Il 18/01/2012 15:25, Alan DeKok ha scritto:

NdK wrote:

...

I think I'm near to correctly configure my server... but I incur in a situation that IIUC should be related to win clients only: I get ... message and *eapol_test* (run from a *linux* machine!) gives up after about 10 seconds.

Then read the error messages from eapol_test. Why does it stop? It should say. That's eapol_test output. I changed my AD pass to 'testing123' just for the time needed to test, so the values are the real ones. I can't see any error, just a timeout... There's a short delay before "EAPOL: startWhen --> 0" and a long one just after. If needed, I logged output of freeradius -X for this run, too (not posted to avoid spamming the list too much -- nothing changed in its config).

# eapol_test -c /home/ndk/Scaricati/peap-mschapv2.conf -s testing123qaz -a 137.204.65.163 Reading configuration file '/home/ndk/Scaricati/peap-mschapv2.conf' Line: 4 - start of a new network block key_mgmt: 0xd proto: 0x3 group: 0x18 scan_ssid=1 (0x1) mode=0 (0x0) ssid - hexdump_ascii(len=8): 41 4c 4d 41 57 49 46 49 ALMAWIFI pairwise: 0x18 eap methods - hexdump(len=16): 00 00 00 00 19 00 00 00 00 00 00 00 00 00 00 00 password - hexdump_ascii(len=10): 74 65 73 74 69 6e 67 31 32 33 testing123 identity - hexdump_ascii(len=23): 50 45 52 53 4f 4e 41 4c 45 5c 64 69 65 67 6f 2e PERSONALE\diego. 7a 75 63 63 61 74 6f zuccato phase2 - hexdump_ascii(len=15): 70 68 61 73 65 32 3d 4d 53 43 48 41 50 56 32 phase2=MSCHAPV2 ca_cert - hexdump_ascii(len=61): 2f 68 6f 6d 65 2f 6e 64 6b 2f 44 6f 63 75 6d 65 /home/ndk/Docume 6e 74 69 2f 55 66 66 69 63 69 6f 2f 43 41 2f 63 nti/Ufficio/CA/c 65 72 74 73 2f 41 73 74 72 6f 6e 6f 6d 69 61 20 erts/Astronomia 2d 20 52 6f 6f 74 20 43 41 2e 63 72 74 - Root CA.crt Priority group 0 id=0 ssid='ALMAWIFI' Authentication server 137.204.65.163:1812 RADIUS local address: 137.204.65.96:45959 EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: KEY_RX entering state NO_KEY_RECEIVE EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED EAPOL: External notification - portValid=0 EAPOL: External notification - portEnabled=1 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_BE entering state IDLE EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE Sending fake EAP-Request-Identity EAPOL: Received EAP-Packet frame EAPOL: SUPP_PAE entering state RESTART EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=0 method=1 vendor=0 vendorMethod=0 EAP: EAP entering state IDENTITY CTRL-EVENT-EAP-STARTED EAP authentication started EAP: EAP-Request Identity data - hexdump_ascii(len=0): EAP: using real identity - hexdump_ascii(len=23): 50 45 52 53 4f 4e 41 4c 45 5c 64 69 65 67 6f 2e PERSONALE\diego. 7a 75 63 63 61 74 6f zuccato EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=28) TX EAP -> RADIUS - hexdump(len=28): 02 00 00 1c 01 50 45 52 53 4f 4e 41 4c 45 5c 64 69 65 67 6f 2e 7a 75 63 63 61 74 6f Encapsulating EAP message into a RADIUS packet Learned identity from EAP-Response-Identity - hexdump(len=23): 50 45 52 53 4f 4e 41 4c 45 5c 64 69 65 67 6f 2e 7a 75 63 63 61 74 6f Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=0 length=154 Attribute 1 (User-Name) length=25 Value: 'PERSONALE\diego.zuccato' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '02-00-00-00-00-01' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=30 Value: 02 00 00 1c 01 50 45 52 53 4f 4e 41 4c 45 5c 64 69 65 67 6f 2e 7a 75 63 63 61 74 6f Attribute 80 (Message-Authenticator) length=18 Value: bd 07 f8 80 77 2d 48 51 d9 90 ce fe 5b e2 8f 35 Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE Received 80 bytes from RADIUS server Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=0 length=80 Attribute 79 (EAP-Message) length=24 Value: 01 01 00 16 04 10 8e 95 2b d6 0d 0e cf cb ea cf a7 f0 f1 2e 1b 55 Attribute 80 (Message-Authenticator) length=18 Value: 75 9e 8f 62 48 3d 24 33 f9 ba cc ac 8c d3 cc 90 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 0e 7b ad 56 82 24 1d fb 53 ea 51 8c STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.00 sec RADIUS packet matching with station decapsulated EAP packet (code=1 id=1 len=22) from RADIUS server: EAP-Request-MD5 (4) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=1 method=4 vendor=0 vendorMethod=0 EAP: EAP entering state GET_METHOD EAP: configuration does not allow: vendor 0 method 4 EAP: vendor 0 method 4 not allowed CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=4 -> NAK EAP: Building EAP-Nak (requested type 4 vendor=0 method=0 not allowed) EAP: allowed methods - hexdump(len=1): 19 EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=6) TX EAP -> RADIUS - hexdump(len=6): 02 01 00 06 03 19 Encapsulating EAP message into a RADIUS packet Copied RADIUS State Attribute Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=1 length=150 Attribute 1 (User-Name) length=25 Value: 'PERSONALE\diego.zuccato' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '02-00-00-00-00-01' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=8 Value: 02 01 00 06 03 19 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 0e 7b ad 56 82 24 1d fb 53 ea 51 8c Attribute 80 (Message-Authenticator) length=18 Value: f4 93 4a d8 34 35 2b 5c 1e eb 27 a8 94 74 58 f0 Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE Received 64 bytes from RADIUS server Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=1 length=64 Attribute 79 (EAP-Message) length=8 Value: 01 02 00 06 19 20 Attribute 80 (Message-Authenticator) length=18 Value: ac aa 7a a3 84 ef de 1f eb e0 37 50 27 36 1b db Attribute 24 (State) length=18 Value: 0e 7a a9 3e 0f 78 b0 56 82 24 1d fb 53 ea 51 8c STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.00 sec RADIUS packet matching with station decapsulated EAP packet (code=1 id=2 len=6) from RADIUS server: EAP-Request-PEAP (25) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=2 method=25 vendor=0 vendorMethod=0 EAP: EAP entering state GET_METHOD CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25 EAP: Initialize selected EAP method: vendor 0 method 25 (PEAP) TLS: Phase2 EAP types - hexdump(len=64): 00 00 00 00 04 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 12 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 2f 00 00 00 00 00 00 00 17 00 00 00 TLS: using phase1 config options TLS: Trusted root certificate(s) loaded CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected EAP: EAP entering state METHOD SSL: Received packet(len=6) - Flags 0x20 EAP-PEAP: Start (server ver=0, own ver=1) EAP-PEAP: Using PEAP version 0 SSL: (where=0x10 ret=0x1) SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:before/connect initialization SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 write client hello A SSL: (where=0x1002 ret=0xffffffff) SSL: SSL_connect:error in SSLv3 read server hello A SSL: SSL_connect - want more data SSL: 208 bytes pending from ssl_out SSL: 208 bytes left to be sent out (of total 208 bytes) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=218) TX EAP -> RADIUS - hexdump(len=218): 02 02 00 da 19 80 00 00 00 d0 16 03 01 00 cb 01 00 00 c7 03 01 4f 17 c2 ae f3 9d fe d9 e2 75 d7 4f 75 ca e1 c1 ca 35 82 f6 47 7d 7a 61 53 64 f0 68 5f 94 7e 50 00 00 5a c0 14 c0 0a 00 39 00 38 00 88 00 87 c0 0f c0 05 00 35 00 84 c0 12 c0 08 00 16 00 13 c0 0d c0 03 00 0a c0 13 c0 09 00 33 00 32 00 9a 00 99 00 45 00 44 c0 0e c0 04 00 2f 00 96 00 41 c0 11 c0 07 c0 0c c0 02 00 05 00 04 00 15 00 12 00 09 00 14 00 11 00 08 00 06 00 03 00 ff 01 00 00 44 00 0b 00 04 03 00 01 02 00 0a 00 34 00 32 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0a 00 0b 00 0c 00 0d 00 0e 00 0f 00 10 00 11 00 12 00 13 00 14 00 15 00 16 00 17 00 18 00 19 00 23 00 00 Encapsulating EAP message into a RADIUS packet Copied RADIUS State Attribute Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=2 length=362 Attribute 1 (User-Name) length=25 Value: 'PERSONALE\diego.zuccato' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '02-00-00-00-00-01' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=220 Value: 02 02 00 da 19 80 00 00 00 d0 16 03 01 00 cb 01 00 00 c7 03 01 4f 17 c2 ae f3 9d fe d9 e2 75 d7 4f 75 ca e1 c1 ca 35 82 f6 47 7d 7a 61 53 64 f0 68 5f 94 7e 50 00 00 5a c0 14 c0 0a 00 39 00 38 00 88 00 87 c0 0f c0 05 00 35 00 84 c0 12 c0 08 00 16 00 13 c0 0d c0 03 00 0a c0 13 c0 09 00 33 00 32 00 9a 00 99 00 45 00 44 c0 0e c0 04 00 2f 00 96 00 41 c0 11 c0 07 c0 0c c0 02 00 05 00 04 00 15 00 12 00 09 00 14 00 11 00 08 00 06 00 03 00 ff 01 00 00 44 00 0b 00 04 03 00 01 02 00 0a 00 34 00 32 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0a 00 0b 00 0c 00 0d 00 0e 00 0f 00 10 00 11 00 12 00 13 00 14 00 15 00 16 00 17 00 18 00 19 00 23 00 00 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 0f 78 b0 56 82 24 1d fb 53 ea 51 8c Attribute 80 (Message-Authenticator) length=18 Value: 6c e1 f0 96 f9 96 a5 c2 28 f0 13 9d 15 e8 e1 c5 Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE Received 1090 bytes from RADIUS server Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=2 length=1090 Attribute 79 (EAP-Message) length=255 Value: 01 03 04 00 19 c0 00 00 13 81 16 03 01 00 31 02 00 00 2d 03 01 4f 17 c2 ad a1 f9 7c c0 cb 32 ce a2 f0 15 b7 c7 19 f9 48 34 b0 59 60 47 5e 79 db a0 a7 b4 c3 ed 00 00 39 00 00 05 ff 01 00 01 00 16 03 01 11 ab 0b 00 11 a7 00 11 a4 00 04 d6 30 82 04 d2 30 82 02 ba a0 03 02 01 02 02 01 12 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 30 81 ba 31 0b 30 09 06 03 55 04 06 13 02 49 54 31 0e 30 0c 06 03 55 04 08 13 05 49 74 61 6c 79 31 10 30 0e 06 03 55 04 07 13 07 42 6f 6c 6f 67 6e 61 31 1e 30 1c 06 03 55 04 0a 13 15 55 6e 69 76 65 72 73 69 74 61 20 64 69 20 42 6f 6c 6f 67 6e 61 31 23 30 21 06 03 55 04 0b 13 1a 44 69 70 61 72 74 69 6d 65 6e 74 6f 20 64 69 20 41 73 74 72 6f 6e 6f 6d 69 61 31 20 30 1e 06 03 55 04 03 13 17 41 73 74 72 6f 6e 6f 6d 69 61 20 2d 20 Attribute 79 (EAP-Message) length=255 Value: 43 41 20 53 65 72 76 65 72 73 31 22 30 20 06 09 2a 86 48 86 f7 0d 01 09 01 16 13 64 69 70 61 73 74 72 2e 73 69 40 75 6e 69 62 6f 2e 69 74 30 20 17 0d 31 31 31 31 30 38 30 30 30 30 30 30 5a 18 0f 39 39 39 39 31 32 33 31 32 33 35 39 35 39 5a 30 81 bd 31 0b 30 09 06 03 55 04 06 13 02 49 54 31 0e 30 0c 06 03 55 04 08 13 05 49 74 61 6c 79 31 10 30 0e 06 03 55 04 07 13 07 42 6f 6c 6f 67 6e 61 31 1e 30 1c 06 03 55 04 0a 13 15 55 6e 69 76 65 72 73 69 74 61 20 64 69 20 42 6f 6c 6f 67 6e 61 31 23 30 21 06 03 55 04 0b 13 1a 44 69 70 61 72 74 69 6d 65 6e 74 6f 20 64 69 20 41 73 74 72 6f 6e 6f 6d 69 61 31 23 30 21 06 03 55 04 03 13 1a 72 61 64 69 75 73 2e 61 73 74 72 6f 6e 6f 6d 69 61 2e 75 6e 69 62 6f 2e 69 74 31 22 30 20 06 09 2a 86 48 86 f7 0d 01 09 01 16 13 Attribute 79 (EAP-Message) length=255 Value: 64 69 70 61 73 74 72 2e 73 69 40 75 6e 69 62 6f 2e 69 74 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 c1 c3 b4 a6 e9 b5 fc e7 24 9f 54 40 a7 51 1e ce 03 5a 79 1f 3f 62 1a 91 d6 ac bb bb 57 98 f2 f1 ea d6 70 7f 98 fb ea fe 84 b1 59 3d d3 a3 79 4c 69 b4 3b ff 83 14 a3 80 f5 2a 44 db 12 60 04 3a ea 66 5a 33 82 3e f1 77 22 56 b8 44 40 d6 13 3e f8 3f 7f 2c 38 b5 fa f7 f1 64 32 63 c3 05 d7 c0 fc 14 0c 57 75 b4 ea 39 26 89 90 83 88 fa 8b 97 3e 1e 58 eb 51 51 2e 69 5a 01 1a 6d 01 a3 bf 97 02 03 01 00 01 a3 60 30 5e 30 0c 06 03 55 1d 13 01 01 ff 04 02 30 00 30 1d 06 03 55 1d 0e 04 16 04 14 6d a6 e7 50 d6 6a 1d 54 e6 bb d9 13 a5 d8 5f 72 e4 10 79 99 30 0b 06 03 55 1d 0f 04 04 03 02 05 e0 30 0f 06 03 55 1d 11 04 08 30 Attribute 79 (EAP-Message) length=255 Value: 06 87 04 89 cc 41 63 30 11 06 09 60 86 48 01 86 f8 42 01 01 04 04 03 02 06 40 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 82 02 01 00 44 82 4e 99 f1 1f 01 47 14 cc fb cc d8 cb a3 34 67 3d 13 04 58 ed 77 3e b9 fc f1 74 91 19 e6 cb db bf 61 95 b3 e4 98 5e 0f ea f5 8e e9 f3 c2 dd 28 4c 2b 44 c5 23 4d 23 b9 42 89 67 b8 22 91 7a 65 17 6b e6 b4 79 85 c4 ba 22 4d f6 6a 5f 3b 86 27 f8 55 b5 3a 86 7e 7c 81 48 32 7d bd 43 55 8c 93 52 dc 61 fb df 59 c0 57 01 18 c2 c3 c6 bc 19 11 98 b2 fa 3d c5 b4 f3 cf 07 b2 6c 12 45 01 6c 75 82 3b d3 e8 ea 1b d2 c7 a1 dc 3f da 0a e6 58 ea 9a 66 09 a0 12 0f 51 bd 34 c6 4d 82 b2 d0 94 cd 3e d0 63 ef c2 27 2d 0b f6 d9 44 00 21 b9 c6 82 7f 56 16 56 de 9b 91 97 c7 6f c8 59 7a c7 b2 ac 50 cd 25 9c df 61 45 ff 80 95 1b db 41 a0 Attribute 79 (EAP-Message) length=14 Value: f4 83 3f e4 32 eb 73 f5 25 56 20 5b Attribute 80 (Message-Authenticator) length=18 Value: 69 b8 41 a8 7d 55 dc f7 0d a7 2c f3 32 e4 22 59 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 0c 79 b0 56 82 24 1d fb 53 ea 51 8c STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.00 sec RADIUS packet matching with station decapsulated EAP packet (code=1 id=3 len=1024) from RADIUS server: EAP-Request-PEAP (25) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=3 method=25 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=1024) - Flags 0xc0 SSL: TLS Message Length: 4993 SSL: Need 3979 bytes more input data SSL: Building ACK (type=25 id=3 ver=0) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=6) TX EAP -> RADIUS - hexdump(len=6): 02 03 00 06 19 00 Encapsulating EAP message into a RADIUS packet Copied RADIUS State Attribute Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=3 length=150 Attribute 1 (User-Name) length=25 Value: 'PERSONALE\diego.zuccato' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '02-00-00-00-00-01' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=8 Value: 02 03 00 06 19 00 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 0c 79 b0 56 82 24 1d fb 53 ea 51 8c Attribute 80 (Message-Authenticator) length=18 Value: 30 3b f8 7f 20 d6 4b 0e 7c f7 af 03 7a c6 0f 71 Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE Received 1086 bytes from RADIUS server Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=3 length=1086 Attribute 79 (EAP-Message) length=255 Value: 01 04 03 fc 19 40 13 be f3 04 b9 b3 6f d1 1d a9 55 06 f7 d0 ab 98 d8 40 cc 79 54 ad 54 61 9d 25 a1 c0 7b 21 29 02 89 1f 17 94 db 9f 34 49 60 61 f9 93 fc 97 5d 33 83 95 0d 58 53 29 53 b2 0a 51 63 68 42 0d 7a 1e 7b 6a af 99 cd d3 27 51 ea 62 84 09 2c 12 b4 09 66 1a fd 56 16 5b a3 63 1a ce b3 57 11 5c 0d e5 89 b6 6b 97 59 30 ec 93 b4 f5 b1 f3 bb 61 85 89 33 eb 89 94 8a 83 c0 c3 6d 04 dd 42 b5 9b e6 38 42 74 49 ad ba 16 a3 90 96 6e 64 14 2f c1 ba 27 db a0 1e dd 84 9b 8e c8 b4 cc bb c7 94 c3 2b 0d 81 0a 24 6a 84 74 e0 f6 b1 e4 9f 5c bc 89 89 18 7f 88 dd 32 36 50 79 43 a1 1c 9e f4 19 c5 4f 05 08 7b 6b b0 d3 3e 6c b8 ee 51 79 69 59 4f f8 b5 e6 45 14 1c 97 28 78 6e 4d 5c b7 44 2b c1 ea 46 40 03 af 25 29 4d c9 f9 95 b6 6f e3 2f 25 d0 57 59 21 81 ef 6e 91 d0 Attribute 79 (EAP-Message) length=255 Value: e7 d7 57 68 52 0a ef 64 03 8d 6f ba 14 98 98 a0 55 26 ce ad d0 55 89 b6 dd e0 08 8d 47 ba ff 43 51 da 66 d5 f9 f1 f4 0e d2 e3 b3 1d 09 d0 00 06 64 30 82 06 60 30 82 04 48 a0 03 02 01 02 02 01 02 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 30 81 b7 31 0b 30 09 06 03 55 04 06 13 02 49 54 31 0e 30 0c 06 03 55 04 08 13 05 49 74 61 6c 79 31 10 30 0e 06 03 55 04 07 13 07 42 6f 6c 6f 67 6e 61 31 1e 30 1c 06 03 55 04 0a 13 15 55 6e 69 76 65 72 73 69 74 61 20 64 69 20 42 6f 6c 6f 67 6e 61 31 23 30 21 06 03 55 04 0b 13 1a 44 69 70 61 72 74 69 6d 65 6e 74 6f 20 64 69 20 41 73 74 72 6f 6e 6f 6d 69 61 31 1d 30 1b 06 03 55 04 03 13 14 41 73 74 72 6f 6e 6f 6d 69 61 20 2d 20 52 6f 6f 74 20 43 41 31 22 30 20 06 09 2a 86 48 86 f7 0d 01 09 01 16 13 64 69 70 61 73 74 Attribute 79 (EAP-Message) length=255 Value: 72 2e 73 69 40 75 6e 69 62 6f 2e 69 74 30 1e 17 0d 31 31 30 34 31 33 31 30 33 37 30 30 5a 17 0d 32 31 30 34 31 33 31 30 33 34 30 30 5a 30 81 ba 31 0b 30 09 06 03 55 04 06 13 02 49 54 31 0e 30 0c 06 03 55 04 08 13 05 49 74 61 6c 79 31 10 30 0e 06 03 55 04 07 13 07 42 6f 6c 6f 67 6e 61 31 1e 30 1c 06 03 55 04 0a 13 15 55 6e 69 76 65 72 73 69 74 61 20 64 69 20 42 6f 6c 6f 67 6e 61 31 23 30 21 06 03 55 04 0b 13 1a 44 69 70 61 72 74 69 6d 65 6e 74 6f 20 64 69 20 41 73 74 72 6f 6e 6f 6d 69 61 31 20 30 1e 06 03 55 04 03 13 17 41 73 74 72 6f 6e 6f 6d 69 61 20 2d 20 43 41 20 53 65 72 76 65 72 73 31 22 30 20 06 09 2a 86 48 86 f7 0d 01 09 01 16 13 64 69 70 61 73 74 72 2e 73 69 40 75 6e 69 62 6f 2e 69 74 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 Attribute 79 (EAP-Message) length=255 Value: 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 c9 a6 5b 65 36 87 e1 f4 bf 0d 00 7c 1b 3a ae 71 b2 7e 2f f3 b0 67 da 0b 00 df bc bf 0c af 2c 00 60 48 95 c0 84 56 62 1a 26 95 99 dc c8 30 61 7f 93 d9 c1 de ab 28 11 df d0 6b e6 2d 67 b5 4c a6 4a 59 49 b6 bd 84 97 ec 29 1d a1 1d 93 f2 a2 e5 87 db 88 0d 81 2a 98 c5 fd a0 2b 36 79 a2 41 c7 cd ce 47 9b bc 70 0f 03 83 89 35 a1 c5 37 98 e1 49 92 dc e2 10 fa d9 e9 ba 9b fd 11 dc 19 0b 32 97 4b d4 be 6a e0 df 5c 7d ce 19 c7 36 1a 16 45 7a 3c a4 55 d0 3d 5c dc 77 9d 16 68 3f 73 41 e9 1a ec c7 70 0d 22 77 30 e2 66 b5 9b 9c 7e 60 b4 4d 40 a6 5b bf ec 45 ba 31 ec 7b 02 12 3c 27 ed f8 58 63 96 5e df 64 b3 ba f1 6f c7 17 ff f7 a1 e3 e8 36 cc e5 af 39 98 c1 f6 52 b6 1e 94 ad 3c 0d 92 9b 94 dc 29 a2 3c f4 a4 75 6c 78 60 55 Attribute 79 (EAP-Message) length=10 Value: 57 c1 c7 5c b2 75 e2 dc Attribute 80 (Message-Authenticator) length=18 Value: 5a da 3f cf d7 32 44 98 c9 75 3a 25 d5 bf d2 e0 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 0d 7e b0 56 82 24 1d fb 53 ea 51 8c STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.00 sec RADIUS packet matching with station decapsulated EAP packet (code=1 id=4 len=1020) from RADIUS server: EAP-Request-PEAP (25) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=4 method=25 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=1020) - Flags 0x40 SSL: Need 2965 bytes more input data SSL: Building ACK (type=25 id=4 ver=0) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=6) TX EAP -> RADIUS - hexdump(len=6): 02 04 00 06 19 00 Encapsulating EAP message into a RADIUS packet Copied RADIUS State Attribute Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=4 length=150 Attribute 1 (User-Name) length=25 Value: 'PERSONALE\diego.zuccato' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '02-00-00-00-00-01' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=8 Value: 02 04 00 06 19 00 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 0d 7e b0 56 82 24 1d fb 53 ea 51 8c Attribute 80 (Message-Authenticator) length=18 Value: 53 88 b7 32 cf 61 03 ae 02 8e 2c 1a 8f be 43 ad Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE Received 1086 bytes from RADIUS server Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=4 length=1086 Attribute 79 (EAP-Message) length=255 Value: 01 05 03 fc 19 40 49 7d b7 ae 62 eb ca 42 5e 91 32 50 41 df 3a 09 72 98 6b 99 82 f7 37 1b d4 b0 7e 00 6d 76 de 0b 75 c5 03 34 5e 77 d8 59 93 d8 0e 68 40 2d 80 66 60 3c cf 88 e2 a2 d3 26 c6 eb c6 a7 af 4e e4 fc 20 e5 e9 db 1d 94 53 30 5b 2e d6 41 b1 aa 87 ee ae bd 1f 19 a8 14 b7 1b 8b 21 7f 93 de 48 91 03 7d 8a ce 80 d2 8d 00 22 8c ac b3 2f ac 30 04 0e e1 d1 70 85 b3 0f db c1 17 03 f2 6f ec 9d b2 e3 3c 05 8f cb bd 69 e6 50 4b 2b d4 3b 29 2c 32 f1 b1 84 88 92 dd 33 e3 43 9d 7f 1d 3e 43 75 e0 30 ec 9b e5 a2 ef 40 7d 6d 85 59 1c 43 20 86 90 b9 c2 57 bd b6 1e 0b 6e 68 b9 bf 13 59 ea 4d 08 b1 1b a6 a9 00 19 e9 64 b3 19 0c 40 05 bf 03 2c 72 40 8d 3a e0 c1 b8 7f a0 69 ed 65 c7 cc 25 e0 de 88 ab 5b 72 3c c1 1a 10 d0 bc 6c 6e 2e 48 f1 1e 1c 2c 89 32 bb 35 bc Attribute 79 (EAP-Message) length=255 Value: 5b da f7 c2 cc 25 6a 9d c7 99 3d 84 7f 30 2d f8 ec cf 02 03 01 00 01 a3 72 30 70 30 0f 06 03 55 1d 13 01 01 ff 04 05 30 03 01 01 ff 30 1d 06 03 55 1d 0e 04 16 04 14 bb 0d 32 68 95 f8 3b d2 4f 85 fc fa ea be e6 cc 8a 5e 56 86 30 0b 06 03 55 1d 0f 04 04 03 02 01 06 30 11 06 09 60 86 48 01 86 f8 42 01 01 04 04 03 02 00 07 30 1e 06 09 60 86 48 01 86 f8 42 01 0d 04 11 16 0f 78 63 61 20 63 65 72 74 69 66 69 63 61 74 65 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 82 02 01 00 69 f6 c7 33 df 30 66 b2 cf 77 05 a1 f4 de b8 79 d2 c4 3c ca b1 b3 d4 4f b2 22 87 06 73 33 f0 51 7f 99 f9 a0 7f 62 b5 97 8f a9 e9 02 90 03 70 d5 0c 05 64 d7 85 5b ee d4 0c 88 83 1d 65 d0 7c a6 69 8d 4e e1 03 05 e0 c4 88 e8 8c 1e dd 57 ff 1c 02 a0 67 9c ab 0a f5 41 74 59 f6 50 ae ef Attribute 79 (EAP-Message) length=255 Value: 63 d5 f8 4f e6 3d cc fc 66 0b 13 81 be 5b 08 34 1a e7 c6 0a c2 c7 a5 ae 18 04 c2 53 c1 08 ba e3 7c 38 41 47 2c 01 cc 4f df f6 9e c7 f4 63 6d d4 7d 07 83 69 33 d9 d0 0c fd 44 54 19 d2 87 7c 82 e0 a8 ce a2 da 6b 1f 03 cd 1c 58 3a 08 73 cf a4 57 0e c0 af f7 84 d7 5f 55 24 b6 6d df 3b 0e a2 d7 6d 2d 51 d6 65 c8 97 6b ab f7 fa bf 17 89 8b 38 63 a6 04 6d e6 c4 e5 77 a7 26 53 1a 14 1a 29 8c 90 12 79 80 7e c5 40 bb 6b d0 74 21 c7 4b 5e e3 e7 c0 b0 00 2e 41 e8 ae 14 66 b5 30 26 a2 6f 95 bf a2 3a e5 b3 d8 b8 cd b4 bc 55 9a 18 0f fb 6b fe 37 59 00 35 0f 28 28 88 9e 3c 75 34 fd 0e fd 54 4b 27 84 ef e6 55 c6 d8 c6 fb 6d 3a fe 60 c8 77 53 3b ef 90 5d ca 4e ac f5 a0 49 d7 6e 9f 82 76 cd 0e cc ab c0 ec cd b1 e1 e8 46 52 eb c8 fe 63 36 de 3c b7 8c db 29 72 92 91 35 Attribute 79 (EAP-Message) length=255 Value: c1 fb 48 eb 42 5e 4c ba de e8 86 35 e5 d3 1c d6 f9 2e 45 9a 80 60 93 1c a7 22 20 f6 52 ec db 61 58 e6 a8 36 2f 95 8d 3c da 07 25 4a 07 fa 4e ad 61 be 4c 04 5e a1 60 91 9d 6b 54 42 54 11 f8 87 18 10 b5 ec 45 fe 79 cd 08 c6 96 dd 86 f5 61 b1 5f c6 e9 90 d4 0c 14 87 6c b4 9b e7 1d db e5 a0 e8 84 a7 a9 f4 18 f3 a9 00 d7 22 87 f2 74 9d 4d 7a 31 10 aa b6 02 98 f2 b1 87 d3 b2 e4 24 0d de bd bc 52 0c fa 91 dd f7 80 f8 ab 92 5a f7 68 5f 5d 22 6b 69 6b 58 a8 4a 93 37 b1 92 14 77 12 f0 3b 9b d3 6b 32 00 06 61 30 82 06 5d 30 82 04 45 a0 03 02 01 02 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 30 81 b7 31 0b 30 09 06 03 55 04 06 13 02 49 54 31 0e 30 0c 06 03 55 04 08 13 05 49 74 61 6c 79 31 10 30 0e 06 03 55 04 07 13 07 42 6f 6c 6f 67 6e 61 31 1e 30 1c Attribute 79 (EAP-Message) length=10 Value: 06 03 55 04 0a 13 15 55 Attribute 80 (Message-Authenticator) length=18 Value: a9 ef 66 e7 21 dc 0d a8 e2 1c 66 d3 0e aa 9a 65 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 0a 7f b0 56 82 24 1d fb 53 ea 51 8c STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.00 sec RADIUS packet matching with station decapsulated EAP packet (code=1 id=5 len=1020) from RADIUS server: EAP-Request-PEAP (25) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=5 method=25 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=1020) - Flags 0x40 SSL: Need 1951 bytes more input data SSL: Building ACK (type=25 id=5 ver=0) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=6) TX EAP -> RADIUS - hexdump(len=6): 02 05 00 06 19 00 Encapsulating EAP message into a RADIUS packet Copied RADIUS State Attribute Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=5 length=150 Attribute 1 (User-Name) length=25 Value: 'PERSONALE\diego.zuccato' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '02-00-00-00-00-01' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=8 Value: 02 05 00 06 19 00 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 0a 7f b0 56 82 24 1d fb 53 ea 51 8c Attribute 80 (Message-Authenticator) length=18 Value: 8f af d6 60 e0 fc 56 49 2f 93 f3 7e 1a dd cd 7c Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE Received 1086 bytes from RADIUS server Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=5 length=1086 Attribute 79 (EAP-Message) length=255 Value: 01 06 03 fc 19 40 6e 69 76 65 72 73 69 74 61 20 64 69 20 42 6f 6c 6f 67 6e 61 31 23 30 21 06 03 55 04 0b 13 1a 44 69 70 61 72 74 69 6d 65 6e 74 6f 20 64 69 20 41 73 74 72 6f 6e 6f 6d 69 61 31 1d 30 1b 06 03 55 04 03 13 14 41 73 74 72 6f 6e 6f 6d 69 61 20 2d 20 52 6f 6f 74 20 43 41 31 22 30 20 06 09 2a 86 48 86 f7 0d 01 09 01 16 13 64 69 70 61 73 74 72 2e 73 69 40 75 6e 69 62 6f 2e 69 74 30 1e 17 0d 31 31 30 34 31 33 31 30 33 34 30 30 5a 17 0d 32 31 30 34 31 33 31 30 33 34 30 30 5a 30 81 b7 31 0b 30 09 06 03 55 04 06 13 02 49 54 31 0e 30 0c 06 03 55 04 08 13 05 49 74 61 6c 79 31 10 30 0e 06 03 55 04 07 13 07 42 6f 6c 6f 67 6e 61 31 1e 30 1c 06 03 55 04 0a 13 15 55 6e 69 76 65 72 73 69 74 61 20 64 69 20 42 6f 6c 6f 67 6e 61 31 23 30 21 06 03 55 04 0b Attribute 79 (EAP-Message) length=255 Value: 13 1a 44 69 70 61 72 74 69 6d 65 6e 74 6f 20 64 69 20 41 73 74 72 6f 6e 6f 6d 69 61 31 1d 30 1b 06 03 55 04 03 13 14 41 73 74 72 6f 6e 6f 6d 69 61 20 2d 20 52 6f 6f 74 20 43 41 31 22 30 20 06 09 2a 86 48 86 f7 0d 01 09 01 16 13 64 69 70 61 73 74 72 2e 73 69 40 75 6e 69 62 6f 2e 69 74 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 b5 72 b5 d8 c1 3e a3 75 04 ee 78 aa 17 97 f2 fd 41 ba e7 fc db be 34 7b 2e 82 cc b4 35 e5 34 ba 0f 3a 86 e8 55 32 58 64 41 8e 9a 25 7c 6b a9 a2 35 49 0a 86 3d 97 55 25 a0 c6 16 86 ba cc 4c 6a 2b d7 2a e8 02 16 87 23 c9 2e 69 ec 9c 60 7c 14 ba b3 10 d6 8a 22 d5 0b c2 6b 67 25 65 30 55 4e 90 11 0e 50 ad da 28 f0 9b b2 eb 39 28 7b 05 15 b3 d5 64 7d 28 d4 5d e0 f4 83 99 8a 15 Attribute 79 (EAP-Message) length=255 Value: 71 27 6b 02 17 3a b7 fc f9 82 69 7b e4 88 47 ea fd 4f 3b 2a 82 dc 48 be 9d 5a 1b 50 99 e0 12 45 5d 40 69 41 18 09 71 25 da 6f fb 23 38 04 f7 ca e4 df 23 3d 82 69 c9 4a fe 55 2d 1d f5 7e 94 10 87 cd 75 8d 3b f1 a8 47 16 47 0b 1d 16 3e 61 de 92 6f 76 b1 d8 a5 93 48 4b a9 e2 d9 a6 f2 db fd 2b be 6e af 02 97 b4 91 c7 d2 96 3e 49 77 59 c9 04 39 ef 56 5d bb 9c a0 7a fd 7a cd cd 46 37 65 2a b4 8c d2 c0 d0 b7 1f 84 88 17 88 b1 31 4b 40 d4 3e 67 72 9c fd ef a4 4d 07 8f 16 bb f4 23 da 10 a0 cc 09 11 f4 6a fb 31 ef 3c 9e 03 e2 fe 84 80 82 49 bd 9d 58 12 9a 69 77 64 3b 0b 2f f1 83 6c 41 c7 f9 df 69 87 9e cd 99 a8 aa cf c9 51 d4 9d bf 31 1e 51 ff a4 b6 9f 4c e2 c0 a0 c1 31 5d 15 c0 b2 c2 5e d3 7e f4 0d d9 a1 20 5a dc e6 ce 1a 45 c4 e1 76 23 d4 34 70 25 e1 1e 9a Attribute 79 (EAP-Message) length=255 Value: a3 28 45 39 57 9f ce 75 d6 bb 21 3c b3 5f d7 5b 22 fa 97 64 c3 45 21 f8 e1 f7 ec a5 7e ff a5 c7 81 45 ab 38 27 8e 73 a2 5e 4a b9 e0 2d a6 2e be 65 60 a6 5e 4e 9e 92 d3 57 66 f7 aa fc 51 6a cc 17 7d bd 84 e5 64 15 f2 3b 93 83 21 20 a8 51 a0 12 53 4b f7 44 c4 6b f3 7f 72 58 f9 96 97 f7 d9 c7 bb ad 72 8d 63 c7 de c4 7b 6a 9c f6 e1 28 8d 04 e1 5c 8d 30 82 96 e6 45 51 7f c2 97 56 4d 06 d4 e9 c7 67 15 f1 02 03 01 00 01 a3 72 30 70 30 0f 06 03 55 1d 13 01 01 ff 04 05 30 03 01 01 ff 30 1d 06 03 55 1d 0e 04 16 04 14 c8 2d 02 f0 84 5d 31 8f 49 82 f8 ee 76 7e df 32 38 6b 43 5d 30 0b 06 03 55 1d 0f 04 04 03 02 01 06 30 11 06 09 60 86 48 01 86 f8 42 01 01 04 04 03 02 00 07 30 1e 06 09 60 86 48 01 86 f8 42 01 0d 04 11 16 0f 78 63 61 20 63 65 72 74 69 66 69 63 61 Attribute 79 (EAP-Message) length=10 Value: 74 65 30 0d 06 09 2a 86 Attribute 80 (Message-Authenticator) length=18 Value: 79 e0 34 38 bd 23 1d c1 9d fa 5f 35 85 1c 48 60 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 0b 7c b0 56 82 24 1d fb 53 ea 51 8c STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.00 sec RADIUS packet matching with station decapsulated EAP packet (code=1 id=6 len=1020) from RADIUS server: EAP-Request-PEAP (25) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=6 method=25 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=1020) - Flags 0x40 SSL: Need 937 bytes more input data SSL: Building ACK (type=25 id=6 ver=0) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=6) TX EAP -> RADIUS - hexdump(len=6): 02 06 00 06 19 00 Encapsulating EAP message into a RADIUS packet Copied RADIUS State Attribute Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=6 length=150 Attribute 1 (User-Name) length=25 Value: 'PERSONALE\diego.zuccato' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '02-00-00-00-00-01' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=8 Value: 02 06 00 06 19 00 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 0b 7c b0 56 82 24 1d fb 53 ea 51 8c Attribute 80 (Message-Authenticator) length=18 Value: 54 f4 db 61 f9 84 54 bc cf 6c 2c 33 d6 30 ec e9 Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE Received 1007 bytes from RADIUS server Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=6 length=1007 Attribute 79 (EAP-Message) length=255 Value: 01 07 03 af 19 00 48 86 f7 0d 01 01 05 05 00 03 82 02 01 00 8e 9e ed 3d 5c ab 55 1c 14 0a 2f 7a 7d c0 7e 83 43 a2 14 84 b6 0e 61 7e 7f 96 42 92 3c 8b 97 65 34 39 3d 89 c5 ca 72 ba 63 88 e8 78 f7 30 f2 c4 5e 32 7b 3e 05 b6 bc c3 d1 d1 68 f0 69 64 d9 b6 5c 3a 6e 57 c6 c3 76 a3 b5 71 c0 92 ad 03 61 b0 dc 4c 9b de 73 3f 91 8c 41 dd a4 80 51 df f5 4a 7f 28 61 6b ec 00 e8 65 ab f4 62 53 3c fd 03 13 a0 dd c7 16 84 40 75 ed 48 82 1e 50 52 77 28 52 75 48 ac e4 f8 fa 1e 6f ba 70 e0 bf db 68 f5 04 7e 48 73 eb e0 8c d1 08 74 d5 18 23 b7 80 ca 14 06 d1 c0 e8 64 c8 66 88 8a 61 cf fe 76 a8 1e 52 1b bb 95 be 97 10 95 78 9f a1 a0 5b 34 90 60 e3 8f 54 3a 94 37 20 60 c1 5d b0 ec eb 71 e6 e9 01 55 4a 65 a9 8f f8 2f b5 e0 15 af 6c 3f 35 9a ef ce 14 91 08 ba 56 83 2a 76 Attribute 79 (EAP-Message) length=255 Value: 0c cb f8 11 a7 b1 47 b5 7a be 28 2b 2f 97 6b 87 4e 5d 87 4b 4e 68 b6 04 9f 82 37 47 ea a6 03 b1 d4 93 86 87 6d 3f 30 ce 48 cb 82 4a 34 f3 33 4e d5 6f d8 5b 6b 0c 52 83 9c da 6f ff d8 a4 e5 86 12 e2 9a b9 e4 79 0c 71 dc fa ab 93 a7 ba 27 90 67 45 47 90 13 f7 14 82 d1 84 7c dc 32 a1 57 fb 22 4a 49 67 d1 24 42 11 2d 1d 4c b5 b2 7d 85 53 99 b3 6e 7a 60 94 94 5c d0 dd 1d 62 c8 f5 b1 2c 44 57 7f c4 1e c8 81 48 a9 36 bf fc 41 55 e2 47 10 52 75 1d ec b3 92 dc 9a c9 49 b6 b5 71 91 9f b7 3e 06 e2 cf 9f a4 9f 65 1d 69 0c b2 fd d2 8e 4f e9 ea c7 d6 9e 83 68 7a 36 1c ed 30 6d 18 5a 7c 33 84 7c 4b 11 e8 98 a5 6b 46 bd 6c f0 6e 91 a1 3e 77 83 03 47 dc e1 54 02 0c 99 b3 b1 13 7d 6e aa a9 bb 3e 98 6a d5 86 58 ca c5 32 5e 32 05 fe 1e 1a a4 0f 43 76 eb ad 56 e3 27 38 Attribute 79 (EAP-Message) length=255 Value: af 46 29 f8 9f 22 60 26 19 26 db ef 1e 7b 53 81 35 e8 45 ea 5a 3f 30 ca 58 bc 16 03 01 01 8d 0c 00 01 89 00 80 86 af 5a fd 81 c8 84 76 eb 4e dc 66 26 f3 05 32 fc 1c 25 e7 fa da 2f f7 f4 e9 84 cc 33 c8 f6 86 d5 e8 4b 92 80 c0 55 08 67 28 ae 16 e6 2b 82 90 c7 b3 85 60 5b 8d 78 89 1b 76 b9 0c 6f 40 79 99 49 72 d9 01 ff 18 08 ad d6 78 08 46 d0 76 4e 95 39 45 17 ee e4 21 0b ec 51 c4 c2 1e a3 58 5e d5 cc b4 2f 55 15 89 f7 3c 5e da ec 4e 85 09 6c fc b1 29 51 5e 33 58 0e 35 c6 5b c9 a8 84 77 4f 73 00 01 02 00 80 73 16 9f 48 1d 56 5b c1 ce 80 8d 2b 00 90 72 90 cb 86 21 60 9c 92 76 34 a2 a2 1a db 1b c9 89 f1 2b 05 76 8c 63 d5 87 bc 42 8d 7e 5f 50 af 62 e1 89 b4 30 32 6a d2 ed dd fb 35 37 b1 81 1e c3 ae a9 a1 fe a7 d1 49 bc be b0 9e e6 8b 38 2b 18 9b f7 27 93 Attribute 79 (EAP-Message) length=186 Value: c4 ac 31 8b 10 b1 2f 3b 49 4d 7e e1 ae ef 88 d0 38 20 fc 63 9e 3b 2d 8d 70 38 f8 4b 30 0c 13 9c 10 05 95 03 e2 a9 4c ed 86 65 b8 87 f8 00 80 7b a9 33 5b 74 24 1b a4 81 5f 99 2e 31 6d 55 8c 76 32 1b a0 fe 73 58 13 f2 90 62 e9 aa dc 98 26 89 81 29 b3 dd 0a 81 10 ff e6 a0 87 c6 58 a3 89 a1 4c d2 56 87 60 a5 15 9d 59 af 59 c5 7b a7 92 8a 74 5c cc 8d 77 9c f3 3e 27 8b 55 64 29 51 31 69 80 54 ae 6e ef 2f c0 c3 2a 4d 93 21 78 4f b6 2c b8 70 b1 45 43 75 75 2a 74 62 0b 23 5d 42 cf 02 0c 31 bd 14 75 7a b2 c1 24 72 a4 b0 bc 58 3a 16 03 01 00 04 0e 00 00 00 Attribute 80 (Message-Authenticator) length=18 Value: d2 cb 5a 54 7e 60 25 41 99 89 f2 88 8b 8e 7e 57 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 08 7d b0 56 82 24 1d fb 53 ea 51 8c STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.00 sec RADIUS packet matching with station decapsulated EAP packet (code=1 id=7 len=943) from RADIUS server: EAP-Request-PEAP (25) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=7 method=25 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=943) - Flags 0x00 SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 read server hello A TLS: tls_verify_cb - preverify_ok=1 err=0 (ok) ca_cert_verify=1 depth=2 buf='/C=IT/ST=Italy/L=Bologna/O=Universita di Bologna/OU=Dipartimento di Astronomia/CN=Astronomia - Root CA/emailAddress=dipastr.si@unibo.it' CTRL-EVENT-EAP-PEER-CERT depth=2 subject='/C=IT/ST=Italy/L=Bologna/O=Universita di Bologna/OU=Dipartimento di Astronomia/CN=Astronomia - Root CA/emailAddress=dipastr.si@unibo.it' TLS: tls_verify_cb - preverify_ok=1 err=0 (ok) ca_cert_verify=1 depth=1 buf='/C=IT/ST=Italy/L=Bologna/O=Universita di Bologna/OU=Dipartimento di Astronomia/CN=Astronomia - CA Servers/emailAddress=dipastr.si@unibo.it' CTRL-EVENT-EAP-PEER-CERT depth=1 subject='/C=IT/ST=Italy/L=Bologna/O=Universita di Bologna/OU=Dipartimento di Astronomia/CN=Astronomia - CA Servers/emailAddress=dipastr.si@unibo.it' TLS: tls_verify_cb - preverify_ok=1 err=0 (ok) ca_cert_verify=1 depth=0 buf='/C=IT/ST=Italy/L=Bologna/O=Universita di Bologna/OU=Dipartimento di Astronomia/CN=radius.astronomia.unibo.it/emailAddress=dipastr.si@unibo.it' CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/C=IT/ST=Italy/L=Bologna/O=Universita di Bologna/OU=Dipartimento di Astronomia/CN=radius.astronomia.unibo.it/emailAddress=dipastr.si@unibo.it' SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 read server certificate A SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 read server key exchange A SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 read server done A SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 write client key exchange A SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 write change cipher spec A SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 write finished A SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 flush data SSL: (where=0x1002 ret=0xffffffff) SSL: SSL_connect:error in SSLv3 read finished A SSL: SSL_connect - want more data SSL: 198 bytes pending from ssl_out SSL: 198 bytes left to be sent out (of total 198 bytes) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=208) TX EAP -> RADIUS - hexdump(len=208): 02 07 00 d0 19 80 00 00 00 c6 16 03 01 00 86 10 00 00 82 00 80 05 2e 02 c4 02 82 35 d2 a1 67 9a 93 65 42 17 5c 0b 35 d3 b2 7c 35 7f 04 c4 09 f5 d2 dd 3d 82 cd 4c a2 70 22 f9 a5 ef e4 10 63 2f a7 65 ab 51 bc 4f 24 86 2c 7c 30 35 2d c2 d7 e1 f3 88 fe 39 67 4b 38 a4 f3 34 96 30 54 f5 bd 74 e5 0b de ba 76 f3 66 21 e2 a1 44 1f af 7c 67 fe 3d cb 4c a6 9d 4a f1 68 03 0d 82 c1 04 33 ce 15 c1 31 f7 99 41 bc a2 c4 4a 73 96 5c d2 59 ee 58 ae ea fd f8 c7 14 03 01 00 01 01 16 03 01 00 30 2e 3c 25 26 01 51 03 68 8e 2c 7f 4c 17 29 26 8e 5b b2 0e 26 11 ee 12 0d 1e 4d 76 bd b2 e8 5d 60 24 00 cb a7 95 22 b9 84 43 91 58 59 65 69 ef 32 Encapsulating EAP message into a RADIUS packet Copied RADIUS State Attribute Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=7 length=352 Attribute 1 (User-Name) length=25 Value: 'PERSONALE\diego.zuccato' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '02-00-00-00-00-01' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=210 Value: 02 07 00 d0 19 80 00 00 00 c6 16 03 01 00 86 10 00 00 82 00 80 05 2e 02 c4 02 82 35 d2 a1 67 9a 93 65 42 17 5c 0b 35 d3 b2 7c 35 7f 04 c4 09 f5 d2 dd 3d 82 cd 4c a2 70 22 f9 a5 ef e4 10 63 2f a7 65 ab 51 bc 4f 24 86 2c 7c 30 35 2d c2 d7 e1 f3 88 fe 39 67 4b 38 a4 f3 34 96 30 54 f5 bd 74 e5 0b de ba 76 f3 66 21 e2 a1 44 1f af 7c 67 fe 3d cb 4c a6 9d 4a f1 68 03 0d 82 c1 04 33 ce 15 c1 31 f7 99 41 bc a2 c4 4a 73 96 5c d2 59 ee 58 ae ea fd f8 c7 14 03 01 00 01 01 16 03 01 00 30 2e 3c 25 26 01 51 03 68 8e 2c 7f 4c 17 29 26 8e 5b b2 0e 26 11 ee 12 0d 1e 4d 76 bd b2 e8 5d 60 24 00 cb a7 95 22 b9 84 43 91 58 59 65 69 ef 32 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 08 7d b0 56 82 24 1d fb 53 ea 51 8c Attribute 80 (Message-Authenticator) length=18 Value: 6b 2f 2e d0 ed ee f8 c6 a4 74 1e a9 93 13 49 ca Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE Received 123 bytes from RADIUS server Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=7 length=123 Attribute 79 (EAP-Message) length=67 Value: 01 08 00 41 19 00 14 03 01 00 01 01 16 03 01 00 30 c9 9b 90 37 fc 28 af f0 57 69 e4 e3 69 b1 03 d7 ac fe 2a ab 6f 95 f1 d3 92 bc 8e 16 43 fa e8 82 1d 1c 12 67 04 ee f4 e4 6f bf b4 02 5c 30 85 5b Attribute 80 (Message-Authenticator) length=18 Value: ce fe bf 29 68 63 cb d8 8b 98 df 7c 72 ac 99 74 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 09 72 b0 56 82 24 1d fb 53 ea 51 8c STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.00 sec RADIUS packet matching with station decapsulated EAP packet (code=1 id=8 len=65) from RADIUS server: EAP-Request-PEAP (25) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=8 method=25 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=65) - Flags 0x00 SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 read finished A SSL: (where=0x20 ret=0x1) SSL: (where=0x1002 ret=0x1) SSL: 0 bytes pending from ssl_out SSL: No Application Data included SSL: No data to be sent out EAP-PEAP: TLS done, proceed to Phase 2 EAP-PEAP: using label 'client EAP encryption' in key derivation EAP-PEAP: Derived key - hexdump(len=64): 65 99 ae 78 31 34 d4 a4 db 05 9d c3 0a 26 4b 69 a5 77 c2 19 e4 0f 9f 8e 9b 56 fd d2 fd b4 fe d8 82 20 09 79 9a fd c1 07 9b 85 7c 07 92 60 58 8d 06 d0 23 76 d5 33 0d 06 4f 91 a8 ea 40 11 cf f1 SSL: Building ACK (type=25 id=8 ver=0) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=6) TX EAP -> RADIUS - hexdump(len=6): 02 08 00 06 19 00 Encapsulating EAP message into a RADIUS packet Copied RADIUS State Attribute Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=8 length=150 Attribute 1 (User-Name) length=25 Value: 'PERSONALE\diego.zuccato' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '02-00-00-00-00-01' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=8 Value: 02 08 00 06 19 00 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 09 72 b0 56 82 24 1d fb 53 ea 51 8c Attribute 80 (Message-Authenticator) length=18 Value: 3f 52 9f 24 52 cd 79 00 3d d1 08 40 2a 33 b4 14 Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE Received 101 bytes from RADIUS server Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=8 length=101 Attribute 79 (EAP-Message) length=45 Value: 01 09 00 2b 19 00 17 03 01 00 20 9c a5 dc 52 6f 74 36 01 4b 9d f6 45 48 66 c1 4e 23 6a 46 95 c2 36 a2 06 25 36 ad cb b4 90 1c 53 Attribute 80 (Message-Authenticator) length=18 Value: 8e 3c 96 54 33 32 da 7d 39 2e d9 44 5e 61 b5 07 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 06 73 b0 56 82 24 1d fb 53 ea 51 8c STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.00 sec RADIUS packet matching with station decapsulated EAP packet (code=1 id=9 len=43) from RADIUS server: EAP-Request-PEAP (25) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=9 method=25 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=43) - Flags 0x00 EAP-PEAP: received 37 bytes encrypted data for Phase 2 EAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=5): 01 09 00 05 01 EAP-PEAP: received Phase 2: code=1 identifier=9 length=5 EAP-PEAP: Phase 2 Request: type=1 EAP: using real identity - hexdump_ascii(len=23): 50 45 52 53 4f 4e 41 4c 45 5c 64 69 65 67 6f 2e PERSONALE\diego. 7a 75 63 63 61 74 6f zuccato EAP-PEAP: Encrypting Phase 2 data - hexdump(len=28): 02 09 00 1c 01 50 45 52 53 4f 4e 41 4c 45 5c 64 69 65 67 6f 2e 7a 75 63 63 61 74 6f SSL: 90 bytes left to be sent out (of total 90 bytes) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=96) TX EAP -> RADIUS - hexdump(len=96): 02 09 00 60 19 00 17 03 01 00 20 27 22 f3 1e 5c e8 88 f5 86 e9 f6 e7 8a 4a b1 56 80 2f c2 8d e8 9a 9b 9a 08 21 80 5d 92 23 35 b5 17 03 01 00 30 4a 1c 6d 37 6c 69 8f 93 9d 8d d0 a3 fb 74 a9 29 1b a2 b4 02 e4 d8 27 33 23 63 c7 9e d1 0f 1f 23 d4 49 42 e0 44 56 96 64 72 f4 71 2c 02 ac 35 9c Encapsulating EAP message into a RADIUS packet Copied RADIUS State Attribute Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=9 length=240 Attribute 1 (User-Name) length=25 Value: 'PERSONALE\diego.zuccato' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '02-00-00-00-00-01' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=98 Value: 02 09 00 60 19 00 17 03 01 00 20 27 22 f3 1e 5c e8 88 f5 86 e9 f6 e7 8a 4a b1 56 80 2f c2 8d e8 9a 9b 9a 08 21 80 5d 92 23 35 b5 17 03 01 00 30 4a 1c 6d 37 6c 69 8f 93 9d 8d d0 a3 fb 74 a9 29 1b a2 b4 02 e4 d8 27 33 23 63 c7 9e d1 0f 1f 23 d4 49 42 e0 44 56 96 64 72 f4 71 2c 02 ac 35 9c Attribute 24 (State) length=18 Value: 0e 7a a9 3e 06 73 b0 56 82 24 1d fb 53 ea 51 8c Attribute 80 (Message-Authenticator) length=18 Value: fb 1a a9 0a 14 34 13 a7 80 89 f4 a4 23 38 51 f3 Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE Received 149 bytes from RADIUS server Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=9 length=149 Attribute 79 (EAP-Message) length=93 Value: 01 0a 00 5b 19 00 17 03 01 00 50 e0 3e c1 3d 89 34 69 c6 60 71 cc 28 c6 02 16 f3 ea 86 77 2c 3d fc 30 bb 96 ab 24 fa 13 b9 d8 9f 31 2f 92 33 62 18 c2 d7 2a a8 9f 83 68 6a 7c 07 02 d0 c7 b4 02 c1 cb d3 8a 3e cc 51 d3 66 9b 74 39 2c d6 24 04 7f eb f6 56 0c ad 59 0c 9b 97 26 Attribute 80 (Message-Authenticator) length=18 Value: 8d 25 4c f7 97 a4 e1 31 a5 ce 99 cc cd e0 47 40 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 07 70 b0 56 82 24 1d fb 53 ea 51 8c STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.00 sec RADIUS packet matching with station decapsulated EAP packet (code=1 id=10 len=91) from RADIUS server: EAP-Request-PEAP (25) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=10 method=25 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=91) - Flags 0x00 EAP-PEAP: received 85 bytes encrypted data for Phase 2 EAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=45): 1a 01 0a 00 2c 10 89 1d 7b 28 d8 fb 7e 88 18 33 48 49 5b 31 40 dd 50 45 52 53 4f 4e 41 4c 45 5c 64 69 65 67 6f 2e 7a 75 63 63 61 74 6f EAP-PEAP: received Phase 2: code=1 identifier=10 length=49 EAP-PEAP: Phase 2 Request: type=26 EAP-PEAP: Selected Phase 2 EAP vendor 0 method 26 EAP-MSCHAPV2: RX identifier 10 mschapv2_id 10 EAP-MSCHAPV2: Received challenge EAP-MSCHAPV2: Authentication Servername - hexdump_ascii(len=23): 50 45 52 53 4f 4e 41 4c 45 5c 64 69 65 67 6f 2e PERSONALE\diego. 7a 75 63 63 61 74 6f zuccato EAP-MSCHAPV2: Generating Challenge Response MSCHAPV2: Identity - hexdump_ascii(len=23): 50 45 52 53 4f 4e 41 4c 45 5c 64 69 65 67 6f 2e PERSONALE\diego. 7a 75 63 63 61 74 6f zuccato MSCHAPV2: Username - hexdump_ascii(len=13): 64 69 65 67 6f 2e 7a 75 63 63 61 74 6f diego.zuccato MSCHAPV2: auth_challenge - hexdump(len=16): 89 1d 7b 28 d8 fb 7e 88 18 33 48 49 5b 31 40 dd MSCHAPV2: peer_challenge - hexdump(len=16): a6 7d 2c b6 fb bb f6 6a 02 93 cb 62 90 b5 40 de MSCHAPV2: username - hexdump_ascii(len=13): 64 69 65 67 6f 2e 7a 75 63 63 61 74 6f diego.zuccato MSCHAPV2: password - hexdump_ascii(len=10): 74 65 73 74 69 6e 67 31 32 33 testing123 MSCHAPV2: NT Response - hexdump(len=24): 4d f5 00 14 b4 6f 8b 83 b4 df 5b 7c ec c0 36 6e fe 63 8e 9d 62 dc 71 69 MSCHAPV2: Auth Response - hexdump(len=20): 04 4c a4 9d c3 22 5d 34 24 8d 06 05 e9 12 07 13 c3 68 1b 2d MSCHAPV2: Master Key - hexdump(len=16): e1 46 a5 1a 0a d0 68 a4 da 8f 6c 05 7c b2 d9 bc EAP-MSCHAPV2: TX identifier 10 mschapv2_id 10 (response) EAP-PEAP: Encrypting Phase 2 data - hexdump(len=82): 02 0a 00 52 1a 02 0a 00 4d 31 a6 7d 2c b6 fb bb f6 6a 02 93 cb 62 90 b5 40 de 00 00 00 00 00 00 00 00 4d f5 00 14 b4 6f 8b 83 b4 df 5b 7c ec c0 36 6e fe 63 8e 9d 62 dc 71 69 00 50 45 52 53 4f 4e 41 4c 45 5c 64 69 65 67 6f 2e 7a 75 63 63 61 74 6f SSL: 154 bytes left to be sent out (of total 154 bytes) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=160) TX EAP -> RADIUS - hexdump(len=160): 02 0a 00 a0 19 00 17 03 01 00 20 8d 59 9d fa 88 e6 f7 16 ca 8d 2b 13 c2 17 3e 31 17 4b ba 1a 86 c1 d4 98 f4 63 18 e1 f9 4d 45 12 17 03 01 00 70 ae 6d 17 2b 03 fb 2f 6a e4 48 f6 43 53 5d 98 cc d7 5f 04 6e 82 f3 2d 61 ce 2e 4c 29 8a 53 80 19 31 87 fa 40 80 c6 7d 39 46 3e 0d c8 2f 1c 30 97 96 f1 58 34 4d de 75 cf 5a 40 9c 15 64 e6 40 fb 9d 03 9f 4d 5d 56 2d b4 00 70 77 ff 3d d7 96 35 89 a3 ed cb d0 28 c7 5e 80 43 c9 b5 05 82 a0 7a a4 61 a6 00 d5 87 78 67 9e fa 65 14 a6 be a1 82 Encapsulating EAP message into a RADIUS packet Copied RADIUS State Attribute Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=10 length=304 Attribute 1 (User-Name) length=25 Value: 'PERSONALE\diego.zuccato' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '02-00-00-00-00-01' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=162 Value: 02 0a 00 a0 19 00 17 03 01 00 20 8d 59 9d fa 88 e6 f7 16 ca 8d 2b 13 c2 17 3e 31 17 4b ba 1a 86 c1 d4 98 f4 63 18 e1 f9 4d 45 12 17 03 01 00 70 ae 6d 17 2b 03 fb 2f 6a e4 48 f6 43 53 5d 98 cc d7 5f 04 6e 82 f3 2d 61 ce 2e 4c 29 8a 53 80 19 31 87 fa 40 80 c6 7d 39 46 3e 0d c8 2f 1c 30 97 96 f1 58 34 4d de 75 cf 5a 40 9c 15 64 e6 40 fb 9d 03 9f 4d 5d 56 2d b4 00 70 77 ff 3d d7 96 35 89 a3 ed cb d0 28 c7 5e 80 43 c9 b5 05 82 a0 7a a4 61 a6 00 d5 87 78 67 9e fa 65 14 a6 be a1 82 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 07 70 b0 56 82 24 1d fb 53 ea 51 8c Attribute 80 (Message-Authenticator) length=18 Value: f2 ab 0b d7 4f 36 9b e0 20 7b c8 8c 87 1e fa be Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE Received 149 bytes from RADIUS server Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=10 length=149 Attribute 79 (EAP-Message) length=93 Value: 01 0b 00 5b 19 00 17 03 01 00 50 55 eb c7 36 70 d6 e4 90 b3 bc f2 78 5a 22 b1 4d a2 d6 d4 1f df 14 37 03 76 7f a3 00 cd 4f 79 8b 2e 13 cf 27 a3 b8 4d 79 9b 78 1a 9a 25 d5 8f ff f3 d1 e4 77 af 65 c7 f3 dc f1 39 a1 c8 86 32 da 76 ef f1 aa 05 00 21 ad d9 be ed 5c f5 b9 7e ea Attribute 80 (Message-Authenticator) length=18 Value: 0e 97 42 d5 36 63 37 33 57 df 91 cc a8 ea a9 05 Attribute 24 (State) length=18 Value: 0e 7a a9 3e 04 71 b0 56 82 24 1d fb 53 ea 51 8c STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.05 sec RADIUS packet matching with station decapsulated EAP packet (code=1 id=11 len=91) from RADIUS server: EAP-Request-PEAP (25) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=11 method=25 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=91) - Flags 0x00 EAP-PEAP: received 85 bytes encrypted data for Phase 2 EAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=47): 1a 03 0a 00 2e 53 3d 32 32 37 34 39 36 33 45 33 37 43 36 36 34 46 42 42 33 30 46 36 34 41 41 36 30 36 33 34 31 31 46 44 44 46 36 35 45 34 41 EAP-PEAP: received Phase 2: code=1 identifier=11 length=51 EAP-PEAP: Phase 2 Request: type=26 EAP-MSCHAPV2: RX identifier 11 mschapv2_id 10 EAP-MSCHAPV2: Received success EAP-MSCHAPV2: Invalid authenticator response in success request EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: startWhen --> 0 EAPOL test timed out EAPOL: EAP key not available EAP: deinitialize previously used EAP method (25, PEAP) at EAP deinit MPPE keys OK: 0 mismatch: 1 FAILURE Tks, Diego

Il 19/01/2012 10:03, Phil Mayers ha scritto:

...

EAP: deinitialize previously used EAP method (25, PEAP) at EAP deinit MPPE keys OK: 0 mismatch: 1 FAILURE These (plus the timeout one) are the lines printed after FR have already cloded session.

Hmm. I see from your original email that Samba & ntlm_auth are succeeding. Yup. I'm quite used to joining machines to AD... Already have about 100 clients and 5 servers, and this one is the one giving me troubles :(

There are a couple of buggy version of Samba out there that return invalid response values, and generate these symptoms. Which version of Samba are you running, and on what OS? Samba 3.5.6 (latest packaged one) on Debian Squeeze. Once it's working, I'll have to move the config to a ZeroShell box with Samba 3.5.10.

Another problem I should fix is the fact that ZS's captive portal passes user@realm credentials instead of realm\user ... rewriting w/ a simple rule in hints file seems to block the rest, so I left it behind, for now. Tks, Diego.

Il 20/01/2012 11:55, Phil Mayers ha scritto:

If that's really all you've changed, there must be something wrong with Samba; it's getting the final crypto blob wrong, and the client is dropping the packets. You'll need to investigate and fix this. Just tested with radtest (have had to use single quotes and FOUR backslashes! -- my password is obviously in $P): # radtest -t mschap 'PERSONALE\\\\diego.zuccato' "$P" localhost 0 testing123 Sending Access-Request of id 123 to 127.0.0.1 port 1812 User-Name = "PERSONALE\\diego.zuccato" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 MS-CHAP-Challenge = 0x7f218889d9de0c84 MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000015ea491108aa02bb34b5fe79918a67cd8a7b069240091194 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=123, length=84 MS-CHAP-MPPE-Keys = 0x00000000000000003b1acd0b65d7af221df50f6ca50447cf0000000000000000 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006

And the Access-Accept is quite fast. When using eapol_test, I get the timeout. The difference is that radtest seems to use mschapv1 while eapol_test uses mschapv2. What could be so wrong that v1 works and v2 doesn't? IIUC v2 includes username and client nonce in the authenticator, while v1 doesn't. BYtE, Diego.

Phil Mayers <p.mayers@imperial.ac.uk> wrote:

Mschap v1 doesn't validate the reply from server to client, which is what is failing with eapol_test. Therefore you're not testing the same path.

Try using a local i.e. non samba user to test. I am sure the problem is with your samba daemon. -- Sent from my phone. Please excuse brevity and typos.

See also: https://bugzilla.samba.org/show_bug.cgi?id=6563 ...which I think is the problem you are seeing. Comment 18 gives a way to test this. See also the final comment about "invalid nt key until I restarted winbind" which might be the issue. -- Sent from my phone. Please excuse brevity and typos.

Il 23/01/2012 11:02, Phil Mayers ha scritto:

Mschap v1 doesn't validate the reply from server to client, which is what is failing with eapol_test. Therefore you're not testing the same path. So radtest isn't actually equivalent to eapol_test. It's just another step for testing.

Try using a local i.e. non samba user to test. I am sure the problem is with your samba daemon. What do you mean by "local user"? One added in users file? I know it works (tested while following the guide), but it's not using mschapv2, IIUC...

From https://bugzilla.samba.org/show_bug.cgi?id=6563 it seems that script only generates NTLMv1 responses... And it references a quite old Samba version. I'm using 3.5.10. From comment 46: "Yes, 3.5.6 has all necessary fixes for this issue. Unless the sernet packages do contain other changes, it should just work with those packages."

I retested, adding "winbind:forcesamlogon = True" and eapol_test is now successful. Might be useful to add to the guide. Seems, after all, it's needed for recent SAMBA releases, too. Just for completeness my (now working) smb.conf is: [global] workgroup = PERSONALE realm = PERSONALE.DIR.UNIBO.IT server string = %v security = ADS restrict anonymous = 2 log level = 3 log file = /var/log/samba/log.%m max log size = 50 socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 local master = No dns proxy = No idmap uid = 100000-100000000 idmap gid = 100000-100000000 template shell = /bin/bash winbind use default domain = Yes winbind refresh tickets = Yes winbind offline logon = Yes winbind normalize names = Yes idmap config STUDENTI:range = 50000000 - 99999999 idmap config STUDENTI:base_rid = 500 idmap config STUDENTI:backend = rid idmap config PERSONALE:range = 100000 - 49999999 idmap config PERSONALE:base_rid = 500 idmap config PERSONALE:backend = rid idmap config STUDENTI:default = yes idmap config PERSONALE:default = no winbind:forcesamlogon = True [maybe the whole idmap could be removed, but better not to touch it once it's working...] No need to edit /etc/krb5.conf (interfacing to a native AD domain, so DNS records are OK for auto-discovery of Kerberos servers. Now it's Zeroshell's turn... Tks for the patience. BYtE, Diego.