Please help ........ I cannot see the problem after a day of reading the lists and googling... hopefully a fresh pair of eyes ???? I am trying to authorize to the network via an ntlm_auth lookup against winbind using PEAP and MS-CHAP v2 etc etc Doing an ntlm_auth on the command line returns success... but on my radius server does not want to authenticate. I am fairly sure I have the certificates ok ?? Samba is joined to the windows domain o.k. I am trying to autheticate against a different domain that than the samba server is joined to.. should be ok ?? [root@curric4182-05 raddb]# ntlm_auth --request-nt-key --domain=admin4182 --username=e2052982 password: NT_STATUS_OK: Success (0x0) [root@curric4182-05 raddb]# . . . . my "stuff" is XP-SP2 Fedora Core 5 Samba 3.0.22-1 Freeradius 1.1.2 Windows 2003 Server AD Cisco Aironet 1100 series . . . Error message is modcall: entering group MS-CHAP for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for e2052982 with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: d6 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=e2052982 --domain=ADMIN4182 --challenge=7801a84637ef5c68 --nt-response=4f77faa8137d60ae186c5f910fea83f936dbd827ac54f757' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=e2052982 --domain=ADMIN4182 --challenge=7801a84637ef5c68 --nt-response=4f77faa8137d60ae186c5f910fea83f936dbd827ac54f757 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 . . . radius -X dump follows .... sorry about the length .. trimmed after first error. TIA Peter Peter de Groot Windows Re-Installation Engineer Eastern Goldfields College Ph 08) 90801800 Fax 08) 90801866 Mob 0418915312 http://egshs.wa.edu.au Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/curric4182-05-cert.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/curric4182-05-cert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/EGC-cacert.pem" tls: private_key_password = "blah-blahk" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.251.20.20:1645, id=236, length=154 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Message-Authenticator = 0xe11606b2cec3600fff69002a34d3c5ce EAP-Message = 0x020200170141444d494e343138325c6532303532393832 NAS-Port-Type = Wireless-802.11 NAS-Port = 366 NAS-IP-Address = 10.251.20.20 NAS-Identifier = "EGC-AP1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 23 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 236 to 10.251.20.20 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd474c0e53a0b58913df6a8463f681310 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.251.20.20:1645, id=237, length=229 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Message-Authenticator = 0x08066899804ab07de6e77f4699f1aa83 EAP-Message = 0x0203005019800000004616030100410100003d030144b60c0f0ad558b9ba802bc7e5262d89eef41c42b99e1b2586f2674e6c13b4d200001600040005000a000900640062000300060013001200630100 NAS-Port-Type = Wireless-802.11 NAS-Port = 366 State = 0xd474c0e53a0b58913df6a8463f681310 NAS-IP-Address = 10.251.20.20 NAS-Identifier = "EGC-AP1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0927], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 237 to 10.251.20.20 port 1645 EAP-Message = 0x0104040a19c000000984160301004a02000046030144b60c6efb4a889fffbb7a1040fa321fed2f98d15922ba81f97720e9bf91222320e869084b36650b68cdb4f4448d3065f4c7e377e45b0a954fb72ee565850327fc00040016030109270b0009230009200004a33082049f30820408a003020102020101300d06092a864886f70d01010505003081ab310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20476f6c646669656c647320436f6c6c656765310b3009060355040b13024954310c30 EAP-Message = 0x0a06035504031303454743312b302906092a864886f70d010901161c70657465722e64652e67726f6f74406465742e77612e6564752e6175301e170d3036303731333036313435305a170d3037303731333036313435305a3081ba310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20476f6c646669656c647320436f6c6c656765310b3009060355040b13024954311630140603550403130d637572726963343138322d30353130302e06092a864886f70d0109011621637572726963343138 EAP-Message = 0x322d30352e637572726963343138322e696e7465726e616c30819f300d06092a864886f70d010101050003818d0030818902818100bcf987fa92038c5aa5258da59449a17ec88d0f6e74cd57a6a60d164878cd19cc41114bb9219fc9589b596dfc8bd29dcfad5a07dbb902ed55e4aacabb896bb66fa7e4cd8a91a59a4da8ce7fde59da64a5b41a847ce049a84434f7ff66c82131d483823a6fcc75e87c4bf0ac50afe9ce76fc31c249377e588cf0e8a600873119490203010001a38201c0308201bc30090603551d1304023000301106096086480186f8420101040403020640302b06096086480186f842010d041e161c54696e7943412047656e6572 EAP-Message = 0x61746564204365727469666963617465301d0603551d0e0416041401407fe6428a641a57e2635f01914af69a50b8673081e00603551d230481d83081d58014c4425cf4ef64fc9ccb4fd2bcf3e4d1807424c623a181b1a481ae3081ab310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20476f6c646669656c647320436f6c6c656765310b3009060355040b13024954310c300a06035504031303454743312b302906092a864886f70d010901161c70657465722e64652e67726f6f7440646574 EAP-Message = 0x2e77612e6564752e617582090093e8cb38c994b33630 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcb5b324f80946972d9dc9a23642def96 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.251.20.20:1645, id=238, length=155 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Message-Authenticator = 0xd2bcd6f014b60cf655218dedefae808e EAP-Message = 0x020400061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 366 State = 0xcb5b324f80946972d9dc9a23642def96 NAS-IP-Address = 10.251.20.20 NAS-Identifier = "EGC-AP1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 238 to 10.251.20.20 port 1645 EAP-Message = 0x010504061940270603551d120420301e811c70657465722e64652e67726f6f74406465742e77612e6564752e6175302c0603551d11042530238121637572726963343138322d30352e637572726963343138322e696e7465726e616c30160603551d250101ff040c300a06082b06010505070301300d06092a864886f70d0101050500038181000c02343214413546cb4ab2027fd6af5df023ed1ce47222a67e973b312e935480866898ca3c2fe7709e8e7ba889fc55f7738f6ecc80a6bf2821c11a5a479cc2a790415b7566d94bf95f9216f8026f130b5a6f6fe447aab9728363e57b9feb4dbf189615446f7265b702016e117cfc8cb03640cb1f2f0d EAP-Message = 0xb6aa78b4dddd66df23a900047730820473308203dca00302010202090093e8cb38c994b336300d06092a864886f70d01010505003081ab310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20476f6c646669656c647320436f6c6c656765310b3009060355040b13024954310c300a06035504031303454743312b302906092a864886f70d010901161c70657465722e64652e67726f6f74406465742e77612e6564752e6175301e170d3036303731333036313234395a170d3136303731303036 EAP-Message = 0x313234395a3081ab310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20476f6c646669656c647320436f6c6c656765310b3009060355040b13024954310c300a06035504031303454743312b302906092a864886f70d010901161c70657465722e64652e67726f6f74406465742e77612e6564752e617530819f300d06092a864886f70d010101050003818d0030818902818100a67e2366b0427ae2c7dab4cef1a303895c9f5ecaecf41dca705e1ae01dc9fa60866dbc7b1727ed2394fb4b02cc EAP-Message = 0x25398c9720c8f8db1e9d1ab70b224e334bc05346153a021b51fd929b073823b12fec849c442b0ca0ccfe0c691f992369d959f24435e04f657ff3ff023ba0adc554dabca8106ea86298892463f0ff3c1be161510203010001a382019b30820197301d0603551d0e04160414c4425cf4ef64fc9ccb4fd2bcf3e4d1807424c6233081e00603551d230481d83081d58014c4425cf4ef64fc9ccb4fd2bcf3e4d1807424c623a181b1a481ae3081ab310b3009060355040613024155311a3018060355040813115765737465726e204175737472616c6961311330110603550407130a4b616c676f6f726c696531233021060355040a131a4561737465726e20 EAP-Message = 0x476f6c646669656c647320436f6c6c656765 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf469ad941f526e94ec1351410d1ff22c Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.251.20.20:1645, id=239, length=155 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Message-Authenticator = 0x299168c635a6458965c93d093b864675 EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 366 State = 0xf469ad941f526e94ec1351410d1ff22c NAS-IP-Address = 10.251.20.20 NAS-Identifier = "EGC-AP1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 239 to 10.251.20.20 port 1645 EAP-Message = 0x0106018a1900310b3009060355040b13024954310c300a06035504031303454743312b302906092a864886f70d010901161c70657465722e64652e67726f6f74406465742e77612e6564752e617582090093e8cb38c994b336300f0603551d130101ff040530030101ff301106096086480186f842010104040302010630090603551d1204023000302b06096086480186f842010d041e161c54696e7943412047656e65726174656420436572746966696361746530270603551d110420301e811c70657465722e64652e67726f6f74406465742e77612e6564752e6175300e0603551d0f0101ff040403020106300d06092a864886f70d0101050500 EAP-Message = 0x03818100798ce3529751d1c0f5255a9ad4e083fe1748a50b633ed1f7cf22e644900e6eba42faae43d7476f486949d0169bda6336338a223b8a529af38c2b4118e933a7ddcda9560b47aaa7ef684b3cd850f961d6f2a75c2fb608dc5dbf49f24f0e6ab33c875ec6df3cccf92177beff8374764aa9d32d59917cbfd0a772295c6165d37bd716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x834ab11b4b0532b9f3d7d32909e2f097 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.251.20.20:1645, id=240, length=341 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Message-Authenticator = 0x11c2e6a099432e32221ecf243b2c342e EAP-Message = 0x020600c01980000000b6160301008610000082008068ea556a9d5bcff59d96209d732af9caba7c63c152206d7199be1a1b8723bde99b893065593eab9245bf98d712fbab31dc2aa5c2263bfa02bac2cbba65fe22b052bda4ce12163f452d40f88a927b37332c1d46081ae1255645b054d1e84761a15b75a1d3d3232a3d022625bed50921834c664db630a1f477ed7e35fa481cf96e1403010001011603010020e0786671da68ad577ac671807db1b1e35e0dd5e202baf00b0a9b9b30399b8200 NAS-Port-Type = Wireless-802.11 NAS-Port = 366 State = 0x834ab11b4b0532b9f3d7d32909e2f097 NAS-IP-Address = 10.251.20.20 NAS-Identifier = "EGC-AP1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 6 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 240 to 10.251.20.20 port 1645 EAP-Message = 0x0107003119001403010001011603010020931e9dc13b975a6087224dba25c64077e2ad548c12975f883faa74b60b0bda93 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4f1d96b5b26ae63457b22012f66e7fad Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.251.20.20:1645, id=241, length=155 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Message-Authenticator = 0x032b0a3a7ca860bc528ba8041fcb2485 EAP-Message = 0x020700061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 366 State = 0x4f1d96b5b26ae63457b22012f66e7fad NAS-IP-Address = 10.251.20.20 NAS-Identifier = "EGC-AP1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 7 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 241 to 10.251.20.20 port 1645 EAP-Message = 0x01080020190017030100156d61b9bad1cd18772d3a5bc4d047f8edd052218d92 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8db2c26675d6c8643212f191f157aa61 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.251.20.20:1645, id=242, length=195 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Message-Authenticator = 0xd5a8bdda87761e1572459a716f6d98d8 EAP-Message = 0x0208002e19001703010023141a817d827fa5e32dd020ac8a82e5874da2e7b6a35a0a432fa6f07ecd70ccc98942a7 NAS-Port-Type = Wireless-802.11 NAS-Port = 366 State = 0x8db2c26675d6c8643212f191f157aa61 NAS-IP-Address = 10.251.20.20 NAS-Identifier = "EGC-AP1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 8 length 46 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - ADMIN4182\e2052982 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of ADMIN4182\e2052982 PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to ADMIN4182\e2052982 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 8 length 23 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 242 to 10.251.20.20 port 1645 EAP-Message = 0x01090043190017030100387d28ca432366b4c61627e8742dbb54a2458802449ee7d043cee54f7eb37e93b0955ba755da5aad5b9017551c02f8999c9ea8c49246b6efe7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefa5735fb3f5cab0b3b468b08df9b103 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.251.20.20:1645, id=243, length=249 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Message-Authenticator = 0xd750ebb3d82173907aa54efb998772f0 EAP-Message = 0x0209006419001703010059e30c5f2d9def3e92ee697f3a3368ccf2c1637832a6b78bf9323db95a014d9b5f34bf64f8c9ce48c0f6ba94251fd4c35a8e40ed06e5be206baeef83a40b311e0647348acebbf588ac25b4ee4f2382dc59066fea3516f94cf09f NAS-Port-Type = Wireless-802.11 NAS-Port = 366 State = 0xefa5735fb3f5cab0b3b468b08df9b103 NAS-IP-Address = 10.251.20.20 NAS-Identifier = "EGC-AP1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 100 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to ADMIN4182\e2052982 PEAP: Adding old state with 5d 21 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "ADMIN4182\e2052982", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 77 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for e2052982 with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: d6 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=e2052982 --domain=ADMIN4182 --challenge=7801a84637ef5c68 --nt-response=4f77faa8137d60ae186c5f910fea83f936dbd827ac54f757' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=e2052982 --domain=ADMIN4182 --challenge=7801a84637ef5c68 --nt-response=4f77faa8137d60ae186c5f910fea83f936dbd827ac54f757 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: leaving group MS-CHAP (returns reject) for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: leaving group authenticate (returns reject) for request 7 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 243 to 10.251.20.20 port 1645 EAP-Message = 0x010a00261900170301001b592ffa55de5d78f799afd27bcf5bbeda4180630d0a453e5b1433eb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9fae1d986c18c5f2cdbabbfbfe4796ce Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.251.20.20:1645, id=244, length=187 User-Name = "ADMIN4182\\e2052982" Framed-MTU = 1400 Called-Station-Id = "0017.5aa1.9520" Calling-Station-Id = "0011.5066.6e61" Service-Type = Login-User Peter de Groot Windows Re-Installation Engineer Eastern Goldfields College Ph 08) 90801800 Fax 08) 90801866 Mob 0418915312 http://egshs.wa.edu.au