AP> FR> LDAP authentication reject
Thanakorn Rattanatikul
darkmastertg at hotmail.com
Fri Dec 28 06:17:31 CET 2012
I'm trying to setup the server to authenticate
using LDAP. I'm having some problem and hope to get some help from the
list.
I'm trying to setup AP->FR->LDAP. FreeRadius is new installation on CentOS. LDAP is Sun Java System Directory Server.
I'm trying radtest ->FR->LDAP pass but AP->FR->LDAP not pass.
The problem is when I try to authenticate through AP. The debug log shows Failed to authenticate the user. here is the log file.
AP->FR->LDAP --------------------------------------------------------------------------------------------------------------------------
rad_recv: Access-Request packet from host 158.108.180.59 port 1645, id=13, length=126
User-Name = "sun"
Framed-MTU = 1400
Called-Station-Id = "0002.8a78.cbce"
Calling-Station-Id = "0026.b6fc.336b"
Service-Type = Login-User
Message-Authenticator = 0xd98e45842efb5088d933dbc76b4971b0
EAP-Message = 0x020200080173756e
NAS-Port-Type = Wireless-802.11
NAS-Port = 604
NAS-IP-Address = 158.108.180.59
NAS-Identifier = "ANRES-WPA"
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "sun", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[eap] EAP packet type response id 2 length 8
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[ldap] performing user authorization for sun
[ldap] expand: %{Stripped-User-Name} ->
[ldap] ... expanding second conditional
[ldap] expand: %{User-Name} -> sun
[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=sun)
[ldap] expand: ou=guest,dc=ku,dc=ac,dc=th -> ou=guest,dc=ku,dc=ac,dc=th
[ldap] ldap_get_conn: Checking Id: 0
[ldap] ldap_get_conn: Got Id: 0
[ldap] attempting LDAP reconnection
[ldap] (re)connect to 158.108.8.214:389, authentication 0
[ldap] bind as uid=thanakorn,ou=guest,dc=ku,dc=ac,dc=th/testtest to 158.108.8.214:389
[ldap] waiting for bind result ...
[ldap] Bind was successful
[ldap] performing search in ou=guest,dc=ku,dc=ac,dc=th, with filter (uid=sun)
[ldap] looking for check items in directory...
[ldap] looking for reply items in directory...
WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly?
[ldap] user sun authorized to use remote access
[ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 13 to 158.108.180.59 port 1645
EAP-Message = 0x010300061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xca8de702ca8efeeb9a8cc3b7ca070519
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 158.108.180.59 port 1645, id=14, length=245
User-Name = "sun"
Framed-MTU = 1400
Called-Station-Id = "0002.8a78.cbce"
Calling-Station-Id = "0026.b6fc.336b"
Service-Type = Login-User
Message-Authenticator = 0x59f124b27612e5e3a3c11fc7fba42813
EAP-Message = 0x0203006d198000000063160301005e0100005a030150dd1e0d9ec2ce2cdc4c013221a787b5fdc04d048bcea271524a5314d54a5611000018002f00350005000ac013c014c009c00a003200380013000401000019ff01000100000a0006000400170018000b0002010000230000
NAS-Port-Type = Wireless-802.11
NAS-Port = 604
State = 0xca8de702ca8efeeb9a8cc3b7ca070519
NAS-IP-Address = 158.108.180.59
NAS-Identifier = "ANRES-WPA"
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "sun", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[eap] EAP packet type response id 3 length 109
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
TLS Length 99
[peap] Length Included
[peap] eaptls_verify returned 11
[peap] (other): before/accept initialization
[peap] TLS_accept: before/accept initialization
[peap] <<< TLS 1.0 Handshake [length 005e], ClientHello
[peap] TLS_accept: SSLv3 read client hello A
[peap] >>> TLS 1.0 Handshake [length 0031], ServerHello
[peap] TLS_accept: SSLv3 write server hello A
[peap] >>> TLS 1.0 Handshake [length 0774], Certificate
[peap] TLS_accept: SSLv3 write certificate A
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
[peap] TLS_accept: SSLv3 write server done A
[peap] TLS_accept: SSLv3 flush data
[peap] TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 14 to 158.108.180.59 port 1645
EAP-Message = 0x0104040019c0000007b816030100310200002d030150dd1e2b832d8f64a222e96a3038dc90bf3393a032b037b49aba0745fd9e508700002f000005ff0100010016030107740b00077000076d00039a308203963082027ea003020102020101300d06092a864886f70d0101050500307b310b3009060355040613025448310c300a06035504080c034b55313110300e06035504070c0742616e676b6f6b310d300b060355040a0c0454657374310d300b060355040b0c0454657374310f300d06035504030c06546573744341311d301b06092a864886f70d010901160e726f6f74406c6f63616c686f7374301e170d3132303930343034333734305a17
EAP-Message = 0x0d3133303930343034333734305a308188310b3009060355040613025448310c300a06035504080c034b55313110300e06035504070c0742616e676b6f6b31143012060355040a0c0b5465737420536572766572310d300b060355040b0c04546573743115301306035504030c0c546573744341536572766572311d301b06092a864886f70d010901160e726f6f74406c6f63616c686f737430820122300d06092a864886f70d01010105000382010f003082010a0282010100d574b86c1987b469ec4f780e1f9e5dbac9a6c976c93fd05d5807b8dfa0bd71b382cc41bd081491d108898f7710edc1573c2194efb1e654e8502ea39d6b0f499b6b06e0
EAP-Message = 0xbedd60602a21261cd335a3b0b0ee1602143078a625d5f42cf3c322b29f4b790187dc0e1d417bd39b15583705e172f51e9a08adde90544cfc7607085e5c65d5cbe91a77fa71dc99f79162ba746f79fc82cb0af8dc794cc63785543ff7834cfeb090758d940a1b4e011fa7a2295d9a65b3870bd6659b710595926560d7960241c0bc8023852d49e3a6fc0e2ece372e88b22324917d48c582b7f9ba1bcfd0a8356f383e313adfa507545e6df78bf1062e5c93b3291a0c59e75573a1c508a30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000382010100b053a6048aaf12d9bbc829c5953f
EAP-Message = 0x4f67caadb005c3dd955627124f7a0d0a37533bcf373eb8b5b03caab912ffadd6b77ed8374d5c1789ee4e187de1092290b787b28df40b788863a09be2486839322be41eeadc669c5ed16084994443572ce41d341da591fa8a74f2f9d38b18367d2a9d60c1e134984a67a47a4daa2421f2ea6725ffeb8226d130a5fff11b75f4f502259cca35b85d308d7c3b727444fc2c6497045bce333ca987907da4431b2e44727e0362912052ac4987d234712eac42ae299a0e59393d05aa9f2a671c1894270ac40cbca7abab01f47a3b1a9231b611377578f3172e3c2b86b02bca05d8e29eb0323e7eb4e21e9ec725ab9827cef102182a0003cd308203c9308202b1
EAP-Message = 0xa003020102020900b200d3d1
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xca8de702cb89feeb9a8cc3b7ca070519
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 158.108.180.59 port 1645, id=15, length=142
User-Name = "sun"
Framed-MTU = 1400
Called-Station-Id = "0002.8a78.cbce"
Calling-Station-Id = "0026.b6fc.336b"
Service-Type = Login-User
Message-Authenticator = 0xfa6f4e1fe95122897b555064dc25a44c
EAP-Message = 0x020400061900
NAS-Port-Type = Wireless-802.11
NAS-Port = 604
State = 0xca8de702cb89feeb9a8cc3b7ca070519
NAS-IP-Address = 158.108.180.59
NAS-Identifier = "ANRES-WPA"
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "sun", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[eap] EAP packet type response id 4 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 15 to 158.108.180.59 port 1645
EAP-Message = 0x010503c81900899c41fc300d06092a864886f70d0101050500307b310b3009060355040613025448310c300a06035504080c034b55313110300e06035504070c0742616e676b6f6b310d300b060355040a0c0454657374310d300b060355040b0c0454657374310f300d06035504030c06546573744341311d301b06092a864886f70d010901160e726f6f74406c6f63616c686f7374301e170d3132303930343034333134355a170d3134303930343034333134355a307b310b3009060355040613025448310c300a06035504080c034b55313110300e06035504070c0742616e676b6f6b310d300b060355040a0c0454657374310d300b060355040b
EAP-Message = 0x0c0454657374310f300d06035504030c06546573744341311d301b06092a864886f70d010901160e726f6f74406c6f63616c686f737430820122300d06092a864886f70d01010105000382010f003082010a0282010100fa52947024d9686060dc363d8f5d6728eb894eef8c1a7aede445cfdb52861ea9f240477dd8ff383159091e4700fbe4dffdbfce87a04f960d63a346be88bcc5bf4ab49801ee763ac297faf51f700415b18bd835a8990288d179f9ac09c30e06b4e20c7524ab2ddc32313e86883637fa310f11127f906fdd9f39b4d04c811c5344228e0a9adab01d06e076a11057273833a034138cf8fbff1aa74085f63f473606bea59178b03e
EAP-Message = 0xc02edef52a377b5fada1379194114a3c5aea8ea9bc3e833585652c980981d4ed4555097d9ee523ddd55ff61d66d2561791470995faafeae2953b23d31caf78246473053bc31619b225f0348baab30e87d9ea2241f56cad5fc96b0203010001a350304e301d0603551d0e04160414043f1ef9f9442cacc469ae656a58b753b2271808301f0603551d23041830168014043f1ef9f9442cacc469ae656a58b753b2271808300c0603551d13040530030101ff300d06092a864886f70d010105050003820101001fe393ea7117e5b9828099eaad45a769570cfbce261f8a15ccbbe13f34ce2e14706baf04fe7a3103dd9f1881f55f8fa09c354f7a82fdb2fc
EAP-Message = 0xf622b8abdf936088b747addf808d79e5af5f9da5da331f0fe07179e9bffd6ca5945414051f995e460af454b4fac0f5ed8ce45f8fd1f0228dbf0099e9e398572b73ba4ae43182ce54e3af3e12d4b1ef9b6a908182ce6340519f5c770b2e515cca5b3a1846e5687817e83036713bc14fb0d1f88f33f80220ba683e7736b51bdb3cad9b76f889d22e0b70f25d5198ca66939482dc34bce8fa6cd008ca33c2c6560152e43fb5eebaa14b111c3043a5e6a27bef97b003b131936113419e7ba1838df7076c332ee0187ad216030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xca8de702c888feeb9a8cc3b7ca070519
Finished request 2.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 158.108.180.59 port 1645, id=16, length=474
User-Name = "sun"
Framed-MTU = 1400
Called-Station-Id = "0002.8a78.cbce"
Calling-Station-Id = "0026.b6fc.336b"
Service-Type = Login-User
Message-Authenticator = 0xcae6327a8a4636b1d9460ec35548afd0
EAP-Message = 0x020501501980000001461603010106100001020100a1d9753cbdddd2ff8bf1fd3077402200416fb6e05a2dc7b86fe390f7e94d607e78d6ee92c5eef4a2b38e6c1ccde6aabb441a3398bfc9eebc9b8a4ccfc3fec664941e990bad74d916fad82916aabfd2b44a7dcfbd7d49c402e5d8fe4fec268f396149240ed68c19f698a9fb0005f74113d75b03d0e835a5caa7a3518ca6d31f640183798c10847d8822630cd8e0bf9402e6ae29256a28937c625db4679efcb7087165d7c0346ff4b7195d9c9524f08957f1384facf673dc6c4b6e2e22c3e1df196928122b0d293446b1334edd6180bc52b49351750ca0af779ea8e0f6094d99cee1c744ed2dee16da
EAP-Message = 0x9520afa893d4c4b9980c79ef804c40b5063ff9dd5c2232a8140301000101160301003028bf830aeeee15db70a61f185bcffbd97c2c5d42358e8685b5ea09bcbcdcc39aed513444d21e74bd003ebfdcee2fddbc
NAS-Port-Type = Wireless-802.11
NAS-Port = 604
State = 0xca8de702c888feeb9a8cc3b7ca070519
NAS-IP-Address = 158.108.180.59
NAS-Identifier = "ANRES-WPA"
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "sun", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[eap] EAP packet type response id 5 length 253
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
TLS Length 326
[peap] Length Included
[peap] eaptls_verify returned 11
[peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange
[peap] TLS_accept: SSLv3 read client key exchange A
[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001]
[peap] <<< TLS 1.0 Handshake [length 0010], Finished
[peap] TLS_accept: SSLv3 read finished A
[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001]
[peap] TLS_accept: SSLv3 write change cipher spec A
[peap] >>> TLS 1.0 Handshake [length 0010], Finished
[peap] TLS_accept: SSLv3 write finished A
[peap] TLS_accept: SSLv3 flush data
[peap] (other): SSL negotiation finished successfully
SSL Connection Established
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 16 to 158.108.180.59 port 1645
EAP-Message = 0x0106004119001403010001011603010030533e313fc5c7e97ebe91661d552b9d90fbb0a0f7eb9e20e4fc8cbd7ba168bab736cddf55bb8eee15917e1658cbd8b347
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xca8de702c98bfeeb9a8cc3b7ca070519
Finished request 3.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 158.108.180.59 port 1645, id=17, length=142
User-Name = "sun"
Framed-MTU = 1400
Called-Station-Id = "0002.8a78.cbce"
Calling-Station-Id = "0026.b6fc.336b"
Service-Type = Login-User
Message-Authenticator = 0x737573ab1d1c444338eb421de1d9aba8
EAP-Message = 0x020600061900
NAS-Port-Type = Wireless-802.11
NAS-Port = 604
State = 0xca8de702c98bfeeb9a8cc3b7ca070519
NAS-IP-Address = 158.108.180.59
NAS-Identifier = "ANRES-WPA"
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "sun", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[eap] EAP packet type response id 6 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake is finished
[peap] eaptls_verify returned 3
[peap] eaptls_process returned 3
[peap] EAPTLS_SUCCESS
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state TUNNEL ESTABLISHED
++[eap] returns handled
Sending Access-Challenge of id 17 to 158.108.180.59 port 1645
EAP-Message = 0x0107002b19001703010020b6e86650645f72cfd79cd2acd6b19431b155ed12797afdff5915cfd81007c661
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xca8de702ce8afeeb9a8cc3b7ca070519
Finished request 4.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 158.108.180.59 port 1645, id=18, length=179
User-Name = "sun"
Framed-MTU = 1400
Called-Station-Id = "0002.8a78.cbce"
Calling-Station-Id = "0026.b6fc.336b"
Service-Type = Login-User
Message-Authenticator = 0x630fab4e0f2d139de4ee0b401f022af8
EAP-Message = 0x0207002b1900170301002063a7eb46a7d50c02b64e6f24ffc05fcbeb027ef7303692dbea910ed75e64719a
NAS-Port-Type = Wireless-802.11
NAS-Port = 604
State = 0xca8de702ce8afeeb9a8cc3b7ca070519
NAS-IP-Address = 158.108.180.59
NAS-Identifier = "ANRES-WPA"
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "sun", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[eap] EAP packet type response id 7 length 43
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state WAITING FOR INNER IDENTITY
[peap] Identity - sun
[peap] Got inner identity 'sun'
[peap] Setting default EAP type for tunneled EAP session.
[peap] Got tunneled request
EAP-Message = 0x020700080173756e
server {
[peap] Setting User-Name to sun
Sending tunneled request
EAP-Message = 0x020700080173756e
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "sun"
Framed-MTU = 1400
Called-Station-Id = "0002.8a78.cbce"
Calling-Station-Id = "0026.b6fc.336b"
Service-Type = Login-User
NAS-Port-Type = Wireless-802.11
NAS-Port = 604
NAS-IP-Address = 158.108.180.59
NAS-Identifier = "ANRES-WPA"
server {
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "sun", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[eap] EAP packet type response id 7 length 8
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[ldap] performing user authorization for sun
[ldap] expand: %{Stripped-User-Name} ->
[ldap] ... expanding second conditional
[ldap] expand: %{User-Name} -> sun
[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=sun)
[ldap] expand: ou=guest,dc=ku,dc=ac,dc=th -> ou=guest,dc=ku,dc=ac,dc=th
[ldap] ldap_get_conn: Checking Id: 0
[ldap] ldap_get_conn: Got Id: 0
[ldap] performing search in ou=guest,dc=ku,dc=ac,dc=th, with filter (uid=sun)
[ldap] looking for check items in directory...
[ldap] looking for reply items in directory...
WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly?
[ldap] user sun authorized to use remote access
[ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type gtc
[gtc] expand: Password: -> Password:
++[eap] returns handled
} # server
[peap] Got tunneled reply code 11
EAP-Message = 0x0108000f0650617373776f72643a20
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x3c82fc6b3c8afa5c064347d138b046be
[peap] Got tunneled reply RADIUS code 11
EAP-Message = 0x0108000f0650617373776f72643a20
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x3c82fc6b3c8afa5c064347d138b046be
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 18 to 158.108.180.59 port 1645
EAP-Message = 0x0108002b19001703010020d5f9ca75a5edd4336d5789d94a63a83e63f7a38cdac30e0c3e40de5b515fc5e6
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xca8de702cf85feeb9a8cc3b7ca070519
Finished request 5.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 158.108.180.59 port 1645, id=19, length=179
User-Name = "sun"
Framed-MTU = 1400
Called-Station-Id = "0002.8a78.cbce"
Calling-Station-Id = "0026.b6fc.336b"
Service-Type = Login-User
Message-Authenticator = 0x2a7b62d36e2728cd42aea4d4e956a445
EAP-Message = 0x0208002b19001703010020742fc20c8c48ed7cb37762a42f970a5e08a7607f2a1ac3557efbad489a903c98
NAS-Port-Type = Wireless-802.11
NAS-Port = 604
State = 0xca8de702cf85feeb9a8cc3b7ca070519
NAS-IP-Address = 158.108.180.59
NAS-Identifier = "ANRES-WPA"
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "sun", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[eap] EAP packet type response id 8 length 43
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type nak
[peap] Got tunneled request
EAP-Message = 0x02080006031a
server {
[peap] Setting User-Name to sun
Sending tunneled request
EAP-Message = 0x02080006031a
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "sun"
State = 0x3c82fc6b3c8afa5c064347d138b046be
Framed-MTU = 1400
Called-Station-Id = "0002.8a78.cbce"
Calling-Station-Id = "0026.b6fc.336b"
Service-Type = Login-User
NAS-Port-Type = Wireless-802.11
NAS-Port = 604
NAS-IP-Address = 158.108.180.59
NAS-Identifier = "ANRES-WPA"
server {
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "sun", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[eap] EAP packet type response id 8 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[ldap] performing user authorization for sun
[ldap] expand: %{Stripped-User-Name} ->
[ldap] ... expanding second conditional
[ldap] expand: %{User-Name} -> sun
[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=sun)
[ldap] expand: ou=guest,dc=ku,dc=ac,dc=th -> ou=guest,dc=ku,dc=ac,dc=th
[ldap] ldap_get_conn: Checking Id: 0
[ldap] ldap_get_conn: Got Id: 0
[ldap] performing search in ou=guest,dc=ku,dc=ac,dc=th, with filter (uid=sun)
[ldap] looking for check items in directory...
[ldap] looking for reply items in directory...
WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly?
[ldap] user sun authorized to use remote access
[ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP NAK
[eap] EAP-NAK asked for EAP-Type/mschapv2
[eap] processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
++[eap] returns handled
} # server
[peap] Got tunneled reply code 11
EAP-Message = 0x0109001d1a01090018104b2d893422c03d3fe9c06e369968ca9c73756e
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x3c82fc6b3d8be65c064347d138b046be
[peap] Got tunneled reply RADIUS code 11
EAP-Message = 0x0109001d1a01090018104b2d893422c03d3fe9c06e369968ca9c73756e
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x3c82fc6b3d8be65c064347d138b046be
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 19 to 158.108.180.59 port 1645
EAP-Message = 0x0109003b190017030100307c1a0dc184af26fa47813eed5dbe34bf714f3e449bbb7e2d7ed97f4220d49d625106fe6b253fee270f45b8c516da9ea0
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xca8de702cc84feeb9a8cc3b7ca070519
Finished request 6.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 158.108.180.59 port 1645, id=20, length=227
User-Name = "sun"
Framed-MTU = 1400
Called-Station-Id = "0002.8a78.cbce"
Calling-Station-Id = "0026.b6fc.336b"
Service-Type = Login-User
Message-Authenticator = 0x0d033a141040162e477653de08ef1187
EAP-Message = 0x0209005b190017030100508cb89bd8f45f58d83a410fc9b8bd37c4f68dc4c8e034ec7dab59e25e116ab4a2afe9a11e59da3521480e6dcf20840cb7abaf63cbd25c7afcab223f787d178e8071dc59590689e2c23a86c6541d4274e3
NAS-Port-Type = Wireless-802.11
NAS-Port = 604
State = 0xca8de702cc84feeb9a8cc3b7ca070519
NAS-IP-Address = 158.108.180.59
NAS-Identifier = "ANRES-WPA"
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "sun", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[eap] EAP packet type response id 9 length 91
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type mschapv2
[peap] Got tunneled request
EAP-Message = 0x0209003e1a02090039313c56a12beee6b6453079744914ca885d0000000000000000d8611a769cf02eb4c90d745e188930a148479f95861355540073756e
server {
[peap] Setting User-Name to sun
Sending tunneled request
EAP-Message = 0x0209003e1a02090039313c56a12beee6b6453079744914ca885d0000000000000000d8611a769cf02eb4c90d745e188930a148479f95861355540073756e
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "sun"
State = 0x3c82fc6b3d8be65c064347d138b046be
Framed-MTU = 1400
Called-Station-Id = "0002.8a78.cbce"
Calling-Station-Id = "0026.b6fc.336b"
Service-Type = Login-User
NAS-Port-Type = Wireless-802.11
NAS-Port = 604
NAS-IP-Address = 158.108.180.59
NAS-Identifier = "ANRES-WPA"
server {
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "sun", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[eap] EAP packet type response id 9 length 62
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[ldap] performing user authorization for sun
[ldap] expand: %{Stripped-User-Name} ->
[ldap] ... expanding second conditional
[ldap] expand: %{User-Name} -> sun
[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=sun)
[ldap] expand: ou=guest,dc=ku,dc=ac,dc=th -> ou=guest,dc=ku,dc=ac,dc=th
[ldap] ldap_get_conn: Checking Id: 0
[ldap] ldap_get_conn: Got Id: 0
[ldap] performing search in ou=guest,dc=ku,dc=ac,dc=th, with filter (uid=sun)
[ldap] looking for check items in directory...
[ldap] looking for reply items in directory...
WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly?
[ldap] user sun authorized to use remote access
[ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] # Executing group from file /etc/raddb/sites-enabled/default
[mschapv2] +- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured. Cannot create LM-Password.
[mschap] No Cleartext-Password configured. Cannot create NT-Password.
[mschap] Creating challenge hash with username: sun
[mschap] Told to do MS-CHAPv2 for sun with NT-Password
[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
[eap] Freeing handler
++[eap] returns reject
Failed to authenticate the user.
Login incorrect: [sun/<via Auth-Type = EAP>] (from client AP-WPA port 604 cli 0026.b6fc.336b via TLS tunnel)
} # server
[peap] Got tunneled reply code 3
MS-CHAP-Error = "\tE=691 R=1"
EAP-Message = 0x04090004
Message-Authenticator = 0x00000000000000000000000000000000
[peap] Got tunneled reply RADIUS code 3
MS-CHAP-Error = "\tE=691 R=1"
EAP-Message = 0x04090004
Message-Authenticator = 0x00000000000000000000000000000000
[peap] Tunneled authentication was rejected.
[peap] FAILURE
++[eap] returns handled
Sending Access-Challenge of id 20 to 158.108.180.59 port 1645
EAP-Message = 0x010a002b19001703010020a64c6a288d64cde89774bf3e2ff45565dc430e81f56db28ade8837007d4079ff
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xca8de702cd87feeb9a8cc3b7ca070519
Finished request 7.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 158.108.180.59 port 1645, id=21, length=179
User-Name = "sun"
Framed-MTU = 1400
Called-Station-Id = "0002.8a78.cbce"
Calling-Station-Id = "0026.b6fc.336b"
Service-Type = Login-User
Message-Authenticator = 0xebe4c66e2562552000c6e8c17f70f456
EAP-Message = 0x020a002b19001703010020d96a399f4279e24b1bf40f065c5e0e0de6ca6bb2644605b0c6146002a6440810
NAS-Port-Type = Wireless-802.11
NAS-Port = 604
State = 0xca8de702cd87feeb9a8cc3b7ca070519
NAS-IP-Address = 158.108.180.59
NAS-Identifier = "ANRES-WPA"
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "sun", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[eap] EAP packet type response id 10 length 43
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state send tlv failure
[peap] Received EAP-TLV response.
[peap] The users session was previously rejected: returning reject (again.)
[peap] *** This means you need to read the PREVIOUS messages in the debug output
[peap] *** to find out the reason why the user was rejected.
[peap] *** Look for "reject" or "fail". Those earlier messages will tell you.
[peap] *** what went wrong, and how to fix the problem.
[eap] Handler failed in EAP/peap
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
Login incorrect: [sun/<via Auth-Type = EAP>] (from client AP-WPA port 604 cli 0026.b6fc.336b)
Using Post-Auth-Type Reject
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject] expand: %{User-Name} -> sun
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 8 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 8
Sending Access-Reject of id 21 to 158.108.180.59 port 1645
EAP-Message = 0x040a0004
Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.8 seconds.
Cleaning up request 0 ID 13 with timestamp +13
Cleaning up request 1 ID 14 with timestamp +13
Cleaning up request 2 ID 15 with timestamp +13
Cleaning up request 3 ID 16 with timestamp +13
Cleaning up request 4 ID 17 with timestamp +13
Cleaning up request 5 ID 18 with timestamp +13
Cleaning up request 6 ID 19 with timestamp +13
Cleaning up request 7 ID 20 with timestamp +13
Waking up in 1.0 seconds.
Cleaning up request 8 ID 21 with timestamp +13
Ready to process requests.
radtest >FR->LDAP --------------------------------------------------------------------------------------------------------------------------
rad_recv: Access-Request packet from host 127.0.0.1 port 55456, id=134, length=73
User-Name = "sun"
User-Password = "testtest"
NAS-IP-Address = 158.108.212.151
NAS-Port = 0
Message-Authenticator = 0xe77766103ba51b64e3aec4687c4b8677
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "sun", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
[ldap] performing user authorization for sun
[ldap] expand: %{Stripped-User-Name} ->
[ldap] ... expanding second conditional
[ldap] expand: %{User-Name} -> sun
[ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=sun)
[ldap] expand: ou=guest,dc=ku,dc=ac,dc=th -> ou=guest,dc=ku,dc=ac,dc=th
[ldap] ldap_get_conn: Checking Id: 0
[ldap] ldap_get_conn: Got Id: 0
[ldap] attempting LDAP reconnection
[ldap] (re)connect to 158.108.8.214:389, authentication 0
[ldap] bind as / to 158.108.8.214:389
[ldap] waiting for bind result ...
[ldap] Bind was successful
[ldap] performing search in ou=guest,dc=ku,dc=ac,dc=th, with filter (uid=sun)
[ldap] looking for check items in directory...
[ldap] looking for reply items in directory...
WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly?
[ldap] Setting Auth-Type = LDAP
[ldap] user sun authorized to use remote access
[ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = LDAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group LDAP {...}
[ldap] login attempt by "sun" with password "testtest"
[ldap] user DN: uid=sun,ou=guest,dc=ku,dc=ac,dc=th
[ldap] (re)connect to 158.108.8.214:389, authentication 1
[ldap] bind as uid=sun,ou=guest,dc=ku,dc=ac,dc=th/testtest to 158.108.8.214:389
[ldap] waiting for bind result ...
[ldap] Bind was successful
[ldap] user sun authenticated succesfully
++[ldap] returns ok
Login OK: [sun/testtest] (from client localhost port 0)
# Executing section post-auth from file /etc/raddb/sites-enabled/default
+- entering group post-auth {...}
++[exec] returns noop
++[call_php] returns ok
Sending Access-Accept of id 134 to 127.0.0.1 port 55456
Finished request 0.
Going to the next request
Waking up in 3.4 seconds.
Thank you very much for your time and help.
thanakorn
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20121228/0d9d069a/attachment-0001.html>
More information about the Freeradius-Users
mailing list