330819f300d06092a864886f70d010101050003818d0030818902818100ac4f52749f 39ea8edc25c4bc985d986424093c21b3cc19b58e948e87d1f8373ea1c82d58a480355ba1 756c1d450c1f61636a5e6f9b0a4cc1c8b861233581fffeac78702d68e13a0798950254dd cd23b78053d7c8374572062412ba1361218a6e7528e0c50f34fd36d8457fe1b836efb3e1 c620 EAP-Message = 0x8ee8b438bce13ef611de8c9d010203010001300d06092a864886f70d01010405000381 81002cf3c3795824dec63bd1e04269b8ee64b33d6201b9b384df237ddd98cf10a9fe00d8 22960513075457c5a7decbd9b88842f699db14771fb6fe253de1a23e03a981d22d6c47f5 96468c22abc8cc0d0e975e8b41b43bc40a06401ddd46f401ddba822e3c3d78709e7c18d0 abf8b877074671f1ca0b635c6af97294d5014fa0db4216030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8b6d71ad223cb4870914b959e657bb0c rad_recv: Access-Request packet from host 10.0.1.12:32769, id=42, length=391 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.12 NAS-Identifier = "BUWISM1-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x020b00d01980000000c61603010086100000820080673a6636279d2c5c8c22af699f1d f35ecf5c09e73efca3cff461c0edc859f9fc56ef6eee0508281625ec70687e0eba7d03f7 31a3ffacbcba3d0394a6ad5140d649d406ad10c895967895f5b4a1e9032751a72ec21e69 3d5fb5e81c7e2f2dc18467335813d5d77a042b6e5f30d1244c4244fec78b3fa59f1016aa 624fa7eec2db140301000101160301003050d5ca2580382b01878c42d34438827cb788cb 3edafe9ca2a59d440de6e98774384e5382098fbf9b2a03a01c6f09bf86 State = 0x8b6d71ad223cb4870914b959e657bb0c Message-Authenticator = 0x55793a1999c24705362d06a4aa98c48b rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Sending Access-Challenge of id 42 to 10.0.1.12 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010c004119001403010001011603010030eb5d2fdedc3a87043cba211fa0137ba62638 c15bb5048074a87f849ee893f8ecc446b6ea17432247ae2af0567cd2c6cf Message-Authenticator = 0x00000000000000000000000000000000 State = 0x80d904459b28d0a9783c8dda3c1c3914 rad_recv: Access-Request packet from host 10.0.1.12:32769, id=43, length=189 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.12 NAS-Identifier = "BUWISM1-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x020c00061900 State = 0x80d904459b28d0a9783c8dda3c1c3914 Message-Authenticator = 0x319a078de1ce901658966ac1123fd7f7 Sending Access-Challenge of id 43 to 10.0.1.12 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010d005019001703010020d3a98e46a7c60cb1fc37403e5c19b307ba16193159b94c30 124cbb0fb8a4dfe81703010020d44d20a541bdd96fdccb6a5038d8f1827f8e5ca77de0e5 002b776e97008f7d30 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8900fe2d829cf4ccaa2a17851c652928 rad_recv: Access-Request packet from host 10.0.1.22:32769, id=0, length=179 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-64-E4-F0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.22 NAS-Identifier = "BUWISM2-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x0207000e014253435c6d6b696e67 Message-Authenticator = 0x2c3b05dc545cd2c5a689f1c0b3c755a3 Sending Access-Challenge of id 0 to 10.0.1.22 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010800061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x630440f07d1a0e1ccd977539ad9901d9 rad_recv: Access-Request packet from host 10.0.1.22:32769, id=1, length=335 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-64-E4-F0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.22 NAS-Identifier = "BUWISM2-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x0208009819800000008e16030100890100008503014536b7533e2c946468b9cab22999 c94d0f6e24de262f637fdd2b59171deb478d202b564bd9b017fe5f134fefac96d0f4018f 5aafda4f05d68e58d7d8f45e4e8c850018002f00350005000ac009c00ac013c014003200 3800130004010000240000000e000c0000096273635c6d6b696e67000a00080006001700 180019000b00020100 State = 0x630440f07d1a0e1ccd977539ad9901d9 Message-Authenticator = 0xb777563d7c2eed8a9e1687d732083cc8 TLS_accept:error in SSLv3 read finished A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Sending Access-Challenge of id 1 to 10.0.1.22 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010900901900160301004a0200004603014536b7530c8118d1beb69888572f855ca033 136e2ca6745f5df11700b66cba7d202b564bd9b017fe5f134fefac96d0f4018f5aafda4f 05d68e58d7d8f45e4e8c85002f00140301000101160301003055c2d0b6df2c2a18aee94f 3f062f3b143cbce93110799befd9e43ddc0056f713ca6e952b2ac166f6702b922c4f4816 cd Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb6da0325e2c95a96f5036dbd6220ba0c rad_recv: Access-Request packet from host 10.0.1.22:32769, id=2, length=252 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-64-E4-F0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.22 NAS-Identifier = "BUWISM2-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x0209004519800000003b14030100010116030100300a0101eb29181ebece7ff68bb1c4 cffa74a5ada3bc69128bb4fddc6d7fe7a0707415dc342f4b07416f58042c27c32588 State = 0xb6da0325e2c95a96f5036dbd6220ba0c Message-Authenticator = 0x2b849928287668f2a334ac7dcb3db897 rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Login incorrect: [BSC\\mking] (from client BUWiSM-2-2 port 29 cli 00-13-02-1B-4F-01) rad_recv: Access-Request packet from host 10.0.1.22:32769, id=2, length=252 Sending Access-Reject of id 2 to 10.0.1.22 port 32769 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000

I thought it looked a bit funny -----Original Message----- From: freeradius-users-bounces+mking=bridgew.edu@lists.freeradius.org [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, October 18, 2006 7:39 PM To: FreeRadius users mailing list Subject: Re: Windows Vista doing PEAP "King, Michael" <MKing@bridgew.edu> wrote: ...

rad2:/home/mking# /usr/sbin/freeradius -x

Please.... -X, not -x. The debug log you posted DOES NOT include the new messages, and therefore is of no help in solving the problem. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

"King, Michael" <MKing@bridgew.edu> wrote:

It seg faults when I do -X (or -sxx. But not with -x)

At this point, I have no clue why it's dying. I suggest editing the code yourself. The issue is that a decision is being made by the module to not continue processing the EAP session, but I don't know why. The patches were an attempt to have it print out more information, soe we could see what information was being used to make that wrong decision. Again, I have no idea why it's core dumping. It shouldn't be. I don't have Vista, and I can't debug this issue myself. It's up to you. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

-----Original Message----- Sorry - I've come late to this thread. Do we have a general problem with Vista failing to authenticate against FR, or is this just one instance failing, and we know of other instances where it is working? It's most likely I'm the first to try it, and I've had..... Difficulties :-)

Could you try the patch Alan has posted, run the server in debug mode, and post the logs? Please don't do this on a production server. For some reason, the patch is causing my server to segfault. (It doesn't matter what the OS is (WinXP, VISTA, they all cause it to seg fault with DEBUG printing) -----Original Message----- From: freeradius-users-bounces+mking=bridgew.edu@lists.freeradius.org [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freeradius.org] On Behalf Of Dourty, Brian R. (IATS) Sent: Thursday, October 19, 2006 4:44 PM To: FreeRadius users mailing list Subject: RE: Windows Vista doing PEAP We have also posted here about our difficulties with Windows Vista and our FR. It isn't working for us either. Brian

-----Original Message----- From: freeradius-users- bounces+dourtyb=missouri.edu@lists.freeradius.org [mailto:freeradius- users-bounces+dourtyb=missouri.edu@lists.freeradius.org] On Behalf Of King, Michael Sent: Thursday, October 19, 2006 2:52 PM To: FreeRadius users mailing list Subject: RE: Windows Vista doing PEAP

-----Original Message----- Sorry - I've come late to this thread. Do we have a general problem with Vista failing to authenticate against FR, or is this just one instance failing, and we know of other instances where it is working?

It's most likely I'm the first to try it, and I've had..... Difficulties :-)

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Josh Howlett wrote:

...

Again, I have no idea why it's core dumping. It shouldn't be. I don't have Vista, and I can't debug this issue myself. It's up to you.

Sorry - I've come late to this thread. Do we have a general problem with Vista failing to authenticate against FR, or is this just one instance failing, and we know of other instances where it is working?

It's a general problem. Sadly the "netsh ras set tracing * enable" thing seems not to be present or work under the vista RCs we've looked at and there was little of value in the event logs so the cause is somewhat hard to pin down. It's definitely PEAP (as opposed to EAP-TLS) related. Knowing MS they've made a TLV that was previously optional, mandatory, or similar. Given the problems seems to be windows-centred, someone with more windows experience may need to get info from the client as to why *it* thinks things are going awry

-----Original Message-----

...

Again, I have no idea why it's core dumping. It shouldn't be. I don't have Vista, and I can't debug this issue myself. It's up to you.

Should this line be like this? DEBUG2("VISTA[%s:%s]: here", __FUNCTION__, __LINE__); I have not coded in C (or C++) for 5 years. I did some reading, and __LINE__ returns an integer (%d). Would that cause a segfault, I figured it would just cause a compile error. I changed __FUNCTION__ to __func__ and the second %s to %d, and the last line in the patch, I removed the two %s%s which had no varibles. I got this.. (The Patch worked) =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2006.10.19 17:52:44 =~=~=~=~=~=~=~=~=~=~=~= clear/usr/sbin/freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1280000 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response} " Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/certs/rad2.campus.bridgew.edu.privkey.pem" tls: certificate_file = "/etc/freeradius/certs/rad2.campus.bridgew.edu.cer" tls: CA_file = "/etc/freeradius/certs/IPS-IPSCABUNDLE.CRT" tls: private_key_password = "(null)" tls: dh_file = "/etc/freeradius/certs/dh" tls: random_file = "/etc/freeradius/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.0.1.12:32769, id=190, length=179 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.12 NAS-Identifier = "BUWISM1-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x0205000e014253435c6d6b696e67 Message-Authenticator = 0xe8ef97a7540606cbd99f433e66af4f2d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "BSC\mking", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 5 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 VISTA[eap_authenticate:341]: here VISTA[eap_compose:475]: reply->id 5 VISTA[eap_compose:476]: reply->code 1 VISTA[eap_compose:514]: eap->request->code 1 VISTA[eap_compose:515]: eap->request->type.type 0 VISTA[eap_compose:516]: handler->eap_type 25 VISTA[eap_compose:523]: Setting EAP type VISTA]: rcode 3 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 190 to 10.0.1.12 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010600061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6a58879f717b5616d92188ef0508bf15 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.12:32769, id=191, length=303 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.12 NAS-Identifier = "BUWISM1-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x0206007819800000006e16030100690100006503014537f3e34070df7f383882e6da6c 989a8dfdfc864b8d598806640919f33d4ed1000018002f00350005000ac009c00ac013c0 140032003800130004010000240000000e000c0000096273635c6d6b696e67000a000800 06001700180019000b00020100 State = 0x6a58879f717b5616d92188ef0508bf15 Message-Authenticator = 0x1152ca164579e5ab619574036ee4f556 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "BSC\mking", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 6 length 120 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0069], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0f42], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED VISTA[eap_authenticate:341]: here VISTA[eap_compose:475]: reply->id 6 VISTA[eap_compose:476]: reply->code 1 VISTA[eap_compose:514]: eap->request->code 1 VISTA[eap_compose:515]: eap->request->type.type 0 VISTA[eap_compose:516]: handler->eap_type 25 VISTA[eap_compose:523]: Setting EAP type VISTA]: rcode 3 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 191 to 10.0.1.12 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0107040a19c000000f9f160301004a0200004603014537f3e3454e6e5b0a00defd26c0 8739c97c3e2459f7f87ec363cd62dae679ca20a832eea17a17b98b7f63304706f5837ced 53e36c6c701cc8bcabb9628ddf7bcd002f001603010f420b000f3e000f3b00068d308206 89308205f2a0030201020203009187300d06092a864886f70d010105050030820112310b 3009060355040613024553311230100603550408130942617263656c6f6e613112301006 03550407130942617263656c6f6e6131293027060355040a132049505320436572746966 69636174696f6e20417574686f7269747920732e6c2e312e302c060355040a142567656e 6572 EAP-Message = 0x616c4069707363612e636f6d20432e492e462e2020422d423632323130363935312e30 2c060355040b1325697073434120434c41534541312043657274696669636174696f6e20 417574686f72697479312e302c06035504031325697073434120434c4153454131204365 7274696669636174696f6e20417574686f726974793120301e06092a864886f70d010901 161167656e6572616c4069707363612e636f6d301e170d3036303530343232313331345a 170d3038303530333232313331345a3081c3310b30090603550406130255533116301406 03550408130d4d617373616368757365747473311430120603550407130b427269646765 7761 EAP-Message = 0x74657231223020060355040a1319427269646765776174657220537461746520436f6c 6c656765311b3019060355040b131254656c65636f6d6d756e69636174696f6e73312030 1e06035504031317726164322e63616d7075732e627269646765772e6564753123302106 092a864886f70d010901161474656c65636f6d6d40627269646765772e65647530819f30 0d06092a864886f70d010101050003818d0030818902818100bafacc8f16e6686769b809 7698e2aeef926367d3d91ab2eb0110ca80f484c9c0ca3ce4eb11e92ffc968e9b585444c9 557738f9ae5839a7b1d10ece940548abb5def53f18be41dc5a5c83a0011481450cfeafcd 7a7e EAP-Message = 0xd7ff87eb7e1ca346ee2a361e8093b98ba19c272f43d213c7d3f58847e6709ef86714eb f0736a01d0f4c44d0203010001a38203373082033330090603551d130402300030110609 6086480186f8420101040403020640300b0603551d0f0404030203f830130603551d2504 0c300a06082b06010505070301301d0603551d0e04160414788bb22abb6e8a41d4a35b01 66a8047f0746d9b7301f0603551d230418301680140e0760d439c91b5b5d907b23c8d234 9d4a9a4639301f0603551d1104183016811474656c65636f6d6d40627269646765772e65 6475301c0603551d1204153013811167656e6572616c4069707363612e636f6d30720609 6086 EAP-Message = 0x480186f842010d046516634f7267616e697a6174696f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x399395fb535f7b5376b204e0c52f389b Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.12:32769, id=192, length=189 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.12 NAS-Identifier = "BUWISM1-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x020700061900 State = 0x399395fb535f7b5376b204e0c52f389b Message-Authenticator = 0x379f503b31ccc665f1cad05a000d91b0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "BSC\mking", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 7 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED VISTA[eap_authenticate:341]: here VISTA[eap_compose:475]: reply->id 7 VISTA[eap_compose:476]: reply->code 1 VISTA[eap_compose:514]: eap->request->code 1 VISTA[eap_compose:515]: eap->request->type.type 0 VISTA[eap_compose:516]: handler->eap_type 25 VISTA[eap_compose:523]: Setting EAP type VISTA]: rcode 3 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 192 to 10.0.1.12 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0108040619406e20496e666f726d6174696f6e204e4f542056414c4944415445442e20 434c41534541312053657276657220436572746966696361746520697373756564206279 2068747470733a2f2f7777772e69707363612e636f6d2f302f06096086480186f8420102 0422162068747470733a2f2f7777772e69707363612e636f6d2f6970736361323030322f 304306096086480186f84201040436163468747470733a2f2f7777772e69707363612e63 6f6d2f6970736361323030322f697073636132303032434c41534541312e63726c304606 096086480186f84201030439163768747470733a2f2f7777772e69707363612e636f6d2f 6970 EAP-Message = 0x736361323030322f7265766f636174696f6e434c41534541312e68746d6c3f30430609 6086480186f84201070436163468747470733a2f2f7777772e69707363612e636f6d2f69 70736361323030322f72656e6577616c434c41534541312e68746d6c3f30410609608648 0186f84201080434163268747470733a2f2f7777772e69707363612e636f6d2f69707363 61323030322f706f6c696379434c41534541312e68746d6c3081830603551d1f047c307a 3039a037a0358633687474703a2f2f7777772e69707363612e636f6d2f69707363613230 30322f697073636132303032434c41534541312e63726c303da03ba0398637687474703a 2f2f EAP-Message = 0x7777776261636b2e69707363612e636f6d2f6970736361323030322f69707363613230 3032434c41534541312e63726c303206082b0601050507010104263024302206082b0601 05050730018616687474703a2f2f6f6373702e69707363612e636f6d2f300d06092a8648 86f70d0101050500038181002f3dd42c1e10181bdd0c69894e19e045c958fd430fc2fd52 9a6c0c19db08b7df43ee5b948d26f7dbcfe04d0ae488f7ecee9dbedc296722a33c0d0291 c1244aa67c913c4e2fe2cae9087971f71e42f5da2fb52f5288ed6d4ed3e5b47165d4ba89 fd3a37d2fd6de04ad2ac3bb0873f97626c50338a20d91ea129be3539037cf4e80005ea30 8205 EAP-Message = 0xe63082054fa0030201020203009018300d06092a864886f70d01010505003081a3310b 3009060355040613024553311230100603550408130942415243454c4f4e413112301006 03550407130942415243454c4f4e4131193017060355040a131049505320536567757269 64616420434131183016060355040b130f43657274696669636163696f6e657331173015 0603550403130e495053205345525649444f524553311e301c06092a864886f70d010901 160f697073406d61696c2e6970732e6573301e170d3031313233303133333631315a170d 3235313232393133333631315a30820112310b3009060355040613024553311230100603 5504 EAP-Message = 0x08130942617263656c6f6e61311230100603 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc5baca98753fda4ad09de51d30999b60 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.12:32769, id=193, length=189 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.12 NAS-Identifier = "BUWISM1-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x020800061900 State = 0xc5baca98753fda4ad09de51d30999b60 Message-Authenticator = 0xe8f5fd61f9f1a9b0425cd24066c046f2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "BSC\mking", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 8 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED VISTA[eap_authenticate:341]: here VISTA[eap_compose:475]: reply->id 8 VISTA[eap_compose:476]: reply->code 1 VISTA[eap_compose:514]: eap->request->code 1 VISTA[eap_compose:515]: eap->request->type.type 0 VISTA[eap_compose:516]: handler->eap_type 25 VISTA[eap_compose:523]: Setting EAP type VISTA]: rcode 3 modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 193 to 10.0.1.12 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010904061940550407130942617263656c6f6e6131293027060355040a132049505320 43657274696669636174696f6e20417574686f7269747920732e6c2e312e302c06035504 0a142567656e6572616c4069707363612e636f6d20432e492e462e2020422d4236323231 30363935312e302c060355040b1325697073434120434c41534541312043657274696669 636174696f6e20417574686f72697479312e302c06035504031325697073434120434c41 534541312043657274696669636174696f6e20417574686f726974793120301e06092a86 4886f70d010901161167656e6572616c4069707363612e636f6d30819f300d06092a8648 86f7 EAP-Message = 0x0d010101050003818d0030818902818100a6f57366361da32f4fad2ad8ef0ca64befa7 1bacf7f246171bb202ab3e11898c6aa80fd8631499d71fbcb22768026ef43089ebadeb41 dcb44206fa481f138c64df872dc714d4a783e4723b32ead34d793165050933812b6ee636 ad211133362b68cabe432c37b73d69163be59dbe32a7d5df4a80fcda7370aad928822f68 bbb10203010001a38202b4308202b0300c0603551d13040530030101ff30110609608648 0186f8420101040403020007300c0603551d0f0405030307ff80306b0603551d25046430 6206082b0601050507030106082b0601050507030206082b0601050507030306082b0601 0505 EAP-Message = 0x07030406082b06010505070308060a2b060104018237020115060a2b06010401823702 0116060a2b0601040182370a0301060a2b0601040182370a0304301d0603551d0e041604 140e0760d439c91b5b5d907b23c8d2349d4a9a46393081ba0603551d230481b23081afa1 81a9a481a63081a3310b3009060355040613024553311230100603550408130942415243 454c4f4e41311230100603550407130942415243454c4f4e4131193017060355040a1310 4950532053656775726964616420434131183016060355040b130f436572746966696361 63696f6e6573311730150603550403130e495053205345525649444f524553311e301c06 092a EAP-Message = 0x864886f70d010901160f697073406d61696c2e6970732e6573820100301c0603551d11 04153013811167656e6572616c4069707363612e636f6d30090603551d12040230003043 06096086480186f842010d04361634434c41534541312043412043657274696669636174 65206973737565642062792068747470733a2f2f7777772e6970732e65732f3022060960 86480186f84201020415161368747470733a2f2f7777772e6970732e65732f3073060355 1d1f046c306a3031a02fa02d862b68747470733a2f2f7777772e6970732e65732f63726c 2f6970735345525649444f52455363726c2e63726c3035a033a031862f68747470733a2f 2f77 EAP-Message = 0x77776261636b2e6970732e65732f63726c2f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8e4448f009c6178344b4f186125a3a4c Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.12:32769, id=194, length=189 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.12 NAS-Identifier = "BUWISM1-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x020900061900 State = 0x8e4448f009c6178344b4f186125a3a4c Message-Authenticator = 0xe452b64d08b70a932153d982511e0d12 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "BSC\mking", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 9 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED VISTA[eap_authenticate:341]: here VISTA[eap_compose:475]: reply->id 9 VISTA[eap_compose:476]: reply->code 1 VISTA[eap_compose:514]: eap->request->code 1 VISTA[eap_compose:515]: eap->request->type.type 0 VISTA[eap_compose:516]: handler->eap_type 25 VISTA[eap_compose:523]: Setting EAP type VISTA]: rcode 3 modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 194 to 10.0.1.12 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010a03a519006970735345525649444f52455363726c2e63726c302f06082b06010505 07010104233021301f06082b060105050730018613687474703a2f2f6f6373702e697073 2e45532f300d06092a864886f70d01010505000381810027054a0c74c9145dc875c8deee 890c631e1f0184c702cb19d791c8dd3ecfb0c8f3f592b5548254621f32eb80a17d56f1e4 e7285926a47df0ca2d31c6c9f3709dc1cf5e26a4efb212e788e81985ed80e43902688763 a9133c6cf5456a22ce9656075fa6a3ee370a6e928b9e40de143019289390b7f3fcb54ef2 f7960ebb1094d40002bb308202b730820220020100300d06092a864886f70d0101040500 3081 EAP-Message = 0xa3310b3009060355040613024553311230100603550408130942415243454c4f4e4131 1230100603550407130942415243454c4f4e4131193017060355040a1310495053205365 6775726964616420434131183016060355040b130f43657274696669636163696f6e6573 311730150603550403130e495053205345525649444f524553311e301c06092a864886f7 0d010901160f697073406d61696c2e6970732e6573301e170d3938303130313233323130 375a170d3039313232393233323130375a3081a3310b3009060355040613024553311230 100603550408130942415243454c4f4e41311230100603550407130942415243454c4f4e 4131 EAP-Message = 0x193017060355040a13104950532053656775726964616420434131183016060355040b 130f43657274696669636163696f6e6573311730150603550403130e4950532053455256 49444f524553311e301c06092a864886f70d010901160f697073406d61696c2e6970732e 657330819f300d06092a864886f70d010101050003818d0030818902818100ac4f52749f 39ea8edc25c4bc985d986424093c21b3cc19b58e948e87d1f8373ea1c82d58a480355ba1 756c1d450c1f61636a5e6f9b0a4cc1c8b861233581fffeac78702d68e13a0798950254dd cd23b78053d7c8374572062412ba1361218a6e7528e0c50f34fd36d8457fe1b836efb3e1 c620 EAP-Message = 0x8ee8b438bce13ef611de8c9d010203010001300d06092a864886f70d01010405000381 81002cf3c3795824dec63bd1e04269b8ee64b33d6201b9b384df237ddd98cf10a9fe00d8 22960513075457c5a7decbd9b88842f699db14771fb6fe253de1a23e03a981d22d6c47f5 96468c22abc8cc0d0e975e8b41b43bc40a06401ddd46f401ddba822e3c3d78709e7c18d0 abf8b877074671f1ca0b635c6af97294d5014fa0db4216030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0259cf5b7108504dc773820306112957 Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.12:32769, id=195, length=391 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.12 NAS-Identifier = "BUWISM1-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x020a00d01980000000c616030100861000008200800c7a24a3d7f670a56ae0b1bfdee8 6f18da2f6dee934bc3c311bb4d49b40ae399b8238aaa42031231dd81d16fa2d80c8a7c87 74147ebd1d9e06921938f4da10e830bedadc4c3c9b998e599da0007c71def67db2756ec4 6ee55ed7996565e41c3e663fb5a23f4ae4cd4a95a51fb1e22e4126d537df741195717728 cbe240b422ff14030100010116030100305d5ade80b1d7bdeba4be62be65b74a255f625c 75630efce8a2ed9c07a596eb49c770536e996c0dbeeec10cd1d2ee30dc State = 0x0259cf5b7108504dc773820306112957 Message-Authenticator = 0x374248fb2c533feb42110fae8d52493f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "BSC\mking", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 10 length 208 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED VISTA[eap_authenticate:341]: here VISTA[eap_compose:475]: reply->id 10 VISTA[eap_compose:476]: reply->code 1 VISTA[eap_compose:514]: eap->request->code 1 VISTA[eap_compose:515]: eap->request->type.type 0 VISTA[eap_compose:516]: handler->eap_type 25 VISTA[eap_compose:523]: Setting EAP type VISTA]: rcode 3 modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 195 to 10.0.1.12 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010b004119001403010001011603010030263cf9a0d40f3916cc2875a89475bba2943f 4e7aff9be5f0a89ed96e17ce1bd7e03ca1801ff9f39856b8012ea86741c3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xde18ef11757232719579055a046a93a6 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.12:32769, id=196, length=189 User-Name = "BSC\\mking" Calling-Station-Id = "00-13-02-1B-4F-01" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.12 NAS-Identifier = "BUWISM1-2" Airespace-Wlan-Id = 7 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x020b00061900 State = 0xde18ef11757232719579055a046a93a6 Message-Authenticator = 0xa8695b4f4d3b92922083d0d694b7ea3a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "BSC\mking", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 11 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS VISTA[eap_authenticate:341]: here VISTA[eap_compose:475]: reply->id 11 VISTA[eap_compose:476]: reply->code 1 VISTA[eap_compose:514]: eap->request->code 1 VISTA[eap_compose:515]: eap->request->type.type 0 VISTA[eap_compose:516]: handler->eap_type 25 VISTA[eap_compose:523]: Setting EAP type VISTA]: rcode 3 modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 196 to 10.0.1.12 port 32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010c005019001703010020388d4e0c86f5e81f5a3a12f8825aec1acbee45a540b156f7 9f8efebe31feed55170301002068620450a5430daa5f41ec40e12ab73f37589158a5fcce 083d35319c3915097f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x536badba63aaca35ec5cdf3002f3b1fb Finished request 6 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 190 with timestamp 4537f3e3 Cleaning up request 1 ID 191 with timestamp 4537f3e3 Cleaning up request 2 ID 192 with timestamp 4537f3e3 Cleaning up request 3 ID 193 with timestamp 4537f3e3 Cleaning up request 4 ID 194 with timestamp 4537f3e3 Cleaning up request 5 ID 195 with timestamp 4537f3e3 Cleaning up request 6 ID 196 with timestamp 4537f3e3 Nothing to do. Sleeping until we see a request. rad2:/home/mking#

-----Original Message----- Are you sure you're using the new code? It looks to me like it's NOT installing the server with symbols, and it's NOT printing the new debugging messages. I was, I just wasn't building the server right. I figured it out a few hours later (See my later emails) The last one has the gdb logs pasted into it.

Hello Alan, The "Radiator" people are talking about problems with SSL empty fragments handing in Windows Vista ... I've tried to compile FreeRADIUS with SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS but the final result is the same, clients can't connect! in: http://www.open.com.au/radiator/history.html

# Enabled SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS in PEAP TLS, to work around a problem with Vista Beta 2 clients, where the extra empty fragment (sent as a security measure by OpenSSL) confuses the Vista PEAP supplicant. See http://www.openssl.org/~bodo/tls-cbc.txt for reasons behind the empty fragments. Reported by David Spindler.

Best Regards! Wednesday, October 4, 2006, 4:14:25 PM, you wrote:

"King, Michael" <MKing@bridgew.edu> wrote:

...

So we've been using FreeRADIUS talking to ActiveDirectory to authenticate our WinXP clients (Over 2000) for over a year now. Along comes Vista. Of COURSE it doesn't work. Microsoft changed something, and it broke a working config. Arrg.

Try: http://www.striker.ottawa.on.ca/~aland/vista.patch

You'll have to re-build & re-install the EAP module (you don't need to touch the rest of the server). It won't help, but it will print out a little more information. We'll probably have to do a few cycles before it's tracked down, though.

...

My (amatuer) analyis, (Aka my gut) is that Vista is Doing something in TLS, not PEAP. (I don't see my mschap module fire).

The TLS tunnel is set up, BUT vista is doing something slightly different that confuses FreeRADIUS, so FreeRADIUS doesn't continue the EAP conversation.

Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Best regards, =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Pedro Ribeiro IPLNet - Rede de dados e comunicações Instituto Politécnico de Lisboa (IPL) Mail: mailto:pribeiro@net.ipl.pt VoIP: sip:pribeiro@net.ipl.pt =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

hey, Vista now working with freeRADIUS? any debugging information needed? ca mIke Alan DeKok schrieb:

Pedro Ribeiro <pribeiro-bulk@net.ipl.pt> wrote:

...

The "Radiator" people are talking about problems with SSL empty fragments handing in Windows Vista ... I've tried to compile FreeRADIUS with SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS but the final result is the same, clients can't connect!

i.e. the patch below MAY help. There is still an issue in the FreeRADIUS state machine where it MAY send an empty ACK once the SSL tunnel is set up. Most clients seem to be OK with this, but maybe Vista isn't.

A solution, I *think* would be to have FreeRADIUS send an EAP Identity request inside of the tunneled session for PEAP, as soon as the session is established. This should work with third-party supplicants, and may allow Vista to work, too.

Alan DeKok schrieb:

Michael Messner wrote:

...

Vista now working with freeRADIUS?

No idea.

...

any debugging information needed?

Yes, someone to test it would be nice. I don't have Vista, so I can't test it.

I think you have not seen the mail from pribeiro-bulk@net.ipl.pt with subject: Re[4]: Windows Vista doing PEAP - WORKING!!!

...

Hello Alan, I can confirm it's working now!!!

so my question is when there will be the next freeRADIUS release with included vista support? ca mIke

Michael Messner wrote:

I think you have not seen the mail from pribeiro-bulk@net.ipl.pt with subject: Re[4]: Windows Vista doing PEAP - WORKING!!!

Hmm... I have noticed the occasional email show up in the list archives, but not in my inbox. Oh well. I've added the patch to 1.1.4 & CVS head. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

The patch did improve things, but is still isn't perfect. If I configure my VISTA client to prompt me for my credentials the authentication works and I get connected. If I configure my VISTA client to use my windows login credentials (This is the default behavior) the Auth fails. For some reason the arguments to ntlm_auth aren't right. I've looked at the requests and don't see anything different as far as domain/username. It still functions fine under XP, even when XP uses windows credentials for the log in rather than prompting. Brian -----Original Message----- From: freeradius-users-bounces+dourtyb=missouri.edu@lists.freeradius.org [mailto:freeradius-users-bounces+dourtyb=missouri.edu@lists.freeradius.o rg] On Behalf Of Michael Griego Sent: Wednesday, November 29, 2006 9:30 PM To: FreeRadius users mailing list Subject: Re: Windows Vista doing PEAP Cool deal. I have also been able to confirm that adding the SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS option to the CTX makes Vista work. This is good news for us since we have a volume license deal and now have release copies beginning to be installed. :) --Mike On Nov 29, 2006, at 5:00 PM, Alan DeKok wrote:

Michael Messner wrote:

...

I think you have not seen the mail from pribeiro-bulk@net.ipl.pt with subject: Re[4]: Windows Vista doing PEAP - WORKING!!!

Hmm... I have noticed the occasional email show up in the list archives, but not in my inbox. Oh well.

I've added the patch to 1.1.4 & CVS head.

Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/ users.html