Calling eap_md5 to process EAP data in inner-tunnel
Oleksandr Yermolenko
aae at sumix.com
Wed Oct 8 11:37:12 CEST 2014
On 10/08/2014 12:29 PM, A.L.M.Buxey at lboro.ac.uk wrote:
> Hi,
>
>> Could someone give me advices or info why it happened?
>> stages how eap-md5 should work in innner-tunnel?
>> I saw http://wiki.freeradius.org/guide/EAPMD5-HOWTO but it's not
>> enough in my scenario.
> radiusd -X form the start, not just the bit you feel like cheers :-)
>
> alan
ok, full radiusd -X
/Received Access-Request Id 177 from 127.0.0.1:53526 to 127.0.0.1:1812
length 152
User-Name = 'stu at sumix.com'
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-Port = 72
NAS-Port-Id = 'rw-eap'
NAS-IP-Address = 10.20.9.12
Called-Station-Id = '10.20.9.12[4500]'
Calling-Station-Id = '10.20.9.8[4500]'
EAP-Message = 0x02000012017374754073756d69782e636f6d
NAS-Identifier = 'strongSwan'
Message-Authenticator = 0x41257dcc2d17ce493aa3b9e17e8d1171
(0) Received Access-Request packet from host 127.0.0.1 port 53526,
id=177, length=152
(0) User-Name = 'stu at sumix.com'
(0) NAS-Port-Type = Virtual
(0) Service-Type = Framed-User
(0) NAS-Port = 72
(0) NAS-Port-Id = 'rw-eap'
(0) NAS-IP-Address = 10.20.9.12
(0) Called-Station-Id = '10.20.9.12[4500]'
(0) Calling-Station-Id = '10.20.9.8[4500]'
(0) EAP-Message = 0x02000012017374754073756d69782e636f6d
(0) NAS-Identifier = 'strongSwan'
(0) Message-Authenticator = 0x41257dcc2d17ce493aa3b9e17e8d1171
(0) # Executing section authorize from file /etc/raddb/sites-enabled/default
(0) authorize {
(0) suffix : Checking for suffix after "@"
(0) suffix : Looking up realm "sumix.com" for User-Name = "stu at sumix.com"
(0) suffix : Found realm "sumix.com"
(0) suffix : Adding Stripped-User-Name = "stu"
(0) suffix : Adding Realm = "sumix.com"
(0) suffix : Authentication realm is LOCAL
(0) [suffix] = ok
(0) eap : Peer sent code Response (2) ID 0 length 18
(0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit
the rest of authorize
(0) [eap] = ok
(0) } # authorize = ok
(0) Found Auth-Type = EAP
(0) # Executing group from file /etc/raddb/sites-enabled/default
(0) authenticate {
(0) eap : Peer sent method Identity (1)
(0) eap : Calling eap_ttls to process EAP data
(0) eap_ttls : Flushing SSL sessions (of #0)
(0) eap_ttls : Initiate
(0) eap_ttls : Start returned 1
(0) eap : New EAP session, adding 'State' attribute to reply
0xb955db71b954ce9f
(0) [eap] = handled
(0) } # authenticate = handled
(0) Sending Access-Challenge packet to host 127.0.0.1 port 53526,
id=177, length=0
(0) EAP-Message = 0x010100061520
(0) Message-Authenticator = 0x00000000000000000000000000000000
(0) State = 0xb955db71b954ce9f198457e8e66f50f6
Sending Access-Challenge Id 177 from 127.0.0.1:1812 to 127.0.0.1:53526
EAP-Message = 0x010100061520
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xb955db71b954ce9f198457e8e66f50f6
(0) Finished request
Waking up in 0.3 seconds.
Received Access-Request Id 178 from 127.0.0.1:53526 to 127.0.0.1:1812
length 250
User-Name = 'stu at sumix.com'
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-Port = 72
NAS-Port-Id = 'rw-eap'
NAS-IP-Address = 10.20.9.12
Called-Station-Id = '10.20.9.12[4500]'
Calling-Station-Id = '10.20.9.8[4500]'
EAP-Message =
0x0201006215800000005816030300530100004f0303543504e19f976a5871b17461d745bee0aa23d75a49a7d9a7b4fcdbe0158eac28000014003300670039006b0016002f003c0035003d000a01000012000d000e000c040105010601030102010101
NAS-Identifier = 'strongSwan'
State = 0xb955db71b954ce9f198457e8e66f50f6
Message-Authenticator = 0x8da8b4a05292ef97b74e152d1b4d8b83
(1) Received Access-Request packet from host 127.0.0.1 port 53526,
id=178, length=250
(1) User-Name = 'stu at sumix.com'
(1) NAS-Port-Type = Virtual
(1) Service-Type = Framed-User
(1) NAS-Port = 72
(1) NAS-Port-Id = 'rw-eap'
(1) NAS-IP-Address = 10.20.9.12
(1) Called-Station-Id = '10.20.9.12[4500]'
(1) Calling-Station-Id = '10.20.9.8[4500]'
(1) EAP-Message =
0x0201006215800000005816030300530100004f0303543504e19f976a5871b17461d745bee0aa23d75a49a7d9a7b4fcdbe0158eac28000014003300670039006b0016002f003c0035003d000a01000012000d000e000c040105010601030102010101
(1) NAS-Identifier = 'strongSwan'
(1) State = 0xb955db71b954ce9f198457e8e66f50f6
(1) Message-Authenticator = 0x8da8b4a05292ef97b74e152d1b4d8b83
(1) # Executing section authorize from file /etc/raddb/sites-enabled/default
(1) authorize {
(1) suffix : Checking for suffix after "@"
(1) suffix : Looking up realm "sumix.com" for User-Name = "stu at sumix.com"
(1) suffix : Found realm "sumix.com"
(1) suffix : Adding Stripped-User-Name = "stu"
(1) suffix : Adding Realm = "sumix.com"
(1) suffix : Authentication realm is LOCAL
(1) [suffix] = ok
(1) eap : Peer sent code Response (2) ID 1 length 98
(1) eap : Continuing tunnel setup
(1) [eap] = ok
(1) } # authorize = ok
(1) Found Auth-Type = EAP
(1) # Executing group from file /etc/raddb/sites-enabled/default
(1) authenticate {
(1) eap : Expiring EAP session with state 0xb955db71b954ce9f
(1) eap : Finished EAP session with state 0xb955db71b954ce9f
(1) eap : Previous EAP request found for state 0xb955db71b954ce9f,
released from the list
(1) eap : Peer sent method TTLS (21)
(1) eap : EAP TTLS (21)
(1) eap : Calling eap_ttls to process EAP data
(1) eap_ttls : Authenticate
(1) eap_ttls : processing EAP-TLS
TLS Length 88
(1) eap_ttls : Length Included
(1) eap_ttls : eaptls_verify returned 11
(1) eap_ttls : (other): before/accept initialization
(1) eap_ttls : TLS_accept: before/accept initialization
(1) eap_ttls : <<< TLS 1.0 Handshake [length 0053], ClientHello
(1) eap_ttls : TLS_accept: SSLv3 read client hello A
(1) eap_ttls : >>> TLS 1.0 Handshake [length 004a], ServerHello
(1) eap_ttls : TLS_accept: SSLv3 write server hello A
(1) eap_ttls : >>> TLS 1.0 Handshake [length 03d3], Certificate
(1) eap_ttls : TLS_accept: SSLv3 write certificate A
(1) eap_ttls : >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange
(1) eap_ttls : TLS_accept: SSLv3 write key exchange A
(1) eap_ttls : >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
(1) eap_ttls : TLS_accept: SSLv3 write server done A
(1) eap_ttls : TLS_accept: SSLv3 flush data
(1) eap_ttls : TLS_accept: Need to read more data: SSLv3 read client
certificate A
In SSL Handshake Phase
In SSL Accept mode
(1) eap_ttls : eaptls_process returned 13
(1) eap : New EAP session, adding 'State' attribute to reply
0xb955db71b857ce9f
(1) [eap] = handled
(1) } # authenticate = handled
(1) Sending Access-Challenge packet to host 127.0.0.1 port 53526,
id=178, length=0
(1) EAP-Message =
0x010203ec15c000000642160301004a020000460301543504e1248026fe90c4f1d4c591f06203871a3dca3d7c2abde9d88ff89ffce220ca08d8b5178eaffc349e3972b298a27b98df16b1832e503c5390ab0d4f712a6600330016030103d30b0003cf0003cc0003c9308203c5308202ada003020102020101300d06092a864886f70d0101050500308186310b3009060355040613025541310f300d06035504081306526164697573310d300b060355040713044b69657631133011060355040a130a53756d697820496e632e311c301a06092a864886f70d010901160d6161654073756d69782e636f6d312430220603550403131b53756d697820436572746966696361746520417574686f72697479301e170d3134313030333039353734355a170d3134313230323039353734355a3074310b3009060355040613025541310f300d0603550408130652616469757331133011060355040a130a53756d697820496e632e3121301f0603550403131853756d697820536572766572204365727469666963617465311c301a06092a864886f70d010901160d6161654073756d69782e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100a653008d510c3ae6faa5cae07b04988d706e8b3cbafb56659636501675bef7639fea37e28e140689aca254f066197b82
(1) Message-Authenticator = 0x00000000000000000000000000000000
(1) State = 0xb955db71b857ce9f198457e8e66f50f6
Sending Access-Challenge Id 178 from 127.0.0.1:1812 to 127.0.0.1:53526
EAP-Message =
0x010203ec15c000000642160301004a020000460301543504e1248026fe90c4f1d4c591f06203871a3dca3d7c2abde9d88ff89ffce220ca08d8b5178eaffc349e3972b298a27b98df16b1832e503c5390ab0d4f712a6600330016030103d30b0003cf0003cc0003c9308203c5308202ada003020102020101300d06092a864886f70d0101050500308186310b3009060355040613025541310f300d06035504081306526164697573310d300b060355040713044b69657631133011060355040a130a53756d697820496e632e311c301a06092a864886f70d010901160d6161654073756d69782e636f6d312430220603550403131b53756d697820436572746966696361746520417574686f72697479301e170d3134313030333039353734355a170d3134313230323039353734355a3074310b3009060355040613025541310f300d0603550408130652616469757331133011060355040a130a53756d697820496e632e3121301f0603550403131853756d697820536572766572204365727469666963617465311c301a06092a864886f70d010901160d6161654073756d69782e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100a653008d510c3ae6faa5cae07b04988d706e8b3cbafb56659636501675bef7639fea37e28e140689aca254f066197b8
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xb955db71b857ce9f198457e8e66f50f6
(1) Finished request
Waking up in 0.2 seconds.
Received Access-Request Id 179 from 127.0.0.1:53526 to 127.0.0.1:1812
length 158
User-Name = 'stu at sumix.com'
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-Port = 72
NAS-Port-Id = 'rw-eap'
NAS-IP-Address = 10.20.9.12
Called-Station-Id = '10.20.9.12[4500]'
Calling-Station-Id = '10.20.9.8[4500]'
EAP-Message = 0x020200061500
NAS-Identifier = 'strongSwan'
State = 0xb955db71b857ce9f198457e8e66f50f6
Message-Authenticator = 0xd836132a96421a71b12b25b882f44065
(2) Received Access-Request packet from host 127.0.0.1 port 53526,
id=179, length=158
(2) User-Name = 'stu at sumix.com'
(2) NAS-Port-Type = Virtual
(2) Service-Type = Framed-User
(2) NAS-Port = 72
(2) NAS-Port-Id = 'rw-eap'
(2) NAS-IP-Address = 10.20.9.12
(2) Called-Station-Id = '10.20.9.12[4500]'
(2) Calling-Station-Id = '10.20.9.8[4500]'
(2) EAP-Message = 0x020200061500
(2) NAS-Identifier = 'strongSwan'
(2) State = 0xb955db71b857ce9f198457e8e66f50f6
(2) Message-Authenticator = 0xd836132a96421a71b12b25b882f44065
(2) # Executing section authorize from file /etc/raddb/sites-enabled/default
(2) authorize {
(2) suffix : Checking for suffix after "@"
(2) suffix : Looking up realm "sumix.com" for User-Name = "stu at sumix.com"
(2) suffix : Found realm "sumix.com"
(2) suffix : Adding Stripped-User-Name = "stu"
(2) suffix : Adding Realm = "sumix.com"
(2) suffix : Authentication realm is LOCAL
(2) [suffix] = ok
(2) eap : Peer sent code Response (2) ID 2 length 6
(2) eap : Continuing tunnel setup
(2) [eap] = ok
(2) } # authorize = ok
(2) Found Auth-Type = EAP
(2) # Executing group from file /etc/raddb/sites-enabled/default
(2) authenticate {
(2) eap : Expiring EAP session with state 0xb955db71b857ce9f
(2) eap : Finished EAP session with state 0xb955db71b857ce9f
(2) eap : Previous EAP request found for state 0xb955db71b857ce9f,
released from the list
(2) eap : Peer sent method TTLS (21)
(2) eap : EAP TTLS (21)
(2) eap : Calling eap_ttls to process EAP data
(2) eap_ttls : Authenticate
(2) eap_ttls : processing EAP-TLS
(2) eap_ttls : Received TLS ACK
(2) eap_ttls : Received TLS ACK
(2) eap_ttls : ACK handshake fragment handler
(2) eap_ttls : eaptls_verify returned 1
(2) eap_ttls : eaptls_process returned 13
(2) eap : New EAP session, adding 'State' attribute to reply
0xb955db71bb56ce9f
(2) [eap] = handled
(2) } # authenticate = handled
(2) Sending Access-Challenge packet to host 127.0.0.1 port 53526,
id=179, length=0
(2) EAP-Message =
0x0103026a158000000642a317ffccd0776df5b7990707c6d71d5e030585c85de43d46b15139605c315ea7cf2ca3022e854a0bbb38dd9539c81dccb967b27a8e84bb0f21e80ce6ec67dd3ce528ac4044160301020d0c0002090080cc92e713074cdd998fce384c110ab6cf8d0ec5073be9131aaae92c6999d1ab5798081c90c3d16d5fc8c26ab41df81d579b89f90490f677c682316e55ff727c41155071985ba46207506faeef575064dc075d40848087a92ff39cb130829cd918ed7c1db61a5b7340b218e50859d8139cbc177b15584096baaaf6ed3154cc716b0001020080a01ca6515cfdffd22e3dca3c806c8a7efb59fd0a9572c5edd89fc49a8857d876d04789f5c735b02b544341ff15cb5a2ddbd1758071c0457fcba7ccd8dad4aeb09c9c913dbe760d40b8dc2672f4ccea49e4445c5a934da63e279778a1c301bbbaf6414e1f9bde5a410e7f6b0b589b2c3bdce079d2eb6b00aa30b7e82fe36c3ec8010057d203bb32ac0231e9e2fc97d90c8ba0a9887074b20ef7e6f24647b2a759d1e11d2d25df6e737bd29fd37f8b260231c214e0de64da92a03eca99c1f40403f0e062cf99ec25ab20a41f7449e49e1ce50fc5685471e3429ec315375556766ff304f01f1f884925e6e4b2036dd56a3a0ca35bd89f4a87d6b4da6c0f74198413e92eee6f4625a8f69d80176bd9dcfc33016a20c920a646e8
(2) Message-Authenticator = 0x00000000000000000000000000000000
(2) State = 0xb955db71bb56ce9f198457e8e66f50f6
Sending Access-Challenge Id 179 from 127.0.0.1:1812 to 127.0.0.1:53526
EAP-Message =
0x0103026a158000000642a317ffccd0776df5b7990707c6d71d5e030585c85de43d46b15139605c315ea7cf2ca3022e854a0bbb38dd9539c81dccb967b27a8e84bb0f21e80ce6ec67dd3ce528ac4044160301020d0c0002090080cc92e713074cdd998fce384c110ab6cf8d0ec5073be9131aaae92c6999d1ab5798081c90c3d16d5fc8c26ab41df81d579b89f90490f677c682316e55ff727c41155071985ba46207506faeef575064dc075d40848087a92ff39cb130829cd918ed7c1db61a5b7340b218e50859d8139cbc177b15584096baaaf6ed3154cc716b0001020080a01ca6515cfdffd22e3dca3c806c8a7efb59fd0a9572c5edd89fc49a8857d876d04789f5c735b02b544341ff15cb5a2ddbd1758071c0457fcba7ccd8dad4aeb09c9c913dbe760d40b8dc2672f4ccea49e4445c5a934da63e279778a1c301bbbaf6414e1f9bde5a410e7f6b0b589b2c3bdce079d2eb6b00aa30b7e82fe36c3ec8010057d203bb32ac0231e9e2fc97d90c8ba0a9887074b20ef7e6f24647b2a759d1e11d2d25df6e737bd29fd37f8b260231c214e0de64da92a03eca99c1f40403f0e062cf99ec25ab20a41f7449e49e1ce50fc5685471e3429ec315375556766ff304f01f1f884925e6e4b2036dd56a3a0ca35bd89f4a87d6b4da6c0f74198413e92eee6f4625a8f69d80176bd9dcfc33016a20c920a646e
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xb955db71bb56ce9f198457e8e66f50f6
(2) Finished request
Waking up in 0.2 seconds.
Received Access-Request Id 180 from 127.0.0.1:53526 to 127.0.0.1:1812
length 360
User-Name = 'stu at sumix.com'
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-Port = 72
NAS-Port-Id = 'rw-eap'
NAS-IP-Address = 10.20.9.12
Called-Station-Id = '10.20.9.12[4500]'
Calling-Station-Id = '10.20.9.8[4500]'
EAP-Message =
0x020300d01580000000c616030100861000008200801bbd376230baee45d7adf7ef3b8ff4125a18d8f43e3df9de7f0ecc721f3e5edb817b914d9df8d8225faa5d48c9374ed312c267b3f7be35eeead2379c94dbb5783f9067c38c65ea0b7dcaea5ca15004d65f250e9b2931f247c5980f2af6e6456845a498faa147e5783de8ae82cde42a1e266223e12fff018148473e323cd7d11114030100010116030100301a532b83c967341b29452202cc5e22a8883f2b8edb7fa17866f93bef78f59a27378085cdb4ba9f10b16a831f9d6451e2
NAS-Identifier = 'strongSwan'
State = 0xb955db71bb56ce9f198457e8e66f50f6
Message-Authenticator = 0x4ca4d4427eb4a0f4fa21d953d65b6490
(3) Received Access-Request packet from host 127.0.0.1 port 53526,
id=180, length=360
(3) User-Name = 'stu at sumix.com'
(3) NAS-Port-Type = Virtual
(3) Service-Type = Framed-User
(3) NAS-Port = 72
(3) NAS-Port-Id = 'rw-eap'
(3) NAS-IP-Address = 10.20.9.12
(3) Called-Station-Id = '10.20.9.12[4500]'
(3) Calling-Station-Id = '10.20.9.8[4500]'
(3) EAP-Message =
0x020300d01580000000c616030100861000008200801bbd376230baee45d7adf7ef3b8ff4125a18d8f43e3df9de7f0ecc721f3e5edb817b914d9df8d8225faa5d48c9374ed312c267b3f7be35eeead2379c94dbb5783f9067c38c65ea0b7dcaea5ca15004d65f250e9b2931f247c5980f2af6e6456845a498faa147e5783de8ae82cde42a1e266223e12fff018148473e323cd7d11114030100010116030100301a532b83c967341b29452202cc5e22a8883f2b8edb7fa17866f93bef78f59a27378085cdb4ba9f10b16a831f9d6451e2
(3) NAS-Identifier = 'strongSwan'
(3) State = 0xb955db71bb56ce9f198457e8e66f50f6
(3) Message-Authenticator = 0x4ca4d4427eb4a0f4fa21d953d65b6490
(3) # Executing section authorize from file /etc/raddb/sites-enabled/default
(3) authorize {
(3) suffix : Checking for suffix after "@"
(3) suffix : Looking up realm "sumix.com" for User-Name = "stu at sumix.com"
(3) suffix : Found realm "sumix.com"
(3) suffix : Adding Stripped-User-Name = "stu"
(3) suffix : Adding Realm = "sumix.com"
(3) suffix : Authentication realm is LOCAL
(3) [suffix] = ok
(3) eap : Peer sent code Response (2) ID 3 length 208
(3) eap : Continuing tunnel setup
(3) [eap] = ok
(3) } # authorize = ok
(3) Found Auth-Type = EAP
(3) # Executing group from file /etc/raddb/sites-enabled/default
(3) authenticate {
(3) eap : Expiring EAP session with state 0xb955db71bb56ce9f
(3) eap : Finished EAP session with state 0xb955db71bb56ce9f
(3) eap : Previous EAP request found for state 0xb955db71bb56ce9f,
released from the list
(3) eap : Peer sent method TTLS (21)
(3) eap : EAP TTLS (21)
(3) eap : Calling eap_ttls to process EAP data
(3) eap_ttls : Authenticate
(3) eap_ttls : processing EAP-TLS
TLS Length 198
(3) eap_ttls : Length Included
(3) eap_ttls : eaptls_verify returned 11
(3) eap_ttls : <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange
(3) eap_ttls : TLS_accept: SSLv3 read client key exchange A
(3) eap_ttls : <<< TLS 1.0 ChangeCipherSpec [length 0001]
(3) eap_ttls : <<< TLS 1.0 Handshake [length 0010], Finished
(3) eap_ttls : TLS_accept: SSLv3 read finished A
(3) eap_ttls : >>> TLS 1.0 ChangeCipherSpec [length 0001]
(3) eap_ttls : TLS_accept: SSLv3 write change cipher spec A
(3) eap_ttls : >>> TLS 1.0 Handshake [length 0010], Finished
(3) eap_ttls : TLS_accept: SSLv3 write finished A
(3) eap_ttls : TLS_accept: SSLv3 flush data
SSL: adding session
ca08d8b5178eaffc349e3972b298a27b98df16b1832e503c5390ab0d4f712a66 to cache
(3) eap_ttls : (other): SSL negotiation finished successfully
SSL Connection Established
(3) eap_ttls : eaptls_process returned 13
(3) eap : New EAP session, adding 'State' attribute to reply
0xb955db71ba51ce9f
(3) [eap] = handled
(3) } # authenticate = handled
(3) Sending Access-Challenge packet to host 127.0.0.1 port 53526,
id=180, length=0
(3) EAP-Message =
0x0104004515800000003b1403010001011603010030605b0355d43aa174d8372a38a8f8fbe4e1cc4a1c76f985aa4c1a733db1cbe6fe7049a1836fc4f4ca7a979b6bcf33d46f
(3) Message-Authenticator = 0x00000000000000000000000000000000
(3) State = 0xb955db71ba51ce9f198457e8e66f50f6
Sending Access-Challenge Id 180 from 127.0.0.1:1812 to 127.0.0.1:53526
EAP-Message =
0x0104004515800000003b1403010001011603010030605b0355d43aa174d8372a38a8f8fbe4e1cc4a1c76f985aa4c1a733db1cbe6fe7049a1836fc4f4ca7a979b6bcf33d46f
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xb955db71ba51ce9f198457e8e66f50f6
(3) Finished request
Waking up in 0.2 seconds.
Received Access-Request Id 181 from 127.0.0.1:53526 to 127.0.0.1:1812
length 231
User-Name = 'stu at sumix.com'
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-Port = 72
NAS-Port-Id = 'rw-eap'
NAS-IP-Address = 10.20.9.12
Called-Station-Id = '10.20.9.12[4500]'
Calling-Station-Id = '10.20.9.8[4500]'
EAP-Message =
0x0204004f15800000004517030100405cd863f406852d3aa4401fc49c497b6ea8a891fbea3b414c2c879efa53a1f75168988f9d8fe07378a162dff2b94b19d09e6341226d0e9eb418fff84f52bc0695
NAS-Identifier = 'strongSwan'
State = 0xb955db71ba51ce9f198457e8e66f50f6
Message-Authenticator = 0xceec60943d84e141d8ac64ac4fff3ab3
(4) Received Access-Request packet from host 127.0.0.1 port 53526,
id=181, length=231
(4) User-Name = 'stu at sumix.com'
(4) NAS-Port-Type = Virtual
(4) Service-Type = Framed-User
(4) NAS-Port = 72
(4) NAS-Port-Id = 'rw-eap'
(4) NAS-IP-Address = 10.20.9.12
(4) Called-Station-Id = '10.20.9.12[4500]'
(4) Calling-Station-Id = '10.20.9.8[4500]'
(4) EAP-Message =
0x0204004f15800000004517030100405cd863f406852d3aa4401fc49c497b6ea8a891fbea3b414c2c879efa53a1f75168988f9d8fe07378a162dff2b94b19d09e6341226d0e9eb418fff84f52bc0695
(4) NAS-Identifier = 'strongSwan'
(4) State = 0xb955db71ba51ce9f198457e8e66f50f6
(4) Message-Authenticator = 0xceec60943d84e141d8ac64ac4fff3ab3
(4) # Executing section authorize from file /etc/raddb/sites-enabled/default
(4) authorize {
(4) suffix : Checking for suffix after "@"
(4) suffix : Looking up realm "sumix.com" for User-Name = "stu at sumix.com"
(4) suffix : Found realm "sumix.com"
(4) suffix : Adding Stripped-User-Name = "stu"
(4) suffix : Adding Realm = "sumix.com"
(4) suffix : Authentication realm is LOCAL
(4) [suffix] = ok
(4) eap : Peer sent code Response (2) ID 4 length 79
(4) eap : Continuing tunnel setup
(4) [eap] = ok
(4) } # authorize = ok
(4) Found Auth-Type = EAP
(4) # Executing group from file /etc/raddb/sites-enabled/default
(4) authenticate {
(4) eap : Expiring EAP session with state 0xb955db71ba51ce9f
(4) eap : Finished EAP session with state 0xb955db71ba51ce9f
(4) eap : Previous EAP request found for state 0xb955db71ba51ce9f,
released from the list
(4) eap : Peer sent method TTLS (21)
(4) eap : EAP TTLS (21)
(4) eap : Calling eap_ttls to process EAP data
(4) eap_ttls : Authenticate
(4) eap_ttls : processing EAP-TLS
TLS Length 69
(4) eap_ttls : Length Included
(4) eap_ttls : eaptls_verify returned 11
(4) eap_ttls : eaptls_process returned 7
(4) eap_ttls : Session established. Proceeding to decode tunneled
attributes
(4) eap_ttls : Got tunneled request
EAP-Message = 0x02000012017374754073756d69782e636f6d
(4) eap_ttls : Got tunneled identity of stu at sumix.com
(4) eap_ttls : Setting default EAP type for tunneled EAP session
(4) eap_ttls : Sending tunneled request
(4) server inner-tunnel {
(4) Request:
EAP-Message = 0x02000012017374754073756d69782e636f6d
User-Name = 'stu at sumix.com'
(4) # Executing section authorize from file
/etc/raddb/sites-enabled/inner-tunnel
(4) authorize {
(4) eap : Peer sent code Response (2) ID 0 length 18
(4) eap : EAP-Identity reply, returning 'ok' so we can short-circuit
the rest of authorize
(4) [eap] = ok
(4) } # authorize = ok
(4) Found Auth-Type = EAP
(4) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
(4) authenticate {
(4) eap : Peer sent method Identity (1)
(4) eap : Calling eap_md5 to process EAP data
(4) eap_md5 : Issuing MD5 Challenge
(4) eap : New EAP session, adding 'State' attribute to reply
0x2a5805682a59014a
(4) [eap] = handled
(4) } # authenticate = handled
(4) Reply:
EAP-Message = 0x0101001604103a78132fcb2897f6a7f85e8f1359a1b8
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x2a5805682a59014a69aedaddefad98a4
(4) } # server inner-tunnel
(4) eap_ttls : Got tunneled Access-Challenge
(4) eap : New EAP session, adding 'State' attribute to reply
0xb955db71bd50ce9f
(4) [eap] = handled
(4) } # authenticate = handled
(4) Sending Access-Challenge packet to host 127.0.0.1 port 53526,
id=181, length=0
(4) EAP-Message =
0x0105004f1580000000451703010040390c24d5904b15b8b2b9c01c1b1294a8fec8aebf4f28fccd133148d410760a463a5e11077227b057c6619935cd9f9e9dcc8209f4432c7c5f1518c8f83dc9f4b5
(4) Message-Authenticator = 0x00000000000000000000000000000000
(4) State = 0xb955db71bd50ce9f198457e8e66f50f6
Sending Access-Challenge Id 181 from 127.0.0.1:1812 to 127.0.0.1:53526
EAP-Message =
0x0105004f1580000000451703010040390c24d5904b15b8b2b9c01c1b1294a8fec8aebf4f28fccd133148d410760a463a5e11077227b057c6619935cd9f9e9dcc8209f4432c7c5f1518c8f83dc9f4b5
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xb955db71bd50ce9f198457e8e66f50f6
(4) Finished request
Waking up in 0.2 seconds.
Received Access-Request Id 182 from 127.0.0.1:53526 to 127.0.0.1:1812
length 231
User-Name = 'stu at sumix.com'
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-Port = 72
NAS-Port-Id = 'rw-eap'
NAS-IP-Address = 10.20.9.12
Called-Station-Id = '10.20.9.12[4500]'
Calling-Station-Id = '10.20.9.8[4500]'
EAP-Message =
0x0205004f15800000004517030100405b5acf43e5169c4f2cd97dd4dd54f7e1ba4f1280bb26034f493c6163b40ced9f291017cd305a9ca6a0725b19f534da7f64d243cb9ab6eac01f8a0de9cc179f5d
NAS-Identifier = 'strongSwan'
State = 0xb955db71bd50ce9f198457e8e66f50f6
Message-Authenticator = 0x6c6eafc5e75ae5bb67174d8f0c14c948
(5) Received Access-Request packet from host 127.0.0.1 port 53526,
id=182, length=231
(5) User-Name = 'stu at sumix.com'
(5) NAS-Port-Type = Virtual
(5) Service-Type = Framed-User
(5) NAS-Port = 72
(5) NAS-Port-Id = 'rw-eap'
(5) NAS-IP-Address = 10.20.9.12
(5) Called-Station-Id = '10.20.9.12[4500]'
(5) Calling-Station-Id = '10.20.9.8[4500]'
(5) EAP-Message =
0x0205004f15800000004517030100405b5acf43e5169c4f2cd97dd4dd54f7e1ba4f1280bb26034f493c6163b40ced9f291017cd305a9ca6a0725b19f534da7f64d243cb9ab6eac01f8a0de9cc179f5d
(5) NAS-Identifier = 'strongSwan'
(5) State = 0xb955db71bd50ce9f198457e8e66f50f6
(5) Message-Authenticator = 0x6c6eafc5e75ae5bb67174d8f0c14c948
(5) # Executing section authorize from file /etc/raddb/sites-enabled/default
(5) authorize {
(5) suffix : Checking for suffix after "@"
(5) suffix : Looking up realm "sumix.com" for User-Name = "stu at sumix.com"
(5) suffix : Found realm "sumix.com"
(5) suffix : Adding Stripped-User-Name = "stu"
(5) suffix : Adding Realm = "sumix.com"
(5) suffix : Authentication realm is LOCAL
(5) [suffix] = ok
(5) eap : Peer sent code Response (2) ID 5 length 79
(5) eap : Continuing tunnel setup
(5) [eap] = ok
(5) } # authorize = ok
(5) Found Auth-Type = EAP
(5) # Executing group from file /etc/raddb/sites-enabled/default
(5) authenticate {
(5) eap : Expiring EAP session with state 0x2a5805682a59014a
(5) eap : Finished EAP session with state 0xb955db71bd50ce9f
(5) eap : Previous EAP request found for state 0xb955db71bd50ce9f,
released from the list
(5) eap : Peer sent method TTLS (21)
(5) eap : EAP TTLS (21)
(5) eap : Calling eap_ttls to process EAP data
(5) eap_ttls : Authenticate
(5) eap_ttls : processing EAP-TLS
TLS Length 69
(5) eap_ttls : Length Included
(5) eap_ttls : eaptls_verify returned 11
(5) eap_ttls : eaptls_process returned 7
(5) eap_ttls : Session established. Proceeding to decode tunneled
attributes
(5) eap_ttls : Got tunneled request
EAP-Message = 0x02010016041074f572db9bcb6f7cc2084efc64d87351
(5) eap_ttls : Sending tunneled request
(5) server inner-tunnel {
(5) Request:
EAP-Message = 0x02010016041074f572db9bcb6f7cc2084efc64d87351
User-Name = 'stu at sumix.com'
State = 0x2a5805682a59014a69aedaddefad98a4
(5) # Executing section authorize from file
/etc/raddb/sites-enabled/inner-tunnel
(5) authorize {
(5) eap : Peer sent code Response (2) ID 1 length 22
(5) eap : No EAP Start, assuming it's an on-going EAP conversation
(5) [eap] = updated
(5) [files] = noop
(5) } # authorize = updated
(5) Found Auth-Type = EAP
(5) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
(5) authenticate {
(5) eap : Expiring EAP session with state 0x2a5805682a59014a
(5) eap : Finished EAP session with state 0x2a5805682a59014a
(5) eap : Previous EAP request found for state 0x2a5805682a59014a,
released from the list
(5) eap : Peer sent method MD5 (4)
(5) eap : EAP MD5 (4)
(5) eap : Calling eap_md5 to process EAP data
(5) eap_md5 : Cleartext-Password is required for EAP-MD5 authentication
(5) ERROR: eap : Failed continuing EAP MD5 (4) session. EAP sub-module
failed
(5) eap : Failed in EAP select
(5) [eap] = invalid
(5) } # authenticate = invalid
(5) Failed to authenticate the user
(5) Login incorrect (eap: Failed continuing EAP MD5 (4) session. EAP
sub-module failed): [stu at sumix.com/<via Auth-Type = EAP>] (from client
aae-vm port 0 via TLS tunnel)
(5) Using Post-Auth-Type Reject
(5) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
(5) Post-Auth-Type REJECT {
(5) attr_filter.access_reject : EXPAND %{User-Name}
(5) attr_filter.access_reject : --> stu at sumix.com
(5) attr_filter.access_reject : Matched entry DEFAULT at line 11
(5) [attr_filter.access_reject] = updated
(5) } # Post-Auth-Type REJECT = updated
(5) Reply:
EAP-Message = 0x04010004
Message-Authenticator = 0x00000000000000000000000000000000
(5) } # server inner-tunnel
(5) eap_ttls : Got tunneled Access-Reject
SSL: Removing session
ca08d8b5178eaffc349e3972b298a27b98df16b1832e503c5390ab0d4f712a66 from
the cache
(5) ERROR: eap : Failed continuing EAP TTLS (21) session. EAP
sub-module failed
(5) eap : Failed in EAP select
(5) [eap] = invalid
(5) } # authenticate = invalid
(5) Failed to authenticate the user
(5) Login incorrect (eap: Failed continuing EAP TTLS (21) session. EAP
sub-module failed): [stu at sumix.com/<via Auth-Type = EAP>] (from client
aae-vm port 72 cli 10.20.9.8[4500])
(5) Using Post-Auth-Type Reject
(5) # Executing group from file /etc/raddb/sites-enabled/default
(5) Post-Auth-Type REJECT {
(5) attr_filter.access_reject : EXPAND %{User-Name}
(5) attr_filter.access_reject : --> stu at sumix.com
(5) attr_filter.access_reject : Matched entry DEFAULT at line 11
(5) [attr_filter.access_reject] = updated
(5) } # Post-Auth-Type REJECT = updated
(5) Delaying response for 1 seconds
Waking up in 0.2 seconds.
Waking up in 0.6 seconds.
(5) Sending delayed response
(5) Sending Access-Reject packet to host 127.0.0.1 port 53526, id=182,
length=0
(5) EAP-Message = 0x04050004
(5) Message-Authenticator = 0x00000000000000000000000000000000
Sending Access-Reject Id 182 from 127.0.0.1:1812 to 127.0.0.1:53526
EAP-Message = 0x04050004
Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 177 with timestamp +7
(1) Cleaning up request packet ID 178 with timestamp +7
(2) Cleaning up request packet ID 179 with timestamp +7
(3) Cleaning up request packet ID 180 with timestamp +7
(4) Cleaning up request packet ID 181 with timestamp +7
(5) Cleaning up request packet ID 182 with timestamp +7
Ready to process requests
/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20141008/c870e484/attachment-0001.html>
More information about the Freeradius-Users
mailing list