Problem with freeradius 2.0 pre1 and realms

Christian Frank christian.frank at rsel.renesas.com
Fri Aug 17 13:34:37 CEST 2007


Hi Guys,

I'm trying to use freeradius with peap+mschapv2+ldap+realms.

If i don't use realms, everything works fine.
But the problem is that i need to stripp of the domain part of the username,
cause windows sends TEST\cfra .

But i have only cfra in my ldap .

So i di the follwing:

radius.conf:

	realm ntdomain {
		format = prefix
		delimiter = "\\"
	}	


and enabled ntdomain under authorisation .

My proxy.conf:

realm test {
	type		= radius
	authhost	= LOCAL
	accthost	= LOCAL
}


But when i want to login, it does not work.
Seems like the domain is stripped of correctly for authorisation, but not for authentication.

But what could be wrong ?

Here is the output of radius:


Config:   including file: ../etc/raddb//radiusd.conf
Config:   including file: /usr/local/freeradius2/etc/raddb/proxy.conf
Config:   including file: /usr/local/freeradius2/etc/raddb/clients.conf
Config:   including file: /usr/local/freeradius2/etc/raddb/snmp.conf
Config:   including file: /usr/local/freeradius2/etc/raddb/eap.conf
Config:   including file: /usr/local/freeradius2/etc/raddb/sql.conf
Config:   including file: /usr/local/freeradius2/etc/raddb/sql/mysql-dialup.conf
FreeRADIUS Version 2.0.0-pre1, for host i686-pc-linux-gnu, built on Aug 16 2007 at 13:45:55
Starting - reading configuration files ...
read_config_files:  reading dictionary
main {
	prefix = "/usr/local/freeradius2"
	localstatedir = "/usr/local/freeradius2/var"
	logdir = "/usr/local/freeradius2/var/log/radius"
	libdir = "/usr/local/freeradius2/lib"
	radacctdir = "/usr/local/freeradius2/var/log/radius/radacct"
	hostname_lookups = no
	max_request_time = 30
	cleanup_delay = 5
	max_requests = 1024
	allow_core_dumps = no
	log_stripped_names = no
	log_file = "/usr/local/freeradius2/var/log/radius/radius.log"
	log_auth = no
	log_auth_badpass = no
	log_auth_goodpass = no
	pidfile = "/usr/local/freeradius2/var/run/radiusd/radiusd.pid"
	user = "radiusd"
	group = "radiusd"
	checkrad = "/usr/local/freeradius2/sbin/checkrad"
	debug_level = 0
	proxy_requests = yes
  log {
	syslog_facility = "daemon"
  }
  proxy server {
	retry_delay = 5
	retry_count = 3
	default_fallback = no
	dead_time = 120
	wake_all_if_all_dead = no
  }
  security {
	max_attributes = 200
	reject_delay = 1
	status_server = yes
  }
}
  home_server localhost {
	ipaddr = 127.0.0.1 IP address [127.0.0.1]
	port = 1812
	type = "auth"
	secret = "testing123"
	response_window = 20
	max_outstanding = 65536
	zombie_period = 40
	status_check = "status-server"
	ping_check = "none"
	ping_interval = 30
	check_interval = 30
	num_answers_to_alive = 3
	num_pings_to_alive = 3
	revive_interval = 120
	status_check_timeout = 4
  }
  server_pool my_auth_failover {
	type = my_auth_failover
	home_server = localhost
  }
  realm example.com {
	auth_pool = my_auth_failover
  }
  realm LOCAL {
	ldflag = fail_over
  }
  realm test {
	ldflag = fail_over
  }
	port = 1812
  listen {
	type = "auth"
	ipaddr = *
	port = 0
  }
  listen {
	type = "acct"
	ipaddr = *
	port = 0
  }
  client 127.0.0.1 {
	secret = "testing123"
	shortname = "localhost"
	nastype = "other"
  }
  client 150.150.40.0/16 {
	secret = "ciscotest1"
	shortname = "private-network-1"
	nastype = "cisco"
  }
radiusd:  entering modules setup
radiusd: Library search path is /usr/local/freeradius2/lib
  instantiate {
  Module: Linked to module rlm_exec
  Module: Instantiating exec
   exec {
	wait = yes
	input_pairs = "request"
	shell_escape = yes
   }
rlm_exec: wait=yes but no output defined. Did you mean output=none?
  Module: Linked to module rlm_expr
  Module: Instantiating expr
  Module: Linked to module rlm_expiration
  Module: Instantiating expiration
   expiration {
	reply-message = "Password Has Expired  "
   }
  Module: Linked to module rlm_logintime
  Module: Instantiating logintime
   logintime {
	reply-message = "You are calling outside your allowed timespan  "
	minimum-timeout = 60
   }
  }
  modules {
  Module: Instantiating section authenticate
  Module: Linked to module rlm_pap
  Module: Instantiating pap
   pap {
	encryption_scheme = "auto"
	auto_header = no
   }
  Module: Linked to module rlm_chap
  Module: Instantiating chap
  Module: Linked to module rlm_mschap
  Module: Instantiating mschap
   mschap {
	use_mppe = yes
	require_encryption = no
	require_strong = no
	with_ntdomain_hack = no
   }
  Module: Linked to module rlm_unix
  Module: Instantiating unix
   unix {
	radwtmp = "/usr/local/freeradius2/var/log/radius/radwtmp"
   }
  Module: Linked to module rlm_eap
  Module: Instantiating eap
   eap {
	default_eap_type = "peap"
	timer_expire = 60
	ignore_unknown_eap_types = no
	cisco_accounting_username_bug = no
   }
   eap: Linked to sub-module rlm_eap_md5
   eap: Instantiating eap-md5
   eap: Linked to sub-module rlm_eap_leap
   eap: Instantiating eap-leap
   eap: Linked to sub-module rlm_eap_gtc
   eap: Instantiating eap-gtc
    gtc {
	challenge = "Password: "
	auth_type = "PAP"
    }
   eap: Linked to sub-module rlm_eap_tls
   eap: Instantiating eap-tls
    tls {
	rsa_key_exchange = no
	dh_key_exchange = yes
	rsa_key_length = 512
	dh_key_length = 512
	verify_depth = 0
	pem_file_type = yes
	private_key_file = "/usr/local/certs/wcsserver.key"
	certificate_file = "/usr/local/certs/wcsserver.pem"
	CA_file = "/usr/local/certs/root.pem"
	private_key_password = "wcs"
	dh_file = "/usr/local/freeradius2/etc/raddb/certs/dh"
	random_file = "/dev/urandom"
	fragment_size = 1024
	include_length = yes
	check_crl = no
	cipher_list = "DEFAULT"
	make_cert_command = "/usr/local/freeradius2/etc/raddb/certs/bootstrap"
    }
rlm_eap_tls: Loading the certificate file as a chain
   eap: Linked to sub-module rlm_eap_ttls
   eap: Instantiating eap-ttls
    ttls {
	default_eap_type = "md5"
	copy_request_to_tunnel = no
	use_tunneled_reply = no
    }
   eap: Linked to sub-module rlm_eap_peap
   eap: Instantiating eap-peap
    peap {
	default_eap_type = "mschapv2"
	copy_request_to_tunnel = no
	use_tunneled_reply = no
	proxy_tunneled_request_as_eap = yes
    }
   eap: Linked to sub-module rlm_eap_mschapv2
   eap: Instantiating eap-mschapv2
    mschapv2 {
	with_ntdomain_hack = no
    }
  Module: Instantiating section authorize
  Module: Linked to module rlm_preprocess
  Module: Instantiating preprocess
   preprocess {
	huntgroups = "/usr/local/freeradius2/etc/raddb/huntgroups"
	hints = "/usr/local/freeradius2/etc/raddb/hints"
	with_ascend_hack = no
	ascend_channels_per_line = 23
	with_ntdomain_hack = no
	with_specialix_jetstream_hack = no
	with_cisco_vsa_hack = no
	with_alvarion_vsa_hack = no
   }
  Module: Linked to module rlm_realm
  Module: Instantiating suffix
   realm suffix {
	format = "suffix"
	delimiter = "@"
	ignore_default = no
	ignore_null = no
   }
  Module: Instantiating ntdomain
   realm ntdomain {
	format = "prefix"
	delimiter = "\"
	ignore_default = no
	ignore_null = no
   }
  Module: Linked to module rlm_files
  Module: Instantiating files
   files {
	usersfile = "/usr/local/freeradius2/etc/raddb/users"
	acctusersfile = "/usr/local/freeradius2/etc/raddb/acct_users"
	preproxy_usersfile = "/usr/local/freeradius2/etc/raddb/preproxy_users"
	compat = "no"
   }
  Module: Linked to module rlm_ldap
  Module: Instantiating ldap
   ldap {
	server = "150.150.40.241"
	port = 389
	password = "secret"
	identity = "cn=Manager,dc=rsel,dc=com"
	net_timeout = 1
	timeout = 4
	timelimit = 3
	tls_mode = no
	start_tls = no
	tls_require_cert = "allow"
    tls {
	start_tls = no
	require_cert = "allow"
    }
	basedn = "dc=rsel,dc=com"
	filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
	base_filter = "(objectclass=radiusprofile)"
	password_attribute = "userPassword"
	auto_header = no
	access_attr_used_for_allow = yes
	groupname_attribute = "cn"
	groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
	dictionary_mapping = "/usr/local/freeradius2/etc/raddb/ldap.attrmap"
	ldap_debug = 0
	ldap_connections_number = 5
	compare_check_items = no
	do_xlat = yes
	set_auth_type = yes
   }
rlm_ldap: Registering ldap_groupcmp for Ldap-Group
rlm_ldap: Registering ldap_xlat with xlat_name ldap
rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section.
rlm_ldap: reading ldap<->radius mappings from file /usr/local/freeradius2/etc/raddb/ldap.attrmap
rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type
rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use
rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id
rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id
rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT
rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration
rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address
rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type
rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol
rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address
rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask
rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route
rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing
rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id
rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU
rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression
rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host
rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service
rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port
rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number
rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id
rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network
rlm_ldap: LDAP radiusClass mapped to RADIUS Class
rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout
rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout
rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action
rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service
rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node
rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group
rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link
rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network
rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone
rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit
rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port
rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message
conns: 0x9be8488
  Module: Instantiating section preacct
  Module: Linked to module rlm_acct_unique
  Module: Instantiating acct_unique
   acct_unique {
	key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
   }
  Module: Instantiating section accounting
  Module: Linked to module rlm_detail
  Module: Instantiating detail
   detail {
	detailfile = "/usr/local/freeradius2/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
	header = "%t"
	detailperm = 384
	dirperm = 493
	locking = no
	log_packet_header = no
   }
  Module: Linked to module rlm_radutmp
  Module: Instantiating radutmp
   radutmp {
	filename = "/usr/local/freeradius2/var/log/radius/radutmp"
	username = "%{User-Name}"
	case_sensitive = yes
	check_with_nas = yes
	perm = 384
	callerid = yes
   }
  Module: Linked to module rlm_attr_filter
  Module: Instantiating attr_filter.accounting_response
   attr_filter attr_filter.accounting_response {
	attrsfile = "/usr/local/freeradius2/etc/raddb/attrs.accounting_response"
	key = "%{User-Name}"
   }
  Module: Instantiating section session
  Module: Instantiating section post-proxy
  Module: Instantiating section post-auth
  Module: Instantiating attr_filter.access_reject
   attr_filter attr_filter.access_reject {
	attrsfile = "/usr/local/freeradius2/etc/raddb/attrs.access_reject"
	key = "%{User-Name}"
   }
  }
Initializing the thread pool...
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on proxy address * port 1814
Ready to process requests.
Nothing to do.  Sleeping until we see a request.
   Processing the authorize section of radiusd.conf
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[unix] returns notfound
     rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[suffix] returns noop
     rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[ntdomain] returns noop
   rlm_eap: EAP packet type response id 13 length 14
   rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
rlm_ldap: - authorize
rlm_ldap: performing user authorization for anonymous
radius_xlat:  '(uid=anonymous)'
radius_xlat:  'dc=rsel,dc=com'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: attempting LDAP reconnection
rlm_ldap: (re)connect to 150.150.40.241:389, authentication 0
rlm_ldap: bind as cn=Manager,dc=rsel,dc=com/secret to 150.150.40.241:389
rlm_ldap: waiting for bind result ...
rlm_ldap: Bind was successful
rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=anonymous)
rlm_ldap: object not found or got ambiguous search result
rlm_ldap: search failed
rlm_ldap: ldap_release_conn: Release Id: 0
++[ldap] returns notfound
++[expiration] returns noop
++[logintime] returns noop
rlm_pap: WARNING! No "known good" password found for the user.  Authentication may fail because of this.
++[pap] returns noop
+- group authorize returns updated
   rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
   Processing the authenticate section of radiusd.conf
+- entering group authenticate
   rlm_eap: EAP Identity
   rlm_eap: processing type tls
   rlm_eap_tls: Initiate
   rlm_eap_tls: Start returned 1
++[eap] returns handled
+- group authenticate returns handled
Finished request 0 state 5
Going to the next request
   Processing the authorize section of radiusd.conf
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[unix] returns notfound
     rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[suffix] returns noop
     rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[ntdomain] returns noop
   rlm_eap: EAP packet type response id 14 length 82
   rlm_eap: Continuing tunnel setup.
++[eap] returns ok
+- group authorize returns ok
   rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
   Processing the authenticate section of radiusd.conf
+- entering group authenticate
   rlm_eap: Request found, released from the list
   rlm_eap: EAP/peap
   rlm_eap: processing type peap
   rlm_eap_peap: Authenticate
   rlm_eap_tls: processing TLS
rlm_eap_tls:  Length Included
   eaptls_verify returned 11
     (other): before/accept initialization
     TLS_accept: before/accept initialization
   rlm_eap_tls: <<< TLS 1.0 Handshake [length 0043], ClientHello
     TLS_accept: SSLv3 read client hello A
   rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello
     TLS_accept: SSLv3 write server hello A
   rlm_eap_tls: >>> TLS 1.0 Handshake [length 04e9], Certificate
     TLS_accept: SSLv3 write certificate A
   rlm_eap_tls: >>> TLS 1.0 Handshake [length 018d], ServerKeyExchange
     TLS_accept: SSLv3 write key exchange A
   rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
     TLS_accept: SSLv3 write server done A
     TLS_accept: SSLv3 flush data
     TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
   eaptls_process returned 13
   rlm_eap_peap: EAPTLS_HANDLED
++[eap] returns handled
+- group authenticate returns handled
Finished request 1 state 5
Going to the next request
rad_recv: Access-Request packet from host 150.150.40.141 port 32769, id=235, length=160
	User-Name = "anonymous"
	Calling-Station-Id = "00-0C-F1-10-95-48"
	Called-Station-Id = "00-0B-85-82-C3-60:RSEL"
	NAS-Port = 29
	NAS-IP-Address = 150.150.40.141
	NAS-Identifier = "RSEL-WLC"
	Airespace-Wlan-Id = 1
	Service-Type = Framed-User
	Framed-MTU = 1300
	NAS-Port-Type = Wireless-802.11
	EAP-Message = 0x020d000e01616e6f6e796d6f7573
	Message-Authenticator = 0x237df9d6a5ccc4b8a6e7e241372567f7
Sending Access-Challenge of id 235 to 150.150.40.141 port 32769
	EAP-Message = 0x010e00061920
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x7e04413c4ac3982e863e3bc1d40fc3cc
rad_recv: Access-Request packet from host 150.150.40.141 port 32769, id=236, length=246
	User-Name = "anonymous"
	Calling-Station-Id = "00-0C-F1-10-95-48"
	Called-Station-Id = "00-0B-85-82-C3-60:RSEL"
	NAS-Port = 29
	NAS-IP-Address = 150.150.40.141
	NAS-Identifier = "RSEL-WLC"
	Airespace-Wlan-Id = 1
	Service-Type = Framed-User
	Framed-MTU = 1300
	NAS-Port-Type = Wireless-802.11
	EAP-Message = 0x020e005219800000004816030100430100003f030146c57f9e6adfd54e836ecd7108b2d9b0e8b32885ce5fb7dc236fd9502c507a1a00001800390038003300320016001300660035002f000a000500040100
	State = 0x7e04413c4ac3982e863e3bc1d40fc3cc
	Message-Authenticator = 0x1ee566e14988e1656634a8bda1a23970
Sending Access-Challenge of id 236 to 150.150.40.141 port 32769
	EAP-Message = 
0x010f040a19c0000006d8160301004a02000046030146c580d914781e0631885babfd323f744e073c1a0d762fa5edd6dfe2690fbb9320d843d45cd88fecc5cb4b2c1256cc25c4d4e442e804158b8ec4485fc9bfeb53c000390016030104e90b0004e50004e200027430820270308201d9a003020102020101300d06092a864886f70d0101050500306d3110300e060355040313075253454c204341310b3009060355040b13024954310b3009060355040b13024954310d300b060355040a13045253454c3111300f060355040713084c616e64736875743110300e0603550408130742617661726961310b3009060355040613024445301e170d303730
	EAP-Message = 
0x3830363030303030305a170d3038303830363233353935395a301f311d301b060355040313147763732e7273656c2e72656e657361732e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100bfdca3c73f9d3442ee1d8fd3edb90bc20a935415000efe8003eca3cea0168658ccf33924df3648aa81744a9d15f69ceece4373e1b25d294f93b93cb98371cb9cfd159a917c2e099b8954d9751626ba4a0fe8972b9459538ff3894d078253dec1e445d976ad05207e6d4d2da68d1343e6db85fe7f64bab0f83a8dca8afd1d26370203010001a36e306c30160603551d250101ff040c300a06082b060105050703013052060355
	EAP-Message = 
0x1d1f044b30493047a045a0438641687474703a2f2f70633430333335313a383038302f736572766c65742f636f6d2e66756e6b2e6f6463612e7365727665722e736572766c6574732e47657443524c300d06092a864886f70d0101050500038181001ed004b5c41754dc2c5cfaaac2217d6a90aca3b5aaf7a27461102d4acdfe2905836a9baed7c6aaa41914893be6cfad54589fa57b359a491097b6d60fe8b2a090e68a2adc4f2654875d9585a9759eefa924cf421c29f71e08a4eeb5ad5d23da6bdd9b5a9bac4549edd8004c553ca9a19c948c0a895f0622141645d18dfea4427800026830820264308201cda003020102020100300d06092a864886
	EAP-Message = 
0xf70d0101050500306d3110300e060355040313075253454c204341310b3009060355040b13024954310b3009060355040b13024954310d300b060355040a13045253454c3111300f060355040713084c616e64736875743110300e0603550408130742617661726961310b3009060355040613024445301e170d3037303830363030303030305a170d3137303830363233353935395a306d3110300e060355040313075253454c204341310b3009060355040b13024954310b3009060355040b13024954310d300b060355040a13045253454c3111300f060355040713084c616e64736875743110300e0603550408130742617661726961310b300906
	EAP-Message = 0x035504061302444530819d300d06092a864886f70d01
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x67538f85548078f113fef01af0d2efc4
rad_recv: Access-Request packet from host 150.150.40.141 port 32769, id=237, length=170
	User-Name = "anonymous"
	Calling-Station-Id = "00-0C-F1-10-95-48"
	Called-Station-Id = "00-0B-85-82-C3-60:RSEL"
	NAS-Port = 29
	NAS-IP-Address = 150.150.40.141
	NAS-Identifier = "RSEL-WLC"
	Airespace-Wlan-Id = 1
	Service-Type = Framed-User
	Framed-MTU = 1300
	NAS-Port-Type = Wireless-802.11
	EAP-Message = 0x020f00061900
	State   Processing the authorize section of radiusd.conf
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[unix] returns notfound
     rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[suffix] returns noop
     rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[ntdomain] returns noop
   rlm_eap: EAP packet type response id 15 length 6
   rlm_eap: Continuing tunnel setup.
++[eap] returns ok
+- group authorize returns ok
   rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
   Processing the authenticate section of radiusd.conf
+- entering group authenticate
   rlm_eap: Request found, released from the list
   rlm_eap: EAP/peap
   rlm_eap: processing type peap
   rlm_eap_peap: Authenticate
   rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
   rlm_eap_tls: ack handshake fragment handler
   eaptls_verify returned 1
   eaptls_process returned 13
   rlm_eap_peap: EAPTLS_HANDLED
++[eap] returns handled
+- group authenticate returns handled
Finished request 2 state 5
Going to the next request
   Processing the authorize section of radiusd.conf
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[unix] returns notfound
     rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[suffix] returns noop
     rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[ntdomain] returns noop
   rlm_eap: EAP packet type response id 16 length 208
   rlm_eap: Continuing tunnel setup.
++[eap] returns ok
+- group authorize returns ok
   rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
   Processing the authenticate section of radiusd.conf
+- entering group authenticate
   rlm_eap: Request found, released from the list
   rlm_eap: EAP/peap
   rlm_eap: processing type peap
   rlm_eap_peap: Authenticate
   rlm_eap_tls: processing TLS
rlm_eap_tls:  Length Included
   eaptls_verify returned 11
   rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange
     TLS_accept: SSLv3 read client key exchange A
   rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001]
   rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished
     TLS_accept: SSLv3 read finished A
   rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001]
     TLS_accept: SSLv3 write change cipher spec A
   rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished
     TLS_accept: SSLv3 write finished A
     TLS_accept: SSLv3 flush data
     (other): SSL negotiation finished successfully
SSL Connection Established
   eaptls_process returned 13
   rlm_eap_peap: EAPTLS_HANDLED
++[eap] returns handled
+- group authenticate returns handled
Finished request 3 state 5
Going to the next request
   Processing the authorize section of radiusd.conf
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[unix] returns notfound
     rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[suffix] returns noop
     rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[ntdomain] returns noop
   rlm_eap: EAP packet type response id 17 length 6
   rlm_eap: Continuing tunnel setup.
++[eap] returns ok
+- group authorize returns ok
   rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
   Processing the authenticate section of radiusd.conf
+- entering group authenticate
   rlm_eap: Request found, released from the list
   rlm_eap: EAP/peap
   rlm_eap: processing type peap
   rlm_eap_peap: Authenticate
   rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
   rlm_eap_tls: ack handshake is finished
   eaptls_verify returned 3
   eaptls_process returned 3
   rlm_eap_peap: EAPTLS_SUCCESS
++[eap] returns handled
+- group authenticate returns handled
Finished request 4 state 5
Going to the next request
= 0x67538f85548078f113fef01af0d2efc4
	Message-Authenticator = 0x31cbc446aeb5a95d6e907b59aad4f27a
Sending Access-Challenge of id 237 to 150.150.40.141 port 32769
	EAP-Message = 
0x011002de19000101050003818b0030818702818100b74f716b56b2464b8bd640955a1ffb274335f05646eddff3f93dcd47520eb764f5bd05d510275861f30e7e727c4b0ccc10797b1ed07bf9e98d88ba4d91ef041e0fc5a7f755b4b375d196170ab1a47c38a75e8d44bf09e20fe0e86994fe89060820e9f5fd284dc1551d48aa64951dbed7410548aeac1824ac5ddbdf629c946be5020111a316301430120603551d130101ff040830060101ff020100300d06092a864886f70d0101050500038181005649f966db9fe97da32747c5cc3af6cf15fde8f9c0db98db3aae700e3e74d1cc0fd07969def57f876d864aa05a01a5ef961487081ad57e4b18e7
	EAP-Message = 
0xd3a445ed9de2c9f4e79376f2991b4796ecf3ecb27786443b7e99b9e24b27756c03d9123a93a1eb8c091b796e6ce73f66a9700a71f24f7874de816052c4bc1f25b05235abf93c160301018d0c0001890080c7fdf4f2281a88444fb04733e293131bce140e28f08bb104facc9f16bbb0e3a1fc291776b898ec3e41884668163bc9a4f9feb445807c5b473a6c6714446d020935e87a0949c7863829e465c0ff1969384880e68b7f5add98429755464e76d4e239adb1de9dc8c4a376d1b61111dc0309c4e8b1abe76b3449ce313020d34216cb00010200800ea1768aedf982acd3dad43f3b5f6c440327d9656d82e0c0440e87bcc3f690741044f4d196bf4c
	EAP-Message = 
0x9687da51560b696339059923f15ebc123fb1008fef0d5d0cb67832e5b51ac8e616d2ba10f34f980525ed587e8da3d42205a72964f12c96bd41c3b586ed93d12108699a5bb86e97b803c67d97225053d6f2f38084cf0f9e7a3e0080a1d348ca67045ab0ceebd35497c5e0a51795a534e4e902a06880f7bbbd288e5f0f502e36d5cfb50863f71253bd6ebc9e8d9208a54b1996cac92fba67886e98750a7867145a5706e41706baa75b32205aaa1f0916d5b519d525e9bcfd0bd447a01db9ebdcb0f821cbc1cbfe1f7facc3aea50cc2ccf5c93a588d69400ba2522f7d16030100040e000000
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0xd613929d0835375b51b0bad22b0859c8
rad_recv: Access-Request packet from host 150.150.40.141 port 32769, id=238, length=372
	User-Name = "anonymous"
	Calling-Station-Id = "00-0C-F1-10-95-48"
	Called-Station-Id = "00-0B-85-82-C3-60:RSEL"
	NAS-Port = 29
	NAS-IP-Address = 150.150.40.141
	NAS-Identifier = "RSEL-WLC"
	Airespace-Wlan-Id = 1
	Service-Type = Framed-User
	Framed-MTU = 1300
	NAS-Port-Type = Wireless-802.11
	EAP-Message = 
0x021000d01980000000c6160301008610000082008039724b2d404ca74c3b10364d9cfdb3ae6aad2a2be4250d2bc8af99abec7f0123bbf1868d547d29217c1bb0029a4abbde00940c54686a852e8d76033992c36a886c95302c16ddce802ab4956d578ad648e7b5923aa7ce88a0199db9245531b02b2c1c31bbc3fcc37b461c5e2eebae2fc44235a4723e35d2d86e7feffb26e778111403010001011603010030d16158a87ab639360df086b3c2dff39bd1ce72bbb875734f1d0b485ef8a3fd4b645cccc8c0bb284a561374ec26304714
	State = 0xd613929d0835375b51b0bad22b0859c8
	Message-Authenticator = 0x0f8218941c2ce5d17ecdee9dcc4b2762
Sending Access-Challenge of id 238 to 150.150.40.141 port 32769
	EAP-Message = 0x011100411900140301000101160301003088c0c27a6f51fb7527c91b1b5303922637f4cc60fedecadd80965391e8dba99bf9841f8d0eb24d9371259333eaa767cf
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x3cafbd9fc9bad1cc56e6e3b7680d946f
rad_recv: Access-Request packet from host 150.150.40.141 port 32769, id=239, length=170
	User-Name = "anonymous"
	Calling-Station-Id = "00-0C-F1-10-95-48"
	Called-Station-Id = "00-0B-85-82-C3-60:RSEL"
	NAS-Port = 29
	NAS-IP-Address = 150.150.40.141
	NAS-Identifier = "RSEL-WLC"
	Airespace-Wlan-Id = 1
	Service-Type = Framed-User
	Framed-MTU = 1300
	NAS-Port-Type = Wireless-802.11
	EAP-Message = 0x021100061900
	State = 0x3cafbd9fc9bad1cc56e6e3b7680d946f
	Message-Authenticator = 0x7e13c9b8d0b8083b90ef4f55195383ec
Sending Access-Challenge of id 239 to 150.150.40.141 port 32769
	EAP-Message = 0x0112002b19001703010020a9fce9f01fd333b6acd4e84c383b77d3c463b6847adf1ab77354f677ce6fe62e
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x0eca445faa2dd2b4a2e9097a7d976000
rad_recv: Access-Request packet from host 150.150.40.141 port 32769, id=240, length=207
	User-Name = "anonymous"
	Calling-Station-Id = "00-0C-F1-10-95-48"
	Called-Station-Id = "00-0B-85-82-C3-60:RSEL"
	NAS-Port = 29
	NAS-IP-Address = 150.150.40.141
	NAS-Identifier = "RSEL-WLC"
	Airespac  Processing the authorize section of radiusd.conf
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[unix] returns notfound
     rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[suffix] returns noop
     rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[ntdomain] returns noop
   rlm_eap: EAP packet type response id 18 length 43
   rlm_eap: Continuing tunnel setup.
++[eap] returns ok
+- group authorize returns ok
   rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
   Processing the authenticate section of radiusd.conf
+- entering group authenticate
   rlm_eap: Request found, released from the list
   rlm_eap: EAP/peap
   rlm_eap: processing type peap
   rlm_eap_peap: Authenticate
   rlm_eap_tls: processing TLS
   eaptls_verify returned 7
   rlm_eap_tls: Done initial handshake
   eaptls_process returned 7
   rlm_eap_peap: EAPTLS_OK
   rlm_eap_peap: Session established.  Decoding tunneled attributes.
   rlm_eap_peap: Identity - test\cfra
   rlm_eap_peap: Tunneled data is valid.
   PEAP: Got tunneled identity of test\cfra
   PEAP: Setting default EAP type for tunneled EAP session.
   PEAP: Setting User-Name to test\cfra
   Processing the authorize section of radiusd.conf
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[unix] returns notfound
     rlm_realm: No '@' in User-Name = "test\cfra", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[suffix] returns noop
     rlm_realm: Looking up realm "test" for User-Name = "test\cfra"
     rlm_realm: Found realm "test"
     rlm_realm: Adding Stripped-User-Name = "cfra"
     rlm_realm: Proxying request from user cfra to realm test
     rlm_realm: Adding Realm = "test"
     rlm_realm: Authentication realm is LOCAL.
++[ntdomain] returns noop
   rlm_eap: EAP packet type response id 18 length 14
   rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
rlm_ldap: - authorize
rlm_ldap: performing user authorization for cfra
radius_xlat:  '(uid=cfra)'
radius_xlat:  'dc=rsel,dc=com'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra)
rlm_ldap: Added User-Password = cisco12 in check items
rlm_ldap: looking for check items in directory...
rlm_ldap: looking for reply items in directory...
rlm_ldap: user cfra authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
rlm_pap: Found existing Auth-Type, not changing it.
++[pap] returns noop
+- group authorize returns updated
   rad_check_password:  Found Auth-Type EAP
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!    Replacing User-Password in config items with Cleartext-Password.     !!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!! Please update your configuration so that the "known good"               !!!
!!! clear text password is in Cleartext-Password, and not in User-Password. !!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
auth: type "EAP"
   Processing the authenticate section of radiusd.conf
+- entering group authenticate
   rlm_eap: EAP Identity
   rlm_eap: processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
++[eap] returns handled
+- group authenticate returns handled
   PEAP: Got tunneled Access-Challenge
++[eap] returns handled
+- group authenticate returns handled
Finished request 5 state 5
Going to the next request
   Processing the authorize section of radiusd.conf
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[unix] returns notfound
     rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[suffix] returns noop
     rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[ntdomain] returns noop
   rlm_eap: EAP packet type response id 19 length 91
   rlm_eap: Continuing tunnel setup.
++[eap] returns ok
+- group authorize returns ok
   rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
   Processing the authenticate section of radiusd.conf
+- entering group authenticate
   rlm_eap: Request found, released from the list
   rlm_eap: EAP/peap
   rlm_eap: processing type peap
   rlm_eap_peap: Authenticate
   rlm_eap_tls: processing TLS
   eaptls_verify returned 7
   rlm_eap_tls: Done initial handshake
   eaptls_process returned 7
   rlm_eap_peap: EAPTLS_OK
   rlm_eap_peap: Session established.  Decoding tunneled attributes.
   rlm_eap_peap: EAP type mschapv2
   rlm_eap_peap: Tunneled data is valid.
   PEAP: Setting User-Name to test\cfra
   PEAP: Adding old state with 13 1f
   Processing the authorize section of radiusd.conf
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[unix] returns notfound
     rlm_realm: No '@' in User-Name = "test\cfra", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[suffix] returns noop
     rlm_realm: Looking up realm "test" for User-Name = "test\cfra"
     rlm_realm: Found realm "test"
     rlm_realm: Adding Stripped-User-Name = "cfra"
     rlm_realm: Proxying request from user cfra to realm test
     rlm_realm: Adding Realm = "test"
     rlm_realm: Authentication realm is LOCAL.
++[ntdomain] returns noop
   rlm_eap: EAP packet type response id 19 length 63
   rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
rlm_ldap: - authorize
rlm_ldap: performing user authorization for cfra
radius_xlat:  '(uid=cfra)'
radius_xlat:  'dc=rsel,dc=com'
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in dc=rsel,dc=com, with filter (uid=cfra)
rlm_ldap: Added User-Password = cisco12 in check items
rlm_ldap: looking for check items in directory...
rlm_ldap: looking for reply items in directory...
rlm_ldap: user cfra authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
rlm_pap: Found existing Auth-Type, not changing it.
++[pap] returns noop
+- group authorize returns updated
   rad_check_password:  Found Auth-Type EAP
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!    Replacing User-Password in config items with Cleartext-Password.     !!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!! Please update your configuration so that the "known good"               !!!
!!! clear text password is in Cleartext-Password, and not in User-Password. !!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
auth: type "EAP"
   Processing the authenticate section of radiusd.conf
+- entering group authenticate
   rlm_eap: Request found, released from the list
   rlm_eap: EAP/mschapv2
   rlm_eap: processing type mschapv2
   Processing the authenticate section of radiusd.conf
+- entering group MS-CHAP
   rlm_mschap: NT Domain delimeter found, should we have enabled with_ntdomain_hack?
   rlm_mschap: Told to do MS-CHAPv2 for test\cfra with NT-Password
   rlm_mschap: FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
+- group MS-CHAP returns reject
   rlm_eap: Freeing handler
++[eap] returns reject
+- group authenticate returns reject
auth: Failed to validate the user.
   PEAP: Tunneled authentication was rejected.
   rlm_eap_peap: FAILURE
++[eap] returns handled
+- group authenticate returns handled
Finished request 6 state 5
Going to the next request
   Processing the authorize section of radiusd.conf
+- entering group authorize
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[unix] returns notfound
     rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[suffix] returns noop
     rlm_realm: No '\' in User-Name = "anonymous", looking up realm NULL
     rlm_realm: No such realm "NULL"
++[ntdomain] returns noop
   rlm_eap: EAP packet type response id 20 length 43
   rlm_eap: Continuing tunnel setup.
++[eap] returns ok
+- group authorize returns ok
   rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
   Processing the authenticate section of radiusd.conf
+- entering group authenticate
   rlm_eap: Request found, released from the list
   rlm_eap: EAP/peap
   rlm_eap: processing type peap
   rlm_eap_peap: Authenticate
   rlm_eap_tls: processing TLS
   eaptls_verify returned 7
   rlm_eap_tls: Done initial handshake
   eaptls_process returned 7
   rlm_eap_peap: EAPTLS_OK
   rlm_eap_peap: Session established.  Decoding tunneled attributes.
   rlm_eap_peap: Received EAP-TLV response.
   rlm_eap_peap: Tunneled data is valid.
   rlm_eap_peap:  Had sent TLV failure.  User was rejcted rejected earlier in this session.
  rlm_eap: Handler failed in EAP/peap
   rlm_eap: Failed in EAP select
++[eap] returns invalid
+- group authenticate returns invalid
auth: Failed to validate the user.
   Found Post-Auth-Type Reject
   Processing the post-auth section of radiusd.conf
+- entering group REJECT
radius_xlat:  'anonymous'
  attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
+- group REJECT returns updated
Delaying reject of request 7 for 1 seconds
Going to the next request
Sending delayed reject for request 7
Waking up in 3 seconds...
Cleaning up request 0 ID 235 with timestamp +26
Waking up in 1 seconds...
Cleaning up request 7 ID 242 with timestamp +26
Nothing to do.  Sleeping until we see a request.


Would be nice if someone could give me some hints.


Thanks,
Christian











****************************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. Access to this e-mail by anyone else is unauthorised.
If you are not the intended recipient, any disclosure, copying,
distribution or any action taken or omitted to be taken in reliance on
it, is prohibited.
E-mail messages are not necessarily secure.  Renesas does not accept
responsibility for any changes made to this message after it was sent.
Please note that this email message has been swept by Renesas for
the presence of computer viruses.

Renesas Semiconductor Europe (Landshut) GmbH
Jenaer Strasse 1, 84034 Landshut
Tel.: +49-(0)871-684-0, Fax: +49-(0)871-684-150
www.rsel.renesas.com

GESCHAEFTSFUEHRER:  Dipl.-Ing. YOSHIHARU KAKUI
GESCHAEFTSFUEHRER:  Dipl.-Phys. STEFAN SAUER

Registergericht Landshut HRB 1464
Ust-ldNr.: DE 128953054  Steuer-Nr.: 132/136/30347

HypoVereinsbank, Landshut, Kto.-Nr. 3704 700 (BLZ  743 200 73) 
Mizuho Corporate Bank (Germany) AG, Frankfurt, Kto.-Nr. 200 733 (BLZ 503 308 00)
****************************************************************************




More information about the Freeradius-Users mailing list