Wpa/WPA2-Radius+EAP-TLS/EAP-PEAP

[salimk]

Здравствуйте Товарищи!
Я вам хочу рассказать сказку царевну точку-доступа Dlink и богатыря FreeRADIUS

http://www.lissyara.su/?id=2173

Приму любые замечание и предложение

[Хостинг HostFood.ru]

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

[salimk]

Radius-certs-scritps

[snorlov]

Я добавил бы еще некоторые моменты для виндового клиента.
Так как не писатель то будет сумбурно...
1.личный сертификат установленный под пользователем доступен только, если вы этим пользователем прошли аутенфикацию на машине, под другим пользователем он недоступен, а до этого машинка не может быть подключена к wi-fi, со всеми вытекающими условиями типа недоступность станции ну и т.д., отсюда появляется 2-ой момент
2. Для доступности не залогиненной машины надо клиентский сертификат устанавливать через оснастку "сертификаты" и там выбирать локальный компьютер, после аутенфикации он будет заменен сертификатом из сертификатов пользователя, это особенно надо учитывать если вы используете виндовый домен, если там установлена политика "проверка пользователя сетью", кажется так, то вы никогда не сможете пройти аутенфикаицию, при этом данный сертификат может и не быть сертификатом пользователя, а своим...

[salimk]

Я добавил бы еще некоторые моменты для виндового клиента.
Так как не писатель то будет сумбурно...
1.личный сертификат установленный под пользователем доступен только, если вы этим пользователем прошли аутенфикацию на машине, под другим пользователем он недоступен, а до этого машинка не может быть подключена к wi-fi, со всеми вытекающими условиями типа недоступность станции ну и т.д., отсюда появляется 2-ой момент
2. Для доступности не залогиненной машины надо клиентский сертификат устанавливать через оснастку "сертификаты" и там выбирать локальный компьютер, после аутенфикации он будет заменен сертификатом из сертификатов пользователя, это особенно надо учитывать если вы используете виндовый домен, если там установлена политика "проверка пользователя сетью", кажется так, то вы никогда не сможете пройти аутенфикаицию, при этом данный сертификат может и не быть сертификатом пользователя, а своим...

snorlov огромное спасибо за замечание!
насчет этой небольшой проблемы я в курсе, но еще не успел ее включит в статью, так что в скором времени добавлю этот пункт тоже. спс.
От себя хотел добавить что компьютере подключенные через wifi это ноутбуки и мобильные девайсы, и я не вижу смысла подключать их к домену, поэтому наверное я этот момент упустил, но не у всех сетка по проводам, так я то я все равно включу это в статью
СПС

[Kano]

Доброго времени суток!
подскажите пож-та , ставил радиус по вашей статье, только не генерил сертификаты, решил аутентификацию только по WPA2+AES реализовать.
все установил, прописал, но клиент(ТСД symbol MC3090) не хочет авторизовываться в сети, проверял radtest'ом все отлично.
логи точки доступа
[AP Uptime:0 Hours 9 Minutes 21 Seconds]---hostapd: ath0: STA 00:15:70:6a:93:e4 IEEE 802.11: associated
[AP Uptime:0 Hours 9 Minutes 21 Seconds]---[WLAN Event] ASSOCIATION: associated from Station 00:15:70:6a:93:e4
[AP Uptime:0 Hours 9 Minutes 19 Seconds]---hostapd: ath0: STA 00:15:70:6a:93:e4 IEEE 802.11: deassociated
[AP Uptime:0 Hours 9 Minutes 19 Seconds]---[WLAN Event] DEAUTHENTICATION: deassociated from Station 00:15:70:6a:93:e4
[AP Uptime:0 Hours 9 Minutes 14 Seconds]---hostapd: ath0: STA 00:15:70:6a:93:e4 IEEE 802.11: associated
[AP Uptime:0 Hours 9 Minutes 14 Seconds]---[WLAN Event] ASSOCIATION: associated from Station 00:15:70:6a:93:e4
[AP Uptime:0 Hours 9 Minutes 13 Seconds]---hostapd: ath0: STA 00:15:70:6a:93:e4 IEEE 802.11: deassociated
[AP Uptime:0 Hours 9 Minutes 13 Seconds]---[WLAN Event] DEAUTHENTICATION: deassociated from Station 00:15:70:6a:93:e4
[AP Uptime:0 Hours 8 Minutes 38 Seconds]---hostapd: ath0: STA 00:15:70:6a:93:e4 IEEE 802.11: associated
[AP Uptime:0 Hours 8 Minutes 38 Seconds]---[WLAN Event] ASSOCIATION: associated from Station 00:15:70:6a:93:e4

[salimk]

Вам того же
наверное вы имели ввиду WPA/EAP-PEAP
если так, то тогда вам надо по любому генерировать все сертификаты, кроме сертификатов клиента
в /usr/local/etc/raddb/eap.conf
default_eap_type = peap

в остальном все делайте по инструкции и даже пункт "3.1 EAP-TLS"
кроме пункта "2.5 Создаем сертификат клиента"

Доброго времени суток!
подскажите пож-та , ставил радиус по вашей статье, только не генерил сертификаты, решил аутентификацию только по WPA2+AES реализовать.
все установил, прописал, но клиент(ТСД symbol MC3090) не хочет авторизовываться в сети, проверял radtest'ом все отлично.
логи точки доступа
[AP Uptime:0 Hours 9 Minutes 21 Seconds]---hostapd: ath0: STA 00:15:70:6a:93:e4 IEEE 802.11: associated
[AP Uptime:0 Hours 9 Minutes 21 Seconds]---[WLAN Event] ASSOCIATION: associated from Station 00:15:70:6a:93:e4
[AP Uptime:0 Hours 9 Minutes 19 Seconds]---hostapd: ath0: STA 00:15:70:6a:93:e4 IEEE 802.11: deassociated
[AP Uptime:0 Hours 9 Minutes 19 Seconds]---[WLAN Event] DEAUTHENTICATION: deassociated from Station 00:15:70:6a:93:e4
[AP Uptime:0 Hours 9 Minutes 14 Seconds]---hostapd: ath0: STA 00:15:70:6a:93:e4 IEEE 802.11: associated
[AP Uptime:0 Hours 9 Minutes 14 Seconds]---[WLAN Event] ASSOCIATION: associated from Station 00:15:70:6a:93:e4
[AP Uptime:0 Hours 9 Minutes 13 Seconds]---hostapd: ath0: STA 00:15:70:6a:93:e4 IEEE 802.11: deassociated
[AP Uptime:0 Hours 9 Minutes 13 Seconds]---[WLAN Event] DEAUTHENTICATION: deassociated from Station 00:15:70:6a:93:e4
[AP Uptime:0 Hours 8 Minutes 38 Seconds]---hostapd: ath0: STA 00:15:70:6a:93:e4 IEEE 802.11: associated
[AP Uptime:0 Hours 8 Minutes 38 Seconds]---[WLAN Event] ASSOCIATION: associated from Station 00:15:70:6a:93:e4

[lolwut]

Radius-certs-scritps

Зачем изобретать велосипеды?

Код: Выделить всё

# ls /usr/src/crypto/openssl/apps | grep ^CA.
CA.pl
CA.pl.in
CA.sh

Код: Выделить всё

# sh /usr/src/crypto/openssl/apps/CA.sh -help
usage: /usr/src/crypto/openssl/apps/CA.sh -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify

Код: Выделить всё

# perl /usr/src/crypto/openssl/apps/CA.pl -help
usage: CA -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify

Или я что-то не так понял?

BTW, ссылка на статью 2005-го года Защита беспроводных сетей, WPA: теория и практика тут не помешает

[VN8]

Ни как не получается настроить авторизацию Wi-Fi клиентов по EAP-PEAP в freeradius2. При настройке подобной авторизации на freeradius 1.1.8 машина с Win7 авторизовалась нормально, а вот на freeradius 2.1.10 - ни в какую.
База пользователей находится в файле users, mysql пока не использую, точка доступа TP-Link TP-WA901ND. Тестовые команды с локальной машины (виртуалка с FreeBSD 8.2), на которой установлен freeradius, типа:

# radtest USER_NAME USER_PASSWORD localhost 0 FREERADIUS_PASSWORD

# radtest -t mschap USER_NAME USER_PASSWORD localhost:18120 0 FREERADIUS_PASSWORD


проходят нормально, получаю "Acceess-Accept", а вот реальный юзер Windows 7, как уже писал, стабильно риджектится.

Лог теста конвигурации feeradius'а:

Код: Выделить всё

FreeRADIUS Version 2.1.10, for host i386-portbld-freebsd8.2, built on Jul 31 2011 at 13:38:54
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. 
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A 
PARTICULAR PURPOSE. 
You may redistribute copies of FreeRADIUS under the terms of the 
GNU General Public License v2. 
Starting - reading configuration files ...
including configuration file /usr/local/etc/raddb/radiusd.conf
including configuration file /usr/local/etc/raddb/proxy.conf
including configuration file /usr/local/etc/raddb/clients.conf
including files in directory /usr/local/etc/raddb/modules/
including configuration file /usr/local/etc/raddb/modules/wimax
including configuration file /usr/local/etc/raddb/modules/always
including configuration file /usr/local/etc/raddb/modules/attr_filter
including configuration file /usr/local/etc/raddb/modules/attr_rewrite
including configuration file /usr/local/etc/raddb/modules/chap
including configuration file /usr/local/etc/raddb/modules/checkval
including configuration file /usr/local/etc/raddb/modules/counter
including configuration file /usr/local/etc/raddb/modules/cui
including configuration file /usr/local/etc/raddb/modules/detail
including configuration file /usr/local/etc/raddb/modules/detail.example.com
including configuration file /usr/local/etc/raddb/modules/detail.log
including configuration file /usr/local/etc/raddb/modules/digest
including configuration file /usr/local/etc/raddb/modules/dynamic_clients
including configuration file /usr/local/etc/raddb/modules/echo
including configuration file /usr/local/etc/raddb/modules/etc_group
including configuration file /usr/local/etc/raddb/modules/exec
including configuration file /usr/local/etc/raddb/modules/expiration
including configuration file /usr/local/etc/raddb/modules/expr
including configuration file /usr/local/etc/raddb/modules/files
including configuration file /usr/local/etc/raddb/modules/inner-eap
including configuration file /usr/local/etc/raddb/modules/ippool
including configuration file /usr/local/etc/raddb/modules/krb5
including configuration file /usr/local/etc/raddb/modules/ldap
including configuration file /usr/local/etc/raddb/modules/linelog
including configuration file /usr/local/etc/raddb/modules/logintime
including configuration file /usr/local/etc/raddb/modules/mac2ip
including configuration file /usr/local/etc/raddb/modules/mschap
including configuration file /usr/local/etc/raddb/modules/mac2vlan
including configuration file /usr/local/etc/raddb/modules/ntlm_auth
including configuration file /usr/local/etc/raddb/modules/opendirectory
including configuration file /usr/local/etc/raddb/modules/otp
including configuration file /usr/local/etc/raddb/modules/pam
including configuration file /usr/local/etc/raddb/modules/pap
including configuration file /usr/local/etc/raddb/modules/passwd
including configuration file /usr/local/etc/raddb/modules/perl
including configuration file /usr/local/etc/raddb/modules/policy
including configuration file /usr/local/etc/raddb/modules/preprocess
including configuration file /usr/local/etc/raddb/modules/radutmp
including configuration file /usr/local/etc/raddb/modules/realm
including configuration file /usr/local/etc/raddb/modules/smbpasswd
including configuration file /usr/local/etc/raddb/modules/smsotp
including configuration file /usr/local/etc/raddb/modules/sql_log
including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login
including configuration file /usr/local/etc/raddb/modules/sradutmp
including configuration file /usr/local/etc/raddb/modules/unix
including configuration file /usr/local/etc/raddb/modules/acct_unique
including configuration file /usr/local/etc/raddb/eap.conf
including configuration file /usr/local/etc/raddb/policy.conf
including files in directory /usr/local/etc/raddb/sites-enabled/
including configuration file /usr/local/etc/raddb/sites-enabled/default
including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel
including configuration file /usr/local/etc/raddb/sites-enabled/control-socket
main {
        user = "freeradius"
        group = "freeradius"
        allow_core_dumps = no
}
including dictionary file /usr/local/etc/raddb/dictionary
main {
        prefix = "/usr/local"
        localstatedir = "/var"
        logdir = "/var/log"
        libdir = "/usr/local/lib/freeradius-2.1.10"
        radacctdir = "/var/log/radacct"
        hostname_lookups = no
        max_request_time = 30
        cleanup_delay = 5
        max_requests = 1024
        pidfile = "/var/run/radiusd/radiusd.pid"
        checkrad = "/usr/local/sbin/checkrad"
        debug_level = 0
        proxy_requests = yes
 log {
        stripped_names = no
        auth = no
        auth_badpass = no
        auth_goodpass = no
 }
 security {
        max_attributes = 200
        reject_delay = 1
        status_server = yes
 }
}
radiusd: #### Loading Realms and Home Servers ####
 proxy server {
        retry_delay = 5
        retry_count = 3
        default_fallback = no
        dead_time = 120
        wake_all_if_all_dead = no
 }
 home_server localhost {
        ipaddr = 127.0.0.1
        port = 1812
        type = "auth"
        secret = "testing123"
        response_window = 20
        max_outstanding = 65536
        require_message_authenticator = yes
        zombie_period = 40
        status_check = "status-server"
        ping_interval = 30
        check_interval = 30
        num_answers_to_alive = 3
        num_pings_to_alive = 3
        revive_interval = 120
        status_check_timeout = 4
        irt = 2
        mrt = 16
        mrc = 5
        mrd = 30
 }
 home_server_pool my_auth_failover {
        type = fail-over
        home_server = localhost
 }
 realm example.com {
        auth_pool = my_auth_failover
 }
 realm LOCAL {
 }
 realm DEFAULT {
        authhost = LOCAL
        accthost = LOCAL
 }
radiusd: #### Loading Clients ####
 client localhost {
        ipaddr = 127.0.0.1
        require_message_authenticator = no
        secret = "test"
        nastype = "other"
 }
 client TP-Link Access Point {
        ipaddr = 192.168.201.253
        require_message_authenticator = no
        secret = "test"
        nastype = "other"
 }
radiusd: #### Instantiating modules ####
 instantiate {
 Module: Linked to module rlm_exec
 Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec
  exec {
        wait = no
        input_pairs = "request"
        shell_escape = yes
  }
 Module: Linked to module rlm_expr
 Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr
 Module: Linked to module rlm_expiration
 Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration
  expiration {
        reply-message = "Password Has Expired  "
  }
 Module: Linked to module rlm_logintime
 Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime
  logintime {
        reply-message = "You are calling outside your allowed timespan  "
        minimum-timeout = 60
  }
 }
radiusd: #### Loading Virtual Servers ####
server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Linked to module rlm_pap
 Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap
  pap {
        encryption_scheme = "auto"
        auto_header = no
  }
 Module: Linked to module rlm_chap
 Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap
 Module: Linked to module rlm_mschap
 Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap
  mschap {
        use_mppe = yes
        require_encryption = yes
        require_strong = yes
        with_ntdomain_hack = yes
  }
 Module: Linked to module rlm_unix
 Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix
  unix {
        radwtmp = "/var/log/radwtmp"
  }
 Module: Linked to module rlm_eap
 Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf
  eap {
        default_eap_type = "peap"
        timer_expire = 60
        ignore_unknown_eap_types = no
        cisco_accounting_username_bug = no
        max_sessions = 4096
  }
 Module: Linked to sub-module rlm_eap_md5
 Module: Instantiating eap-md5
 Module: Linked to sub-module rlm_eap_leap
 Module: Instantiating eap-leap
 Module: Linked to sub-module rlm_eap_gtc
 Module: Instantiating eap-gtc
   gtc {
        challenge = "Password: "
        auth_type = "PAP"
   }
 Module: Linked to sub-module rlm_eap_tls
 Module: Instantiating eap-tls
   tls {
        rsa_key_exchange = no
        dh_key_exchange = yes
        rsa_key_length = 512
        dh_key_length = 512
        verify_depth = 0
        CA_path = "/usr/local/etc/raddb/certs"
        pem_file_type = yes
        private_key_file = "/usr/local/etc/raddb/certs/server.pem"
        certificate_file = "/usr/local/etc/raddb/certs/server.pem"
        CA_file = "/usr/local/etc/raddb/certs/ca.pem"
        private_key_password = "whatever"
        dh_file = "/usr/local/etc/raddb/certs/dh"
        random_file = "/usr/local/etc/raddb/certs/random"
        fragment_size = 1024
        include_length = yes
        check_crl = no
        cipher_list = "DEFAULT"
        make_cert_command = "/usr/local/etc/raddb/certs/bootstrap"
    cache {
        enable = no
        lifetime = 24
        max_entries = 255
    }
    verify {
    }
   }
 Module: Linked to sub-module rlm_eap_ttls
 Module: Instantiating eap-ttls
   ttls {
        default_eap_type = "md5"
        copy_request_to_tunnel = no
        use_tunneled_reply = no
        virtual_server = "inner-tunnel"
        include_length = yes
   }
 Module: Linked to sub-module rlm_eap_peap
 Module: Instantiating eap-peap
   peap {
        default_eap_type = "mschapv2"
        copy_request_to_tunnel = no
        use_tunneled_reply = no
        proxy_tunneled_request_as_eap = yes
        virtual_server = "inner-tunnel"
   }
 Module: Linked to sub-module rlm_eap_mschapv2
 Module: Instantiating eap-mschapv2
   mschapv2 {
        with_ntdomain_hack = no
   }
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_realm
 Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm
  realm suffix {
        format = "suffix"
        delimiter = "@"
        ignore_default = no
        ignore_null = no
  }
 Module: Linked to module rlm_files
 Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files
  files {
        usersfile = "/usr/local/etc/raddb/users"
        acctusersfile = "/usr/local/etc/raddb/acct_users"
        preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"
        compat = "no"
  }
 Module: Checking session {...} for more modules to load
 Module: Linked to module rlm_radutmp
 Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp
  radutmp {
        filename = "/var/log/radutmp"
        username = "%{User-Name}"
        case_sensitive = yes
        check_with_nas = yes
        perm = 384
        callerid = yes
  }
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 Module: Linked to module rlm_attr_filter
 Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter
  attr_filter attr_filter.access_reject {
        attrsfile = "/usr/local/etc/raddb/attrs.access_reject"
        key = "%{User-Name}"
  }
 } # modules
} # server
server { # from file /usr/local/etc/raddb/radiusd.conf
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Linked to module rlm_digest
 Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_preprocess
 Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess
  preprocess {
        huntgroups = "/usr/local/etc/raddb/huntgroups"
        hints = "/usr/local/etc/raddb/hints"
        with_ascend_hack = no
        ascend_channels_per_line = 23
        with_ntdomain_hack = no
        with_specialix_jetstream_hack = no
        with_cisco_vsa_hack = no
        with_alvarion_vsa_hack = no
  }
 Module: Instantiating module "ntdomain" from file /usr/local/etc/raddb/modules/realm
  realm ntdomain {
        format = "prefix"
        delimiter = "\"
        ignore_default = no
        ignore_null = no
  }
 Module: Checking preacct {...} for more modules to load
 Module: Linked to module rlm_acct_unique
 Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique
  acct_unique {
        key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
  }
 Module: Checking accounting {...} for more modules to load
 Module: Linked to module rlm_detail
 Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail
  detail {
        detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d"
        header = "%t"
        detailperm = 384
        dirperm = 493
        locking = no
        log_packet_header = no
  }
 Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter
  attr_filter attr_filter.accounting_response {
        attrsfile = "/usr/local/etc/raddb/attrs.accounting_response"
        key = "%{User-Name}"
  }
 Module: Checking session {...} for more modules to load
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 } # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
        type = "auth"
        ipaddr = *
        port = 0
}
listen {
        type = "acct"
        ipaddr = *
        port = 0
}
listen {
        type = "control"
 listen {
        socket = "/var/run/radiusd/radiusd.sock"
 }
}
listen {
        type = "auth"
        ipaddr = 127.0.0.1
        port = 18120
}
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on command file /var/run/radiusd/radiusd.sock
Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
Listening on proxy address * port 1814
Ready to process requests.

Тут мне непонятна следующая запись:

Module: Linked to sub-module rlm_eap_mschapv2
Module: Instantiating eap-mschapv2
mschapv2 {
with_ntdomain_hack = no
}

В /modules/mschap у меня указано "with_ntdomain_hack = yes", отдельного файла для конфигурации ms-chapv2 я не нашёл. Простите за глупый ламерский вопрос, но где расположена настройка этого самого суб-модуля rlm_eap_mschapv2, чтобы мне и там для with_ntdomain_hack указать "yes"?

Лог самого подключения:

Код: Выделить всё

rad_recv: Access-Request packet from host 192.168.201.253 port 2048, id=117, length=190
        User-Name = "Laptop\\Test_user"
        NAS-IP-Address = 192.168.201.253
        NAS-Port = 0
        Called-Station-Id = "74-EA-3A-D4-DC-BE:HOMENET-WIRELESS"
        Calling-Station-Id = "E0-2A-82-15-3C-3A"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x0201001a014e6174616c792d48502d626f6f6b5c4e6174616c79
        Message-Authenticator = 0x5167e41ee97484e6be91244b4427353b
# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[ntdomain] Looking up realm "Laptop" for User-Name = "Laptop\Test_user"
[ntdomain] Found realm "DEFAULT"
[ntdomain] Adding Stripped-User-Name = "Test_user"
[ntdomain] Adding Realm = "DEFAULT"
[ntdomain] Authentication realm is LOCAL.
++[ntdomain] returns ok
[eap] EAP packet type response id 1 length 26
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[files] users: Matched entry Test_user at line 50
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING: Auth-Type already set.  Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 117 to 192.168.201.253 port 2048
        EAP-Message = 0x010200061920
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x6e53c9f96e51d068aa05e09ea0e2213e
Finished request 18.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.201.253 port 2048, id=118, length=287
        User-Name = "Laptop\\Test_user"
        NAS-IP-Address = 192.168.201.253
        NAS-Port = 0
        Called-Station-Id = "74-EA-3A-D4-DC-BE:HOMENET-WIRELESS"
        Calling-Station-Id = "E0-2A-82-15-3C-3A"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x0202006919800000005f160301005a0100005603014e352f76a159c290e6e584a44dff55790b7a1e770c96fc5aa7a91f8346d73a46000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100
        State = 0x6e53c9f96e51d068aa05e09ea0e2213e
        Message-Authenticator = 0x7cae4c62e640d0d7e081a1e9dd3302d4
# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[ntdomain] Looking up realm "Laptop" for User-Name = "Laptop\Test_user"
[ntdomain] Found realm "DEFAULT"
[ntdomain] Adding Stripped-User-Name = "Test_user"
[ntdomain] Adding Realm = "DEFAULT"
[ntdomain] Authentication realm is LOCAL.
++[ntdomain] returns ok
[eap] EAP packet type response id 2 length 105
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
  TLS Length 95
[peap] Length Included
[peap] eaptls_verify returned 11 
[peap]     (other): before/accept initialization
[peap]     TLS_accept: before/accept initialization
[peap] <<< TLS 1.0 Handshake [length 005a], ClientHello  
[peap]     TLS_accept: SSLv3 read client hello A
[peap] >>> TLS 1.0 Handshake [length 0031], ServerHello  
[peap]     TLS_accept: SSLv3 write server hello A
[peap] >>> TLS 1.0 Handshake [length 085e], Certificate  
[peap]     TLS_accept: SSLv3 write certificate A
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone  
[peap]     TLS_accept: SSLv3 write server done A
[peap]     TLS_accept: SSLv3 flush data
[peap]     TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase 
In SSL Accept mode  
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 118 to 192.168.201.253 port 2048
        EAP-Message = 0x0103040019c0000008a216030100310200002d03014e352f865859d551753680ef22852c790050a13900075680f1d04ee83c2de9b400002f000005ff01000100160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c65204365727469666963617465204175
        EAP-Message = 0x74686f72697479301e170d3131303733313037343031345a170d3132303733303037343031345a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100db4189bb6357783d51e759843eaf93b98bab0f7c3033a09fa7e55239786c692e4e6732934fcd46baa47201d9af8ea22c455f5e7428e821
        EAP-Message = 0x29cc0e369c5de2ae4ab5d4d447b6fb03697c553afbb3be5ca1d010843e35092d5a36003bc89585fa6ade154d345e8710164006121a0ccc16bd1e005e42e6b3e4c3c9642399a0cc229cb8b187fc33b432dce074017e64f3c121d9f2fedfde11432545d87aee6269ea182e39277a133faf3bfdfa8ba7f69b7b95b15c8b8d790c82df48569671621be5f2f49143668b5db4e6ea9249c98ae499f5645a2fc72248a02d06e6e22c5c31b759b4c76c83b37f58c76bc8da707c7de926bc31149804bce278062f9fabd17d92c30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104050003820101007398
        EAP-Message = 0xc03d7cbc63c7e9ed6eb0ff0467a346e5775864459bb11e734fd7b36f507f09a33bbbbe6b06f720219dd24c2632fb0fd889104da937d80151da73e674eb3fc11e7cdaa0e5c199930e3a4c4bb56bc884459c243b4e30665905d0c4606fafb16cb03971ddc3b3a44806a21b4debb285f9fa637c67c689b2326684e48b6b7b6c6b898036d26b0b22a7c1726fc607bae5495ae323ed4bc5b063a86717e81e35e15cd83038733b6fc5920d82b6d3eb0e6f931cae06f63546904fd13b86d2522a9ea24e13301de0437cf1850572f28b6b5c9c1743b2fc2cc4bfec5a112af779e028199dd46b5827afac91dc41c642a2e276f70c8e36bffda2fa6ba56f4b3ab12a
        EAP-Message = 0x050004ab308204a73082038f
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x6e53c9f96f50d068aa05e09ea0e2213e
Finished request 19.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.201.253 port 2048, id=119, length=188
        User-Name = "Laptop\\Test_user"
        NAS-IP-Address = 192.168.201.253
        NAS-Port = 0
        Called-Station-Id = "74-EA-3A-D4-DC-BE:HOMENET-WIRELESS"
        Calling-Station-Id = "E0-2A-82-15-3C-3A"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x020300061900
        State = 0x6e53c9f96f50d068aa05e09ea0e2213e
        Message-Authenticator = 0x57d9569a488fba8c80fd5b5e2b942928
# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[ntdomain] Looking up realm "Laptop" for User-Name = "Laptop\Test_user"
[ntdomain] Found realm "DEFAULT"
[ntdomain] Adding Stripped-User-Name = "Test_user"
[ntdomain] Adding Realm = "DEFAULT"
[ntdomain] Authentication realm is LOCAL.
++[ntdomain] returns ok
[eap] EAP packet type response id 3 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 119 to 192.168.201.253 port 2048
        EAP-Message = 0x010403fc1940a003020102020900d0762dc2a1952268300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3131303733313037343031345a170d3132303733303037343031345a308193310b3009060355040613024652310f300d0603550408130652616469757331
        EAP-Message = 0x12301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a02820101009a2b6c033c4eec7e78c46c8c596104c6170fbf6891a961730601137a2603bbd2541223dad413aa8d4bea6d7bf8fc82476fe54050a52d1a2e48e76a98247765df6505152bde71d3e706950424e152123bd64b7562dba8221c7317c4268cb249d6e68a3686c6248dcf
        EAP-Message = 0xe6342728a0ec16764b7b488eec939ada786a73ae9ab4d14969850a2b3e198cbb51e9392167aa789293eedd36b48f154bfec7dfc4e35cfd7f9a9ab1d925b7e34abb9f2db6b810063c303c21f2b83af70f3b35c8400e606297937aa5cd37bea10e4d6982aa173abde4372477cce4160355deb4c287865e72f875ca65bcc34b2d233c318af627feef6cea2906d770a50afe09e192a31a750e010203010001a381fb3081f8301d0603551d0e04160414f0fc2c07840395725bbe1a3c91e8da97236fe4383081c80603551d230481c03081bd8014f0fc2c07840395725bbe1a3c91e8da97236fe438a18199a48196308193310b300906035504061302465231
        EAP-Message = 0x0f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900d0762dc2a1952268300c0603551d13040530030101ff300d06092a864886f70d010105050003820101004570473d7baac719904c41687a88509ae2d2443ef8a710b0081255009362def16b795c68ac80f417d94dfe9f89663996ed1bf7020f4f7a7e3a92670f1c4d1bd30be7f8283ee9f1a43e77ad
        EAP-Message = 0xd13a7d64d177ae03
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x6e53c9f96c57d068aa05e09ea0e2213e
Finished request 20.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.201.253 port 2048, id=120, length=188
        User-Name = "Laptop\\Test_user"
        NAS-IP-Address = 192.168.201.253
        NAS-Port = 0
        Called-Station-Id = "74-EA-3A-D4-DC-BE:HOMENET-WIRELESS"
        Calling-Station-Id = "E0-2A-82-15-3C-3A"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x020400061900
        State = 0x6e53c9f96c57d068aa05e09ea0e2213e
        Message-Authenticator = 0xca12a64f3b11f5b5402c918a958cad33
# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[ntdomain] Looking up realm "Laptop" for User-Name = "Laptop\Test_user"
[ntdomain] Found realm "DEFAULT"
[ntdomain] Adding Stripped-User-Name = "Test_user"
[ntdomain] Adding Realm = "DEFAULT"
[ntdomain] Authentication realm is LOCAL.
++[ntdomain] returns ok
[eap] EAP packet type response id 4 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 120 to 192.168.201.253 port 2048
        EAP-Message = 0x010500bc1900021eb9da13c75ae97f41dc2c5d3857e817d0285b2cac6dbb1f55e0955e0ba913a844c946e2a60df6203646d952f95bbf71f712dc3e1aeab536e376b7aa798d47fa57b15c5a4553c8597cb7fb1aaac38bf15e53a49a3563719ed3710b11ea46cf5bb59352588d94285aacb41d2dadfae893da2940cafe2ec36cf7cc504a9934909a5460242cf844be0defef1fce4b17796897f30877dee559e52fa76b95d28df787a329c603429fd18bdd24437b16030100040e000000
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x6e53c9f96d56d068aa05e09ea0e2213e
Finished request 21.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.201.253 port 2048, id=121, length=520
        User-Name = "Laptop\\Test_user"
        NAS-IP-Address = 192.168.201.253
        NAS-Port = 0
        Called-Station-Id = "74-EA-3A-D4-DC-BE:HOMENET-WIRELESS"
        Calling-Station-Id = "E0-2A-82-15-3C-3A"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x020501501980000001461603010106100001020100bbe79d557e30b4f7b4b4b3b43ac49ba891b06e8bfef17567c5ee6fd6f98f3dd209934aa1e69b555932ba7a2cde0612ebd493d031b198ce854db4d2d7debd6c2c4a771f13683adbead07f1dd5933151ac1c2ba3aa43ac54fc7f1526ccaeee163bc9048ff7612a6269a9d93a2a69556a0130b8bc23777b90520e0fbe782931a51c1257ff8d38b35d5fa358bb868634997499f2cee9a1e03ec4e3133b22aa98b6970754d0a0029790bc90fbefe4148669fe799e72b06730cd605984ed93225a863d3d8b58b1c072a662c2f57d92c678fcfaeffccfc95f6397e4d618f58ef2fba90d1592925b003bc0a2
        EAP-Message = 0x92184b2aba74b7d82b3a80b0991dc42202c4c111a52b55a31403010001011603010030f5e047d6403e8cad1b48a60e8c25fc001b500cd1e58ad9795c6f34c35c4d5892f23f454cf87d2dfedeedfd9b41c418d1
        State = 0x6e53c9f96d56d068aa05e09ea0e2213e
        Message-Authenticator = 0x56dd646fdd12b25bcaba8de672959897
# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[ntdomain] Looking up realm "Laptop" for User-Name = "Laptop\Test_user"
[ntdomain] Found realm "DEFAULT"
[ntdomain] Adding Stripped-User-Name = "Test_user"
[ntdomain] Adding Realm = "DEFAULT"
[ntdomain] Authentication realm is LOCAL.
++[ntdomain] returns ok
[eap] EAP packet type response id 5 length 253
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
  TLS Length 326
[peap] Length Included
[peap] eaptls_verify returned 11 
[peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange  
[peap]     TLS_accept: SSLv3 read client key exchange A
[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001]  
[peap] <<< TLS 1.0 Handshake [length 0010], Finished  
[peap]     TLS_accept: SSLv3 read finished A
[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001]  
[peap]     TLS_accept: SSLv3 write change cipher spec A
[peap] >>> TLS 1.0 Handshake [length 0010], Finished  
[peap]     TLS_accept: SSLv3 write finished A
[peap]     TLS_accept: SSLv3 flush data
[peap]     (other): SSL negotiation finished successfully
SSL Connection Established 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 121 to 192.168.201.253 port 2048
        EAP-Message = 0x01060041190014030100010116030100307e369d59bf56556d679558b3fcc122fba8a236ae3b568ef2fec64b73cbf515fd5cd14b0ad5d7a37ef2b2390c31b28e2a
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x6e53c9f96a55d068aa05e09ea0e2213e
Finished request 22.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.201.253 port 2048, id=122, length=188
        User-Name = "Laptop\\Test_user"
        NAS-IP-Address = 192.168.201.253
        NAS-Port = 0
        Called-Station-Id = "74-EA-3A-D4-DC-BE:HOMENET-WIRELESS"
        Calling-Station-Id = "E0-2A-82-15-3C-3A"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x020600061900
        State = 0x6e53c9f96a55d068aa05e09ea0e2213e
        Message-Authenticator = 0x798e4d1d9d23e731ce219dbe97c9768f
# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[ntdomain] Looking up realm "Laptop" for User-Name = "Laptop\Test_user"
[ntdomain] Found realm "DEFAULT"
[ntdomain] Adding Stripped-User-Name = "Test_user"
[ntdomain] Adding Realm = "DEFAULT"
[ntdomain] Authentication realm is LOCAL.
++[ntdomain] returns ok
[eap] EAP packet type response id 6 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake is finished
[peap] eaptls_verify returned 3 
[peap] eaptls_process returned 3 
[peap] EAPTLS_SUCCESS
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state TUNNEL ESTABLISHED
++[eap] returns handled
Sending Access-Challenge of id 122 to 192.168.201.253 port 2048
        EAP-Message = 0x0107002b19001703010020079eebb9a45535c2e669083f531e8ad001cf9e748ccd3d0a96a2376455b3a171
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x6e53c9f96b54d068aa05e09ea0e2213e
Finished request 23.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.201.253 port 2048, id=123, length=241
        User-Name = "Laptop\\Test_user"
        NAS-IP-Address = 192.168.201.253
        NAS-Port = 0
        Called-Station-Id = "74-EA-3A-D4-DC-BE:HOMENET-WIRELESS"
        Calling-Station-Id = "E0-2A-82-15-3C-3A"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x0207003b19001703010030db52261b870dbeb2f949048be1a5450a603505a97bd9fb2f65819343d4814a14b51788e2fd006d7cc7e6251ccd5af5ff
        State = 0x6e53c9f96b54d068aa05e09ea0e2213e
        Message-Authenticator = 0x9551f302acdc813e0bc7cf56d2cc5189
# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[ntdomain] Looking up realm "Laptop" for User-Name = "Laptop\Test_user"
[ntdomain] Found realm "DEFAULT"
[ntdomain] Adding Stripped-User-Name = "Test_user"
[ntdomain] Adding Realm = "DEFAULT"
[ntdomain] Authentication realm is LOCAL.
++[ntdomain] returns ok
[eap] EAP packet type response id 7 length 59
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state WAITING FOR INNER IDENTITY
[peap] Identity - Laptop\Test_user
[peap] Got inner identity 'Laptop\Test_user'
[peap] Setting default EAP type for tunneled EAP session.
[peap] Got tunneled request
        EAP-Message = 0x0207001a014e6174616c792d48502d626f6f6b5c4e6174616c79
server  {
  PEAP: Setting User-Name to Laptop\Test_user
Sending tunneled request
        EAP-Message = 0x0207001a014e6174616c792d48502d626f6f6b5c4e6174616c79
        FreeRADIUS-Proxied-To = 127.0.0.1
        User-Name = "Laptop\\Test_user"
server inner-tunnel {
# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "Laptop\Test_user", looking up realm NULL
[suffix] Found realm "DEFAULT"
[suffix] Adding Stripped-User-Name = "Laptop\Test_user"
[suffix] Adding Realm = "DEFAULT"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
++[control] returns ok
[eap] EAP packet type response id 7 length 26
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
        EAP-Message = 0x0108002f1a0108002a105c8321b5a83aa566597c5bc136b9139d4e6174616c792d48502d626f6f6b5c4e6174616c79
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x10ec93b310e4897c5552860ed7f04456
[peap] Got tunneled reply RADIUS code 11
        EAP-Message = 0x0108002f1a0108002a105c8321b5a83aa566597c5bc136b9139d4e6174616c792d48502d626f6f6b5c4e6174616c79
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x10ec93b310e4897c5552860ed7f04456
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 123 to 192.168.201.253 port 2048
        EAP-Message = 0x0108004b1900170301004047830f6a71b9ef9f80aa10d5b23c3398b8bd26b087a0e6c00caa8d6b1ac7a9da583c98ee24cf0022b2392a01ccdc9648311295ad93cfd13e895164894d1cd983
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x6e53c9f9685bd068aa05e09ea0e2213e
Finished request 24.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.201.253 port 2048, id=124, length=289
        User-Name = "Laptop\\Test_user"
        NAS-IP-Address = 192.168.201.253
        NAS-Port = 0
        Called-Station-Id = "74-EA-3A-D4-DC-BE:HOMENET-WIRELESS"
        Calling-Station-Id = "E0-2A-82-15-3C-3A"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x0208006b19001703010060f74b5b0637ba6fb327c562b9ab29061edb4e63e0d56124f642c4f4749518eadd3d254a20b77daefb506729b0c88a3cc6ffad802475d3914e4f7bc47fa293996b6a14256164986e6cbe808f6ffac90ffb737b02b9f275d6875af509599a7c1d4d
        State = 0x6e53c9f9685bd068aa05e09ea0e2213e
        Message-Authenticator = 0x44c52e86951bc2d2bb1fcb32728edd4a
# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[ntdomain] Looking up realm "Laptop" for User-Name = "Laptop\Test_user"
[ntdomain] Found realm "DEFAULT"
[ntdomain] Adding Stripped-User-Name = "Test_user"
[ntdomain] Adding Realm = "DEFAULT"
[ntdomain] Authentication realm is LOCAL.
++[ntdomain] returns ok
[eap] EAP packet type response id 8 length 107
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type mschapv2
[peap] Got tunneled request
        EAP-Message = 0x020800411a0208003c31694506801694da62c83cf6398159f4bb0000000000000000249b20ae475dae6162779c359e8dd7738c1d942a80e8ba9a004e6174616c79
server  {
  PEAP: Setting User-Name to Laptop\Test_user
Sending tunneled request
        EAP-Message = 0x020800411a0208003c31694506801694da62c83cf6398159f4bb0000000000000000249b20ae475dae6162779c359e8dd7738c1d942a80e8ba9a004e6174616c79
        FreeRADIUS-Proxied-To = 127.0.0.1
        User-Name = "Laptop\\Test_user"
        State = 0x10ec93b310e4897c5552860ed7f04456
server inner-tunnel {
# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "Laptop\Test_user", looking up realm NULL
[suffix] Found realm "DEFAULT"
[suffix] Adding Stripped-User-Name = "Laptop\Test_user"
[suffix] Adding Realm = "DEFAULT"
[suffix] Authentication realm is LOCAL.
++[suffix] returns ok
++[control] returns ok
[eap] EAP packet type response id 8 length 65
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
[mschapv2] +- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured.  Cannot create LM-Password.
[mschap] No Cleartext-Password configured.  Cannot create NT-Password.
[mschap] ERROR: User-Name (Laptop\Test_user) is not the same as MS-CHAP Name (Test_user) from EAP-MSCHAPv2
++[mschap] returns reject
[eap] Freeing handler
++[eap] returns reject
Failed to authenticate the user.
} # server inner-tunnel
[peap] Got tunneled reply code 3
        EAP-Message = 0x04080004
        Message-Authenticator = 0x00000000000000000000000000000000
[peap] Got tunneled reply RADIUS code 3
        EAP-Message = 0x04080004
        Message-Authenticator = 0x00000000000000000000000000000000
[peap] Tunneled authentication was rejected.
[peap] FAILURE
++[eap] returns handled
Sending Access-Challenge of id 124 to 192.168.201.253 port 2048
        EAP-Message = 0x0109002b19001703010020d2be1e910b2a8a64aaa919b636028e230da8fc2420673151203ddd69a01b180d
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x6e53c9f9695ad068aa05e09ea0e2213e
Finished request 25.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.201.253 port 2048, id=125, length=225
        User-Name = "Laptop\\Test_user"
        NAS-IP-Address = 192.168.201.253
        NAS-Port = 0
        Called-Station-Id = "74-EA-3A-D4-DC-BE:HOMENET-WIRELESS"
        Calling-Station-Id = "E0-2A-82-15-3C-3A"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x0209002b19001703010020b46cf86af1da4057785b33d9e07357b3aba1577d38fabb56b4ce3842d03da861
        State = 0x6e53c9f9695ad068aa05e09ea0e2213e
        Message-Authenticator = 0x8a327c3f964153ab9824041f881132ce
# Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[ntdomain] Looking up realm "Laptop" for User-Name = "Laptop\Test_user"
[ntdomain] Found realm "DEFAULT"
[ntdomain] Adding Stripped-User-Name = "Test_user"
[ntdomain] Adding Realm = "DEFAULT"
[ntdomain] Authentication realm is LOCAL.
++[ntdomain] returns ok
[eap] EAP packet type response id 9 length 43
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /usr/local/etc/raddb/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state send tlv failure
[peap] Received EAP-TLV response.
[peap]  The users session was previously rejected: returning reject (again.)
[peap]  *** This means you need to read the PREVIOUS messages in the debug output
[peap]  *** to find out the reason why the user was rejected.
[peap]  *** Look for "reject" or "fail".  Those earlier messages will tell you.
[peap]  *** what went wrong, and how to fix the problem.
[eap] Handler failed in EAP/peap
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
Using Post-Auth-Type Reject
# Executing group from file /usr/local/etc/raddb/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject]     expand: %{User-Name} -> Laptop\Test_user
 attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 26 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 26
Sending Access-Reject of id 125 to 192.168.201.253 port 2048
        EAP-Message = 0x04090004
        Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.9 seconds.
Cleaning up request 18 ID 117 with timestamp +284
Cleaning up request 19 ID 118 with timestamp +284
Cleaning up request 20 ID 119 with timestamp +284
Cleaning up request 21 ID 120 with timestamp +284
Cleaning up request 22 ID 121 with timestamp +284
Cleaning up request 23 ID 122 with timestamp +284
Cleaning up request 24 ID 123 with timestamp +284
Cleaning up request 25 ID 124 with timestamp +284
Waking up in 0.9 seconds.
Cleaning up request 26 ID 125 with timestamp +284
Ready to process requests.

Как исправить следующее:

[mschap] No Cleartext-Password configured. Cannot create LM-Password.
[mschap] No Cleartext-Password configured. Cannot create NT-Password.
[mschap] ERROR: User-Name (Laptop\Test_user) is not the same as MS-CHAP Name (Test_user) from EAP-MSCHAPv2
++[mschap] returns reject

Что посоветуйте?

[VN8]

Вопрос снимается. Разобрался сам. Вроде работает.

[bbk]

Настроил связку Freeradius2 + EAP-TLS + WPA2 + WindowsXP по вашей статье. С Windows XP всё без проблем работает.
Но к сожалению никак не получается сделать всё тоже самое для Windows7.
Дайте пожалуйста подробную инструкцию, если кто может, по настройке Windows7 под этуже связку.

[bbk]

Настроил связку Freeradius2 + EAP-TLS + WPA2 + WindowsXP по вашей статье. С Windows XP всё без проблем работает.
Но к сожалению никак не получается сделать всё тоже самое для Windows7.
Дайте пожалуйста подробную инструкцию, если кто может, по настройке Windows7 под этуже связку.

Скрины по настройке Win 7 для связки Freeradius2 + EAP-TLS + WPA2 + Windows7
Решение во вложении

[InventoR]

Пишу сюда, чтобы не начинать новый топик.
Настраиваю пока легкую связку для точек доступа к freeradius.
Использую как вижу: eap-peap mschapv2
Лог соединенния прилагается

Код: Выделить всё

Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
Listening on proxy address * port 1814
Ready to process requests.



rad_recv: Access-Request packet from host 192.168.10.20 port 2048, id=2, length=171
        User-Name = "anonymous@myisp.com"
        NAS-Port = 0
        Called-Station-Id = "00-27-22-1E-BB-06:testnet"
        Calling-Station-Id = "00-27-22-42-A6-71"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x02ff001801616e6f6e796d6f7573406d796973702e636f6d
        Message-Authenticator = 0x54ad047e5a74d2e55e10d3a71a1d0f24
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] Looking up realm "myisp.com" for User-Name = "anonymous@myisp.com"
[suffix] No such realm "myisp.com"
++[suffix] returns noop
[eap] EAP packet type response id 255 length 24
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.  Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 2 to 192.168.10.20 port 2048
        EAP-Message = 0x010000061920
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x8ca7a10c8ca7b8395344abc968755e37
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.10.20 port 2048, id=3, length=231
        User-Name = "anonymous@myisp.com"
        NAS-Port = 0
        Called-Station-Id = "00-27-22-1E-BB-06:testnet"
        Calling-Station-Id = "00-27-22-42-A6-71"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x0200004219800000003816030100330100002f03014e2ea8eb56e659f991dd5e25b6fdaf4a718d8d4cba998cd1d27c09ecd23bc01e000008002f000a000500040100
        State = 0x8ca7a10c8ca7b8395344abc968755e37
        Message-Authenticator = 0x338afe1129a27028d270708106e90ccb
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] Looking up realm "myisp.com" for User-Name = "anonymous@myisp.com"
[suffix] No such realm "myisp.com"
++[suffix] returns noop
[eap] EAP packet type response id 0 length 66
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
  TLS Length 56
[peap] Length Included
[peap] eaptls_verify returned 11
[peap]     (other): before/accept initialization
[peap]     TLS_accept: before/accept initialization
[peap] <<< TLS 1.0 Handshake [length 0033], ClientHello
[peap]     TLS_accept: SSLv3 read client hello A
[peap] >>> TLS 1.0 Handshake [length 002a], ServerHello
[peap]     TLS_accept: SSLv3 write server hello A
[peap] >>> TLS 1.0 Handshake [length 02cc], Certificate
[peap]     TLS_accept: SSLv3 write certificate A
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
[peap]     TLS_accept: SSLv3 write server done A
[peap]     TLS_accept: SSLv3 flush data
[peap]     TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 3 to 192.168.10.20 port 2048
        EAP-Message = 0x0101030f1900160301002a0200002603014e59d2e41600b8a21f8d565834ba60a1362be53132253fb44f6410c799ea027b00002f0016030102cc0b0002c80002c50002c2308202be308201a6020900f1a6f1fe6befbd1b300d06092a864886f70d01010505003021311f301d0603550403131667772e696e76656e746f72732e6d796674702e6f7267301e170d3131303630353136303334365a170d3231303630323136303334365a3021311f301d0603550403131667772e696e76656e746f72732e6d796674702e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100f878c2ca99a10210e0ac035ee8541865
        EAP-Message = 0x11d413cbde04e6a10371834d02eb63ca05e0ae0fd30ceb788822aec1efbcda1f24f1398839da1530d8c74dda62b65215a7b009e4f01680540047514239d0e389f45d7c064de1d9c7babd3d84a5edc4eea97a0fbfdf375347fc0e0edd15c70af8e4a73e48a9d9f77877e876095f5b8a5c674fc102c876c932d4739942708f21e3aa0abc0f9ceee16083a1c75915041b9d16b34d2fea3b9035455b2f3a223a2124ebd58abd5358ae4d1a9c055a62f584a147860c9eaed339544222b478eee089ea9413952204298a871c0d18e5d14586bb41a8dd44995eb6229af771a2a75e3126e79c166a0b9dad05266fec50b294e1610203010001300d06092a864886
        EAP-Message = 0xf70d01010505000382010100302c5f469856c51344802a312cbf3d795df1e90d2d5263a48be1d53d8b80cdb654bfc6db2ddad737a46b792f1cfa106012bbb9e22da68fcd39d0fa46dda555f19732f085b686376e3b5b0b235c67529ba1e484f6aed2d656dc3945518aeaed62d5fa69c79a0fa55c6d484fff92369c259f739188b3f81f90fc0fc6fe15ecbc0f8b5d90d991f787a9ad41417c78046e091d72c41a1c907537497dd1e1de8351c34343143f5511571133b3f11770b3380b879a3f32c2fefd93458e8e1902971578942455e822118020ada425ba5a2bb4412b887288db9694eafb8c48e7a0cf5f0c489a2ef6e06780aefee5c0a9ce02ae37de
        EAP-Message = 0x9cd2d3496e8ae4dfcad1a60e63451616030100040e000000
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x8ca7a10c8da6b8395344abc968755e37
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.10.20 port 2048, id=4, length=503
        User-Name = "anonymous@myisp.com"
        NAS-Port = 0
        Called-Station-Id = "00-27-22-1E-BB-06:testnet"
        Calling-Station-Id = "00-27-22-42-A6-71"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x02010150198000000146160301010610000102010046ed4f1840aa861fa88c9cd54494a5fba92722275ce77ede9202da3a0a233594da8582aab25a211fbd028faccdf2e870e95e52475f1b6a5cbb819593a6bae5d723df06ef7b58cdb30d4b257add990aa7fa1caf0c1dbd7adb9b9f0fb41b681e8dc6c5bd49ed6bc3158a0d8f70fae76a8bf1e127d0c750a7354bc73826c97f98e1b861c26eefb2105cb7bc2459666d3d2e1274e90b0d37f2a6afff7ec5361f49bc7815cab5f89c12bf55e3262a1ceea877fbebf7e154ca61513349cc4617ce61ccd925ae2f4bbb00164c7cc77808d44b77863620739eecc6022a33e7b01baf826bc52e4d38af67b4f8
        EAP-Message = 0xaacbf67b13c741384ec9c3a5473411f42ba81da0625dc5f1140301000101160301003004d591e202410b3fdc5094a7b67c518d5b4177ccc8b2025eee16892ac898fc65be4e9d6c4a7592f2b43c719cdf83e06f
        State = 0x8ca7a10c8da6b8395344abc968755e37
        Message-Authenticator = 0xc842f2885b1d00512af1a28d1483ac1b
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] Looking up realm "myisp.com" for User-Name = "anonymous@myisp.com"
[suffix] No such realm "myisp.com"
++[suffix] returns noop
[eap] EAP packet type response id 1 length 253
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
  TLS Length 326
[peap] Length Included
[peap] eaptls_verify returned 11
[peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange
[peap]     TLS_accept: SSLv3 read client key exchange A
[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001]
[peap] <<< TLS 1.0 Handshake [length 0010], Finished
[peap]     TLS_accept: SSLv3 read finished A
[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001]
[peap]     TLS_accept: SSLv3 write change cipher spec A
[peap] >>> TLS 1.0 Handshake [length 0010], Finished
[peap]     TLS_accept: SSLv3 write finished A
[peap]     TLS_accept: SSLv3 flush data
[peap]     (other): SSL negotiation finished successfully
SSL Connection Established
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 4 to 192.168.10.20 port 2048
        EAP-Message = 0x0102004119001403010001011603010030c93b9d09bd05179639fec99498785db77ff885a4ad8dad78276383f957649913821748bda95d1a4f435744c0c218288f
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x8ca7a10c8ea5b8395344abc968755e37
Finished request 2.
Going to the next request
Waking up in 4.7 seconds.
rad_recv: Access-Request packet from host 192.168.10.20 port 2048, id=5, length=171
        User-Name = "anonymous@myisp.com"
        NAS-Port = 0
        Called-Station-Id = "00-27-22-1E-BB-06:testnet"
        Calling-Station-Id = "00-27-22-42-A6-71"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x020200061900
        State = 0x8ca7a10c8ea5b8395344abc968755e37
        Message-Authenticator = 0x3b54953e0f1251888be6a629317c0138
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] Looking up realm "myisp.com" for User-Name = "anonymous@myisp.com"
[suffix] No such realm "myisp.com"
++[suffix] returns noop
[eap] EAP packet type response id 2 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake is finished
[peap] eaptls_verify returned 3
[peap] eaptls_process returned 3
[peap] EAPTLS_SUCCESS
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state TUNNEL ESTABLISHED
++[eap] returns handled
Sending Access-Challenge of id 5 to 192.168.10.20 port 2048
        EAP-Message = 0x0103002b190017030100204e1bc0166613bb6483b4d26c1ccfb6473701fd31672b8cbbb6f500290df026e7
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x8ca7a10c8fa4b8395344abc968755e37
Finished request 3.
Going to the next request
Waking up in 4.7 seconds.
rad_recv: Access-Request packet from host 192.168.10.20 port 2048, id=6, length=208
        User-Name = "anonymous@myisp.com"
        NAS-Port = 0
        Called-Station-Id = "00-27-22-1E-BB-06:testnet"
        Calling-Station-Id = "00-27-22-42-A6-71"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x0203002b19001703010020fc500dfcf7be1935461aed71da5e1d3202685774473b9a959f68de1920626704
        State = 0x8ca7a10c8fa4b8395344abc968755e37
        Message-Authenticator = 0x877d09c2de47833cb3261f745718812f
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] Looking up realm "myisp.com" for User-Name = "anonymous@myisp.com"
[suffix] No such realm "myisp.com"
++[suffix] returns noop
[eap] EAP packet type response id 3 length 43
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state WAITING FOR INNER IDENTITY
[peap] Identity - user1
[peap] Got inner identity 'user1'
[peap] Setting default EAP type for tunneled EAP session.
[peap] Got tunneled request
        EAP-Message = 0x0203000a017573657231
server  {
  PEAP: Setting User-Name to user1
Sending tunneled request
        EAP-Message = 0x0203000a017573657231
        FreeRADIUS-Proxied-To = 127.0.0.1
        User-Name = "user1"
server inner-tunnel {
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "user1", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 3 length 10
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[files] users: Matched entry user1 at line 206
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING: Auth-Type already set.  Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
        EAP-Message = 0x0104001f1a0104001a102f8e0164e73883a0776d8bdf5f1e8b017573657231
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x327d016932791b124a6348fdf6393dc0
[peap] Got tunneled reply RADIUS code 11
        EAP-Message = 0x0104001f1a0104001a102f8e0164e73883a0776d8bdf5f1e8b017573657231
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x327d016932791b124a6348fdf6393dc0
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 6 to 192.168.10.20 port 2048
        EAP-Message = 0x0104003b19001703010030a5adcefd70a8cde5dc9c317524fa99bfc967573523ea9be23d50e3d4f682e35ac099db972bb1a195f6a19437283040e4
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x8ca7a10c88a3b8395344abc968755e37
Finished request 4.
Going to the next request
Waking up in 4.7 seconds.
rad_recv: Access-Request packet from host 192.168.10.20 port 2048, id=7, length=272
        User-Name = "anonymous@myisp.com"
        NAS-Port = 0
        Called-Station-Id = "00-27-22-1E-BB-06:testnet"
        Calling-Station-Id = "00-27-22-42-A6-71"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x0204006b19001703010060699d09d3ba169fc120b6e729d73d23e7139e73ebeedd322cb243ae003cdad87899eae3ca922f7b92f001e885838ea1367a6ac1df1df7632d29e46f2b51b52f18b5c046f287f4a86f41394f327ed2ceb19e6dfa2186966f3314320f79bb96c149
        State = 0x8ca7a10c88a3b8395344abc968755e37
        Message-Authenticator = 0x4f89d6dbb1726b98604190aaed0d3e48
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] Looking up realm "myisp.com" for User-Name = "anonymous@myisp.com"
[suffix] No such realm "myisp.com"
++[suffix] returns noop
[eap] EAP packet type response id 4 length 107
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type mschapv2
[peap] Got tunneled request
        EAP-Message = 0x020400401a0204003b31da6a82d2d82e699e52df91351b5a48a40000000000000000dd9333f3273b7db2e4736d8c5d1dad6005eb671ef9b6b02c007573657231
server  {
  PEAP: Setting User-Name to user1
Sending tunneled request
        EAP-Message = 0x020400401a0204003b31da6a82d2d82e699e52df91351b5a48a40000000000000000dd9333f3273b7db2e4736d8c5d1dad6005eb671ef9b6b02c007573657231
        FreeRADIUS-Proxied-To = 127.0.0.1
        User-Name = "user1"
        State = 0x327d016932791b124a6348fdf6393dc0
server inner-tunnel {
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "user1", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 4 length 64
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[files] users: Matched entry user1 at line 206
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING: Auth-Type already set.  Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
[mschapv2] +- entering group MS-CHAP {...}
[mschap] Creating challenge hash with username: user1
[mschap] Told to do MS-CHAPv2 for user1 with NT-Password
[mschap] adding MS-CHAPv2 MPPE keys
++[mschap] returns ok
MSCHAP Success
++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
        EAP-Message = 0x010500331a0304002e533d32374435443431453030374139453442414444374137344639393436304534394637433437453243
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x327d016933781b124a6348fdf6393dc0
[peap] Got tunneled reply RADIUS code 11
        EAP-Message = 0x010500331a0304002e533d32374435443431453030374139453442414444374137344639393436304534394637433437453243
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x327d016933781b124a6348fdf6393dc0
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 7 to 192.168.10.20 port 2048
        EAP-Message = 0x0105005b190017030100508f9562adfc2e5b57b4738c77cebf6d733de315c8b83cd0a24e3d06ad733f3b1760518bbfac70d6401329a7f82d46ffa72763eb98e514ed4c1e9a7e843e00c93ed193334847bc3943b10c6073fdff21fe
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x8ca7a10c89a2b8395344abc968755e37
Finished request 5.
Going to the next request
Waking up in 4.7 seconds.
rad_recv: Access-Request packet from host 192.168.10.20 port 2048, id=8, length=208
        User-Name = "anonymous@myisp.com"
        NAS-Port = 0
        Called-Station-Id = "00-27-22-1E-BB-06:testnet"
        Calling-Station-Id = "00-27-22-42-A6-71"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x0205002b19001703010020e67e5e5c0438a0343f54c29dffa3c7fa3313ff7296cd2320dc1942d7a1c194a2
        State = 0x8ca7a10c89a2b8395344abc968755e37
        Message-Authenticator = 0x3e8c0e69a4837794f5552820194d1ce5
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] Looking up realm "myisp.com" for User-Name = "anonymous@myisp.com"
[suffix] No such realm "myisp.com"
++[suffix] returns noop
[eap] EAP packet type response id 5 length 43
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type mschapv2
[peap] Got tunneled request
        EAP-Message = 0x020500061a03
server  {
  PEAP: Setting User-Name to user1
Sending tunneled request
        EAP-Message = 0x020500061a03
        FreeRADIUS-Proxied-To = 127.0.0.1
        User-Name = "user1"
        State = 0x327d016933781b124a6348fdf6393dc0
server inner-tunnel {
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "user1", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 5 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[files] users: Matched entry user1 at line 206
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING: Auth-Type already set.  Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[eap] Freeing handler
++[eap] returns ok
  WARNING: Empty post-auth section.  Using default return values.
# Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel
} # server inner-tunnel
[peap] Got tunneled reply code 2
        MS-MPPE-Encryption-Policy = 0x00000001
        MS-MPPE-Encryption-Types = 0x00000006
        MS-MPPE-Send-Key = 0x1bf3ea8704c20fa5550c878f750c8799
        MS-MPPE-Recv-Key = 0x7923d10e918076de6691b42751a157c4
        EAP-Message = 0x03050004
        Message-Authenticator = 0x00000000000000000000000000000000
        User-Name = "user1"
[peap] Got tunneled reply RADIUS code 2
        MS-MPPE-Encryption-Policy = 0x00000001
        MS-MPPE-Encryption-Types = 0x00000006
        MS-MPPE-Send-Key = 0x1bf3ea8704c20fa5550c878f750c8799
        MS-MPPE-Recv-Key = 0x7923d10e918076de6691b42751a157c4
        EAP-Message = 0x03050004
        Message-Authenticator = 0x00000000000000000000000000000000
        User-Name = "user1"
[peap] Tunneled authentication was successful.
[peap] SUCCESS
++[eap] returns handled
Sending Access-Challenge of id 8 to 192.168.10.20 port 2048
        EAP-Message = 0x0106002b19001703010020a8b70af41f36e6c729141f2ff3d1d3ab2acf4e3a5a8962fc478f5162e6dc33e6
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x8ca7a10c8aa1b8395344abc968755e37
Finished request 6.
Going to the next request
Waking up in 4.7 seconds.
rad_recv: Access-Request packet from host 192.168.10.20 port 2048, id=9, length=208
        User-Name = "anonymous@myisp.com"
        NAS-Port = 0
        Called-Station-Id = "00-27-22-1E-BB-06:testnet"
        Calling-Station-Id = "00-27-22-42-A6-71"
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        Connect-Info = "CONNECT 0Mbps 802.11"
        EAP-Message = 0x0206002b19001703010020cdbc56107b1033c0e27c8a75ec602262ae8b33a8ccd5ae172324e66ba8018b6b
        State = 0x8ca7a10c8aa1b8395344abc968755e37
        Message-Authenticator = 0xa39d124835cf0f9a6c7a75f4f4d878f9
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] Looking up realm "myisp.com" for User-Name = "anonymous@myisp.com"
[suffix] No such realm "myisp.com"
++[suffix] returns noop
[eap] EAP packet type response id 6 length 43
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state send tlv success
[peap] Received EAP-TLV response.
[peap] Success
[eap] Freeing handler
++[eap] returns ok
# Executing section post-auth from file /etc/freeradius/sites-enabled/default
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 9 to 192.168.10.20 port 2048
        MS-MPPE-Recv-Key = 0x681ec932a747d80fa6e00fbf0fa983a962f7fc5d4530a325e53425c87acbeb9a
        MS-MPPE-Send-Key = 0x57aabf05fad823769c20d33b5a0335b691eb9277a74b62f501df0447cebca6b5
        EAP-Message = 0x03060004
        Message-Authenticator = 0x00000000000000000000000000000000
        User-Name = "anonymous@myisp.com"
Finished request 7.
Going to the next request
Waking up in 4.7 seconds.



Cleaning up request 0 ID 2 with timestamp +23
Cleaning up request 1 ID 3 with timestamp +23
Waking up in 0.1 seconds.
Cleaning up request 2 ID 4 with timestamp +24
Cleaning up request 3 ID 5 with timestamp +24
Cleaning up request 4 ID 6 with timestamp +24
Cleaning up request 5 ID 7 with timestamp +24
Cleaning up request 6 ID 8 with timestamp +24
Cleaning up request 7 ID 9 with timestamp +24
Ready to process requests.

хочется узнать что можно узнать из этого лога и есть ли в обще более менее вменяемая русская документация к radius?

[Гость]

суть проблемы в чем? или просто хочется что то почитать? почитайте книгу о вкусной и здоровой еде

[Picasso]

Всем привет! Есть небольшая проблемка, но она мне как заноза в заднице. Настроил FreeRadius2+LDAP для WPA2 enterprise (EAP PEAP MS-CHAP-v2), все работает, но почему-то все клиенты переподключаются раз в 10 минут, причем любые, хоть этот устройство на андроиде, хоть Мак, хоть Винда. Сессия длится ровно 10 минут, потом обрубается и клиент пытается заново переподключиться. Некоторые пользователи этого не замечают, а вот у некоторых наблюдаются проблемы, когда не получается переподключиться с первого раза по какой-либо причине, приходится делать это руками. Куда копать?

[snorlov]

Точка доступа у вас железная или нет, а вообще-то это похоже на смену временных ключей, посмотрите, там где нибудь в параметрах есть число 600

[Picasso]

Точка доступа у вас железная или нет, а вообще-то это похоже на смену временных ключей, посмотрите, там где нибудь в параметрах есть число 600

Точка железная Unifi. Вы имеете ввиду посмотреть в параметрах на точке или в радиусе?

[snorlov]

В параметрах точки...

[Picasso]

Проблему решил. Написал на официальном форуме ubnt об этой проблеме, мне ответили что это баг прошивки, который пофиксили в версии контроллера 2.1.0. Если кому-то пригодится, его можно скачать здесь: http://ubnt.com/forum/showthread.php?t=38842

[buryanov]

А я вот воюю, не могу понять долго, где кошка зарыта, ситуация следующая:
Есть Hotspot, который делался по этой статье + другая, в котором в конфиге прописаны следующие стороки:

Код: Выделить всё

#own_ip_addr=127.0.0.1
own_ip_addr=10.4.250.4

auth_server_addr=10.4.250.3
#auth_server_addr=127.0.0.1
auth_server_port=1812
auth_server_shared_secret=qwerty

не хочет обращатся мой hotspot нивкакую к радиус серверу, смотрел tcpdump на всех интерфейсах. Если делать с идентификацией по паролю - то работает на ура
В логе при этом я вижу

Код: Выделить всё

Sep  9 14:27:01 aaaqs hostapd: wlan0: STA 00:1e:65:db:7b:26 IEEE 802.11: associated
Sep  9 14:27:01 aaaqs hostapd: wlan0: STA 00:1e:65:db:7b:26 WPA: event 1 notification
Sep  9 14:27:01 aaaqs hostapd: wlan0: STA 00:1e:65:db:7b:26 IEEE 802.1X: start authentication
Sep  9 14:27:01 aaaqs hostapd: wlan0: STA 00:1e:65:db:7b:26 WPA: start authentication
Sep  9 14:27:01 aaaqs hostapd: wlan0: STA 00:1e:65:db:7b:26 IEEE 802.1X: unauthorizing port
Sep  9 14:27:01 aaaqs hostapd: wlan0: STA 00:1e:65:db:7b:26 IEEE 802.1X: received EAPOL-Start from STA
Sep  9 14:27:01 aaaqs hostapd: wlan0: STA 00:1e:65:db:7b:26 WPA: event 5 notification
Sep  9 14:27:06 aaaqs hostapd: wlan0: STA 00:1e:65:db:7b:26 IEEE 802.1X: received EAPOL-Start from STA
Sep  9 14:27:06 aaaqs hostapd: wlan0: STA 00:1e:65:db:7b:26 WPA: event 5 notification
Sep  9 14:27:11 aaaqs hostapd: wlan0: STA 00:1e:65:db:7b:26 IEEE 802.1X: received EAPOL-Start from STA
Sep  9 14:27:11 aaaqs hostapd: wlan0: STA 00:1e:65:db:7b:26 WPA: event 5 notification
Sep  9 14:27:16 aaaqs hostapd: wlan0: STA 00:1e:65:db:7b:26 IEEE 802.11: deassociated
Sep  9 14:27:16 aaaqs hostapd: wlan0: STA 00:1e:65:db:7b:26 WPA: event 2 notification

[buryanov]

решается следующим образом

Код: Выделить всё

$ cat /etc/src.conf 
HOSTAPD_CFLAGS+=-DEAP_SERVER -DEAP_GTC -DEAP_AKA -DEAP_SIM -DEAP_GPSK 
HOSTAPD_CFLAGS+=-DEAP_PAX -DEAP_SAKE 
WITH_OPENSSL=YES 

and 

cd /usr/src/usr.sbin/wpa 
make clean all 
make install

[schizoid]

плин,а у меня вот эта хрень вылетает в логах

Код: Выделить всё

WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
WARNING: !! EAP session for state 0xd2cb1bc0d2c91613 did not finish!
WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility
WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

по ссылке сходил, но чета так и не догнал как победить...

[Гость]

а что не понятно то? по ссылке на инглыше все описано

[schizoid]

так а что там написано то, что все претензии к мелкософту? а как решить жеж не написано.
кстати на андроиде таже фигня

[Гость]

http://wiki.freeradius.org/Certificate_Compatibility
переведи дословно каждое слово и предложения
о том что претензии мелкософту там ни слова нет

[schizoid]

пасиб, попробую еще раз внимательнее прочитать...
наверна просто где-то туплю