Ok, update!
After tearing out my hair I have decided to start again from scratch (only FR
NOT my whole PF install : )
I backed up my current FR install and completely removed FR and the PF FR
package. I then went back through the install docs and followed them to the
letter (or at least I THINK I did) and now I am getting a different error.
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] # Executing group from file
/etc/raddb/sites-enabled/packetfence-tunnel
[mschapv2] +- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured. Cannot create LM-Password.
[mschap] No Cleartext-Password configured. Cannot create NT-Password.
[mschap] Creating challenge hash with username: [email protected]
[mschap] Told to do MS-CHAPv2 for [email protected] with NT-Password
[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
[eap] Freeing handler
++[eap] returns reject
Failed to authenticate the user.
Full debug below...
<SNIP>
rad_recv: Access-Request packet from host 10.11.40.180 port 32781, id=80,
length=204
User-Name = "[email protected]"
NAS-IP-Address = 10.11.40.180
NAS-Identifier = "Sanderford-3"
NAS-Port = 656
Called-Station-Id = "00-0F-7D-31-67-A2:UMHB CruNet"
Calling-Station-Id = "4C-EB-42-33-64-8B"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 6Mbps/6Mbps 802.11g"
EAP-Message = 0x02010019016a616b652e73616c6c656540756d68622e656475
Message-Authenticator = 0x773b41cec985871f5bc3c89864df6cc8
server packetfence {
# Executing section authorize from file /etc/raddb/sites-enabled/packetfence
+- entering group authorize {...}
[suffix] Looking up realm "umhb.edu" for User-Name = "[email protected]"
[suffix] Found realm "~.*umhb\.edu$"
[suffix] Adding Stripped-User-Name = "jake.sallee"
[suffix] Adding Realm = "umhb.edu"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
++[preprocess] returns ok
[eap] EAP packet type response id 1 length 25
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
rlm_perl: Added pair NAS-Port-Type = Wireless-802.11
rlm_perl: Added pair Calling-Station-Id = 4C-EB-42-33-64-8B
rlm_perl: Added pair Called-Station-Id = 00-0F-7D-31-67-A2:UMHB CruNet
rlm_perl: Added pair Message-Authenticator = 0x773b41cec985871f5bc3c89864df6cc8
rlm_perl: Added pair User-Name = [email protected]
rlm_perl: Added pair NAS-Identifier = Sanderford-3
rlm_perl: Added pair EAP-Message =
0x02010019016a616b652e73616c6c656540756d68622e656475
rlm_perl: Added pair Connect-Info = CONNECT 6Mbps/6Mbps 802.11g
rlm_perl: Added pair Realm = umhb.edu
rlm_perl: Added pair EAP-Type = Identity
rlm_perl: Added pair Stripped-User-Name = jake.sallee
rlm_perl: Added pair NAS-IP-Address = 10.11.40.180
rlm_perl: Added pair NAS-Port = 656
rlm_perl: Added pair Framed-MTU = 1400
rlm_perl: Added pair Auth-Type = EAP
++[packetfence] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/packetfence
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
} # server packetfence
Sending Access-Challenge of id 80 to 10.11.40.180 port 32781
EAP-Message = 0x010200061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x95bc685395be71a604a9879bee4e90cd
Finished request 25.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.11.40.180 port 32781, id=81,
length=302
User-Name = "[email protected]"
NAS-IP-Address = 10.11.40.180
NAS-Identifier = "Sanderford-3"
NAS-Port = 656
Called-Station-Id = "00-0F-7D-31-67-A2:UMHB CruNet"
Calling-Station-Id = "4C-EB-42-33-64-8B"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 6Mbps/6Mbps 802.11g"
EAP-Message =
0x0202006919800000005f160301005a0100005603014fa874680028bee14badd822a737ddb06796b3a1f136dc67e18e32662593cbe0000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100
State = 0x95bc685395be71a604a9879bee4e90cd
Message-Authenticator = 0x2a97e46ade7a7bdb9d796141c0ee929b
server packetfence {
# Executing section authorize from file /etc/raddb/sites-enabled/packetfence
+- entering group authorize {...}
[suffix] Looking up realm "umhb.edu" for User-Name = "[email protected]"
[suffix] Found realm "~.*umhb\.edu$"
[suffix] Adding Stripped-User-Name = "jake.sallee"
[suffix] Adding Realm = "umhb.edu"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
++[preprocess] returns ok
[eap] EAP packet type response id 2 length 105
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/packetfence
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
TLS Length 95
[peap] Length Included
[peap] eaptls_verify returned 11
[peap] (other): before/accept initialization
[peap] TLS_accept: before/accept initialization
[peap] <<< TLS 1.0 Handshake [length 005a], ClientHello
[peap] TLS_accept: SSLv3 read client hello A
[peap] >>> TLS 1.0 Handshake [length 0031], ServerHello
[peap] TLS_accept: SSLv3 write server hello A
[peap] >>> TLS 1.0 Handshake [length 03f3], Certificate
[peap] TLS_accept: SSLv3 write certificate A
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
[peap] TLS_accept: SSLv3 write server done A
[peap] TLS_accept: SSLv3 flush data
[peap] TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
} # server packetfence
Sending Access-Challenge of id 81 to 10.11.40.180 port 32781
EAP-Message =
0x0103040019c00000043716030100310200002d03014fa87468174c0696ef57393d266ca5d6609ced181a8ecb232611d28ef4c2da8700002f000005ff0100010016030103f30b0003ef0003ec0003e9308203e5308202cda003020102020900ed97d7d6e9b4c5e0300d06092a864886f70d0101050500308188310b3009060355040613025553310e300c06035504080c055465786173310f300d06035504070c0642656c746f6e310d300b060355040a0c04554d4842310b3009060355040b0c0249543117301506035504030c0e4e414330322e756d68622e6564753123302106092a864886f70d01090116144a616b652e53616c6c656540756d6862
EAP-Message =
0x2e656475301e170d3131313133303232333634305a170d3132313132393232333634305a308188310b3009060355040613025553310e300c06035504080c055465786173310f300d06035504070c0642656c746f6e310d300b060355040a0c04554d4842310b3009060355040b0c0249543117301506035504030c0e4e414330322e756d68622e6564753123302106092a864886f70d01090116144a616b652e53616c6c656540756d68622e65647530820122300d06092a864886f70d01010105000382010f003082010a0282010100b11541b0665b84b6df7140f721a4bbf2d9ba05757e522c864e524776a3be836da6bf30cefcac181dd1ec0beb2e
EAP-Message =
0x0d9fa2f57c2bdac09e9b5602d6fe1eb0c4f60ec41fe5b09d68b6046ee180d309ce2917acaac959e133599c8711e36c5134c16446e6b21a9f83d7c1e21d600bccb7641ee92e6cfca2980c0ff404ecfd7d519a6f6ad09cd98c6512a9ee9ea44c2edbe139df1c4bce0357f203e7df734f2a3f128dc75127d6da92ce23ccbcc5b650d5f57ce4785ebe3d00b00890f8b637cbeb6394e08111b50170f213a1570679fcb962a7f25fc49e6fa3301557d7ff546277afa8a1c4829636755307ed536a2b87566a783147e23482511fae793573c91f9453f50203010001a350304e301d0603551d0e041604149b75f0e23075b98408163c65b37e5ba852e80d95301f
EAP-Message =
0x0603551d230418301680149b75f0e23075b98408163c65b37e5ba852e80d95300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010061390050a0e552e4b5debafba32a41c7bec2384083317451204d6f3583f28ec23946b2a5b4ba3a0db71e2113bcb8f58c0e69f6520802a9d008e16db9652b077535d194c54861db0345dca5a694e1c20a78631234369906d0ef6f05fe776510f50233d6b5d046fd4c3d83f48f16ff695122e6b475aa3a4f6819a283bb066c72c59f84d93641fe5040a5c248fde0cc18827aec18ff72f21c8a7608e420e32607d7e34bbb55696f67cb5e1b398d48caa5f8f671e885671984b6af71bd92
EAP-Message = 0x6ddf6c53caaa87839ace7d26
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x95bc685394bf71a604a9879bee4e90cd
Finished request 26.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.11.40.180 port 32781, id=82,
length=203
User-Name = "[email protected]"
NAS-IP-Address = 10.11.40.180
NAS-Identifier = "Sanderford-3"
NAS-Port = 656
Called-Station-Id = "00-0F-7D-31-67-A2:UMHB CruNet"
Calling-Station-Id = "4C-EB-42-33-64-8B"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 6Mbps/6Mbps 802.11g"
EAP-Message = 0x020300061900
State = 0x95bc685394bf71a604a9879bee4e90cd
Message-Authenticator = 0x4fdda9f373c4adfe24603801ec7b1bac
server packetfence {
# Executing section authorize from file /etc/raddb/sites-enabled/packetfence
+- entering group authorize {...}
[suffix] Looking up realm "umhb.edu" for User-Name = "[email protected]"
[suffix] Found realm "~.*umhb\.edu$"
[suffix] Adding Stripped-User-Name = "jake.sallee"
[suffix] Adding Realm = "umhb.edu"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
++[preprocess] returns ok
[eap] EAP packet type response id 3 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/packetfence
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
} # server packetfence
Sending Access-Challenge of id 82 to 10.11.40.180 port 32781
EAP-Message =
0x0104004719003dc56ac25beb9951ec9e7013a2f7a80bff8481cad330b4964ed8575a4d4265b83055b54ee8a4c19f6f8e8fa41c2e6500fe5a6bb6043e1c5216030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x95bc685397b871a604a9879bee4e90cd
Finished request 27.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.11.40.180 port 32781, id=83,
length=535
User-Name = "[email protected]"
NAS-IP-Address = 10.11.40.180
NAS-Identifier = "Sanderford-3"
NAS-Port = 656
Called-Station-Id = "00-0F-7D-31-67-A2:UMHB CruNet"
Calling-Station-Id = "4C-EB-42-33-64-8B"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 6Mbps/6Mbps 802.11g"
EAP-Message =
0x02040150198000000146160301010610000102010050809e6cdb2fd59f03cd3ff9d4b423e78f15622d494fc54b65823e5d50d8ffbf8bcecef9f84992e49c6e1dd039848acb045b0a7f61864330646ed3f97b3eb8e48889a7cdb0ed74efe353e75e8f970eb9479699632f37467893bab362297351906f005f812b4e64cf1c10e9061557a7ceea167e08a069dc07abb0f97c4c5fd03c74ed2df0b07469163711e144a5fff84c40f71b02a851aab3b8e8bb7f45993d9ea9e7ba5a2800c29cf3028a57ce75668690a102a5d899883c7741685538abe6b4df99ff73b3c907298907762f8ddce8e31e43f6c36a268eeb96c6c4688714db549f7a714f90cc0b06
EAP-Message =
0xbdb82166e114e09a4f3724b4e78e637d9251a393ce47af9e14030100010116030100305a6897a8705d49804946d0abae720f25a2d8d4dec6ab3f7fc4c37895d13684be3a20396d603c29c2c7552b5299de3576
State = 0x95bc685397b871a604a9879bee4e90cd
Message-Authenticator = 0x3da7c0c127c37507f5b9db7d6680f03c
server packetfence {
# Executing section authorize from file /etc/raddb/sites-enabled/packetfence
+- entering group authorize {...}
[suffix] Looking up realm "umhb.edu" for User-Name = "[email protected]"
[suffix] Found realm "~.*umhb\.edu$"
[suffix] Adding Stripped-User-Name = "jake.sallee"
[suffix] Adding Realm = "umhb.edu"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
++[preprocess] returns ok
[eap] EAP packet type response id 4 length 253
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/packetfence
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
TLS Length 326
[peap] Length Included
[peap] eaptls_verify returned 11
[peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange
[peap] TLS_accept: SSLv3 read client key exchange A
[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001]
[peap] <<< TLS 1.0 Handshake [length 0010], Finished
[peap] TLS_accept: SSLv3 read finished A
[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001]
[peap] TLS_accept: SSLv3 write change cipher spec A
[peap] >>> TLS 1.0 Handshake [length 0010], Finished
[peap] TLS_accept: SSLv3 write finished A
[peap] TLS_accept: SSLv3 flush data
[peap] (other): SSL negotiation finished successfully
SSL Connection Established
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
} # server packetfence
Sending Access-Challenge of id 83 to 10.11.40.180 port 32781
EAP-Message =
0x0105004119001403010001011603010030b112db4854a9d54d537993e1e9bddf7b9a4fe3f1e311ee808a93f95050d8d3ffbcaf63451350b3264a7ca858da4af1c0
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x95bc685396b971a604a9879bee4e90cd
Finished request 28.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.11.40.180 port 32781, id=84,
length=203
User-Name = "[email protected]"
NAS-IP-Address = 10.11.40.180
NAS-Identifier = "Sanderford-3"
NAS-Port = 656
Called-Station-Id = "00-0F-7D-31-67-A2:UMHB CruNet"
Calling-Station-Id = "4C-EB-42-33-64-8B"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 6Mbps/6Mbps 802.11g"
EAP-Message = 0x020500061900
State = 0x95bc685396b971a604a9879bee4e90cd
Message-Authenticator = 0xbc091af3e28cd3dc67435efcb4c4554b
server packetfence {
# Executing section authorize from file /etc/raddb/sites-enabled/packetfence
+- entering group authorize {...}
[suffix] Looking up realm "umhb.edu" for User-Name = "[email protected]"
[suffix] Found realm "~.*umhb\.edu$"
[suffix] Adding Stripped-User-Name = "jake.sallee"
[suffix] Adding Realm = "umhb.edu"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
++[preprocess] returns ok
[eap] EAP packet type response id 5 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/packetfence
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake is finished
[peap] eaptls_verify returned 3
[peap] eaptls_process returned 3
[peap] EAPTLS_SUCCESS
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state TUNNEL ESTABLISHED
++[eap] returns handled
} # server packetfence
Sending Access-Challenge of id 84 to 10.11.40.180 port 32781
EAP-Message =
0x0106002b19001703010020ecf5f58c0a80cdae67f8db614689d4555e9de8158e13fd3eb3fb21987e97e3fb
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x95bc685391ba71a604a9879bee4e90cd
Finished request 29.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.11.40.180 port 32781, id=85,
length=256
User-Name = "[email protected]"
NAS-IP-Address = 10.11.40.180
NAS-Identifier = "Sanderford-3"
NAS-Port = 656
Called-Station-Id = "00-0F-7D-31-67-A2:UMHB CruNet"
Calling-Station-Id = "4C-EB-42-33-64-8B"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 6Mbps/6Mbps 802.11g"
EAP-Message =
0x0206003b190017030100300acd1c92ad8cc64cf236b637ed48f11f7c90a31e6e5b6ecff131c6b8a50399506c4be8ab6166f80da76947d5c71a40f2
State = 0x95bc685391ba71a604a9879bee4e90cd
Message-Authenticator = 0xdaf1dd8f3b36ae58986ca7be0974e339
server packetfence {
# Executing section authorize from file /etc/raddb/sites-enabled/packetfence
+- entering group authorize {...}
[suffix] Looking up realm "umhb.edu" for User-Name = "[email protected]"
[suffix] Found realm "~.*umhb\.edu$"
[suffix] Adding Stripped-User-Name = "jake.sallee"
[suffix] Adding Realm = "umhb.edu"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
++[preprocess] returns ok
[eap] EAP packet type response id 6 length 59
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/packetfence
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state WAITING FOR INNER IDENTITY
[peap] Identity - [email protected]
[peap] Got inner identity '[email protected]'
[peap] Setting default EAP type for tunneled EAP session.
[peap] Got tunneled request
EAP-Message = 0x02060019016a616b652e73616c6c656540756d68622e656475
server packetfence {
[peap] Setting User-Name to [email protected]
Sending tunneled request
EAP-Message = 0x02060019016a616b652e73616c6c656540756d68622e656475
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "[email protected]"
NAS-IP-Address = 10.11.40.180
NAS-Identifier = "Sanderford-3"
NAS-Port = 656
Called-Station-Id = "00-0F-7D-31-67-A2:UMHB CruNet"
Calling-Station-Id = "4C-EB-42-33-64-8B"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 6Mbps/6Mbps 802.11g"
server packetfence-tunnel {
# Executing section authorize from file
/etc/raddb/sites-enabled/packetfence-tunnel
+- entering group authorize {...}
[suffix] Looking up realm "umhb.edu" for User-Name = "[email protected]"
[suffix] Found realm "~.*umhb\.edu$"
[suffix] Adding Stripped-User-Name = "jake.sallee"
[suffix] Adding Realm = "umhb.edu"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[eap] EAP packet type response id 6 length 25
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/packetfence-tunnel
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
++[eap] returns handled
} # server packetfence-tunnel
[peap] Got tunneled reply code 11
EAP-Message =
0x0107002e1a0107002910328400d931934dc99a9a4a971d7bdbba6a616b652e73616c6c656540756d68622e656475
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xa762c1dfa765dbbb6301b6adce3a0d6b
[peap] Got tunneled reply RADIUS code 11
EAP-Message =
0x0107002e1a0107002910328400d931934dc99a9a4a971d7bdbba6a616b652e73616c6c656540756d68622e656475
Message-Authenticator = 0x00000000000000000000000000000000
State = 0xa762c1dfa765dbbb6301b6adce3a0d6b
[peap] Got tunneled Access-Challenge
++[eap] returns handled
} # server packetfence
Sending Access-Challenge of id 85 to 10.11.40.180 port 32781
EAP-Message =
0x0107004b190017030100404eea319237db9c739267b92cf8c4f3d48dcf7cce742514db94b77632e71cae54bb3c84ac3486f2d6060008b803620077c9e77f09c459d1845d1d50c573617d16
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x95bc685390bb71a604a9879bee4e90cd
Finished request 30.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.11.40.180 port 32781, id=86,
length=304
User-Name = "[email protected]"
NAS-IP-Address = 10.11.40.180
NAS-Identifier = "Sanderford-3"
NAS-Port = 656
Called-Station-Id = "00-0F-7D-31-67-A2:UMHB CruNet"
Calling-Station-Id = "4C-EB-42-33-64-8B"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 6Mbps/6Mbps 802.11g"
EAP-Message =
0x0207006b190017030100607b2d54293f1acce7fb52a4d89de7a5d817b3e5fc4373eb7ff556923f415e84652384e92061df4705783d064fd9bbb211e7d4017bad1288d3dc6bce0d745eb697eecd1a2d04b4dbf9bedcfa706b8e2f299fcd3bd8b733fadf6bfb8eb35771c5c5
State = 0x95bc685390bb71a604a9879bee4e90cd
Message-Authenticator = 0x06b14f2bbfe4ce264b6b75cfd7a6cd96
server packetfence {
# Executing section authorize from file /etc/raddb/sites-enabled/packetfence
+- entering group authorize {...}
[suffix] Looking up realm "umhb.edu" for User-Name = "[email protected]"
[suffix] Found realm "~.*umhb\.edu$"
[suffix] Adding Stripped-User-Name = "jake.sallee"
[suffix] Adding Realm = "umhb.edu"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
++[preprocess] returns ok
[eap] EAP packet type response id 7 length 107
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/packetfence
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type mschapv2
[peap] Got tunneled request
EAP-Message =
0x0207004f1a0207004a31c79242d0f4a7e7601bbec43d74ab46790000000000000000504fb43c1f9e099a2ab342ddc9e453c54c63a8e2fb56a4d1006a616b652e73616c6c656540756d68622e656475
server packetfence {
[peap] Setting User-Name to [email protected]
Sending tunneled request
EAP-Message =
0x0207004f1a0207004a31c79242d0f4a7e7601bbec43d74ab46790000000000000000504fb43c1f9e099a2ab342ddc9e453c54c63a8e2fb56a4d1006a616b652e73616c6c656540756d68622e656475
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "[email protected]"
State = 0xa762c1dfa765dbbb6301b6adce3a0d6b
NAS-IP-Address = 10.11.40.180
NAS-Identifier = "Sanderford-3"
NAS-Port = 656
Called-Station-Id = "00-0F-7D-31-67-A2:UMHB CruNet"
Calling-Station-Id = "4C-EB-42-33-64-8B"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 6Mbps/6Mbps 802.11g"
server packetfence-tunnel {
# Executing section authorize from file
/etc/raddb/sites-enabled/packetfence-tunnel
+- entering group authorize {...}
[suffix] Looking up realm "umhb.edu" for User-Name = "[email protected]"
[suffix] Found realm "~.*umhb\.edu$"
[suffix] Adding Stripped-User-Name = "jake.sallee"
[suffix] Adding Realm = "umhb.edu"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
[eap] EAP packet type response id 7 length 79
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/packetfence-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] # Executing group from file
/etc/raddb/sites-enabled/packetfence-tunnel
[mschapv2] +- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured. Cannot create LM-Password.
[mschap] No Cleartext-Password configured. Cannot create NT-Password.
[mschap] Creating challenge hash with username: [email protected]
[mschap] Told to do MS-CHAPv2 for [email protected] with NT-Password
[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
[eap] Freeing handler
++[eap] returns reject
Failed to authenticate the user.
Login incorrect: [[email protected]] (from client 10.11.40.180 port 656 cli
4C-EB-42-33-64-8B via TLS tunnel)
} # server packetfence-tunnel
[peap] Got tunneled reply code 3
MS-CHAP-Error = "\007E=691 R=1"
EAP-Message = 0x04070004
Message-Authenticator = 0x00000000000000000000000000000000
[peap] Got tunneled reply RADIUS code 3
MS-CHAP-Error = "\007E=691 R=1"
EAP-Message = 0x04070004
Message-Authenticator = 0x00000000000000000000000000000000
[peap] Tunneled authentication was rejected.
[peap] FAILURE
++[eap] returns handled
} # server packetfence
Sending Access-Challenge of id 86 to 10.11.40.180 port 32781
EAP-Message =
0x0108002b19001703010020f9b7035417fc77f789962c35338617c98084be1a0ab94686080472c0a8b76b6d
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x95bc685393b471a604a9879bee4e90cd
Finished request 31.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.11.40.180 port 32781, id=87,
length=240
User-Name = "[email protected]"
NAS-IP-Address = 10.11.40.180
NAS-Identifier = "Sanderford-3"
NAS-Port = 656
Called-Station-Id = "00-0F-7D-31-67-A2:UMHB CruNet"
Calling-Station-Id = "4C-EB-42-33-64-8B"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 6Mbps/6Mbps 802.11g"
EAP-Message =
0x0208002b190017030100206780737dce2993ff36609cbd677440aa808a6c3739141931fe4ffba1caafc851
State = 0x95bc685393b471a604a9879bee4e90cd
Message-Authenticator = 0x55012d87cc3f46830bf33243800870eb
server packetfence {
# Executing section authorize from file /etc/raddb/sites-enabled/packetfence
+- entering group authorize {...}
[suffix] Looking up realm "umhb.edu" for User-Name = "[email protected]"
[suffix] Found realm "~.*umhb\.edu$"
[suffix] Adding Stripped-User-Name = "jake.sallee"
[suffix] Adding Realm = "umhb.edu"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
++[preprocess] returns ok
[eap] EAP packet type response id 8 length 43
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/packetfence
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state send tlv failure
[peap] Received EAP-TLV response.
[peap] The users session was previously rejected: returning reject (again.)
[peap] *** This means you need to read the PREVIOUS messages in the debug
output
[peap] *** to find out the reason why the user was rejected.
[peap] *** Look for "reject" or "fail". Those earlier messages will tell you.
[peap] *** what went wrong, and how to fix the problem.
[eap] Handler failed in EAP/peap
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
Login incorrect: [[email protected]] (from client 10.11.40.180 port 656 cli
4C-EB-42-33-64-8B)
} # server packetfence
Using Post-Auth-Type Reject
# Executing group from file /etc/raddb/sites-enabled/packetfence
+- entering group REJECT {...}
[attr_filter.access_reject] expand: %{User-Name} -> [email protected]
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 32 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 32
Sending Access-Reject of id 87 to 10.11.40.180 port 32781
EAP-Message = 0x04080004
Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.9 seconds.
</SNIP>
Jake Sallee
Godfather of Bandwidth
System Engineer
University of Mary Hardin-Baylor
900 College St.
Belton TX. 76513
Fone: 254-295-4658
Phax: 254-295-4221
HTTP://WWW.UMHB.EDU
-----Original Message-----
From: Sallee, Stephen (Jake) [mailto:[email protected]]
Sent: Monday, May 07, 2012 11:46 AM
To: [email protected]
Subject: Re: [PacketFence-users] EAP type getting set to EAP-TLS
Francois:
My apologies for not contacting you sooner, I was doing some more
testing. This is wireless 802.1x.
I was testing multiple clients just to make sure I was not doing
something foolish on the client side. Same results.
The EAP type must be getting set SOMEWHERE in the RADIUS server, but
for the life of me I cannot figure out where. I'm off to look at the virtual
servers again ... if anyone has any ideas I am all ears.
See log:
rad_recv: Access-Request packet from host 10.11.40.180 port 32887, id=53,
length=207
User-Name = "[email protected]"
NAS-IP-Address = 10.11.40.180
NAS-Identifier = "Sanderford-3"
NAS-Port = 656
Called-Station-Id = "00-0F-7D-31-67-A3:UMHB SecureNet"
Calling-Station-Id = "90-4C-E5-BE-77-AF"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 6Mbps/6Mbps 802.11g"
EAP-Message = 0x020400060d00
State = 0x82c8a90480cca43bf4984f827c0da5de
Message-Authenticator = 0xc3124d5e300bb15393e7e6c1c93f930c
server packetfence {
# Executing section authorize from file /etc/raddb/sites-enabled/packetfence
+- entering group authorize {...}
[suffix] Looking up realm "umhb.edu" for User-Name = "[email protected]"
[suffix] Found realm "~.*umhb\.edu$"
[suffix] Adding Stripped-User-Name = "tommy.moore"
[suffix] Adding Realm = "umhb.edu"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
++[preprocess] returns ok
[eap] EAP packet type response id 4 length 6 [eap] No EAP Start, assuming it's
an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
rlm_perl: Added pair NAS-Port-Type = Wireless-802.11
rlm_perl: Added pair State = 0x82c8a90480cca43bf4984f827c0da5de
rlm_perl: Added pair Calling-Station-Id = 90-4C-E5-BE-77-AF
rlm_perl: Added pair Called-Station-Id = 00-0F-7D-31-67-A3:UMHB SecureNet
rlm_perl: Added pair Message-Authenticator = 0xc3124d5e300bb15393e7e6c1c93f930c
rlm_perl: Added pair User-Name = [email protected]
rlm_perl: Added pair NAS-Identifier = Sanderford-3
rlm_perl: Added pair EAP-Message = 0x020400060d00
rlm_perl: Added pair Connect-Info = CONNECT 6Mbps/6Mbps 802.11g
rlm_perl: Added pair Realm = umhb.edu
rlm_perl: Added pair EAP-Type = EAP-TLS
rlm_perl: Added pair Stripped-User-Name = tommy.moore
rlm_perl: Added pair NAS-IP-Address = 10.11.40.180
rlm_perl: Added pair NAS-Port = 656
rlm_perl: Added pair Framed-MTU = 1400
rlm_perl: Added pair Auth-Type = EAP
++[packetfence] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/packetfence
+- entering group authenticate {...}
[eap] Request found, released from the list [eap] EAP/tls [eap] processing type
tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls]
ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls]
eaptls_process returned 13
++[eap] returns handled
} # server packetfence
Sending Access-Challenge of id 53 to 10.11.40.180 port 32887
EAP-Message = 0x010500100d80000003fc00000e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x82c8a90481cda43bf4984f827c0da5de
Finished request 74.
Going to the next request
Waking up in 0.5 seconds.
rad_recv: Access-Request packet from host 10.11.40.180 port 32887, id=54,
length=218
User-Name = "[email protected]"
NAS-IP-Address = 10.11.40.180
NAS-Identifier = "Sanderford-3"
NAS-Port = 656
Called-Station-Id = "00-0F-7D-31-67-A3:UMHB SecureNet"
Calling-Station-Id = "90-4C-E5-BE-77-AF"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 6Mbps/6Mbps 802.11g"
EAP-Message = 0x020500110d800000000715030100020230
State = 0x82c8a90481cda43bf4984f827c0da5de
Message-Authenticator = 0x419a427e92646925a7b40307cd5254df
server packetfence {
# Executing section authorize from file /etc/raddb/sites-enabled/packetfence
+- entering group authorize {...}
[suffix] Looking up realm "umhb.edu" for User-Name = "[email protected]"
[suffix] Found realm "~.*umhb\.edu$"
[suffix] Adding Stripped-User-Name = "tommy.moore"
[suffix] Adding Realm = "umhb.edu"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
++[preprocess] returns ok
[eap] EAP packet type response id 5 length 17 [eap] No EAP Start, assuming it's
an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
rlm_perl: Added pair NAS-Port-Type = Wireless-802.11
rlm_perl: Added pair State = 0x82c8a90481cda43bf4984f827c0da5de
rlm_perl: Added pair Calling-Station-Id = 90-4C-E5-BE-77-AF
rlm_perl: Added pair Called-Station-Id = 00-0F-7D-31-67-A3:UMHB SecureNet
rlm_perl: Added pair Message-Authenticator = 0x419a427e92646925a7b40307cd5254df
rlm_perl: Added pair User-Name = [email protected]
rlm_perl: Added pair NAS-Identifier = Sanderford-3
rlm_perl: Added pair EAP-Message = 0x020500110d800000000715030100020230
rlm_perl: Added pair Connect-Info = CONNECT 6Mbps/6Mbps 802.11g
rlm_perl: Added pair Realm = umhb.edu
rlm_perl: Added pair EAP-Type = EAP-TLS
rlm_perl: Added pair Stripped-User-Name = tommy.moore
rlm_perl: Added pair NAS-IP-Address = 10.11.40.180
rlm_perl: Added pair NAS-Port = 656
rlm_perl: Added pair Framed-MTU = 1400
rlm_perl: Added pair Auth-Type = EAP
++[packetfence] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/raddb/sites-enabled/packetfence
+- entering group authenticate {...}
[eap] Request found, released from the list [eap] EAP/tls [eap] processing type
tls [tls] Authenticate [tls] processing EAP-TLS
TLS Length 7
[tls] Length Included
[tls] eaptls_verify returned 11
[tls] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert
read:fatal:unknown CA
TLS_accept: failed in SSLv3 read client certificate A
rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert
unknown ca
SSL: SSL_read failed inside of TLS (-1), TLS session fails.
TLS receive handshake failed during operation [tls] eaptls_process returned 4
[eap] Handler failed in EAP/tls [eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
Login incorrect (TLS Alert read:fatal:unknown CA): [[email protected]] (from
client 10.11.40.180 port 656 cli 90-4C-E5-BE-77-AF) } # server packetfence
Using Post-Auth-Type Reject # Executing group from file
/etc/raddb/sites-enabled/packetfence
+- entering group REJECT {...}
[attr_filter.access_reject] expand: %{User-Name} -> [email protected]
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 75 for 1 seconds Going to the next request
Jake Sallee
Godfather of Bandwidth
System Engineer
University of Mary Hardin-Baylor
900 College St.
Belton TX. 76513
Fone: 254-295-4658
Phax: 254-295-4221
HTTP://WWW.UMHB.EDU
-----Original Message-----
From: Francois Gaudreault [mailto:[email protected]]
Sent: Monday, May 07, 2012 9:40 AM
To: [email protected]
Subject: Re: [PacketFence-users] EAP type getting set to EAP-TLS
The eap.conf default_eap_type is properly set, so it's not FreeRADIUS.
Is this wired or wireless 802.1X? Maybe you can try to connect on another
switch or AP?
--
Francois Gaudreault, ing. jr
[email protected] :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse
inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence
(www.packetfence.org)
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and threat
landscape has changed and how IT managers can respond. Discussions will include
endpoint security, mobile security and the latest in malware threats.
http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and threat
landscape has changed and how IT managers can respond. Discussions will include
endpoint security, mobile security and the latest in malware threats.
http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
