What is this "group authentication"?
Gary Algier
gaa at ulticom.com
Mon Jan 9 19:27:12 CET 2006
Alan DeKok wrote:
> Gary Algier <gaa at ulticom.com> wrote:
>
>>I am trying to use the WinXP supplied supplicant and I am getting:
>> modcall: group authenticate returns invalid for request 41
>>
>>Can someone give me a hint as to what this means?
>
>
> Read the *rest* of the debug log above that to see what's going on.
I did and it I did not understand it (see below for the log). I thought
that perhaps there was some sort of groups I needed to setup.
>
>
>>When I use the WinXP bulitin supplicant in "Automatically use my
>>Windows login..." mode, Freeradius fails with the group
>>authentication message.
>
>
> It's not "group authentication", it's the "authentication" section
> of "radiusd.conf".
>
>
>>If I uncheck that and type a login
>>and password (but not a domain), it works fine. It never does
>>any sort of group check. If I supply a domain, it does the group
>>check (and fails). When does it check groups? What is it
>>checking?
>
>
> Read the *rest* of the debug log.
Here's the logs (when is fails with a domain supplied):
-------------------------------------------------------------------
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config: including file: /etc/ulcmit/raddb/clients.conf
Config: including file: /etc/ulcmit/raddb/snmp.conf
Config: including file: /etc/ulcmit/raddb/eap.conf
main: prefix = "/usr"
main: localstatedir = "/var"
main: logdir = "/var/log/radius"
main: libdir = "/usr/lib"
main: radacctdir = "/var/log/radius/radacct"
main: hostname_lookups = no
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 0
main: allow_core_dumps = no
main: log_stripped_names = no
main: log_file = "/var/log/radius/radius.log"
main: log_auth = no
main: log_auth_badpass = no
main: log_auth_goodpass = no
main: pidfile = "/var/run/radiusd/radiusd.pid"
main: user = "radiusd"
main: group = "radiusd"
main: usercollide = no
main: lower_user = "no"
main: lower_pass = "no"
main: nospace_user = "no"
main: nospace_pass = "no"
main: checkrad = "/usr/sbin/checkrad"
main: proxy_requests = no
security: max_attributes = 200
security: reject_delay = 1
security: status_server = no
main: debug_level = 0
read_config_files: reading dictionary
read_config_files: reading naslist
Using deprecated naslist file. Support for this will go away soon.
read_config_files: reading clients
read_config_files: reading realms
radiusd: entering modules setup
Module: Library search path is /usr/lib
Module: Loaded exec
exec: wait = yes
exec: program = "(null)"
exec: input_pairs = "request"
exec: output_pairs = "(null)"
exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded PAP
pap: encryption_scheme = "clear"
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded MS-CHAP
mschap: use_mppe = yes
mschap: require_encryption = no
mschap: require_strong = no
mschap: with_ntdomain_hack = no
mschap: passwd = "(null)"
mschap: authtype = "MS-CHAP"
mschap: ntlm_auth = "(null)"
Module: Instantiated mschap (mschap)
Module: Loaded Pam
pam: pam_auth = "radiusd"
Module: Instantiated pam (pam)
Module: Loaded System
unix: cache = no
unix: passwd = "(null)"
unix: shadow = "(null)"
unix: group = "(null)"
unix: radwtmp = "/var/log/radius/radwtmp"
unix: usegroup = no
unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded eap
eap: default_eap_type = "mschapv2"
eap: timer_expire = 60
eap: ignore_unknown_eap_types = no
eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
tls: rsa_key_exchange = no
tls: dh_key_exchange = yes
tls: rsa_key_length = 512
tls: dh_key_length = 512
tls: verify_depth = 0
tls: CA_path = "(null)"
tls: pem_file_type = yes
tls: private_key_file = "/etc/ulcmit/raddb/certs/pyrope.ulticom.com.key"
tls: certificate_file = "/etc/ulcmit/raddb/certs/pyrope.ulticom.com.crt"
tls: CA_file = "/etc/ulcmit/raddb/certs/ca.pem"
tls: private_key_password = "(null)"
tls: dh_file = "/etc/ulcmit/raddb/certs/dh"
tls: random_file = "/dev/urandom"
tls: fragment_size = 1024
tls: include_length = yes
tls: check_crl = no
tls: check_cert_cn = "(null)"
rlm_eap: Loaded and initialized type tls
ttls: default_eap_type = "md5"
ttls: copy_request_to_tunnel = no
ttls: use_tunneled_reply = no
rlm_eap: Loaded and initialized type ttls
peap: default_eap_type = "mschapv2"
peap: copy_request_to_tunnel = no
peap: use_tunneled_reply = no
peap: proxy_tunneled_request_as_eap = yes
rlm_eap: Loaded and initialized type peap
mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
preprocess: huntgroups = "/etc/ulcmit/raddb/huntgroups"
preprocess: hints = "/etc/ulcmit/raddb/hints"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line = 23
preprocess: with_ntdomain_hack = no
preprocess: with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded LDAP
ldap: server = "ldap.ulticom.com"
ldap: port = 389
ldap: net_timeout = 1
ldap: timeout = 4
ldap: timelimit = 3
ldap: identity = ""
ldap: tls_mode = no
ldap: start_tls = no
ldap: tls_cacertfile = "(null)"
ldap: tls_cacertdir = "(null)"
ldap: tls_certfile = "(null)"
ldap: tls_keyfile = "(null)"
ldap: tls_randfile = "(null)"
ldap: tls_require_cert = "allow"
ldap: password = ""
ldap: basedn = "dc=ulticom,dc=com"
ldap: filter = "(&(objectclass=person)(uid=%{exec:/etc/ulcmit/raddb/nodomain %{User-Name}}))"
ldap: base_filter = "(objectclass=*)"
ldap: default_profile = "(null)"
ldap: profile_attribute = "(null)"
ldap: password_header = "(null)"
ldap: password_attribute = "(null)"
ldap: access_attr = "uid"
ldap: groupname_attribute = "cn"
ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniq
ueNames)(uniquemember=%{Ldap-UserDn})))"
ldap: groupmembership_attribute = "(null)"
ldap: dictionary_mapping = "/etc/ulcmit/raddb/ldap.attrmap"
ldap: ldap_debug = 0
ldap: ldap_connections_number = 5
ldap: compare_check_items = no
ldap: access_attr_used_for_allow = yes
ldap: do_xlat = yes
lm_ldap: Registering ldap_groupcmp for Ldap-Group
rlm_ldap: Registering ldap_xlat with xlat_name ldap
rlm_ldap: reading ldap<->radius mappings from file /etc/ulcmit/raddb/ldap.attrmap
rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type
rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use
rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id
rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id
rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT
rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration
rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type
rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol
rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address
rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask
rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route
rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing
rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id
rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU
rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression
rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host
rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service
rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port
rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number
rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id
rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network
rlm_ldap: LDAP radiusClass mapped to RADIUS Class
rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout
rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout
rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action
rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service
rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node
rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group
rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link
rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network
rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone
rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit
rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port
conns: 126510
Module: Instantiated ldap (ldap)
Module: Loaded files
files: usersfile = "/etc/ulcmit/raddb/users"
files: acctusersfile = "/etc/ulcmit/raddb/acct_users"
files: preproxy_usersfile = "/etc/ulcmit/raddb/preproxy_users"
files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename = "/var/log/radius/radutmp"
radutmp: username = "%{User-Name}"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.
rad_recv: Access-Request packet from host 172.25.16.9:1230, id=85, length=213
Framed-MTU = 1480
NAS-IP-Address = 172.25.16.9
NAS-Identifier = "hp-50-9"
User-Name = "MALACHITE\\gaa"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 1
NAS-Port-Type = Ethernet
NAS-Port-Id = "1"
Called-Station-Id = "00-11-85-40-71-ff"
Calling-Station-Id = "00-14-22-dc-9b-16"
Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "50"
EAP-Message = 0x02010012014d414c4143484954455c676161
Message-Authenticator = 0x9fe6191e75699a28156146fa98342f4d
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module "preprocess" returns ok for request 0
modcall[authorize]: module "chap" returns noop for request 0
modcall[authorize]: module "mschap" returns noop for request 0
rlm_ldap: - authorize
rlm_ldap: performing user authorization for MALACHITE\gaa
radius_xlat: Running registered xlat function of module exec for string '/etc/ulcmit/raddb/nodomain %{User-Name}'
rlm_exec (exec): Executing /etc/ulcmit/raddb/nodomain %{User-Name}
radius_xlat: '/etc/ulcmit/raddb/nodomain MALACHITE\\gaa'
Exec-Program: /etc/ulcmit/raddb/nodomain MALACHITE\\gaa
Exec-Program output: gaa
Exec-Program-Wait: plaintext: gaa
Exec-Program: returned: 0
rlm_exec (exec): result 0
radius_xlat: '(&(objectclass=person)(uid=gaa))'
radius_xlat: 'dc=ulticom,dc=com'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: attempting LDAP reconnection
rlm_ldap: (re)connect to ldap.ulticom.com:389, authentication 0
rlm_ldap: bind as / to ldap.ulticom.com:389
rlm_ldap: waiting for bind result ...
rlm_ldap: Bind was successful
rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=gaa))
rlm_ldap: checking if remote access for MALACHITE\gaa is allowed by uid
rlm_ldap: looking for check items in directory...
rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21
rlm_ldap: Adding sambaNTPassword as NT-Password, value E6DEABE732705BC462E2195793EDAF37 & op=21
rlm_ldap: Adding sambaLMPassword as LM-Password, value D388721E3CDDC12DAAD3B435B51404EE & op=21
rlm_ldap: looking for reply items in directory...
rlm_ldap: user MALACHITE\gaa authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
modcall[authorize]: module "ldap" returns ok for request 0
rlm_eap: EAP packet type response id 1 length 18
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 0
users: Matched entry DEFAULT at line 153
users: Matched entry DEFAULT at line 176
users: Matched entry DEFAULT at line 188
modcall[authorize]: module "files" returns ok for request 0
modcall: group authorize returns updated for request 0
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
rlm_eap: EAP Identity
rlm_eap: processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
modcall[authenticate]: module "eap" returns handled for request 0
modcall: group authenticate returns handled for request 0
Sending Access-Challenge of id 85 to 172.25.16.9:1230
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
Framed-Protocol = PPP
Framed-Compression = Van-Jacobson-TCP-IP
EAP-Message = 0x010200271a010200221010130293c1f011fcd0e66b5d6118d2344d414c4143484954455c676161
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xd78143c9277890d881701cfb419ad903
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 172.25.16.9:1230, id=86, length=219
Framed-MTU = 1480
NAS-IP-Address = 172.25.16.9
NAS-Identifier = "hp-50-9"
User-Name = "MALACHITE\\gaa"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 1
NAS-Port-Type = Ethernet
NAS-Port-Id = "1"
Called-Station-Id = "00-11-85-40-71-ff"
Calling-Station-Id = "00-14-22-dc-9b-16"
Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "50"
State = 0xd78143c9277890d881701cfb419ad903
EAP-Message = 0x020200060319
Message-Authenticator = 0xd461ecf0394aed21f586e3620dd34b0a
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
modcall[authorize]: module "preprocess" returns ok for request 1
modcall[authorize]: module "chap" returns noop for request 1
modcall[authorize]: module "mschap" returns noop for request 1
rlm_ldap: - authorize
rlm_ldap: performing user authorization for MALACHITE\gaa
radius_xlat: Running registered xlat function of module exec for string '/etc/ulcmit/raddb/nodomain %{User-Name}'
rlm_exec (exec): Executing /etc/ulcmit/raddb/nodomain %{User-Name}
radius_xlat: '/etc/ulcmit/raddb/nodomain MALACHITE\\gaa'
Exec-Program: /etc/ulcmit/raddb/nodomain MALACHITE\\gaa
Exec-Program output: gaa
Exec-Program-Wait: plaintext: gaa
Exec-Program: returned: 0
rlm_exec (exec): result 0
radius_xlat: '(&(objectclass=person)(uid=gaa))'
radius_xlat: 'dc=ulticom,dc=com'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=gaa))
rlm_ldap: checking if remote access for MALACHITE\gaa is allowed by uid
rlm_ldap: looking for check items in directory...
rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21
rlm_ldap: Adding sambaNTPassword as NT-Password, value E6DEABE732705BC462E2195793EDAF37 & op=21
rlm_ldap: Adding sambaLMPassword as LM-Password, value D388721E3CDDC12DAAD3B435B51404EE & op=21
rlm_ldap: looking for reply items in directory...
rlm_ldap: user MALACHITE\gaa authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
modcall[authorize]: module "ldap" returns ok for request 1
rlm_eap: EAP packet type response id 2 length 6
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 1
users: Matched entry DEFAULT at line 153
users: Matched entry DEFAULT at line 176
users: Matched entry DEFAULT at line 188
modcall[authorize]: module "files" returns ok for request 1
modcall: group authorize returns updated for request 1
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 1
rlm_eap: Request found, released from the list
rlm_eap: EAP NAK
rlm_eap: EAP-NAK asked for EAP-Type/peap
rlm_eap: processing type tls
rlm_eap_tls: Initiate
rlm_eap_tls: Start returned 1
modcall[authenticate]: module "eap" returns handled for request 1
modcall: group authenticate returns handled for request 1
Sending Access-Challenge of id 86 to 172.25.16.9:1230
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
Framed-Protocol = PPP
Framed-Compression = Van-Jacobson-TCP-IP
EAP-Message = 0x010300061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xd5b41d44d5a957756e939fddd080ca71
Finished request 1
Going to the next request
--- Walking the entire request list ---
Waking up in 5 seconds...
rad_recv: Access-Request packet from host 172.25.16.9:1230, id=87, length=293
Framed-MTU = 1480
NAS-IP-Address = 172.25.16.9
NAS-Identifier = "hp-50-9"
User-Name = "MALACHITE\\gaa"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 1
NAS-Port-Type = Ethernet
NAS-Port-Id = "1"
Called-Station-Id = "00-11-85-40-71-ff"
Calling-Station-Id = "00-14-22-dc-9b-16"
Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "50"
State = 0xd5b41d44d5a957756e939fddd080ca71
EAP-Message = 0x0203005019800000004616030100410100003d030143c2a6d3a3ef3f81f7b63ab1c666ff6a16bd9a8cf8dcb4c
2f89bc1ebe8949b5e00001600040005000a000900640062000300060013001200630100
Message-Authenticator = 0x2f00f7f94a7e8773822061af30b65184
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 2
modcall[authorize]: module "preprocess" returns ok for request 2
modcall[authorize]: module "chap" returns noop for request 2
modcall[authorize]: module "mschap" returns noop for request 2
rlm_ldap: - authorize
rlm_ldap: performing user authorization for MALACHITE\gaa
radius_xlat: Running registered xlat function of module exec for string '/etc/ulcmit/raddb/nodomain %{User-Name}'
rlm_exec (exec): Executing /etc/ulcmit/raddb/nodomain %{User-Name}
radius_xlat: '/etc/ulcmit/raddb/nodomain MALACHITE\\gaa'
Exec-Program: /etc/ulcmit/raddb/nodomain MALACHITE\\gaa
Exec-Program output: gaa
Exec-Program-Wait: plaintext: gaa
Exec-Program: returned: 0
rlm_exec (exec): result 0
radius_xlat: '(&(objectclass=person)(uid=gaa))'
radius_xlat: 'dc=ulticom,dc=com'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=gaa))
rlm_ldap: checking if remote access for MALACHITE\gaa is allowed by uid
rlm_ldap: looking for check items in directory...
rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21
rlm_ldap: Adding sambaNTPassword as NT-Password, value E6DEABE732705BC462E2195793EDAF37 & op=21
rlm_ldap: Adding sambaLMPassword as LM-Password, value D388721E3CDDC12DAAD3B435B51404EE & op=21
rlm_ldap: looking for reply items in directory...
rlm_ldap: user MALACHITE\gaa authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
modcall[authorize]: module "ldap" returns ok for request 2
rlm_eap: EAP packet type response id 3 length 80
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 2
users: Matched entry DEFAULT at line 153
users: Matched entry DEFAULT at line 176
users: Matched entry DEFAULT at line 188
modcall[authorize]: module "files" returns ok for request 2
modcall: group authorize returns updated for request 2
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 2
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Length Included
eaptls_verify returned 11
(other): before/accept initialization
TLS_accept: before/accept initialization
rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello
TLS_accept: SSLv3 read client hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello
TLS_accept: SSLv3 write server hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 02b0], Certificate
TLS_accept: SSLv3 write certificate A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
TLS_accept: SSLv3 write server done A
TLS_accept: SSLv3 flush data
TLS_accept:error in SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
eaptls_process returned 13
rlm_eap_peap: EAPTLS_HANDLED
modcall[authenticate]: module "eap" returns handled for request 2
modcall: group authenticate returns handled for request 2
Sending Access-Challenge of id 87 to 172.25.16.9:1230
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
Framed-Protocol = PPP
Framed-Compression = Van-Jacobson-TCP-IP
EAP-Message = 0x010403131900160301004a02000046030143c2a6d9dde76b5c1689d53cd6a956ed1e0867963fba2ef75e39da4
21beaf4352054ca69f97e0231c3c45b9e911063b13aef76e71ebbb3bee335c185ba5419474f00040016030102b00b0002ac0002a90002a630
8202a23082020b020104300d06092a864886f70d01010405003081a6310b3009060355040613025553311330110603550408130a4e6577204
a6572736579311330110603550407130a4d742e204c617572656c31143012060355040a130b556c7469636f6d20496e633121301f06035504
0b1318496e666f726d6174696f6e20546563686e6f6c6f67696573311330110603550403130a55
EAP-Message = 0x6c7469636f6d204954311f301d06092a864886f70d0109011610726f6f7440756c7469636f6d2e636f6d301e1
70d3035313231353138353031365a170d3039313231353138353031365a30818b310b3009060355040613025553311330110603550408130a
4e6577204a6572736579311330110603550407130a4d742e204c617572656c31143012060355040a130b556c7469636f6d20496e63311b301
9060355040313127079726f70652e756c7469636f6d2e636f6d311f301d06092a864886f70d01090116106365727440756c7469636f6d2e63
6f6d30819f300d06092a864886f70d010101050003818d0030818902818100bcef4f9735a4fe70
EAP-Message = 0xc7b49e61554ceca88f896391f54840e9b045c7bc1d2d8172729a93ea6a3caf74689b1d5a94502bfd80fb536a4
3ee57c997e498b7068b18517d6a7aa3b7c69e7a8716317b0658697e218d78a36048a0222cc82e0085d058c49a137b476ef1365a0b02482baf
be65244841d9468d8ac0d82e07b35d99b379e90203010001300d06092a864886f70d010104050003818100be1b22a1d77b5eee2cd1f7d6966
034b778a81596cc6e7e40963d67df46951b36f435103da62babcbba99f22ecc5f13e1097e6f843f587ed9f539ca0c2a7a5bed4e86b1c8d669
927373d3553717a312a35df8f562841ebd1dffcf66e51e8682b7eb47851a2737bf327bc2b1a8e0
EAP-Message = 0x3ac5b28fb2e6fd549c30cb4c1e7e0a37a7208a16030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x28abe2f9101132c971a07e16302eaca7
Finished request 2
Going to the next request
Waking up in 5 seconds...
rad_recv: Access-Request packet from host 172.25.16.9:1230, id=88, length=405
Framed-MTU = 1480
NAS-IP-Address = 172.25.16.9
NAS-Identifier = "hp-50-9"
User-Name = "MALACHITE\\gaa"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 1
NAS-Port-Type = Ethernet
NAS-Port-Id = "1"
Called-Station-Id = "00-11-85-40-71-ff"
Calling-Station-Id = "00-14-22-dc-9b-16"
Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "50"
State = 0x28abe2f9101132c971a07e16302eaca7
EAP-Message = 0x020400c01980000000b616030100861000008200803af0872cb540732a24029c8e11a6bd34fac1a865f5394d0
b135090e3852e522c2bade22fa4a6e57b25c84ee69236b5b9d38d068f0a198c5c8c69e17d8e27a52ab1763c047ab8f9c7300b1456735a7c92
b666a56341317ea5cd903d6aa3cf162d64c2d7e9c880721fcbe264fac1ac82beb50ac5de3269dc5bd9a6c0092b46c95314030100010116030
10020b343d463f4df0f2defd061db0cab5226e4c130fd52f1960dc217ede867b1defb
Message-Authenticator = 0x389c6d2df6ebcbc16c53d91c4ae3b280
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 3
modcall[authorize]: module "preprocess" returns ok for request 3
modcall[authorize]: module "chap" returns noop for request 3
modcall[authorize]: module "mschap" returns noop for request 3
rlm_ldap: - authorize
rlm_ldap: performing user authorization for MALACHITE\gaa
radius_xlat: Running registered xlat function of module exec for string '/etc/ulcmit/raddb/nodomain %{User-Name}'
rlm_exec (exec): Executing /etc/ulcmit/raddb/nodomain %{User-Name}
radius_xlat: '/etc/ulcmit/raddb/nodomain MALACHITE\\gaa'
Exec-Program: /etc/ulcmit/raddb/nodomain MALACHITE\\gaa
Exec-Program output: gaa
Exec-Program-Wait: plaintext: gaa
Exec-Program: returned: 0
rlm_exec (exec): result 0
radius_xlat: '(&(objectclass=person)(uid=gaa))'
radius_xlat: 'dc=ulticom,dc=com'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=gaa))
rlm_ldap: checking if remote access for MALACHITE\gaa is allowed by uid
rlm_ldap: looking for check items in directory...
rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21
rlm_ldap: Adding sambaNTPassword as NT-Password, value E6DEABE732705BC462E2195793EDAF37 & op=21
rlm_ldap: Adding sambaLMPassword as LM-Password, value D388721E3CDDC12DAAD3B435B51404EE & op=21
rlm_ldap: looking for reply items in directory...
rlm_ldap: user MALACHITE\gaa authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
modcall[authorize]: module "ldap" returns ok for request 3
rlm_eap: EAP packet type response id 4 length 192
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 3
users: Matched entry DEFAULT at line 153
users: Matched entry DEFAULT at line 176
users: Matched entry DEFAULT at line 188
modcall[authorize]: module "files" returns ok for request 3
modcall: group authorize returns updated for request 3
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 3
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Length Included
eaptls_verify returned 11
rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange
TLS_accept: SSLv3 read client key exchange A
rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001]
rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished
TLS_accept: SSLv3 read finished A
rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001]
TLS_accept: SSLv3 write change cipher spec A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished
TLS_accept: SSLv3 write finished A
TLS_accept: SSLv3 flush data
(other): SSL negotiation finished successfully
SSL Connection Established
eaptls_process returned 13
rlm_eap_peap: EAPTLS_HANDLED
modcall[authenticate]: module "eap" returns handled for request 3
modcall: group authenticate returns handled for request 3
Sending Access-Challenge of id 88 to 172.25.16.9:1230
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
Framed-Protocol = PPP
Framed-Compression = Van-Jacobson-TCP-IP
EAP-Message = 0x0105003119001403010001011603010020450d43f8fe77d406da967e25cb20130b9138134590d30600839dbca
a90009313
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x41ecdb8ff87e2ebb8bd9d9ab845414ad
Finished request 3
Going to the next request
Waking up in 5 seconds...
rad_recv: Access-Request packet from host 172.25.16.9:1230, id=89, length=219
Framed-MTU = 1480
NAS-IP-Address = 172.25.16.9
NAS-Identifier = "hp-50-9"
User-Name = "MALACHITE\\gaa"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 1
NAS-Port-Type = Ethernet
NAS-Port-Id = "1"
Called-Station-Id = "00-11-85-40-71-ff"
Calling-Station-Id = "00-14-22-dc-9b-16"
Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "50"
State = 0x41ecdb8ff87e2ebb8bd9d9ab845414ad
EAP-Message = 0x020500061900
Message-Authenticator = 0x82d48fdee79673d1b2d6e19af9262a62
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 4
modcall[authorize]: module "preprocess" returns ok for request 4
modcall[authorize]: module "chap" returns noop for request 4
modcall[authorize]: module "mschap" returns noop for request 4
rlm_ldap: - authorize
rlm_ldap: performing user authorization for MALACHITE\gaa
radius_xlat: Running registered xlat function of module exec for string '/etc/ulcmit/raddb/nodomain %{User-Name}'
rlm_exec (exec): Executing /etc/ulcmit/raddb/nodomain %{User-Name}
radius_xlat: '/etc/ulcmit/raddb/nodomain MALACHITE\\gaa'
Exec-Program: /etc/ulcmit/raddb/nodomain MALACHITE\\gaa
Exec-Program output: gaa
Exec-Program-Wait: plaintext: gaa
Exec-Program: returned: 0
rlm_exec (exec): result 0
radius_xlat: '(&(objectclass=person)(uid=gaa))'
radius_xlat: 'dc=ulticom,dc=com'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=gaa))
rlm_ldap: checking if remote access for MALACHITE\gaa is allowed by uid
rlm_ldap: looking for check items in directory...
rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21
rlm_ldap: Adding sambaNTPassword as NT-Password, value E6DEABE732705BC462E2195793EDAF37 & op=21
rlm_ldap: Adding sambaLMPassword as LM-Password, value D388721E3CDDC12DAAD3B435B51404EE & op=21
rlm_ldap: looking for reply items in directory...
rlm_ldap: user MALACHITE\gaa authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
modcall[authorize]: module "ldap" returns ok for request 4
rlm_eap: EAP packet type response id 5 length 6
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 4
users: Matched entry DEFAULT at line 153
users: Matched entry DEFAULT at line 176
users: Matched entry DEFAULT at line 188
modcall[authorize]: module "files" returns ok for request 4
modcall: group authorize returns updated for request 4
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 4
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
rlm_eap_tls: ack handshake is finished
eaptls_verify returned 3
eaptls_process returned 3
rlm_eap_peap: EAPTLS_SUCCESS
modcall[authenticate]: module "eap" returns handled for request 4
modcall: group authenticate returns handled for request 4
Sending Access-Challenge of id 89 to 172.25.16.9:1230
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
Framed-Protocol = PPP
Framed-Compression = Van-Jacobson-TCP-IP
EAP-Message = 0x01060020190017030100153b60c494388f8168550229442e6f575b8efa2eee31
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xe5aab6b483e096944c4c374392e35c98
Finished request 4
Going to the next request
Waking up in 5 seconds...
rad_recv: Access-Request packet from host 172.25.16.9:1230, id=90, length=254
Framed-MTU = 1480
NAS-IP-Address = 172.25.16.9
NAS-Identifier = "hp-50-9"
User-Name = "MALACHITE\\gaa"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 1
NAS-Port-Type = Ethernet
NAS-Port-Id = "1"
Called-Station-Id = "00-11-85-40-71-ff"
Calling-Station-Id = "00-14-22-dc-9b-16"
Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "50"
State = 0xe5aab6b483e096944c4c374392e35c98
EAP-Message = 0x020600291900170301001eab64380cecc1f7985fde402c803b5802088d260b7fb1fe361005032f4c0d
Message-Authenticator = 0xe357fd824a4477214b07ff0fcad1828f
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 5
modcall[authorize]: module "preprocess" returns ok for request 5
modcall[authorize]: module "chap" returns noop for request 5
modcall[authorize]: module "mschap" returns noop for request 5
rlm_ldap: - authorize
rlm_ldap: performing user authorization for MALACHITE\gaa
radius_xlat: Running registered xlat function of module exec for string '/etc/ulcmit/raddb/nodomain %{User-Name}'
rlm_exec (exec): Executing /etc/ulcmit/raddb/nodomain %{User-Name}
radius_xlat: '/etc/ulcmit/raddb/nodomain MALACHITE\\gaa'
Exec-Program: /etc/ulcmit/raddb/nodomain MALACHITE\\gaa
Exec-Program output: gaa
Exec-Program-Wait: plaintext: gaa
Exec-Program: returned: 0
rlm_exec (exec): result 0
radius_xlat: '(&(objectclass=person)(uid=gaa))'
radius_xlat: 'dc=ulticom,dc=com'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=gaa))
rlm_ldap: checking if remote access for MALACHITE\gaa is allowed by uid
rlm_ldap: looking for check items in directory...
rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21
rlm_ldap: Adding sambaNTPassword as NT-Password, value E6DEABE732705BC462E2195793EDAF37 & op=21
rlm_ldap: Adding sambaLMPassword as LM-Password, value D388721E3CDDC12DAAD3B435B51404EE & op=21
rlm_ldap: looking for reply items in directory...
rlm_ldap: user MALACHITE\gaa authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
modcall[authorize]: module "ldap" returns ok for request 5
rlm_eap: EAP packet type response id 6 length 41
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 5
users: Matched entry DEFAULT at line 153
users: Matched entry DEFAULT at line 176
users: Matched entry DEFAULT at line 188
modcall[authorize]: module "files" returns ok for request 5
modcall: group authorize returns updated for request 5
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 5
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
eaptls_process returned 7
rlm_eap_peap: EAPTLS_OK
rlm_eap_peap: Session established. Decoding tunneled attributes.
rlm_eap_peap: Identity - MALACHITE\gaa
rlm_eap_peap: Tunneled data is valid.
PEAP: Got tunneled EAP-Message
EAP-Message = 0x02060012014d414c4143484954455c676161
PEAP: Got tunneled identity of MALACHITE\gaa
PEAP: Setting default EAP type for tunneled EAP session.
PEAP: Setting User-Name to MALACHITE\gaa
PEAP: Sending tunneled request
EAP-Message = 0x02060012014d414c4143484954455c676161
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "MALACHITE\\gaa"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 5
modcall[authorize]: module "preprocess" returns ok for request 5
modcall[authorize]: module "chap" returns noop for request 5
modcall[authorize]: module "mschap" returns noop for request 5
rlm_ldap: - authorize
rlm_ldap: performing user authorization for MALACHITE\gaa
radius_xlat: Running registered xlat function of module exec for string '/etc/ulcmit/raddb/nodomain %{User-Name}'
rlm_exec (exec): Executing /etc/ulcmit/raddb/nodomain %{User-Name}
radius_xlat: '/etc/ulcmit/raddb/nodomain MALACHITE\\gaa'
Exec-Program: /etc/ulcmit/raddb/nodomain MALACHITE\\gaa
Exec-Program output: gaa
Exec-Program-Wait: plaintext: gaa
Exec-Program: returned: 0
rlm_exec (exec): result 0
radius_xlat: '(&(objectclass=person)(uid=gaa))'
radius_xlat: 'dc=ulticom,dc=com'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=gaa))
rlm_ldap: checking if remote access for MALACHITE\gaa is allowed by uid
rlm_ldap: looking for check items in directory...
rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21
rlm_ldap: Adding sambaNTPassword as NT-Password, value E6DEABE732705BC462E2195793EDAF37 & op=21
rlm_ldap: Adding sambaLMPassword as LM-Password, value D388721E3CDDC12DAAD3B435B51404EE & op=21
rlm_ldap: looking for reply items in directory...
rlm_ldap: user MALACHITE\gaa authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
modcall[authorize]: module "ldap" returns ok for request 5
rlm_eap: EAP packet type response id 6 length 18
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 5
users: Matched entry DEFAULT at line 153
modcall[authorize]: module "files" returns ok for request 5
modcall: group authorize returns updated for request 5
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 5
rlm_eap: EAP Identity
rlm_eap: processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
modcall[authenticate]: module "eap" returns handled for request 5
modcall: group authenticate returns handled for request 5
PEAP: Got tunneled reply RADIUS code 11
EAP-Message = 0x010700271a010700221038ab51172b080f7780d8377e3294d6904d414c4143484954455c676161
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x44291341705504e0490ffb683cbdcc1d
PEAP: Processing from tunneled session code 14ff38 11
EAP-Message = 0x010700271a010700221038ab51172b080f7780d8377e3294d6904d414c4143484954455c676161
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x44291341705504e0490ffb683cbdcc1d
PEAP: Got tunneled Access-Challenge
modcall[authenticate]: module "eap" returns handled for request 5
modcall: group authenticate returns handled for request 5
Sending Access-Challenge of id 90 to 172.25.16.9:1230
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
Framed-Protocol = PPP
Framed-Compression = Van-Jacobson-TCP-IP
EAP-Message = 0x0107003e1900170301003385e6247dbf02066d6ab45d4545985a79f7c28211fabcccb73f103eecfc028e95c15
cabfd387fc1b9bb1559c9c52c251e4eabc2
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x46cf8fa85528152e10d8974266365efd
Finished request 5
Going to the next request
Waking up in 5 seconds...
rad_recv: Access-Request packet from host 172.25.16.9:1230, id=91, length=308
Framed-MTU = 1480
NAS-IP-Address = 172.25.16.9
NAS-Identifier = "hp-50-9"
User-Name = "MALACHITE\\gaa"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 1
NAS-Port-Type = Ethernet
NAS-Port-Id = "1"
Called-Station-Id = "00-11-85-40-71-ff"
Calling-Station-Id = "00-14-22-dc-9b-16"
Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "50"
State = 0x46cf8fa85528152e10d8974266365efd
EAP-Message = 0x0207005f19001703010054b53b33a93bff2ba1d6471508b12db69f2e1a45317218bc2c1077ed89ddd0f950bf8
74424af9c20676b66bbf453479c7460ea52ba0c2d4aad001b99663187561a812eafe2266556d6f76e93ccad61748a509c24d5
Message-Authenticator = 0xee7a225857e3d13f27a7e7580b60f627
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 6
modcall[authorize]: module "preprocess" returns ok for request 6
modcall[authorize]: module "chap" returns noop for request 6
modcall[authorize]: module "mschap" returns noop for request 6
rlm_ldap: - authorize
rlm_ldap: performing user authorization for MALACHITE\gaa
radius_xlat: Running registered xlat function of module exec for string '/etc/ulcmit/raddb/nodomain %{User-Name}'
rlm_exec (exec): Executing /etc/ulcmit/raddb/nodomain %{User-Name}
radius_xlat: '/etc/ulcmit/raddb/nodomain MALACHITE\\gaa'
Exec-Program: /etc/ulcmit/raddb/nodomain MALACHITE\\gaa
Exec-Program output: gaa
Exec-Program-Wait: plaintext: gaa
Exec-Program: returned: 0
rlm_exec (exec): result 0
radius_xlat: '(&(objectclass=person)(uid=gaa))'
radius_xlat: 'dc=ulticom,dc=com'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=gaa))
rlm_ldap: checking if remote access for MALACHITE\gaa is allowed by uid
rlm_ldap: looking for check items in directory...
rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21
rlm_ldap: Adding sambaNTPassword as NT-Password, value E6DEABE732705BC462E2195793EDAF37 & op=21
rlm_ldap: Adding sambaLMPassword as LM-Password, value D388721E3CDDC12DAAD3B435B51404EE & op=21
rlm_ldap: looking for reply items in directory...
rlm_ldap: user MALACHITE\gaa authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
modcall[authorize]: module "ldap" returns ok for request 6
rlm_eap: EAP packet type response id 7 length 95
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 6
users: Matched entry DEFAULT at line 153
users: Matched entry DEFAULT at line 176
users: Matched entry DEFAULT at line 188
modcall[authorize]: module "files" returns ok for request 6
modcall: group authorize returns updated for request 6
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 6
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
eaptls_process returned 7
rlm_eap_peap: EAPTLS_OK
rlm_eap_peap: Session established. Decoding tunneled attributes.
rlm_eap_peap: EAP type mschapv2
rlm_eap_peap: Tunneled data is valid.
PEAP: Got tunneled EAP-Message
EAP-Message = 0x020700481a02070043313e60a45540ab5f7c421378d3c273a6bf00000000000000006b001b6efee1b5e7988dc
e396f73e31d055c512861885cfa004d414c4143484954455c676161
PEAP: Setting User-Name to MALACHITE\gaa
PEAP: Adding old state with 44 29
PEAP: Sending tunneled request
EAP-Message = 0x020700481a02070043313e60a45540ab5f7c421378d3c273a6bf00000000000000006b001b6efee1b5e7988dc
e396f73e31d055c512861885cfa004d414c4143484954455c676161
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "MALACHITE\\gaa"
State = 0x44291341705504e0490ffb683cbdcc1d
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 6
modcall[authorize]: module "preprocess" returns ok for request 6
modcall[authorize]: module "chap" returns noop for request 6
modcall[authorize]: module "mschap" returns noop for request 6
rlm_ldap: - authorize
rlm_ldap: performing user authorization for MALACHITE\gaa
radius_xlat: Running registered xlat function of module exec for string '/etc/ulcmit/raddb/nodomain %{User-Name}'
rlm_exec (exec): Executing /etc/ulcmit/raddb/nodomain %{User-Name}
radius_xlat: '/etc/ulcmit/raddb/nodomain MALACHITE\\gaa'
Exec-Program: /etc/ulcmit/raddb/nodomain MALACHITE\\gaa
Exec-Program output: gaa
Exec-Program-Wait: plaintext: gaa
Exec-Program: returned: 0
rlm_exec (exec): result 0
radius_xlat: '(&(objectclass=person)(uid=gaa))'
radius_xlat: 'dc=ulticom,dc=com'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=gaa))
rlm_ldap: checking if remote access for MALACHITE\gaa is allowed by uid
rlm_ldap: looking for check items in directory...
rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21
rlm_ldap: Adding sambaNTPassword as NT-Password, value E6DEABE732705BC462E2195793EDAF37 & op=21
rlm_ldap: Adding sambaLMPassword as LM-Password, value D388721E3CDDC12DAAD3B435B51404EE & op=21
rlm_ldap: looking for reply items in directory...
rlm_ldap: user MALACHITE\gaa authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
modcall[authorize]: module "ldap" returns ok for request 6
rlm_eap: EAP packet type response id 7 length 72
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 6
users: Matched entry DEFAULT at line 153
modcall[authorize]: module "files" returns ok for request 6
modcall: group authorize returns updated for request 6
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 6
rlm_eap: Request found, released from the list
rlm_eap: EAP/mschapv2
rlm_eap: processing type mschapv2
Processing the authenticate section of radiusd.conf
modcall: entering group Auth-Type for request 6
rlm_mschap: Found LM-Password
rlm_mschap: Found NT-Password
rlm_mschap: NT Domain delimeter found, should we have enabled with_ntdomain_hack?
rlm_mschap: Told to do MS-CHAPv2 for MALACHITE\gaa with NT-Password
rlm_mschap: FAILED: MS-CHAP2-Response is incorrect
modcall[authenticate]: module "mschap" returns reject for request 6
modcall: group Auth-Type returns reject for request 6
rlm_eap: Freeing handler
modcall[authenticate]: module "eap" returns reject for request 6
modcall: group authenticate returns reject for request 6
auth: Failed to validate the user.
PEAP: Got tunneled reply RADIUS code 3
MS-CHAP-Error = "\007E=691 R=1"
EAP-Message = 0x04070004
Message-Authenticator = 0x00000000000000000000000000000000
PEAP: Processing from tunneled session code 150d40 3
MS-CHAP-Error = "\007E=691 R=1"
EAP-Message = 0x04070004
Message-Authenticator = 0x00000000000000000000000000000000
PEAP: Tunneled authentication was rejected.
rlm_eap_peap: FAILURE
modcall[authenticate]: module "eap" returns handled for request 6
modcall: group authenticate returns handled for request 6
Sending Access-Challenge of id 91 to 172.25.16.9:1230
Framed-IP-Address = 255.255.255.254
Framed-MTU = 576
Service-Type = Framed-User
Framed-Protocol = PPP
Framed-Compression = Van-Jacobson-TCP-IP
EAP-Message = 0x010800261900170301001b80744293aa74be02bac75f0751b543b5c4a3da2b05405537e1d50b
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x5c53e02f3defbe5281c56129dbab5ac0
Finished request 6
Going to the next request
Waking up in 5 seconds...
rad_recv: Access-Request packet from host 172.25.16.9:1230, id=92, length=251
Framed-MTU = 1480
NAS-IP-Address = 172.25.16.9
NAS-Identifier = "hp-50-9"
User-Name = "MALACHITE\\gaa"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 1
NAS-Port-Type = Ethernet
NAS-Port-Id = "1"
Called-Station-Id = "00-11-85-40-71-ff"
Calling-Station-Id = "00-14-22-dc-9b-16"
Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "50"
State = 0x5c53e02f3defbe5281c56129dbab5ac0
EAP-Message = 0x020800261900170301001bb607670cf9aa0e0f599f7dc939230f500eae9fca26c1ebd07f758e
Message-Authenticator = 0xd6b2998526c8831e8d7e1df1ce0fb09d
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 7
modcall[authorize]: module "preprocess" returns ok for request 7
modcall[authorize]: module "chap" returns noop for request 7
modcall[authorize]: module "mschap" returns noop for request 7
rlm_ldap: - authorize
rlm_ldap: performing user authorization for MALACHITE\gaa
radius_xlat: Running registered xlat function of module exec for string '/etc/ulcmit/raddb/nodomain %{User-Name}'
rlm_exec (exec): Executing /etc/ulcmit/raddb/nodomain %{User-Name}
radius_xlat: '/etc/ulcmit/raddb/nodomain MALACHITE\\gaa'
Exec-Program: /etc/ulcmit/raddb/nodomain MALACHITE\\gaa
Exec-Program output: gaa
Exec-Program-Wait: plaintext: gaa
Exec-Program: returned: 0
rlm_exec (exec): result 0
radius_xlat: '(&(objectclass=person)(uid=gaa))'
radius_xlat: 'dc=ulticom,dc=com'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=gaa))
rlm_ldap: checking if remote access for MALACHITE\gaa is allowed by uid
rlm_ldap: looking for check items in directory...
rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21
rlm_ldap: Adding sambaNTPassword as NT-Password, value E6DEABE732705BC462E2195793EDAF37 & op=21
rlm_ldap: Adding sambaLMPassword as LM-Password, value D388721E3CDDC12DAAD3B435B51404EE & op=21
rlm_ldap: looking for reply items in directory...
rlm_ldap: user MALACHITE\gaa authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
modcall[authorize]: module "ldap" returns ok for request 7
rlm_eap: EAP packet type response id 8 length 38
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 7
users: Matched entry DEFAULT at line 153
users: Matched entry DEFAULT at line 176
users: Matched entry DEFAULT at line 188
modcall[authorize]: module "files" returns ok for request 7
modcall: group authorize returns updated for request 7
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 7
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
eaptls_verify returned 7
rlm_eap_tls: Done initial handshake
eaptls_process returned 7
rlm_eap_peap: EAPTLS_OK
rlm_eap_peap: Session established. Decoding tunneled attributes.
rlm_eap_peap: Received EAP-TLV response.
rlm_eap_peap: Tunneled data is valid.
rlm_eap_peap: Had sent TLV failure, rejecting.
rlm_eap: Handler failed in EAP/peap
rlm_eap: Failed in EAP select
modcall[authenticate]: module "eap" returns invalid for request 7
modcall: group authenticate returns invalid for request 7
auth: Failed to validate the user.
Delaying request 7 for 1 seconds
Finished request 7
Going to the next request
Waking up in 5 seconds...
rad_recv: Access-Request packet from host 172.25.16.9:1230, id=92, length=251
Sending Access-Reject of id 92 to 172.25.16.9:1230
EAP-Message = 0x04080004
Message-Authenticator = 0x00000000000000000000000000000000
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 85 with timestamp 43c2a6d8
Waking up in 1 seconds...
--- Walking the entire request list ---
Cleaning up request 1 ID 86 with timestamp 43c2a6d9
Cleaning up request 2 ID 87 with timestamp 43c2a6d9
Cleaning up request 3 ID 88 with timestamp 43c2a6d9
Cleaning up request 4 ID 89 with timestamp 43c2a6d9
Cleaning up request 5 ID 90 with timestamp 43c2a6d9
Cleaning up request 6 ID 91 with timestamp 43c2a6d9
Cleaning up request 7 ID 92 with timestamp 43c2a6d9
Nothing to do. Sleeping until we see a request.
-------------------------------------------------------------------
>
> If all you do is look at the last line or two, you're guaranteed to
> not see what's going on.
>
> Alan DeKok.
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
--
Gary Algier, WB2FWZ gaa at ulticom.com +1 856 787 2758
Ulticom Inc., 1020 Briggs Rd, Mt. Laurel, NJ 08054 Fax:+1 856 866 2033
Nielsen's First Law of Computer Manuals:
People don't read documentation voluntarily.
More information about the Freeradius-Users
mailing list