On Sat, Feb 11, 2012 at 3:23 PM, Matthew Newton <m...@leicester.ac.uk> wrote:
> update control {
> Auth-Type := 'pam'
> }
Thanks! When I run rad-test it successfully returns Access-Accept.
I'm not able to authenticate my client. I'm trying to use EAP-GTC on
the inner-tunnel. I realize this isn't a very scalable configuration,
but for my small network I would like to have the passwords in one
place and ldap or a an sql database are over kill. I had this
configuration working before and foolishly deleted the config. I
haven't made any changes to the client.
Here is the radiusd -X output:
FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Feb
11 2012 at 09:59:42
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License v2.
Starting - reading configuration files ...
including configuration file /etc/raddb/radiusd.conf
including configuration file /etc/raddb/proxy.conf
including configuration file /etc/raddb/clients.conf
including files in directory /etc/raddb/modules/
including configuration file /etc/raddb/modules/pap
including configuration file /etc/raddb/modules/smsotp
including configuration file /etc/raddb/modules/soh
including configuration file /etc/raddb/modules/attr_filter
including configuration file /etc/raddb/modules/opendirectory
including configuration file /etc/raddb/modules/inner-eap
including configuration file /etc/raddb/modules/passwd
including configuration file /etc/raddb/modules/otp
including configuration file /etc/raddb/modules/attr_rewrite
including configuration file /etc/raddb/modules/counter
including configuration file /etc/raddb/modules/expr
including configuration file /etc/raddb/modules/expiration
including configuration file /etc/raddb/modules/sradutmp
including configuration file /etc/raddb/modules/realm
including configuration file /etc/raddb/modules/mac2vlan
including configuration file /etc/raddb/modules/rediswho
including configuration file /etc/raddb/modules/etc_group
including configuration file /etc/raddb/modules/always
including configuration file /etc/raddb/modules/wimax
including configuration file /etc/raddb/modules/detail.log
including configuration file /etc/raddb/modules/redis
including configuration file /etc/raddb/modules/pam
including configuration file /etc/raddb/modules/digest
including configuration file /etc/raddb/modules/files
including configuration file /etc/raddb/modules/preprocess
including configuration file /etc/raddb/modules/detail.example.com
including configuration file /etc/raddb/modules/radutmp
including configuration file /etc/raddb/modules/ldap
including configuration file /etc/raddb/modules/perl
including configuration file /etc/raddb/modules/replicate
including configuration file /etc/raddb/modules/sql_log
including configuration file /etc/raddb/modules/exec
including configuration file /etc/raddb/modules/krb5
including configuration file /etc/raddb/modules/acct_unique
including configuration file /etc/raddb/modules/sqlcounter_expire_on_login
including configuration file /etc/raddb/modules/mschap
including configuration file /etc/raddb/modules/ntlm_auth
including configuration file /etc/raddb/modules/checkval
including configuration file /etc/raddb/modules/dynamic_clients
including configuration file /etc/raddb/modules/detail
including configuration file /etc/raddb/modules/chap
including configuration file /etc/raddb/modules/cui
including configuration file /etc/raddb/modules/policy
including configuration file /etc/raddb/modules/mac2ip
including configuration file /etc/raddb/modules/unix
including configuration file /etc/raddb/modules/smbpasswd
including configuration file /etc/raddb/modules/ippool
including configuration file /etc/raddb/modules/echo
including configuration file /etc/raddb/modules/logintime
including configuration file /etc/raddb/modules/linelog
including configuration file /etc/raddb/eap.conf
including configuration file /etc/raddb/policy.conf
including files in directory /etc/raddb/sites-enabled/
including configuration file /etc/raddb/sites-enabled/default
including configuration file /etc/raddb/sites-enabled/control-socket
including configuration file /etc/raddb/sites-enabled/inner-tunnel
main {
allow_core_dumps = no
}
including dictionary file /etc/raddb/dictionary
main {
name = "radiusd"
prefix = "/usr"
localstatedir = "/var"
sbindir = "/usr/sbin"
logdir = "/var/log/radius"
run_dir = "/var/run/radiusd"
libdir = "/usr/lib64/freeradius"
radacctdir = "/var/log/radius/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
pidfile = "/var/run/radiusd/radiusd.pid"
checkrad = "/usr/sbin/checkrad"
debug_level = 0
proxy_requests = yes
log {
stripped_names = no
auth = yes
auth_badpass = no
auth_goodpass = no
}
security {
max_attributes = 200
reject_delay = 1
status_server = yes
}
}
radiusd: #### Loading Realms and Home Servers ####
proxy server {
retry_delay = 5
retry_count = 3
default_fallback = no
dead_time = 120
wake_all_if_all_dead = no
}
home_server localhost {
ipaddr = 127.0.0.1
port = 1812
type = "auth"
secret = "testing123"
response_window = 20
max_outstanding = 65536
require_message_authenticator = yes
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_interval = 30
num_answers_to_alive = 3
num_pings_to_alive = 3
revive_interval = 120
status_check_timeout = 4
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
home_server_pool my_auth_failover {
type = fail-over
home_server = localhost
}
realm example.com {
auth_pool = my_auth_failover
}
realm LOCAL {
}
radiusd: #### Loading Clients ####
client localhost {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = "testing123"
nastype = "other"
}
client 192.168.1.10 {
require_message_authenticator = no
secret = "cisc0"
shortname = "ciscowap"
}
radiusd: #### Instantiating modules ####
instantiate {
Module: Linked to module rlm_exec
Module: Instantiating module "exec" from file /etc/raddb/modules/exec
exec {
wait = no
input_pairs = "request"
shell_escape = yes
}
Module: Linked to module rlm_expr
Module: Instantiating module "expr" from file /etc/raddb/modules/expr
Module: Linked to module rlm_expiration
Module: Instantiating module "expiration" from file
/etc/raddb/modules/expiration
expiration {
reply-message = "Password Has Expired "
}
Module: Linked to module rlm_logintime
Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime
logintime {
reply-message = "You are calling outside your allowed timespan "
minimum-timeout = 60
}
}
radiusd: #### Loading Virtual Servers ####
server { # from file /etc/raddb/radiusd.conf
modules {
Module: Creating Auth-Type = digest
Module: Creating Post-Auth-Type = REJECT
Module: Checking authenticate {...} for more modules to load
Module: Linked to module rlm_pap
Module: Instantiating module "pap" from file /etc/raddb/modules/pap
pap {
encryption_scheme = "auto"
auto_header = no
}
Module: Linked to module rlm_chap
Module: Instantiating module "chap" from file /etc/raddb/modules/chap
Module: Linked to module rlm_mschap
Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap
mschap {
use_mppe = yes
require_encryption = no
require_strong = no
with_ntdomain_hack = no
allow_retry = yes
}
Module: Linked to module rlm_digest
Module: Instantiating module "digest" from file /etc/raddb/modules/digest
Module: Linked to module rlm_pam
Module: Instantiating module "pam" from file /etc/raddb/modules/pam
pam {
pam_auth = "radiusd"
}
Module: Linked to module rlm_unix
Module: Instantiating module "unix" from file /etc/raddb/modules/unix
unix {
radwtmp = "/var/log/radius/radwtmp"
}
Module: Linked to module rlm_eap
Module: Instantiating module "eap" from file /etc/raddb/eap.conf
eap {
default_eap_type = "md5"
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
max_sessions = 4096
}
Module: Linked to sub-module rlm_eap_md5
Module: Instantiating eap-md5
Module: Linked to sub-module rlm_eap_leap
Module: Instantiating eap-leap
Module: Linked to sub-module rlm_eap_gtc
Module: Instantiating eap-gtc
gtc {
challenge = "Password: "
auth_type = "PAP"
}
Module: Linked to sub-module rlm_eap_tls
Module: Instantiating eap-tls
tls {
rsa_key_exchange = no
dh_key_exchange = yes
rsa_key_length = 512
dh_key_length = 512
verify_depth = 0
CA_path = "/etc/ssl/certs"
pem_file_type = yes
private_key_file = "/etc/raddb/newcerts/server.key"
certificate_file = "/etc/raddb/newcerts/server.crt"
CA_file = "/etc/ssl/certs/ca.pem"
dh_file = "/etc/raddb/newcerts/dh"
random_file = "/dev/urandom"
fragment_size = 1024
include_length = yes
check_crl = no
cipher_list = "DEFAULT"
make_cert_command = "/etc/raddb/newcerts/bootstrap"
ecdh_curve = "prime256v1"
cache {
enable = no
lifetime = 24
max_entries = 255
}
verify {
}
ocsp {
enable = no
override_cert_url = yes
url = "http://127.0.0.1/ocsp/";
}
}
Module: Linked to sub-module rlm_eap_ttls
Module: Instantiating eap-ttls
ttls {
default_eap_type = "md5"
copy_request_to_tunnel = yes
use_tunneled_reply = no
virtual_server = "inner-tunnel"
include_length = yes
}
Module: Linked to sub-module rlm_eap_peap
Module: Instantiating eap-peap
peap {
default_eap_type = "mschapv2"
copy_request_to_tunnel = yes
use_tunneled_reply = no
proxy_tunneled_request_as_eap = yes
virtual_server = "inner-tunnel"
soh = no
}
Module: Linked to sub-module rlm_eap_mschapv2
Module: Instantiating eap-mschapv2
mschapv2 {
with_ntdomain_hack = no
send_error = no
}
Module: Checking authorize {...} for more modules to load
Module: Linked to module rlm_preprocess
Module: Instantiating module "preprocess" from file
/etc/raddb/modules/preprocess
preprocess {
huntgroups = "/etc/raddb/huntgroups"
hints = "/etc/raddb/hints"
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
with_alvarion_vsa_hack = no
}
Module: Linked to module rlm_realm
Module: Instantiating module "suffix" from file /etc/raddb/modules/realm
realm suffix {
format = "suffix"
delimiter = "@"
ignore_default = no
ignore_null = no
}
Module: Linked to module rlm_files
Module: Instantiating module "files" from file /etc/raddb/modules/files
files {
usersfile = "/etc/raddb/users"
acctusersfile = "/etc/raddb/acct_users"
preproxy_usersfile = "/etc/raddb/preproxy_users"
compat = "no"
}
Module: Checking preacct {...} for more modules to load
Module: Linked to module rlm_acct_unique
Module: Instantiating module "acct_unique" from file
/etc/raddb/modules/acct_unique
acct_unique {
key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address,
NAS-Port"
}
Module: Checking accounting {...} for more modules to load
Module: Linked to module rlm_detail
Module: Instantiating module "detail" from file /etc/raddb/modules/detail
detail {
detailfile =
"/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
header = "%t"
detailperm = 384
dirperm = 493
locking = no
log_packet_header = no
}
Module: Linked to module rlm_radutmp
Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp
radutmp {
filename = "/var/log/radius/radutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
perm = 384
callerid = yes
}
Module: Linked to module rlm_attr_filter
Module: Instantiating module "attr_filter.accounting_response" from
file /etc/raddb/modules/attr_filter
attr_filter attr_filter.accounting_response {
attrsfile = "/etc/raddb/attrs.accounting_response"
key = "%{User-Name}"
relaxed = no
}
Module: Checking session {...} for more modules to load
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
Module: Instantiating module "attr_filter.access_reject" from file
/etc/raddb/modules/attr_filter
attr_filter attr_filter.access_reject {
attrsfile = "/etc/raddb/attrs.access_reject"
key = "%{User-Name}"
relaxed = no
}
} # modules
} # server
server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel
modules {
Module: Checking authenticate {...} for more modules to load
Module: Checking authorize {...} for more modules to load
Module: Checking session {...} for more modules to load
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
} # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "auth"
ipaddr = *
port = 0
}
listen {
type = "acct"
ipaddr = *
port = 0
}
listen {
type = "control"
listen {
socket = "/var/run/radiusd/radiusd.sock"
}
}
listen {
type = "auth"
ipaddr = 127.0.0.1
port = 18120
}
... adding new socket proxy address * port 36318
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on command file /var/run/radiusd/radiusd.sock
Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 192.168.1.10 port 2051,
id=159, length=157
User-Name = "anonymous"
NAS-IP-Address = 192.168.1.10
NAS-Port = 0
Called-Station-Id = "00-15-62-FF-ED-25:erehwon"
Calling-Station-Id = "00-21-5C-13-85-23"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
EAP-Message = 0x0200000e01616e6f6e796d6f7573
Message-Authenticator = 0xe29296f7a8b516cff2687763f1912bde
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 0 length 14
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.
Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type md5
rlm_eap_md5: Issuing Challenge
++[eap] returns handled
Sending Access-Challenge of id 159 to 192.168.1.10 port 2051
EAP-Message = 0x0101001604106f11691c586baa605173888d4a2984c5
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8c1fb46c8c1eb01427521e7ce2e2867c
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.1.10 port 2051,
id=160, length=167
User-Name = "anonymous"
NAS-IP-Address = 192.168.1.10
NAS-Port = 0
Called-Station-Id = "00-15-62-FF-ED-25:erehwon"
Calling-Station-Id = "00-21-5C-13-85-23"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
EAP-Message = 0x020100060319
State = 0x8c1fb46c8c1eb01427521e7ce2e2867c
Message-Authenticator = 0x2b61e9656bf72fd2356757d47e2d5e87
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 1 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.
Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP NAK
[eap] EAP-NAK asked for EAP-Type/peap
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 160 to 192.168.1.10 port 2051
EAP-Message = 0x010200061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8c1fb46c8d1dad1427521e7ce2e2867c
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.1.10 port 2051,
id=161, length=379
User-Name = "anonymous"
NAS-IP-Address = 192.168.1.10
NAS-Port = 0
Called-Station-Id = "00-15-62-FF-ED-25:erehwon"
Calling-Station-Id = "00-21-5C-13-85-23"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
EAP-Message =
0x020200da1980000000d016030100cb010000c703014f370260b755e71e997075c93edda6adc2dfe14e809102fe53be01a8771f6c0000005ac014c00a0039003800880087c00fc00500350084c012c00800160013c00dc003000ac013c00900330032009a009900450044c00ec004002f00960041c011c007c00cc002000500040015001200090014001100080006000300ff01000044000b000403000102000a00340032000100020003000400050006000700080009000a000b000c000d000e000f001000110012001300140015001600170018001900230000
State = 0x8c1fb46c8d1dad1427521e7ce2e2867c
Message-Authenticator = 0x44d13283665017985ac0d3bab0cd3b95
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 2 length 218
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
TLS Length 208
[peap] Length Included
[peap] eaptls_verify returned 11
[peap] (other): before/accept initialization
[peap] TLS_accept: before/accept initialization
[peap] <<< TLS 1.0 Handshake [length 00cb], ClientHello
[peap] TLS_accept: SSLv3 read client hello A
[peap] >>> TLS 1.0 Handshake [length 0039], ServerHello
[peap] TLS_accept: SSLv3 write server hello A
[peap] >>> TLS 1.0 Handshake [length 0816], Certificate
[peap] TLS_accept: SSLv3 write certificate A
[peap] >>> TLS 1.0 Handshake [length 024b], ServerKeyExchange
[peap] TLS_accept: SSLv3 write key exchange A
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
[peap] TLS_accept: SSLv3 write server done A
[peap] TLS_accept: SSLv3 flush data
[peap] TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 161 to 192.168.1.10 port 2051
EAP-Message =
0x0103040019c000000ab216030100390200003503014f37021b1531532d7d364f410dcdf3f16d4a6d01700666734d368346701a6d7f00c01400000dff01000100000b00040300010216030108160b00081200080f0004433082043f308203a8a003020102020101300d06092a864886f70d010104050030819d310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a53616372616d656e746f31123010060355040a1309547275656e6f72746831173015060355040b130e4f6e746f6c6f677920446570742e311530130603550403130c747275656e6f7274682e6e753120301e06092a8648
EAP-Message =
0x86f70d01090116116d61726b40747275656e6f7274682e6e75301e170d3131313231353138343830385a170d3132313231343138343830385a30818f310b3009060355040613025553311330110603550408130a43616c69666f726e696131123010060355040a1309547275656e6f72746831173015060355040b130e4f6e746f6c6f677920446570742e311c301a0603550403131373636f6f62792e747275656e6f7274682e6e753120301e06092a864886f70d01090116116d61726b40747275656e6f7274682e6e7530820222300d06092a864886f70d01010105000382020f003082020a0282020100a4e47b9948b29a5735fc98bd61eaa6a02b
EAP-Message =
0xe26f7417463e054adf1132034eadfb92cc53bdd8e3bf4991122be691daef4b9b254f64ffd8b3dbc2bea109b61a2acac2c82019f46201671f920d3446b555dbd4181ed09680cf487c37406d7f5871bac4fdb8bd91994d4442bc9395790f2d0057cff03994221064ce43ab24e2b27c006f2d5f8967914c2e864b72e373557ae84cc00bc99943a41ec9351289393bd2c427cc078373b4b9fff82a0444e38fa7e3ca676a2abc4cea2465616792b057036c311ac3434b390acc26e26a60b41618ef19493b127c244bbb41e3697a1edf68edf87212b7ba0cfd8484bce9c91b6332f32829755c00e8bd4467abdd26d005cf8bbbc5a07c3419d33e4b894993e6c9
EAP-Message =
0x7b58a24a6bb3e66cfa6838a5644d11305aa7aeb6cdb0f7d4289b822172597260f9f0e3d7ba8babf4af9d42554f958e10c53949f85b4d63a9ea709a1904aeb3b76b879f6d3caaff981f169e9d34435d9fff05433b0e6d7c65eb5f6835bb6e79bd7d071d3d11968b034fce991da9e5754da86d485621e3dfc423ad8040e9417b740ad32ca17ecffd15832d3384da43a296ea9ba86c1c64300e8d3615ff010c060fd3c6dc4373443f7c991a52ba333fcd86ec8440312c56b916f726d0648a39870fdf97dd96b4c2d999de5fa4c3a74c797a785865c971cc46aae23a54ecafce1f8684a617f372bfe1c940ace72bcfae2561e4d90203010001a31730153013
EAP-Message = 0x0603551d25040c300a06082b
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8c1fb46c8e1cad1427521e7ce2e2867c
Finished request 2.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.1.10 port 2051,
id=162, length=167
User-Name = "anonymous"
NAS-IP-Address = 192.168.1.10
NAS-Port = 0
Called-Station-Id = "00-15-62-FF-ED-25:erehwon"
Calling-Station-Id = "00-21-5C-13-85-23"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
EAP-Message = 0x020300061900
State = 0x8c1fb46c8e1cad1427521e7ce2e2867c
Message-Authenticator = 0x550138bbf3be98ed4c2875f9965792fb
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 3 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 162 to 192.168.1.10 port 2051
EAP-Message =
0x010403fc194006010505070301300d06092a864886f70d010104050003818100309f062ea206c657c94462bd8854f3e77c0ef934f172d386f6fc347a7e7d13e39d34f640728ed85c926d848885028166d153283c6d1187328958f13f3b27c0ced2f1aa20a7c8e6bfb21efd84c88e16b9a7c3efe541ccce4eb6c4917819ff123a3afb816beebc3017459633d6fd2798837f094d55c020f51708cedf2dec09760a0003c6308203c23082032ba003020102020900822c4ccb1bc10a34300d06092a864886f70d010105050030819d310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a536163
EAP-Message =
0x72616d656e746f31123010060355040a1309547275656e6f72746831173015060355040b130e4f6e746f6c6f677920446570742e311530130603550403130c747275656e6f7274682e6e753120301e06092a864886f70d01090116116d61726b40747275656e6f7274682e6e75301e170d3131313231353138333232335a170d3134303931303138333232335a30819d310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a53616372616d656e746f31123010060355040a1309547275656e6f72746831173015060355040b130e4f6e746f6c6f677920446570742e311530130603550403
EAP-Message =
0x130c747275656e6f7274682e6e753120301e06092a864886f70d01090116116d61726b40747275656e6f7274682e6e7530819f300d06092a864886f70d010101050003818d0030818902818100f76b2970c7057629f9940bc19df56923f5f7cb40cd17558db8583d3b0b35c9af286f0e38f0190700c8125492c866e305cb60f323ca93aeb44e9e307780ecde93150430a3f4a7735242df14666fb42641557204136c9d113c32f63987c0fa473b06f70b15b8575e713ceaddbe5e5c19a9b1c80bdf9404b3c83a018ecaac25ca230203010001a382010630820102301d0603551d0e04160414a5b7cb574f2042622dbad243f15b09cadcfb29493081d206
EAP-Message =
0x03551d230481ca3081c78014a5b7cb574f2042622dbad243f15b09cadcfb2949a181a3a481a030819d310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a53616372616d656e746f31123010060355040a1309547275656e6f72746831173015060355040b130e4f6e746f6c6f677920446570742e311530130603550403130c747275656e6f7274682e6e753120301e06092a864886f70d01090116116d61726b40747275656e6f7274682e6e75820900822c4ccb1bc10a34300c0603551d13040530030101ff300d06092a864886f70d0101050500038181009bbb7f4e875d72c95dc3d6
EAP-Message = 0xdaa1169ceddfe7ce
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8c1fb46c8f1bad1427521e7ce2e2867c
Finished request 3.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.1.10 port 2051,
id=163, length=167
User-Name = "anonymous"
NAS-IP-Address = 192.168.1.10
NAS-Port = 0
Called-Station-Id = "00-15-62-FF-ED-25:erehwon"
Calling-Station-Id = "00-21-5C-13-85-23"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
EAP-Message = 0x020400061900
State = 0x8c1fb46c8f1bad1427521e7ce2e2867c
Message-Authenticator = 0x7369b3171c0dca7bc23bbb6c71e0b7d9
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 4 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 163 to 192.168.1.10 port 2051
EAP-Message =
0x010502cc19004293f30ee80dbd50d30acb0c02b184042d79653c6b42af4bc67fe6743d6a589ba1de6bda9f6c0321c55da25402df0399041011f5591482403fd5f022bdce1e6ebe6c881487f0da72f150c789f981fb03cdf708e999b785429307508393c82253b1a1ad64f58fcde0c6ddf38ffb160301024b0c0002470300174104e53e744000c6a25bc0029b7ae8d8cbfbf04510633893c37e0a537cfa292279d8bcaac37b076ef44f187f5c3f1d024a53e51c3948079ecd77c439983c9b999ee8020090e0fc166efbea22b51377ded2649c25d84771ab26fc94a7f975ddb99dba035541363f5b7f1e85a27000ed06d7e2ee9e7f662e7707341f62b07c
EAP-Message =
0x2dd96d18b3bab0e8287df2c4065856dca3209eb61d79bbf49f45d9bc125b08b63c316a3366a19f2a6e9564f09c7154893fcf75d3c01ce5c24a2f53eff7de15f9c2487b655b3a15a1d4f2eb6500810e51460f43013c82279ee9462880372ec941596249b17267de944ea628af6864f5fc13713e35c1e43d60e079d7b16883823a55aa49296eb19cfe540d561244b69cfeb68640f25542a909f19d3177e86bfb07e28527663903b978e062e9bb8f8fdccb2da121220507a7792aa8a5c226011039dc5bd57da169409ca9d54cec4da3968988968d143565a920eb6922b141c50f81c3df1645a572b68e73891f3c3401e3be522775e7c5b5875f7dc2a8017a
EAP-Message =
0x5896bf8287249d5dc199f32246e471a4414a2b0c5c04d535b1ddc3dca2de3d561d0021d0ed9bf833d31c0fa002c00cc7e8d558abcb69c6579a2013a103697e13c76e2abb629928be3490c1d03bc9057963f246ad2dedb3064924fc0f7d3752ee3fd85f871c303e89549283a24d7e42c37131b08bd0d1c221a5e043a26987b93672151881f65cd667e18075f58f8d9e6f1ca1f8e918887a5fb6df4b470d40dd787f9656943393609ce6eef56172bb6b1820fe306fd8d66f6def917c2316347d012306471c686750292916030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8c1fb46c881aad1427521e7ce2e2867c
Finished request 4.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.1.10 port 2051,
id=164, length=305
User-Name = "anonymous"
NAS-IP-Address = 192.168.1.10
NAS-Port = 0
Called-Station-Id = "00-15-62-FF-ED-25:erehwon"
Calling-Station-Id = "00-21-5C-13-85-23"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
EAP-Message =
0x0205009019800000008616030100461000004241044ef5f6bbedc6a514e779b94a6a06bd797b466dc7b8bc7b63134f3f50ced214af802b0fe76a08c1778c50641725f596bd62bc317b17ad3e9001f969f6a72c9ce81403010001011603010030b7dfede4e43fdbc4d2e077fa3d10b5fbf060c3ce60b1c5a521ac09d14d849391439018582df6d3be139ba29017ee25fc
State = 0x8c1fb46c881aad1427521e7ce2e2867c
Message-Authenticator = 0x59d9940812d16043faa58933e90702a3
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 5 length 144
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
TLS Length 134
[peap] Length Included
[peap] eaptls_verify returned 11
[peap] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange
[peap] TLS_accept: SSLv3 read client key exchange A
[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001]
[peap] <<< TLS 1.0 Handshake [length 0010], Finished
[peap] TLS_accept: SSLv3 read finished A
[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001]
[peap] TLS_accept: SSLv3 write change cipher spec A
[peap] >>> TLS 1.0 Handshake [length 0010], Finished
[peap] TLS_accept: SSLv3 write finished A
[peap] TLS_accept: SSLv3 flush data
[peap] (other): SSL negotiation finished successfully
SSL Connection Established
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 164 to 192.168.1.10 port 2051
EAP-Message =
0x0106004119001403010001011603010030b73a3cdb0e01bab3efb71eb8e2093c80bb8e38cd982046fd4a97266a0f14e83da99280f3940ed46bee5283261a212276
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8c1fb46c8919ad1427521e7ce2e2867c
Finished request 5.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.1.10 port 2051,
id=165, length=167
User-Name = "anonymous"
NAS-IP-Address = 192.168.1.10
NAS-Port = 0
Called-Station-Id = "00-15-62-FF-ED-25:erehwon"
Calling-Station-Id = "00-21-5C-13-85-23"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
EAP-Message = 0x020600061900
State = 0x8c1fb46c8919ad1427521e7ce2e2867c
Message-Authenticator = 0x3f1411b76574e2f86525c70b5ba94f1d
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 6 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake is finished
[peap] eaptls_verify returned 3
[peap] eaptls_process returned 3
[peap] EAPTLS_SUCCESS
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state TUNNEL ESTABLISHED
++[eap] returns handled
Sending Access-Challenge of id 165 to 192.168.1.10 port 2051
EAP-Message =
0x0107002b19001703010020c993d33c5702fd62a7d81d4100f5601ba1588d7565c498aefa245873657febe7
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8c1fb46c8a18ad1427521e7ce2e2867c
Finished request 6.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.1.10 port 2051,
id=166, length=241
User-Name = "anonymous"
NAS-IP-Address = 192.168.1.10
NAS-Port = 0
Called-Station-Id = "00-15-62-FF-ED-25:erehwon"
Calling-Station-Id = "00-21-5C-13-85-23"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
EAP-Message =
0x0207005019001703010020212abdd2e6a9b9cf09e1ae963ac3d95f74b0096e61466b6d9d0c9709accd3781170301002052ca6ca284971d9ed736b40c156b786a462b115cc521cb4ff5cc9b3aaf3ce56c
State = 0x8c1fb46c8a18ad1427521e7ce2e2867c
Message-Authenticator = 0xa9d47914cf2d9fe81dc26ebb7fe2ba78
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 7 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state WAITING FOR INNER IDENTITY
[peap] Identity - markg
[peap] Got inner identity 'markg'
[peap] Setting default EAP type for tunneled EAP session.
[peap] Got tunneled request
EAP-Message = 0x0207000a016d61726b67
server {
[peap] Setting User-Name to markg
Sending tunneled request
EAP-Message = 0x0207000a016d61726b67
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "markg"
NAS-IP-Address = 192.168.1.10
NAS-Port = 0
Called-Station-Id = "00-15-62-FF-ED-25:erehwon"
Calling-Station-Id = "00-21-5C-13-85-23"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
server inner-tunnel {
# Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "markg", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
++[control] returns noop
[eap] EAP packet type response id 7 length 10
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = PAM
Found Auth-Type = EAP
Warning: Found 2 auth-types on request for user 'markg'
# Executing group from file /etc/raddb/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
EAP-Message =
0x0108001f1a0108001a109faf45166abb1c0be417ccdaf1b885a66d61726b67
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x28a093e528a88997c55ad698bef3c1ed
[peap] Got tunneled reply RADIUS code 11
EAP-Message =
0x0108001f1a0108001a109faf45166abb1c0be417ccdaf1b885a66d61726b67
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x28a093e528a88997c55ad698bef3c1ed
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 166 to 192.168.1.10 port 2051
EAP-Message =
0x0108003b190017030100303af3e9413638ca82fe1cba0182c4ea8da18c529d905221e8f512321ed084c2e149ca5203e2f36a7ac7270d03817e079b
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8c1fb46c8b17ad1427521e7ce2e2867c
Finished request 7.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.1.10 port 2051,
id=167, length=241
User-Name = "anonymous"
NAS-IP-Address = 192.168.1.10
NAS-Port = 0
Called-Station-Id = "00-15-62-FF-ED-25:erehwon"
Calling-Station-Id = "00-21-5C-13-85-23"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
EAP-Message =
0x020800501900170301002015f72c0634bb56f93b5e3850e53e1a1bba9480dd1a148a48052464089e337a2a17030100207d1d2cf09cdf7026b6edb25fa2212c891802d4f76810ada3067e523ed0fd97f9
State = 0x8c1fb46c8b17ad1427521e7ce2e2867c
Message-Authenticator = 0xe9bb360bdd977ddd14a426054a073106
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 8 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type nak
[peap] Got tunneled request
EAP-Message = 0x020800060306
server {
[peap] Setting User-Name to markg
Sending tunneled request
EAP-Message = 0x020800060306
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "markg"
State = 0x28a093e528a88997c55ad698bef3c1ed
NAS-IP-Address = 192.168.1.10
NAS-Port = 0
Called-Station-Id = "00-15-62-FF-ED-25:erehwon"
Calling-Station-Id = "00-21-5C-13-85-23"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
server inner-tunnel {
# Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "markg", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
++[control] returns noop
[eap] EAP packet type response id 8 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = PAM
Found Auth-Type = EAP
Warning: Found 2 auth-types on request for user 'markg'
# Executing group from file /etc/raddb/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP NAK
[eap] EAP-NAK asked for EAP-Type/gtc
[eap] processing type gtc
[gtc] expand: Password: -> Password:
++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
EAP-Message = 0x0109000f0650617373776f72643a20
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x28a093e529a99597c55ad698bef3c1ed
[peap] Got tunneled reply RADIUS code 11
EAP-Message = 0x0109000f0650617373776f72643a20
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x28a093e529a99597c55ad698bef3c1ed
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 167 to 192.168.1.10 port 2051
EAP-Message =
0x0109002b19001703010020f968f375dac67f7d4a46be914b2c4aa1d52bc974fa397873cbcf8015b0d56941
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8c1fb46c8416ad1427521e7ce2e2867c
Finished request 8.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.1.10 port 2051,
id=168, length=241
User-Name = "anonymous"
NAS-IP-Address = 192.168.1.10
NAS-Port = 0
Called-Station-Id = "00-15-62-FF-ED-25:erehwon"
Calling-Station-Id = "00-21-5C-13-85-23"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
EAP-Message =
0x02090050190017030100208370785615ed8e69c9193361a17935853a547821e2212a3cb7273e5b5210fe8117030100209e0bc4771104ecc62f52ebbb6423d3fdba79603dde6f0fab0ec70a8e3773f1d6
State = 0x8c1fb46c8416ad1427521e7ce2e2867c
Message-Authenticator = 0xbfaa2b52470ca264a58964e5c8b676c7
# Executing section authorize from file /etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "anonymous", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 9 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type gtc
[peap] Got tunneled request
EAP-Message = 0x0209000f067963736d393874673068
server {
[peap] Setting User-Name to markg
Sending tunneled request
EAP-Message = 0x0209000f067963736d393874673068
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "markg"
State = 0x28a093e529a99597c55ad698bef3c1ed
NAS-IP-Address = 192.168.1.10
NAS-Port = 0
Called-Station-Id = "00-15-62-FF-ED-25:erehwon"
Calling-Station-Id = "00-21-5C-13-85-23"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 0Mbps 802.11"
server inner-tunnel {
# Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "markg", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
++[control] returns noop
[eap] EAP packet type response id 9 length 15
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = PAM
Found Auth-Type = EAP
Warning: Found 2 auth-types on request for user 'markg'
# Executing group from file /etc/raddb/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/gtc
[eap] processing type gtc
[gtc] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
[gtc] +- entering group PAP {...}
[pap] login attempt with password "goodpass"
[pap] No password configured for the user. Cannot do authentication
++[pap] returns fail
[eap] Handler failed in EAP/gtc
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
Login incorrect: [markg] (from client ciscowap port 0 cli
00-21-5C-13-85-23 via TLS tunnel)
} # server inner-tunnel
[peap] Got tunneled reply code 3
EAP-Message = 0x04090004
Message-Authenticator = 0x00000000000000000000000000000000
[peap] Got tunneled reply RADIUS code 3
EAP-Message = 0x04090004
Message-Authenticator = 0x00000000000000000000000000000000
[peap] Tunneled authentication was rejected.
[peap] FAILURE
++[eap] returns handled
Sending Access-Challenge of id 168 to 192.168.1.10 port 2051
EAP-Message =
0x010a002b19001703010020e1494cc2c66fa214bfaa942d354a22c3d2cd8f1cebd6a204a4df0a65ef4cdff1
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8c1fb46c8515ad1427521e7ce2e2867c
Finished request 9.
Going to the next request
Waking up in 4.9 seconds.
I'm not sure where the problem is specifically, but two things seem
out of place to me:
1. The two auth-type messages. It never seems to make it to PAM.
2. These lines seem incorrect:
[gtc] +- entering group PAP {...}
[pap] login attempt with password "goodpass"
[pap] No password configured for the user. Cannot do authentication
I don't see an error message in the system event log. If I send the
wrong password into the inner-tunnel with the rad-test command, I get
an authentication failed in the system log.
Thanks in advance for your help!
Mark
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
