smbencrypt is distributed with the server. Use it to check the password hash.

Ivan Kalik Kalik Informatika ISP

The authentication is half finished. The hint with the smbencrypt showed that the stored nt passwords in our ldap directory was wrong. The hint with ldap.attrmap pointed to a wrong nt-password mapping. Thanks a lot for the help. Now we are facing another problem: 1. We use the native windows xp (sp2 + sp3) 802.1x client without the check in the box "Validate server certificate". Result: The authentication works. 2. We check the box, fill in the right dns server name and select the right Trusted Root CA. Result: The authentication fails. 3. We use an macintosh with leopard, the authentication works fine. 4. We use windows xp (sp3) with an odyssey client, the authentication works fine. The failed authentication shows in the debug log, that something goes wrong with the user data in the inner tunnel. There is no "rlm_eap_peap: Identity - username". Instead it breaks with an "TLS Alert" and an "No data inside the tunnel" Our Server Certificate has the extended key-usage PKIX serverAuth (OID: 1.3.6.1.5.5.7.3.1) PKIX clientAuth (OID: 1.3.6.1.5.5.7.3.2) Any help is appreciated, best regards Michael rad_recv: Access-Request packet from host 141.2.252.203:55558, id=60, length=82 User-Name = "nutzername" EAP-Message = 0x0200000b016d706f736572 Message-Authenticator = 0x4f1d0d2973fdb38611ce6bfacb5846f2 NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "nutzername", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched DEFAULT at 238 radius_xlat: 'nutzername' modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for nutzername radius_xlat: '(uid=nutzername)' radius_xlat: 'ou=raduser,ou=HRZ,o=bla,dc=bla,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldaps://septimus.domain.de, authentication 0 rlm_ldap: setting TLS CACert File to /etc/openldap/cacerts/ca-bundle.crt rlm_ldap: bind as uid=authproxy,o=bla,dc=bla,dc=de/geheim$ to ldaps://septimus.domain.de rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=raduser,ou=HRZ,o=bla,dc=bla,dc=de, with filter (uid=nutzername) rlm_ldap: Added password 0x81.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as NT-Password, value 0x81.... & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user nutzername authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 60 to 141.2.252.203:55558 User-Name = "nutzername" EAP-Message = 0x010100160410cae9bfb010ee5187489092b9a2f82ddd Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbea2ee7e075274739942fa3464748581 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 141.2.252.203:55558, id=226, length=95 User-Name = "nutzername" State = 0xbea2ee7e075274739942fa3464748581 EAP-Message = 0x020100060319 Message-Authenticator = 0x200b492108ca7cac81f0e8922229d1ce NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "nutzername", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched DEFAULT at 238 radius_xlat: 'nutzername' modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for nutzername radius_xlat: '(uid=nutzername)' radius_xlat: 'ou=raduser,ou=HRZ,o=bla,dc=bla,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=raduser,ou=HRZ,o=bla,dc=bla,dc=de, with filter (uid=nutzername) rlm_ldap: Added password 0x81.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as NT-Password, value 0x81.... & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user nutzername authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 226 to 141.2.252.203:55558 User-Name = "nutzername" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5750c0ff371ce186f1965748119d04ac Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 141.2.252.203:55558, id=38, length=169 User-Name = "nutzername" State = 0x5750c0ff371ce186f1965748119d04ac EAP-Message = 0x0202005019800000004616030100410100003d0301496e0c138b66c4b2b03439662b6dbd53 73c2bffd1be848b6eacc3fb4f77dba7900001600040005000a00090064006200030006001300 1200630100 Message-Authenticator = 0x13930a9cfe35d09670f4963fa3e99ece NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "nutzername", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched DEFAULT at 238 radius_xlat: 'nutzername' modcall[authorize]: module "files" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for nutzername radius_xlat: '(uid=nutzername)' radius_xlat: 'ou=raduser,ou=HRZ,o=bla,dc=bla,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=raduser,ou=HRZ,o=bla,dc=bla,dc=de, with filter (uid=nutzername) rlm_ldap: Added password 0x81.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as NT-Password, value 0x81.... & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user nutzername authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 08e4], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 38 to 141.2.252.203:55558 User-Name = "nutzername" EAP-Message = 0x0103040a19c000000941160301004a020000460301496e0c0a313b94cc31ef3ce5fcf21642 9dcae1a13d91a1f4d634e431b7fba52f2063656f16763acb98fb6dae900682fe430116f46619 ef62da13543c269dca608200040016030108e40b0008e00008dd00057730820573308204dca0 03020102020e369900010002c59829d76c5f17cc300d06092a864886f70d01010505003081bc 310b30090603550406130244453110300e0603550408130748616d627572673110300e060355 0407130748616d62757267313a3038060355040a1331544320547275737443656e7465722066 6f7220536563757269747920696e2044617461204e6574776f72 EAP-Message = 0x6b7320476d624831223020060355040b1319544320547275737443656e74657220436c6173 7320322043413129302706092a864886f70d010901161a636572746966696361746540747275 737463656e7465722e6465301e170d3038303830343132303430355a170d3039303832393132 303430355a3081d5310b3009060355040613024445310f300d0603550408130648657373656e 311a3018060355040713114672616e6b6675727420616d204d61696e312c302a060355040a13 234a6f68616e6e20576f6c6667616e6720476f657468652d556e69766572736974616574311f 301d060355040b1316486f6368736368756c72656368656e7a65 EAP-Message = 0x6e7472756d31223020060355040314192a2e7365727665722e756e692d6672616e6b667572 742e64653126302406092a864886f70d010901161777777740727a2e756e692d6672616e6b66 7572742e646530820122300d06092a864886f70d01010105000382010f003082010a02820101 00be916aaefcd7a193458cea127673dd7296b608360945fcd1288f4537f751bf37ea0c47b7a4 ca89ecbd7677012462b1519de606a232c2e73e28d0d04ed554ce6a82e38d4f7bb8942008df11 e17122c5215333c5a49658abded7116628676a4f49e0f7230a1f85a339dfca410a5ff5045b51 3b413eb6bc84f171084be88d31b5159d915f86ddb50499409df2 EAP-Message = 0x0207f15d52432a76601ed7bea5f25d59093b39632a02424eb053b9688ff91db85f9ca665b4 a42b985b9afe2cd9b6e9b8c5c8b30c7be0a8227fec6f6948fbec296b256879fe09403cb2c476 0643605e6ea1746d02fb0274c38139d16397733c36997fbf3c7775ca54f869dd47dc1cd4ed0e 28dc52ff0203010001a38201d7308201d330818e06082b06010505070101048181307f304c06 082b060105050730028640687474703a2f2f7777772e747275737463656e7465722e64652f63 65727473657276696365732f636163657274732f74635f636c6173735f325f63612e63727430 2f06082b060105050730018623687474703a2f2f6f6373702e74 EAP-Message = 0x63636c617373322e747275737463656e7465722e6465 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7d2d73c29099b11eba9f436f60e7786f Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 141.2.252.203:55558, id=100, length=95 User-Name = "nutzername" State = 0x7d2d73c29099b11eba9f436f60e7786f EAP-Message = 0x020300061900 Message-Authenticator = 0xc16bfac26a67d57deac7d60e2da85581 NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "nutzername", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched DEFAULT at 238 radius_xlat: 'nutzername' modcall[authorize]: module "files" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for nutzername radius_xlat: '(uid=nutzername)' radius_xlat: 'ou=raduser,ou=HRZ,o=bla,dc=bla,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=raduser,ou=HRZ,o=bla,dc=bla,dc=de, with filter (uid=nutzername) rlm_ldap: Added password 0x81.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as NT-Password, value 0x81.... & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user nutzername authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 100 to 141.2.252.203:55558 User-Name = "nutzername" EAP-Message = 0x010404061940300c0603551d130101ff040230003081820603551d20047b3079307706092a 8214002c01010102306a303606082b06010505070202302a1a28544320547275737443656e74 657220436c6173733220536572766572204365727469666963617465303006082b0601050507 02011624687474703a2f2f7777772e747275737463656e7465722e64652f67756964656c696e 6573300e0603551d0f0101ff0404030205e0301d0603551d0e04160414b766adfc0fd80652bc 51275e88e6b5254598806a304c0603551d1f044530433041a03fa03d863b687474703a2f2f63 726c2e7463636c617373322e747275737463656e7465722e6465 EAP-Message = 0x2f63726c2f76322f74635f636c6173735f325f63612e63726c301d0603551d250416301406 082b0601050507030106082b06010505070302301106096086480186f84201010404030206c0 300d06092a864886f70d01010505000381810029a625b45ec3f9852a465b2fec2a9c47c7c781 33fc2cd3bc58f75a5ea04a32755dd12c7a7f4c0c3850ab7bf42504ec8ea307e5629919700750 c0114ef2772d713179c68258157d2873d61d9491ff5ba0252cf52020ed9dc4fce69ae5d58e82 171e077b1a193c903c1cfd27c6125e2201b0b31ac8a70de3592fe903a1258644620003603082 035c308202c5a003020102020203ea300d06092a864886f70d01 EAP-Message = 0x010405003081bc310b30090603550406130244453110300e0603550408130748616d627572 673110300e0603550407130748616d62757267313a3038060355040a13315443205472757374 43656e74657220666f7220536563757269747920696e2044617461204e6574776f726b732047 6d624831223020060355040b1319544320547275737443656e74657220436c61737320322043 413129302706092a864886f70d010901161a636572746966696361746540747275737463656e 7465722e6465301e170d3938303330393131353935395a170d3131303130313131353935395a 3081bc310b30090603550406130244453110300e060355040813 EAP-Message = 0x0748616d627572673110300e0603550407130748616d62757267313a3038060355040a1331 544320547275737443656e74657220666f7220536563757269747920696e2044617461204e65 74776f726b7320476d624831223020060355040b1319544320547275737443656e7465722043 6c61737320322043413129302706092a864886f70d010901161a636572746966696361746540 747275737463656e7465722e646530819f300d06092a864886f70d010101050003818d003081 8902818100da38e8ed3200297183010dbf8c01dcdac6ad39a4a98a2fd58b5c685f50c662f566 bdca9122ecaa1d51d73db351b2834e5dcb49b0f04c55e56b2dc7 EAP-Message = 0x850b301c924e82d4ca02edf76fbedce0e314 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6f3c1ccd94830375640659699664a51a Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 141.2.252.203:55558, id=62, length=95 User-Name = "nutzername" State = 0x6f3c1ccd94830375640659699664a51a EAP-Message = 0x020400061900 Message-Authenticator = 0xd3621dcb8ecf03d17c966eb0f661ad99 NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "nutzername", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched DEFAULT at 238 radius_xlat: 'nutzername' modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for nutzername radius_xlat: '(uid=nutzername)' radius_xlat: 'ou=raduser,ou=HRZ,o=bla,dc=bla,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=raduser,ou=HRZ,o=bla,dc=bla,dc=de, with filter (uid=nutzername) rlm_ldap: Added password 0x81.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as NT-Password, value 0x81.... & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user nutzername authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 62 to 141.2.252.203:55558 User-Name = "nutzername" EAP-Message = 0x010501471900b80553f29af4568b5a9e8593d1b48256ae4dbba84b5716bcfef8589ef8298d b07bcd78c94fac8b670cf19cfbfc579b575c4f0d0203010001a36b3069300f0603551d130101 ff040530030101ff300e0603551d0f0101ff040403020186303306096086480186f842010804 261624687474703a2f2f7777772e747275737463656e7465722e64652f67756964656c696e65 73301106096086480186f8420101040403020007300d06092a864886f70d0101040500038181 008452fb28dfff1f7501bc01be0456976a7442243183f946b1068a89cf962c33bf8cb55f7a72 a18506ce86f8058ee8f925cada838c06aceb366d8591340436f4 EAP-Message = 0x42f0f8792e0a485cabcc514f7876a0d9ac19bd2ad169042891ca36102780575bd25cf5c25b ab6481637451f497bfcd1228f74d667fa7f01c012678b2664770516416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbd5c957dea92c16671d2a4bb23ff2a96 Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 141.2.252.203:55558, id=77, length=411 User-Name = "nutzername" State = 0xbd5c957dea92c16671d2a4bb23ff2a96 EAP-Message = 0x02050140198000000136160301010610000102010083c661702c546243ae82b89c22329e68 70c992c122d7d6eba0cd49909a808a5246245e5368d9871f7256a00f1d02fc7655fdb3407ff0 f2c334920716bbc7c249a6915917b2c81b2dbe2769d6bfbb0f5c746863e7f429a4a9b6236568 9637b27317c4fc1c5e8b6876a93f8b0119fb66204c48dadcae5f1d7ca514b2690e15a7e857f0 e2f8925e910bc4e8678340bb80c9581e16a4fabd801b7ce90839497be1938b3800f28574d37a e46f7313ec6f2eac7b1c332e9c06773ded5f136e8b3e942ebfd4977cefd66550cb16882de8f4 e6c65cb843008f3738b94085ddb2fbd48cf79312ca1ee6e5ae09 EAP-Message = 0x8d724ebb401cd378fc2965eb82b476f705b7795ed924f34e1403010001011603010020d6d7 ac087f5a4b8452126caa6f15acee0d30608d4b259d910486c4dc153a7940 Message-Authenticator = 0x3a8c157d07a1eeedddbe386f4cfca41b NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "nutzername", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched DEFAULT at 238 radius_xlat: 'nutzername' modcall[authorize]: module "files" returns ok for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for nutzername radius_xlat: '(uid=nutzername)' radius_xlat: 'ou=raduser,ou=HRZ,o=bla,dc=bla,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=raduser,ou=HRZ,o=bla,dc=bla,dc=de, with filter (uid=nutzername) rlm_ldap: Added password 0x81.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as NT-Password, value 0x81.... & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user nutzername authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 77 to 141.2.252.203:55558 User-Name = "nutzername" EAP-Message = 0x0106003119001403010001011603010020941bf982a2967829df2e9158013bbecb542a799d 37afb0ee09da1aa705146157 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf1f497af4715856825aa1004c515a4d0 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 141.2.252.203:55558, id=242, length=122 User-Name = "nutzername" State = 0xf1f497af4715856825aa1004c515a4d0 EAP-Message = 0x02060021198000000017150301001272c8140acf019f865785ebe57bfdc0ed9fdf Message-Authenticator = 0x7f0775975b56263d6d04c5d1714f2ed8 NAS-Identifier = "cb-jur-vc0-11og" NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "nutzername", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 33 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched DEFAULT at 238 radius_xlat: 'nutzername' modcall[authorize]: module "files" returns ok for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for nutzername radius_xlat: '(uid=nutzername)' radius_xlat: 'ou=raduser,ou=HRZ,o=bla,dc=bla,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=raduser,ou=HRZ,o=bla,dc=bla,dc=de, with filter (uid=nutzername) rlm_ldap: Added password 0x81.... in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as NT-Password, value 0x81.... & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user nutzername authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied rlm_eap_peap: No data inside of the tunnel. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 6 modcall: group authenticate returns invalid for request 6 auth: Failed to validate the user. Login incorrect: [nutzername] (from client Juniper-EX port 0) Delaying request 6 for 1 seconds Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 141.2.252.203:55558, id=242, length=122 Sending Access-Reject of id 242 to 141.2.252.203:55558 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 38 with timestamp 496e0c0a Cleaning up request 0 ID 60 with timestamp 496e0c0a Cleaning up request 4 ID 62 with timestamp 496e0c0a Cleaning up request 5 ID 77 with timestamp 496e0c0a Cleaning up request 3 ID 100 with timestamp 496e0c0a Cleaning up request 1 ID 226 with timestamp 496e0c0a Cleaning up request 6 ID 242 with timestamp 496e0c0a Nothing to do. Sleeping until we see a request. [root@wlan1 ~]#