Re: cisco WAP/FreeRadius/OpenLDAP

3 Nov 2011

      looks like removing the 'unix' from the two enabled sites might have 
done the trick.  i have a w7 machine running off of one of the AP's 
using the RADIUS server... more testing next tues.

-m

On 11/3/2011 2:40 PM, freeradius-users-request@lists.freeradius.org wrote:
...
Send Freeradius-Users mailing list submissions to
  freeradius-users@lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit
  http://lists.freeradius.org/mailman/listinfo/freeradius-users
or, via email, send a message with subject or body 'help' to
  freeradius-users-request@lists.freeradius.org
You can reach the person managing the list at
  freeradius-users-owner@lists.freeradius.org
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. use pam as authentication medium of FreeRadius (Ivan Matala)
    2. Re: cisco WAP/FreeRadius/OpenLDAP (Matthew Arguin)
----------------------------------------------------------------------
Message: 1
Date: Thu, 3 Nov 2011 07:08:32 -0700
From: Ivan Matala<ivanmatala@gmail.com>
Subject: use pam as authentication medium of FreeRadius
To: freeradius-users@lists.freeradius.org
Message-ID:
  <CAH92aV5T6AoSqTF6ky4jWhQYdyK=p0xmHy-v6ODrL-CHcKT5cg@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
i have a server A with freeradius installed. is there anyway to use
the pam of it to be use as authentication medium of freeradius?
(instead of using Auth Type = System, Local, SQL
The pam module (http://linuxexplore.wordpress.com/how-tos/pam-with-radius-authentication/)
connects to another radius server (Server B), and then returns a reply
whether it is valid or invalid.
Thanks
------------------------------
Message: 2
Date: Thu, 03 Nov 2011 14:40:06 -0400
From: Matthew Arguin<matt.arguin@currensee.com>
Subject: Re: cisco WAP/FreeRadius/OpenLDAP
To: freeradius-users@lists.freeradius.org
Message-ID:<4EB2E006.3040705@currensee.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
sorry about the snipped debug.  i am attaching another fresh one here.
there are no users in the files on the computer, all in LDAP so the
shadow file should not be an issue.  I will find the 'unix' part and
comment it out.
-m
full debug below frm windows machine attempt:
[root@ops2 ~]# radiusd -X
FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on
Oct  3 2011 at 10:29:04
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License v2.
Starting - reading configuration files ...
including configuration file /etc/raddb/radiusd.conf
including configuration file /etc/raddb/proxy.conf
including configuration file /etc/raddb/clients.conf
including files in directory /etc/raddb/modules/
including configuration file /etc/raddb/modules/pap
including configuration file /etc/raddb/modules/preprocess
including configuration file /etc/raddb/modules/perl
including configuration file /etc/raddb/modules/linelog
including configuration file /etc/raddb/modules/sql_log
including configuration file /etc/raddb/modules/cui
including configuration file /etc/raddb/modules/acct_unique
including configuration file /etc/raddb/modules/mac2ip
including configuration file /etc/raddb/modules/detail.example.com
including configuration file /etc/raddb/modules/replicate
including configuration file /etc/raddb/modules/dynamic_clients
including configuration file /etc/raddb/modules/passwd
including configuration file /etc/raddb/modules/wimax
including configuration file /etc/raddb/modules/inner-eap
including configuration file /etc/raddb/modules/logintime
including configuration file /etc/raddb/modules/chap
including configuration file /etc/raddb/modules/digest
including configuration file /etc/raddb/modules/ippool
including configuration file /etc/raddb/modules/mschap
including configuration file /etc/raddb/modules/pam
including configuration file /etc/raddb/modules/redis
including configuration file /etc/raddb/modules/detail.log
including configuration file /etc/raddb/modules/always
including configuration file /etc/raddb/modules/radutmp
including configuration file /etc/raddb/modules/ldap
including configuration file /etc/raddb/modules/ntlm_auth
including configuration file /etc/raddb/modules/ldap.new
including configuration file /etc/raddb/modules/mac2vlan
including configuration file /etc/raddb/modules/etc_group
including configuration file /etc/raddb/modules/sradutmp
including configuration file /etc/raddb/modules/counter
including configuration file /etc/raddb/modules/attr_filter
including configuration file /etc/raddb/modules/soh
including configuration file /etc/raddb/modules/policy
including configuration file /etc/raddb/modules/unix
including configuration file /etc/raddb/modules/opendirectory
including configuration file /etc/raddb/modules/sqlcounter_expire_on_login
including configuration file /etc/raddb/modules/otp
including configuration file /etc/raddb/modules/exec
including configuration file /etc/raddb/modules/realm
including configuration file /etc/raddb/modules/rediswho
including configuration file /etc/raddb/modules/expiration
including configuration file /etc/raddb/modules/checkval
including configuration file /etc/raddb/modules/echo
including configuration file /etc/raddb/modules/detail
including configuration file /etc/raddb/modules/attr_rewrite
including configuration file /etc/raddb/modules/smsotp
including configuration file /etc/raddb/modules/expr
including configuration file /etc/raddb/modules/smbpasswd
including configuration file /etc/raddb/modules/files
including configuration file /etc/raddb/eap.conf
including configuration file /etc/raddb/policy.conf
including files in directory /etc/raddb/sites-enabled/
including configuration file /etc/raddb/sites-enabled/inner-tunnel
including configuration file /etc/raddb/sites-enabled/default
including configuration file /etc/raddb/sites-enabled/control-socket
main {
          user = "radiusd"
          group = "radiusd"
          allow_core_dumps = no
}
including dictionary file /etc/raddb/dictionary
main {
          name = "radiusd"
          prefix = "/usr"
          localstatedir = "/var"
          sbindir = "/usr/sbin"
          logdir = "/var/log/radius"
          run_dir = "/var/run/radiusd"
          libdir = "/usr/lib64/freeradius"
          radacctdir = "/var/log/radius/radacct"
          hostname_lookups = no
          max_request_time = 30
          cleanup_delay = 5
          max_requests = 1024
          pidfile = "/var/run/radiusd/radiusd.pid"
          checkrad = "/usr/sbin/checkrad"
          debug_level = 0
          proxy_requests = yes
   log {
          stripped_names = no
          auth = no
          auth_badpass = no
          auth_goodpass = no
   }
   security {
          max_attributes = 200
          reject_delay = 1
          status_server = yes
   }
}
radiusd: #### Loading Realms and Home Servers ####
   proxy server {
          retry_delay = 5
          retry_count = 3
          default_fallback = no
          dead_time = 120
          wake_all_if_all_dead = no
   }
   home_server localhost {
          ipaddr = 127.0.0.1
          port = 1812
          type = "auth"
          secret = "testing123"
          response_window = 20
          max_outstanding = 65536
          require_message_authenticator = no
          zombie_period = 40
          status_check = "status-server"
          ping_interval = 30
          check_interval = 30
          num_answers_to_alive = 3
          num_pings_to_alive = 3
          revive_interval = 120
          status_check_timeout = 4
    coa {
          irt = 2
          mrt = 16
          mrc = 5
          mrd = 30
    }
   }
   home_server_pool my_auth_failover {
          type = fail-over
          home_server = localhost
   }
   realm local.currensee.com {
          auth_pool = my_auth_failover
   }
   realm LOCAL {
   }
radiusd: #### Loading Clients ####
   client localhost {
          ipaddr = 127.0.0.1
          require_message_authenticator = no
          secret = "i6Lw7uNsG7pZDUGgxirg"
          nastype = "other"
   }
   client ops2 {
          ipaddr = 192.168.10.247
          require_message_authenticator = no
          secret = "i6Lw7uNsG7pZDUGgxirg"
          nastype = "other"
   }
   client ap1 {
          ipaddr = 192.168.10.31
          require_message_authenticator = no
          secret = "i6Lw7uNsG7pZDUGgxirg"
          shortname = "ap1"
          nastype = "cisco"
   }
   client ap2 {
          ipaddr = 192.168.10.30
          require_message_authenticator = no
          secret = "i6Lw7uNsG7pZDUGgxirg"
          shortname = "ap2"
          nastype = "cisco"
   }
radiusd: #### Instantiating modules ####
   instantiate {
   Module: Linked to module rlm_exec
   Module: Instantiating module "exec" from file /etc/raddb/modules/exec
    exec {
          wait = no
          input_pairs = "request"
          shell_escape = yes
    }
   Module: Linked to module rlm_expr
   Module: Instantiating module "expr" from file /etc/raddb/modules/expr
   Module: Linked to module rlm_expiration
   Module: Instantiating module "expiration" from file
/etc/raddb/modules/expiration
    expiration {
          reply-message = "Password Has Expired  "
    }
   Module: Linked to module rlm_logintime
   Module: Instantiating module "logintime" from file
/etc/raddb/modules/logintime
    logintime {
          reply-message = "You are calling outside your allowed timespan  "
          minimum-timeout = 60
    }
   }
radiusd: #### Loading Virtual Servers ####
server { # from file /etc/raddb/radiusd.conf
   modules {
    Module: Creating Auth-Type = LDAP
    Module: Creating Post-Auth-Type = REJECT
   Module: Checking authenticate {...} for more modules to load
   Module: Linked to module rlm_pap
   Module: Instantiating module "pap" from file /etc/raddb/modules/pap
    pap {
          encryption_scheme = "auto"
          auto_header = yes
    }
   Module: Linked to module rlm_chap
   Module: Instantiating module "chap" from file /etc/raddb/modules/chap
   Module: Linked to module rlm_mschap
   Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap
    mschap {
          use_mppe = yes
          require_encryption = yes
          require_strong = yes
          with_ntdomain_hack = no
          allow_retry = yes
    }
   Module: Linked to module rlm_unix
   Module: Instantiating module "unix" from file /etc/raddb/modules/unix
    unix {
          radwtmp = "/var/log/radius/radwtmp"
    }
   Module: Linked to module rlm_ldap
   Module: Instantiating module "ldap" from file /etc/raddb/modules/ldap
    ldap {
          server = "ldap.local.currensee.com"
          port = 389
          password = "VcnxJbFqeAuAFyiu3zvi"
          identity = "cn=manager,dc=currensee,dc=com"
          net_timeout = 1
          timeout = 4
          timelimit = 3
          tls_mode = no
          start_tls = yes
          tls_cacertfile = "/etc/ldap/csca.crt"
          tls_require_cert = "demand"
     tls {
          start_tls = no
          require_cert = "allow"
     }
          basedn = "ou=people,dc=currensee,dc=com"
          filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
          base_filter = "(objectclass=radiusprofile)"
          auto_header = no
          access_attr = "uid"
          access_attr_used_for_allow = yes
          groupname_attribute = "cn"
          groupmembership_filter =
"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
          dictionary_mapping = "/etc/raddb/ldap.attrmap"
          ldap_debug = 40
          ldap_connections_number = 5
          compare_check_items = no
          do_xlat = yes
          set_auth_type = yes
    }
rlm_ldap: Registering ldap_groupcmp for Ldap-Group
rlm_ldap: Registering ldap_xlat with xlat_name ldap
rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap
rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type
rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use
rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id
rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id
rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password
rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT
rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration
rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address
rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header
rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type
rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol
rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address
rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask
rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route
rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing
rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id
rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU
rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression
rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host
rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service
rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port
rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number
rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id
rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network
rlm_ldap: LDAP radiusClass mapped to RADIUS Class
rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout
rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout
rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action
rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service
rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node
rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group
rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS
Framed-AppleTalk-Link
rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS
Framed-AppleTalk-Network
rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS
Framed-AppleTalk-Zone
rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit
rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port
rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message
rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type
rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type
rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS
Tunnel-Private-Group-Id
conns: 0xb5bdcd0
   Module: Linked to module rlm_eap
   Module: Instantiating module "eap" from file /etc/raddb/eap.conf
    eap {
          default_eap_type = "peap"
          timer_expire = 60
          ignore_unknown_eap_types = no
          cisco_accounting_username_bug = no
          max_sessions = 2048
    }
   Module: Linked to sub-module rlm_eap_md5
   Module: Instantiating eap-md5
   Module: Linked to sub-module rlm_eap_leap
   Module: Instantiating eap-leap
   Module: Linked to sub-module rlm_eap_gtc
   Module: Instantiating eap-gtc
     gtc {
          challenge = "Password: "
          auth_type = "PAP"
     }
   Module: Linked to sub-module rlm_eap_tls
   Module: Instantiating eap-tls
     tls {
          rsa_key_exchange = no
          dh_key_exchange = yes
          rsa_key_length = 512
          dh_key_length = 512
          verify_depth = 0
          pem_file_type = yes
          private_key_file = "/etc/raddb/certs/radius.key.pem"
          certificate_file = "/etc/raddb/certs/radius.crt.pem"
          CA_file = "/etc/raddb/certs/cacert.pem"
          private_key_password = "i6Lw7uNsG7pZDUGgxirg"
          dh_file = "/etc/raddb/certs/dh"
          random_file = "/dev/urandom"
          fragment_size = 1024
          include_length = yes
          check_crl = no
          cipher_list = "DEFAULT"
          make_cert_command = "/etc/raddb/certs/bootstrap"
      cache {
          enable = no
          lifetime = 24
          max_entries = 255
      }
     }
   Module: Linked to sub-module rlm_eap_ttls
   Module: Instantiating eap-ttls
     ttls {
          default_eap_type = "md5"
          copy_request_to_tunnel = no
          use_tunneled_reply = no
          virtual_server = "inner-tunnel"
          include_length = yes
     }
   Module: Linked to sub-module rlm_eap_peap
   Module: Instantiating eap-peap
     peap {
          default_eap_type = "mschapv2"
          copy_request_to_tunnel = no
          use_tunneled_reply = no
          proxy_tunneled_request_as_eap = yes
          virtual_server = "inner-tunnel"
          soh = no
     }
   Module: Linked to sub-module rlm_eap_mschapv2
   Module: Instantiating eap-mschapv2
     mschapv2 {
          with_ntdomain_hack = no
          send_error = no
     }
   Module: Checking authorize {...} for more modules to load
   Module: Linked to module rlm_preprocess
   Module: Instantiating module "preprocess" from file
/etc/raddb/modules/preprocess
    preprocess {
          huntgroups = "/etc/raddb/huntgroups"
          hints = "/etc/raddb/hints"
          with_ascend_hack = no
          ascend_channels_per_line = 23
          with_ntdomain_hack = no
          with_specialix_jetstream_hack = no
          with_cisco_vsa_hack = no
          with_alvarion_vsa_hack = no
    }
   Module: Linked to module rlm_realm
   Module: Instantiating module "suffix" from file /etc/raddb/modules/realm
    realm suffix {
          format = "suffix"
          delimiter = "@"
          ignore_default = no
          ignore_null = no
    }
   Module: Linked to module rlm_files
   Module: Instantiating module "files" from file /etc/raddb/modules/files
    files {
          usersfile = "/etc/raddb/users"
          acctusersfile = "/etc/raddb/acct_users"
          preproxy_usersfile = "/etc/raddb/preproxy_users"
          compat = "no"
    }
   Module: Checking preacct {...} for more modules to load
   Module: Linked to module rlm_acct_unique
   Module: Instantiating module "acct_unique" from file
/etc/raddb/modules/acct_unique
    acct_unique {
          key = "User-Name, Acct-Session-Id, NAS-IP-Address,
Client-IP-Address, NAS-Port"
    }
   Module: Checking accounting {...} for more modules to load
   Module: Linked to module rlm_detail
   Module: Instantiating module "detail" from file /etc/raddb/modules/detail
    detail {
          detailfile =
"/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
          header = "%t"
          detailperm = 384
          dirperm = 493
          locking = no
          log_packet_header = no
    }
   Module: Linked to module rlm_radutmp
   Module: Instantiating module "radutmp" from file
/etc/raddb/modules/radutmp
    radutmp {
          filename = "/var/log/radius/radutmp"
          username = "%{User-Name}"
          case_sensitive = yes
          check_with_nas = yes
          perm = 384
          callerid = yes
    }
   Module: Linked to module rlm_attr_filter
   Module: Instantiating module "attr_filter.accounting_response" from
file /etc/raddb/modules/attr_filter
    attr_filter attr_filter.accounting_response {
          attrsfile = "/etc/raddb/attrs.accounting_response"
          key = "%{User-Name}"
          relaxed = no
    }
   Module: Checking session {...} for more modules to load
   Module: Checking post-proxy {...} for more modules to load
   Module: Checking post-auth {...} for more modules to load
   Module: Instantiating module "attr_filter.access_reject" from file
/etc/raddb/modules/attr_filter
    attr_filter attr_filter.access_reject {
          attrsfile = "/etc/raddb/attrs.access_reject"
          key = "%{User-Name}"
          relaxed = no
    }
   } # modules
} # server
server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel
   modules {
   Module: Checking authenticate {...} for more modules to load
   Module: Checking authorize {...} for more modules to load
   Module: Checking session {...} for more modules to load
   Module: Checking post-proxy {...} for more modules to load
   Module: Checking post-auth {...} for more modules to load
   } # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
          type = "auth"
          ipaddr = *
          port = 0
}
listen {
          type = "acct"
          ipaddr = *
          port = 0
}
listen {
          type = "control"
   listen {
          socket = "/var/run/radiusd/radiusd.sock"
   }
}
   ... adding new socket proxy address * port 50281
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on command file /var/run/radiusd/radiusd.sock
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=105, length=133
          User-Name = "anonymous"
          Framed-MTU = 1400
          Called-Station-Id = "64a0.e729.b890"
          Calling-Station-Id = "1c65.9d32.fb68"
          Service-Type = Login-User
          Message-Authenticator = 0x7b50b55eaa1b8572fd679e2acff05bba
          EAP-Message = 0x0202000e01616e6f6e796d6f7573
          NAS-Port-Type = Wireless-802.11
          NAS-Port = 2387
          NAS-Port-Id = "2387"
          NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 2 length 14
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
[ldap] performing user authorization for anonymous
[ldap]  expand: %{Stripped-User-Name} ->
[ldap]  ... expanding second conditional
[ldap]  expand: %{User-Name} ->  anonymous
[ldap]  expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) ->
(uid=anonymous)
[ldap]  expand: ou=people,dc=currensee,dc=com ->
ou=people,dc=currensee,dc=com
    [ldap] ldap_get_conn: Checking Id: 0
    [ldap] ldap_get_conn: Got Id: 0
    [ldap] attempting LDAP reconnection
    [ldap] (re)connect to ldap.local.currensee.com:389, authentication 0
    [ldap] setting TLS CACert File to /etc/ldap/csca.crt
    [ldap] bind as cn=manager,dc=currensee,dc=com/VcnxJbFqeAuAFyiu3zvi to
ldap.local.currensee.com:389
    [ldap] waiting for bind result ...
request done: ld 0xb5ee050 msgid 1
    [ldap] Bind was successful
    [ldap] performing search in ou=people,dc=currensee,dc=com, with
filter (uid=anonymous)
request done: ld 0xb5ee050 msgid 2
    [ldap] object not found
[ldap] search failed
    [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns notfound
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.
Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 105 to 192.168.10.31 port 1645
          EAP-Message = 0x010300061920
          Message-Authenticator = 0x00000000000000000000000000000000
          State = 0xd78eeafcd78df33bec47a0da331d3912
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=106, length=229
          User-Name = "anonymous"
          Framed-MTU = 1400
          Called-Station-Id = "64a0.e729.b890"
          Calling-Station-Id = "1c65.9d32.fb68"
          Service-Type = Login-User
          Message-Authenticator = 0xab1d629124040d4a484088109c2dabd1
          EAP-Message =
0x0203005c190016030100510100004d03014eb2df500e212426b1eb54e97dcf30eb655cfb3f10a02b7cda369f1be5bc676a00002600390038003500160013000a00330032002f00050004001500120009001400110008000600030100
          NAS-Port-Type = Wireless-802.11
          NAS-Port = 2387
          NAS-Port-Id = "2387"
          State = 0xd78eeafcd78df33bec47a0da331d3912
          NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 3 length 92
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap]     (other): before/accept initialization
[peap]     TLS_accept: before/accept initialization
[peap]<<<  TLS 1.0 Handshake [length 0051], ClientHello
[peap]     TLS_accept: SSLv3 read client hello A
[peap]>>>  TLS 1.0 Handshake [length 002a], ServerHello
[peap]     TLS_accept: SSLv3 write server hello A
[peap]>>>  TLS 1.0 Handshake [length 06cd], Certificate
[peap]     TLS_accept: SSLv3 write certificate A
[peap]>>>  TLS 1.0 Handshake [length 018d], ServerKeyExchange
[peap]     TLS_accept: SSLv3 write key exchange A
[peap]>>>  TLS 1.0 Handshake [length 0004], ServerHelloDone
[peap]     TLS_accept: SSLv3 write server done A
[peap]     TLS_accept: SSLv3 flush data
[peap]     TLS_accept: Need to read more data: SSLv3 read client
certificate A
In SSL Handshake Phase
In SSL Accept mode
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 106 to 192.168.10.31 port 1645
          EAP-Message =
0x0104040019c00000089c160301002a0200002603014eb2df2dbf13dc964c4b531d3eb1305f35f8be28746de76d5e5c8741d18bbd180000390016030106cd0b0006c90006c60002a6308202a23082020b0203100028300d06092a864886f70d01010405003081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f
          EAP-Message =
0x63616c2043757272656e73656520436572746966696361746520417574686f72697479301e170d3131313032313135313134335a170d3231313032303135313134335a3077310b3009060355040613025553311630140603550408130d4d61737361636875736574747331183016060355040a130f43757272656e7365652c20496e632e31133011060355040b130a4f7065726174696f6e733121301f060355040313186f7073322e6c6f63616c2e63757272656e7365652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100dbd67230f6e9b1f8d37cd689371e4965f6760ef34369b95ea48e1ef153be887b5dd5ef31
          EAP-Message =
0x7a47e5d66048731d7458d9ae1ebe0508aa349d4fa74dd0c077cdca1fb2af2868d309e938cd6222f3c6737116ff656e10bbb175b76e2aa83c35efc2b0655f3bf669cabbad375d98d89c84f9d30b5887ac5225685c5bee55176ce2fe890203010001300d06092a864886f70d01010405000381810023558f75bca5500a1b7ca225f46cd98622ef05c01cc43e000dcae1cd19b8d8fcf7c53d2dff7c6403781839d0dd4a0bffb4eec337967c32665ee5f11720e09760c222e2fc6a029b0d4eb33c45614d21a6fb55cb6f01df47958d97578160057f0d23aa685539931ad0229522218b7d7c31f9fb1b8e94a9b88d6e8bc4f410a9701400041a308204163082
          EAP-Message =
0x037fa003020102020900d869d83ec24831ce300d06092a864886f70d01010405003081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f72697479301e170d3130303432363138323634325a170d3230303432353138323634325a
          EAP-Message = 0x3081b931183016060355040a
          Message-Authenticator = 0x00000000000000000000000000000000
          State = 0xd78eeafcd68af33bec47a0da331d3912
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=107, length=143
          User-Name = "anonymous"
          Framed-MTU = 1400
          Called-Station-Id = "64a0.e729.b890"
          Calling-Station-Id = "1c65.9d32.fb68"
          Service-Type = Login-User
          Message-Authenticator = 0x331b8832fcf1fc4ecce2b5d8b11d74e0
          EAP-Message = 0x020400061900
          NAS-Port-Type = Wireless-802.11
          NAS-Port = 2387
          NAS-Port-Id = "2387"
          State = 0xd78eeafcd68af33bec47a0da331d3912
          NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 4 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 107 to 192.168.10.31 port 1645
          EAP-Message =
0x010503fc1940130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d0109011612726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100d6e8fe8f9e3905fcd63f0c9f3b9eded323e8b7a1e47ef23d8d53a29572e41656e189ccd616664ad52ea7
          EAP-Message =
0x36ee86a2e1fe0696e1fe24e0345cd5b3167530ef0d6b7a58f9f55774d7a403b9a03e5d9374118a1dbb30fcab8c8bc499ef62b3aac1aec00134b635416c73e2f555b24e08933cefe2fb2a47024ee61ab51490f1cae3070203010001a38201223082011e300c0603551d13040530030101ff301d0603551d0e04160414706ed0933d93523470a6e9bc979d124333df14b03081ee0603551d230481e63081e38014706ed0933d93523470a6e9bc979d124333df14b0a181bfa481bc3081b931183016060355040a130f43757272656e7365652c20496e632e31143012060355040b130b456e67696e656572696e673121301f06092a864886f70d01090116
          EAP-Message =
0x12726f6f744063757272656e7365652e636f6d310f300d06035504071306426f73746f6e311630140603550408130d4d617373616368757365747473310b3009060355040613025553312e302c060355040313254c6f63616c2043757272656e73656520436572746966696361746520417574686f72697479820900d869d83ec24831ce300d06092a864886f70d010104050003818100d435d275a02b5e04e17e75b6046bbd1ab3ca33299cee907f2bd9c7603b3da4a23ee97e677e97e442bd855e8c2dffc351e134e03fbec16ad71eb7608c62c29bd2a2aaa2660013bc8d76520a5a9f3b516dcbddf6a773564e57c29e20d0a614a6116a36aef3cdfb
          EAP-Message =
0xdc510f1058d291e6310d9b53c8b17e521038a866f3510355ef29160301018d0c0001890080ff76d1db8e9c6aa6bbe3d1bcc691f539a047acfa556255866a6d802ab6698cb71cf82f2fb16dfe236b5855ea6c50768f5725618bf523493f97785eda71b4aab842513a83fdb1b2466f94df90ec6c771bc6c8004fe3695f678f44ed4618b609c0e8eaf250ea9aef1bfc6213d2e48bd75258d4b20fcb2ea89eb6f562a93619ebeb0001020080214043a4ba5893fc759b15a385d241d1adb217e7f74e7109031b3640e522e9ed150cc6dfccf1bd4cb9f01442d33a8c09b936e53faf477aa1eff2a2ba70c808f1309c8c20fe2cf7231b8935ee494cf8868c7517
          EAP-Message = 0xd6067c739d8d28db
          Message-Authenticator = 0x00000000000000000000000000000000
          State = 0xd78eeafcd58bf33bec47a0da331d3912
Finished request 2.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=108, length=143
          User-Name = "anonymous"
          Framed-MTU = 1400
          Called-Station-Id = "64a0.e729.b890"
          Calling-Station-Id = "1c65.9d32.fb68"
          Service-Type = Login-User
          Message-Authenticator = 0xd26c70de6bf8873741146ca58d32fc5d
          EAP-Message = 0x020500061900
          NAS-Port-Type = Wireless-802.11
          NAS-Port = 2387
          NAS-Port-Id = "2387"
          State = 0xd78eeafcd58bf33bec47a0da331d3912
          NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 5 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 108 to 192.168.10.31 port 1645
          EAP-Message =
0x010600b61900c262d314f99faee60a3b1d641dc0639f14fc17da74acf016f52a585323c4f4597448ce37340080ac4cd31a3bdd6227eac7f5bff7134ca8897172a0533f3b6bbfbdca381a3c62ffc1fca799d5ed7fa8aab8d19ce8eb66f024b2e247dde53df5182ee42cb17aef581790d53feaacf1f35a0522c107ac8e32939b0899a5da755215e8758574e17aad17037d3bb79ef57b5ca937233bf3feee03d589b996aa635f676da7b9733458f116030100040e000000
          Message-Authenticator = 0x00000000000000000000000000000000
          State = 0xd78eeafcd488f33bec47a0da331d3912
Finished request 3.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=109, length=341
          User-Name = "anonymous"
          Framed-MTU = 1400
          Called-Station-Id = "64a0.e729.b890"
          Calling-Station-Id = "1c65.9d32.fb68"
          Service-Type = Login-User
          Message-Authenticator = 0x5ea79a07344221e8a7b651c1590465f2
          EAP-Message =
0x020600cc190016030100861000008200806b365dd6b7e8f0506b9beeff8cb047093b38f4ade146677bde95387db9a85179e3981438ecdb81dc8bd66ff17e75044860531e7a035008408cae1c45206bccb3b738ad64f073bd7f4047b618b619b618529ee0e3b4de03c98603332d4361b6806ce927f870ae05231c3137ee8ce31b9c74aeead97a5821a96d3f789c9552c5f9140301000101160301003075082bfc6ec0756f985b798560404ec0a42e93fc29e045e4d07dfb2cab101ee1db9c3dabb7cc87926bb2dce22b494a9f
          NAS-Port-Type = Wireless-802.11
          NAS-Port = 2387
          NAS-Port-Id = "2387"
          State = 0xd78eeafcd488f33bec47a0da331d3912
          NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 6 length 204
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap]<<<  TLS 1.0 Handshake [length 0086], ClientKeyExchange
[peap]     TLS_accept: SSLv3 read client key exchange A
[peap]<<<  TLS 1.0 ChangeCipherSpec [length 0001]
[peap]<<<  TLS 1.0 Handshake [length 0010], Finished
[peap]     TLS_accept: SSLv3 read finished A
[peap]>>>  TLS 1.0 ChangeCipherSpec [length 0001]
[peap]     TLS_accept: SSLv3 write change cipher spec A
[peap]>>>  TLS 1.0 Handshake [length 0010], Finished
[peap]     TLS_accept: SSLv3 write finished A
[peap]     TLS_accept: SSLv3 flush data
[peap]     (other): SSL negotiation finished successfully
SSL Connection Established
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 109 to 192.168.10.31 port 1645
          EAP-Message =
0x01070041190014030100010116030100300a48ff69d71686b3d02fc914361e30c20649d2bae5c5807b805036131c0ba13b94ac2fa8f3e095f265452a799724a29a
          Message-Authenticator = 0x00000000000000000000000000000000
          State = 0xd78eeafcd389f33bec47a0da331d3912
Finished request 4.
Going to the next request
Waking up in 0.2 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=110, length=143
          User-Name = "anonymous"
          Framed-MTU = 1400
          Called-Station-Id = "64a0.e729.b890"
          Calling-Station-Id = "1c65.9d32.fb68"
          Service-Type = Login-User
          Message-Authenticator = 0x4e6a3b2a54d77a7dd6d830e5371ce9d4
          EAP-Message = 0x020700061900
          NAS-Port-Type = Wireless-802.11
          NAS-Port = 2387
          NAS-Port-Id = "2387"
          State = 0xd78eeafcd389f33bec47a0da331d3912
          NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 7 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake is finished
[peap] eaptls_verify returned 3
[peap] eaptls_process returned 3
[peap] EAPTLS_SUCCESS
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state TUNNEL ESTABLISHED
++[eap] returns handled
Sending Access-Challenge of id 110 to 192.168.10.31 port 1645
          EAP-Message =
0x0108002b1900170301002063d9c378f2cc040c57f69b9e176af752dc3b28f1b340bc482356cee997f5c7cc
          Message-Authenticator = 0x00000000000000000000000000000000
          State = 0xd78eeafcd286f33bec47a0da331d3912
Finished request 5.
Going to the next request
Waking up in 0.2 seconds.
Cleaning up request 0 ID 105 with timestamp +16
Cleaning up request 1 ID 106 with timestamp +16
Cleaning up request 2 ID 107 with timestamp +16
Cleaning up request 3 ID 108 with timestamp +16
Waking up in 4.6 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=111, length=217
          User-Name = "anonymous"
          Framed-MTU = 1400
          Called-Station-Id = "64a0.e729.b890"
          Calling-Station-Id = "1c65.9d32.fb68"
          Service-Type = Login-User
          Message-Authenticator = 0xfccbcc2ac4f1db3d69e75f2db50a71b1
          EAP-Message =
0x020800501900170301002083120e205df189c08c8450ccf4ff0ce2c19a1b92251acb1bf4fe573413b384e117030100203af2415265a1b22ab46c54782d2fae8073830d3d8201f0a921cdb946eb1c86c8
          NAS-Port-Type = Wireless-802.11
          NAS-Port = 2387
          NAS-Port-Id = "2387"
          State = 0xd78eeafcd286f33bec47a0da331d3912
          NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 8 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state WAITING FOR INNER IDENTITY
[peap] Identity - marguin2
[peap] Got inner identity 'marguin2'
[peap] Setting default EAP type for tunneled EAP session.
[peap] Got tunneled request
          EAP-Message = 0x0208000d016d61726775696e32
server  {
[peap] Setting User-Name to marguin2
Sending tunneled request
          EAP-Message = 0x0208000d016d61726775696e32
          FreeRADIUS-Proxied-To = 127.0.0.1
          User-Name = "marguin2"
server inner-tunnel {
# Executing section authorize from file
/etc/raddb/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
++[unix] returns updated
[suffix] No '@' in User-Name = "marguin2", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 8 length 13
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
[ldap] performing user authorization for marguin2
[ldap]  expand: %{Stripped-User-Name} ->
[ldap]  ... expanding second conditional
[ldap]  expand: %{User-Name} ->  marguin2
[ldap]  expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) ->
(uid=marguin2)
[ldap]  expand: ou=people,dc=currensee,dc=com ->
ou=people,dc=currensee,dc=com
    [ldap] ldap_get_conn: Checking Id: 0
    [ldap] ldap_get_conn: Got Id: 0
    [ldap] performing search in ou=people,dc=currensee,dc=com, with
filter (uid=marguin2)
request done: ld 0xb5ee050 msgid 3
[ldap] checking if remote access for marguin2 is allowed by uid
[ldap] looking for check items in directory...
    [ldap] userPassword ->  Password-With-Header == "{CRYPT}tGS8HbszeyDmM"
[ldap] looking for reply items in directory...
[ldap] user marguin2 authorized to use remote access
    [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING: Auth-Type already set.  Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
          EAP-Message =
0x010900221a0109001d100b6a17aa07733a1f91509b758d0a88b86d61726775696e32
          Message-Authenticator = 0x00000000000000000000000000000000
          State = 0x602c86f460259c20be85326c7f25bc52
[peap] Got tunneled reply RADIUS code 11
          EAP-Message =
0x010900221a0109001d100b6a17aa07733a1f91509b758d0a88b86d61726775696e32
          Message-Authenticator = 0x00000000000000000000000000000000
          State = 0x602c86f460259c20be85326c7f25bc52
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 111 to 192.168.10.31 port 1645
          EAP-Message =
0x0109004b190017030100408f8962038e1da77347bee429f2d4dc18cfb0e6f1116c844102ce42970981de33c538b4e8e19bd069b5d1fb6bf7513b67f6178f452f3d016b3cccefbc70f45238
          Message-Authenticator = 0x00000000000000000000000000000000
          State = 0xd78eeafcd187f33bec47a0da331d3912
Finished request 6.
Going to the next request
Waking up in 3.7 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=112, length=217
          User-Name = "anonymous"
          Framed-MTU = 1400
          Called-Station-Id = "64a0.e729.b890"
          Calling-Station-Id = "1c65.9d32.fb68"
          Service-Type = Login-User
          Message-Authenticator = 0x48c8b4886963729f80a85293243ad9a9
          EAP-Message =
0x0209005019001703010020d22dda4e67687876b057da3c7c0555dc1d60323c6cc45bc6af2a53cad54722381703010020d6aab5196d83bf44cc35f02b892bbb5918c6dc786ac09570f3bbe96dc9fbe8b1
          NAS-Port-Type = Wireless-802.11
          NAS-Port = 2387
          NAS-Port-Id = "2387"
          State = 0xd78eeafcd187f33bec47a0da331d3912
          NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 9 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type nak
[peap] Got tunneled request
          EAP-Message = 0x020900060306
server  {
[peap] Setting User-Name to marguin2
Sending tunneled request
          EAP-Message = 0x020900060306
          FreeRADIUS-Proxied-To = 127.0.0.1
          User-Name = "marguin2"
          State = 0x602c86f460259c20be85326c7f25bc52
server inner-tunnel {
# Executing section authorize from file
/etc/raddb/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
++[unix] returns updated
[suffix] No '@' in User-Name = "marguin2", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 9 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
[ldap] performing user authorization for marguin2
[ldap]  expand: %{Stripped-User-Name} ->
[ldap]  ... expanding second conditional
[ldap]  expand: %{User-Name} ->  marguin2
[ldap]  expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) ->
(uid=marguin2)
[ldap]  expand: ou=people,dc=currensee,dc=com ->
ou=people,dc=currensee,dc=com
    [ldap] ldap_get_conn: Checking Id: 0
    [ldap] ldap_get_conn: Got Id: 0
    [ldap] performing search in ou=people,dc=currensee,dc=com, with
filter (uid=marguin2)
request done: ld 0xb5ee050 msgid 4
[ldap] checking if remote access for marguin2 is allowed by uid
[ldap] looking for check items in directory...
    [ldap] userPassword ->  Password-With-Header == "{CRYPT}tGS8HbszeyDmM"
[ldap] looking for reply items in directory...
[ldap] user marguin2 authorized to use remote access
    [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING: Auth-Type already set.  Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP NAK
[eap] EAP-NAK asked for EAP-Type/gtc
[eap] processing type gtc
[gtc]   expand: Password:  ->  Password:
++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
          EAP-Message = 0x010a000f0650617373776f72643a20
          Message-Authenticator = 0x00000000000000000000000000000000
          State = 0x602c86f461268020be85326c7f25bc52
[peap] Got tunneled reply RADIUS code 11
          EAP-Message = 0x010a000f0650617373776f72643a20
          Message-Authenticator = 0x00000000000000000000000000000000
          State = 0x602c86f461268020be85326c7f25bc52
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 112 to 192.168.10.31 port 1645
          EAP-Message =
0x010a002b190017030100200420787dcb200576e528687e537fbcff4c0f871ed6b918a6126eb9f63e37d8ac
          Message-Authenticator = 0x00000000000000000000000000000000
          State = 0xd78eeafcd084f33bec47a0da331d3912
Finished request 7.
Going to the next request
Waking up in 2.6 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=113, length=217
          User-Name = "anonymous"
          Framed-MTU = 1400
          Called-Station-Id = "64a0.e729.b890"
          Calling-Station-Id = "1c65.9d32.fb68"
          Service-Type = Login-User
          Message-Authenticator = 0x7e1a36f67f33d35949af6bf12455126d
          EAP-Message =
0x020a005019001703010020c6bef0b5339d234f36fac19dd890ccc11decb7ad21400e3a6f09cbe1463f187117030100204e26d40af582983750b24ee8ba17aff71f3cdeae50d8d1187402a263dbe0efda
          NAS-Port-Type = Wireless-802.11
          NAS-Port = 2387
          NAS-Port-Id = "2387"
          State = 0xd78eeafcd084f33bec47a0da331d3912
          NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 10 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type gtc
[peap] Got tunneled request
          EAP-Message = 0x020a000d06723061646b696c6c
server  {
[peap] Setting User-Name to marguin2
Sending tunneled request
          EAP-Message = 0x020a000d06723061646b696c6c
          FreeRADIUS-Proxied-To = 127.0.0.1
          User-Name = "marguin2"
          State = 0x602c86f461268020be85326c7f25bc52
server inner-tunnel {
# Executing section authorize from file
/etc/raddb/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
++[unix] returns updated
[suffix] No '@' in User-Name = "marguin2", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 10 length 13
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
[ldap] performing user authorization for marguin2
[ldap]  expand: %{Stripped-User-Name} ->
[ldap]  ... expanding second conditional
[ldap]  expand: %{User-Name} ->  marguin2
[ldap]  expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) ->
(uid=marguin2)
[ldap]  expand: ou=people,dc=currensee,dc=com ->
ou=people,dc=currensee,dc=com
    [ldap] ldap_get_conn: Checking Id: 0
    [ldap] ldap_get_conn: Got Id: 0
    [ldap] performing search in ou=people,dc=currensee,dc=com, with
filter (uid=marguin2)
request done: ld 0xb5ee050 msgid 5
[ldap] checking if remote access for marguin2 is allowed by uid
[ldap] looking for check items in directory...
    [ldap] userPassword ->  Password-With-Header == "{CRYPT}tGS8HbszeyDmM"
[ldap] looking for reply items in directory...
[ldap] user marguin2 authorized to use remote access
    [ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING: Auth-Type already set.  Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/gtc
[eap] processing type gtc
[gtc] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
[gtc] +- entering group PAP {...}
[pap] login attempt with password "r0adkill"
[pap] Using CRYPT password "*"
[pap] Passwords don't match
++[pap] returns reject
[eap] Handler failed in EAP/gtc
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
} # server inner-tunnel
[peap] Got tunneled reply code 3
          EAP-Message = 0x040a0004
          Message-Authenticator = 0x00000000000000000000000000000000
[peap] Got tunneled reply RADIUS code 3
          EAP-Message = 0x040a0004
          Message-Authenticator = 0x00000000000000000000000000000000
[peap] Tunneled authentication was rejected.
[peap] FAILURE
++[eap] returns handled
Sending Access-Challenge of id 113 to 192.168.10.31 port 1645
          EAP-Message =
0x010b002b1900170301002096e49cfd808473952eb3fa75834f12426a53b614dfecd8be68ecf308d9c0e582
          Message-Authenticator = 0x00000000000000000000000000000000
          State = 0xd78eeafcdf85f33bec47a0da331d3912
Finished request 8.
Going to the next request
Waking up in 1.1 seconds.
Cleaning up request 4 ID 109 with timestamp +21
Cleaning up request 5 ID 110 with timestamp +21
Waking up in 1.2 seconds.
rad_recv: Access-Request packet from host 192.168.10.31 port 1645,
id=114, length=217
          User-Name = "anonymous"
          Framed-MTU = 1400
          Called-Station-Id = "64a0.e729.b890"
          Calling-Station-Id = "1c65.9d32.fb68"
          Service-Type = Login-User
          Message-Authenticator = 0xc89f6cfb84abeaafca32c0ca19c71cda
          EAP-Message =
0x020b005019001703010020a5c60e28809a4129d771755d38edf4f696225365ed1ac4501fb72bab9eb3c3d017030100204a26a2449d048491deddc5081a17ee3198e1eeed73ca1b4bab8857cd7a5361be
          NAS-Port-Type = Wireless-802.11
          NAS-Port = 2387
          NAS-Port-Id = "2387"
          State = 0xd78eeafcdf85f33bec47a0da331d3912
          NAS-IP-Address = 192.168.10.31
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 11 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state send tlv failure
[peap] Received EAP-TLV response.
[peap]  The users session was previously rejected: returning reject (again.)
[peap]  *** This means you need to read the PREVIOUS messages in the
debug output
[peap]  *** to find out the reason why the user was rejected.
[peap]  *** Look for "reject" or "fail".  Those earlier messages will
tell you.
[peap]  *** what went wrong, and how to fix the problem.
[eap] Handler failed in EAP/peap
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
Using Post-Auth-Type Reject
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject]     expand: %{User-Name} ->  anonymous
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 9 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Cleaning up request 6 ID 111 with timestamp +22
Sending delayed reject for request 9
Sending Access-Reject of id 114 to 192.168.10.31 port 1645
          EAP-Message = 0x040b0004
          Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 1.0 seconds.
Cleaning up request 7 ID 112 with timestamp +23
Waking up in 1.4 seconds.
Cleaning up request 8 ID 113 with timestamp +24
Waking up in 2.4 seconds.
Cleaning up request 9 ID 114 with timestamp +26
Ready to process requests.
On 11/2/2011 5:25 PM, freeradius-users-request@lists.freeradius.org wrote:
...
Re: cisco WAP/FreeRadius/OpenLDAP
-- 
Matthew Arguin
Currensee, Inc.
54 Canal St, 4th Floor
Boston, MA 02114
(617) 986-4758 (Office)
_________________________________________________________________________
This email and any files transmitted with it are confidential and intended solely for the addressee.  If you received this email in error, please do not disclose the contents to anyone; kindly notify the sender by return email and delete this email and any attachments from your system.

© 2011 Currensee Inc. is a member of the National Futures Association (NFA) Member ID 0403251 | Over the counter retail foreign currency (Forex) trading may involve significant risk of loss. It is not suitable for all investors and you should make sure you understand the risks involved before trading and seek independent advice if necessary. Performance, strategies and charts shown are not necessarily predictive of any particular result and past performance is no indication of future results. Investor returns may vary from Trade Leader returns based on slippage, fees, broker spreads, volatility or other market conditions.

Currensee Inc | 54 Canal St 4th Floor | Boston, MA 02114 | +1.617.624.3824

Matthew Arguin

tags

participants (1)