EAP-PEAP + Windows 7 with SSO and Password change
CD DD
c_dornig at gmx.de
Wed Jun 13 11:21:03 CEST 2012
Hi Phil, Alan,
>Ok. ntlm_auth is returning something different to what I saw in testing.
>Have you set the "must change password at next login" bit, as opposed to
>"expired" bit?
>
>Try this:
>
> 1. Edit src/modules/rlm_mschap/rlm_mschap.c about line 1100, where it
>says:
>
> if (strstr(buffer, "Password expired")) {
>
>...to read:
>
> if (strstr(buffer, "Password expired") ||
> strstr(buffer, "Must change password")) {
>
> 2. Re-compile and re-install
>
> 3. Test again
>
>There's no great way to parse the output of ntlm_auth. I guess we could
>make the string a regexp comparison against the output, and at least
>make it an item in the config file (with a sensible default) so that if
>more such cases come up, or Samba change their output, it can be fixed
>without a recompile.
i changed the source src/modules/rlm_mschap/rlm_mschap.c, recompiled and re-installed it.
But it still not working.
Why the passchange part will not handled ?
Here is the debug output:
FreeRADIUS Version 3.0.0, for host x86_64-portbld-freebsd9.0, built on Jun 13 2012 at 10:06:56
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License v2.
Starting - reading configuration files ...
including configuration file /usr/local/etc/raddb/radiusd.conf
including configuration file /usr/local/etc/raddb/proxy.conf
including configuration file /usr/local/etc/raddb/clients.conf
including files in directory /usr/local/etc/raddb/mods-enabled/
including configuration file /usr/local/etc/raddb/mods-enabled/wimax
including configuration file /usr/local/etc/raddb/mods-enabled/always
including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter
including configuration file /usr/local/etc/raddb/mods-enabled/attr_rewrite
including configuration file /usr/local/etc/raddb/mods-enabled/chap
including configuration file /usr/local/etc/raddb/mods-enabled/checkval
including configuration file /usr/local/etc/raddb/mods-enabled/counter
including configuration file /usr/local/etc/raddb/mods-enabled/cui
including configuration file /usr/local/etc/raddb/mods-enabled/detail
including configuration file /usr/local/etc/raddb/mods-enabled/detail.log
including configuration file /usr/local/etc/raddb/mods-enabled/digest
including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients
including configuration file /usr/local/etc/raddb/mods-enabled/eap
including configuration file /usr/local/etc/raddb/mods-enabled/echo
including configuration file /usr/local/etc/raddb/mods-enabled/exec
including configuration file /usr/local/etc/raddb/mods-enabled/expiration
including configuration file /usr/local/etc/raddb/mods-enabled/expr
including configuration file /usr/local/etc/raddb/mods-enabled/files
including configuration file /usr/local/etc/raddb/mods-enabled/inner-eap
including configuration file /usr/local/etc/raddb/mods-enabled/linelog
including configuration file /usr/local/etc/raddb/mods-enabled/logintime
including configuration file /usr/local/etc/raddb/mods-enabled/mschap
including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth
including configuration file /usr/local/etc/raddb/mods-enabled/pap
including configuration file /usr/local/etc/raddb/mods-enabled/passwd
including configuration file /usr/local/etc/raddb/mods-enabled/preprocess
including configuration file /usr/local/etc/raddb/mods-enabled/radutmp
including configuration file /usr/local/etc/raddb/mods-enabled/realm
including configuration file /usr/local/etc/raddb/mods-enabled/replicate
including configuration file /usr/local/etc/raddb/mods-enabled/soh
including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp
including configuration file /usr/local/etc/raddb/mods-enabled/unix
including configuration file /usr/local/etc/raddb/mods-enabled/utf8
including configuration file /usr/local/etc/raddb/mods-enabled/acct_unique
including configuration file /usr/local/etc/raddb/policy.conf
including files in directory /usr/local/etc/raddb/sites-enabled/
including configuration file /usr/local/etc/raddb/sites-enabled/default
including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel
main {
security {
allow_core_dumps = no
}
}
including dictionary file /usr/local/etc/raddb/dictionary
main {
name = "radiusd"
prefix = "/usr/local"
localstatedir = "/var"
sbindir = "/usr/local/sbin"
logdir = "/var/log"
run_dir = "/var/run/radiusd"
libdir = "/usr/local/lib/freeradius-3.0.0"
radacctdir = "/var/log/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
pidfile = "/var/run/radiusd/radiusd.pid"
checkrad = "/usr/local/sbin/checkrad"
debug_level = 0
proxy_requests = yes
log {
stripped_names = no
auth = no
auth_badpass = no
auth_goodpass = no
}
security {
max_attributes = 200
reject_delay = 1
status_server = yes
}
}
radiusd: #### Loading Realms and Home Servers ####
proxy server {
retry_delay = 5
retry_count = 3
default_fallback = no
dead_time = 120
wake_all_if_all_dead = no
}
home_server localhost {
ipaddr = 127.0.0.1
port = 1812
type = "auth"
secret = "testing123"
response_window = 20
max_outstanding = 65536
require_message_authenticator = yes
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_interval = 30
num_answers_to_alive = 3
num_pings_to_alive = 3
revive_interval = 120
status_check_timeout = 4
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
}
home_server_pool my_auth_failover {
type = fail-over
home_server = localhost
}
realm example.com {
auth_pool = my_auth_failover
}
realm LOCAL {
}
radiusd: #### Loading Clients ####
client localhost {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = "testing123"
nastype = "other"
}
client AP {
ipaddr = 10.0.5.100
netmask = 32
require_message_authenticator = no
secret = "**************"
shortname = "AP"
nastype = "other"
}
radiusd: #### Instantiating modules ####
instantiate {
Module: Linked to module rlm_exec
Module: Instantiating module "exec" from file /usr/local/etc/raddb/mods-enabled/exec
exec {
wait = no
input_pairs = "request"
shell_escape = yes
}
Module: Linked to module rlm_expr
Module: Instantiating module "expr" from file /usr/local/etc/raddb/mods-enabled/expr
Module: Linked to module rlm_expiration
Module: Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration
expiration {
reply-message = "Password Has Expired "
}
Module: Linked to module rlm_logintime
Module: Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime
logintime {
reply-message = "You are calling outside your allowed timespan "
minimum-timeout = 60
}
}
radiusd: #### Loading Virtual Servers ####
server { # from file /usr/local/etc/raddb/radiusd.conf
modules {
Module: Creating Auth-Type = digest
Module: Checking authenticate {...} for more modules to load
Module: Linked to module rlm_pap
Module: Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
pap {
encryption_scheme = "auto"
auto_header = no
}
Module: Linked to module rlm_chap
Module: Instantiating module "chap" from file /usr/local/etc/raddb/mods-enabled/chap
Module: Linked to module rlm_mschap
Module: Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap
mschap {
use_mppe = yes
require_encryption = no
require_strong = no
with_ntdomain_hack = yes
ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}"
passchange {
ntlm_auth = "/usr/local/bin/ntlm_auth --helper-protocol=ntlm-change-password-1"
ntlm_auth_username = "username: %{mschap:User-Name}"
ntlm_auth_domain = "nt-domain: %{mschap:NT-Domain}"
local_cpw = "%{exec:/path/to/script %{mschap:User-Name} %{MS-CHAP-New-Cleartext-Password}}"
}
allow_retry = yes
retry_msg = "Re-enter (or reset) the password"
}
Module: Linked to module rlm_digest
Module: Instantiating module "digest" from file /usr/local/etc/raddb/mods-enabled/digest
Module: Linked to module rlm_unix
Module: Instantiating module "unix" from file /usr/local/etc/raddb/mods-enabled/unix
unix {
radwtmp = "/var/log/radwtmp"
}
Module: Linked to module rlm_eap
Module: Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
eap {
default_eap_type = "peap"
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
max_sessions = 4096
}
Module: Linked to sub-module rlm_eap_md5
Module: Instantiating eap-md5
Module: Linked to sub-module rlm_eap_pwd
Module: Instantiating eap-pwd
pwd {
group = 19
fragment_size = 1020
server_id = "theserver at example.com"
virtual_server = "inner-tunnel"
}
Module: Linked to sub-module rlm_eap_leap
Module: Instantiating eap-leap
Module: Linked to sub-module rlm_eap_gtc
Module: Instantiating eap-gtc
gtc {
challenge = "Password: "
auth_type = "PAP"
}
Module: Linked to sub-module rlm_eap_tls
Module: Instantiating eap-tls
tls {
tls = "tls-common"
}
tls-config tls-common {
rsa_key_exchange = no
dh_key_exchange = yes
rsa_key_length = 512
dh_key_length = 512
verify_depth = 0
CA_path = "/usr/local/etc/raddb/certs"
pem_file_type = yes
private_key_file = "/usr/local/etc/raddb/certs/server.key"
certificate_file = "/usr/local/etc/raddb/certs/server.pem"
CA_file = "/usr/local/etc/raddb/certs/ca.pem"
dh_file = "/usr/local/etc/raddb/certs/dh"
random_file = "/usr/local/etc/raddb/certs/random"
fragment_size = 1024
include_length = yes
check_crl = no
cipher_list = "DEFAULT"
make_cert_command = "/usr/local/etc/raddb/certs/bootstrap"
ecdh_curve = "prime256v1"
cache {
enable = yes
lifetime = 24
max_entries = 255
}
verify {
}
ocsp {
enable = no
override_cert_url = yes
url = "http://127.0.0.1/ocsp/"
use_nonce = yes
timeout = 0
softfail = yes
}
}
Module: Linked to sub-module rlm_eap_ttls
Module: Instantiating eap-ttls
ttls {
tls = "tls-common"
default_eap_type = "md5"
copy_request_to_tunnel = no
use_tunneled_reply = no
virtual_server = "inner-tunnel"
include_length = yes
}
debug: Using cached TLS configuration from previous invocation
Module: Linked to sub-module rlm_eap_peap
Module: Instantiating eap-peap
peap {
tls = "tls-common"
default_eap_type = "mschapv2"
copy_request_to_tunnel = no
use_tunneled_reply = no
proxy_tunneled_request_as_eap = yes
virtual_server = "inner-tunnel"
soh = no
}
debug: Using cached TLS configuration from previous invocation
Module: Linked to sub-module rlm_eap_mschapv2
Module: Instantiating eap-mschapv2
mschapv2 {
with_ntdomain_hack = no
send_error = yes
}
Module: Checking authorize {...} for more modules to load
Module: Linked to module rlm_preprocess
Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess
preprocess {
huntgroups = "/usr/local/etc/raddb/huntgroups"
hints = "/usr/local/etc/raddb/hints"
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
with_alvarion_vsa_hack = no
}
Module: Linked to module rlm_realm
Module: Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm
realm suffix {
format = "suffix"
delimiter = "@"
ignore_default = no
ignore_null = no
}
Module: Linked to module rlm_files
Module: Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files
files {
usersfile = "/usr/local/etc/raddb/users"
acctusersfile = "/usr/local/etc/raddb/acct_users"
preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"
compat = "no"
}
Module: Checking preacct {...} for more modules to load
Module: Loading virtual module acct_unique
Module: Checking accounting {...} for more modules to load
Module: Linked to module rlm_detail
Module: Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail
detail {
detailfile = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
header = "%t"
detailperm = 384
dirperm = 493
locking = no
log_packet_header = no
}
Module: Linked to module rlm_radutmp
Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp
radutmp {
filename = "/var/log/radutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
perm = 384
callerid = yes
}
Module: Linked to module rlm_attr_filter
Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.accounting_response {
attrsfile = "/usr/local/etc/raddb/attrs.accounting_response"
key = "%{User-Name}"
relaxed = no
}
Module: Checking session {...} for more modules to load
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
Module: Loading virtual module remove_reply_message_if_eap
Module: Linked to module rlm_always
Module: Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always
always noop {
rcode = "noop"
simulcount = 0
mpp = no
}
Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.access_reject {
attrsfile = "/usr/local/etc/raddb/attrs.access_reject"
key = "%{User-Name}"
relaxed = no
}
Module: Loading virtual module remove_reply_message_if_eap
} # modules
} # server
server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
modules {
Module: Creating Post-Proxy-Type = Fail
Module: Checking authenticate {...} for more modules to load
Module: Checking authorize {...} for more modules to load
Module: Checking session {...} for more modules to load
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
Module: Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
detail reply_log {
detailfile = "/var/log/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d"
header = "%t"
detailperm = 384
dirperm = 493
locking = no
log_packet_header = no
}
} # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "auth"
ipaddr = *
port = 0
max_pps = 0
}
listen {
type = "acct"
ipaddr = *
port = 0
max_pps = 0
}
listen {
type = "auth"
ipaddr = 127.0.0.1
port = 18120
max_pps = 0
}
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
Opening new proxy address * port 1814
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=201, length=359
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67"
Acct-Session-Id = "cf76c8d5-000000fc"
NAS-Port = 236
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AP"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x024b0015015a4f4f504c55535c6173646631323334
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0x8c7ada2e1d18cc1f23c9920c78d3aca8
(0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(0) group authorize {
(0) - entering group authorize {...}
(0) [preprocess] = ok
(0) [chap] = noop
(0) [mschap] = noop
(0) [digest] = noop
(0) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(0) suffix : No such realm "NULL"
(0) [suffix] = noop
(0) eap : EAP packet type response id 75 length 21
(0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize
(0) [eap] = ok
(0) Found Auth-Type = EAP
(0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(0) group authenticate {
(0) - entering group authenticate {...}
(0) eap : EAP Identity
(0) eap : processing type peap
(0) peap : Flushing SSL sessions (of #0)
(0) peap : Initiate
(0) peap : Start returned 1
(0) [eap] = handled
Sending Access-Challenge of id 201 to 10.0.5.100 port 32783
EAP-Message = 0x014c00061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x930c2e1f9340379d95095c27e471c371
(0) Finished request 0.
Waking up in 0.3 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=219, length=486
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67"
Acct-Session-Id = "cf76c8d5-000000fc"
NAS-Port = 236
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AP"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x024c008219800000007816030100730100006f03014fd85561ec74aceb37fdd54e7985c3dac0333a03256e4c822ecc40ac227a5e93000018002f00350005000ac013c014c009c00a00320038001300040100002eff010001000000001500130000107a6f6f706c75735c6173646631323334000a0006000400170018000b00020100
State = 0x930c2e1f9340379d95095c27e471c371
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0x05df0aead4255d6ea51dde0c23afb31c
(1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(1) group authorize {
(1) - entering group authorize {...}
(1) [preprocess] = ok
(1) [chap] = noop
(1) [mschap] = noop
(1) [digest] = noop
(1) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(1) suffix : No such realm "NULL"
(1) [suffix] = noop
(1) eap : EAP packet type response id 76 length 130
(1) eap : Continuing tunnel setup.
(1) [eap] = ok
(1) Found Auth-Type = EAP
(1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(1) group authenticate {
(1) - entering group authenticate {...}
(1) eap : Request found, released from the list
(1) eap : EAP/peap
(1) eap : processing type peap
(1) peap : processing EAP-TLS
TLS Length 120
(1) peap : Length Included
(1) peap : eaptls_verify returned 11
(1) peap : (other): before/accept initialization
(1) peap : TLS_accept: before/accept initialization
(1) peap : <<< TLS 1.0 Handshake [length 0073], ClientHello
(1) peap : TLS_accept: SSLv3 read client hello A
(1) peap : >>> TLS 1.0 Handshake [length 0051], ServerHello
(1) peap : TLS_accept: SSLv3 write server hello A
(1) peap : >>> TLS 1.0 Handshake [length 0cc5], Certificate
(1) peap : TLS_accept: SSLv3 write certificate A
(1) peap : >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
(1) peap : TLS_accept: SSLv3 write server done A
(1) peap : TLS_accept: SSLv3 flush data
(1) peap : TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
(1) peap : eaptls_process returned 13
(1) peap : FR_TLS_HANDLED
(1) [eap] = handled
Sending Access-Challenge of id 219 to 10.0.5.100 port 32783
EAP-Message = 0x014d03ec19c000000d2916030100510200004d03014fd855f89cbf46621ff862e29a11a62efe9fe9c274fe8c1c7b03051753a3a701202c54374903787f84edf1c20ee8cf8a71bb39c8c63f30e574697b821577436c1b002f000005ff010001001603010cc50b000cc1000cbe0007aa308207a63082068ea003020102020310004e300d06092a864886f70d01010405003081a3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c0603550403
EAP-Message = 0x1315777777706b692e7765622e7a6f6f706c75732e64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e6465301e170d3132303232383039323934315a170d3135303232383039323934315a3081c3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731293027060355040a13206639323232396139633932306238656464613063346563383830643865383362310b3009060355040b130249543121301f060355040313187a7072616469757330312e7a6f6f706c75732e6c6f63616c
EAP-Message = 0x3120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e646530820222300d06092a864886f70d01010105000382020f003082020a0282020100df0e40f450e8633fdc375cb76ddca4885ce8cb275601f5b5e78a0ff8f4e8f13036c27a4e3c2e503e005d11e5c19a8b535e68a015b67f15b313d88a21df7b788ce45174c0137beadfb8186928e9acc169237805e0a00ea8f8245c7d4b1d64214e368339fe807dab5cc82c235823474903f76d8e363ff25a79094959af1edf13d4b23c4f9942467ffd088f91fd7072618e9e95d6360e44ede071785ce41f0899d4abe3e8d941f728ad204ad1e48f1fd12384ab392ed048d917b361
EAP-Message = 0x77efb35d76edcf6f6bf4518c46e53186e9c8ca7560481f8a87eb9cba46f56716fcff6a05ae25a1917ca1ede18c05640b41242465118dc66de1f3f22aa77598df0f0130070b95af02502eb9dd86f087502a2ce4ddf67dc94ccb60edba0f4e92e5f9ca75e950bc89a21671430395782d6d8fb78ba77b497ab6577e673acd4b9ebda8eb638d2aa6ba89798d0adc603a765c7b109f7b204abab14831b08fe1b34be34f3e1acb92bf878644e94f5de7381e3df2647f307d9343332112b978d68b02c63658d617268e610bf337d85f0a62a2e1a7b5a8fa1261e1835101920e3b37fd4e95e3fead50a5cac3239e57541679679824eacd1aa6
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x930c2e1f9241379d95095c27e471c371
(1) Finished request 1.
Waking up in 0.3 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=186, length=362
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67"
Acct-Session-Id = "cf76c8d5-000000fc"
NAS-Port = 236
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AP"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x024d00061900
State = 0x930c2e1f9241379d95095c27e471c371
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0x6466c7912ccfa79c06a36fc1af9f6467
(2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(2) group authorize {
(2) - entering group authorize {...}
(2) [preprocess] = ok
(2) [chap] = noop
(2) [mschap] = noop
(2) [digest] = noop
(2) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(2) suffix : No such realm "NULL"
(2) [suffix] = noop
(2) eap : EAP packet type response id 77 length 6
(2) eap : Continuing tunnel setup.
(2) [eap] = ok
(2) Found Auth-Type = EAP
(2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(2) group authenticate {
(2) - entering group authenticate {...}
(2) eap : Request found, released from the list
(2) eap : EAP/peap
(2) eap : processing type peap
(2) peap : processing EAP-TLS
(2) peap : Received TLS ACK
(2) peap : Received TLS ACK
(2) peap : ACK handshake fragment handler
(2) peap : eaptls_verify returned 1
(2) peap : eaptls_process returned 13
(2) peap : FR_TLS_HANDLED
(2) [eap] = handled
Sending Access-Challenge of id 186 to 10.0.5.100 port 32783
EAP-Message = 0x014e03e81940766385383e2cde4857beed6f5d0055147b933e7daa9922162c79d246e82182b9093f71aa15acaac374d5e514c545fde8d4246e4471d9ead260e06fc5a292a62aac5911d4b904b8015bf168d6c7022f8b8b0203010001a38202bf308202bb300c0603551d130101ff04023000300e0603551d0f0101ff0404030205a0301406096086480186f84201010101ff04040302064030160603551d250101ff040c300a06082b06010505070301301d0603551d0e0416041424e274626b9d850eb8eb9fd2a5d4e4555dccc3233081d80603551d230481d03081cd8014343094169c0bc40653b5ebaf41601f3b65d91227a181a9a481a63081a331
EAP-Message = 0x0b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c06035504031315777777706b692e7765622e7a6f6f706c75732e64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e64658209008f68987367f3a4b330360603551d11042f302d82187a7072616469757330312e7a6f6f706c75732e6c6f63616c811173797361646d407a6f6f706c75732e6465301c0603551d1204153013811173797361646d407a6f6f70
EAP-Message = 0x6c75732e6465304a0603551d1f04433041303fa03da03b8639687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f696e6465782e7068703f73746167653d646c5f63726c303906096086480186f842010d042c162a5048506b692f4f70656e53534c2047656e65726174656420536572766572204365727469666963617465303206096086480186f842010204251623687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f302306096086480186f8420103041616146e735f7265766f6b655f71756572792e7068703f303d06096086480186f84201080430162e687474703a2f
EAP-Message = 0x2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f706f6c6963792e68746d6c300d06092a864886f70d01010405000382010100a9926e3eab9f9ed846e4d3618ab5df744295922b7393517c86a7e9e879ae6862200092525a365845841ed019acb8401c12057b4fd132a39fdb89eed85e85beb4ec203049f8dfd9c3038bee65de5bb59962b0a77e9a4d95b99340ed94d38845b185f1483898f18272d216f4d831bfe43f02df131b8445b7417677965db6f94676b0c7337240f09fbd8fd5755e0c0fe88469f12a0b4b929dcd4327517f0cdc4327432be87207cf40f81f60d90c16d7045566b611ee90
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x930c2e1f9142379d95095c27e471c371
(2) Finished request 2.
Waking up in 0.2 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=210, length=362
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67"
Acct-Session-Id = "cf76c8d5-000000fc"
NAS-Port = 236
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AP"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x024e00061900
State = 0x930c2e1f9142379d95095c27e471c371
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0xc6bf7d0a64ded4d427400730c9f64a00
(3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(3) group authorize {
(3) - entering group authorize {...}
(3) [preprocess] = ok
(3) [chap] = noop
(3) [mschap] = noop
(3) [digest] = noop
(3) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(3) suffix : No such realm "NULL"
(3) [suffix] = noop
(3) eap : EAP packet type response id 78 length 6
(3) eap : Continuing tunnel setup.
(3) [eap] = ok
(3) Found Auth-Type = EAP
(3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(3) group authenticate {
(3) - entering group authenticate {...}
(3) eap : Request found, released from the list
(3) eap : EAP/peap
(3) eap : processing type peap
(3) peap : processing EAP-TLS
(3) peap : Received TLS ACK
(3) peap : Received TLS ACK
(3) peap : ACK handshake fragment handler
(3) peap : eaptls_verify returned 1
(3) peap : eaptls_process returned 13
(3) peap : FR_TLS_HANDLED
(3) [eap] = handled
Sending Access-Challenge of id 210 to 10.0.5.100 port 32783
EAP-Message = 0x014f03e81940dd918bae3094651e2d38da6cb6470e5a5705d04419ecc02984c06dd99d858684b4ffeea1f0049440d3542eb307f94b4e343a78ad2bf5d8dff067c49eed40825295fc525c89ffe00316ab9800050e3082050a308203f2a0030201020209008f68987367f3a4b3300d06092a864886f70d01010405003081a3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c06035504031315777777706b692e7765622e7a6f6f706c75732e
EAP-Message = 0x64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e6465301e170d3039303331333134323030315a170d3134303331333134323030315a3081a3310b30090603550406130244453111300f06035504081308426176617269616e310f300d060355040713064d756e69636831133011060355040a130a5a6f6f706c757320414731193017060355040b1310495420496e667261737472756b747572311e301c06035504031315777777706b692e7765622e7a6f6f706c75732e64653120301e06092a864886f70d010901161173797361646d407a6f6f706c75732e646530820122300d06092a864886f70d0101010500
EAP-Message = 0x0382010f003082010a0282010100b53247f132a0563881dd2cd39b014fce9dd553316e5acfad692af9121c4144dd5518fddd97459ae4c5b58dde04746615af13ce199e492269694b7a90f39a0ee2abb1222fc5b966b75f04e7d5b3ea9855bea211c5fbbfcb8f9d9059034e2af246494ba7d21812bce51f716000309a2842a43b53b3d69ded50954cf1bf0259e32410074bdd61676dac3af823013cc07fecd18329dee9a0129ae38fe37db7cf2161b1a6a313a2e48f07c80a630467dae941cfa094df8eebd542b85275f6dc776d6eb96f28b879c1f3178fcae1c8c984e8aaec01cd18c3ccdf90a9fea7a1239b605bc2c3a4092dc2551e84007d9a047359
EAP-Message = 0xf47dda3aba5d94d2785f684b8bd95603410203010001a382013d30820139300c0603551d13040530030101ff300b0603551d0f040403020106301106096086480186f8420101040403020007301d0603551d0e04160414343094169c0bc40653b5ebaf41601f3b65d91227301c0603551d1104153013811173797361646d407a6f6f706c75732e6465304a0603551d1f04433041303fa03da03b8639687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f696e6465782e7068703f73746167653d646c5f63726c304106096086480186f842010d043416325048506b692f4f70656e53
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x930c2e1f9043379d95095c27e471c371
(3) Finished request 3.
Waking up in 0.2 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=64, length=362
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67"
Acct-Session-Id = "cf76c8d5-000000fc"
NAS-Port = 236
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AP"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x024f00061900
State = 0x930c2e1f9043379d95095c27e471c371
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0xdf19c2e6d02c9dc91e86aaa3922e4797
(4) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(4) group authorize {
(4) - entering group authorize {...}
(4) [preprocess] = ok
(4) [chap] = noop
(4) [mschap] = noop
(4) [digest] = noop
(4) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(4) suffix : No such realm "NULL"
(4) [suffix] = noop
(4) eap : EAP packet type response id 79 length 6
(4) eap : Continuing tunnel setup.
(4) [eap] = ok
(4) Found Auth-Type = EAP
(4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(4) group authenticate {
(4) - entering group authenticate {...}
(4) eap : Request found, released from the list
(4) eap : EAP/peap
(4) eap : processing type peap
(4) peap : processing EAP-TLS
(4) peap : Received TLS ACK
(4) peap : Received TLS ACK
(4) peap : ACK handshake fragment handler
(4) peap : eaptls_verify returned 1
(4) peap : eaptls_process returned 13
(4) peap : FR_TLS_HANDLED
(4) [eap] = handled
Sending Access-Challenge of id 64 to 10.0.5.100 port 32783
EAP-Message = 0x015001891900534c2047656e65726174656420526f6f7420436572746966696361746520417574686f72697479303d06096086480186f84201080430162e687474703a2f2f777777706b692e7765622e7a6f6f706c75732e64652f7068706b692f706f6c6963792e68746d6c300d06092a864886f70d010104050003820101009ebc1a5dd90c801d205cb2a90c8bc3ab00db1ecb7d733632e6c5cfc033ded56fe93dc9752096ea56f194ebc980b843d7b1444b46689baea6c180997eaa77ae4b5aed2657c924a0f160b64adeef2af57df3ea220a94dd1c6571213f432e0888abc037f9ad970406d797bce1163d31c9df848258296d336f929dadd33ba7
EAP-Message = 0xad9e6bd0a8e101e4514e569f64097e12bb6e05ae9e51a4170b056570bd14a33faa584075a9dfafa8dd979d4664f76f5730953903ce77c7b4e8e2e3356ed9be221fd6f872dab6451da6950f46893af28efb6df277e22169e81884cd3abe4c464523d7622dfe93d1a5f29b2d623292eca09b3bfe84fb67b6d4749ff6b61de2971388045316030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x930c2e1f975c379d95095c27e471c371
(4) Finished request 4.
Waking up in 0.2 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=60, length=952
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67"
Acct-Session-Id = "cf76c8d5-000000fc"
NAS-Port = 236
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AP"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x025002501980000002461603010206100002020200309897ca72ca8c5c64c113ad383216b0131678f5050e5775dd6bd2fab48640b9db094b7d7e4db6d45e067cbd69d46c27de3e6bbbb7b8b1914dba63cb4ab3a9f69b7320ddc37a0d5c19aa1a23298b024faa6e63c1a2c1a90a2b20263f83a6b76504ef01e2c955bb2d539b762e7929fb0248b1c59b0338a481aa87069d3f53de5dca8fc996771af0576a056a52016d7bb48d12bf9c4a524efcb45b59fde15a2370249f2440a777627c2b367438a648435f6e86e91536e260c24a7ff2a857e9a5a7e62f72746043cb815cc41ff1d8d0e622f9cd4446fdabcb0f2fe6520293280a2d75598437b6caa18d
EAP-Message = 0xb81872487e9af91e30148211a5241926410132ae15aa19ea3f89e8d8b17410b2f4aeb832840ad33cbc2c9c6889de1ff0b39bb0931e1767b64df862541373026ce1acbcc96a0073e9f4c0ac43da5262af1754af7ebe8e71b5f665dc249eacf8240233cdf9ad50a976bde939058e3107e87ae36798bee9362c121d31dbe144e06abb0c12451f6815220a954badf5e64d6db6fd5d790d71c2591ef900648764003d55028d2a04a84262bca9fcbad62b512aca739f772dc2999e2c9eb142840bc75bc17aab9891076f166a3794fc9b0a9ef70ed8cdac493ba2f584588eed62c6c9b8456a53707b91c4cff00e4cfe2e9fdcf2cdeea548d50699cb7505b1b041
EAP-Message = 0x05ccd32355f6b0502ce405c48693f9a14270993aabd9a07438499c14030100010116030100301fa06a5058a700bd21307760604ca7fbf39f6e2c7e5bc730ddb4d7a7e54c415957a88cfd7910e4d9cec812d88bf2c48a
State = 0x930c2e1f975c379d95095c27e471c371
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0xf7328527ad83d2d65ae600cee18db09c
(5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(5) group authorize {
(5) - entering group authorize {...}
(5) [preprocess] = ok
(5) [chap] = noop
(5) [mschap] = noop
(5) [digest] = noop
(5) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(5) suffix : No such realm "NULL"
(5) [suffix] = noop
(5) eap : EAP packet type response id 80 length 253
(5) eap : Continuing tunnel setup.
(5) [eap] = ok
(5) Found Auth-Type = EAP
(5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(5) group authenticate {
(5) - entering group authenticate {...}
(5) eap : Request found, released from the list
(5) eap : EAP/peap
(5) eap : processing type peap
(5) peap : processing EAP-TLS
TLS Length 582
(5) peap : Length Included
(5) peap : eaptls_verify returned 11
(5) peap : <<< TLS 1.0 Handshake [length 0206], ClientKeyExchange
(5) peap : TLS_accept: SSLv3 read client key exchange A
(5) peap : <<< TLS 1.0 ChangeCipherSpec [length 0001]
(5) peap : <<< TLS 1.0 Handshake [length 0010], Finished
(5) peap : TLS_accept: SSLv3 read finished A
(5) peap : >>> TLS 1.0 ChangeCipherSpec [length 0001]
(5) peap : TLS_accept: SSLv3 write change cipher spec A
(5) peap : >>> TLS 1.0 Handshake [length 0010], Finished
(5) peap : TLS_accept: SSLv3 write finished A
(5) peap : TLS_accept: SSLv3 flush data
SSL: adding session 2c54374903787f84edf1c20ee8cf8a71bb39c8c63f30e574697b821577436c1b to cache
(5) peap : (other): SSL negotiation finished successfully
SSL Connection Established
(5) peap : eaptls_process returned 13
(5) peap : FR_TLS_HANDLED
(5) [eap] = handled
Sending Access-Challenge of id 60 to 10.0.5.100 port 32783
EAP-Message = 0x0151004119001403010001011603010030f6aa4ff160c5f9b19e7120e24cd4a464b3ccc46aa829cf6d04735641949509bbddafb18c85d8ecc9b9c13ce4d9be6acb
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x930c2e1f965d379d95095c27e471c371
(5) Finished request 5.
Waking up in 0.2 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=136, length=362
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67"
Acct-Session-Id = "cf76c8d5-000000fc"
NAS-Port = 236
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AP"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x025100061900
State = 0x930c2e1f965d379d95095c27e471c371
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0x258bd54678fdab223698ae4e86af97a5
(6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(6) group authorize {
(6) - entering group authorize {...}
(6) [preprocess] = ok
(6) [chap] = noop
(6) [mschap] = noop
(6) [digest] = noop
(6) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(6) suffix : No such realm "NULL"
(6) [suffix] = noop
(6) eap : EAP packet type response id 81 length 6
(6) eap : Continuing tunnel setup.
(6) [eap] = ok
(6) Found Auth-Type = EAP
(6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(6) group authenticate {
(6) - entering group authenticate {...}
(6) eap : Request found, released from the list
(6) eap : EAP/peap
(6) eap : processing type peap
(6) peap : processing EAP-TLS
(6) peap : Received TLS ACK
(6) peap : Received TLS ACK
(6) peap : ACK handshake is finished
(6) peap : eaptls_verify returned 3
(6) peap : eaptls_process returned 3
(6) peap : FR_TLS_SUCCESS
(6) peap : Session established. Decoding tunneled attributes.
(6) peap : Peap state TUNNEL ESTABLISHED
(6) [eap] = handled
Sending Access-Challenge of id 136 to 10.0.5.100 port 32783
EAP-Message = 0x0152002b19001703010020f55fb6c5caa3a2f060a22bdbb38b9d10cbc036d5ab0917a9c3e286e7114685b4
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x930c2e1f955e379d95095c27e471c371
(6) Finished request 6.
Waking up in 0.1 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=168, length=415
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67"
Acct-Session-Id = "cf76c8d5-000000fc"
NAS-Port = 236
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AP"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x0252003b190017030100301f80985ec72756e184b2749ffaadbad99bacae6260b0e902544c14a0a32ac8462345c78966b49be0890162adc850fc69
State = 0x930c2e1f955e379d95095c27e471c371
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0x62f97908b69011a30e4a5e669ce06722
(7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(7) group authorize {
(7) - entering group authorize {...}
(7) [preprocess] = ok
(7) [chap] = noop
(7) [mschap] = noop
(7) [digest] = noop
(7) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(7) suffix : No such realm "NULL"
(7) [suffix] = noop
(7) eap : EAP packet type response id 82 length 59
(7) eap : Continuing tunnel setup.
(7) [eap] = ok
(7) Found Auth-Type = EAP
(7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(7) group authenticate {
(7) - entering group authenticate {...}
(7) eap : Request found, released from the list
(7) eap : EAP/peap
(7) eap : processing type peap
(7) peap : processing EAP-TLS
(7) peap : eaptls_verify returned 7
(7) peap : Done initial handshake
(7) peap : eaptls_process returned 7
(7) peap : FR_TLS_OK
(7) peap : Session established. Decoding tunneled attributes.
(7) peap : Peap state WAITING FOR INNER IDENTITY
(7) peap : Identity - TEST\user1
(7) peap : Got inner identity 'TEST\user1'
(7) peap : Setting default EAP type for tunneled EAP session.
(7) peap : Got tunneled request
EAP-Message = 0x02520015015a4f4f504c55535c6173646631323334
server {
(7) peap : Setting User-Name to TEST\user1
Sending tunneled request
EAP-Message = 0x02520015015a4f4f504c55535c6173646631323334
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "TEST\\user1"
server inner-tunnel {
(7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(7) group authorize {
(7) - entering group authorize {...}
(7) [chap] = noop
(7) [mschap] = noop
(7) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(7) suffix : No such realm "NULL"
(7) [suffix] = noop
(7) update control {
(7) } # update control = noop
(7) eap : EAP packet type response id 82 length 21
(7) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize
(7) [eap] = ok
(7) Found Auth-Type = EAP
(7) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(7) group authenticate {
(7) - entering group authenticate {...}
(7) eap : EAP Identity
(7) eap : processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
(7) [eap] = handled
} # server inner-tunnel
(7) peap : Got tunneled reply code 11
EAP-Message = 0x0153002a1a01530025100138f26de51fe8877ff61f134946da9a5a4f4f504c55535c6173646631323334
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8abb48828ae852f8102b63fc437692fc
(7) peap : Got tunneled reply RADIUS code 11
EAP-Message = 0x0153002a1a01530025100138f26de51fe8877ff61f134946da9a5a4f4f504c55535c6173646631323334
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8abb48828ae852f8102b63fc437692fc
(7) peap : Got tunneled Access-Challenge
(7) [eap] = handled
Sending Access-Challenge of id 168 to 10.0.5.100 port 32783
EAP-Message = 0x0153004b19001703010040ea858820fac13721de9038841c4e86bf9161eccaf99ee6e9dac2d2dde316259fbd0b0b1f0a23db379a96544d6fedc5bc8265eb396da9a5d8dd96fc162e1a36d0
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x930c2e1f945f379d95095c27e471c371
(7) Finished request 7.
Waking up in 0.1 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=99, length=463
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67"
Acct-Session-Id = "cf76c8d5-000000fc"
NAS-Port = 236
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AP"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x0253006b19001703010060a3dc72b8efb48dc8c146899dc9630574e40f2ce3e7522dd7ede7e9773a93da740c378ec97534753bc00eae72a62d57337c455740b3ee8727f0d42343dd9c6be9af6952283e953c1433f7438e629bcf0dfd361db0ad4d16dfe2340e598396ce90
State = 0x930c2e1f945f379d95095c27e471c371
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0x3732ac156e76595657a5221130446fab
(8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(8) group authorize {
(8) - entering group authorize {...}
(8) [preprocess] = ok
(8) [chap] = noop
(8) [mschap] = noop
(8) [digest] = noop
(8) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(8) suffix : No such realm "NULL"
(8) [suffix] = noop
(8) eap : EAP packet type response id 83 length 107
(8) eap : Continuing tunnel setup.
(8) [eap] = ok
(8) Found Auth-Type = EAP
(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(8) group authenticate {
(8) - entering group authenticate {...}
(8) eap : Request found, released from the list
(8) eap : EAP/peap
(8) eap : processing type peap
(8) peap : processing EAP-TLS
(8) peap : eaptls_verify returned 7
(8) peap : Done initial handshake
(8) peap : eaptls_process returned 7
(8) peap : FR_TLS_OK
(8) peap : Session established. Decoding tunneled attributes.
(8) peap : Peap state phase2
(8) peap : EAP type mschapv2
(8) peap : Got tunneled request
EAP-Message = 0x0253004b1a02530046319b261aedb04447e6f33644abcb83415b0000000000000000e3426708aea6af13c9ba6ca1af31212f460cd1a834482660005a4f4f504c55535c6173646631323334
server {
(8) peap : Setting User-Name to TEST\user1
Sending tunneled request
EAP-Message = 0x0253004b1a02530046319b261aedb04447e6f33644abcb83415b0000000000000000e3426708aea6af13c9ba6ca1af31212f460cd1a834482660005a4f4f504c55535c6173646631323334
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "TEST\\user1"
State = 0x8abb48828ae852f8102b63fc437692fc
server inner-tunnel {
(8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) group authorize {
(8) - entering group authorize {...}
(8) [chap] = noop
(8) [mschap] = noop
(8) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(8) suffix : No such realm "NULL"
(8) [suffix] = noop
(8) update control {
(8) } # update control = noop
(8) eap : EAP packet type response id 83 length 75
(8) eap : No EAP Start, assuming it's an on-going EAP conversation
(8) [eap] = updated
(8) [files] = noop
(8) [expiration] = noop
(8) [logintime] = noop
(8) [pap] = noop
(8) Found Auth-Type = EAP
(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) group authenticate {
(8) - entering group authenticate {...}
(8) eap : Request found, released from the list
(8) eap : EAP/mschapv2
(8) eap : processing type mschapv2
(8) mschapv2 : # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) mschapv2 : group MS-CHAP {
(8) mschapv2 : - entering group MS-CHAP {...}
(8) mschap : Creating challenge hash with username: test1
(8) mschap : Told to do MS-CHAPv2 for test1 with NT-Password
(8) mschap : expand: %{Stripped-User-Name} ->
(8) mschap : ... expanding second conditional
(8) mschap : expand: %{User-Name} -> TEST\user1
(8) mschap : expand: %{%{User-Name}:-None} -> TEST\user1
(8) mschap : expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=TEST\user1
(8) mschap : Creating challenge hash with username: user1
(8) mschap : expand: %{mschap:Challenge} -> 05ac8b071ffed031
(8) mschap : expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=05ac8b071ffed031
(8) mschap : expand: %{mschap:NT-Response} -> e3426708aea6af13c9ba6ca1af31212f460cd1a834482660
(8) mschap : expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=e3426708aea6af13c9ba6ca1af31212f460cd1a834482660
Exec-Program output: Must change password (0xc0000224)
Exec-Program-Wait: plaintext: Must change password (0xc0000224)
Exec-Program: returned: 1
(8) mschap : ntlm_auth says password must change
(8) [mschap] = reject
rlm_eap_mschapv2: No MS-CHAPv2-Success or MS-CHAP-Error was found.
(8) eap : Handler failed in EAP/mschapv2
(8) eap : Failed in EAP select
(8) [eap] = invalid
(8) Failed to authenticate the user.
} # server inner-tunnel
(8) peap : Got tunneled reply code 3
MS-CHAP-Error = "SE=648 R=0 C=9b268dcbbfadefbba4138c2b12f90353 V=3 M=Password Expired"
EAP-Message = 0x04530004
Message-Authenticator = 0x00000000000000000000000000000000
(8) peap : Got tunneled reply RADIUS code 3
MS-CHAP-Error = "SE=648 R=0 C=9b268dcbbfadefbba4138c2b12f90353 V=3 M=Password Expired"
EAP-Message = 0x04530004
Message-Authenticator = 0x00000000000000000000000000000000
(8) peap : Tunneled authentication was rejected.
(8) peap : FAILURE
(8) [eap] = handled
Sending Access-Challenge of id 99 to 10.0.5.100 port 32783
EAP-Message = 0x0154002b19001703010020014b48b95de643020707b13524faf7b1a23f4ba34ee63c2c2a260b9335c74e35
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x930c2e1f9b58379d95095c27e471c371
(8) Finished request 8.
Waking up in 0.1 seconds.
rad_recv: Access-Request packet from host 10.0.5.100 port 32783, id=44, length=399
Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67"
Acct-Session-Id = "cf76c8d5-000000fc"
NAS-Port = 236
NAS-Port-Type = Wireless-802.11
NAS-Identifier = "AP"
NAS-IP-Address = 10.0.1.50
Framed-MTU = 1496
User-Name = "TEST\\user1"
Calling-Station-Id = "A1-23-DF-79-F0-B9"
Called-Station-Id = "00-A1-B1-4D-D4-78"
Service-Type = Framed-User
EAP-Message = 0x0254002b19001703010020fdf63531aebd5e4de6cb29edf9a3fc7aace323aaba3853272fb46f862d7479aa
State = 0x930c2e1f9b58379d95095c27e471c371
Attr-26 = 0x00002228000c737369643d7a706c5f320016696e636f6d696e672d766c616e2d69643d313238000f67726f75703d4dfc6e6368656e00127673632d756e697175652d69643d31300017706879747970653d49454545383032646f74313167
Attr-26.8744.250 = 0x00000003
Attr-26.8744.249 = 0xc0a81489
Message-Authenticator = 0x6f7dc3389c985148f3853c3f8e6644a3
(9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(9) group authorize {
(9) - entering group authorize {...}
(9) [preprocess] = ok
(9) [chap] = noop
(9) [mschap] = noop
(9) [digest] = noop
(9) suffix : No '@' in User-Name = "TEST\user1", looking up realm NULL
(9) suffix : No such realm "NULL"
(9) [suffix] = noop
(9) eap : EAP packet type response id 84 length 43
(9) eap : Continuing tunnel setup.
(9) [eap] = ok
(9) Found Auth-Type = EAP
(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(9) group authenticate {
(9) - entering group authenticate {...}
(9) eap : Request found, released from the list
(9) eap : EAP/peap
(9) eap : processing type peap
(9) peap : processing EAP-TLS
(9) peap : eaptls_verify returned 7
(9) peap : Done initial handshake
(9) peap : eaptls_process returned 7
(9) peap : FR_TLS_OK
(9) peap : Session established. Decoding tunneled attributes.
(9) peap : Peap state send tlv failure
(9) peap : Received EAP-TLV response.
(9) peap : The users session was previously rejected: returning reject (again.)
(9) peap : *** This means you need to read the PREVIOUS messages in the debug output
(9) peap : *** to find out the reason why the user was rejected.
(9) peap : *** Look for "reject" or "fail". Those earlier messages will tell you.
(9) peap : *** what went wrong, and how to fix the problem.
SSL: Removing session 2c54374903787f84edf1c20ee8cf8a71bb39c8c63f30e574697b821577436c1b from the cache
(9) eap : Handler failed in EAP/peap
(9) eap : Failed in EAP select
(9) [eap] = invalid
(9) Failed to authenticate the user.
(9) Using Post-Auth-Type Reject
(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(9) group REJECT {
(9) - entering group REJECT {...}
(9) attr_filter.access_reject : expand: %{User-Name} -> TEST\user1
(9) attr_filter.access_reject : Matched entry DEFAULT at line 11
(9) [attr_filter.access_reject] = updated
(9) eap : Reply already contained an EAP-Message, not inserting EAP-Failure
(9) [eap] = noop
(9) policy remove_reply_message_if_eap {
(9) - entering policy remove_reply_message_if_eap {...}
(9) ? if (reply:EAP-Message && reply:Reply-Message)
(9) ? Evaluating (reply:EAP-Message ) -> TRUE
(9) ? Evaluating (reply:Reply-Message) -> FALSE
(9) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE
(9) else else {
(9) - entering else else {...}
(9) [noop] = noop
(9) - else else returns noop
(9) - policy remove_reply_message_if_eap returns noop
(9) Finished request 9.
Waking up in 0.6 seconds.
(9) Sending delayed reject
Sending Access-Reject of id 44 to 10.0.5.100 port 32783
EAP-Message = 0x04540004
Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.7 seconds.
(0) Cleaning up request packet ID 201 with timestamp +12
(1) Cleaning up request packet ID 219 with timestamp +12
(2) Cleaning up request packet ID 186 with timestamp +12
(3) Cleaning up request packet ID 210 with timestamp +12
(4) Cleaning up request packet ID 64 with timestamp +12
(5) Cleaning up request packet ID 60 with timestamp +12
(6) Cleaning up request packet ID 136 with timestamp +12
(7) Cleaning up request packet ID 168 with timestamp +12
(8) Cleaning up request packet ID 99 with timestamp +12
Waking up in 1.0 seconds.
(9) Cleaning up request packet ID 44 with timestamp +12
Ready to process requests.
--
Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir
belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de
More information about the Freeradius-Users
mailing list