PEAP Authentication Problems with Windows Users
Jacob Dawson
dawson at vt.edu
Tue Sep 6 17:07:10 CEST 2011
Anyone have any thoughts on where I need to poke at this thing? I'm about at the limits of my ability to figure out what's going wrong.
- Jacob
On 29 Aug 2011, at 17:28, Jacob Dawson wrote:
> We're having an odd problem here, and I just can't pin down quite where to look to fix it. We use PEAP-MSCHAPv2 for authentication of our windows domain users on wireless. This is accomplished by terminating the TLS conversation at FreeRADIUS and sending along the MSCHAP conversation to an IAS server. We've tested this in the past, and it's worked fine, and we're doing a modified form of this in production, and it's working fine, but I've lately been unable to get it to work in our pre-production 2.1.11 environment. What's particularly odd is that it's only affecting the Windows clients. My OS X client doing PEAP with the same credentials is happy.
>
> What we're doing in production, which continues to work, is this:
> We terminate TLS at FreeRADIUS. This allows us to manage the wireless service certificate there, keeps the IAS operators from having to keep up with it.
> We proxy the MSCHAP conversation to our OpenRADIUS server (which is also running and interacting with TACACS).
> OpenRADIUS proxies the CHAP stuff to IAS. It may be tinkering with the MSCHAP fields from IAS to make them more compatible (basically changing out the secrets because it's standing in the middle).
> Successful authentication then percolates back through the chain and the user is happy.
>
> In pre-production, it looks like this:
> Request comes in from Windows client, is recognized to be a Domain authentication request, gets proxied to an FR virtual server.
> Said virtual server gets it, processes the TLS and terminates it, and proxies the MSCHAP conversation to IAS.
> IAS does its MSCHAP thing, accepts the user.
> Access-Accept percolates back up through the chain. We send an access challenge, the user sends an Access request, and FR says the user said something weird, so it's rejecting them.
>
> Request comes in from non-windows client, is recognized to be Domain authentication request, gets proxied to an FR virtual server
> Said virtual server gets it, processes the TLS and terminates it, and proxies the MSCHAP conversation to IAS.
> IAS does its MSCHAP thing, accepts the user.
> Access-Accept percolates back up through the chain. We send an access challenge, the user sends an Access request, and FR says everything's fine, user gets Access-Accept.
>
> Thoughts on where I need to look? I can't parse out what's happening to cause a response to be invalid for Windows users but not for, say, Mac users. Our initial guess here is that the Windows clients are looking at the MPPE keys, and are unhappy about them, whereas the Mac clients are not, though we suspect neither set of clients requires them.
>
> Posting relevant bits of debug output below.
>
> Thanks much,
> Jacob M. Dawson
>
> ---------
>
> Pre-production failure:
> rad_recv: Access-Request packet from host 198.82.171.153 port 32768, id=138, length=293
> User-Name = "HOKIES\\dawson"
> Calling-Station-Id = "00-1d-e0-90-5f-db"
> Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test"
> NAS-Port = 29
> NAS-IP-Address = 198.82.171.153
> NAS-Identifier = "cas-6509-3.wsm8b"
> Airespace-Wlan-Id = 17
> Service-Type = Framed-User
> Framed-MTU = 1300
> NAS-Port-Type = Wireless-802.11
> Tunnel-Type:0 = VLAN
> Tunnel-Medium-Type:0 = IEEE-802
> Tunnel-Private-Group-Id:0 = "1381"
> EAP-Message = 0x020b005f19001703010054bdd79574acfa8744908880dfa66a9e861f5fff5d2b3b7e387679b867704afa60476df6cc1ac0f30d92a4dc753cebb4bc4e71f4e0bc4db75534ab2403ec993619f05ad02497597deaa193debe78641e14b4718e84
> State = 0x5b4a8e485341972bae816e794759d3ea
> Message-Authenticator = 0xc234d7f3f04c9d023687fd78e4d5c9da
> (75) # Executing section authorize from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default
> (75) group authorize {
> (75) - entering group authorize {...}
> (75) policy split_username_prefix {
> (75) - entering policy split_username_prefix {...}
> (75) ? if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i)
> (75) ? Evaluating (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) -> TRUE
> (75) ? if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) -> TRUE
> (75) if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) {
> (75) - entering if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) {...}
> (75) update request {
> (75) expand: %{2} -> dawson
> (75) expand: %{1} -> HOKIES
> (75) } # update request = notfound
> (75) [updated] = updated
> (75) - if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) returns updated
> (75) ... skipping else for request 75: Preceding "if" was taken
> (75) - policy split_username_prefix returns updated
> (75) policy split_username_suffix {
> (75) - entering policy split_username_suffix {...}
> (75) ? if (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i)
> (75) ? Evaluating (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) -> FALSE
> (75) ? if (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) -> FALSE
> (75) else else {
> (75) - entering else else {...}
> (75) [noop] = noop
> (75) - else else returns noop
> (75) - policy split_username_suffix returns noop
> (75) [preprocess] = ok
> (75) auth_log : expand: /usr/local/freeradius-2.1.11/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/freeradius-2.1.11/var/log/radius/radacct/198.82.171.153/auth-detail-20110823
> (75) auth_log : /usr/local/freeradius-2.1.11/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/freeradius-2.1.11/var/log/radius/radacct/198.82.171.153/auth-detail-20110823
> (75) auth_log : expand: %t -> Tue Aug 23 10:40:16 2011
> (75) [auth_log] = ok
> rlm_perl: Added pair NAS-Port-Type = Wireless-802.11
> rlm_perl: Added pair Service-Type = Framed-User
> rlm_perl: Added pair Tunnel-Type = VLAN
> rlm_perl: Added pair State = 0x5b4a8e485341972bae816e794759d3ea
> rlm_perl: Added pair Called-Station-Id = 00-21-55-4d-c4-40:CNS-Test
> rlm_perl: Added pair Message-Authenticator = 0xc234d7f3f04c9d023687fd78e4d5c9da
> rlm_perl: Added pair Airespace-Wlan-Id = 17
> rlm_perl: Added pair Stripped-User-Domain = HOKIES
> rlm_perl: Added pair NAS-IP-Address = 198.82.171.153
> rlm_perl: Added pair Tunnel-Private-Group-Id = 1381
> rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802
> rlm_perl: Added pair Calling-Station-Id = 00-1d-e0-90-5f-db
> rlm_perl: Added pair User-Name = HOKIES\\dawson
> rlm_perl: Added pair NAS-Identifier = cas-6509-3.wsm8b
> rlm_perl: Added pair EAP-Message = 0x020b005f19001703010054bdd79574acfa8744908880dfa66a9e861f5fff5d2b3b7e387679b867704afa60476df6cc1ac0f30d92a4dc753cebb4bc4e71f4e0bc4db75534ab2403ec993619f05ad02497597deaa193debe78641e14b4718e84
> rlm_perl: Added pair Stripped-User-Name = dawson
> rlm_perl: Added pair NAS-Port = 29
> rlm_perl: Added pair Framed-MTU = 1300
> (75) [perl] = noop
> (75) ? if ("%{Stripped-User-Domain}" != "HOKIES")
> (75) expand: %{Stripped-User-Domain} -> HOKIES
> (75) ? Evaluating ("%{Stripped-User-Domain}" != "HOKIES") -> FALSE
> (75) ? if ("%{Stripped-User-Domain}" != "HOKIES") -> FALSE
> (75) eap : EAP packet type response id 11 length 95
> (75) eap : Continuing tunnel setup.
> (75) [eap] = ok
> (75) Found Auth-Type = ?
> (75) # Executing group from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default
> (75) group authenticate {
> (75) - entering group authenticate {...}
> (75) eap : Request found, released from the list
> (75) eap : EAP/peap
> (75) eap : processing type peap
> (75) peap : processing EAP-TLS
> (75) peap : eaptls_verify returned 7
> (75) peap : Done initial handshake
> (75) peap : eaptls_process returned 7
> (75) peap : FR_TLS_OK
> (75) peap : Session established. Decoding tunneled attributes.
> (75) peap : Peap state phase2
> (75) peap : EAP type mschapv2
> (75) peap : Got tunneled request
> EAP-Message = 0x020b00481a020b004331bf4d439d3028cbdba8fff532c04f1cf60000000000000000bee44f94acbe708a682535adc0505e56a87462580576d06600484f4b4945535c646177736f6e
> server {
> (75) peap : Setting User-Name to HOKIES\dawson
> Sending tunneled request
> EAP-Message = 0x020b00481a020b004331bf4d439d3028cbdba8fff532c04f1cf60000000000000000bee44f94acbe708a682535adc0505e56a87462580576d06600484f4b4945535c646177736f6e
> FreeRADIUS-Proxied-To = 127.0.0.1
> User-Name = "HOKIES\\dawson"
> State = 0x21ebcfee21e0d5ab22fbf5cfb29bfd25
> NAS-Port-Type = Wireless-802.11
> Service-Type = Framed-User
> Tunnel-Type:0 = VLAN
> Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test"
> NAS-IP-Address = 198.82.171.153
> Tunnel-Private-Group-Id:0 = "1381"
> Tunnel-Medium-Type:0 = IEEE-802
> Calling-Station-Id = "00-1d-e0-90-5f-db"
> NAS-Identifier = "cas-6509-3.wsm8b"
> NAS-Port = 29
> Framed-MTU = 1300
> server proxy-inner-tunnel {
> (75) # Executing section authorize from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/proxy-inner-tunnel
> (75) group authorize {
> (75) - entering group authorize {...}
> (75) ? if ("%{User-Name}" =~ /^(host\/.*)$/)
> (75) expand: %{User-Name} -> HOKIES\dawson
> (75) ? Evaluating ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE
> (75) ? if ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE
> (75) else else {
> (75) - entering else else {...}
> (75) update control {
> (75) } # update control = notfound
> (75) - else else returns notfound
> } # server proxy-inner-tunnel
> (75) peap : Got tunneled reply code 0
> PEAP: Calling authenticate in order to initiate tunneled EAP session.
> (75) # Executing group from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/proxy-inner-tunnel
> (75) group authenticate {
> (75) - entering group authenticate {...}
> (75) eap : Request found, released from the list
> (75) eap : EAP/mschapv2
> (75) eap : processing type mschapv2
> rlm_eap_mschapv2: cancelling authentication and letting it be proxied
> (75) eap : Not-EAP proxy set. Not composing EAP
> (75) [eap] = handled
> PEAP: Tunneled authentication will be proxied to DomainUser
> PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy.
> (75) eap : Tunneled session will be proxied. Not doing EAP.
> (75) [eap] = handled
> (75) WARNING: Empty pre-proxy section. Using default return values.
> Sending Access-Request of id 161 to 198.82.160.219 port 1812
> User-Name = "HOKIES\\dawson"
> NAS-Port-Type = Wireless-802.11
> Service-Type = Framed-User
> Tunnel-Type:0 = VLAN
> Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test"
> NAS-IP-Address = 198.82.171.153
> Tunnel-Private-Group-Id:0 = "1381"
> Tunnel-Medium-Type:0 = IEEE-802
> Calling-Station-Id = "00-1d-e0-90-5f-db"
> NAS-Identifier = "cas-6509-3.wsm8b"
> NAS-Port = 29
> Framed-MTU = 1300
> MS-CHAP-Challenge = 0xd3827513a357a99d4eb9a5c87a716418
> MS-CHAP2-Response = 0x0b4fbf4d439d3028cbdba8fff532c04f1cf60000000000000000bee44f94acbe708a682535adc0505e56a87462580576d066
> Proxy-State = 0x313338
> (75) Proxying request to home server 198.82.160.219 port 1812
> Sending Access-Request of id 161 to 198.82.160.219 port 1812
> User-Name = "HOKIES\\dawson"
> NAS-Port-Type = Wireless-802.11
> Service-Type = Framed-User
> Tunnel-Type:0 = VLAN
> Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test"
> NAS-IP-Address = 198.82.171.153
> Tunnel-Private-Group-Id:0 = "1381"
> Tunnel-Medium-Type:0 = IEEE-802
> Calling-Station-Id = "00-1d-e0-90-5f-db"
> NAS-Identifier = "cas-6509-3.wsm8b"
> NAS-Port = 29
> Framed-MTU = 1300
> MS-CHAP-Challenge = 0xd3827513a357a99d4eb9a5c87a716418
> MS-CHAP2-Response = 0x0b4fbf4d439d3028cbdba8fff532c04f1cf60000000000000000bee44f94acbe708a682535adc0505e56a87462580576d066
> Proxy-State = 0x313338
> Waking up in 0.2 seconds.
> rad_recv: Access-Accept packet from host 198.82.160.219 port 1812, id=161, length=219
> DEBUG: Compare b472204 to calculated digest f796ca40, secret temporaryS3CR3T
> Proxy-State = 0x313338
> Framed-Protocol = PPP
> Service-Type = Framed-User
> Class = 0x6538078a000001370001c652a0db01cc5476fe414ece0000000000004586
> MS-MPPE-Recv-Key = 0x7208bb9a9555b125d123303ac3db12a1
> MS-MPPE-Send-Key = 0x0cd6218a695a558ade111bcd7b05cfc2
> MS-CHAP2-Success = 0x0b533d32434230433038364541464632333233453842414534314643443231333130453939354641454134
> MS-CHAP-Domain = "\013HOKIES"
> (75) # Executing section post-proxy from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default
> (75) group post-proxy {
> (75) - entering group post-proxy {...}
> (75) eap : Doing post-proxy callback
> (75) eap : Passing reply from proxy back into the tunnel.
> server proxy-inner-tunnel {
> (75) eap : Passing reply back for EAP-MS-CHAP-V2
> (75) # Executing section post-proxy from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/proxy-inner-tunnel
> (75) group post-proxy {
> (75) - entering group post-proxy {...}
> (75) [eap] = noop
> (75) WARNING: Empty post-auth section. Using default return values.
> } # server proxy-inner-tunnel
> (75) eap : Final reply from tunneled session code 2
> Proxy-State = 0x313338
> Framed-Protocol = PPP
> Service-Type = Framed-User
> Class = 0x6538078a000001370001c652a0db01cc5476fe414ece0000000000004586
> MS-MPPE-Recv-Key = 0x7208bb9a9555b125d123303ac3db12a1
> MS-MPPE-Send-Key = 0x0cd6218a695a558ade111bcd7b05cfc2
> MS-CHAP2-Success = 0x0b533d32434230433038364541464632333233453842414534314643443231333130453939354641454134
> MS-CHAP-Domain = "\013HOKIES"
> (75) eap : Got reply 2
> (75) eap : Got tunneled reply RADIUS code 2
> Proxy-State = 0x313338
> Framed-Protocol = PPP
> Service-Type = Framed-User
> Class = 0x6538078a000001370001c652a0db01cc5476fe414ece0000000000004586
> MS-MPPE-Recv-Key = 0x7208bb9a9555b125d123303ac3db12a1
> MS-MPPE-Send-Key = 0x0cd6218a695a558ade111bcd7b05cfc2
> MS-CHAP2-Success = 0x0b533d32434230433038364541464632333233453842414534314643443231333130453939354641454134
> MS-CHAP-Domain = "\013HOKIES"
> (75) eap : Tunneled authentication was successful.
> (75) eap : SUCCESS
> (75) eap : Reply was handled
> (75) [eap] = ok
> (75) Found Auth-Type = ?
> (75) Found Auth-Type = ?
> (75) Warning: Found 2 auth-types on request for user 'HOKIES\dawson'
> (75) Auth-Type = Accept, accepting the user
> (75) Login OK: [HOKIES\\dawson] (from client 198.82.171.153 port 29 cli 00-1d-e0-90-5f-db)
> (75) # Executing section post-auth from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default
> (75) group post-auth {
> (75) - entering group post-auth {...}
> (75) [exec] = noop
> Sending Access-Challenge of id 138 to 198.82.171.153 port 32768
> EAP-Message = 0x010c00261900170301001b0167b434a0313cb3f29b20e1f731efe3d173083c964cda1451135a
> Message-Authenticator = 0x00000000000000000000000000000000
> State = 0x5b4a8e485246972bae816e794759d3ea
> (75) Finished request 75.
> Waking up in 0.2 seconds.
> rad_recv: Access-Request packet from host 198.82.171.153 port 32768, id=139, length=236
> User-Name = "HOKIES\\dawson"
> Calling-Station-Id = "00-1d-e0-90-5f-db"
> Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test"
> NAS-Port = 29
> NAS-IP-Address = 198.82.171.153
> NAS-Identifier = "cas-6509-3.wsm8b"
> Airespace-Wlan-Id = 17
> Service-Type = Framed-User
> Framed-MTU = 1300
> NAS-Port-Type = Wireless-802.11
> Tunnel-Type:0 = VLAN
> Tunnel-Medium-Type:0 = IEEE-802
> Tunnel-Private-Group-Id:0 = "1381"
> EAP-Message = 0x020c00261900170301001b00dae368dd150e9d42e0c8888cb128e6ecc520b887a849a8a1d743
> State = 0x5b4a8e485246972bae816e794759d3ea
> Message-Authenticator = 0x26b42d72271f1819599977a28920622f
> (76) # Executing section authorize from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default
> (76) group authorize {
> (76) - entering group authorize {...}
> (76) policy split_username_prefix {
> (76) - entering policy split_username_prefix {...}
> (76) ? if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i)
> (76) ? Evaluating (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) -> TRUE
> (76) ? if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) -> TRUE
> (76) if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) {
> (76) - entering if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) {...}
> (76) update request {
> (76) expand: %{2} -> dawson
> (76) expand: %{1} -> HOKIES
> (76) } # update request = notfound
> (76) [updated] = updated
> (76) - if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) returns updated
> (76) ... skipping else for request 76: Preceding "if" was taken
> (76) - policy split_username_prefix returns updated
> (76) policy split_username_suffix {
> (76) - entering policy split_username_suffix {...}
> (76) ? if (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i)
> (76) ? Evaluating (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) -> FALSE
> (76) ? if (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) -> FALSE
> (76) else else {
> (76) - entering else else {...}
> (76) [noop] = noop
> (76) - else else returns noop
> (76) - policy split_username_suffix returns noop
> (76) [preprocess] = ok
> (76) auth_log : expand: /usr/local/freeradius-2.1.11/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/freeradius-2.1.11/var/log/radius/radacct/198.82.171.153/auth-detail-20110823
> (76) auth_log : /usr/local/freeradius-2.1.11/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/freeradius-2.1.11/var/log/radius/radacct/198.82.171.153/auth-detail-20110823
> (76) auth_log : expand: %t -> Tue Aug 23 10:40:16 2011
> (76) [auth_log] = ok
> rlm_perl: Added pair NAS-Port-Type = Wireless-802.11
> rlm_perl: Added pair Service-Type = Framed-User
> rlm_perl: Added pair Tunnel-Type = VLAN
> rlm_perl: Added pair State = 0x5b4a8e485246972bae816e794759d3ea
> rlm_perl: Added pair Called-Station-Id = 00-21-55-4d-c4-40:CNS-Test
> rlm_perl: Added pair Message-Authenticator = 0x26b42d72271f1819599977a28920622f
> rlm_perl: Added pair Airespace-Wlan-Id = 17
> rlm_perl: Added pair Stripped-User-Domain = HOKIES
> rlm_perl: Added pair NAS-IP-Address = 198.82.171.153
> rlm_perl: Added pair Tunnel-Private-Group-Id = 1381
> rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802
> rlm_perl: Added pair Calling-Station-Id = 00-1d-e0-90-5f-db
> rlm_perl: Added pair User-Name = HOKIES\\dawson
> rlm_perl: Added pair NAS-Identifier = cas-6509-3.wsm8b
> rlm_perl: Added pair EAP-Message = 0x020c00261900170301001b00dae368dd150e9d42e0c8888cb128e6ecc520b887a849a8a1d743
> rlm_perl: Added pair Stripped-User-Name = dawson
> rlm_perl: Added pair NAS-Port = 29
> rlm_perl: Added pair Framed-MTU = 1300
> (76) [perl] = noop
> (76) ? if ("%{Stripped-User-Domain}" != "HOKIES")
> (76) expand: %{Stripped-User-Domain} -> HOKIES
> (76) ? Evaluating ("%{Stripped-User-Domain}" != "HOKIES") -> FALSE
> (76) ? if ("%{Stripped-User-Domain}" != "HOKIES") -> FALSE
> (76) eap : EAP packet type response id 12 length 38
> (76) eap : Continuing tunnel setup.
> (76) [eap] = ok
> (76) Found Auth-Type = ?
> (76) # Executing group from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default
> (76) group authenticate {
> (76) - entering group authenticate {...}
> (76) eap : Request found, released from the list
> (76) eap : EAP/peap
> (76) eap : processing type peap
> (76) peap : processing EAP-TLS
> (76) peap : eaptls_verify returned 7
> (76) peap : Done initial handshake
> (76) peap : eaptls_process returned 7
> (76) peap : FR_TLS_OK
> (76) peap : Session established. Decoding tunneled attributes.
> (76) peap : Peap state send tlv success
> (76) peap : Received EAP-TLV response.
> (76) peap : Client rejected our response. The password is probably incorrect.
> (76) peap : We sent a success, but received something weird in return.
> (76) eap : Handler failed in EAP/peap
> (76) eap : Failed in EAP select
> (76) [eap] = invalid
> (76) Failed to authenticate the user.
> (76) Login incorrect: [HOKIES\\dawson] (from client 198.82.171.153 port 29 cli 00-1d-e0-90-5f-db)
> (76) Using Post-Auth-Type Reject
> (76) # Executing group from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default
> (76) group REJECT {
> (76) - entering group REJECT {...}
> (76) attr_filter.access_reject : expand: %{User-Name} -> HOKIES\dawson
> attr_filter: Matched entry DEFAULT at line 11
> (76) [attr_filter.access_reject] = updated
> (76) Finished request 76.
> Waking up in 0.2 seconds.
> Waking up in 0.6 seconds.
> (76) Sending delayed reject
> Sending Access-Reject of id 139 to 198.82.171.153 port 32768
> EAP-Message = 0x040c0004
> Message-Authenticator = 0x00000000000000000000000000000000
>
> -----
>
> Production Success:
> Waking up in 4.9 seconds.
> User-Name = "HOKIES\\dawson"
> Calling-Station-Id = "00-1d-e0-90-5f-db"
> Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test"
> NAS-Port = 29
> NAS-IP-Address = 198.82.171.153
> NAS-Identifier = "cas-6509-3.wsm8b"
> Airespace-Wlan-Id = 17
> Service-Type = Framed-User
> Framed-MTU = 1300
> NAS-Port-Type = Wireless-802.11
> Tunnel-Type:0 = VLAN
> Tunnel-Medium-Type:0 = IEEE-802
> Tunnel-Private-Group-Id:0 = "1381"
> EAP-Message = 0x020a005f1900170301005499a000fc4d08b0c067d3251047d61b836767466160c386b38d37d4b6c39b07ce3b09c85590c8a923419e6f0ae464ac472050214b71b4d641e06f8a439348319233d622cd7900f8f172726407b0010bcb54c6a1d6
> State = 0x764462057e4e7bc59f1c525ed4400d40
> Message-Authenticator = 0xd9566738adb17439ce7d7568c8bc8264
> +- entering group authorize
> ++[mschap] returns noop
> rlm_eap: EAP packet type response id 10 length 95
> rlm_eap: Continuing tunnel setup.
> ++[eap] returns ok
> rad_check_password: Found Auth-Type EAP
> auth: type "EAP"
> +- entering group EAP
> rlm_eap: Request found, released from the list
> rlm_eap: EAP/peap
> rlm_eap: processing type peap
> rlm_eap_peap: Authenticate
> rlm_eap_tls: processing TLS
> eaptls_verify returned 7
> rlm_eap_tls: Done initial handshake
> eaptls_process returned 7
> rlm_eap_peap: EAPTLS_OK
> rlm_eap_peap: Session established. Decoding tunneled attributes.
> rlm_eap_peap: EAP type mschapv2
> PEAP: Setting User-Name to HOKIES\dawson
> +- entering group authorize
> ++? if ("%{User-Name}" =~ /^(host\/.*)$/)
> expand: %{User-Name} -> HOKIES\dawson
> ? Evaluating ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE
> ++? if ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE
> ++- entering else else
> +++[control] returns notfound
> ++- else else returns notfound
> PEAP: Calling authenticate in order to initiate tunneled EAP session.
> +- entering group authenticate
> rlm_eap: Request found, released from the list
> rlm_eap: EAP/mschapv2
> rlm_eap: processing type mschapv2
> Not-EAP proxy set. Not composing EAP
> ++[eap] returns handled
> PEAP: Tunneled authentication will be proxied to openradius
> PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy.
> Tunneled session will be proxied. Not doing EAP.
> ++[eap] returns handled
> +- entering group pre-proxy
> preproxy_users: Matched entry DEFAULT at line 1
> ++[files] returns ok
> User-Name = "HOKIES\\dawson"
> Calling-Station-Id = "00-1d-e0-90-5f-db"
> Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test"
> NAS-Port = 29
> NAS-IP-Address := 198.82.247.103
> NAS-Identifier = "cas-6509-3.wsm8b"
> Airespace-Wlan-Id = 17
> Service-Type := Framed-User
> Framed-MTU = 1300
> NAS-Port-Type := Wireless-802.11
> Tunnel-Type:0 = VLAN
> Tunnel-Medium-Type:0 = IEEE-802
> Tunnel-Private-Group-Id:0 = "1381"
> MS-CHAP-Challenge = 0x20760eb105e545d6a131f324c1d30464
> MS-CHAP2-Response = 0x0a4f84e590f059f31dc3ca5b621b238582190000000000000000385984c78f91f816edb8f1b279838a0a890bdd6573bac9f7
> Proxy-State = 0x323433
> Proxying request 9 to home server 198.82.247.67 port 1812
> User-Name = "HOKIES\\dawson"
> Calling-Station-Id = "00-1d-e0-90-5f-db"
> Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test"
> NAS-Port = 29
> NAS-IP-Address := 198.82.247.103
> NAS-Identifier = "cas-6509-3.wsm8b"
> Airespace-Wlan-Id = 17
> Service-Type := Framed-User
> Framed-MTU = 1300
> NAS-Port-Type := Wireless-802.11
> Tunnel-Type:0 = VLAN
> Tunnel-Medium-Type:0 = IEEE-802
> Tunnel-Private-Group-Id:0 = "1381"
> MS-CHAP-Challenge = 0x20760eb105e545d6a131f324c1d30464
> MS-CHAP2-Response = 0x0a4f84e590f059f31dc3ca5b621b238582190000000000000000385984c78f91f816edb8f1b279838a0a890bdd6573bac9f7
> Proxy-State = 0x323433
> Going to the next request
> Waking up in 0.9 seconds.
> Framed-Protocol = PPP
> Service-Type = Framed-User
> MS-MPPE-Recv-Key = 0xe32365fe45921738025084f44fd7822a
> MS-MPPE-Send-Key = 0xf65c13fbcd70a80768ea868ec27085ff
> MS-CHAP2-Success = 0x0a533d46333146313034313438374339373131303542344546363341364339333146344135424141383434
> MS-CHAP-Domain = "\nHOKIES"
> +- entering group post-proxy
> rlm_eap: Doing post-proxy callback
> PEAP: Passing reply from proxy back into the tunnel.
> PEAP: Passing reply back for EAP-MS-CHAP-V2
> +- entering group post-proxy
> rlm_eap: Doing post-proxy callback
> rlm_eap_mschapv2: Passing reply from proxy back into the tunnel 0x1cd469a0 2.
> rlm_eap_mschapv2: Authentication succeeded.
> MSCHAP Success
> ++[eap] returns ok
> PEAP: Got reply 11
> PEAP: Got tunneled Access-Challenge
> PEAP: Reply was handled
> ++[eap] returns ok
> EAP-Message = 0x010b004a1900170301003f084cf62c48fb9b9e951aa3801c9a88bbe2078c7a667df320929296299bdff2863bf8572a744dac5d9409953cda9855feca24aa24b8205677fbf3f7e3767f36
> Message-Authenticator = 0x00000000000000000000000000000000
> State = 0x764462057f4f7bc59f1c525ed4400d40
> Finished request 9.
> Going to the next request
> Waking up in 4.9 seconds.
> User-Name = "HOKIES\\dawson"
> Calling-Station-Id = "00-1d-e0-90-5f-db"
> Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test"
> NAS-Port = 29
> NAS-IP-Address = 198.82.171.153
> NAS-Identifier = "cas-6509-3.wsm8b"
> Airespace-Wlan-Id = 17
> Service-Type = Framed-User
> Framed-MTU = 1300
> NAS-Port-Type = Wireless-802.11
> Tunnel-Type:0 = VLAN
> Tunnel-Medium-Type:0 = IEEE-802
> Tunnel-Private-Group-Id:0 = "1381"
> EAP-Message = 0x020b001d19001703010012091d2f1089b72dd14c76daf331c2dc4de167
> State = 0x764462057f4f7bc59f1c525ed4400d40
> Message-Authenticator = 0xee39bc3d804727c33f69fc7d8172d2bf
> +- entering group authorize
> ++[mschap] returns noop
> rlm_eap: EAP packet type response id 11 length 29
> rlm_eap: Continuing tunnel setup.
> ++[eap] returns ok
> rad_check_password: Found Auth-Type EAP
> auth: type "EAP"
> +- entering group EAP
> rlm_eap: Request found, released from the list
> rlm_eap: EAP/peap
> rlm_eap: processing type peap
> rlm_eap_peap: Authenticate
> rlm_eap_tls: processing TLS
> eaptls_verify returned 7
> rlm_eap_tls: Done initial handshake
> eaptls_process returned 7
> rlm_eap_peap: EAPTLS_OK
> rlm_eap_peap: Session established. Decoding tunneled attributes.
> rlm_eap_peap: EAP type mschapv2
> PEAP: Setting User-Name to HOKIES\dawson
> +- entering group authorize
> ++? if ("%{User-Name}" =~ /^(host\/.*)$/)
> expand: %{User-Name} -> HOKIES\dawson
> ? Evaluating ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE
> ++? if ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE
> ++- entering else else
> +++[control] returns notfound
> ++- else else returns notfound
> PEAP: Calling authenticate in order to initiate tunneled EAP session.
> +- entering group authenticate
> rlm_eap: Request found, released from the list
> rlm_eap: EAP/mschapv2
> rlm_eap: processing type mschapv2
> rlm_eap: Freeing handler
> ++[eap] returns ok
> PEAP: Tunneled authentication was successful.
> rlm_eap_peap: SUCCESS
> ++[eap] returns handled
> EAP-Message = 0x010c00261900170301001badffc5c8196273037ffc5ae8b421cb5a11d4cdbf3d67e521a2dd10
> Message-Authenticator = 0x00000000000000000000000000000000
> State = 0x764462057c487bc59f1c525ed4400d40
> Finished request 10.
> Going to the next request
> Waking up in 4.9 seconds.
> User-Name = "HOKIES\\dawson"
> Calling-Station-Id = "00-1d-e0-90-5f-db"
> Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test"
> NAS-Port = 29
> NAS-IP-Address = 198.82.171.153
> NAS-Identifier = "cas-6509-3.wsm8b"
> Airespace-Wlan-Id = 17
> Service-Type = Framed-User
> Framed-MTU = 1300
> NAS-Port-Type = Wireless-802.11
> Tunnel-Type:0 = VLAN
> Tunnel-Medium-Type:0 = IEEE-802
> Tunnel-Private-Group-Id:0 = "1381"
> EAP-Message = 0x020c00261900170301001be252b19386182f2a3d9b6255f0b51007da074f90f732568c1dfbb8
> State = 0x764462057c487bc59f1c525ed4400d40
> Message-Authenticator = 0xc04ab29e63cd60e30bfd3fed2ba3be09
> +- entering group authorize
> ++[mschap] returns noop
> rlm_eap: EAP packet type response id 12 length 38
> rlm_eap: Continuing tunnel setup.
> ++[eap] returns ok
> rad_check_password: Found Auth-Type EAP
> auth: type "EAP"
> +- entering group EAP
> rlm_eap: Request found, released from the list
> rlm_eap: EAP/peap
> rlm_eap: processing type peap
> rlm_eap_peap: Authenticate
> rlm_eap_tls: processing TLS
> eaptls_verify returned 7
> rlm_eap_tls: Done initial handshake
> eaptls_process returned 7
> rlm_eap_peap: EAPTLS_OK
> rlm_eap_peap: Session established. Decoding tunneled attributes.
> rlm_eap_peap: Received EAP-TLV response.
> rlm_eap_peap: Success
> rlm_eap: Freeing handler
> ++[eap] returns ok
> perl_pool: item 0x17a6e7a0 asigned new request. Handled so far: 1
> found interpetator at address 0x17a6e7a0
> rlm_perl: no serial number; assuming non-TLS authentication
> rlm_perl: Added pair NAS-Port-Type = Wireless-802.11
> rlm_perl: Added pair Service-Type = Framed-User
> rlm_perl: Added pair Tunnel-Type = VLAN
> rlm_perl: Added pair State = 0x764462057c487bc59f1c525ed4400d40
> rlm_perl: Added pair Called-Station-Id = 00-21-55-4d-c4-40:CNS-Test
> rlm_perl: Added pair Message-Authenticator = 0xc04ab29e63cd60e30bfd3fed2ba3be09
> rlm_perl: Added pair Airespace-Wlan-Id = 17
> rlm_perl: Added pair EAP-Type = PEAP
> rlm_perl: Added pair NAS-IP-Address = 198.82.171.153
> rlm_perl: Added pair Tunnel-Private-Group-Id = 1381
> rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802
> rlm_perl: Added pair Calling-Station-Id = 00-1d-e0-90-5f-db
> rlm_perl: Added pair User-Name = HOKIES\\dawson
> rlm_perl: Added pair NAS-Identifier = cas-6509-3.wsm8b
> rlm_perl: Added pair EAP-Message = 0x020c00261900170301001be252b19386182f2a3d9b6255f0b51007da074f90f732568c1dfbb8
> rlm_perl: Added pair NAS-Port = 29
> rlm_perl: Added pair Framed-MTU = 1300
> rlm_perl: Added pair User-Name = HOKIES\\dawson
> rlm_perl: Added pair MS-MPPE-Recv-Key = 0x4e3e827b7fb173dbe293fadd607586b838cd55ae5261090fd483569509a070de
> rlm_perl: Added pair EAP-Message = 0x030c0004
> rlm_perl: Added pair MS-MPPE-Send-Key = 0xb43ef9e36d44d66d205184ee8ca81f0f14e3a52cd254bd27268c7c99f58a18b0
> rlm_perl: Added pair Message-Authenticator = 0x00000000000000000000000000000000
> rlm_perl: Added pair Auth-Type = EAP
> perl_pool total/active/spare [32/0/32]
> Unreserve perl at address 0x17a6e7a0
> ++[perl] returns ok
> Login OK: [HOKIES\\\\dawson/<via Auth-Type = EAP>] (from client cas-6509-3.wsm8b port 29 cli 00-1d-e0-90-5f-db)
> User-Name = "HOKIES\\\\dawson"
> MS-MPPE-Recv-Key = 0x4e3e827b7fb173dbe293fadd607586b838cd55ae5261090fd483569509a070de
> EAP-Message = 0x030c0004
> MS-MPPE-Send-Key = 0xb43ef9e36d44d66d205184ee8ca81f0f14e3a52cd254bd27268c7c99f58a18b0
> Message-Authenticator = 0x00000000000000000000000000000000
> Finished request 11.
> Going to the next request
> Waking up in 4.9 seconds.
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
More information about the Freeradius-Users
mailing list