EAP-PEAP + Windows 7 with SSO and Password change
CD DD
c_dornig at gmx.de
Tue Jun 12 19:47:18 CEST 2012
Hi Phil,
>> But i got from the ntlm_auth Error 691 which are send back to client.
>
>Please post full debugging output i.e. run "radiusd -X" and post the
>output to the list.
>
>Better yet, gather the debug output and READ IT carefully first, to see
>if you can spot the problem.
>
>The MSCHAP password change code looks for the string "Password expired"
>in the output of the ntlm_auth command. If your ntlm_auth is printing
>something different, it'll just assume it's a regular failure.
Sure, here are the Debug output:
FreeRADIUS Version 3.0.0, for host x86_64-portbld-freebsd9.0, built on Jun 12 2012 at 13:31:44
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License v2.
Starting - reading configuration files ...
including configuration file /usr/local/etc/raddb/radiusd.conf
including configuration file /usr/local/etc/raddb/proxy.conf
including configuration file /usr/local/etc/raddb/clients.conf
including files in directory /usr/local/etc/raddb/mods-enabled/
including configuration file /usr/local/etc/raddb/mods-enabled/wimax
including configuration file /usr/local/etc/raddb/mods-enabled/always
including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter
including configuration file /usr/local/etc/raddb/mods-enabled/attr_rewrite
including configuration file /usr/local/etc/raddb/mods-enabled/chap
including configuration file /usr/local/etc/raddb/mods-enabled/checkval
including configuration file /usr/local/etc/raddb/mods-enabled/counter
including configuration file /usr/local/etc/raddb/mods-enabled/cui
including configuration file /usr/local/etc/raddb/mods-enabled/detail
including configuration file /usr/local/etc/raddb/mods-enabled/detail.log
including configuration file /usr/local/etc/raddb/mods-enabled/digest
including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients
including configuration file /usr/local/etc/raddb/mods-enabled/eap
including configuration file /usr/local/etc/raddb/mods-enabled/echo
including configuration file /usr/local/etc/raddb/mods-enabled/exec
including configuration file /usr/local/etc/raddb/mods-enabled/expiration
including configuration file /usr/local/etc/raddb/mods-enabled/expr
including configuration file /usr/local/etc/raddb/mods-enabled/files
including configuration file /usr/local/etc/raddb/mods-enabled/inner-eap
including configuration file /usr/local/etc/raddb/mods-enabled/linelog
including configuration file /usr/local/etc/raddb/mods-enabled/logintime
including configuration file /usr/local/etc/raddb/mods-enabled/mschap
including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth
including configuration file /usr/local/etc/raddb/mods-enabled/pap
including configuration file /usr/local/etc/raddb/mods-enabled/passwd
including configuration file /usr/local/etc/raddb/mods-enabled/preprocess
including configuration file /usr/local/etc/raddb/mods-enabled/radutmp
including configuration file /usr/local/etc/raddb/mods-enabled/realm
including configuration file /usr/local/etc/raddb/mods-enabled/replicate
including configuration file /usr/local/etc/raddb/mods-enabled/soh
including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp
including configuration file /usr/local/etc/raddb/mods-enabled/unix
including configuration file /usr/local/etc/raddb/mods-enabled/utf8
including configuration file /usr/local/etc/raddb/mods-enabled/acct_unique
including configuration file /usr/local/etc/raddb/mods-enabled/ldap
including configuration file /usr/local/etc/raddb/policy.conf
including files in directory /usr/local/etc/raddb/sites-enabled/
including configuration file /usr/local/etc/raddb/sites-enabled/default
including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel
main {
security {
allow_core_dumps = no
}
}
including dictionary file /usr/local/etc/raddb/dictionary
main {
name = "radiusd"
prefix = "/usr/local"
localstatedir = "/var"
sbindir = "/usr/local/sbin"
logdir = "/var/log"
run_dir = "/var/run/radiusd"
libdir = "/usr/local/lib/freeradius-3.0.0"
radacctdir = "/var/log/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
pidfile = "/var/run/radiusd/radiusd.pid"
checkrad = "/usr/local/sbin/checkrad"
debug_level = 0
proxy_requests = yes
log {
stripped_names = no
auth = no
auth_badpass = no
auth_goodpass = no
}
security {
max_attributes = 200
reject_delay = 1
status_server = yes
}
}
radiusd: #### Loading Realms and Home Servers ####
proxy server {
retry_delay = 5
retry_count = 3
default_fallback = no
dead_time = 120
wake_all_if_all_dead = no
}
home_server localhost {
ipaddr = 127.0.0.1
port = 1812
type = "auth"
secret = "testing123"
response_window = 20
max_outstanding = 65536
require_message_authenticator = yes
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_interval = 30
num_answers_to_alive = 3
num_pings_to_alive = 3
revive_interval = 120
status_check_timeout = 4
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
}
home_server_pool my_auth_failover {
type = fail-over
home_server = localhost
}
realm example.com {
auth_pool = my_auth_failover
}
realm LOCAL {
}
radiusd: #### Loading Clients ####
client localhost {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = "testing123"
nastype = "other"
}
client AP {
ipaddr = 10.0.5.100
netmask = 32
require_message_authenticator = no
secret = "**********"
shortname = "AP"
nastype = "other"
}
radiusd: #### Instantiating modules ####
instantiate {
Module: Linked to module rlm_exec
Module: Instantiating module "exec" from file /usr/local/etc/raddb/mods-enabled/exec
exec {
wait = no
input_pairs = "request"
shell_escape = yes
}
Module: Linked to module rlm_expr
Module: Instantiating module "expr" from file /usr/local/etc/raddb/mods-enabled/expr
Module: Linked to module rlm_expiration
Module: Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration
expiration {
reply-message = "Password Has Expired "
}
Module: Linked to module rlm_logintime
Module: Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime
logintime {
reply-message = "You are calling outside your allowed timespan "
minimum-timeout = 60
}
}
radiusd: #### Loading Virtual Servers ####
server { # from file /usr/local/etc/raddb/radiusd.conf
modules {
Module: Creating Auth-Type = digest
Module: Checking authenticate {...} for more modules to load
Module: Linked to module rlm_pap
Module: Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
pap {
encryption_scheme = "auto"
auto_header = no
}
Module: Linked to module rlm_chap
Module: Instantiating module "chap" from file /usr/local/etc/raddb/mods-enabled/chap
Module: Linked to module rlm_mschap
Module: Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap
mschap {
use_mppe = no
require_encryption = no
require_strong = no
with_ntdomain_hack = yes
ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}"
passchange {
ntlm_auth = "/usr/local/bin/ntlm_auth --helper-protocol=ntlm-change-password-1"
ntlm_auth_username = "username: %{mschap:User-Name}"
ntlm_auth_domain = "nt-domain: %{mschap:NT-Domain}"
}
allow_retry = no
retry_msg = "Re-enter (or reset) the password"
}
Module: Linked to module rlm_digest
Module: Instantiating module "digest" from file /usr/local/etc/raddb/mods-enabled/digest
Module: Linked to module rlm_unix
Module: Instantiating module "unix" from file /usr/local/etc/raddb/mods-enabled/unix
unix {
radwtmp = "/var/log/radwtmp"
}
Module: Linked to module rlm_eap
Module: Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
eap {
default_eap_type = "peap"
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
max_sessions = 4096
}
Module: Linked to sub-module rlm_eap_md5
Module: Instantiating eap-md5
Module: Linked to sub-module rlm_eap_pwd
Module: Instantiating eap-pwd
pwd {
group = 19
fragment_size = 1020
server_id = "theserver at example.com"
virtual_server = "inner-tunnel"
}
Module: Linked to sub-module rlm_eap_leap
Module: Instantiating eap-leap
Module: Linked to sub-module rlm_eap_gtc
Module: Instantiating eap-gtc
gtc {
challenge = "Password: "
auth_type = "PAP"
}
Module: Linked to sub-module rlm_eap_tls
Module: Instantiating eap-tls
tls {
tls = "tls-common"
}
tls-config tls-common {
rsa_key_exchange = no
dh_key_exchange = yes
rsa_key_length = 512
dh_key_length = 512
verify_depth = 0
CA_path = "/usr/local/etc/raddb/certs"
pem_file_type = yes
private_key_file = "/usr/local/etc/raddb/certs/server.key"
certificate_file = "/usr/local/etc/raddb/certs/server.pem"
CA_file = "/usr/local/etc/raddb/certs/ca.pem"
dh_file = "/usr/local/etc/raddb/certs/dh"
random_file = "/usr/local/etc/raddb/certs/random"
fragment_size = 1024
include_length = yes
check_crl = no
cipher_list = "DEFAULT"
make_cert_command = "/usr/local/etc/raddb/certs/bootstrap"
ecdh_curve = "prime256v1"
cache {
enable = yes
lifetime = 8
max_entries = 255
}
verify {
}
ocsp {
enable = no
override_cert_url = yes
url = "http://127.0.0.1/ocsp/"
use_nonce = yes
timeout = 0
softfail = yes
}
}
Module: Linked to sub-module rlm_eap_ttls
Module: Instantiating eap-ttls
ttls {
tls = "tls-common"
default_eap_type = "md5"
copy_request_to_tunnel = no
use_tunneled_reply = no
virtual_server = "inner-tunnel"
include_length = yes
}
debug: Using cached TLS configuration from previous invocation
Module: Linked to sub-module rlm_eap_peap
Module: Instantiating eap-peap
peap {
tls = "tls-common"
default_eap_type = "mschapv2"
copy_request_to_tunnel = no
use_tunneled_reply = no
proxy_tunneled_request_as_eap = yes
virtual_server = "inner-tunnel"
soh = no
}
debug: Using cached TLS configuration from previous invocation
Module: Linked to sub-module rlm_eap_mschapv2
Module: Instantiating eap-mschapv2
mschapv2 {
with_ntdomain_hack = no
send_error = yes
}
Module: Checking authorize {...} for more modules to load
Module: Linked to module rlm_preprocess
Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess
preprocess {
huntgroups = "/usr/local/etc/raddb/huntgroups"
hints = "/usr/local/etc/raddb/hints"
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
with_alvarion_vsa_hack = no
}
Module: Linked to module rlm_realm
Module: Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm
realm suffix {
format = "suffix"
delimiter = "@"
ignore_default = no
ignore_null = no
}
Module: Linked to module rlm_files
Module: Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files
files {
usersfile = "/usr/local/etc/raddb/users"
acctusersfile = "/usr/local/etc/raddb/acct_users"
preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"
compat = "no"
}
Module: Checking preacct {...} for more modules to load
Module: Loading virtual module acct_unique
Module: Checking accounting {...} for more modules to load
Module: Linked to module rlm_detail
Module: Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail
detail {
detailfile = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
header = "%t"
detailperm = 384
dirperm = 493
locking = no
log_packet_header = no
}
Module: Linked to module rlm_radutmp
Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp
radutmp {
filename = "/var/log/radutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
perm = 384
callerid = yes
}
Module: Linked to module rlm_attr_filter
Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.accounting_response {
attrsfile = "/usr/local/etc/raddb/attrs.accounting_response"
key = "%{User-Name}"
relaxed = no
}
Module: Checking session {...} for more modules to load
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
Module: Loading virtual module remove_reply_message_if_eap
Module: Linked to module rlm_always
Module: Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always
always noop {
rcode = "noop"
simulcount = 0
mpp = no
}
Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.access_reject {
attrsfile = "/usr/local/etc/raddb/attrs.access_reject"
key = "%{User-Name}"
relaxed = no
}
Module: Loading virtual module remove_reply_message_if_eap
} # modules
} # server
server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
modules {
Module: Checking authenticate {...} for more modules to load
Module: Checking authorize {...} for more modules to load
Module: Checking session {...} for more modules to load
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
} # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "auth"
ipaddr = *
port = 0
max_pps = 0
}
listen {
type = "acct"
ipaddr = *
port = 0
max_pps = 0
}
listen {
type = "auth"
ipaddr = 127.0.0.1
port = 18120
max_pps = 0
}
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
Opening new proxy address * port 1814
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=106, length=359
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF"
Acct-Session-Id = "1d01db22-000000ea"
NAS-Port = 218
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AccessPoint1"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x02750015015a4f4f504c55535c6173646631323334
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0xe153ae3481cd9424c23bf36b5f175aaf
(0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(0) group authorize {
(0) - entering group authorize {...}
(0) [preprocess] = ok
(0) [chap] = noop
(0) [mschap] = noop
(0) [digest] = noop
(0) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(0) suffix : No such realm "NULL"
(0) [suffix] = noop
(0) eap : EAP packet type response id 117 length 21
(0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize
(0) [eap] = ok
(0) Found Auth-Type = EAP
(0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(0) group authenticate {
(0) - entering group authenticate {...}
(0) eap : EAP Identity
(0) eap : processing type peap
(0) peap : Flushing SSL sessions (of #0)
(0) peap : Initiate
(0) peap : Start returned 1
(0) [eap] = handled
Sending Access-Challenge of id 106 to 10.0.5.100 port 32783
EAP-Message = 0x017600061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x233fc17e2349d8f3e83a34544ff58a3c
(0) Finished request 0.
Waking up in 0.3 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=226, length=486
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF"
Acct-Session-Id = "1d01db22-000000ea"
NAS-Port = 218
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AccessPoint1"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x0276008219800000007816030100730100006f03014fd73824002ede6455fb6910c0084294967e65e18410e16d52d9926c80e67e5e000018002f00350005000ac013c014c009c00a00320038001300040100002eff010001000000001500130000107a6f6f706c75735c6173646631323334000a0006000400170018000b00020100
State = 0x233fc17e2349d8f3e83a34544ff58a3c
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0xc113cc579b9a44ae6f78cc78df61fe45
(1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(1) group authorize {
(1) - entering group authorize {...}
(1) [preprocess] = ok
(1) [chap] = noop
(1) [mschap] = noop
(1) [digest] = noop
(1) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(1) suffix : No such realm "NULL"
(1) [suffix] = noop
(1) eap : EAP packet type response id 118 length 130
(1) eap : Continuing tunnel setup.
(1) [eap] = ok
(1) Found Auth-Type = EAP
(1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(1) group authenticate {
(1) - entering group authenticate {...}
(1) eap : Request found, released from the list
(1) eap : EAP/peap
(1) eap : processing type peap
(1) peap : processing EAP-TLS
TLS Length 120
(1) peap : Length Included
(1) peap : eaptls_verify returned 11
(1) peap : (other): before/accept initialization
(1) peap : TLS_accept: before/accept initialization
(1) peap : <<< TLS 1.0 Handshake [length 0073], ClientHello
(1) peap : TLS_accept: SSLv3 read client hello A
(1) peap : >>> TLS 1.0 Handshake [length 0051], ServerHello
(1) peap : TLS_accept: SSLv3 write server hello A
(1) peap : >>> TLS 1.0 Handshake [length 0cc5], Certificate
(1) peap : TLS_accept: SSLv3 write certificate A
(1) peap : >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
(1) peap : TLS_accept: SSLv3 write server done A
(1) peap : TLS_accept: SSLv3 flush data
(1) peap : TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
(1) peap : eaptls_process returned 13
(1) peap : FR_TLS_HANDLED
(1) [eap] = handled
Sending Access-Challenge of id 226 to 10.0.5.100 port 32783
EAP-Message = 0x017703ec19c000000d2916030100510200004d03014fd73898ff528088986ce611991705eb5a5f001acf69d93b17f1a9fa7cab3d0e20f3ed404d9531a40bbcad0cadbad4133c4ad48296899ea27022fc32535d459cf0002f000005ff010001001603010cc50b000cc1000cbe0007aa308207a63082068ea003020102020310004e300d06092a864886f70d01010405003081a3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c0603550403
EAP-Message = 0x1315777777706b692e7765622e7a6f6f706c75732e64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e6465301e170d3132303232383039323934315a170d3135303232383039323934315a3081c3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731293027060355040a13206639323232396139633932306238656464613063346563383830643865383362310b3009060355040b130249543121301f060355040313187a7072616469757330312e7a6f6f706c75732e6c6f63616c
EAP-Message = 0x3120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e646530820222300d06092a864886f70d01010105000382020f003082020a0282020100df0e40f450e8633fdc375cb76ddca4885ce8cb275601f5b5e78a0ff8f4e8f13036c27a4e3c2e503e005d11e5c19a8b535e68a015b67f15b313d88a21df7b788ce45174c0137beadfb8186928e9acc169237805e0a00ea8f8245c7d4b1d64214e368339fe807dab5cc82c235823474903f76d8e363ff25a79094959af1edf13d4b23c4f9942467ffd088f91fd7072618e9e95d6360e44ede071785ce41f0899d4abe3e8d941f728ad204ad1e48f1fd12384ab392ed048d917b361
EAP-Message = 0x77efb35d76edcf6f6bf4518c46e53186e9c8ca7560481f8a87eb9cba46f56716fcff6a05ae25a1917ca1ede18c05640b41242465118dc66de1f3f22aa77598df0f0130070b95af02502eb9dd86f087502a2ce4ddf67dc94ccb60edba0f4e92e5f9ca75e950bc89a21671430395782d6d8fb78ba77b497ab6577e673acd4b9ebda8eb638d2aa6ba89798d0adc603a765c7b109f7b204abab14831b08fe1b34be34f3e1acb92bf878644e94f5de7381e3df2647f307d9343332112b978d68b02c63658d617268e610bf337d85f0a62a2e1a7b5a8fa1261e1835101920e3b37fd4e95e3fead50a5cac3239e57541679679824eacd1aa6
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x233fc17e2248d8f3e83a34544ff58a3c
(1) Finished request 1.
Waking up in 0.3 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=207, length=362
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF"
Acct-Session-Id = "1d01db22-000000ea"
NAS-Port = 218
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AccessPoint1"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x027700061900
State = 0x233fc17e2248d8f3e83a34544ff58a3c
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0x09aba499b093fc17f1b1ad231435c1dd
(2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(2) group authorize {
(2) - entering group authorize {...}
(2) [preprocess] = ok
(2) [chap] = noop
(2) [mschap] = noop
(2) [digest] = noop
(2) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(2) suffix : No such realm "NULL"
(2) [suffix] = noop
(2) eap : EAP packet type response id 119 length 6
(2) eap : Continuing tunnel setup.
(2) [eap] = ok
(2) Found Auth-Type = EAP
(2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(2) group authenticate {
(2) - entering group authenticate {...}
(2) eap : Request found, released from the list
(2) eap : EAP/peap
(2) eap : processing type peap
(2) peap : processing EAP-TLS
(2) peap : Received TLS ACK
(2) peap : Received TLS ACK
(2) peap : ACK handshake fragment handler
(2) peap : eaptls_verify returned 1
(2) peap : eaptls_process returned 13
(2) peap : FR_TLS_HANDLED
(2) [eap] = handled
Sending Access-Challenge of id 207 to 10.0.5.100 port 32783
EAP-Message = 0x017803e81940766385383e2cde4857beed6f5d0055147b933e7daa9922162c79d246e82182b9093f71aa15acaac374d5e514c545fde8d4246e4471d9ead260e06fc5a292a62aac5911d4b904b8015bf168d6c7022f8b8b0203010001a38202bf308202bb300c0603551d130101ff04023000300e0603551d0f0101ff0404030205a0301406096086480186f84201010101ff04040302064030160603551d250101ff040c300a06082b06010505070301301d0603551d0e0416041424e274626b9d850eb8eb9fd2a5d4e4555dccc3233081d80603551d230481d03081cd8014343094169c0bc40653b5ebaf41601f3b65d91227a181a9a481a63081a331
EAP-Message = 0x0b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c06035504031315777777706b692e7765622e7a6f6f706c75732e64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e64658209008f68987367f3a4b330360603551d11042f302d82187a7072616469757330312e7a6f6f706c75732e6c6f63616c811173797361646d407a6f6f706c75732e6465301c0603551d1204153013811173797361646d407a6f6f70
EAP-Message = 0x6c75732e6465304a0603551d1f04433041303fa03da03b8639687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f696e6465782e7068703f73746167653d646c5f63726c303906096086480186f842010d042c162a5048506b692f4f70656e53534c2047656e65726174656420536572766572204365727469666963617465303206096086480186f842010204251623687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f302306096086480186f8420103041616146e735f7265766f6b655f71756572792e7068703f303d06096086480186f84201080430162e687474703a2f
EAP-Message = 0x2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f706f6c6963792e68746d6c300d06092a864886f70d01010405000382010100a9926e3eab9f9ed846e4d3618ab5df744295922b7393517c86a7e9e879ae6862200092525a365845841ed019acb8401c12057b4fd132a39fdb89eed85e85beb4ec203049f8dfd9c3038bee65de5bb59962b0a77e9a4d95b99340ed94d38845b185f1483898f18272d216f4d831bfe43f02df131b8445b7417677965db6f94676b0c7337240f09fbd8fd5755e0c0fe88469f12a0b4b929dcd4327517f0cdc4327432be87207cf40f81f60d90c16d7045566b611ee90
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x233fc17e2147d8f3e83a34544ff58a3c
(2) Finished request 2.
Waking up in 0.3 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=156, length=362
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF"
Acct-Session-Id = "1d01db22-000000ea"
NAS-Port = 218
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AccessPoint1"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x027800061900
State = 0x233fc17e2147d8f3e83a34544ff58a3c
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0x46ddf4fb8e62864d34ee09b02240cac4
(3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(3) group authorize {
(3) - entering group authorize {...}
(3) [preprocess] = ok
(3) [chap] = noop
(3) [mschap] = noop
(3) [digest] = noop
(3) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(3) suffix : No such realm "NULL"
(3) [suffix] = noop
(3) eap : EAP packet type response id 120 length 6
(3) eap : Continuing tunnel setup.
(3) [eap] = ok
(3) Found Auth-Type = EAP
(3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(3) group authenticate {
(3) - entering group authenticate {...}
(3) eap : Request found, released from the list
(3) eap : EAP/peap
(3) eap : processing type peap
(3) peap : processing EAP-TLS
(3) peap : Received TLS ACK
(3) peap : Received TLS ACK
(3) peap : ACK handshake fragment handler
(3) peap : eaptls_verify returned 1
(3) peap : eaptls_process returned 13
(3) peap : FR_TLS_HANDLED
(3) [eap] = handled
Sending Access-Challenge of id 156 to 10.0.5.100 port 32783
EAP-Message = 0x017903e81940dd918bae3094651e2d38da6cb6470e5a5705d04419ecc02984c06dd99d858684b4ffeea1f0049440d3542eb307f94b4e343a78ad2bf5d8dff067c49eed40825295fc525c89ffe00316ab9800050e3082050a308203f2a0030201020209008f68987367f3a4b3300d06092a864886f70d01010405003081a3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c06035504031315777777706b692e7765622e7a6f6f706c75732e
EAP-Message = 0x64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e6465301e170d3039303331333134323030315a170d3134303331333134323030315a3081a3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c06035504031315777777706b692e7765622e7a6f6f706c75732e64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e646530820122300d06092a864886f70d0101010500
EAP-Message = 0x0382010f003082010a0282010100b53247f132a0563881dd2cd39b014fce9dd553316e5acfad692af9121c4144dd5518fddd97459ae4c5b58dde04746615af13ce199e492269694b7a90f39a0ee2abb1222fc5b966b75f04e7d5b3ea9855bea211c5fbbfcb8f9d9059034e2af246494ba7d21812bce51f716000309a2842a43b53b3d69ded50954cf1bf0259e32410074bdd61676dac3af823013cc07fecd18329dee9a0129ae38fe37db7cf2161b1a6a313a2e48f07c80a630467dae941cfa094df8eebd542b85275f6dc776d6eb96f28b879c1f3178fcae1c8c984e8aaec01cd18c3ccdf90a9fea7a1239b605bc2c3a4092dc2551e84007d9a047359
EAP-Message = 0xf47dda3aba5d94d2785f684b8bd95603410203010001a382013d30820139300c0603551d13040530030101ff300b0603551d0f040403020106301106096086480186f8420101040403020007301d0603551d0e04160414343094169c0bc40653b5ebaf41601f3b65d91227301c0603551d1104153013811173797361646d407a6f6f706c75732e6465304a0603551d1f04433041303fa03da03b8639687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f696e6465782e7068703f73746167653d646c5f63726c304106096086480186f842010d043416325048506b692f4f70656e53
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x233fc17e2046d8f3e83a34544ff58a3c
(3) Finished request 3.
Waking up in 0.2 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=11, length=362
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF"
Acct-Session-Id = "1d01db22-000000ea"
NAS-Port = 218
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AccessPoint1"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x027900061900
State = 0x233fc17e2046d8f3e83a34544ff58a3c
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0xec85e36dffa4447885ebfa7cfdb60897
(4) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(4) group authorize {
(4) - entering group authorize {...}
(4) [preprocess] = ok
(4) [chap] = noop
(4) [mschap] = noop
(4) [digest] = noop
(4) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(4) suffix : No such realm "NULL"
(4) [suffix] = noop
(4) eap : EAP packet type response id 121 length 6
(4) eap : Continuing tunnel setup.
(4) [eap] = ok
(4) Found Auth-Type = EAP
(4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(4) group authenticate {
(4) - entering group authenticate {...}
(4) eap : Request found, released from the list
(4) eap : EAP/peap
(4) eap : processing type peap
(4) peap : processing EAP-TLS
(4) peap : Received TLS ACK
(4) peap : Received TLS ACK
(4) peap : ACK handshake fragment handler
(4) peap : eaptls_verify returned 1
(4) peap : eaptls_process returned 13
(4) peap : FR_TLS_HANDLED
(4) [eap] = handled
Sending Access-Challenge of id 11 to 10.0.5.100 port 32783
EAP-Message = 0x017a01891900534c2047656e65726174656420526f6f7420436572746966696361746520417574686f72697479303d06096086480186f84201080430162e687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f706f6c6963792e68746d6c300d06092a864886f70d010104050003820101009ebc1a5dd90c801d205cb2a90c8bc3ab00db1ecb7d733632e6c5cfc033ded56fe93dc9752096ea56f194ebc980b843d7b1444b46689baea6c180997eaa77ae4b5aed2657c924a0f160b64adeef2af57df3ea220a94dd1c6571213f432e0888abc037f9ad970406d797bce1163d31c9df848258296d336f929dadd33ba7
EAP-Message = 0xad9e6bd0a8e101e4514e569f64097e12bb6e05ae9e51a4170b056570bd14a33faa584075a9dfafa8dd979d4664f76f5730953903ce77c7b4e8e2e3356ed9be221fd6f872dab6451da6950f46893af28efb6df277e22169e81884cd3abe4c464523d7622dfe93d1a5f29b2d623292eca09b3bfe84fb67b6d4749ff6b61de2971388045316030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x233fc17e2745d8f3e83a34544ff58a3c
(4) Finished request 4.
Waking up in 0.2 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=248, length=952
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF"
Acct-Session-Id = "1d01db22-000000ea"
NAS-Port = 218
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AccessPoint1"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x027a02501980000002461603010206100002020200acca8ade0f1fd58406607d426b60e70361405ebf04154b58b5e1d1a8389c062ca456d04c9774825a8758dea005093c8bc80926b15d45e95a23b1481627470e61f7c0ef7f76ad0f93dd48d7835f5f2a362dca360d8c98a50e40f928366a67d71d740a4840f7123a5c68ef91b870b60867a0231378d22c106f6f744631722ea7dce899d39f1781eb1dcb6f1ce8ded9303f276929c073691f32271ffd931e351170f37e3dcf441d3deabc91c6d98680f713694b8d99a360a7eeeb7db12f862c6e97d7d850cce98662d4635f6e231433e11abf8bac7139653682960981c85881a10a52570aa8ed0c0af6
EAP-Message = 0xe9bcf38e1699dc72aeb83b0d9c364511450e5ea5bb4f3eabf3461249af95b2adeddaf4feb70036f8f211f65b26caf7719100a035b64e9ef74dcb0831a724d41376aaab060eae667952bdbbc6e70f3908305e9351b9f23d9e9012aa7aeed7f0e35da736fb1b587d8dc0df9f7c490c4539fc95bdb28fc39fbe965700a18cba4b216b95ae74a170aff5cb7ad7ba8f2a95e542e53027d8bc1fe12894fc7519952633fef32543972883e7a66d8a6464d3a39f66631aebba43104d2976128a39b49c1b46a4fec4a48dd56b5e225414a83ebc2efc8742a5e99cbf9b12804c6680aebe25da8104c7996ae77f7e849b8f35febd7c52d8fd894ca5cd6423ac144771
EAP-Message = 0xcee2b19e48cfb074a1da7322d2afc1a62768444cb53ecb9a13dedc1403010001011603010030641a65b0a9a884ed3878189b2f7bbd64b715575e1d9895118cbd778b57b163d03c93e0a0f7f3e2133cbae51da4f73a55
State = 0x233fc17e2745d8f3e83a34544ff58a3c
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0xc9e0e7727d36281e317a5814ab7e34b0
(5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(5) group authorize {
(5) - entering group authorize {...}
(5) [preprocess] = ok
(5) [chap] = noop
(5) [mschap] = noop
(5) [digest] = noop
(5) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(5) suffix : No such realm "NULL"
(5) [suffix] = noop
(5) eap : EAP packet type response id 122 length 253
(5) eap : Continuing tunnel setup.
(5) [eap] = ok
(5) Found Auth-Type = EAP
(5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(5) group authenticate {
(5) - entering group authenticate {...}
(5) eap : Request found, released from the list
(5) eap : EAP/peap
(5) eap : processing type peap
(5) peap : processing EAP-TLS
TLS Length 582
(5) peap : Length Included
(5) peap : eaptls_verify returned 11
(5) peap : <<< TLS 1.0 Handshake [length 0206], ClientKeyExchange
(5) peap : TLS_accept: SSLv3 read client key exchange A
(5) peap : <<< TLS 1.0 ChangeCipherSpec [length 0001]
(5) peap : <<< TLS 1.0 Handshake [length 0010], Finished
(5) peap : TLS_accept: SSLv3 read finished A
(5) peap : >>> TLS 1.0 ChangeCipherSpec [length 0001]
(5) peap : TLS_accept: SSLv3 write change cipher spec A
(5) peap : >>> TLS 1.0 Handshake [length 0010], Finished
(5) peap : TLS_accept: SSLv3 write finished A
(5) peap : TLS_accept: SSLv3 flush data
SSL: adding session f3ed404d9531a40bbcad0cadbad4133c4ad48296899ea27022fc32535d459cf0 to cache
(5) peap : (other): SSL negotiation finished successfully
SSL Connection Established
(5) peap : eaptls_process returned 13
(5) peap : FR_TLS_HANDLED
(5) [eap] = handled
Sending Access-Challenge of id 248 to 10.0.5.100 port 32783
EAP-Message = 0x017b004119001403010001011603010030142a567a85a52fa32a1ccb3cabd673369805c95546236721bc294226ffb35a1b72a92cc5dacf5be8944ff2f5faf613e4
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x233fc17e2644d8f3e83a34544ff58a3c
(5) Finished request 5.
Waking up in 0.2 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=236, length=362
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF"
Acct-Session-Id = "1d01db22-000000ea"
NAS-Port = 218
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AccessPoint1"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x027b00061900
State = 0x233fc17e2644d8f3e83a34544ff58a3c
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0x110a13403df450de92653db8bdea68cf
(6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(6) group authorize {
(6) - entering group authorize {...}
(6) [preprocess] = ok
(6) [chap] = noop
(6) [mschap] = noop
(6) [digest] = noop
(6) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(6) suffix : No such realm "NULL"
(6) [suffix] = noop
(6) eap : EAP packet type response id 123 length 6
(6) eap : Continuing tunnel setup.
(6) [eap] = ok
(6) Found Auth-Type = EAP
(6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(6) group authenticate {
(6) - entering group authenticate {...}
(6) eap : Request found, released from the list
(6) eap : EAP/peap
(6) eap : processing type peap
(6) peap : processing EAP-TLS
(6) peap : Received TLS ACK
(6) peap : Received TLS ACK
(6) peap : ACK handshake is finished
(6) peap : eaptls_verify returned 3
(6) peap : eaptls_process returned 3
(6) peap : FR_TLS_SUCCESS
(6) peap : Session established. Decoding tunneled attributes.
(6) peap : Peap state TUNNEL ESTABLISHED
(6) [eap] = handled
Sending Access-Challenge of id 236 to 10.0.5.100 port 32783
EAP-Message = 0x017c002b190017030100209d8662246db6c2b5ce090091cd7608392fa5e1865ac698f0d2d8955cc3f6a56b
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x233fc17e2543d8f3e83a34544ff58a3c
(6) Finished request 6.
Waking up in 0.1 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=36, length=415
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF"
Acct-Session-Id = "1d01db22-000000ea"
NAS-Port = 218
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AccessPoint1"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x027c003b1900170301003088024a1842d558d7174d7b2bb36ef45d3b11f4e252f68af7c7d1a216e2ebf6b5a3e0adb89bd232b6f8f297e69d26256e
State = 0x233fc17e2543d8f3e83a34544ff58a3c
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0x6ea6ff20fdce1b56c97c6ac976f3223d
(7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(7) group authorize {
(7) - entering group authorize {...}
(7) [preprocess] = ok
(7) [chap] = noop
(7) [mschap] = noop
(7) [digest] = noop
(7) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(7) suffix : No such realm "NULL"
(7) [suffix] = noop
(7) eap : EAP packet type response id 124 length 59
(7) eap : Continuing tunnel setup.
(7) [eap] = ok
(7) Found Auth-Type = EAP
(7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(7) group authenticate {
(7) - entering group authenticate {...}
(7) eap : Request found, released from the list
(7) eap : EAP/peap
(7) eap : processing type peap
(7) peap : processing EAP-TLS
(7) peap : eaptls_verify returned 7
(7) peap : Done initial handshake
(7) peap : eaptls_process returned 7
(7) peap : FR_TLS_OK
(7) peap : Session established. Decoding tunneled attributes.
(7) peap : Peap state WAITING FOR INNER IDENTITY
(7) peap : Identity - TEST\user1
(7) peap : Got inner identity 'TEST\user1'
(7) peap : Setting default EAP type for tunneled EAP session.
(7) peap : Got tunneled request
EAP-Message = 0x027c0015015a4f4f504c55535c6173646631323334
server {
(7) peap : Setting User-Name to TEST\user1
Sending tunneled request
EAP-Message = 0x027c0015015a4f4f504c55535c6173646631323334
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "TEST\\user1"
server inner-tunnel {
(7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(7) group authorize {
(7) - entering group authorize {...}
(7) [chap] = noop
(7) [mschap] = noop
(7) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(7) suffix : No such realm "NULL"
(7) [suffix] = noop
(7) update control {
(7) } # update control = noop
(7) eap : EAP packet type response id 124 length 21
(7) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize
(7) [eap] = ok
(7) Found Auth-Type = EAP
(7) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(7) group authenticate {
(7) - entering group authenticate {...}
(7) eap : EAP Identity
(7) eap : processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
(7) [eap] = handled
} # server inner-tunnel
(7) peap : Got tunneled reply code 11
EAP-Message = 0x017d002a1a017d002510ee147dab7777ab81d08e6d124679316a5a4f4f504c55535c6173646631323334
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x9d9cbe589de1a4d031f1fd4ff27cd0d2
(7) peap : Got tunneled reply RADIUS code 11
EAP-Message = 0x017d002a1a017d002510ee147dab7777ab81d08e6d124679316a5a4f4f504c55535c6173646631323334
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x9d9cbe589de1a4d031f1fd4ff27cd0d2
(7) peap : Got tunneled Access-Challenge
(7) [eap] = handled
Sending Access-Challenge of id 36 to 10.0.5.100 port 32783
EAP-Message = 0x017d004b19001703010040c66cade655df6d537e10ca7520aed7f9ca846d289258b8b60963e2133992e1294c215ed5cfb4cf73f7a60a8d098ed7cb4cd1cb1552d29063812d1762af58465e
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x233fc17e2442d8f3e83a34544ff58a3c
(7) Finished request 7.
Waking up in 0.1 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=254, length=463
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF"
Acct-Session-Id = "1d01db22-000000ea"
NAS-Port = 218
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AccessPoint1"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x027d006b19001703010060af1e4b00434bd2a75f4c3ccf0d8f189e6b2896f0adc6abd84d38260ec7cad6f927bfa09a70bde000d8ec160b763b57d71a9f103ff578c251f8bb9504f8c5a2fb5a9e64f7716940c33e5ce165519490a14575dcbc91eb2896ed1a4d9759d72148
State = 0x233fc17e2442d8f3e83a34544ff58a3c
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0x50a2fdf665bde54e7aeeab93fc7a9138
(8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(8) group authorize {
(8) - entering group authorize {...}
(8) [preprocess] = ok
(8) [chap] = noop
(8) [mschap] = noop
(8) [digest] = noop
(8) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(8) suffix : No such realm "NULL"
(8) [suffix] = noop
(8) eap : EAP packet type response id 125 length 107
(8) eap : Continuing tunnel setup.
(8) [eap] = ok
(8) Found Auth-Type = EAP
(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(8) group authenticate {
(8) - entering group authenticate {...}
(8) eap : Request found, released from the list
(8) eap : EAP/peap
(8) eap : processing type peap
(8) peap : processing EAP-TLS
(8) peap : eaptls_verify returned 7
(8) peap : Done initial handshake
(8) peap : eaptls_process returned 7
(8) peap : FR_TLS_OK
(8) peap : Session established. Decoding tunneled attributes.
(8) peap : Peap state phase2
(8) peap : EAP type mschapv2
(8) peap : Got tunneled request
EAP-Message = 0x027d004b1a027d004631664019e4cf68c221dd4265b9f41a569e00000000000000008aacee551ce230cd14d51c517b26780d896edf4c1026c24f005a4f4f504c55535c6173646631323334
server {
(8) peap : Setting User-Name to TEST\user1
Sending tunneled request
EAP-Message = 0x027d004b1a027d004631664019e4cf68c221dd4265b9f41a569e00000000000000008aacee551ce230cd14d51c517b26780d896edf4c1026c24f005a4f4f504c55535c6173646631323334
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "TEST\\user1"
State = 0x9d9cbe589de1a4d031f1fd4ff27cd0d2
server inner-tunnel {
(8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) group authorize {
(8) - entering group authorize {...}
(8) [chap] = noop
(8) [mschap] = noop
(8) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(8) suffix : No such realm "NULL"
(8) [suffix] = noop
(8) update control {
(8) } # update control = noop
(8) eap : EAP packet type response id 125 length 75
(8) eap : No EAP Start, assuming it's an on-going EAP conversation
(8) [eap] = updated
(8) files : users: Matched entry DEFAULT at line 205
(8) [files] = ok
(8) [expiration] = noop
(8) [logintime] = noop
(8) [pap] = noop
(8) Found Auth-Type = EAP
(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) group authenticate {
(8) - entering group authenticate {...}
(8) eap : Request found, released from the list
(8) eap : EAP/mschapv2
(8) eap : processing type mschapv2
(8) mschapv2 : # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) mschapv2 : group MS-CHAP {
(8) mschapv2 : - entering group MS-CHAP {...}
(8) mschap : Creating challenge hash with username: asdf1234
(8) mschap : Told to do MS-CHAPv2 for asdf1234 with NT-Password
(8) mschap : expand: %{Stripped-User-Name} ->
(8) mschap : ... expanding second conditional
(8) mschap : expand: %{User-Name} -> TEST\user1
(8) mschap : expand: %{%{User-Name}:-None} -> TEST\user1
(8) mschap : expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=TEST\user1
(8) mschap : Creating challenge hash with username: asdf1234
(8) mschap : expand: %{mschap:Challenge} -> 77bfad378970f10a
(8) mschap : expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=77bfad378970f10a
(8) mschap : expand: %{mschap:NT-Response} -> 8aacee551ce230cd14d51c517b26780d896edf4c1026c24f
(8) mschap : expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=8aacee551ce230cd14d51c517b26780d896edf4c1026c24f
Exec-Program output: Must change password (0xc0000224)
Exec-Program-Wait: plaintext: Must change password (0xc0000224)
Exec-Program: returned: 1
(8) mschap : External script failed.
(8) mschap : FAILED: MS-CHAP2-Response is incorrect
(8) [mschap] = reject
rlm_eap_mschapv2: No MS-CHAPv2-Success or MS-CHAP-Error was found.
(8) eap : Handler failed in EAP/mschapv2
(8) eap : Failed in EAP select
(8) [eap] = invalid
(8) Failed to authenticate the user.
} # server inner-tunnel
(8) peap : Got tunneled reply code 3
MS-CHAP-Error = "}E=691 R=0 C=9247f7d726bf93f281dae5fe1ec145cf V=3 M=Re-enter (or reset) the password"
EAP-Message = 0x047d0004
Message-Authenticator = 0x00000000000000000000000000000000
(8) peap : Got tunneled reply RADIUS code 3
MS-CHAP-Error = "}E=691 R=0 C=9247f7d726bf93f281dae5fe1ec145cf V=3 M=Re-enter (or reset) the password"
EAP-Message = 0x047d0004
Message-Authenticator = 0x00000000000000000000000000000000
(8) peap : Tunneled authentication was rejected.
(8) peap : FAILURE
(8) [eap] = handled
Sending Access-Challenge of id 254 to 10.0.5.100 port 32783
EAP-Message = 0x017e002b190017030100202710abb6cdf56f18475467e64ec4624bf711475bf2c28ef0061b7084e195e0c0
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x233fc17e2b41d8f3e83a34544ff58a3c
(8) Finished request 8.
Waking up in 0.1 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=202, length=399
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D7-38-03-00-0D-86-CF"
Acct-Session-Id = "1d01db22-000000ea"
NAS-Port = 218
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AccessPoint1"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x027e002b19001703010020ce53a51bb41f504fab4bd8b2443460e86422697ed22c2e9680d9fb4a673fa6b1
State = 0x233fc17e2b41d8f3e83a34544ff58a3c
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0xd5a792fd0f47b601d1a818f1c3fe959f
(9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(9) group authorize {
(9) - entering group authorize {...}
(9) [preprocess] = ok
(9) [chap] = noop
(9) [mschap] = noop
(9) [digest] = noop
(9) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(9) suffix : No such realm "NULL"
(9) [suffix] = noop
(9) eap : EAP packet type response id 126 length 43
(9) eap : Continuing tunnel setup.
(9) [eap] = ok
(9) Found Auth-Type = EAP
(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(9) group authenticate {
(9) - entering group authenticate {...}
(9) eap : Request found, released from the list
(9) eap : EAP/peap
(9) eap : processing type peap
(9) peap : processing EAP-TLS
(9) peap : eaptls_verify returned 7
(9) peap : Done initial handshake
(9) peap : eaptls_process returned 7
(9) peap : FR_TLS_OK
(9) peap : Session established. Decoding tunneled attributes.
(9) peap : Peap state send tlv failure
(9) peap : Received EAP-TLV response.
(9) peap : The users session was previously rejected: returning reject (again.)
(9) peap : *** This means you need to read the PREVIOUS messages in the debug output
(9) peap : *** to find out the reason why the user was rejected.
(9) peap : *** Look for "reject" or "fail". Those earlier messages will tell you.
(9) peap : *** what went wrong, and how to fix the problem.
SSL: Removing session f3ed404d9531a40bbcad0cadbad4133c4ad48296899ea27022fc32535d459cf0 from the cache
(9) eap : Handler failed in EAP/peap
(9) eap : Failed in EAP select
(9) [eap] = invalid
(9) Failed to authenticate the user.
(9) Using Post-Auth-Type Reject
(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(9) group REJECT {
(9) - entering group REJECT {...}
(9) attr_filter.access_reject : expand: %{User-Name} -> TEST\user1
(9) attr_filter.access_reject : Matched entry DEFAULT at line 11
(9) [attr_filter.access_reject] = updated
(9) eap : Reply already contained an EAP-Message, not inserting EAP-Failure
(9) [eap] = noop
(9) policy remove_reply_message_if_eap {
(9) - entering policy remove_reply_message_if_eap {...}
(9) ? if (reply:EAP-Message && reply:Reply-Message)
(9) ? Evaluating (reply:EAP-Message ) -> TRUE
(9) ? Evaluating (reply:Reply-Message) -> FALSE
(9) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE
(9) else else {
(9) - entering else else {...}
(9) [noop] = noop
(9) - else else returns noop
(9) - policy remove_reply_message_if_eap returns noop
(9) Finished request 9.
Waking up in 0.6 seconds.
(9) Sending delayed reject
Sending Access-Reject of id 202 to 10.0.5.100 port 32783
EAP-Message = 0x047e0004
Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.7 seconds.
(0) Cleaning up request packet ID 106 with timestamp +7
(1) Cleaning up request packet ID 226 with timestamp +7
(2) Cleaning up request packet ID 207 with timestamp +7
(3) Cleaning up request packet ID 156 with timestamp +7
(4) Cleaning up request packet ID 11 with timestamp +7
(5) Cleaning up request packet ID 248 with timestamp +7
(6) Cleaning up request packet ID 236 with timestamp +7
(7) Cleaning up request packet ID 36 with timestamp +7
(8) Cleaning up request packet ID 254 with timestamp +7
Waking up in 1.0 seconds.
(9) Cleaning up request packet ID 202 with timestamp +7
Ready to process requests.
--
NEU: FreePhone 3-fach-Flat mit kostenlosem Smartphone!
Jetzt informieren: http://mobile.1und1.de/?ac=OM.PW.PW003K20328T7073a
More information about the Freeradius-Users
mailing list