EAP-MD5: Access-Accept packet in debug log messages
Hello, While confronting my config attempts with various scenarios, I noticed that the Message-Authenticator seems to always be displayed as a sequence of null bytes: (1) Sending Access-Accept packet to host 127.0.0.1 port 60546, id=174, length=0 (1) EAP-Message = 0x03ad0004 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) User-Name = 'bob' Sending Access-Accept Id 174 from 127.0.0.1:1812 to 127.0.0.1:60546 EAP-Message = 0x03ad0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = 'bob' BTW, out of curiosity, attribute User-Name appears to be unconditionally added to the Acces-Accept packet; is this common practice? Axel
Axel Luttgens wrote:
While confronting my config attempts with various scenarios, I noticed that the Message-Authenticator seems to always be displayed as a sequence of null bytes:
Yes. It's printed out before it's calculated. The exact value of Message-Authenticator doesn't matter. You don't care what it is in the debug output. You have no way of verifying that it's correct. So it might as well be all zeros.
BTW, out of curiosity, attribute User-Name appears to be unconditionally added to the Acces-Accept packet; is this common practice?
Read RFC 3579. Alan DeKok.
participants (2)
-
Alan DeKok -
Axel Luttgens