Hi, I have a FreeRADIUS-server for configuration testing purposes and on this server TTLS-MSCHAPv2 works fine but PEAP-MSCHAPv2 fails. PEAP-MSCHAPv2 fails both with the WindowsXP client and the NetworkManager included in Ubuntu 8.04 LTS. The output from radius -X are shown below. The configuration files are attached. I'd appreciate if someone could take a look at this and check where the problem might be. Regards, Wenche Backman PEAP-MSCHAPv2 failure (this one from Ubuntu 8.04 LTS, the output from WinXP is the same): Ready to process requests rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=137 User-Name = "du@mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000011016475406d79746573742e6669 Message-Authenticator = 0xb613072b66070df9b35799b65683a666 server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du@mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 0 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b666ed0567b6ebba8e637a5c Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=231 Cleaning up request 0 ID 0 with timestamp +107 User-Name = "du@mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b666ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201005d190016030100520100004e03014d638d2813d992579c034f3369d4734a02fcc8603b1297948e5ee5d6950eb9ae00002600390038003500160013000a00330032002f0005000400150012000900140011000800060003020100 Message-Authenticator = 0x7aaf685db9bfc8a730e04e61846a8ba4 server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du@mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 1 length 93 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0052], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x0102040019c000000aad160301002a0200002603014d638d2822caad2a4af2262ab74eea2824d9767d409a66ca0cfad0ae45610e7500003901160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039303131363130323433375a170d3130303131363130323433375a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100bca3a7d340515ebd6023cbfb2c18b2ffc99f5276c2af17db6621b34a2e596aa4193eee8582efc0a84f8cb24b740602f7344f0d3e07f05dfab378f03112e3 EAP-Message = 0xa43530d75b5a611e456d530cc9e9a5143dbdcf6129d99273f9960b4d6bb2124f42bc61be778bad4e34a21d75e2904cc26ab003927898cdab60fb4bc1780c19d23e5d64065248e8a2e586a9d7f7ac6dc089269890532c952ea979de7202b549e5979c1be63419a29d64febe0a4576d629e7431a2e1fcca05c550172c0c4e309e746662bb2a80d26c975b979409596dd3e079a96850532745cb92dfdca8aab7bbb66fedd8a9ac3f30c62252a453c57acbc33cb0f669326ece07032fafb4584bcc417430203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100110e3b6ca51ea7854b EAP-Message = 0x05a122cefcc96f0060bc1c3d2de06a79f50ff17de7c50664598b7b499ebf536f80bc0c3a86bfb6c9837cd23992d522be1693f12aa3b9e8eead66d0e85316cb038b7673642d83b924891b057126d85e52d91452c0a52203424fc16d6094e812ef0bd1535852edbe3e5a9696a0c5c7611badba4f789f1a04dd6548127c82d7b4e4635c03b12b621b2b4022644907e12ab5f0ecfd4863cfeb440636da869fcb57b65d67b95c007afb7bd160d20e01d946cb8f4d7a3d6c252417172ea45ffb847585e98c8c6d0d34094d031cc69cfc015b24297fa0d085fe4dfb2b2de27a9363d8d023b151867e8a5c04dcfc072e0397a063db3bf4bdc5f26f0004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b765ed0567b6ebba8e637a5c Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=144 Cleaning up request 1 ID 0 with timestamp +107 User-Name = "du@mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b765ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200061900 Message-Authenticator = 0xf24d59a32f188207dee0c313a901bfb3 server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du@mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x010303fc19400095425f8466e364f5300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303131363130323433375a170d3130303131363130323433375a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a79b656861b09eb9d5bd77174981b3b00554530ffc18238cf3164a1882e42c6379db8d256187bc4788e63349ae25379f606087ab41864d8a533d738c7c5286b4057c96d0f5be5972a34b0d27d784d2571bc8a085f15fd17942948566e7589f1b4994676beb9e3d9828bdda3bd6f767 EAP-Message = 0xed21bdf2e4bd035a8e235ddf4341c2b5a587e707e5b333c49d4533110ce905b31071c90bc795dee46e8b0b063862c0d58c4765553bcef3d8408dffcb951b81a1b5e8e61f5e857bc6f5931f132146fd145ed316517e7e8bd8f5941b7d571a7a0b8500a2d4538c0a036d12ce655a55dea0b4360739b0c251ed44c91900b67a7206c83e22b34ead286d9ac6023258892f4d150203010001a381fb3081f8301d0603551d0e041604140397fbc3d67c570e8f13b91c45394b5f44616cf43081c80603551d230481c03081bd80140397fbc3d67c570e8f13b91c45394b5f44616cf4a18199a48196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747982090095425f8466e364f5300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010023477ecf0e1f391af60dccc8605dd8743615a07242f1d68f3815855b86ab605a9fa22c9da76fe73fdcceb1a76afb224d424dd032efa93e7d7bacc26a0fc592ed29a04993e5c4043fcfd4312b92337b2919f5 EAP-Message = 0x5746b2fc48857aac Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b464ed0567b6ebba8e637a5c Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=144 Cleaning up request 2 ID 0 with timestamp +107 User-Name = "du@mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b464ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061900 Message-Authenticator = 0xb8250ec4167cfca1229cd8fed99c2ebe server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du@mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x010402c71900d8fba265108675c4143ba764839add9dad12b1e94d9c914c0f18108e5d9f99090bf291b83623238457fe4576e87c1f3b3cb9dd0cf0de1522e48948e5af796c8ed530986f5610a0dc3b0d89fa14686238e318a1cbb0de862d2ea63cc0b0b29ae1210bf94ab9e772de19b817e7d0df45b71a9595499756b5d5e6c757ca7bc55b1fc7a3ebe98be922105889149cfaa023c94eda62121c053d11f6c6e59736b2d25a0496aab4db2f160301020d0c0002090080d6c327b60d685b7dea0b3bf533d54f8e151fb5d72b4a805e4c120a847706984eedeb80d3a48fabd0f36bbabdd4125fe717709c5c73010ac5185e4154b12c4738f6cb62d40b82 EAP-Message = 0x47efc9ae7da9c0612f0bf7592be07f1eb2f5b45b5289743831f2b2cad359dbf213c9e14aaf44a1ede1e7ac48b9fbb7b371d82ec2d6ab9415ff230001020080185049cf069168f5fa3037bab3f8cbe72ffa09d5222d80db41a2265b2a270aae741f7ef06a574144055e27724d75001556dd166feedcfb7827625b2fa66f72a1c85cd9dc3e1dd693ef38f2bf0c3d8f08e21d86b9ed9d8dba54a571bdb36bed6190ddfa42816f76e3a154799ba7c629ca358df7f55f2746f7918be7a9ded259fb01006b443e4a0e6f85d615db5c3a3308860a8e7335b4c3ed7a6ca6a26b60b60399b81d97499c77a6c889c21293b3bcc5ff03b87cc98556f0b3d6c1e211ed EAP-Message = 0x7e11c75caad6f24d6d967130f88120690fbce884666d5c4d9e235230e58b53878eb7437b253601580401c2cafba3ae088abce707763cec25709e95cb0dc4a3a9b772a507058baa5783dbf780b2e59cc2be5e8bf28401722211bec6093170c426993baf969daad724132211f1ae38314bbbb6e6a7681a57894482574f43fc60fc18d8f40b92d2fa6de896ddedfd5be469845235a8fa561c2abc94cd37764575ff0c209165d1d128af9cde0b51be10533052b7180313f411529ba43abd073e54b2111495a516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b563ed0567b6ebba8e637a5c Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=342 Cleaning up request 3 ID 0 with timestamp +107 User-Name = "du@mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b563ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400cc1900160301008610000082008086f0298b073e157e853a830e045a18b40f17a02efbe131d943518b00817f8a72a2be1b64d1208657beea1cff038418106c6beda352e34d9950e7b9c397932bd7cb8f722ff87b819edfea5910676e1e898ec4c071c6cdedab5b8c8980dbd752c9f74bbf5818cc35900515d0a97a4b6139b94e24c2b0aa1aa7ca282e205952121e140301000101160301003053d0e5fbe8ed7e32c5d7318f3baf834371d7ccc760d9a0fb0b2320f9707c9acf7f218bcb8c70a8b51e88bbdc2274aec8 Message-Authenticator = 0x7b92c60ebe961910947ed53e0f3deced server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du@mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 204 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x01050041190014030100010116030100305a7b9877876923768d3f6b8ddffb2a49d7c701b35c74a0c803a5c99b9b632fcb4eeb6ef635de4e8994feef3c84f828ff Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b262ed0567b6ebba8e637a5c Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=144 Cleaning up request 4 ID 0 with timestamp +107 User-Name = "du@mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b262ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0xc5648cb005eb7be3dcd512844c73fc53 server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du@mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x0106002b190017030100204911606b54a92f837428b80e62f8fd2eaa9def9e14ca28d915ccc4e1718e421e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b361ed0567b6ebba8e637a5c Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=234 Cleaning up request 5 ID 0 with timestamp +107 User-Name = "du@mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b361ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600601900170301002084f81dbeee164be0d004166b849fec7362852574d78846dad2b62b39b08cf6a51703010030825c7db26910cfcc090ad6f9edf862db3bf8a16401564750eb0bcf77857da0fdb7de955192557ac83755357f816949b9 Message-Authenticator = 0xa9e56e06a53d4769e832e0f8cee70a4d server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du@mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 6 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - du@mytest.fi [peap] Got tunneled request EAP-Message = 0x02060011016475406d79746573742e6669 server eduroam { PEAP: Got tunneled identity of du@mytest.fi PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to du@mytest.fi Sending tunneled request EAP-Message = 0x02060011016475406d79746573742e6669 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "du@mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 server eduroam-inner-tunnel { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [files] users: Matched entry du@mytest.fi at line 206 ++[files] returns ok ++[mschap] returns noop [pap] Normalizing NT-Password from hex encoding [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. } # server eduroam-inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled } # server eduroam Sending Access-Challenge of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x0107003b19001703010030998319d6fd8e167dc17373bdbd74ff90ed3b3565f1eeec9f48a3fabf8022e8a3f0d84d04fed1507c2be2696c67f0591b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb667f4e0b060ed0567b6ebba8e637a5c Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 193.166.6.179 port 2048, id=0, length=234 Cleaning up request 6 ID 0 with timestamp +107 User-Name = "du@mytest.fi" NAS-IP-Address = 193.166.6.179 Called-Station-Id = "000d0b6cd027" Calling-Station-Id = "001de01a9a47" NAS-Identifier = "000d0b6cd027" NAS-Port = 7 Framed-MTU = 1400 State = 0xb667f4e0b060ed0567b6ebba8e637a5c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02070060190017030100206a2891cc8d712812216d36fc9a6aafafcfa02faf5c3746b46c8b5bd3fec306071703010030bb13eb9f3a5a8808db75cf59c22d50994ae45e0ecc1f7b91c3e00de1e70e8e45a98adbe3b2d7a7e15547c50362d7fdda Message-Authenticator = 0x534b7bb55532f1fde1e5c3205e83ecae server eduroam { +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/auth-detail-20110222 [auth_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[auth_log] returns ok [suffix] Looking up realm "mytest.fi" for User-Name = "du@mytest.fi" [suffix] Found realm "mytest.fi" [suffix] Adding Realm = "mytest.fi" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 7 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server eduroam Using Post-Auth-Type Reject +- entering group REJECT {...} [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/193.166.6.179/reply-detail-20110222 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/193.166.6.179/reply-detail-20110222 [reply_log] expand: %t -> Tue Feb 22 12:17:12 2011 ++[reply_log] returns ok Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 0 to 193.166.6.179 port 2048 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 7 ID 0 with timestamp +107 Ready to process requests. Wenche Backman Tietoliikenneasiantuntija CSC - Tieteen tietotekniikan keskus Oy PL 405, 02101 Espoo (09) 457 2737, Wenche.Backman@csc.fi Ms. Wenche Backman Data Communications Specialist CSC - IT Center for Science Ltd. P.O. BOX 405, FI-02101 Espoo, Finland +358 9 457 2737, Wenche.Backman@csc.fi