Problem with eap-peap
Trujillo Carmona, Antonio
antonio.trujillo.sspa at juntadeandalucia.es
Fri Feb 19 13:06:05 CET 2010
Thank in advance and sorry for my english.
Realy I have spend several day reading from internet
(wiki.freeradius.org, deployingradius.com and google)
Itry all the thing, including apply a hotfix from microsoft
but I can't make it work.
I use a debian backport version of freeradius
radius-2:/etc/freeradius# freeradius -v
freeradius: FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu,
built on Jan 3 2010 at 14:14:04
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License.
For more information about these matters, see the file named COPYRIGHT.
my files are:
radius-2:/etc/freeradius# cat eap.conf
# -*- text -*-
##
## eap.conf -- Configuration for EAP types (PEAP, TTLS, etc.)
##
## $Id$
#######################################################################
eap {
default_eap_type = peap
timer_expire = 60
ignore_unknown_eap_types = no
max_sessions = 4096
tls {
certdir = ${confdir}/certs
cadir = ${confdir}/certs
private_key_password = *****
private_key_file = ${certdir}/server.key
certificate_file = ${certdir}/server.pem
CA_file = ${cadir}/ca.pem
dh_file = ${certdir}/dh
random_file = ${certdir}/random
cipher_list = "DEFAULT"
cache {
enable = no
lifetime = 24 # hours
max_entries = 255
}
}
peap {
default_eap_type = mschapv2
copy_request_to_tunnel = no
use_tunneled_reply = no
virtual_server = "inner-tunnel"
}
mschapv2 {
}
}
-----------------------------------------------
radius-2:/etc/freeradius# cat modules/mschap
# -*- text -*-
#
# $Id$
# Microsoft CHAP authentication
#
# This module supports MS-CHAP and MS-CHAPv2 authentication.
# It also enforces the SMB-Account-Ctrl attribute.
#
mschap {
use_mppe = yes
require_encryption = yes
require_strong = yes
with_ntdomain_hack = yes
authtype = MS-CHAP
ntlm_auth = "/usr/bin/ntlm_auth \
--request-nt-key \
--username=%{mschap:User-Name:-None} \
--domain=%{mschap:NT-Domain:-HUVN} \
--challenge=%{mschap:Challenge:-00} \
--nt-response=%{mschap:NT-Response:-00}"
}
--------------------------------------------
radius-2:/etc/freeradius# cat
sites-enabled/default
######################################################################
#
# As of 2.0.0, FreeRADIUS supports virtual hosts using
the
# "server" section, and configuration
directives.
#
# Virtual hosts should be put into the
"sites-available"
# directory. Soft links should be created in the
"sites-enabled"
# directory to these files. This is done in a normal
installation.
#
# $Id
$
#
######################################################################
authorize
{
#ntlm_auth
preprocess
#chap
mschap
suffix
#ntdomain
# eap {
# ok = return
# }
eap
#unix
#files
#expiration
#logintime
#pap
}
authenticate {
Auth-Type MS-CHAP {
mschap
}
eap
}
#
# Pre-accounting. Decide which accounting type to use.
#
preacct {
preprocess
acct_unique
suffix
# ntdomain
# files
}
#
# Accounting. Log the accounting data.
#
accounting {
detail
radutmp
# sql
attr_filter.accounting_response
}
session {
radutmp
# sql
}
post-auth {
exec
# Post-Auth-Type REJECT {
# attr_filter.access_reject
# }
}
pre-proxy {
}
post-proxy {
eap
}
---------------------------------------------------
The output of a debug session:
Linux radius-2 2.6.26-2-amd64 #1 SMP Tue Jan 12 22:12:20 UTC 2010 x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Feb 18 09:17:57 2010 from 10.104.24.54
radius-2:~# freeradius -X
FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu, built on Jan 3 2010 at 14:14:04
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2.
Starting - reading configuration
files ...
including configuration file /etc/freeradius/radiusd.conf
including configuration file /etc/freeradius/proxy.conf
including configuration file /etc/freeradius/clients.conf
including files in directory /etc/freeradius/modules/
including configuration file /etc/freeradius/modules/acct_unique
including configuration file /etc/freeradius/modules/expr
including configuration file /etc/freeradius/modules/attr_filter
including configuration file /etc/freeradius/modules/mschap
including configuration file /etc/freeradius/modules/pam
including configuration file /etc/freeradius/modules/digest
including configuration file /etc/freeradius/modules/mac2vlan
including configuration file /etc/freeradius/modules/perl
including configuration file /etc/freeradius/modules/chap
including configuration file /etc/freeradius/modules/mac2ip
including configuration file /etc/freeradius/modules/wimax
including configuration file /etc/freeradius/modules/expiration
including configuration file /etc/freeradius/modules/counter
including configuration file /etc/freeradius/modules/checkval
including configuration file /etc/freeradius/modules/attr_rewrite
including configuration file /etc/freeradius/modules/always
including configuration file /etc/freeradius/modules/unix
including configuration file /etc/freeradius/modules/sql_log
including configuration file /etc/freeradius/modules/preprocess
including configuration file /etc/freeradius/modules/smsotp
including configuration file /etc/freeradius/modules/policy
including configuration file /etc/freeradius/modules/logintime
including configuration file /etc/freeradius/modules/ldap
including configuration file /etc/freeradius/modules/passwd
including configuration file /etc/freeradius/modules/files
including configuration file /etc/freeradius/modules/linelog
including configuration file /etc/freeradius/modules/inner-eap
including configuration file /etc/freeradius/modules/otp
including configuration file /etc/freeradius/modules/smbpasswd
including configuration file /etc/freeradius/modules/detail.log
including configuration file /etc/freeradius/modules/radutmp
including configuration file /etc/freeradius/modules/realm
including configuration file /etc/freeradius/modules/krb5
including configuration file /etc/freeradius/modules/ippool
including configuration file /etc/freeradius/modules/echo
including configuration file /etc/freeradius/modules/detail.example.com
including configuration file /etc/freeradius/modules/exec
including configuration file /etc/freeradius/modules/pap
including configuration file /etc/freeradius/modules/etc_group
including configuration file /etc/freeradius/modules/detail
including configuration file /etc/freeradius/modules/cui
including configuration file /etc/freeradius/modules/sradutmp
including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login
including configuration file /etc/freeradius/modules/ntlm_auth
including configuration file /etc/freeradius/eap.conf
including configuration file /etc/freeradius/policy.conf
including files in directory /etc/freeradius/sites-enabled/
including configuration file /etc/freeradius/sites-enabled/default
including configuration file /etc/freeradius/sites-enabled/inner-tunnel
main {
user = "freerad"
group = "freerad"
allow_core_dumps = no
}
including dictionary file /etc/freeradius/dictionary
main {
prefix = "/usr"
localstatedir = "/var"
logdir = "/var/log/freeradius"
libdir = "/usr/lib/freeradius"
radacctdir = "/var/log/freeradius/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
pidfile = "/var/run/freeradius/freeradius.pid"
checkrad = "/usr/sbin/checkrad"
debug_level = 0
proxy_requests = yes
log {
stripped_names = no
auth = no
auth_badpass = no
auth_goodpass = no
}
security {
max_attributes = 200
reject_delay = 1
status_server = yes
}
}
radiusd: #### Loading Realms and Home Servers ####
proxy server {
retry_delay = 5
retry_count = 3
default_fallback = no
dead_time = 120
wake_all_if_all_dead = no
}
home_server localhost {
ipaddr = 127.0.0.1
port = 1812
type = "auth"
secret = "testing123"
response_window = 20
max_outstanding = 65536
require_message_authenticator = no
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_interval = 30
num_answers_to_alive = 3
num_pings_to_alive = 3
revive_interval = 120
status_check_timeout = 4
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
home_server_pool my_auth_failover {
type = fail-over
home_server = localhost
}
realm example.com {
auth_pool = my_auth_failover
}
realm LOCAL{
}
radiusd: #### Loading Clients ####
client localhost {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = "*******"
nastype = "other"
}
client 10.104.16.128 {
ipaddr = 10.104.16.128
require_message_authenticator = no
secret = "******"
shortname = "Nostracom"
nastype = "other"
}
client 192.168.69.1 {
ipaddr = 192.168.69.1
require_message_authenticator = no
secret = "******"
shortname = "Nostracom"
nastype = "other"
}
radiusd: #### Instantiating modules ####
instantiate {
Module: Linked to module rlm_exec
Module: Instantiating exec
exec {
wait = no
input_pairs = "request"
shell_escape = yes
}
Module: Linked to module rlm_expr
Module: Instantiating expr
Module: Linked to module rlm_expiration
Module: Instantiating expiration
expiration {
reply-message = "Password Has Expired"
}
Module: Linked to module rlm_logintime
Module: Instantiating logintime
logintime {
reply-message = "You are calling outside your allowed timespan "
minimum-timeout = 60
}
}
radiusd: #### Loading Virtual Servers ####
server inner-tunnel {
modules {
Module: Checking authenticate {...} for more modules to load
Module: Linked to module rlm_pap
Module: Instantiating pap
pap {
encryption_scheme = "auto"
auto_header = no
}
Module: Linked to module rlm_mschap
Module: Instantiating mschap
mschap {
use_mppe = yes
require_encryption = yes
require_strong = yes
with_ntdomain_hack = yes
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-HUVN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
}
Module: Linked to module rlm_eap
Module: Instantiating eap
eap {
default_eap_type = "peap"
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
max_sessions = 4096
}
Module: Linked to sub-module rlm_eap_tls
Module: Instantiating eap-tls
tls {
rsa_key_exchange = no
dh_key_exchange = yes
rsa_key_length = 512
dh_key_length = 512
verify_depth = 0
pem_file_type = yes
private_key_file = "/etc/freeradius/certs/server.key"
certificate_file = "/etc/freeradius/certs/server.pem"
CA_file = "/etc/freeradius/certs/ca.pem"
private_key_password = "*****"
dh_file = "/etc/freeradius/certs/dh"
random_file = "/etc/freeradius/certs/random"
fragment_size = 1024
include_length = yes
check_crl = no
cipher_list = "DEFAULT"
cache {
enable = no
lifetime = 24
max_entries = 255
}
}
Module: Linked to sub-module rlm_eap_peap
Module: Instantiating eap-peap
peap {
default_eap_type = "mschapv2"
copy_request_to_tunnel = no
use_tunneled_reply = no
proxy_tunneled_request_as_eap = yes
virtual_server = "inner-tunnel"
}
Module: Linked to sub-module rlm_eap_mschapv2
Module: Instantiating eap-mschapv2
mschapv2 {
with_ntdomain_hack = no
}
Module: Checking authorize {...} for more modules to load
Module: Linked to module rlm_realm
Module: Instantiating suffix
realm suffix {
format = "suffix"
delimiter = "@"
ignore_default = no
ignore_null = no
}
Module: Checking session {...} for more modules to load
Module: Linked to module rlm_radutmp
Module: Instantiating radutmp
radutmp {
filename = "/var/log/freeradius/radutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
perm = 384
callerid = yes
}
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
Module: Linked to module rlm_attr_filter
Module: Instantiating attr_filter.access_reject
attr_filter attr_filter.access_reject {
attrsfile = "/etc/freeradius/attrs.access_reject"
key = "%{User-Name}"
}
} # modules
} # server
server {
modules {
Module: Checking authenticate {...} for more modules to load
Module: Checking authorize {...} for more modules to load
Module: Linked to module rlm_preprocess
Module: Instantiating preprocess
preprocess {
huntgroups = "/etc/freeradius/huntgroups"
hints = "/etc/freeradius/hints"
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
with_alvarion_vsa_hack = no
}
Module: Checking preacct {...} for more modules to load
Module: Linked to module rlm_acct_unique
Module: Instantiating acct_unique
acct_unique {
key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
}
Module: Checking accounting {...} for more modules to load
Module: Linked to module rlm_detail
Module: Instantiating detail
detail {
detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
header = "%t"
detailperm = 384
dirperm = 493
locking = no
log_packet_header = no
}
Module: Instantiating attr_filter.accounting_response
attr_filter attr_filter.accounting_response {
attrsfile = "/etc/freeradius/attrs.accounting_response"
key = "%{User-Name}"
}
Module: Checking session {...} for more modules to load
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
} # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "auth"
ipaddr = *
port = 0
}
listen {
type = "acct"
ipaddr = *
port = 0
}
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 10.104.16.128 port 45236,
id=43, length=163
User-Name = "HUVN\\gdxtrujo"
NAS-IP-Address = 192.168.69.1
NAS-Port = 8193
Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS"
Calling-Station-Id = "00-15-AF-DC-45-2E"
Framed-MTU = 900
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 802.11g"
EAP-Message = 0x02010012014855564e5c6764787472756a6f
Message-Authenticator = 0x7a690fbe4e69ed232adb1afdd61eb451
+- entering group authorize {...}
++[preprocess] returns ok
++[mschap] returns noop
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 1 length 18
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 43 to 10.104.16.128 port 45236
EAP-Message = 0x010200061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x3cd4450c3cd65c57a4c67a935e13b1f8
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=44, length=243
User-Name = "HUVN\\gdxtrujo"
NAS-IP-Address = 192.168.69.1
NAS-Port = 8193
Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS"
Calling-Station-Id = "00-15-AF-DC-45-2E"
Framed-MTU = 900
NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 802.11g"
EAP-Message = 0x0202005019800000004616030100410100003d03014b7d355f9bf52e8c1779e6d1ef7add93b63615a7468de75e9cedc37734cb42ea00001600040005000a000900640062000300060013001200630100
State = 0x3cd4450c3cd65c57a4c67a935e13b1f8
Message-Authenticator = 0xb8c94b0c183743721d148fd2cc54e118
+- entering group authorize {...}
++[preprocess] returns ok
++[mschap] returns noop
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 2 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
TLS Length 70
[peap] Length Included
[peap] eaptls_verify returned 11
[peap] (other): before/accept initialization
[peap] TLS_accept: before/accept initialization
[peap] <<< TLS 1.0 Handshake [length 0041], ClientHello
[peap] TLS_accept: SSLv3 read client hello A
[peap] >>> TLS 1.0 Handshake [length 002a], ServerHello
[peap] TLS_accept: SSLv3 write server hello A
[peap] >>> TLS 1.0 Handshake [length 08a0], Certificate
[peap] TLS_accept: SSLv3 write certificate A
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
[peap] TLS_accept: SSLv3 write server done A
[peap] TLS_accept: SSLv3 flush data
[peap] TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 44 to 10.104.16.128 port 45236
EAP-Message = 0x0103038019c0000008dd160301002a0200002603014b7d3535617b3f06c7d3d6ee649ea0649f5c4514f3c355a63851a62eae88fcef0000040016030108a00b00089c0008990003ce308203ca308202b2a003020102020101300d06092a864886f70d010104050030819b310b30090603550406130245533112301006035504081309416e64616c756369613110300e060355040713074772616e616461310d300b060355040a13044855564e3130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e6573312530230603550403131c436572746966696361646f20696e7465726e6f20
EAP-Message = 0x64656c204855564e301e170d3130303231383131303535385a170d3131303231383131303535385a30819b310b30090603550406130245533112301006035504081309416e64616c75636961310d300b060355040a13044855564e313730350603550403132e70756572746168766e312e6875766e2e6469726179612e737370612e6a756e74612d616e64616c756369612e65733130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e657330820122300d06092a864886f70d01010105000382010f003082010a0282010100c9a0f9e752a29d36e20366b97df6d8bbae1c6b11c248
EAP-Message = 0x4e8a7ea13dbcdbb3397cc3551bca4317b8679c538ea5779bb256455ec5d26c8f96667cd42451ffadffe085cf807acd4f6766e6a50587a3e606921a657932f28bc4caf1b8b20de5da7dbbfc656cdbe70048743959573e6e2621131f1a6a7dd4284284d6425844a914165aa0f340b7f544d9faf5508acd1160671dce2c69d2a35d9398714c449bddd3ca981500b414c4b0b49f0995311ace024ba7eb5e266b6140d233aea138ec151c41e6c06085ac04837a5471e11274af01de2c5734d172dafc1cfaea87304ade8cecbf330204e702806cb5d562bd2656f43dc67bb3a36000ce69357bbbb4fe104fe6790203010001a317301530130603551d25040c30
EAP-Message = 0x0a06082b06010505070301300d06092a864886f70d01010405000382010100c8c0f7f55aa25c2518202181dd228e722a9890093284585289c10f6e1865f026114a38b545b2b8b39e11db1f4c4fb58053362835f18116ffd8800b21bef9197b1864ed09029c7edf3b18de94dc9ce886d83173962c156299079207020051552ef31d5735718832c9bdd3
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x3cd4450c3dd75c57a4c67a935e13b1f8
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=45, length=169
User-Name = "HUVN\\gdxtrujo"
NAS-IP-Address = 192.168.69.1
NAS-Port = 8193
Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS"
Calling-Station-Id = "00-15-AF-DC-45-2E"
Framed-MTU = 900
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT802.11g"
EAP-Message = 0x020300061900
State = 0x3cd4450c3dd75c57a4c67a935e13b1f8
Message-Authenticator = 0x0d2248a94a51fd9be68bca50c67b8429
+- entering group authorize {...}
++[preprocess] returns ok
++[mschap] returns noop
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 3 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 45 to 10.104.16.128 port 45236
EAP-Message = 0x0104037c1940407a2d7aaa916a7af56d6e11f0f2122fb35582b8c6d9fadcfb531363fb6c9178e625574622c8210d6d0d9688b73435c60e6d01daee7d8bdbe6b6e56d965a49efcf5019bea2bf61a8ea2753e7c33dd1c2149d96e83ecd56311111e3a9f4a0c264f82e85e1074b496f03fff45f273cbab792fab85804deb8b4026fd343b2a98849f4ed25ef76f19b38837c804620091ba9022ca4ac8a9d0004c5308204c1308203a9a0030201020209008235595e0380a483300d06092a864886f70d010105050030819b310b30090603550406130245533112301006035504081309416e64616c756369613110300e060355040713074772616e61646131
EAP-Message = 0x0d300b060355040a13044855564e3130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e6573312530230603550403131c436572746966696361646f20696e7465726e6f2064656c204855564e301e170d3130303231383131303535385a170d3130303332303131303535385a30819b310b30090603550406130245533112301006035504081309416e64616c756369613110300e060355040713074772616e616461310d300b060355040a13044855564e3130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e65
EAP-Message = 0x73312530230603550403131c436572746966696361646f20696e7465726e6f2064656c204855564e30820122300d06092a864886f70d01010105000382010f003082010a0282010100d64bbd4ad1ec76d41f2ace6c442099ec85b405735600b46a821906475dc357b59c3edb22d05c5c22e7be1d99b1b847b30b95ec137d93bf8d652f6c14c3bf0665b702fee14eb64636fc50e3886483e3aacc75080d73f920da50529bb5103bb0de9c15d51c506c8920c1f8bcb3154b1359f6c00268940a7bfa3450bc9a0153cf04fddd5dc4f46067ec8f5183d3790f814570781e7c9d02f6f9e301e0b828f55edae4fc84390cdd3470b2f1f9a8558f28856ff253e9
EAP-Message = 0x5822c9ff96244b5e236006154a32c754fc01cdc883745964901b0e39f3ac6135a2a76dd351e9c4049e658ae2501f6221619b4a41d4acbf0c7f618168f6c04b5352d5b246ef2243fb63d359310203010001a382010430820100301d0603551d0e0416041454f9c12706d36e7282442b9838fce221ba5f26183081d00603551d230481c83081
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x3cd4450c3ed05c57a4c67a935e13b1f8
Finished request 2.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=46, length=169
User-Name = "HUVN\\gdxtrujo"
NAS-IP-Address = 192.168.69.1
NAS-Port = 8193
Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS"
Calling-Station-Id = "00-15-AF-DC-45-2E"
Framed-MTU = 900
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 802.11g"
EAP-Message = 0x020400061900
State = 0x3cd4450c3ed05c57a4c67a935e13b1f8
Message-Authenticator = 0xe7a8886894f56a15a4e5dac3576cd04b
+- entering group authorize {...}
++[preprocess] returns ok
++[mschap] returns noop
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 4 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 46 to 10.104.16.128 port 45236
EAP-Message = 0x010501f71900c5801454f9c12706d36e7282442b9838fce221ba5f2618a181a1a4819e30819b310b30090603550406130245533112301006035504081309416e64616c756369613110300e060355040713074772616e616461310d300b060355040a13044855564e3130302e06092a864886f70d0109011621617273732e68766e2e73737061406a756e74616465616e64616c756369612e6573312530230603550403131c436572746966696361646f20696e7465726e6f2064656c204855564e8209008235595e0380a483300c0603551d13040530030101ff300d06092a864886f70d010105050003820101005f562f88b85ff6fceaa39f3938ebe6
EAP-Message = 0x049eb9de52b47377c7896a46e87d244df4286d48d7f639856078ab9667b2bcee73921d017f66aeeee584acf6e5632a1b9ee18adc3a30679034580f348992803cfc4f7c8b49d518cab99093ba00db3e04ce612a01379a7443c8f38662f98801f58fc56bb574f6cb93314838c70f48d6089e2b03ca5efd96425a6d1205e244277ebf2856910f94e8027b681df32bb4e6247ce879c21ad5216fc7336aaec9dfd871e1f9690783c77dbfea0673c22a7bb282548be147de3f59074e1c21efbf586c07934fd3ae71e331b7c31fb5e15c83fdd52f44d6ee4a1d533a0c29a5f122610d4fbde8b8de8e361e6c79298aec559912533316030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x3cd4450c3fd15c57a4c67a935e13b1f8
Finished request 3.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=47, length=485
User-Name = "HUVN\\gdxtrujo"
NAS-IP-Address = 192.168.69.1
NAS-Port = 8193
Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS"
Calling-Station-Id = "00-15-AF-DC-45-2E"
Framed-MTU = 900
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 802.11g"
EAP-Message = 0x020501401980000001361603010106100001020100057a7c049e1e45ae4cdf01e672f90cdea597c9c86bf6f864a9b01e477f5d556b25c47bd19f8f22ef5905b86745dde3e454fd5aaa6c02379e47fdd9b2b0ac4d0777d8bcfc3e0e7c79986fac80eefc8bd9f9718229f4acd8bb53aa7d6e227f8aff3626cba1b13c1ca516ff8277e47a4291aa57c8da1381336cfaae51108058ca1d5e4c580fc242e1a9d5a35c2e37edc49063865fd29768d7952279c47fb9c8c17925e546e1723e10c781a9593d3e0c109d543462b2070930dfeb6dc3489259d73db520da2197ff47a960415b0c3a65db7837b980664e6ea5badf19ab9b0aa734a79bd73bb657bdf065
EAP-Message = 0x3da16cc050dde37f18a3011e5892db6e9f23a31aee647ed51403010001011603010020fc7cb78c3fcff4257432f413651ff1a68a331daa44063ee1ba7357d53c5c721f
State = 0x3cd4450c3fd15c57a4c67a935e13b1f8
Message-Authenticator = 0xa0b751cab837d32aaade6144d6f08f2e
+- entering group authorize {...}
++[preprocess] returns ok
++[mschap] returns noop
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 5 length 253
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
TLS Length 310
[peap] Length Included
[peap] eaptls_verify returned 11
[peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange
[peap] TLS_accept: SSLv3 read client key exchange A
[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001]
[peap] <<< TLS 1.0 Handshake [length 0010], Finished
[peap] TLS_accept: SSLv3 read finished A
[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001]
[peap] TLS_accept: SSLv3 write change cipher spec A
[peap] >>> TLS 1.0 Handshake [length 0010], Finished
[peap] TLS_accept: SSLv3 write finished A
[peap] TLS_accept: SSLv3 flush data
[peap] (other): SSL negotiation finished successfully
SSL Connection Established
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 47 to 10.104.16.128 port 45236
EAP-Message = 0x010600311900140301000101160301002072ff86ea6e4c6cfc190a9297cf07fd15083137cd2f67edea5dd2f18e75102f06
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x3cd4450c38d25c57a4c67a935e13b1f8
Finished request 4.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=48, length=169
User-Name = "HUVN\\gdxtrujo"
NAS-IP-Address = 192.168.69.1
NAS-Port = 8193
Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS"
Calling-Station-Id = "00-15-AF-DC-45-2E"
Framed-MTU = 900
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 802.11g"
EAP-Message = 0x020600061900
State = 0x3cd4450c38d25c57a4c67a935e13b1f8
Message-Authenticator = 0xc3f2a00bcc6e4f986a6aa4d573441d6a
+- entering group authorize {...}
++[preprocess] returns ok
++[mschap] returns noop
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 6 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake is finished
[peap] eaptls_verify returned 3
[peap] eaptls_process returned 3
[peap] EAPTLS_SUCCESS
++[eap] returns handled
Sending Access-Challenge of id 48 to 10.104.16.128 port 45236
EAP-Message = 0x0107002019001703010015832012a10a36559544d2d55db5f540a35b44d27aa0
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x3cd4450c39d35c57a4c67a935e13b1f8
Finished request 5.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=49, length=204
User-Name = "HUVN\\gdxtrujo"
NAS-IP-Address = 192.168.69.1
NAS-Port = 8193
Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS"
Calling-Station-Id = "00-15-AF-DC-45-2E"
Framed-MTU = 900
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 802.11g"
EAP-Message = 0x020700291900170301001e2acbee97084e2e33afc6ef6db5c15e21dc7840292d08f56549fa5f953b01
State = 0x3cd4450c39d35c57a4c67a935e13b1f8
Message-Authenticator = 0x917540a49ced99b1188e2bc396e9b16b
+- entering group authorize {...}
++[preprocess] returns ok
++[mschap] returns noop
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 7 length 41
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Identity - HUVN\gdxtrujo
[peap] Got tunneled request
EAP-Message = 0x02070012014855564e5c6764787472756a6f
server {
PEAP: Got tunneled identity of HUVN\gdxtrujo
PEAP: Setting default EAP type for tunneled EAP session.
PEAP: Setting User-Name to HUVN\gdxtrujo
Sending tunneled request
EAP-Message = 0x02070012014855564e5c6764787472756a6f
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "HUVN\\gdxtrujo"
server inner-tunnel {
+- entering group authorize {...}
++[mschap] returns noop
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 7 length 18
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
EAP-Message = 0x010800271a0108002210108d0360de57661511ac8e07d44d5fa54855564e5c6764787472756a6f
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xe3f15a23e3f94029084a6a7e3a6f63f8
[peap] Got tunneled reply RADIUS code 11
EAP-Message = 0x010800271a0108002210108d0360de57661511ac8e07d44d5fa54855564e5c6764787472756a6f
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xe3f15a23e3f94029084a6a7e3a6f63f8
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 49 to 10.104.16.128 port 45236
EAP-Message = 0x0108003e19001703010033d2f9963fe2a7c1570b905e3678ce7c0cc342fd75dee75aeef1fab414d1c6bc9087f988a525c3046586add694814100e03271cc
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x3cd4450c3adc5c57a4c67a935e13b1f8
Finished request 6.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.104.16.128 port 45236, id=50, length=258
User-Name = "HUVN\\gdxtrujo"
NAS-IP-Address = 192.168.69.1
NAS-Port = 8193
Called-Station-Id = "00-90-0B-0E-2B-52:REDMEDICOS"
Calling-Station-Id = "00-15-AF-DC-45-2E"
Framed-MTU = 900
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 802.11g"
EAP-Message = 0x0208005f190017030100543af645994c32ed46321e5112cff49a097d65e4a8c10596daba1d5514e2fcebedeba22162932f16450175f7488236bcd243aeb981cebf39d532e62916477ef5555ab630072f0bc847a80ce9975b4051a215abe698
State = 0x3cd4450c3adc5c57a4c67a935e13b1f8
Message-Authenticator = 0x180916b71df70e8ab7d54867f9c22baa
+- entering group authorize {...}
++[preprocess] returns ok
++[mschap] returns noop
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 8 length 95
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] EAP type mschapv2
[peap] Got tunneled request
EAP-Message = 0x020800481a020800433138fec6ce84b614e4f6a3957becea631b00000000000000003e1277f2d4835fc8a8de7dfae71b2890c6ef6d3841140af2004855564e5c6764787472756a6f
server {
PEAP: Setting User-Name to HUVN\gdxtrujo
Sending tunneled request
EAP-Message = 0x020800481a020800433138fec6ce84b614e4f6a3957becea631b00000000000000003e1277f2d4835fc8a8de7dfae71b2890c6ef6d3841140af2004855564e5c6764787472756a6f
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "HUVN\\gdxtrujo"
State = 0xe3f15a23e3f94029084a6a7e3a6f63f8
server inner-tunnel {
+- entering group authorize {...}
++[mschap] returns noop
[suffix] No '@' in User-Name = "HUVN\gdxtrujo", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 8 length 72
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] +- entering group MS-CHAP {...}
[mschap] Told to do MS-CHAPv2 for gdxtrujo with NT-Password
[mschap] expand: --username=%{mschap:User-Name:-None} -> --username=gdxtrujo
[mschap] expand: --domain=%{mschap:NT-Domain:-HUVN} -> --domain=HUVN
[mschap] mschap2: 10
[mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=cacf5023c11e7ea7
[mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=3e1277f2d4835fc8a8de7dfae71b2890c6ef6d3841140af2
Exec-Program output: NT_KEY: 2A28DA9AD2160A673F22F87D37D8E9BC
Exec-Program-Wait: plaintext: NT_KEY: 2A28DA9AD2160A673F22F87D37D8E9BC
Exec-Program: returned: 0
[mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok
MSCHAP Success ++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
EAP-Message = 0x010900331a0308002e533d36453744323533424634333934323345424634454132444141413038424441414534373235363644
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xe3f15a23e2f84029084a6a7e3a6f63f8
[peap] Got tunneled reply RADIUS code 11
EAP-Message = 0x010900331a0308002e533d36453744323533424634333934323345424634454132444141413038424441414534373235363644
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xe3f15a23e2f84029084a6a7e3a6f63f8
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 50 to 10.104.16.128 port 45236
EAP-Message = 0x0109004a1900170301003f27dd660624182f35234bd9f80b3c7ad5c4ca8c538fc86c6bae1ba3991e4d3fd17f1a934ac2f7453801032ca9894b0d4a8687ceccbb61bb439c4c9fc642d244
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x3cd4450c3bdd5c57a4c67a935e13b1f8
Finished request 7.
Going to the next request
Waking up in 4.8 seconds.
Cleaning up request 0 ID 43 with timestamp +35
Cleaning up request 1 ID 44 with timestamp +35
Cleaning up request 2 ID 45 with timestamp +35
Cleaning up request 3 ID 46 with timestamp +35
Cleaning up request 4 ID 47 with timestamp +35
Cleaning up request 5 ID 48 with timestamp +35
Cleaning up request 6 ID 49 with timestamp +35
Cleaning up request 7 ID 50 with timestamp +35
Ready to process requests.
--
Por favor, NO utilice formatos de archivo propietarios para el
intercambio de documentos, como DOC y XLS, sino HTML, RTF, TXT,
CSV o cualquier otro que no obligue a utilizar un programa de un
fabricante concreto para tratar la información contenida en él.
SALUD.
More information about the Freeradius-Users
mailing list