EAP-PEAP-MS-CHAPv2: MS-CHAPv2 attributes discarded after proxying
Hi! I'm trying to setup the following scheme: [win_xp]-----[Wi-Fi AP with WPA]-------[FreeRADIUS]--------[home RADIUS server] FreeRADIUS: 1.1.7 Users being connected to access point must be authenticated against EAP-PEAP-MS-CHAPv2 protocol. Home RADIUS server can do only MS-CHAPv2 authorization and knows nothing about EAP. To pass extracted MS-CHAPv2 request from PEAP tunnel I've turned off proxy_tunneled_request_as_eap: ---------eap.conf------------- peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no } --------users----------------- aaa FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := "xxx" Fall-Through := No --------proxy.conf------------ realm xxx { type = radius authhost = 192.168.2.80:1812 accthost = 192.168.2.80:1813 secret = pretty_secret } ------------------------------ Authorization requests are being proxied from FreeRADIUS to home RADIUS server as plain MS-CHAPv2. Home server authorizes client and passes back MS-MPPE-*-Keys. But FreeRADIUS discards all MS-CHAPv2 attributes from proxy reply just saying "rlm_eap_mschapv2: Authentication succeeded.". Here is the response from home server: rad_recv: Access-Accept packet from host 192.168.2.80:1812, id=0, length=262 Wed Jan 30 15:03:33 2008 : Debug: proxy: de-allocating 5002a8c0:1812 0 Reply-Message = "ACCESS: GRANTED" Reply-Message = "AGREEMENT-ID: 587986" Framed-IP-Address = 192.168.2.56 Framed-IP-Netmask = 255.255.255.255 Framed-Protocol = PPP MS-CHAP2-Success = 0x00533d37354142314531443945333538353133414541334245443244314630344333384533363742384232 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Recv-Key = 0xadfa59550658460011ffff6aee8df748 MS-MPPE-Send-Key = 0x2f62bd6b536d9e6141790bf5c477a5b8 Service-Type = Framed-User Reply-Message = "STATUS: 0.00000000" and the response to Wi-Fi AP before tunnel: PEAP: Final reply from tunneled session code 11 Reply-Message = "ACCESS: GRANTED" Reply-Message = "AGREEMENT-ID: 587986" Framed-IP-Address = 192.168.2.56 Framed-IP-Netmask = 255.255.255.255 Framed-Protocol = PPP Service-Type = Framed-User Reply-Message = "STATUS: 0.00000000" EAP-Message = 0x010700331a0306002e533d37354142314531443945333538353133414541334245443244314630344333384533363742384232 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbb336a79c074253ad516aa753953f8aa There is no MS-CHAP2-Success attribute here. So no "rlm_eap_peap: Success" at the end of challenge and no Access-Accept packet being sent to Wi-Fi AP. When username is configured locally (i.e. with no proxying request to home server), everything works fine. Does anyone have such working scheme here? Please find complete log attached. -- Best wishes, Dmitry Sergienko (SDA104-RIPE) Trifle Co., Ltd. Wed Jan 30 16:21:17 2008 : Info: Starting - reading configuration files ... Wed Jan 30 16:21:17 2008 : Debug: reread_config: reading radiusd.conf Wed Jan 30 16:21:17 2008 : Debug: Config: including file: /etc/freeradius/proxy.conf Wed Jan 30 16:21:17 2008 : Debug: Config: including file: /etc/freeradius/clients.conf Wed Jan 30 16:21:17 2008 : Debug: Config: including file: /etc/freeradius/snmp.conf Wed Jan 30 16:21:17 2008 : Debug: Config: including file: /etc/freeradius/eap.conf Wed Jan 30 16:21:17 2008 : Debug: Config: including file: /etc/freeradius/sql.conf Wed Jan 30 16:21:17 2008 : Debug: main: prefix = "/usr" Wed Jan 30 16:21:17 2008 : Debug: main: localstatedir = "/var" Wed Jan 30 16:21:17 2008 : Debug: main: logdir = "/var/log/freeradius" Wed Jan 30 16:21:17 2008 : Debug: main: libdir = "/usr/lib/freeradius" Wed Jan 30 16:21:17 2008 : Debug: main: radacctdir = "/var/log/freeradius/radacct" Wed Jan 30 16:21:17 2008 : Debug: main: hostname_lookups = no Wed Jan 30 16:21:17 2008 : Debug: main: snmp = no Wed Jan 30 16:21:17 2008 : Debug: main: max_request_time = 30 Wed Jan 30 16:21:17 2008 : Debug: main: cleanup_delay = 5 Wed Jan 30 16:21:17 2008 : Debug: main: max_requests = 1024 Wed Jan 30 16:21:17 2008 : Debug: main: delete_blocked_requests = 0 Wed Jan 30 16:21:17 2008 : Debug: main: port = 0 Wed Jan 30 16:21:17 2008 : Debug: main: allow_core_dumps = no Wed Jan 30 16:21:17 2008 : Debug: main: log_stripped_names = no Wed Jan 30 16:21:17 2008 : Debug: main: log_file = "/var/log/freeradius/radius.log" Wed Jan 30 16:21:17 2008 : Debug: main: log_auth = no Wed Jan 30 16:21:17 2008 : Debug: main: log_auth_badpass = no Wed Jan 30 16:21:17 2008 : Debug: main: log_auth_goodpass = no Wed Jan 30 16:21:17 2008 : Debug: main: pidfile = "/var/run/freeradius/freeradius.pid" Wed Jan 30 16:21:17 2008 : Debug: main: user = "freerad" Wed Jan 30 16:21:17 2008 : Debug: main: group = "freerad" Wed Jan 30 16:21:17 2008 : Debug: main: usercollide = no Wed Jan 30 16:21:17 2008 : Debug: main: lower_user = "no" Wed Jan 30 16:21:17 2008 : Debug: main: lower_pass = "no" Wed Jan 30 16:21:17 2008 : Debug: main: nospace_user = "no" Wed Jan 30 16:21:17 2008 : Debug: main: nospace_pass = "no" Wed Jan 30 16:21:17 2008 : Debug: main: checkrad = "/usr/sbin/checkrad" Wed Jan 30 16:21:17 2008 : Debug: main: proxy_requests = yes Wed Jan 30 16:21:17 2008 : Debug: proxy: retry_delay = 5 Wed Jan 30 16:21:17 2008 : Debug: proxy: retry_count = 3 Wed Jan 30 16:21:17 2008 : Debug: proxy: synchronous = no Wed Jan 30 16:21:17 2008 : Debug: proxy: default_fallback = yes Wed Jan 30 16:21:17 2008 : Debug: proxy: dead_time = 120 Wed Jan 30 16:21:17 2008 : Debug: proxy: post_proxy_authorize = no Wed Jan 30 16:21:17 2008 : Debug: proxy: wake_all_if_all_dead = no Wed Jan 30 16:21:17 2008 : Debug: security: max_attributes = 200 Wed Jan 30 16:21:17 2008 : Debug: security: reject_delay = 1 Wed Jan 30 16:21:17 2008 : Debug: security: status_server = no Wed Jan 30 16:21:17 2008 : Debug: main: debug_level = 0 Wed Jan 30 16:21:17 2008 : Debug: read_config_files: reading dictionary Wed Jan 30 16:21:17 2008 : Debug: read_config_files: reading naslist Wed Jan 30 16:21:17 2008 : Debug: read_config_files: reading clients Wed Jan 30 16:21:17 2008 : Debug: read_config_files: reading realms Wed Jan 30 16:21:17 2008 : Debug: radiusd: entering modules setup Wed Jan 30 16:21:17 2008 : Debug: Module: Library search path is /usr/lib/freeradius Wed Jan 30 16:21:17 2008 : Debug: Module: Loaded exec Wed Jan 30 16:21:17 2008 : Debug: exec: wait = yes Wed Jan 30 16:21:17 2008 : Debug: exec: program = "(null)" Wed Jan 30 16:21:17 2008 : Debug: exec: input_pairs = "request" Wed Jan 30 16:21:17 2008 : Debug: exec: output_pairs = "(null)" Wed Jan 30 16:21:17 2008 : Debug: exec: packet_type = "(null)" Wed Jan 30 16:21:17 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated exec (exec) Wed Jan 30 16:21:17 2008 : Debug: Module: Loaded expr Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated expr (expr) Wed Jan 30 16:21:17 2008 : Debug: Module: Loaded PAP Wed Jan 30 16:21:17 2008 : Debug: pap: encryption_scheme = "crypt" Wed Jan 30 16:21:17 2008 : Debug: pap: auto_header = yes Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated pap (pap) Wed Jan 30 16:21:17 2008 : Debug: Module: Loaded CHAP Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated chap (chap) Wed Jan 30 16:21:17 2008 : Debug: Module: Loaded MS-CHAP Wed Jan 30 16:21:17 2008 : Debug: mschap: use_mppe = yes Wed Jan 30 16:21:17 2008 : Debug: mschap: require_encryption = no Wed Jan 30 16:21:17 2008 : Debug: mschap: require_strong = no Wed Jan 30 16:21:17 2008 : Debug: mschap: with_ntdomain_hack = no Wed Jan 30 16:21:17 2008 : Debug: mschap: passwd = "(null)" Wed Jan 30 16:21:17 2008 : Debug: mschap: ntlm_auth = "(null)" Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated mschap (mschap) Wed Jan 30 16:21:17 2008 : Debug: Module: Loaded System Wed Jan 30 16:21:17 2008 : Debug: unix: cache = no Wed Jan 30 16:21:17 2008 : Debug: unix: passwd = "(null)" Wed Jan 30 16:21:17 2008 : Debug: unix: shadow = "/etc/shadow" Wed Jan 30 16:21:17 2008 : Debug: unix: group = "(null)" Wed Jan 30 16:21:17 2008 : Debug: unix: radwtmp = "/var/log/freeradius/radwtmp" Wed Jan 30 16:21:17 2008 : Debug: unix: usegroup = no Wed Jan 30 16:21:17 2008 : Debug: unix: cache_reload = 600 Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated unix (unix) Wed Jan 30 16:21:17 2008 : Debug: Module: Loaded eap Wed Jan 30 16:21:17 2008 : Debug: eap: default_eap_type = "peap" Wed Jan 30 16:21:17 2008 : Debug: eap: timer_expire = 60 Wed Jan 30 16:21:17 2008 : Debug: eap: ignore_unknown_eap_types = no Wed Jan 30 16:21:17 2008 : Debug: eap: cisco_accounting_username_bug = no Wed Jan 30 16:21:17 2008 : Debug: rlm_eap: Loaded and initialized type md5 Wed Jan 30 16:21:17 2008 : Debug: rlm_eap: Loaded and initialized type leap Wed Jan 30 16:21:17 2008 : Debug: gtc: challenge = "Password: " Wed Jan 30 16:21:17 2008 : Debug: gtc: auth_type = "PAP" Wed Jan 30 16:21:17 2008 : Debug: rlm_eap: Loaded and initialized type gtc Wed Jan 30 16:21:17 2008 : Debug: tls: rsa_key_exchange = no Wed Jan 30 16:21:17 2008 : Debug: tls: dh_key_exchange = yes Wed Jan 30 16:21:17 2008 : Debug: tls: rsa_key_length = 512 Wed Jan 30 16:21:17 2008 : Debug: tls: dh_key_length = 512 Wed Jan 30 16:21:17 2008 : Debug: tls: verify_depth = 0 Wed Jan 30 16:21:17 2008 : Debug: tls: CA_path = "(null)" Wed Jan 30 16:21:17 2008 : Debug: tls: pem_file_type = yes Wed Jan 30 16:21:17 2008 : Debug: tls: private_key_file = "/etc/freeradius/certs/cert-srv.pem" Wed Jan 30 16:21:17 2008 : Debug: tls: certificate_file = "/etc/freeradius/certs/cert-srv.pem" Wed Jan 30 16:21:17 2008 : Debug: tls: CA_file = "/etc/freeradius/certs/demoCA/cacert.pem" Wed Jan 30 16:21:17 2008 : Debug: tls: private_key_password = "whatever" Wed Jan 30 16:21:17 2008 : Debug: tls: dh_file = "/etc/freeradius/certs/dh" Wed Jan 30 16:21:17 2008 : Debug: tls: random_file = "/etc/freeradius/certs/random" Wed Jan 30 16:21:17 2008 : Debug: tls: fragment_size = 1024 Wed Jan 30 16:21:17 2008 : Debug: tls: include_length = yes Wed Jan 30 16:21:17 2008 : Debug: tls: check_crl = no Wed Jan 30 16:21:17 2008 : Debug: tls: check_cert_cn = "(null)" Wed Jan 30 16:21:17 2008 : Debug: tls: cipher_list = "(null)" Wed Jan 30 16:21:17 2008 : Debug: tls: check_cert_issuer = "(null)" Wed Jan 30 16:21:17 2008 : Info: rlm_eap_tls: Loading the certificate file as a chain Wed Jan 30 16:21:17 2008 : Info: WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work! Wed Jan 30 16:21:17 2008 : Debug: WARNING: Fix this by running the OpenSSL command listed in eap.conf Wed Jan 30 16:21:17 2008 : Debug: rlm_eap: Loaded and initialized type tls Wed Jan 30 16:21:17 2008 : Debug: peap: default_eap_type = "mschapv2" Wed Jan 30 16:21:17 2008 : Debug: peap: copy_request_to_tunnel = no Wed Jan 30 16:21:17 2008 : Debug: peap: use_tunneled_reply = no Wed Jan 30 16:21:17 2008 : Debug: peap: proxy_tunneled_request_as_eap = no Wed Jan 30 16:21:17 2008 : Debug: rlm_eap: Loaded and initialized type peap Wed Jan 30 16:21:17 2008 : Debug: mschapv2: with_ntdomain_hack = no Wed Jan 30 16:21:17 2008 : Debug: rlm_eap: Loaded and initialized type mschapv2 Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated eap (eap) Wed Jan 30 16:21:17 2008 : Debug: Module: Loaded preprocess Wed Jan 30 16:21:17 2008 : Debug: preprocess: huntgroups = "/etc/freeradius/huntgroups" Wed Jan 30 16:21:17 2008 : Debug: preprocess: hints = "/etc/freeradius/hints" Wed Jan 30 16:21:17 2008 : Debug: preprocess: with_ascend_hack = no Wed Jan 30 16:21:17 2008 : Debug: preprocess: ascend_channels_per_line = 23 Wed Jan 30 16:21:17 2008 : Debug: preprocess: with_ntdomain_hack = no Wed Jan 30 16:21:17 2008 : Debug: preprocess: with_specialix_jetstream_hack = no Wed Jan 30 16:21:17 2008 : Debug: preprocess: with_cisco_vsa_hack = no Wed Jan 30 16:21:17 2008 : Debug: preprocess: with_alvarion_vsa_hack = no Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated preprocess (preprocess) Wed Jan 30 16:21:17 2008 : Debug: Module: Loaded detail Wed Jan 30 16:21:17 2008 : Debug: detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" Wed Jan 30 16:21:17 2008 : Debug: detail: detailperm = 384 Wed Jan 30 16:21:17 2008 : Debug: detail: dirperm = 493 Wed Jan 30 16:21:17 2008 : Debug: detail: locking = no Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated detail (auth_log) Wed Jan 30 16:21:17 2008 : Debug: Module: Loaded attr_filter Wed Jan 30 16:21:17 2008 : Debug: attr_filter: attrsfile = "/etc/freeradius/attrs" Wed Jan 30 16:21:17 2008 : Error: rlm_attr_filter: Authorize method will be deprecated. Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated attr_filter (attr_filter) Wed Jan 30 16:21:17 2008 : Debug: Module: Loaded realm Wed Jan 30 16:21:17 2008 : Debug: realm: format = "suffix" Wed Jan 30 16:21:17 2008 : Debug: realm: delimiter = "@" Wed Jan 30 16:21:17 2008 : Debug: realm: ignore_default = no Wed Jan 30 16:21:17 2008 : Debug: realm: ignore_null = no Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated realm (suffix) Wed Jan 30 16:21:17 2008 : Debug: Module: Loaded files Wed Jan 30 16:21:17 2008 : Debug: files: usersfile = "/etc/freeradius/users" Wed Jan 30 16:21:17 2008 : Debug: files: acctusersfile = "/etc/freeradius/acct_users" Wed Jan 30 16:21:17 2008 : Debug: files: preproxy_usersfile = "/etc/freeradius/preproxy_users" Wed Jan 30 16:21:17 2008 : Debug: files: compat = "no" Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated files (files) Wed Jan 30 16:21:17 2008 : Debug: Module: Loaded Acct-Unique-Session-Id Wed Jan 30 16:21:17 2008 : Debug: acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated acct_unique (acct_unique) Wed Jan 30 16:21:17 2008 : Debug: detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Wed Jan 30 16:21:17 2008 : Debug: detail: detailperm = 384 Wed Jan 30 16:21:17 2008 : Debug: detail: dirperm = 493 Wed Jan 30 16:21:17 2008 : Debug: detail: locking = no Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated detail (detail) Wed Jan 30 16:21:17 2008 : Debug: Module: Loaded radutmp Wed Jan 30 16:21:17 2008 : Debug: radutmp: filename = "/var/log/freeradius/radutmp" Wed Jan 30 16:21:17 2008 : Debug: radutmp: username = "%{User-Name}" Wed Jan 30 16:21:17 2008 : Debug: radutmp: case_sensitive = yes Wed Jan 30 16:21:17 2008 : Debug: radutmp: check_with_nas = yes Wed Jan 30 16:21:17 2008 : Debug: radutmp: perm = 384 Wed Jan 30 16:21:17 2008 : Debug: radutmp: callerid = yes Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated radutmp (radutmp) Wed Jan 30 16:21:17 2008 : Debug: detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d" Wed Jan 30 16:21:17 2008 : Debug: detail: detailperm = 384 Wed Jan 30 16:21:17 2008 : Debug: detail: dirperm = 493 Wed Jan 30 16:21:17 2008 : Debug: detail: locking = no Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated detail (pre_proxy_log) Wed Jan 30 16:21:17 2008 : Debug: detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d" Wed Jan 30 16:21:17 2008 : Debug: detail: detailperm = 384 Wed Jan 30 16:21:17 2008 : Debug: detail: dirperm = 493 Wed Jan 30 16:21:17 2008 : Debug: detail: locking = no Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated detail (post_proxy_log) Wed Jan 30 16:21:17 2008 : Debug: detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" Wed Jan 30 16:21:17 2008 : Debug: detail: detailperm = 384 Wed Jan 30 16:21:17 2008 : Debug: detail: dirperm = 493 Wed Jan 30 16:21:17 2008 : Debug: detail: locking = no Wed Jan 30 16:21:17 2008 : Debug: Module: Instantiated detail (reply_log) Wed Jan 30 16:21:17 2008 : Debug: Listening on authentication *:1812 Wed Jan 30 16:21:17 2008 : Debug: Listening on accounting *:1813 Wed Jan 30 16:21:17 2008 : Debug: Listening on proxy *:1814 Wed Jan 30 16:21:17 2008 : Info: Ready to process requests. rad_recv: Access-Request packet from host 192.168.2.28:1032, id=0, length=184 Message-Authenticator = 0x95738e03d1fb1c0ceba98dbdf1ab912f Service-Type = Framed-User User-Name = "aaa" Framed-MTU = 1488 Called-Station-Id = "00-15-E9-AE-B2-BF:WLAN" Calling-Station-Id = "00-17-9A-82-C7-7B" NAS-Identifier = "WLAN Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000801616161 NAS-IP-Address = 192.168.2.28 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Wed Jan 30 16:21:23 2008 : Debug: Processing the authorize section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authorize for request 0 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "preprocess" returns ok for request 0 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 0 Wed Jan 30 16:21:23 2008 : Debug: radius_xlat: '/var/log/freeradius/radacct/192.168.2.28/auth-detail-20080130' Wed Jan 30 16:21:23 2008 : Debug: rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.2.28/auth-detail-20080130 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 0 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "auth_log" returns ok for request 0 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling attr_filter (rlm_attr_filter) for request 0 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from attr_filter (rlm_attr_filter) for request 0 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "attr_filter" returns noop for request 0 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 0 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 0 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "chap" returns noop for request 0 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "mschap" returns noop for request 0 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 0 Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No '@' in User-Name = "aaa", looking up realm NULL Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No such realm "NULL" Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "suffix" returns noop for request 0 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP packet type response id 0 length 8 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "eap" returns updated for request 0 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "files" returns notfound for request 0 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 0 Wed Jan 30 16:21:23 2008 : Debug: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 0 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "pap" returns noop for request 0 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authorize (returns updated) for request 0 Wed Jan 30 16:21:23 2008 : Debug: rad_check_password: Found Auth-Type EAP Wed Jan 30 16:21:23 2008 : Debug: auth: type "EAP" Wed Jan 30 16:21:23 2008 : Debug: Processing the authenticate section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authenticate for request 0 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 0 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP Identity Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: processing type tls Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: Initiate Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: Start returned 1 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 0 Wed Jan 30 16:21:23 2008 : Debug: modcall[authenticate]: module "eap" returns handled for request 0 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.2.28 port 1032 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5db289aaf7d6fa0ebe901707a31e963c Wed Jan 30 16:21:23 2008 : Debug: Finished request 0 Wed Jan 30 16:21:23 2008 : Debug: Going to the next request Wed Jan 30 16:21:23 2008 : Debug: --- Walking the entire request list --- Wed Jan 30 16:21:23 2008 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.28:1032, id=1, length=306 Message-Authenticator = 0x47b000110073bbb08377c494b4bd16ef Service-Type = Framed-User User-Name = "aaa" Framed-MTU = 1488 State = 0x5db289aaf7d6fa0ebe901707a31e963c Called-Station-Id = "00-15-E9-AE-B2-BF:WLAN" Calling-Station-Id = "00-17-9A-82-C7-7B" NAS-Identifier = "WLAN Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201007019800000006616030100610100005d030147a087e3be36eef7e3c8558ad9836ef8545a57ad4ecd31cb1dee537f0217d0a0203285b3ca15b5bc19c4dc749138750ef06e349d1b28dc3864c757ae2d531b31bb001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 192.168.2.28 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Wed Jan 30 16:21:23 2008 : Debug: Processing the authorize section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authorize for request 1 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "preprocess" returns ok for request 1 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 1 Wed Jan 30 16:21:23 2008 : Debug: radius_xlat: '/var/log/freeradius/radacct/192.168.2.28/auth-detail-20080130' Wed Jan 30 16:21:23 2008 : Debug: rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.2.28/auth-detail-20080130 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 1 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "auth_log" returns ok for request 1 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling attr_filter (rlm_attr_filter) for request 1 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from attr_filter (rlm_attr_filter) for request 1 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "attr_filter" returns noop for request 1 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 1 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 1 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "chap" returns noop for request 1 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 1 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 1 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "mschap" returns noop for request 1 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 1 Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No '@' in User-Name = "aaa", looking up realm NULL Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No such realm "NULL" Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 1 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "suffix" returns noop for request 1 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 1 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP packet type response id 1 length 112 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 1 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "eap" returns updated for request 1 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 1 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 1 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "files" returns notfound for request 1 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 1 Wed Jan 30 16:21:23 2008 : Debug: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 1 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "pap" returns noop for request 1 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authorize (returns updated) for request 1 Wed Jan 30 16:21:23 2008 : Debug: rad_check_password: Found Auth-Type EAP Wed Jan 30 16:21:23 2008 : Debug: auth: type "EAP" Wed Jan 30 16:21:23 2008 : Debug: Processing the authenticate section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authenticate for request 1 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 1 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: Request found, released from the list Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP/peap Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: processing type peap Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: Authenticate Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: processing TLS Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: Length Included Wed Jan 30 16:21:23 2008 : Debug: eaptls_verify returned 11 Wed Jan 30 16:21:23 2008 : Debug: (other): before/accept initialization Wed Jan 30 16:21:23 2008 : Debug: TLS_accept: before/accept initialization Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello Wed Jan 30 16:21:23 2008 : Debug: TLS_accept: SSLv3 read client hello A Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello Wed Jan 30 16:21:23 2008 : Debug: TLS_accept: SSLv3 write server hello A Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate Wed Jan 30 16:21:23 2008 : Debug: TLS_accept: SSLv3 write certificate A Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Wed Jan 30 16:21:23 2008 : Debug: TLS_accept: SSLv3 write server done A Wed Jan 30 16:21:23 2008 : Debug: TLS_accept: SSLv3 flush data Wed Jan 30 16:21:23 2008 : Debug: TLS_accept: Need to read more data: SSLv3 read client certificate A Wed Jan 30 16:21:23 2008 : Debug: In SSL Handshake Phase Wed Jan 30 16:21:23 2008 : Debug: In SSL Accept mode Wed Jan 30 16:21:23 2008 : Debug: eaptls_process returned 13 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: EAPTLS_HANDLED Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 1 Wed Jan 30 16:21:23 2008 : Debug: modcall[authenticate]: module "eap" returns handled for request 1 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 1 to 192.168.2.28 port 1032 EAP-Message = 0x0102040a19c0000006f1160301004a02000046030147a087e30fe5927afc6e913fc013cdd64421ade59e5e48e0081dec52246dfb5620406d860bab150a348618c2468f0782195f2b7bad6e69a157ff5bbefb9bf70b6e00040016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5708202a97e43ae72b2b2c71ba80ada9 Wed Jan 30 16:21:23 2008 : Debug: Finished request 1 Wed Jan 30 16:21:23 2008 : Debug: Going to the next request Wed Jan 30 16:21:23 2008 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.28:1032, id=2, length=200 Message-Authenticator = 0xc8c00d8115a81d1ef2d1975cd7b7815b Service-Type = Framed-User User-Name = "aaa" Framed-MTU = 1488 State = 0x5708202a97e43ae72b2b2c71ba80ada9 Called-Station-Id = "00-15-E9-AE-B2-BF:WLAN" Calling-Station-Id = "00-17-9A-82-C7-7B" NAS-Identifier = "WLAN Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020200061900 NAS-IP-Address = 192.168.2.28 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Wed Jan 30 16:21:23 2008 : Debug: Processing the authorize section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authorize for request 2 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 2 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 2 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "preprocess" returns ok for request 2 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 2 Wed Jan 30 16:21:23 2008 : Debug: radius_xlat: '/var/log/freeradius/radacct/192.168.2.28/auth-detail-20080130' Wed Jan 30 16:21:23 2008 : Debug: rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.2.28/auth-detail-20080130 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 2 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "auth_log" returns ok for request 2 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling attr_filter (rlm_attr_filter) for request 2 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from attr_filter (rlm_attr_filter) for request 2 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "attr_filter" returns noop for request 2 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 2 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 2 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "chap" returns noop for request 2 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 2 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 2 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "mschap" returns noop for request 2 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 2 Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No '@' in User-Name = "aaa", looking up realm NULL Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No such realm "NULL" Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 2 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "suffix" returns noop for request 2 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 2 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP packet type response id 2 length 6 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 2 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "eap" returns updated for request 2 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 2 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 2 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "files" returns notfound for request 2 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 2 Wed Jan 30 16:21:23 2008 : Debug: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 2 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "pap" returns noop for request 2 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authorize (returns updated) for request 2 Wed Jan 30 16:21:23 2008 : Debug: rad_check_password: Found Auth-Type EAP Wed Jan 30 16:21:23 2008 : Debug: auth: type "EAP" Wed Jan 30 16:21:23 2008 : Debug: Processing the authenticate section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authenticate for request 2 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 2 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: Request found, released from the list Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP/peap Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: processing type peap Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: Authenticate Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: processing TLS Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: Received EAP-TLS ACK message Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: ack handshake fragment handler Wed Jan 30 16:21:23 2008 : Debug: eaptls_verify returned 1 Wed Jan 30 16:21:23 2008 : Debug: eaptls_process returned 13 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: EAPTLS_HANDLED Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 2 Wed Jan 30 16:21:23 2008 : Debug: modcall[authenticate]: module "eap" returns handled for request 2 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 2 to 192.168.2.28 port 1032 EAP-Message = 0x010302f71900170d3036303132343133323630375a30819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d4c5b19724f164acf1ffb189db1c8fbff4f14396ea7cb1e90f78d69451725377895dfe52ccb99b41e8 EAP-Message = 0x0ddeb58b127a943f4f58cbc562878192fbdc6fece9f871e7c130d35cf5188817e9b133249edd2a1c75d31043ae87553cec7a77ef26aa7d74281db9b77e17c6446c5dd9b188b43250ca0229963722a123a726b00b4027fd0203010001a381ff3081fc301d0603551d0e0416041468d36d3e1ee7bc9d5a057021c363da1365d1ade33081cc0603551d230481c43081c1801468d36d3e1ee7bc9d5a057021c363da1365d1ade3a181a5a481a230819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010 EAP-Message = 0x060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810033c00b66b1e579ef73a06798252dab8d5e5511fc00fd276d80d12f834777c6743fdc2743fca1507704e4bc0979e4f60ac3ad9ee83e6f347369229d1f77229ba2e982359da563024a00163dba6d6c986c0bad28af85132ff8f0d76501bf1b7c2dff658ce1e62c01997b6e64e3e8d4373354ce9912847651539063b85bbc5485c516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe6496d844bf69bdcdb1602289e985d94 Wed Jan 30 16:21:23 2008 : Debug: Finished request 2 Wed Jan 30 16:21:23 2008 : Debug: Going to the next request Wed Jan 30 16:21:23 2008 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.28:1032, id=3, length=386 Message-Authenticator = 0x50eaac0ad7a2fe459a874501a98ac64b Service-Type = Framed-User User-Name = "aaa" Framed-MTU = 1488 State = 0xe6496d844bf69bdcdb1602289e985d94 Called-Station-Id = "00-15-E9-AE-B2-BF:WLAN" Calling-Station-Id = "00-17-9A-82-C7-7B" NAS-Identifier = "WLAN Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300c01980000000b61603010086100000820080bac89a3ea71151d7ad09a69ff4ea8bc2951547167c8ea167fa9c3650285c4b106263fbff6b6b52bbbd6ec2c9eb4b9eb1a19d949ed96f2d81ee59cde3e388b26f6bc5285b71dcf6965e8ced6b59007420c47ac570b12d170c3bf9d3d3a133004a8e7fe37bf4fe4e27ed41982a8eec19682e20fa680c9bd41339e28477bce1d0581403010001011603010020fea0deb5a460a2665fc5b24deae99e753a3ba1a12c198817bb33422ec05227ee NAS-IP-Address = 192.168.2.28 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Wed Jan 30 16:21:23 2008 : Debug: Processing the authorize section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authorize for request 3 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 3 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 3 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "preprocess" returns ok for request 3 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 3 Wed Jan 30 16:21:23 2008 : Debug: radius_xlat: '/var/log/freeradius/radacct/192.168.2.28/auth-detail-20080130' Wed Jan 30 16:21:23 2008 : Debug: rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.2.28/auth-detail-20080130 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 3 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "auth_log" returns ok for request 3 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling attr_filter (rlm_attr_filter) for request 3 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from attr_filter (rlm_attr_filter) for request 3 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "attr_filter" returns noop for request 3 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 3 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 3 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "chap" returns noop for request 3 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 3 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 3 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "mschap" returns noop for request 3 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 3 Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No '@' in User-Name = "aaa", looking up realm NULL Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No such realm "NULL" Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 3 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "suffix" returns noop for request 3 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 3 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP packet type response id 3 length 192 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 3 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "eap" returns updated for request 3 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 3 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 3 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "files" returns notfound for request 3 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 3 Wed Jan 30 16:21:23 2008 : Debug: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 3 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "pap" returns noop for request 3 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authorize (returns updated) for request 3 Wed Jan 30 16:21:23 2008 : Debug: rad_check_password: Found Auth-Type EAP Wed Jan 30 16:21:23 2008 : Debug: auth: type "EAP" Wed Jan 30 16:21:23 2008 : Debug: Processing the authenticate section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authenticate for request 3 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 3 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: Request found, released from the list Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP/peap Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: processing type peap Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: Authenticate Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: processing TLS Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: Length Included Wed Jan 30 16:21:23 2008 : Debug: eaptls_verify returned 11 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange Wed Jan 30 16:21:23 2008 : Debug: TLS_accept: SSLv3 read client key exchange A Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished Wed Jan 30 16:21:23 2008 : Debug: TLS_accept: SSLv3 read finished A Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] Wed Jan 30 16:21:23 2008 : Debug: TLS_accept: SSLv3 write change cipher spec A Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished Wed Jan 30 16:21:23 2008 : Debug: TLS_accept: SSLv3 write finished A Wed Jan 30 16:21:23 2008 : Debug: TLS_accept: SSLv3 flush data Wed Jan 30 16:21:23 2008 : Debug: (other): SSL negotiation finished successfully Wed Jan 30 16:21:23 2008 : Debug: SSL Connection Established Wed Jan 30 16:21:23 2008 : Debug: eaptls_process returned 13 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: EAPTLS_HANDLED Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 3 Wed Jan 30 16:21:23 2008 : Debug: modcall[authenticate]: module "eap" returns handled for request 3 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 3 to 192.168.2.28 port 1032 EAP-Message = 0x0104003119001403010001011603010020a562e906ef0e8bcc20bdf677cf9488ea9f72210f343b6b2764f4751c5ec28418 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3882c9b17babca451a6ccc9e89a82d1e Wed Jan 30 16:21:23 2008 : Debug: Finished request 3 Wed Jan 30 16:21:23 2008 : Debug: Going to the next request Wed Jan 30 16:21:23 2008 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.28:1032, id=4, length=200 Message-Authenticator = 0x3d2571581a9de91e3544ff7994b3bc4c Service-Type = Framed-User User-Name = "aaa" Framed-MTU = 1488 State = 0x3882c9b17babca451a6ccc9e89a82d1e Called-Station-Id = "00-15-E9-AE-B2-BF:WLAN" Calling-Station-Id = "00-17-9A-82-C7-7B" NAS-Identifier = "WLAN Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020400061900 NAS-IP-Address = 192.168.2.28 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Wed Jan 30 16:21:23 2008 : Debug: Processing the authorize section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authorize for request 4 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 4 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 4 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "preprocess" returns ok for request 4 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 4 Wed Jan 30 16:21:23 2008 : Debug: radius_xlat: '/var/log/freeradius/radacct/192.168.2.28/auth-detail-20080130' Wed Jan 30 16:21:23 2008 : Debug: rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.2.28/auth-detail-20080130 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 4 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "auth_log" returns ok for request 4 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling attr_filter (rlm_attr_filter) for request 4 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from attr_filter (rlm_attr_filter) for request 4 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "attr_filter" returns noop for request 4 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 4 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 4 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "chap" returns noop for request 4 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 4 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 4 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "mschap" returns noop for request 4 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 4 Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No '@' in User-Name = "aaa", looking up realm NULL Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No such realm "NULL" Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 4 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "suffix" returns noop for request 4 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 4 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP packet type response id 4 length 6 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 4 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "eap" returns updated for request 4 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 4 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 4 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "files" returns notfound for request 4 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 4 Wed Jan 30 16:21:23 2008 : Debug: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 4 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "pap" returns noop for request 4 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authorize (returns updated) for request 4 Wed Jan 30 16:21:23 2008 : Debug: rad_check_password: Found Auth-Type EAP Wed Jan 30 16:21:23 2008 : Debug: auth: type "EAP" Wed Jan 30 16:21:23 2008 : Debug: Processing the authenticate section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authenticate for request 4 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 4 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: Request found, released from the list Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP/peap Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: processing type peap Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: Authenticate Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: processing TLS Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: Received EAP-TLS ACK message Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: ack handshake is finished Wed Jan 30 16:21:23 2008 : Debug: eaptls_verify returned 3 Wed Jan 30 16:21:23 2008 : Debug: eaptls_process returned 3 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: EAPTLS_SUCCESS Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 4 Wed Jan 30 16:21:23 2008 : Debug: modcall[authenticate]: module "eap" returns handled for request 4 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 4 to 192.168.2.28 port 1032 EAP-Message = 0x0105002019001703010015a003beb410bd42441cf8049fc078150a1f62dc13a5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6472259ba53a52a47938bbb75daab0fc Wed Jan 30 16:21:23 2008 : Debug: Finished request 4 Wed Jan 30 16:21:23 2008 : Debug: Going to the next request Wed Jan 30 16:21:23 2008 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.28:1032, id=5, length=225 Message-Authenticator = 0xfa8d3e5d9994f240fd0ef4158a8c9246 Service-Type = Framed-User User-Name = "aaa" Framed-MTU = 1488 State = 0x6472259ba53a52a47938bbb75daab0fc Called-Station-Id = "00-15-E9-AE-B2-BF:WLAN" Calling-Station-Id = "00-17-9A-82-C7-7B" NAS-Identifier = "WLAN Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0205001f19001703010014f2094e78f3e975f48718cbb7d270c92bdeb7b1a5 NAS-IP-Address = 192.168.2.28 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Wed Jan 30 16:21:23 2008 : Debug: Processing the authorize section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authorize for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "preprocess" returns ok for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 5 Wed Jan 30 16:21:23 2008 : Debug: radius_xlat: '/var/log/freeradius/radacct/192.168.2.28/auth-detail-20080130' Wed Jan 30 16:21:23 2008 : Debug: rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.2.28/auth-detail-20080130 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "auth_log" returns ok for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling attr_filter (rlm_attr_filter) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from attr_filter (rlm_attr_filter) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "attr_filter" returns noop for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "chap" returns noop for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "mschap" returns noop for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 5 Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No '@' in User-Name = "aaa", looking up realm NULL Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No such realm "NULL" Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "suffix" returns noop for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP packet type response id 5 length 31 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "eap" returns updated for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "files" returns notfound for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "pap" returns noop for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authorize (returns updated) for request 5 Wed Jan 30 16:21:23 2008 : Debug: rad_check_password: Found Auth-Type EAP Wed Jan 30 16:21:23 2008 : Debug: auth: type "EAP" Wed Jan 30 16:21:23 2008 : Debug: Processing the authenticate section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authenticate for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: Request found, released from the list Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP/peap Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: processing type peap Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: Authenticate Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: processing TLS Wed Jan 30 16:21:23 2008 : Debug: eaptls_verify returned 7 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: Done initial handshake Wed Jan 30 16:21:23 2008 : Debug: eaptls_process returned 7 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: EAPTLS_OK Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: Session established. Decoding tunneled attributes. PEAP tunnel data in 0000: 01 61 61 61 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: Identity - aaa Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0205000801616161 Wed Jan 30 16:21:23 2008 : Debug: PEAP: Got tunneled identity of aaa Wed Jan 30 16:21:23 2008 : Debug: PEAP: Setting default EAP type for tunneled EAP session. Wed Jan 30 16:21:23 2008 : Debug: PEAP: Setting User-Name to aaa PEAP: Sending tunneled request EAP-Message = 0x0205000801616161 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "aaa" Wed Jan 30 16:21:23 2008 : Debug: Processing the authorize section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authorize for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "preprocess" returns ok for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 5 Wed Jan 30 16:21:23 2008 : Debug: radius_xlat: '/var/log/freeradius/radacct/127.0.0.1/auth-detail-20080130' Wed Jan 30 16:21:23 2008 : Debug: rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20080130 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "auth_log" returns ok for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling attr_filter (rlm_attr_filter) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from attr_filter (rlm_attr_filter) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "attr_filter" returns noop for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "chap" returns noop for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "mschap" returns noop for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 5 Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No '@' in User-Name = "aaa", looking up realm NULL Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No such realm "NULL" Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "suffix" returns noop for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP packet type response id 5 length 8 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "eap" returns updated for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 5 Wed Jan 30 16:21:23 2008 : Debug: users: Matched entry aaa at line 85 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "files" returns ok for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "pap" returns noop for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authorize (returns updated) for request 5 PEAP: Got tunneled reply RADIUS code 0 Wed Jan 30 16:21:23 2008 : Debug: PEAP: Calling authenticate in order to initiate tunneled EAP session. Wed Jan 30 16:21:23 2008 : Debug: Processing the authenticate section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authenticate for request 5 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP Identity Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: processing type mschapv2 Wed Jan 30 16:21:23 2008 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authenticate]: module "eap" returns handled for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authenticate (returns handled) for request 5 Wed Jan 30 16:21:23 2008 : Debug: PEAP: Cancelling proxy to realm xxx until the tunneled EAP session has been established PEAP: Processing from tunneled session code 0x80147040 11 EAP-Message = 0x0106001d1a0106001810d705730f12a9595b41ac811cc23eab54616161 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x767993fd4ad4ebf861acdf27ec0a3a8e Wed Jan 30 16:21:23 2008 : Debug: PEAP: Got tunneled Access-Challenge PEAP tunnel data out 0000: 1a 01 06 00 18 10 d7 05 73 0f 12 a9 59 5b 41 ac PEAP tunnel data out 0010: 81 1c c2 3e ab 54 61 61 61 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall[authenticate]: module "eap" returns handled for request 5 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 5 to 192.168.2.28 port 1032 EAP-Message = 0x01060034190017030100291f8fadaf8be94d9469a30a78fcc2ae5503135fb3588b426d80237b5bb96cd390128aaaeab9af12f9f3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x46e3664e4d1315184ed1a50e6dc819b3 Wed Jan 30 16:21:23 2008 : Debug: Finished request 5 Wed Jan 30 16:21:23 2008 : Debug: Going to the next request Wed Jan 30 16:21:23 2008 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.28:1032, id=6, length=279 Message-Authenticator = 0xf24acb657d7e9f0ea425095ba74e861b Service-Type = Framed-User User-Name = "aaa" Framed-MTU = 1488 State = 0x46e3664e4d1315184ed1a50e6dc819b3 Called-Station-Id = "00-15-E9-AE-B2-BF:WLAN" Calling-Station-Id = "00-17-9A-82-C7-7B" NAS-Identifier = "WLAN Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020600551900170301004aba2524bee95d3df9b8b22f2250e4c4314a0e52353fd9037b6d96d8010f9811be0f665cae244749d9b0f10fa2d28d5660564fe27284e1f3d92a4222360cf90d70f12d193a481852d84bbe NAS-IP-Address = 192.168.2.28 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Wed Jan 30 16:21:23 2008 : Debug: Processing the authorize section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authorize for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "preprocess" returns ok for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 6 Wed Jan 30 16:21:23 2008 : Debug: radius_xlat: '/var/log/freeradius/radacct/192.168.2.28/auth-detail-20080130' Wed Jan 30 16:21:23 2008 : Debug: rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.2.28/auth-detail-20080130 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "auth_log" returns ok for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling attr_filter (rlm_attr_filter) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from attr_filter (rlm_attr_filter) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "attr_filter" returns noop for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "chap" returns noop for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "mschap" returns noop for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 6 Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No '@' in User-Name = "aaa", looking up realm NULL Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No such realm "NULL" Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "suffix" returns noop for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP packet type response id 6 length 85 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "eap" returns updated for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "files" returns notfound for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "pap" returns noop for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authorize (returns updated) for request 6 Wed Jan 30 16:21:23 2008 : Debug: rad_check_password: Found Auth-Type EAP Wed Jan 30 16:21:23 2008 : Debug: auth: type "EAP" Wed Jan 30 16:21:23 2008 : Debug: Processing the authenticate section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authenticate for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: Request found, released from the list Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP/peap Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: processing type peap Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: Authenticate Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: processing TLS Wed Jan 30 16:21:23 2008 : Debug: eaptls_verify returned 7 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: Done initial handshake Wed Jan 30 16:21:23 2008 : Debug: eaptls_process returned 7 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: EAPTLS_OK Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: Session established. Decoding tunneled attributes. PEAP tunnel data in 0000: 1a 02 06 00 39 31 54 3b ff a8 dd c0 94 f4 dd 7d PEAP tunnel data in 0010: 68 d5 83 58 3c ef 00 00 00 00 00 00 00 00 37 cc PEAP tunnel data in 0020: 3c cd 31 b8 76 ad 62 b6 16 4c bb b4 7f 0f 87 d0 PEAP tunnel data in 0030: 4f 4c 21 56 a1 3d 00 61 61 61 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: EAP type mschapv2 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0206003e1a0206003931543bffa8ddc094f4dd7d68d583583cef000000000000000037cc3ccd31b876ad62b6164cbbb47f0f87d04f4c2156a13d00616161 Wed Jan 30 16:21:23 2008 : Debug: PEAP: Setting User-Name to aaa Wed Jan 30 16:21:23 2008 : Debug: PEAP: Adding old state with 76 79 PEAP: Sending tunneled request EAP-Message = 0x0206003e1a0206003931543bffa8ddc094f4dd7d68d583583cef000000000000000037cc3ccd31b876ad62b6164cbbb47f0f87d04f4c2156a13d00616161 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "aaa" State = 0x767993fd4ad4ebf861acdf27ec0a3a8e Wed Jan 30 16:21:23 2008 : Debug: Processing the authorize section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authorize for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "preprocess" returns ok for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 6 Wed Jan 30 16:21:23 2008 : Debug: radius_xlat: '/var/log/freeradius/radacct/127.0.0.1/auth-detail-20080130' Wed Jan 30 16:21:23 2008 : Debug: rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20080130 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "auth_log" returns ok for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling attr_filter (rlm_attr_filter) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from attr_filter (rlm_attr_filter) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "attr_filter" returns noop for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "chap" returns noop for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "mschap" returns noop for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 6 Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No '@' in User-Name = "aaa", looking up realm NULL Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No such realm "NULL" Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "suffix" returns noop for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP packet type response id 6 length 62 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "eap" returns updated for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 6 Wed Jan 30 16:21:23 2008 : Debug: users: Matched entry aaa at line 85 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "files" returns ok for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "pap" returns noop for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authorize (returns updated) for request 6 PEAP: Got tunneled reply RADIUS code 0 Wed Jan 30 16:21:23 2008 : Debug: PEAP: Calling authenticate in order to initiate tunneled EAP session. Wed Jan 30 16:21:23 2008 : Debug: Processing the authenticate section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authenticate for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: Request found, released from the list Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP/mschapv2 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: processing type mschapv2 Wed Jan 30 16:21:23 2008 : Debug: Not-EAP proxy set. Not composing EAP Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authenticate]: module "eap" returns handled for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authenticate (returns handled) for request 6 Wed Jan 30 16:21:23 2008 : Debug: PEAP: Tunneled authentication will be proxied to xxx Wed Jan 30 16:21:23 2008 : Debug: PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy. Wed Jan 30 16:21:23 2008 : Debug: Tunneled session will be proxied. Not doing EAP. Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[authenticate]: module "eap" returns handled for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authenticate (returns handled) for request 6 Wed Jan 30 16:21:23 2008 : Debug: Processing the pre-proxy section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group pre-proxy for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[pre-proxy]: calling files (rlm_files) for request 6 Wed Jan 30 16:21:23 2008 : Debug: preproxy_users: Matched entry DEFAULT at line 33 Wed Jan 30 16:21:23 2008 : Debug: modsingle[pre-proxy]: returned from files (rlm_files) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[pre-proxy]: module "files" returns ok for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[pre-proxy]: calling pre_proxy_log (rlm_detail) for request 6 Wed Jan 30 16:21:23 2008 : Debug: radius_xlat: '/var/log/freeradius/radacct/192.168.2.28/pre-proxy-detail-20080130' Wed Jan 30 16:21:23 2008 : Debug: rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.2.28/pre-proxy-detail-20080130 Wed Jan 30 16:21:23 2008 : Debug: modsingle[pre-proxy]: returned from pre_proxy_log (rlm_detail) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[pre-proxy]: module "pre_proxy_log" returns ok for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group pre-proxy (returns ok) for request 6 Wed Jan 30 16:21:23 2008 : Debug: proxy: creating 5002a8c0:1812 Wed Jan 30 16:21:23 2008 : Debug: proxy: allocating 5002a8c0:1812 0 Sending Access-Request of id 0 to 192.168.2.80 port 1812 User-Name = "aaa" NAS-IP-Address = 127.0.0.1 MS-CHAP-Challenge = 0xd705730f12a9595b41ac811cc23eab54 MS-CHAP2-Response = 0x0661543bffa8ddc094f4dd7d68d583583cef000000000000000037cc3ccd31b876ad62b6164cbbb47f0f87d04f4c2156a13d Proxy-State = 0x36 Service-Type := BOSS4-HomeNet-VPN Wed Jan 30 16:21:23 2008 : Debug: Waking up in 6 seconds... rad_recv: Access-Accept packet from host 192.168.2.80:1812, id=0, length=262 Wed Jan 30 16:21:23 2008 : Debug: proxy: de-allocating 5002a8c0:1812 0 Reply-Message = "ACCESS: GRANTED" Reply-Message = "AGREEMENT-ID: 587986" Framed-IP-Address = 192.168.2.56 Framed-IP-Netmask = 255.255.255.255 Framed-Protocol = PPP MS-CHAP2-Success = 0x00533d46344538343746453843323736414341453537393637343835343143384642303742334633303739 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Recv-Key = 0x6b79482763300b5dece7d6ac717d8a21 MS-MPPE-Send-Key = 0xe23347a646ed9a7a19693881f99ebb37 Service-Type = Framed-User Reply-Message = "STATUS: 0.00000000" Wed Jan 30 16:21:23 2008 : Debug: Processing the post-proxy section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group post-proxy for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[post-proxy]: calling post_proxy_log (rlm_detail) for request 6 Wed Jan 30 16:21:23 2008 : Debug: radius_xlat: '/var/log/freeradius/radacct/192.168.2.28/post-proxy-detail-20080130' Wed Jan 30 16:21:23 2008 : Debug: rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.2.28/post-proxy-detail-20080130 Wed Jan 30 16:21:23 2008 : Debug: modsingle[post-proxy]: returned from post_proxy_log (rlm_detail) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[post-proxy]: module "post_proxy_log" returns ok for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[post-proxy]: calling eap (rlm_eap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: PEAP: Passing reply from proxy back into the tunnel. Wed Jan 30 16:21:23 2008 : Debug: PEAP: Passing reply back for EAP-MS-CHAP-V2 0x801453f8 2 Wed Jan 30 16:21:23 2008 : Debug: Processing the post-proxy section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group post-proxy for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[post-proxy]: calling post_proxy_log (rlm_detail) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[post-proxy]: returned from post_proxy_log (rlm_detail) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[post-proxy]: module "post_proxy_log" returns noop for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[post-proxy]: calling eap (rlm_eap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_mschapv2: Passing reply from proxy back into the tunnel 0x801453f8 2. Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_mschapv2: Authentication succeeded. Wed Jan 30 16:21:23 2008 : Debug: MSCHAP Success Wed Jan 30 16:21:23 2008 : Debug: modsingle[post-proxy]: returned from eap (rlm_eap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[post-proxy]: module "eap" returns ok for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group post-proxy (returns ok) for request 6 Wed Jan 30 16:21:23 2008 : Debug: POST-PROXY 2 Wed Jan 30 16:21:23 2008 : Debug: Processing the post-auth section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group post-auth for request 6 Wed Jan 30 16:21:23 2008 : Debug: modsingle[post-auth]: calling reply_log (rlm_detail) for request 6 Wed Jan 30 16:21:23 2008 : Debug: radius_xlat: '/var/log/freeradius/radacct/127.0.0.1/reply-detail-20080130' Wed Jan 30 16:21:23 2008 : Debug: rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/reply-detail-20080130 Wed Jan 30 16:21:23 2008 : Debug: modsingle[post-auth]: returned from reply_log (rlm_detail) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[post-auth]: module "reply_log" returns ok for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group post-auth (returns ok) for request 6 Wed Jan 30 16:21:23 2008 : Debug: POST-AUTH 2 PEAP: Final reply from tunneled session code 11 Reply-Message = "ACCESS: GRANTED" Reply-Message = "AGREEMENT-ID: 587986" Framed-IP-Address = 192.168.2.56 Framed-IP-Netmask = 255.255.255.255 Framed-Protocol = PPP Service-Type = Framed-User Reply-Message = "STATUS: 0.00000000" EAP-Message = 0x010700331a0306002e533d46344538343746453843323736414341453537393637343835343143384642303742334633303739 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2e6847c5eb9a59e5f7cdbc3d8f082a8f Wed Jan 30 16:21:23 2008 : Debug: PEAP: Got reply 11 PEAP: Processing from tunneled session code 0x80144e58 11 Reply-Message = "ACCESS: GRANTED" Reply-Message = "AGREEMENT-ID: 587986" Framed-IP-Address = 192.168.2.56 Framed-IP-Netmask = 255.255.255.255 Framed-Protocol = PPP Service-Type = Framed-User Reply-Message = "STATUS: 0.00000000" EAP-Message = 0x010700331a0306002e533d46344538343746453843323736414341453537393637343835343143384642303742334633303739 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2e6847c5eb9a59e5f7cdbc3d8f082a8f Wed Jan 30 16:21:23 2008 : Debug: PEAP: Got tunneled Access-Challenge PEAP tunnel data out 0000: 1a 03 06 00 2e 53 3d 46 34 45 38 34 37 46 45 38 PEAP tunnel data out 0010: 43 32 37 36 41 43 41 45 35 37 39 36 37 34 38 35 PEAP tunnel data out 0020: 34 31 43 38 46 42 30 37 42 33 46 33 30 37 39 Wed Jan 30 16:21:23 2008 : Debug: PEAP: Reply was handled Wed Jan 30 16:21:23 2008 : Debug: modsingle[post-proxy]: returned from eap (rlm_eap) for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall[post-proxy]: module "eap" returns ok for request 6 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group post-proxy (returns ok) for request 6 Sending Access-Challenge of id 6 to 192.168.2.28 port 1032 EAP-Message = 0x0107004a1900170301003f3cbae61fe7c97a3500bb9b7aa65a7ebf4dfde9f637ba2a0f53ed7e91716066ab1dac2c590f7476689bf80aacf390629dd56a9d5e9df17b60819fc23938d207 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8f6fded6f73f89f6c871aa78026be3fe Wed Jan 30 16:21:23 2008 : Debug: Finished request 6 Wed Jan 30 16:21:23 2008 : Debug: Going to the next request Wed Jan 30 16:21:23 2008 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.28:1032, id=7, length=223 Message-Authenticator = 0xdf76dfa6cb666f43cae3f55e797a4b95 Service-Type = Framed-User User-Name = "aaa" Framed-MTU = 1488 State = 0x8f6fded6f73f89f6c871aa78026be3fe Called-Station-Id = "00-15-E9-AE-B2-BF:WLAN" Calling-Station-Id = "00-17-9A-82-C7-7B" NAS-Identifier = "WLAN Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0207001d19001703010012156f46fa75527ef68f17bb704f8dba1532f7 NAS-IP-Address = 192.168.2.28 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Wed Jan 30 16:21:23 2008 : Debug: Processing the authorize section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authorize for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "preprocess" returns ok for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 7 Wed Jan 30 16:21:23 2008 : Debug: radius_xlat: '/var/log/freeradius/radacct/192.168.2.28/auth-detail-20080130' Wed Jan 30 16:21:23 2008 : Debug: rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.2.28/auth-detail-20080130 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "auth_log" returns ok for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling attr_filter (rlm_attr_filter) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from attr_filter (rlm_attr_filter) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "attr_filter" returns noop for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "chap" returns noop for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "mschap" returns noop for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 7 Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No '@' in User-Name = "aaa", looking up realm NULL Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No such realm "NULL" Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "suffix" returns noop for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP packet type response id 7 length 29 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "eap" returns updated for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "files" returns notfound for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "pap" returns noop for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authorize (returns updated) for request 7 Wed Jan 30 16:21:23 2008 : Debug: rad_check_password: Found Auth-Type EAP Wed Jan 30 16:21:23 2008 : Debug: auth: type "EAP" Wed Jan 30 16:21:23 2008 : Debug: Processing the authenticate section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authenticate for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: Request found, released from the list Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP/peap Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: processing type peap Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: Authenticate Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: processing TLS Wed Jan 30 16:21:23 2008 : Debug: eaptls_verify returned 7 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_tls: Done initial handshake Wed Jan 30 16:21:23 2008 : Debug: eaptls_process returned 7 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: EAPTLS_OK Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: Session established. Decoding tunneled attributes. PEAP tunnel data in 0000: 1a 03 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: EAP type mschapv2 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020700061a03 Wed Jan 30 16:21:23 2008 : Debug: PEAP: Setting User-Name to aaa Wed Jan 30 16:21:23 2008 : Debug: PEAP: Adding old state with 2e 68 PEAP: Sending tunneled request EAP-Message = 0x020700061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "aaa" State = 0x2e6847c5eb9a59e5f7cdbc3d8f082a8f Wed Jan 30 16:21:23 2008 : Debug: Processing the authorize section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authorize for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "preprocess" returns ok for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 7 Wed Jan 30 16:21:23 2008 : Debug: radius_xlat: '/var/log/freeradius/radacct/127.0.0.1/auth-detail-20080130' Wed Jan 30 16:21:23 2008 : Debug: rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20080130 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "auth_log" returns ok for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling attr_filter (rlm_attr_filter) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from attr_filter (rlm_attr_filter) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "attr_filter" returns noop for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "chap" returns noop for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "mschap" returns noop for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 7 Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No '@' in User-Name = "aaa", looking up realm NULL Wed Jan 30 16:21:23 2008 : Debug: rlm_realm: No such realm "NULL" Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "suffix" returns noop for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: EAP packet type response id 7 length 6 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "eap" returns updated for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 7 Wed Jan 30 16:21:23 2008 : Debug: users: Matched entry aaa at line 85 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "files" returns ok for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authorize]: module "pap" returns noop for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authorize (returns updated) for request 7 PEAP: Got tunneled reply RADIUS code 0 Wed Jan 30 16:21:23 2008 : Debug: PEAP: Calling authenticate in order to initiate tunneled EAP session. Wed Jan 30 16:21:23 2008 : Debug: Processing the authenticate section of radiusd.conf Wed Jan 30 16:21:23 2008 : Debug: modcall: entering group authenticate for request 7 Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: Request not found in the list Wed Jan 30 16:21:23 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: Failed in handler Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authenticate]: module "eap" returns invalid for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authenticate (returns invalid) for request 7 Wed Jan 30 16:21:23 2008 : Debug: PEAP: Can't handle the return code 4 Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: Handler failed in EAP/peap Wed Jan 30 16:21:23 2008 : Debug: rlm_eap: Failed in EAP select Wed Jan 30 16:21:23 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall[authenticate]: module "eap" returns invalid for request 7 Wed Jan 30 16:21:23 2008 : Debug: modcall: leaving group authenticate (returns invalid) for request 7 Wed Jan 30 16:21:23 2008 : Debug: auth: Failed to validate the user. Wed Jan 30 16:21:23 2008 : Debug: Delaying request 7 for 1 seconds Wed Jan 30 16:21:23 2008 : Debug: Finished request 7 Wed Jan 30 16:21:23 2008 : Debug: Going to the next request Wed Jan 30 16:21:23 2008 : Debug: Waking up in 6 seconds...
Hi! Does anyone here have working inner tunnel proxying with freeradius 2.0.x? Still having troubles with doing EAP-PEAP-MSCHAPv2 authorization. Switched to FreeRadius 2.0.1 from 1.1.7. What I need: extract MSCHAPv2 auth from PEAP, proxy auth to external server which knows nothing about EAP. All configs are almost default from distribution. Key changes: in eap.conf: peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "proxy-inner-tunnel" } proxy-inner-tunnel is taken from examples with modified realm name: server proxy-inner-tunnel { authorize { update control { Proxy-To-Realm := "xxx" } } } As a result, no proxying has been done by freeradius: PEAP: Sending tunneled request EAP-Message = 0x0206000801616161 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "aaa" server proxy-inner-tunnel { Tue Feb 5 14:56:01 2008 : Debug: +- entering group authorize Tue Feb 5 14:56:01 2008 : Debug: ++[control] returns notfound } # server proxy-inner-tunnel PEAP: Got tunneled reply RADIUS code 0 Tue Feb 5 14:56:01 2008 : Debug: PEAP: Tunneled authentication will be proxied to xxx Tue Feb 5 14:56:01 2008 : Debug: Tunneled session will be proxied. Not doing EAP. Tue Feb 5 14:56:01 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 6 Tue Feb 5 14:56:01 2008 : Debug: ++[eap] returns handled Tue Feb 5 14:56:01 2008 : Debug: There was no response configured: rejecting request 6 Tue Feb 5 14:56:01 2008 : Debug: Found Post-Auth-Type Reject Tue Feb 5 14:56:01 2008 : Debug: +- entering group REJECT .... -- Best wishes, Dmitry Sergienko (SDA104-RIPE) Trifle Co., Ltd.
Dmitry Sergienko wrote:
Does anyone here have working inner tunnel proxying with freeradius 2.0.x?
Still having troubles with doing EAP-PEAP-MSCHAPv2 authorization. Switched to FreeRadius 2.0.1 from 1.1.7.
I think the issue was introduced recently. Try editing src/main/event.c, function request_post_handler() ... if (request->root->proxy_requests && /* !request->proxy && */ // comment out this line !request->in_proxy_hash && // add this line (request->reply->code == 0) && (request->packet->dst_port != 0) && (request->packet->code != PW_STATUS_SERVER)) { ... Re-build && install. See if that helps... Alan DeKok.
Hi! Alan DeKok wrote:
Dmitry Sergienko wrote:
Does anyone here have working inner tunnel proxying with freeradius 2.0.x?
Still having troubles with doing EAP-PEAP-MSCHAPv2 authorization. Switched to FreeRadius 2.0.1 from 1.1.7.
I think the issue was introduced recently. Try editing src/main/event.c, function request_post_handler()
... if (request->root->proxy_requests && /* !request->proxy && */ // comment out this line !request->in_proxy_hash && // add this line (request->reply->code == 0) && (request->packet->dst_port != 0) && (request->packet->code != PW_STATUS_SERVER)) { ...
Re-build && install. See if that helps...
Thanks for the tip. successfully_proxied_request() also needs patching: /* * If it was already proxied, do nothing. * * FIXME: This should really be a serious error. */ /* if (request->in_proxy_hash || request->proxy) { */ if (request->in_proxy_hash) { return 0; } AFAIU this function relies on empty request->packet, but it is not empty because has been filled in eappeap_process(): /* * Seed the proxy packet with the * tunneled request. */ rad_assert(request->proxy == NULL); request->proxy = fake->packet; The second oddity: when setting "proxy_tunneled_request_as_eap = no" proxying is not working because no inner MSCHAPv2 request extracted. Debug looks like this: Wed Feb 6 00:33:09 2008 : Debug: PEAP: Calling authenticate in order to initiate tunneled EAP session. Wed Feb 6 00:33:09 2008 : Debug: WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Solution is quite simple: write down the following in proxy-inner-tunnel file after authorize {} section: authenticate { eap } module_authenticate() is being called in eappeap_process() to extract MSCHAPv2 request and when no authenticate section in virtual server proxying will fail. IMHO it will be useful to have these lines in example proxy-inner-tunnel as a comment for "proxy_tunneled_request_as_eap" set to "no". Maybe someone will run into the same issue and spend several hours or days to figure out how to fix this. -- Best regards, Dmitry Sergienko
Dmitry Sergienko wrote:
Thanks for the tip. successfully_proxied_request() also needs patching:
Fixed, thanks.
The second oddity: when setting "proxy_tunneled_request_as_eap = no" proxying is not working because no inner MSCHAPv2 request extracted. Debug looks like this: .. Solution is quite simple: write down the following in proxy-inner-tunnel file after authorize {} section:
authenticate { eap }
Fixed, thanks. Alan DeKok.
Hi! Alan DeKok wrote:
Dmitry Sergienko wrote:
Thanks for the tip. successfully_proxied_request() also needs patching:
Fixed, thanks.
Thanks for committing patches. But I have to return to the question of proxying EAP-PEAP-MS-CHAPv2. I've spent several nights with gdb, radsniff and xsupplicant to figure out why authentication passes on eapol_test and fails on WinXP supplicant. Even tried Juniper Odissey 802.1x client :) The reason why authentication fails is missing EAP-MSCHAP Success packet inside EAP-PEAP response. Here is a debug output from CVS current snapshot: Tue Feb 12 23:45:21 2008 : Debug: PEAP: Tunneled authentication was successful. Tue Feb 12 23:45:21 2008 : Debug: rlm_eap_peap: SUCCESS Tue Feb 12 23:45:21 2008 : Debug: PEAP: Reply was handled Tue Feb 12 23:45:21 2008 : Debug: modsingle[post-proxy]: returned from eap (rlm_eap) for request 7 Tue Feb 12 23:45:21 2008 : Debug: ++[eap] returns ok Tue Feb 12 23:45:21 2008 : Debug: +- entering group authorize ..... Tue Feb 12 23:45:21 2008 : Debug: ++[pap] returns noop Tue Feb 12 23:45:21 2008 : Debug: rad_check_password: Found Auth-Type EAP Tue Feb 12 23:45:21 2008 : Debug: rad_check_password: Found Auth-Type Tue Feb 12 23:45:21 2008 : Error: Warning: Found 2 auth-types on request for user 'myid@mynet.net' Tue Feb 12 23:45:21 2008 : Debug: rad_check_password: Auth-Type = Accept, accepting the user Tue Feb 12 23:45:21 2008 : Auth: Login OK: [myid@mynet.net/<via Auth-Type = EAP>] (from client sw-local port 33 cli 00-a9-40-0f-83-a5) Sending Access-Challenge of id 207 to 192.168.2.3 port 8021 EAP-Message = 0x010a003b190017030100302dab2609196723fb8eeb007a902318e351b22e5da4aae2777dbb6d788504c8528a4e3950e2239c1a37793f835ff8ce46 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2fdece8d28d4d781421b7dc8777de66c 1. We have duplicate Auth-Type which seems to be incorrect. 2. We haven't finished EAP-MSCHAPv2 challenge and return empty EAP request to supplicant: /sending EAP-MS-CHAPv2 challenge/ [AUTH TYPE] (EAP-MSCHAPv2) Challenge [AUTH TYPE] (EAP-MS-CHAPv2) ID : 09 [AUTH TYPE] Authenticator Challenge : 02 71 99 df 1a 3e 5e 4f 5e e6 02 44 46 55 13 b9 [AUTH TYPE] Generated PeerChallenge : a0 50 6b 66 b1 af ef af c2 cd 19 93 93 fd d8 e9 [AUTH TYPE] PeerChallenge : a0 50 6b 66 b1 af ef af [AUTH TYPE] AuthenticatorChallenge : 02 71 99 df 1a 3e 5e 4f [AUTH TYPE] Username : aaa [AUTH TYPE] Challenge : a2 6e 27 64 a4 25 5d 34 [AUTH TYPE] PasswordHash : 75 f1 d2 3f 3a 25 27 c6 bf aa da 3e 93 b3 2a 8b [AUTH TYPE] Response : a0 bd 3f 60 4c 55 37 09 3f af e8 06 04 5d 74 c1 e8 18 07 6e 90 53 5f b1 [AUTH TYPE] myvars->NtResponse = a0 bd 3f 60 4c 55 37 09 3f af e8 06 04 5d 74 c1 e8 18 07 6e 90 53 5f b1 [AUTH TYPE] response->NT_Response = a0 bd 3f 60 4c 55 37 09 3f af e8 06 04 5d 74 c1 e8 18 07 6e 90 53 5f b1 [AUTH TYPE] Unencrypted return frame : [AUTH TYPE] Encrypted return frame : [STATE] [backend_sm] REQUEST -> RESPONSE [ALL] Frame to be sent (162) : [STATE] [backend_sm] RESPONSE -> RECEIVE /receiving response from FreeRADIUS/ [ALL] Got Frame (77) : 000 | 00 a9 40 0f 83 a5 00 15 e9 b8 79 dd 88 8e 01 00 | ..@.......y..... 010 | 00 3b 01 0a 00 3b 19 00 17 03 01 00 30 2d ab 26 | .;...;......0-.& 020 | 09 19 67 23 fb 8e eb 00 7a 90 23 18 e3 51 b2 2e | ..g#....z.#..Q.. 030 | 5d a4 aa e2 77 7d bb 6d 78 85 04 c8 52 8a 4e 39 | ]...w}.mx...R.N9 040 | 50 e2 23 9c 1a 37 79 3f 83 5f f8 ce 46 | P.#..7y?._..F [ALL] Got EAP-Request for type 25 (EAP_PEAP). [ALL] Got EAP-Request-Authentication. [STATE] [backend_sm] RECEIVE -> REQUEST [ALL] Got EAP-Request for type 25 (EAP_PEAP). [ALL] Got EAP-Request-Authentication. [STATE] Building EAPOL-Response-Authentication [AUTH TYPE] Packet in (54) : 000 | 00 17 03 01 00 30 2d ab 26 09 19 67 23 fb 8e eb | .....0-.&..g#... 010 | 00 7a 90 23 18 e3 51 b2 2e 5d a4 aa e2 77 7d bb | .z.#..Q..]...w}. 020 | 6d 78 85 04 c8 52 8a 4e 39 50 e2 23 9c 1a 37 79 | mx...R.N9P.#..7y 030 | 3f 83 5f f8 ce 46 | ?._..F [AUTH TYPE] Decrypted dump : 000 | 01 0a 00 0b 21 80 03 00 02 00 01 | ....!...... [AUTH TYPE] Decrypted packet returned 11 byte(s) [AUTH TYPE] Doing PEAP v0! [AUTH TYPE] Inner packet : 000 | 01 0a 00 0b 21 80 03 00 02 00 01 | ....!...... [AUTH TYPE] Got an EAP extension frame! [AUTH TYPE] Unencrypted return frame : 000 | 02 0a 00 0b 21 80 03 00 02 00 01 | ....!...... [AUTH TYPE] Encrypted return frame : 000 | 00 17 03 01 00 20 dd 2e 66 ce be ad ab 66 4b 56 | ..... ..f....fKV 010 | 22 21 6e 8f 2c a9 89 fe 3f 99 63 50 da 24 25 9b | "!n.,...?.cP.$%. 020 | 38 56 03 cb 05 1a 17 03 01 00 30 74 f0 f7 c5 09 | 8V........0t.... 030 | 75 c0 ab ec f6 84 9e 97 11 ae ce 63 64 6f e4 27 | u..........cdo.' 040 | 4c dc c0 54 b5 b3 23 72 99 96 74 8f 23 dd 8b 45 | L..T..#r..t.#..E 050 | ce dc 7b c0 cf 05 dc 47 b6 ac 8d | ..{....G... [STATE] [backend_sm] REQUEST -> RESPONSE And here is correct authentication with username/password configured in users and no proxying has been done: [STATE] Building EAPOL-Response-Authentication [AUTH TYPE] Packet in (86) : 000 | 00 17 03 01 00 50 6b 3a 34 1d ce c5 39 05 e6 14 | .....Pk:4...9... 010 | a5 18 a2 96 56 c8 42 10 5d 34 9d 41 9b fe 3e ee | ....V.B.]4.A..>. 020 | a6 40 c7 bb a6 19 bb 11 b2 b6 10 20 5d 97 0b b3 | .@......... ]... 030 | 36 ee bc 91 85 08 9b 6a dc b9 00 40 3d d0 88 3f | 6......j...@=..? 040 | 63 5b 66 87 e1 df ae fc 00 41 f6 25 f0 8b 35 75 | c[f......A.%..5u 050 | f4 7d aa 91 b2 cd | .}.... [AUTH TYPE] Decrypted dump : 000 | 1a 03 09 00 2e 53 3d 42 46 37 42 35 34 32 46 46 | .....S=BF7B542FF 010 | 43 35 46 45 45 41 44 33 45 46 44 34 43 35 35 36 | C5FEEAD3EFD4C556 020 | 44 39 44 32 38 36 38 30 31 32 41 42 31 42 44 | D9D2868012AB1BD [AUTH TYPE] Decrypted packet returned 47 byte(s) [AUTH TYPE] Doing PEAP v0! [AUTH TYPE] Inner packet : 000 | 00 00 00 00 1a 03 09 00 2e 53 3d 42 46 37 42 35 | .........S=BF7B5 010 | 34 32 46 46 43 35 46 45 45 41 44 33 45 46 44 34 | 42FFC5FEEAD3EFD4 020 | 43 35 35 36 44 39 44 32 38 36 38 30 31 32 41 42 | C556D9D2868012AB 030 | 31 42 44 | 1BD [AUTH TYPE] (EAP-MSCHAPv2) Success! [AUTH TYPE] Server authentication check success! Sending phase 2 success! As you can see, 802.1x supplicant waits for EAP-MSCHAPv2 Success inside PEAP. -- Best wishes, Dmitry Sergienko (SDA104-RIPE) Trifle Co., Ltd.
Hi! Situation gets more clear if eap module is being called in post-proxy section of proxy-inner-tunnel: Wed Feb 13 01:31:41 2008 : Debug: +- entering group post-proxy Wed Feb 13 01:31:41 2008 : Debug: modsingle[post-proxy]: calling eap (rlm_eap) for request 7 Wed Feb 13 01:31:41 2008 : Debug: rlm_eap_mschapv2: Passing reply from proxy back into the tunnel 0x8185f20 2. Wed Feb 13 01:31:41 2008 : Debug: rlm_eap_mschapv2: Authentication succeeded. Wed Feb 13 01:31:41 2008 : Debug: MSCHAP Success Wed Feb 13 01:31:41 2008 : Debug: modsingle[post-proxy]: returned from eap (rlm_eap) for request 7 Wed Feb 13 01:31:41 2008 : Debug: ++[eap] returns ok Wed Feb 13 01:31:41 2008 : Debug: POST-PROXY 2 Wed Feb 13 01:31:41 2008 : Debug: POST-AUTH 2 But it still fails to authorize: Wed Feb 13 03:17:19 2008 : Debug: rlm_eap_peap: Session established. Decoding tunneled attributes. PEAP tunnel data in 0000: 1a 03 Wed Feb 13 03:17:19 2008 : Debug: rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x020a00061a03 Wed Feb 13 03:17:19 2008 : Debug: PEAP: Setting User-Name to aaa PEAP: Sending tunneled request EAP-Message = 0x020a00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "aaa" State = 0x29fd9dc228f787186321d63394dc60d5 Framed-MTU = 1466 NAS-IP-Address = 192.168.2.3 NAS-Identifier = "D-Link" Service-Type = Framed-User NAS-Port = 33 NAS-Port-Type = Ethernet NAS-Port-Id = "ether3_33" Called-Station-Id = "00-15-e9-b8-79-dd" Calling-Station-Id = "00-a9-40-0f-83-a5" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" server proxy-inner-tunnel { Wed Feb 13 03:17:19 2008 : Debug: +- entering group authorize Wed Feb 13 03:17:19 2008 : Debug: ++[control] returns notfound } # server proxy-inner-tunnel PEAP: Got tunneled reply RADIUS code 0 Wed Feb 13 03:17:19 2008 : Debug: PEAP: Calling authenticate in order to initiate tunneled EAP session. Wed Feb 13 03:17:19 2008 : Debug: +- entering group authenticate Wed Feb 13 03:17:19 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 8 Wed Feb 13 03:17:19 2008 : Error: rlm_eap: No EAP session matching the State variable. Wed Feb 13 03:17:19 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Wed Feb 13 03:17:19 2008 : Debug: rlm_eap: Failed in handler Wed Feb 13 03:17:19 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 8 Wed Feb 13 03:17:19 2008 : Debug: ++[eap] returns invalid In normal case inner tunnel has "EAP-Type = MS-CHAP-V2" and Auth-Type = EAP in check_items: Wed Feb 13 03:09:51 2008 : Debug: EAP-Message = 0x020a00061a03 Wed Feb 13 03:09:51 2008 : Debug: FreeRADIUS-Proxied-To = 127.0.0.1 Wed Feb 13 03:09:51 2008 : Debug: User-Name = "aaa" Wed Feb 13 03:09:51 2008 : Debug: State = 0xe314f6cee21eecffcdeca66afa541172 Wed Feb 13 03:09:51 2008 : Debug: Framed-MTU = 1466 Wed Feb 13 03:09:51 2008 : Debug: NAS-IP-Address = 192.168.2.3 Wed Feb 13 03:09:51 2008 : Debug: NAS-Identifier = "D-Link" Wed Feb 13 03:09:51 2008 : Debug: Service-Type = Framed-User Wed Feb 13 03:09:51 2008 : Debug: NAS-Port = 33 Wed Feb 13 03:09:51 2008 : Debug: NAS-Port-Type = Ethernet Wed Feb 13 03:09:51 2008 : Debug: NAS-Port-Id = "ether3_33" Wed Feb 13 03:09:51 2008 : Debug: Called-Station-Id = "00-15-e9-b8-79-dd" Wed Feb 13 03:09:51 2008 : Debug: Calling-Station-Id = "00-a9-40-0f-83-a5" Wed Feb 13 03:09:51 2008 : Debug: Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Wed Feb 13 03:09:51 2008 : Debug: EAP-Type = MS-CHAP-V2 In this (proxied) case inner tunnel contains only following attributes: (gdb) p vp_listdebug(request->packet->vps) Wed Feb 13 03:15:10 2008 : Debug: EAP-Message = 0x020a00061a03 Wed Feb 13 03:15:10 2008 : Debug: FreeRADIUS-Proxied-To = 127.0.0.1 Wed Feb 13 03:15:10 2008 : Debug: User-Name = "aaa" Wed Feb 13 03:15:10 2008 : Debug: State = 0x7f6817377e620dc906c84fac864d0550 Wed Feb 13 03:15:10 2008 : Debug: Framed-MTU = 1466 Wed Feb 13 03:15:10 2008 : Debug: NAS-IP-Address = 192.168.2.3 Wed Feb 13 03:15:10 2008 : Debug: NAS-Identifier = "D-Link" Wed Feb 13 03:15:10 2008 : Debug: Service-Type = Framed-User Wed Feb 13 03:15:10 2008 : Debug: NAS-Port = 33 Wed Feb 13 03:15:10 2008 : Debug: NAS-Port-Type = Ethernet Wed Feb 13 03:15:10 2008 : Debug: NAS-Port-Id = "ether3_33" Wed Feb 13 03:15:10 2008 : Debug: Called-Station-Id = "00-15-e9-b8-79-dd" Wed Feb 13 03:15:10 2008 : Debug: Calling-Station-Id = "00-a9-40-0f-83-a5" Wed Feb 13 03:15:10 2008 : Debug: Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" request->check_items contain only Proxy-To-Realm AVPair. Dmitry Sergienko wrote:
Thanks for committing patches. But I have to return to the question of proxying EAP-PEAP-MS-CHAPv2. I've spent several nights with gdb, radsniff and xsupplicant to figure out why authentication passes on eapol_test and fails on WinXP supplicant. Even tried Juniper Odissey 802.1x client :)
The reason why authentication fails is missing EAP-MSCHAP Success packet inside EAP-PEAP response.
-- Best regards, Dmitry Sergienko
Dmitry Sergienko wrote:
Situation gets more clear if eap module is being called in post-proxy section of proxy-inner-tunnel:
I've updated the proxy-inner-tunnel example to work. It sends the MS-CHAP2-Success as part of the EAP session. And please don't CC me on messages to the list. I get enough messages already. Alan DeKok.
Hi,
Tue Feb 12 23:45:21 2008 : Error: Warning: Found 2 auth-types on request for user 'myid@mynet.net' Tue Feb 12 23:45:21 2008 : Debug: rad_check_password: Auth-Type = Accept, accepting the user
whoah. WinXP is very fussy (as should all EAP clients) about getting a proper EAP return. you seem to have thrown an 'Accept' straight back to the challenge rather than let the EAP engine do its business. config file or startup debug output please alan
Hi! A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
Tue Feb 12 23:45:21 2008 : Error: Warning: Found 2 auth-types on request for user 'myid@mynet.net' Tue Feb 12 23:45:21 2008 : Debug: rad_check_password: Auth-Type = Accept, accepting the user
whoah. WinXP is very fussy (as should all EAP clients) about getting a proper EAP return. you seem to have thrown an 'Accept' straight back to the challenge rather than let the EAP engine do its business.
config file or startup debug output please
Config file is the same as default example proxy-inner-tunnel in 2.0.2 release with modified realm name only. As I wrote before, double Auth-Type had been fixed by adding post-proxy { eap } part in proxy-inner-tunnel. But authentication still fails to pass. Got the following error: Thu Feb 14 16:42:06 2008 : Error: rlm_eap: No EAP session matching the State variable. Thu Feb 14 16:42:06 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request It comes after second authentication in eap module, after passing inner request to virtual server. xsupplicant receives EAP-MSCHAPv2 Success and sends phase 2 success back to FreeRADIUS: ----------------- [AUTH TYPE] (EAP-MSCHAPv2) Success! [AUTH TYPE] Server authentication check success! Sending phase 2 success! [AUTH TYPE] Unencrypted return frame : 000 | 1a 03 | .. [AUTH TYPE] Encrypted return frame : ----------------- FreeRADIUS debug output with failed authentication: ----------------- rad_recv: Access-Request packet from host 192.168.2.3 port 8021, id=85, length=279 Framed-MTU = 1466 NAS-IP-Address = 192.168.2.3 NAS-Identifier = "D-Link" User-Name = "myid@mynet.net" Service-Type = Framed-User NAS-Port = 33 NAS-Port-Type = Ethernet NAS-Port-Id = "ether3_33" Called-Station-Id = "00-15-e9-b8-79-dd" Calling-Station-Id = "00-a9-40-0f-83-a5" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" State = 0x827a1bd58a710287540fbc1db46cf1a2 EAP-Message = 0x020b005019001703010020a8e33063d77e6a2f489c6f5d9a12306c870537dc721149322bd85623235edda1170301002088aaf69e118a31b4eac9 c0d7c106de95b51101eb9e1b0c70949645a855cc206c Message-Authenticator = 0x82efd03b0f271f621eb2677ebf3c5902 Thu Feb 14 16:42:06 2008 : Debug: +- entering group authorize Thu Feb 14 16:42:06 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 9 Thu Feb 14 16:42:06 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 9 Thu Feb 14 16:42:06 2008 : Debug: ++[preprocess] returns ok Thu Feb 14 16:42:06 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 9 Thu Feb 14 16:42:06 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 9 Thu Feb 14 16:42:06 2008 : Debug: ++[chap] returns noop Thu Feb 14 16:42:06 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 9 Thu Feb 14 16:42:06 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 9 Thu Feb 14 16:42:06 2008 : Debug: ++[mschap] returns noop Thu Feb 14 16:42:06 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 9 Thu Feb 14 16:42:06 2008 : Debug: rlm_realm: Looking up realm "mynet.net" for User-Name = "myid@mynet.net" Thu Feb 14 16:42:06 2008 : Debug: rlm_realm: No such realm "mynet.net" Thu Feb 14 16:42:06 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 9 Thu Feb 14 16:42:06 2008 : Debug: ++[suffix] returns noop Thu Feb 14 16:42:06 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 9 Thu Feb 14 16:42:06 2008 : Debug: rlm_eap: EAP packet type response id 11 length 80 Thu Feb 14 16:42:06 2008 : Debug: rlm_eap: Continuing tunnel setup. Thu Feb 14 16:42:06 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 9 Thu Feb 14 16:42:06 2008 : Debug: ++[eap] returns ok Thu Feb 14 16:42:06 2008 : Debug: rad_check_password: Found Auth-Type EAP Thu Feb 14 16:42:06 2008 : Debug: auth: type "EAP" Thu Feb 14 16:42:06 2008 : Debug: +- entering group authenticate Thu Feb 14 16:42:06 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 9 Thu Feb 14 16:42:06 2008 : Debug: rlm_eap: Request found, released from the list Thu Feb 14 16:42:06 2008 : Debug: rlm_eap: EAP/peap Thu Feb 14 16:42:06 2008 : Debug: rlm_eap: processing type peap Thu Feb 14 16:42:06 2008 : Debug: rlm_eap_peap: Authenticate Thu Feb 14 16:42:06 2008 : Debug: rlm_eap_tls: processing TLS Thu Feb 14 16:42:06 2008 : Debug: eaptls_verify returned 7 Thu Feb 14 16:42:06 2008 : Debug: rlm_eap_tls: Done initial handshake Thu Feb 14 16:42:06 2008 : Debug: eaptls_process returned 7 Thu Feb 14 16:42:06 2008 : Debug: rlm_eap_peap: EAPTLS_OK Thu Feb 14 16:42:06 2008 : Debug: rlm_eap_peap: Session established. Decoding tunneled attributes. PEAP tunnel data in 0000: 1a 03 Thu Feb 14 16:42:06 2008 : Debug: rlm_eap_peap: EAP type mschapv2 PEAP: Got tunneled EAP-Message EAP-Message = 0x020b00061a03 Thu Feb 14 16:42:06 2008 : Debug: PEAP: Setting User-Name to aaa PEAP: Sending tunneled request EAP-Message = 0x020b00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "aaa" State = 0xc858015dc9531b78fbe76e30aaba109e Framed-MTU = 1466 NAS-IP-Address = 192.168.2.3 NAS-Identifier = "D-Link" Service-Type = Framed-User NAS-Port = 33 NAS-Port-Type = Ethernet NAS-Port-Id = "ether3_33" Called-Station-Id = "00-15-e9-b8-79-dd" Calling-Station-Id = "00-a9-40-0f-83-a5" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" server proxy-inner-tunnel { Thu Feb 14 16:42:06 2008 : Debug: +- entering group authorize Thu Feb 14 16:42:06 2008 : Debug: ++[control] returns notfound } # server proxy-inner-tunnel PEAP: Got tunneled reply RADIUS code 0 Thu Feb 14 16:42:06 2008 : Debug: PEAP: Calling authenticate in order to initiate tunneled EAP session. Thu Feb 14 16:42:06 2008 : Debug: +- entering group authenticate Thu Feb 14 16:42:06 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 9 Thu Feb 14 16:42:06 2008 : Error: rlm_eap: No EAP session matching the State variable. Thu Feb 14 16:42:06 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Thu Feb 14 16:42:06 2008 : Debug: rlm_eap: Failed in handler Thu Feb 14 16:42:06 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 9 Thu Feb 14 16:42:06 2008 : Debug: ++[eap] returns invalid Thu Feb 14 16:42:06 2008 : Debug: PEAP: Can't handle the return code 4 Thu Feb 14 16:42:06 2008 : Debug: rlm_eap: Handler failed in EAP/peap Thu Feb 14 16:42:06 2008 : Debug: rlm_eap: Failed in EAP select Thu Feb 14 16:42:06 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 9 Thu Feb 14 16:42:06 2008 : Debug: ++[eap] returns invalid Thu Feb 14 16:42:06 2008 : Debug: auth: Failed to validate the user. Thu Feb 14 16:42:06 2008 : Auth: Login incorrect: [myid@mynet.net/<via Auth-Type = EAP>] (from client sw-local port 33 cli 00-a9-40-0f-83-a5) ----------------- -- Best wishes, Dmitry Sergienko (SDA104-RIPE) Trifle Co., Ltd.
Dmitry Sergienko wrote:
Config file is the same as default example proxy-inner-tunnel in 2.0.2 release with modified realm name only.
I really don't understand. 1) default config 2) edit eap.conf, peap{} section to set proxy_tunneled_request_as_eap = no 3) edit eap.conf, peap{} section to set virtual_server = "proxy-inner-tunnel" 4) edit proxy.conf to add realm "example.com" with another RADIUS server. 5) send PEAP request. 6) verify that MS-CHAPv2 is proxied to second RADIUS server 7) verify that the supplicant receives EAP-MSCHAPv2 with MSCHAP Success. Alan DeKok.
Hi! Alan DeKok wrote:
Dmitry Sergienko wrote:
Config file is the same as default example proxy-inner-tunnel in 2.0.2 release with modified realm name only.
I really don't understand.
1) default config
Configuration from scratch. on Debian: cd freeradius-server-2.0.2 dpkg-buildpackage -rfakeroot -uc -b dpkg -i ../freeradius_2.0.2-0_i386.deb
2) edit eap.conf, peap{} section to set proxy_tunneled_request_as_eap = no 3) edit eap.conf, peap{} section to set virtual_server = "proxy-inner-tunnel"
also copied proxy-inner-tunnel from examples bundled with 2.0.2.
4) edit proxy.conf to add realm "example.com" with another RADIUS server.
done. also added client in clients.conf.
5) send PEAP request. 6) verify that MS-CHAPv2 is proxied to second RADIUS server
all correct. Answer from proxy is Access-Accept.
7) verify that the supplicant receives EAP-MSCHAPv2 with MSCHAP Success.
It's here. Both logs of xsupplicant and freeradius are available here (posting here exceeds the limit of 100Kb): http://web.apex.dp.ua/~trooper/fr2/fr202.log http://web.apex.dp.ua/~trooper/fr2/xsupplicant.log -- Best wishes, Dmitry Sergienko (SDA104-RIPE) Trifle Co., Ltd.
Dmitry Sergienko wrote:
Hi! Both logs of xsupplicant and freeradius are available here (posting here exceeds the limit of 100Kb):
Ah... you're using xsupplicant. It's sending an EAP-MSCHAPv2 ACK to the SUCCESS that the server sends. Apparently this is handled properly when the server isn't proxying. I'm not sure why it isn't handled when the server proxies the request. Alan DeKok.
Hi! Alan DeKok wrote:
Ah... you're using xsupplicant. It's sending an EAP-MSCHAPv2 ACK to the SUCCESS that the server sends. Apparently this is handled properly when the server isn't proxying. I'm not sure why it isn't handled when the server proxies the request.
Please give me some tips how/where to fix this issue. I'm somewhat lost while debugging this EAP stuff with tunnelling and proxying ;) -- Best wishes, Dmitry Sergienko (SDA104-RIPE) Trifle Co., Ltd.
Dmitry Sergienko wrote:
Please give me some tips how/where to fix this issue. I'm somewhat lost while debugging this EAP stuff with tunnelling and proxying ;)
It's rather complicated after a while. I'm not sure how it can be easily debugged... Alan DeKok.
Hi! Alan DeKok wrote:
Dmitry Sergienko wrote:
Please give me some tips how/where to fix this issue. I'm somewhat lost while debugging this EAP stuff with tunnelling and proxying ;)
It's rather complicated after a while. I'm not sure how it can be easily debugged...
Added some functions to make debugging easier and found out the following: There is a call of eaplist_add() in eap_post_proxy(): 541 if ((handler->eap_ds->request->code == PW_EAP_REQUEST) && 542 (handler->eap_ds->request->type.type >= PW_EAP_MD5)) { 543 eaplist_add(inst, handler); and in eaplist_add(): 271 handler->src_ipaddr = handler->request->packet->src_ipaddr; But during proxying handler->request->packet->src_ipaddr.ipaddr.ip4addr is zero: (gdb) p handler->request->packet->src_ipaddr $7 = {af = 2, ipaddr = {ip4addr = {s_addr = 0}, ip6addr = {in6_u = {u6_addr8 = "\000\000\000\000\220\006\030\b\215\b\b\000\000\000", u6_addr16 = {0, 0, 1680, 2072, 36260, 2056, 0, 0}, u6_addr32 = {0, 135792272, 134778276, 0}}}}} Then we're trying to find a session with correct ip address of NAS, i.e. 192.168.2.3 and eaplist_find() fails because it contains session with zero ipaddr. I'll try to debug deeper and figure out how to fix this correctly (and not to break anything else ;) -- Best wishes, Dmitry Sergienko (SDA104-RIPE) Trifle Co., Ltd.
Hi! Dmitry Sergienko wrote:
But during proxying handler->request->packet->src_ipaddr.ipaddr.ip4addr is zero:
I'll try to debug deeper and figure out how to fix this correctly (and not to break anything else ;)
At last it works. Patch is in attachment. I'm still not sure if this patch doesn't break anything so please double check it. I'm new to freeradius code. Here is the result: PEAP: Sending tunneled request EAP-Message = 0x020b00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "aaa" State = 0xc0688788c1639d2a0b378c391f825bde server proxy-inner-tunnel { Mon Feb 18 18:53:04 2008 : Debug: +- entering group authorize Mon Feb 18 18:53:04 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 9 Mon Feb 18 18:53:04 2008 : Debug: rlm_eap: EAP packet type response id 11 length 6 Mon Feb 18 18:53:04 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Mon Feb 18 18:53:04 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 9 Mon Feb 18 18:53:04 2008 : Debug: ++[eap] returns updated Mon Feb 18 18:53:04 2008 : Debug: ++[control] returns updated } # server proxy-inner-tunnel PEAP: Got tunneled reply RADIUS code 0 Mon Feb 18 18:53:04 2008 : Debug: PEAP: Calling authenticate in order to initiate tunneled EAP session. Mon Feb 18 18:53:04 2008 : Debug: +- entering group authenticate Mon Feb 18 18:53:04 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 9 Mon Feb 18 18:53:04 2008 : Debug: rlm_eap: Request found, released from the list Mon Feb 18 18:53:04 2008 : Debug: rlm_eap: EAP/mschapv2 Mon Feb 18 18:53:04 2008 : Debug: rlm_eap: processing type mschapv2 Mon Feb 18 18:53:04 2008 : Debug: rlm_eap: Freeing handler Mon Feb 18 18:53:04 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 9 Mon Feb 18 18:53:04 2008 : Debug: ++[eap] returns ok PEAP: Processing from tunneled session code 0x81a3380 2 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "aaa" Mon Feb 18 18:53:04 2008 : Debug: PEAP: Tunneled authentication was successful. Mon Feb 18 18:53:04 2008 : Debug: rlm_eap_peap: SUCCESS Mon Feb 18 18:53:04 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 9 Mon Feb 18 18:53:04 2008 : Debug: ++[eap] returns handled Sending Access-Challenge of id 128 to 192.168.2.3 port 8021 EAP-Message = 0x010c003b190017030100306ab8df262f8c6d2baed3a48cebc42431d0e21fdb1c045843655aece32052f1d927b38a0913526945e8d673551cf09b68 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x34e964c03de57d86becfe482ce4c450e Mon Feb 18 18:53:04 2008 : Debug: Finished request 9. Mon Feb 18 18:53:04 2008 : Debug: Going to the next request Mon Feb 18 18:53:04 2008 : Debug: Waking up in 0.9 seconds. Mon Feb 18 18:53:05 2008 : Debug: Cleaning up request 7 ID 126 with timestamp +18 Mon Feb 18 18:53:05 2008 : Debug: Waking up in 2.0 seconds. rad_recv: Access-Request packet from host 192.168.2.3 port 8021, id=129, length=295 Framed-MTU = 1466 NAS-IP-Address = 192.168.2.3 NAS-Identifier = "D-Link" User-Name = "myid@mynet.net" Service-Type = Framed-User NAS-Port = 33 NAS-Port-Type = Ethernet NAS-Port-Id = "ether3_33" Called-Station-Id = "00-15-e9-b8-79-dd" Calling-Station-Id = "00-a9-40-0f-83-a5" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" State = 0x34e964c03de57d86becfe482ce4c450e EAP-Message = 0x020c006019001703010020ba6525822b5e46cf96b43f8d5f3472ee0add04778e445cccee670a1323faf5751703010030f14f2456303f64be72a49607993cd63f327c6fff01e45d0b020e39714c106692f7bdddfc8b51df1163648d47b4b24ece Message-Authenticator = 0x4213abb85ac838f3426660c0304d3f84 Mon Feb 18 18:53:06 2008 : Debug: +- entering group authorize Mon Feb 18 18:53:06 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 10 Mon Feb 18 18:53:06 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 10 Mon Feb 18 18:53:06 2008 : Debug: ++[preprocess] returns ok Mon Feb 18 18:53:06 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 10 Mon Feb 18 18:53:06 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 10 Mon Feb 18 18:53:06 2008 : Debug: ++[chap] returns noop Mon Feb 18 18:53:06 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 10 Mon Feb 18 18:53:06 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 10 Mon Feb 18 18:53:06 2008 : Debug: ++[mschap] returns noop Mon Feb 18 18:53:06 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 10 Mon Feb 18 18:53:06 2008 : Debug: rlm_realm: Looking up realm "mynet.net" for User-Name = "myid@mynet.net" Mon Feb 18 18:53:06 2008 : Debug: rlm_realm: No such realm "mynet.net" Mon Feb 18 18:53:06 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 10 Mon Feb 18 18:53:06 2008 : Debug: ++[suffix] returns noop Mon Feb 18 18:53:06 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 10 Mon Feb 18 18:53:06 2008 : Debug: rlm_eap: EAP packet type response id 12 length 96 Mon Feb 18 18:53:06 2008 : Debug: rlm_eap: Continuing tunnel setup. Mon Feb 18 18:53:06 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 10 Mon Feb 18 18:53:06 2008 : Debug: ++[eap] returns ok Mon Feb 18 18:53:06 2008 : Debug: rad_check_password: Found Auth-Type EAP Mon Feb 18 18:53:06 2008 : Debug: auth: type "EAP" Mon Feb 18 18:53:06 2008 : Debug: +- entering group authenticate Mon Feb 18 18:53:06 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 10 Mon Feb 18 18:53:06 2008 : Debug: rlm_eap: Request found, released from the list Mon Feb 18 18:53:06 2008 : Debug: rlm_eap: EAP/peap Mon Feb 18 18:53:06 2008 : Debug: rlm_eap: processing type peap Mon Feb 18 18:53:06 2008 : Debug: rlm_eap_peap: Authenticate Mon Feb 18 18:53:06 2008 : Debug: rlm_eap_tls: processing TLS Mon Feb 18 18:53:06 2008 : Debug: eaptls_verify returned 7 Mon Feb 18 18:53:06 2008 : Debug: rlm_eap_tls: Done initial handshake Mon Feb 18 18:53:06 2008 : Debug: eaptls_process returned 7 Mon Feb 18 18:53:06 2008 : Debug: rlm_eap_peap: EAPTLS_OK Mon Feb 18 18:53:06 2008 : Debug: rlm_eap_peap: Session established. Decoding tunneled attributes. PEAP tunnel data in 0000: 02 0c 00 0b 21 80 03 00 02 00 01 Mon Feb 18 18:53:06 2008 : Debug: rlm_eap_peap: Received EAP-TLV response. Mon Feb 18 18:53:06 2008 : Debug: rlm_eap_peap: Success Mon Feb 18 18:53:06 2008 : Debug: rlm_eap: Freeing handler Mon Feb 18 18:53:06 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 10 Mon Feb 18 18:53:06 2008 : Debug: ++[eap] returns ok Mon Feb 18 18:53:06 2008 : Auth: Login OK: [myid@mynet.net/<via Auth-Type = EAP>] (from client sw-local port 33 cli 00-a9-40-0f-83-a5) Sending Access-Accept of id 129 to 192.168.2.3 port 8021 MS-MPPE-Recv-Key = 0x6c664fbeee0239086faa4ad89a9cbe491047d1ae131c6f8bf15ae8cb1fc522fc MS-MPPE-Send-Key = 0xb70a6ec74948a76e22f608d849458d7acd5ab5db4ff3834fdee3367dc722187d EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "myid@mynet.net" -- Best regards, Dmitry Sergienko
Dmitry Sergienko wrote:
At last it works. Patch is in attachment. I'm still not sure if this patch doesn't break anything so please double check it. I'm new to freeradius code.
The patch is correct. I've also added a similar patch to ttls.c Thanks. Alan DeKok.
participants (3)
-
A.L.M.Buxey@lboro.ac.uk -
Alan DeKok -
Dmitry Sergienko